ia64/linux-2.6.18-xen.hg

view net/netfilter/xt_tcpudp.c @ 871:9cbcc9008446

xen/x86: don't initialize cpu_data[]'s apicid field on generic code

Afaict, this is not only redundant with the intialization done in
drivers/xen/core/smpboot.c, but actually results - at least for
secondary CPUs - in the Xen-specific value written to be later
overwritten with whatever the generic code determines (with no
guarantee that the two values are identical).

Signed-off-by: Jan Beulich <jbeulich@novell.com>
author Keir Fraser <keir.fraser@citrix.com>
date Thu May 14 10:09:15 2009 +0100 (2009-05-14)
parents 831230e53067
children
line source
1 #include <linux/types.h>
2 #include <linux/module.h>
3 #include <net/ip.h>
4 #include <linux/ipv6.h>
5 #include <net/ipv6.h>
6 #include <net/tcp.h>
7 #include <net/udp.h>
8 #include <linux/netfilter/x_tables.h>
9 #include <linux/netfilter/xt_tcpudp.h>
10 #include <linux/netfilter_ipv4/ip_tables.h>
11 #include <linux/netfilter_ipv6/ip6_tables.h>
13 MODULE_DESCRIPTION("x_tables match for TCP and UDP, supports IPv4 and IPv6");
14 MODULE_LICENSE("GPL");
15 MODULE_ALIAS("xt_tcp");
16 MODULE_ALIAS("xt_udp");
17 MODULE_ALIAS("ipt_udp");
18 MODULE_ALIAS("ipt_tcp");
19 MODULE_ALIAS("ip6t_udp");
20 MODULE_ALIAS("ip6t_tcp");
22 #ifdef DEBUG_IP_FIREWALL_USER
23 #define duprintf(format, args...) printk(format , ## args)
24 #else
25 #define duprintf(format, args...)
26 #endif
29 /* Returns 1 if the port is matched by the range, 0 otherwise */
30 static inline int
31 port_match(u_int16_t min, u_int16_t max, u_int16_t port, int invert)
32 {
33 int ret;
35 ret = (port >= min && port <= max) ^ invert;
36 return ret;
37 }
39 static int
40 tcp_find_option(u_int8_t option,
41 const struct sk_buff *skb,
42 unsigned int protoff,
43 unsigned int optlen,
44 int invert,
45 int *hotdrop)
46 {
47 /* tcp.doff is only 4 bits, ie. max 15 * 4 bytes */
48 u_int8_t _opt[60 - sizeof(struct tcphdr)], *op;
49 unsigned int i;
51 duprintf("tcp_match: finding option\n");
53 if (!optlen)
54 return invert;
56 /* If we don't have the whole header, drop packet. */
57 op = skb_header_pointer(skb, protoff + sizeof(struct tcphdr),
58 optlen, _opt);
59 if (op == NULL) {
60 *hotdrop = 1;
61 return 0;
62 }
64 for (i = 0; i < optlen; ) {
65 if (op[i] == option) return !invert;
66 if (op[i] < 2) i++;
67 else i += op[i+1]?:1;
68 }
70 return invert;
71 }
73 static int
74 tcp_match(const struct sk_buff *skb,
75 const struct net_device *in,
76 const struct net_device *out,
77 const struct xt_match *match,
78 const void *matchinfo,
79 int offset,
80 unsigned int protoff,
81 int *hotdrop)
82 {
83 struct tcphdr _tcph, *th;
84 const struct xt_tcp *tcpinfo = matchinfo;
86 if (offset) {
87 /* To quote Alan:
89 Don't allow a fragment of TCP 8 bytes in. Nobody normal
90 causes this. Its a cracker trying to break in by doing a
91 flag overwrite to pass the direction checks.
92 */
93 if (offset == 1) {
94 duprintf("Dropping evil TCP offset=1 frag.\n");
95 *hotdrop = 1;
96 }
97 /* Must not be a fragment. */
98 return 0;
99 }
101 #define FWINVTCP(bool,invflg) ((bool) ^ !!(tcpinfo->invflags & invflg))
103 th = skb_header_pointer(skb, protoff, sizeof(_tcph), &_tcph);
104 if (th == NULL) {
105 /* We've been asked to examine this packet, and we
106 can't. Hence, no choice but to drop. */
107 duprintf("Dropping evil TCP offset=0 tinygram.\n");
108 *hotdrop = 1;
109 return 0;
110 }
112 if (!port_match(tcpinfo->spts[0], tcpinfo->spts[1],
113 ntohs(th->source),
114 !!(tcpinfo->invflags & XT_TCP_INV_SRCPT)))
115 return 0;
116 if (!port_match(tcpinfo->dpts[0], tcpinfo->dpts[1],
117 ntohs(th->dest),
118 !!(tcpinfo->invflags & XT_TCP_INV_DSTPT)))
119 return 0;
120 if (!FWINVTCP((((unsigned char *)th)[13] & tcpinfo->flg_mask)
121 == tcpinfo->flg_cmp,
122 XT_TCP_INV_FLAGS))
123 return 0;
124 if (tcpinfo->option) {
125 if (th->doff * 4 < sizeof(_tcph)) {
