Gecko [ ifk.uw.edu.pl ]

Name	Size	Permission
ACCOUNT	[ DIR ]	drwxr-xr-x
pknock	[ DIR ]	drwxr-xr-x
Kbuild	1020 B	-rw-r--r--
Makefile	14.31 KB	-rw-r--r--
Makefile.am	910 B	-rw-r--r--
Makefile.in	13.55 KB	-rw-r--r--
Mbuild	989 B	-rw-r--r--
compat_skbuff.h	325 B	-rw-r--r--
compat_user.h	262 B	-rw-r--r--
compat_xtables.c	1.18 KB	-rw-r--r--
compat_xtables.h	2.52 KB	-rw-r--r--
compat_xtnu.h	1.97 KB	-rw-r--r--
libxt_CHAOS.c	2.56 KB	-rw-r--r--
libxt_CHAOS.man	1 KB	-rw-r--r--
libxt_DELUDE.c	1.11 KB	-rw-r--r--
libxt_DELUDE.man	286 B	-rw-r--r--
libxt_DHCPMAC.c	2.55 KB	-rw-r--r--
libxt_DHCPMAC.man	1.2 KB	-rw-r--r--
libxt_DNETMAP.c	6.62 KB	-rw-r--r--
libxt_DNETMAP.man	7.71 KB	-rw-r--r--
libxt_ECHO.c	1.03 KB	-rw-r--r--
libxt_ECHO.man	141 B	-rw-r--r--
libxt_IPMARK.c	4.71 KB	-rw-r--r--
libxt_IPMARK.man	1.99 KB	-rw-r--r--
libxt_LOGMARK.c	3.27 KB	-rw-r--r--
libxt_LOGMARK.man	312 B	-rw-r--r--
libxt_SYSRQ.c	844 B	-rw-r--r--
libxt_SYSRQ.man	3.67 KB	-rw-r--r--
libxt_TARPIT.c	2.75 KB	-rw-r--r--
libxt_TARPIT.man	2.55 KB	-rw-r--r--
libxt_condition.c	2.5 KB	-rw-r--r--
libxt_condition.man	175 B	-rw-r--r--
libxt_dhcpmac.c	2.52 KB	-rw-r--r--
libxt_dhcpmac.man	207 B	-rw-r--r--
libxt_fuzzy.c	3.37 KB	-rw-r--r--
libxt_fuzzy.man	263 B	-rw-r--r--
libxt_geoip.c	8.21 KB	-rw-r--r--
libxt_geoip.man	1 KB	-rw-r--r--
libxt_gradm.c	2.3 KB	-rw-r--r--
libxt_gradm.man	225 B	-rw-r--r--
libxt_iface.c	7.21 KB	-rw-r--r--
libxt_iface.man	1.39 KB	-rw-r--r--
libxt_ipp2p.c	7.36 KB	-rw-r--r--
libxt_ipp2p.man	1.52 KB	-rw-r--r--
libxt_ipv4options.c	4.32 KB	-rw-r--r--
libxt_ipv4options.man	1.44 KB	-rw-r--r--
libxt_length2.c	4.69 KB	-rw-r--r--
libxt_length2.man	695 B	-rw-r--r--
libxt_lscan.c	2.64 KB	-rw-r--r--
libxt_lscan.man	1.58 KB	-rw-r--r--
libxt_psd.c	5.34 KB	-rw-r--r--
libxt_psd.man	720 B	-rw-r--r--
libxt_quota2.c	4.06 KB	-rw-r--r--
libxt_quota2.man	1.6 KB	-rw-r--r--
mac.c	572 B	-rw-r--r--
xt_CHAOS.c	6.29 KB	-rw-r--r--
xt_CHAOS.h	249 B	-rw-r--r--
xt_DELUDE.c	4.96 KB	-rw-r--r--
xt_DHCPMAC.c	4.18 KB	-rw-r--r--
xt_DHCPMAC.h	311 B	-rw-r--r--
xt_DNETMAP.c	25.22 KB	-rw-r--r--
xt_DNETMAP.h	402 B	-rw-r--r--
xt_ECHO.c	6.98 KB	-rw-r--r--
xt_IPMARK.c	2.75 KB	-rw-r--r--
xt_IPMARK.h	252 B	-rw-r--r--
xt_LOGMARK.c	3.96 KB	-rw-r--r--
xt_LOGMARK.h	209 B	-rw-r--r--
xt_SYSRQ.c	9.75 KB	-rw-r--r--
xt_TARPIT.c	14.94 KB	-rw-r--r--
xt_TARPIT.h	258 B	-rw-r--r--
xt_condition.c	6.75 KB	-rw-r--r--
xt_condition.h	276 B	-rw-r--r--
xt_fuzzy.c	4.65 KB	-rw-r--r--
xt_fuzzy.h	397 B	-rw-r--r--
xt_geoip.c	8.73 KB	-rw-r--r--
xt_geoip.h	1.34 KB	-rw-r--r--
xt_gradm.h	108 B	-rw-r--r--
xt_iface.c	3.32 KB	-rw-r--r--
xt_iface.h	596 B	-rw-r--r--
xt_ipp2p.c	23.63 KB	-rw-r--r--
xt_ipp2p.h	995 B	-rw-r--r--
xt_ipv4options.c	1.96 KB	-rw-r--r--
xt_ipv4options.h	581 B	-rw-r--r--
xt_length2.c	6.99 KB	-rw-r--r--
xt_length2.h	457 B	-rw-r--r--
xt_lscan.c	7.85 KB	-rw-r--r--
xt_lscan.h	200 B	-rw-r--r--
xt_psd.c	14.2 KB	-rw-r--r--
xt_psd.h	792 B	-rw-r--r--
xt_quota2.c	9 KB	-rw-r--r--
xt_quota2.h	478 B	-rw-r--r--

