target/linux/generic-2.4/patches/618-netfilter_multiport_backport.patch

   1 Index: linux-2.4.35.4/include/linux/netfilter_ipv4/ipt_multiport.h
   2 ===================================================================
   3 --- linux-2.4.35.4.orig/include/linux/netfilter_ipv4/ipt_multiport.h
   4 +++ linux-2.4.35.4/include/linux/netfilter_ipv4/ipt_multiport.h
   5 @@ -11,11 +11,12 @@ enum ipt_multiport_flags
   6
   7  #define IPT_MULTI_PORTS        15
   8
   9 -/* Must fit inside union ipt_matchinfo: 16 bytes */
  10 -struct ipt_multiport
  11 +struct ipt_multiport_v1
  12  {
  13         u_int8_t flags;                         /* Type of comparison */
  14         u_int8_t count;                         /* Number of ports */
  15         u_int16_t ports[IPT_MULTI_PORTS];       /* Ports */
  16 +       u_int8_t pflags[IPT_MULTI_PORTS];       /* Port flags */
  17 +       u_int8_t invert;                        /* Invert flag */
  18  };
  19  #endif /*_IPT_MULTIPORT_H*/
  20 Index: linux-2.4.35.4/net/ipv4/netfilter/ipt_multiport.c
  21 ===================================================================
  22 --- linux-2.4.35.4.orig/net/ipv4/netfilter/ipt_multiport.c
  23 +++ linux-2.4.35.4/net/ipv4/netfilter/ipt_multiport.c
  24 @@ -1,5 +1,14 @@
  25  /* Kernel module to match one of a list of TCP/UDP ports: ports are in
  26     the same place so we can treat them as equal. */
  27 +
  28 +/* (C) 1999-2001 Paul `Rusty' Russell
  29 + * (C) 2002-2004 Netfilter Core Team <coreteam@netfilter.org>
  30 + *
  31 + * This program is free software; you can redistribute it and/or modify
  32 + * it under the terms of the GNU General Public License version 2 as
  33 + * published by the Free Software Foundation.
  34 + */
  35 +
  36  #include <linux/module.h>
  37  #include <linux/types.h>
  38  #include <linux/udp.h>
  39 @@ -8,97 +17,136 @@
  40  #include <linux/netfilter_ipv4/ipt_multiport.h>
  41  #include <linux/netfilter_ipv4/ip_tables.h>
  42
  43 +MODULE_LICENSE("GPL");
  44 +MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
  45 +MODULE_DESCRIPTION("iptables multiple port match module");
  46 +
  47  #if 0
  48  #define duprintf(format, args...) printk(format , ## args)
  49  #else
  50  #define duprintf(format, args...)
  51  #endif
  52
  53 +/* from linux 2.6 skbuff.h */
  54 +static inline void *skb_header_pointer(const struct sk_buff *skb, int offset,
  55 +                                      int len, void *buffer)
  56 +{
  57 +       int hlen = skb_headlen(skb);
  58 +
  59 +       if (hlen - offset >= len)
  60 +               return skb->data + offset;
  61 +
  62 +       if (skb_copy_bits(skb, offset, buffer, len) < 0)
  63 +               return NULL;
  64 +
  65 +       return buffer;
  66 +}
  67 +
  68 +
  69  /* Returns 1 if the port is matched by the test, 0 otherwise. */
  70  static inline int
  71 -ports_match(const u_int16_t *portlist, enum ipt_multiport_flags flags,
  72 -           u_int8_t count, u_int16_t src, u_int16_t dst)
  73 +ports_match_v1(const struct ipt_multiport_v1 *minfo,
  74 +              u_int16_t src, u_int16_t dst)
  75  {
  76         unsigned int i;
  77 -       for (i=0; i<count; i++) {
  78 -               if (flags != IPT_MULTIPORT_DESTINATION
  79 -                   && portlist[i] == src)
  80 -                       return 1;
  81 -
  82 -               if (flags != IPT_MULTIPORT_SOURCE
  83 -                   && portlist[i] == dst)
  84 -                       return 1;
  85 -       }
  86 +       u_int16_t s, e;
  87
  88 -       return 0;
  89 +       for (i=0; i < minfo->count; i++) {
  90 +               s = minfo->ports[i];
  91 +
  92 +               if (minfo->pflags[i]) {
  93 +                       /* range port matching */
  94 +                       e = minfo->ports[++i];
  95 +                       duprintf("src or dst matches with %d-%d?\n", s, e);
  96 +
  97 +                       if (minfo->flags == IPT_MULTIPORT_SOURCE
  98 +                           && src >= s && src <= e)
  99 +                               return 1 ^ minfo->invert;
 100 +                       if (minfo->flags == IPT_MULTIPORT_DESTINATION
 101 +                           && dst >= s && dst <= e)
 102 +                               return 1 ^ minfo->invert;
 103 +                       if (minfo->flags == IPT_MULTIPORT_EITHER
 104 +                           && ((dst >= s && dst <= e)
 105 +                               || (src >= s && src <= e)))
 106 +                               return 1 ^ minfo->invert;
 107 +               } else {
 108 +                       /* exact port matching */
 109 +                       duprintf("src or dst matches with %d?\n", s);
 110 +
 111 +                       if (minfo->flags == IPT_MULTIPORT_SOURCE
 112 +                           && src == s)
