1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
|
// SPDX-License-Identifier: GPL-2.0-only
/*
* xt_u32 - kernel module to match u32 packet content
*
* Original author: Don Cohen <don@isis.cs3-inc.com>
* (C) CC Computer Consultants GmbH, 2007
*/
#include <linux/module.h>
#include <linux/moduleparam.h>
#include <linux/spinlock.h>
#include <linux/skbuff.h>
#include <linux/types.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter/xt_u32.h>
static bool u32_match_it(const struct xt_u32 *data,
const struct sk_buff *skb)
{
const struct xt_u32_test *ct;
unsigned int testind;
unsigned int nnums;
unsigned int nvals;
unsigned int i;
__be32 n;
u_int32_t pos;
u_int32_t val;
u_int32_t at;
/*
* Small example: "0 >> 28 == 4 && 8 & 0xFF0000 >> 16 = 6, 17"
* (=IPv4 and (TCP or UDP)). Outer loop runs over the "&&" operands.
*/
for (testind = 0; testind < data->ntests; ++testind) {
ct = &data->tests[testind];
at = 0;
pos = ct->location[0].number;
if (skb->len < 4 || pos > skb->len - 4)
return false;
if (skb_copy_bits(skb, pos, &n, sizeof(n)) < 0)
BUG();
val = ntohl(n);
nnums = ct->nnums;
/* Inner loop runs over "&", "<<", ">>" and "@" operands */
for (i = 1; i < nnums; ++i) {
u_int32_t number = ct->location[i].number;
switch (ct->location[i].nextop) {
case XT_U32_AND:
val &= number;
break;
case XT_U32_LEFTSH:
val <<= number;
break;
case XT_U32_RIGHTSH:
val >>= number;
break;
case XT_U32_AT:
if (at + val < at)
return false;
at += val;
pos = number;
if (at + 4 < at || skb->len < at + 4 ||
pos > skb->len - at - 4)
return false;
if (skb_copy_bits(skb, at + pos, &n,
sizeof(n)) < 0)
BUG();
val = ntohl(n);
break;
}
}
/* Run over the "," and ":" operands */
nvals = ct->nvalues;
for (i = 0; i < nvals; ++i)
if (ct->value[i].min <= val && val <= ct->value[i].max)
break;
if (i >= ct->nvalues)
return false;
}
return true;
}
static bool u32_mt(const struct sk_buff *skb, struct xt_action_param *par)
{
const struct xt_u32 *data = par->matchinfo;
bool ret;
ret = u32_match_it(data, skb);
return ret ^ data->invert;
}
static int u32_mt_checkentry(const struct xt_mtchk_param *par)
{
const struct xt_u32 *data = par->matchinfo;
const struct xt_u32_test *ct;
unsigned int i;
if (data->ntests > ARRAY_SIZE(data->tests))
return -EINVAL;
for (i = 0; i < data->ntests; ++i) {
ct = &data->tests[i];
if (ct->nnums > ARRAY_SIZE(ct->location) ||
ct->nvalues > ARRAY_SIZE(ct->value))
return -EINVAL;
}
return 0;
}
static struct xt_match xt_u32_mt_reg __read_mostly = {
.name = "u32",
.revision = 0,
.family = NFPROTO_UNSPEC,
.match = u32_mt,
.checkentry = u32_mt_checkentry,
.matchsize = sizeof(struct xt_u32),
.me = THIS_MODULE,
};
static int __init u32_mt_init(void)
{
return xt_register_match(&xt_u32_mt_reg);
}
static void __exit u32_mt_exit(void)
{
xt_unregister_match(&xt_u32_mt_reg);
}
module_init(u32_mt_init);
module_exit(u32_mt_exit);
MODULE_AUTHOR("Jan Engelhardt <jengelh@medozas.de>");
MODULE_DESCRIPTION("Xtables: arbitrary byte matching");
MODULE_LICENSE("GPL");
MODULE_ALIAS("ipt_u32");
MODULE_ALIAS("ip6t_u32");
|
