1 // SPDX-License-Identifier: GPL-2.0-only
3 * iptables module for DCCP protocol header matching
5 * (C) 2005 by Harald Welte <laforge@netfilter.org>
8 #include <linux/module.h>
9 #include <linux/skbuff.h>
10 #include <linux/slab.h>
11 #include <linux/spinlock.h>
13 #include <linux/dccp.h>
15 #include <linux/netfilter/x_tables.h>
16 #include <linux/netfilter/xt_dccp.h>
18 #include <linux/netfilter_ipv4/ip_tables.h>
19 #include <linux/netfilter_ipv6/ip6_tables.h>
21 MODULE_LICENSE("GPL");
22 MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
23 MODULE_DESCRIPTION("Xtables: DCCP protocol packet match");
24 MODULE_ALIAS("ipt_dccp");
25 MODULE_ALIAS("ip6t_dccp");
27 #define DCCHECK(cond, option, flag, invflag) (!((flag) & (option)) \
28 || (!!((invflag) & (option)) ^ (cond)))
30 static unsigned char *dccp_optbuf;
31 static DEFINE_SPINLOCK(dccp_buflock);
34 dccp_find_option(u_int8_t option,
35 const struct sk_buff *skb,
37 const struct dccp_hdr *dh,
40 /* tcp.doff is only 4 bits, ie. max 15 * 4 bytes */
41 const unsigned char *op;
42 unsigned int optoff = __dccp_hdr_len(dh);
43 unsigned int optlen = dh->dccph_doff*4 - __dccp_hdr_len(dh);
46 if (dh->dccph_doff * 4 < __dccp_hdr_len(dh))
52 spin_lock_bh(&dccp_buflock);
53 op = skb_header_pointer(skb, protoff + optoff, optlen, dccp_optbuf);
55 /* If we don't have the whole header, drop packet. */
59 for (i = 0; i < optlen; ) {
60 if (op[i] == option) {
61 spin_unlock_bh(&dccp_buflock);
71 spin_unlock_bh(&dccp_buflock);
75 spin_unlock_bh(&dccp_buflock);
83 match_types(const struct dccp_hdr *dh, u_int16_t typemask)
85 return typemask & (1 << dh->dccph_type);
89 match_option(u_int8_t option, const struct sk_buff *skb, unsigned int protoff,
90 const struct dccp_hdr *dh, bool *hotdrop)
92 return dccp_find_option(option, skb, protoff, dh, hotdrop);
96 dccp_mt(const struct sk_buff *skb, struct xt_action_param *par)
98 const struct xt_dccp_info *info = par->matchinfo;
99 const struct dccp_hdr *dh;
102 if (par->fragoff != 0)
105 dh = skb_header_pointer(skb, par->thoff, sizeof(_dh), &_dh);
111 return DCCHECK(ntohs(dh->dccph_sport) >= info->spts[0]
112 && ntohs(dh->dccph_sport) <= info->spts[1],
113 XT_DCCP_SRC_PORTS, info->flags, info->invflags)
114 && DCCHECK(ntohs(dh->dccph_dport) >= info->dpts[0]
115 && ntohs(dh->dccph_dport) <= info->dpts[1],
116 XT_DCCP_DEST_PORTS, info->flags, info->invflags)
117 && DCCHECK(match_types(dh, info->typemask),
118 XT_DCCP_TYPE, info->flags, info->invflags)
119 && DCCHECK(match_option(info->option, skb, par->thoff, dh,
121 XT_DCCP_OPTION, info->flags, info->invflags);
124 static int dccp_mt_check(const struct xt_mtchk_param *par)
126 const struct xt_dccp_info *info = par->matchinfo;
128 if (info->flags & ~XT_DCCP_VALID_FLAGS)
130 if (info->invflags & ~XT_DCCP_VALID_FLAGS)
132 if (info->invflags & ~info->flags)
137 static struct xt_match dccp_mt_reg[] __read_mostly = {
140 .family = NFPROTO_IPV4,
141 .checkentry = dccp_mt_check,
143 .matchsize = sizeof(struct xt_dccp_info),
144 .proto = IPPROTO_DCCP,
149 .family = NFPROTO_IPV6,
150 .checkentry = dccp_mt_check,
152 .matchsize = sizeof(struct xt_dccp_info),
153 .proto = IPPROTO_DCCP,
158 static int __init dccp_mt_init(void)
162 /* doff is 8 bits, so the maximum option size is (4*256). Don't put
163 * this in BSS since DaveM is worried about locked TLB's for kernel
165 dccp_optbuf = kmalloc(256 * 4, GFP_KERNEL);
168 ret = xt_register_matches(dccp_mt_reg, ARRAY_SIZE(dccp_mt_reg));
178 static void __exit dccp_mt_exit(void)
180 xt_unregister_matches(dccp_mt_reg, ARRAY_SIZE(dccp_mt_reg));
184 module_init(dccp_mt_init);
185 module_exit(dccp_mt_exit);