Code Editor : xt_length2.c

/*
 *	xt_length - Xtables module to match packet length
 *	Copyright © Jan Engelhardt , 2007 - 2009
 *
 *	This program is free software; you can redistribute it and/or
 *	modify it under the terms of the GNU General Public License; either
 *	version 2 of the License, or any later version, as published by the
 *	Free Software Foundation.
 */
#include <linux/dccp.h>
#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/icmp.h>
#include <linux/ip.h>
#include <linux/ipv6.h>
#include <linux/sctp.h>
#include <linux/tcp.h>
#include <linux/udp.h>
#include <net/ip.h>
#include <net/ipv6.h>
#include <linux/netfilter/x_tables.h>
#include <linux/netfilter_ipv6/ip6_tables.h>
#include "xt_length2.h"
#include "compat_xtables.h"
#if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
#	define WITH_IPV6 1
#endif
#ifndef NEXTHDR_IPV4
#	define NEXTHDR_IPV4 4
#endif

MODULE_AUTHOR("Jan Engelhardt ");
MODULE_DESCRIPTION("Xtables: Packet length (Layer3,4,5) match");
MODULE_LICENSE("GPL");
MODULE_ALIAS("ipt_length2");
MODULE_ALIAS("ip6t_length2");

static bool
xtlength_layer5_tcp(unsigned int *length, const struct sk_buff *skb,
                    unsigned int offset)
{
	const struct tcphdr *tcph;
	struct tcphdr buf;

tcph = skb_header_pointer(skb, offset, sizeof(buf), &buf);
	if (tcph == NULL)
		return false;

*length = skb->len - offset;
	if (*length >= 4 * tcph->doff)
		*length -= 4 * tcph->doff;
	return true;
}

static bool
xtlength_layer5_dccp(unsigned int *length, const struct sk_buff *skb,
                     unsigned int offset)
{
	const struct dccp_hdr *dh;
	struct dccp_hdr dhbuf;

dh = skb_header_pointer(skb, offset, sizeof(dhbuf), &dhbuf);
	if (dh == NULL)
		return false;

*length = skb->len - offset;
	if (*length >= 4 * dh->dccph_doff)
		*length -= 4 * dh->dccph_doff;
	return true;
}

static inline bool
xtlength_layer5(unsigned int *length, const struct sk_buff *skb,
                unsigned int prot, unsigned int offset)
{
	switch (prot) {
	case IPPROTO_TCP:
		return xtlength_layer5_tcp(length, skb, offset);
	case IPPROTO_UDP:
	case IPPROTO_UDPLITE:
		*length = skb->len - offset - sizeof(struct udphdr);
		return true;
	case IPPROTO_SCTP:
		*length = skb->len - offset - sizeof(struct sctphdr);
		return true;
	case IPPROTO_DCCP:
		return xtlength_layer5_dccp(length, skb, offset);
	case IPPROTO_ICMP:
		*length = skb->len - offset - sizeof(struct icmphdr);
		return true;
	case IPPROTO_ICMPV6:
		*length = skb->len - offset -
		          offsetof(struct icmp6hdr, icmp6_dataun);
		return true;
	case IPPROTO_AH:
		*length = skb->len - offset - sizeof(struct ip_auth_hdr);
		return true;
	case IPPROTO_ESP:
		*length = skb->len - offset - sizeof(struct ip_esp_hdr);
		return true;
	}
	return false;
}

static bool
xtlength_layer7_sctp(unsigned int *length, const struct sk_buff *skb,
                     unsigned int offset)
{
	const struct sctp_chunkhdr *ch;
	struct sctp_chunkhdr chbuf;
	unsigned int pos;