126 *hotdrop = 1;
127 return 0;
128 }
129 if (!tcp_find_option(tcpinfo->option, skb, protoff,
130 th->doff*4 - sizeof(_tcph),
131 tcpinfo->invflags & XT_TCP_INV_OPTION,
132 hotdrop))
133 return 0;
134 }
135 return 1;
136 }
138 /* Called when user tries to insert an entry of this type. */
139 static int
140 tcp_checkentry(const char *tablename,
141 const void *info,
142 const struct xt_match *match,
143 void *matchinfo,
144 unsigned int matchsize,
145 unsigned int hook_mask)
146 {
147 const struct xt_tcp *tcpinfo = matchinfo;
149 /* Must specify no unknown invflags */
150 return !(tcpinfo->invflags & ~XT_TCP_INV_MASK);
151 }
153 static int
154 udp_match(const struct sk_buff *skb,
155 const struct net_device *in,
156 const struct net_device *out,
157 const struct xt_match *match,
158 const void *matchinfo,
159 int offset,
160 unsigned int protoff,
161 int *hotdrop)
162 {
163 struct udphdr _udph, *uh;
164 const struct xt_udp *udpinfo = matchinfo;
166 /* Must not be a fragment. */
167 if (offset)
168 return 0;
170 uh = skb_header_pointer(skb, protoff, sizeof(_udph), &_udph);
171 if (uh == NULL) {
172 /* We've been asked to examine this packet, and we
173 can't. Hence, no choice but to drop. */
174 duprintf("Dropping evil UDP tinygram.\n");
175 *hotdrop = 1;
176 return 0;
177 }
179 return port_match(udpinfo->spts[0], udpinfo->spts[1],
180 ntohs(uh->source),
181 !!(udpinfo->invflags & XT_UDP_INV_SRCPT))
182 && port_match(udpinfo->dpts[0], udpinfo->dpts[1],
183 ntohs(uh->dest),
184 !!(udpinfo->invflags & XT_UDP_INV_DSTPT));
185 }
187 /* Called when user tries to insert an entry of this type. */
188 static int
189 udp_checkentry(const char *tablename,
190 const void *info,
191 const struct xt_match *match,
192 void *matchinfo,
193 unsigned int matchsize,
194 unsigned int hook_mask)
195 {
196 const struct xt_tcp *udpinfo = matchinfo;
198 /* Must specify no unknown invflags */
199 return !(udpinfo->invflags & ~XT_UDP_INV_MASK);
200 }
202 static struct xt_match tcp_matchstruct = {
203 .name = "tcp",
204 .match = tcp_match,
205 .matchsize = sizeof(struct xt_tcp),
206 .proto = IPPROTO_TCP,
207 .family = AF_INET,
208 .checkentry = tcp_checkentry,
209 .me = THIS_MODULE,
210 };
212 static struct xt_match tcp6_matchstruct = {
213 .name = "tcp",
214 .match = tcp_match,
215 .matchsize = sizeof(struct xt_tcp),
216 .proto = IPPROTO_TCP,
217 .family = AF_INET6,
218 .checkentry = tcp_checkentry,
219 .me = THIS_MODULE,
220 };
222 static struct xt_match udp_matchstruct = {
223 .name = "udp",
224 .match = udp_match,
225 .matchsize = sizeof(struct xt_udp),
226 .proto = IPPROTO_UDP,
227 .family = AF_INET,
228 .checkentry = udp_checkentry,
229 .me = THIS_MODULE,
230 };
231 static struct xt_match udp6_matchstruct = {
232 .name = "udp",
233 .match = udp_match,
234 .matchsize = sizeof(struct xt_udp),
235 .proto = IPPROTO_UDP,
236 .family = AF_INET6,
237 .checkentry = udp_checkentry,
238 .me = THIS_MODULE,
239 };
241 static int __init xt_tcpudp_init(void)
242 {
243 int ret;
244 ret = xt_register_match(&tcp_matchstruct);
245 if (ret)
246 return ret;
248 ret = xt_register_match(&tcp6_matchstruct);
249 if (ret)
250 goto out_unreg_tcp;
252 ret = xt_register_match(&udp_matchstruct);
253 if (ret)
254 goto out_unreg_tcp6;
256 ret = xt_register_match(&udp6_matchstruct);
257 if (ret)
258 goto out_unreg_udp;
260 return ret;
262 out_unreg_udp:
263 xt_unregister_match(&udp_matchstruct);
264 out_unreg_tcp6:
265 xt_unregister_match(&tcp6_matchstruct);
266 out_unreg_tcp:
267 xt_unregister_match(&tcp_matchstruct);
268 return ret;
269 }
271 static void __exit xt_tcpudp_fini(void)
272 {
273 xt_unregister_match(&udp6_matchstruct);
274 xt_unregister_match(&udp_matchstruct);
275 xt_unregister_match(&tcp6_matchstruct);
276 xt_unregister_match(&tcp_matchstruct);
277 }
279 module_init(xt_tcpudp_init);
280 module_exit(xt_tcpudp_fini);