1 // SPDX-License-Identifier: GPL-2.0-only 2 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 3 #include <linux/types.h> 4 #include <linux/module.h> 5 #include <net/ip.h> 6 #include <linux/ipv6.h> 7 #include <net/ipv6.h> 8 #include <net/tcp.h> 9 #include <net/udp.h> 10 #include <linux/netfilter/x_tables.h> 11 #include <linux/netfilter/xt_tcpudp.h> 12 #include <linux/netfilter_ipv4/ip_tables.h> 13 #include <linux/netfilter_ipv6/ip6_tables.h> 14 15 MODULE_DESCRIPTION("Xtables: TCP, UDP and UDP-Lite match"); 16 MODULE_LICENSE("GPL"); 17 MODULE_ALIAS("xt_tcp"); 18 MODULE_ALIAS("xt_udp"); 19 MODULE_ALIAS("ipt_udp"); 20 MODULE_ALIAS("ipt_tcp"); 21 MODULE_ALIAS("ip6t_udp"); 22 MODULE_ALIAS("ip6t_tcp"); 23 24 /* Returns 1 if the port is matched by the range, 0 otherwise */ 25 static inline bool 26 port_match(u_int16_t min, u_int16_t max, u_int16_t port, bool invert) 27 { 28 return (port >= min && port <= max) ^ invert; 29 } 30 31 static bool 32 tcp_find_option(u_int8_t option, 33 const struct sk_buff *skb, 34 unsigned int protoff, 35 unsigned int optlen, 36 bool invert, 37 bool *hotdrop) 38 { 39 /* tcp.doff is only 4 bits, ie. max 15 * 4 bytes */ 40 const u_int8_t *op; 41 u_int8_t _opt[60 - sizeof(struct tcphdr)]; 42 unsigned int i; 43 44 pr_debug("finding option\n"); 45 46 if (!optlen) 47 return invert; 48 49 /* If we don't have the whole header, drop packet. */ 50 op = skb_header_pointer(skb, protoff + sizeof(struct tcphdr), 51 optlen, _opt); 52 if (op == NULL) { 53 *hotdrop = true; 54 return false; 55 } 56 57 for (i = 0; i < optlen; ) { 58 if (op[i] == option) return !invert; 59 if (op[i] < 2) i++; 60 else i += op[i+1]?:1; 61 } 62 63 return invert; 64 } 65 66 static bool tcp_mt(const struct sk_buff *skb, struct xt_action_param *par) 67 { 68 const struct tcphdr *th; 69 struct tcphdr _tcph; 70 const struct xt_tcp *tcpinfo = par->matchinfo; 71 72 if (par->fragoff != 0) { 73 /* To quote Alan: 74 75 Don't allow a fragment of TCP 8 bytes in. Nobody normal 76 causes this. Its a cracker trying to break in by doing a 77 flag overwrite to pass the direction checks. 78 */ 79 if (par->fragoff == 1) { 80 pr_debug("Dropping evil TCP offset=1 frag.\n"); 81 par->hotdrop = true; 82 } 83 /* Must not be a fragment. */ 84 return false; 85 } 86 87 th = skb_header_pointer(skb, par->thoff, sizeof(_tcph), &_tcph); 88 if (th == NULL) { 89 /* We've been asked to examine this packet, and we 90 can't. Hence, no choice but to drop. */ 91 pr_debug("Dropping evil TCP offset=0 tinygram.\n"); 92 par->hotdrop = true; 93 return false; 94 } 95 96 if (!port_match(tcpinfo->spts[0], tcpinfo->spts[1], 97 ntohs(th->source), 98 !!(tcpinfo->invflags & XT_TCP_INV_SRCPT))) 99 return false; 100 if (!port_match(tcpinfo->dpts[0], tcpinfo->dpts[1], 101 ntohs(th->dest), 102 !!