1 /* Kernel module to match one of a list of TCP/UDP ports: ports are in
2 the same place so we can treat them as equal. */
4 /* (C) 1999-2001 Paul `Rusty' Russell
5 * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
12 #include <linux/module.h>
13 #include <linux/types.h>
14 #include <linux/udp.h>
15 #include <linux/skbuff.h>
18 #include <linux/netfilter_ipv6/ip6t_multiport.h>
19 #include <linux/netfilter_ipv6/ip6_tables.h>
21 MODULE_LICENSE("GPL");
22 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
23 MODULE_DESCRIPTION("ip6tables match for multiple ports");
26 #define duprintf(format, args...) printk(format , ## args)
28 #define duprintf(format, args...)
31 /* Returns 1 if the port is matched by the test, 0 otherwise. */
33 ports_match(const u_int16_t
*portlist
, enum ip6t_multiport_flags flags
,
34 u_int8_t count
, u_int16_t src
, u_int16_t dst
)
37 for (i
=0; i
<count
; i
++) {
38 if (flags
!= IP6T_MULTIPORT_DESTINATION
39 && portlist
[i
] == src
)
42 if (flags
!= IP6T_MULTIPORT_SOURCE
43 && portlist
[i
] == dst
)
51 match(const struct sk_buff
*skb
,
52 const struct net_device
*in
,
53 const struct net_device
*out
,
54 const void *matchinfo
,
60 const struct udphdr
*udp
= hdr
;
61 const struct ip6t_multiport
*multiinfo
= matchinfo
;
63 /* Must be big enough to read ports. */
64 if (offset
== 0 && datalen
< sizeof(struct udphdr
)) {
65 /* We've been asked to examine this packet, and we
66 can't. Hence, no choice but to drop. */
67 duprintf("ip6t_multiport:"
68 " Dropping evil offset=0 tinygram.\n");
73 /* Must not be a fragment. */
75 && ports_match(multiinfo
->ports
,
76 multiinfo
->flags
, multiinfo
->count
,
77 ntohs(udp
->source
), ntohs(udp
->dest
));
80 /* Called when user tries to insert an entry of this type. */
82 checkentry(const char *tablename
,
83 const struct ip6t_ip6
*ip
,
85 unsigned int matchsize
,
86 unsigned int hook_mask
)
88 const struct ip6t_multiport
*multiinfo
= matchinfo
;
90 /* Must specify proto == TCP/UDP, no unknown flags or bad count */
91 return (ip
->proto
== IPPROTO_TCP
|| ip
->proto
== IPPROTO_UDP
)
92 && !(ip
->flags
& IP6T_INV_PROTO
)
93 && matchsize
== IP6T_ALIGN(sizeof(struct ip6t_multiport
))
94 && (multiinfo
->flags
== IP6T_MULTIPORT_SOURCE
95 || multiinfo
->flags
== IP6T_MULTIPORT_DESTINATION
96 || multiinfo
->flags
== IP6T_MULTIPORT_EITHER
)
97 && multiinfo
->count
<= IP6T_MULTI_PORTS
;
100 static struct ip6t_match multiport_match
= {
103 .checkentry
= &checkentry
,
107 static int __init
init(void)
109 return ip6t_register_match(&multiport_match
);
112 static void __exit
fini(void)
114 ip6t_unregister_match(&multiport_match
);