 113 +                               return 1 ^ minfo->invert;
 114 +                       if (minfo->flags == IPT_MULTIPORT_DESTINATION
 115 +                           && dst == s)
 116 +                               return 1 ^ minfo->invert;
 117 +                       if (minfo->flags == IPT_MULTIPORT_EITHER
 118 +                           && (src == s || dst == s))
 119 +                               return 1 ^ minfo->invert;
 120 +               }
 121 +       }
 122 +
 123 +       return minfo->invert;
 124  }
 125
 126  static int
 127 -match(const struct sk_buff *skb,
 128 -      const struct net_device *in,
 129 -      const struct net_device *out,
 130 -      const void *matchinfo,
 131 -      int offset,
 132 -      const void *hdr,
 133 -      u_int16_t datalen,
 134 -      int *hotdrop)
 135 +match_v1(const struct sk_buff *skb,
 136 +        const struct net_device *in,
 137 +        const struct net_device *out,
 138 +        const void *matchinfo,
 139 +        int offset,
 140 +        int *hotdrop)
 141  {
 142 -       const struct udphdr *udp = hdr;
 143 -       const struct ipt_multiport *multiinfo = matchinfo;
 144 +       u16 _ports[2], *pptr;
 145 +       const struct ipt_multiport_v1 *multiinfo = matchinfo;
 146 +
 147 +       if (offset)
 148 +               return 0;
 149
 150 -       /* Must be big enough to read ports. */
 151 -       if (offset == 0 && datalen < sizeof(struct udphdr)) {
 152 +       pptr = skb_header_pointer(skb, skb->nh.iph->ihl * 4,
 153 +                                 sizeof(_ports), _ports);
 154 +       if (pptr == NULL) {
 155                 /* We've been asked to examine this packet, and we
 156 -                  can't.  Hence, no choice but to drop. */
 157 -                       duprintf("ipt_multiport:"
 158 -                                " Dropping evil offset=0 tinygram.\n");
 159 -                       *hotdrop = 1;
 160 -                       return 0;
 161 +                * can't.  Hence, no choice but to drop.
 162 +                */
 163 +               duprintf("ipt_multiport:"
 164 +                        " Dropping evil offset=0 tinygram.\n");
 165 +               *hotdrop = 1;
 166 +               return 0;
 167         }
 168
 169 -       /* Must not be a fragment. */
 170 -       return !offset
 171 -               && ports_match(multiinfo->ports,
 172 -                              multiinfo->flags, multiinfo->count,
 173 -                              ntohs(udp->source), ntohs(udp->dest));
 174 +       return ports_match_v1(multiinfo, ntohs(pptr[0]), ntohs(pptr[1]));
 175  }
 176
 177 -/* Called when user tries to insert an entry of this type. */
 178  static int
 179 -checkentry(const char *tablename,
 180 -          const struct ipt_ip *ip,
 181 -          void *matchinfo,
 182 -          unsigned int matchsize,
 183 -          unsigned int hook_mask)
 184 +checkentry_v1(const char *tablename,
 185 +             const struct ipt_ip *ip,
 186 +             void *matchinfo,
 187 +             unsigned int matchsize,
 188 +             unsigned int hook_mask)
 189  {
 190 -       const struct ipt_multiport *multiinfo = matchinfo;
 191 -
 192 -       if (matchsize != IPT_ALIGN(sizeof(struct ipt_multiport)))
 193 -               return 0;
 194 -
 195 -       /* Must specify proto == TCP/UDP, no unknown flags or bad count */
 196 -       return (ip->proto == IPPROTO_TCP || ip->proto == IPPROTO_UDP)
 197 -               && !(ip->invflags & IPT_INV_PROTO)
 198 -               && matchsize == IPT_ALIGN(sizeof(struct ipt_multiport))
 199 -               && (multiinfo->flags == IPT_MULTIPORT_SOURCE
 200 -                   || multiinfo->flags == IPT_MULTIPORT_DESTINATION
 201 -                   || multiinfo->flags == IPT_MULTIPORT_EITHER)
 202 -               && multiinfo->count <= IPT_MULTI_PORTS;
 203 +       return (matchsize == IPT_ALIGN(sizeof(struct ipt_multiport_v1)));
 204  }
 205
 206 -static struct ipt_match multiport_match
 207 -= { { NULL, NULL }, "multiport", &match, &checkentry, NULL, THIS_MODULE };
 208 +static struct ipt_match multiport_match_v1 = {
 209 +       .name           = "multiport",
 210 +       .match          = &match_v1,
 211 +       .checkentry     = &checkentry_v1,
 212 +       .me             = THIS_MODULE,
 213 +};
 214
 215  static int __init init(void)
 216  {
 217 -       return ipt_register_match(&multiport_match);
 218 +       int err;
 219 +
 220 +       err = ipt_register_match(&multiport_match_v1);
 221 +
 222 +       return err;
 223  }
 224
 225  static void __exit fini(void)
 226  {
 227 -       ipt_unregister_match(&multiport_match);
 228 +       ipt_unregister_match(&multiport_match_v1);
 229  }
 230
 231  module_init(init);
 232  module_exit(fini);
 233 -MODULE_LICENSE("GPL");