1 /* Kernel module to match one of a list of TCP/UDP ports: ports are in
2 the same place so we can treat them as equal. */
4 /* (C) 1999-2001 Paul `Rusty' Russell
5 * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
12 #include <linux/module.h>
13 #include <linux/types.h>
14 #include <linux/udp.h>
15 #include <linux/skbuff.h>
18 #include <linux/netfilter_ipv6/ip6t_multiport.h>
19 #include <linux/netfilter_ipv6/ip6_tables.h>
21 MODULE_LICENSE("GPL");
22 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
23 MODULE_DESCRIPTION("ip6tables match for multiple ports");
26 #define duprintf(format, args...) printk(format , ## args)
28 #define duprintf(format, args...)
31 /* Returns 1 if the port is matched by the test, 0 otherwise. */
33 ports_match(const u_int16_t
*portlist
, enum ip6t_multiport_flags flags
,
34 u_int8_t count
, u_int16_t src
, u_int16_t dst
)
37 for (i
=0; i
<count
; i
++) {
38 if (flags
!= IP6T_MULTIPORT_DESTINATION
39 && portlist
[i
] == src
)
42 if (flags
!= IP6T_MULTIPORT_SOURCE
43 && portlist
[i
] == dst
)
51 match(const struct sk_buff
*skb
,
52 const struct net_device
*in
,
53 const struct net_device
*out
,
54 const void *matchinfo
,
60 const struct ip6t_multiport
*multiinfo
= matchinfo
;
62 /* Must not be a fragment. */
66 /* Must be big enough to read ports (both UDP and TCP have
67 them at the start). */
68 pptr
= skb_header_pointer(skb
, protoff
, sizeof(_ports
), &_ports
[0]);
70 /* We've been asked to examine this packet, and we
71 * can't. Hence, no choice but to drop.
73 duprintf("ip6t_multiport:"
74 " Dropping evil offset=0 tinygram.\n");
79 return ports_match(multiinfo
->ports
,
80 multiinfo
->flags
, multiinfo
->count
,
81 ntohs(pptr
[0]), ntohs(pptr
[1]));
84 /* Called when user tries to insert an entry of this type. */
86 checkentry(const char *tablename
,
87 const struct ip6t_ip6
*ip
,
89 unsigned int matchsize
,
90 unsigned int hook_mask
)
92 const struct ip6t_multiport
*multiinfo
= matchinfo
;
94 if (matchsize
!= IP6T_ALIGN(sizeof(struct ip6t_multiport
)))
97 /* Must specify proto == TCP/UDP, no unknown flags or bad count */
98 return (ip
->proto
== IPPROTO_TCP
|| ip
->proto
== IPPROTO_UDP
)
99 && !(ip
->invflags
& IP6T_INV_PROTO
)
100 && matchsize
== IP6T_ALIGN(sizeof(struct ip6t_multiport
))
101 && (multiinfo
->flags
== IP6T_MULTIPORT_SOURCE
102 || multiinfo
->flags
== IP6T_MULTIPORT_DESTINATION
103 || multiinfo
->flags
== IP6T_MULTIPORT_EITHER
)
104 && multiinfo
->count
<= IP6T_MULTI_PORTS
;
107 static struct ip6t_match multiport_match
= {
110 .checkentry
= &checkentry
,
114 static int __init
init(void)
116 return ip6t_register_match(&multiport_match
);
119 static void __exit
fini(void)
121 ip6t_unregister_match(&multiport_match
);