anonfunc/xtables-addons
1
0
Fork 0
mirror of git://git.code.sf.net/p/xtables-addons/xtables-addons synced 2025-09-06 04:35:12 +02:00
Code Issues Releases Wiki Activity

xt_psd: move L4 header fetching into helper

Browse Source 
Also start splitting psd_match into two functions, one to do initial
sanity checking and header retrieval, one to do the actual work.
This commit is contained in:
Florian Westphal
2012-08-17 14:21:04 +02:00
committed by Jan Engelhardt
parent 77240e0918
commit 2ba833fe47
1 changed files with 57 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files

100
extensions/xt_psd.c
View File

@@ -214,52 +214,36 @@ static void remove_oldest(struct host **head, struct host *curr)
ht_unlink(head, last);
}
static bool
xt_psd_match(const struct sk_buff *pskb, struct xt_action_param *match)
static void *
get_header_pointer4(const struct sk_buff *skb, unsigned int thoff, void *mem)
{
const struct iphdr *iph = ip_hdr(skb);
int hdrlen;
switch (iph->protocol) {
case IPPROTO_TCP:
hdrlen = sizeof(struct tcphdr);
break;
case IPPROTO_UDP:
case IPPROTO_UDPLITE:
hdrlen = sizeof(struct udphdr);
break;
default:
return NULL;
}
return skb_header_pointer(skb, thoff, hdrlen, mem);
}
static bool
handle_packet4(const struct iphdr *iph, const struct tcphdr *tcph,
const struct xt_psd_info *psdinfo)
{
const struct iphdr *iph;
const struct tcphdr *tcph = NULL;
union {
struct tcphdr tcph;
struct udphdr udph;
} _buf;
u_int8_t proto;
unsigned long now;
struct host *curr, *last = NULL, **head;
struct host4 *curr4;
int count = 0;
unsigned int hash;
/* Parameters from userspace */
const struct xt_psd_info *psdinfo = match->matchinfo;
iph = ip_hdr(pskb);
if (iph->frag_off & htons(IP_OFFSET)) {
pr_debug("sanity check failed\n");
return false;
}
proto = iph->protocol;
/* We're using IP address 0.0.0.0 for a special purpose here, so don't let
* them spoof us. [DHCP needs this feature - HW] */
if (iph->saddr == 0) {
pr_debug("spoofed source address (0.0.0.0)\n");
return false;
}
if (proto == IPPROTO_TCP) {
tcph = skb_header_pointer(pskb, match->thoff,
sizeof(_buf.tcph), &_buf.tcph);
if (tcph == NULL)
return false;
} else if (proto == IPPROTO_UDP || proto == IPPROTO_UDPLITE) {
tcph = skb_header_pointer(pskb, match->thoff,
sizeof(_buf.udph), &_buf.udph);
if (tcph == NULL)
return false;
} else {
pr_debug("protocol not supported\n");
return false;
}
now = jiffies;
hash = hashfunc(iph->saddr);
@@ -280,7 +264,7 @@ xt_psd_match(const struct sk_buff *pskb, struct xt_action_param *match)
if (curr != NULL) {
/* We know this address, and the entry isn't too old. Update it. */
if (entry_is_recent(curr, psdinfo->delay_threshold, now)) {
if (is_portscan(curr, psdinfo, tcph, proto))
if (is_portscan(curr, psdinfo, tcph, iph->protocol))
goto out_match;
goto out_no_match;
}
@@ -294,7 +278,7 @@ xt_psd_match(const struct sk_buff *pskb, struct xt_action_param *match)
}
/* We don't need an ACK from a new source address */
if (proto == IPPROTO_TCP && tcph->ack)
if (iph->protocol == IPPROTO_TCP && tcph->ack)
goto out_no_match;
/* Got too many source addresses with the same hash value? Then remove the
@@ -327,7 +311,7 @@ xt_psd_match(const struct sk_buff *pskb, struct xt_action_param *match)
curr->count = 1;
curr->weight = get_port_weight(psdinfo, tcph->dest);
curr->ports[0].number = tcph->dest;
curr->ports[0].proto = proto;
curr->ports[0].proto = iph->protocol;
out_no_match:
spin_unlock(&state.lock);
@@ -338,6 +322,36 @@ out_match:
return true;
}
static bool
xt_psd_match(const struct sk_buff *pskb, struct xt_action_param *match)
{
struct iphdr *iph = ip_hdr(pskb);
struct tcphdr _tcph;
struct tcphdr *tcph;
/* Parameters from userspace */
const struct xt_psd_info *psdinfo = match->matchinfo;
if (iph->frag_off & htons(IP_OFFSET)) {
pr_debug("sanity check failed\n");
return false;
}
/*
* We are using IP address 0.0.0.0 for a special purpose here, so do
* not let them spoof us. [DHCP needs this feature - HW]
*/
if (iph->saddr == 0) {
pr_debug("spoofed source address (0.0.0.0)\n");
return false;
}
tcph = get_header_pointer4(pskb, match->thoff, &_tcph);
if (tcph == NULL)
return false;
return handle_packet4(iph, tcph, psdinfo);
}
static int psd_mt_check(const struct xt_mtchk_param *par)
{
const struct xt_psd_info *info = par->matchinfo;