(tcpinfo->invflags & XT_TCP_INV_DSTPT))) 103 return false; 104 if (!NF_INVF(tcpinfo, XT_TCP_INV_FLAGS, 105 (((unsigned char *)th)[13] & tcpinfo->flg_mask) == tcpinfo->flg_cmp)) 106 return false; 107 if (tcpinfo->option) { 108 if (th->doff * 4 < sizeof(_tcph)) { 109 par->hotdrop = true; 110 return false; 111 } 112 if (!tcp_find_option(tcpinfo->option, skb, par->thoff, 113 th->doff*4 - sizeof(_tcph), 114 tcpinfo->invflags & XT_TCP_INV_OPTION, 115 &par->hotdrop)) 116 return false; 117 } 118 return true; 119 } 120 121 static int tcp_mt_check(const struct xt_mtchk_param *par) 122 { 123 const struct xt_tcp *tcpinfo = par->matchinfo; 124 125 /* Must specify no unknown invflags */ 126 return (tcpinfo->invflags & ~XT_TCP_INV_MASK) ? -EINVAL : 0; 127 } 128 129 static bool udp_mt(const struct sk_buff *skb, struct xt_action_param *par) 130 { 131 const struct udphdr *uh; 132 struct udphdr _udph; 133 const struct xt_udp *udpinfo = par->matchinfo; 134 135 /* Must not be a fragment. */ 136 if (par->fragoff != 0) 137 return false; 138 139 uh = skb_header_pointer(skb, par->thoff, sizeof(_udph), &_udph); 140 if (uh == NULL) { 141 /* We've been asked to examine this packet, and we 142 can't. Hence, no choice but to drop. */ 143 pr_debug("Dropping evil UDP tinygram.\n"); 144 par->hotdrop = true; 145 return false; 146 } 147 148 return port_match(udpinfo->spts[0], udpinfo->spts[1], 149 ntohs(uh->source), 150 !!(udpinfo->invflags & XT_UDP_INV_SRCPT)) 151 && port_match(udpinfo->dpts[0], udpinfo->dpts[1], 152 ntohs(uh->dest), 153 !!(udpinfo->invflags & XT_UDP_INV_DSTPT)); 154 } 155 156 static int udp_mt_check(const struct xt_mtchk_param *par) 157 { 158 const struct xt_udp *udpinfo = par->matchinfo; 159 160 /* Must specify no unknown invflags */ 161 return (udpinfo->invflags & ~XT_UDP_INV_MASK) ? -EINVAL : 0; 162 } 163 164 static struct xt_match tcpudp_mt_reg[] __read_mostly = { 165 { 166 .name = "tcp", 167 .family = NFPROTO_IPV4, 168 .checkentry = tcp_mt_check, 169 .match = tcp_mt, 170 .matchsize = sizeof(struct xt_tcp), 171 .proto = IPPROTO_TCP, 172 .me = THIS_MODULE, 173 }, 174 { 175 .name = "tcp", 176 .family = NFPROTO_IPV6, 177 .checkentry = tcp_mt_check, 178 .match = tcp_mt, 179 .matchsize = sizeof(struct xt_tcp), 180 .proto = IPPROTO_TCP, 181 .me = THIS_MODULE, 182 }, 183 { 184 .name = "udp", 185 .family = NFPROTO_IPV4, 186 .checkentry = udp_mt_check, 187 .match = udp_mt, 188 .matchsize = sizeof(struct xt_udp), 189 .proto = IPPROTO_UDP, 190 .me = THIS_MODULE, 191 }, 192 { 193 .name = "udp", 194 .family = NFPROTO_IPV6, 195 .checkentry = udp_mt_check, 196 .match = udp_mt, 197 .matchsize = sizeof(struct xt_udp), 198 .proto = IPPROTO_UDP, 199 .me = THIS_MODULE, 200 }, 201 { 202 .name = "udplite", 203 .family = NFPROTO_IPV4, 204 .checkentry = udp_mt_check, 205 .match = udp_mt, 206 .matchsize = sizeof(struct xt_udp), 207 .proto = IPPROTO_UDPLITE, 208 .me = THIS_MODULE, 209 }, 210 { 211 .name = "udplite", 212 .family = NFPROTO_IPV6, 213 .checkentry = udp_mt_check, 214 .match = udp_mt, 215 .matchsize = sizeof(struct xt_udp), 216 .proto = IPPROTO_UDPLITE, 217 .me = THIS_MODULE, 218 }, 219 }; 220 221 static int __init tcpudp_mt_init(void) 222 { 223 return xt_register_matches(tcpudp_mt_reg, ARRAY_SIZE(tcpudp_mt_reg)); 224 } 225 226 static void __exit tcpudp_mt_exit(void) 227 { 228 xt_unregister_matches(tcpudp_mt_reg, ARRAY_SIZE(tcpudp_mt_reg)); 229 } 230 231 module_init(tcpudp_mt_init); 232 module_exit(tcpudp_mt_exit); 233