*length = 0;
	for (pos = sizeof(struct sctphdr); pos < skb->len;
	     pos += ntohs(ch->length))
	{
		ch = skb_header_pointer(skb, offset + pos,
		     sizeof(chbuf), &chbuf);
		if (ch == NULL)
			return false;
		if (ch->type != SCTP_CID_DATA)
			continue;
		*length += ntohs(ch->length);
	}
	return true;
}

static bool xtlength_layer7(unsigned int *length, const struct sk_buff *skb,
                            unsigned int proto, unsigned int offset)
{
	switch (proto) {
	case IPPROTO_SCTP:
		return xtlength_layer7_sctp(length, skb, offset);
	default:
		return xtlength_layer5(length, skb, proto, offset);
	}
}

static bool
length2_mt(const struct sk_buff *skb, struct xt_action_param *par)
{
	const struct xt_length_mtinfo2 *info = par->matchinfo;
	const struct iphdr *iph = ip_hdr(skb);
	unsigned int len = 0;
	bool hit = true;

if (info->flags & XT_LENGTH_LAYER3)
		len = ntohs(iph->tot_len);
	else if (info->flags & XT_LENGTH_LAYER4)
		len = ntohs(iph->tot_len) - par->thoff;
	else if (info->flags & XT_LENGTH_LAYER5)
		hit = xtlength_layer5(&len, skb, iph->protocol, par->thoff);
	else if (info->flags & XT_LENGTH_LAYER7)
		hit = xtlength_layer7(&len, skb, iph->protocol, par->thoff);
	if (!hit)
		return false;

return (len >= info->min && len <= info->max) ^
	       !!(info->flags & XT_LENGTH_INVERT);
}

#ifdef WITH_IPV6
/**
 * llayer4_proto - figure out the L4 protocol in an IPv6 packet
 * @skb:	skb pointer
 * @offset:	position at which L4 starts (equal to 'protoff' in IPv4 code)
 * @hotdrop:	hotdrop pointer
 *
 * Searches for a recognized L4 header. On success, fills in @offset and
 * returns the protocol number. If not found, %NEXTHDR_MAX is returned.
 * On error, @hotdrop is set.
 */
static unsigned int
llayer4_proto(const struct sk_buff *skb, unsigned int *offset, bool *hotdrop)
{
	/*
	 * Do encapsulation first so that %NEXTHDR_TCP does not hit the TCP
	 * part in an IPv6-in-IPv6 encapsulation.
	 */
	static const unsigned int types[] =
		{IPPROTO_IPV6, IPPROTO_IPIP, IPPROTO_ESP, IPPROTO_AH,
		IPPROTO_ICMP, IPPROTO_TCP, IPPROTO_UDP, IPPROTO_UDPLITE,
		IPPROTO_SCTP, IPPROTO_DCCP};
	unsigned int i;
	int err;

for (i = 0; i < ARRAY_SIZE(types); ++i) {
		err = ipv6_find_hdr(skb, offset, types[i], NULL, NULL);
		if (err >= 0)
			return types[i];
		if (err != -ENOENT) {
			*hotdrop = true;
			break;
		}
	}

return NEXTHDR_MAX;
}

static bool
length2_mt6(const struct sk_buff *skb, struct xt_action_param *par)
{
	const struct xt_length_mtinfo2 *info = par->matchinfo;
	const struct ipv6hdr *iph = ipv6_hdr(skb);
	unsigned int len = 0, l4proto;
	/* par->thoff would only set if ip6tables -p was used; so just use 0 */
	unsigned int thoff = 0;
	bool hit = true;

if (info->flags & XT_LENGTH_LAYER3) {
		if (iph->payload_len == 0)
			/* Jumbogram */
			len = skb->len;
		else
			len = sizeof(struct ipv6hdr) + ntohs(iph->payload_len);
	} else {
		l4proto = llayer4_proto(skb, &thoff, &par->hotdrop);
		if (l4proto == NEXTHDR_MAX)
			return false;
		if (info->flags & XT_LENGTH_LAYER4)
			len = skb->len - thoff;
		else if (info->flags & XT_LENGTH_LAYER5)
			hit = xtlength_layer5(&len, skb, l4proto, thoff);
		else if (info->flags & XT_LENGTH_LAYER7)
			hit = xtlength_layer7(&len, skb, l4proto, thoff);
	}
	if (!hit)
		return false;

return (len >= info->min && len <= info->max) ^
	       !!(info->flags & XT_LENGTH_INVERT);
}
#endif

static struct xt_match length2_mt_reg[] __read_mostly = {
	{
		.name           = "length2",
		.revision       = 2,
		.family         = NFPROTO_IPV4,
		.match          = length2_mt,
		.matchsize      = sizeof(struct xt_length_mtinfo2),
		.me             = THIS_MODULE,
	},
#ifdef WITH_IPV6
	{
		.name           = "length2",
		.revision       = 2,
		.family         = NFPROTO_IPV6,
		.match          = length2_mt6,
		.matchsize      = sizeof(struct xt_length_mtinfo2),
		.me             = THIS_MODULE,
	},
#endif
};

static int __init length2_mt_init(void)
{
	return xt_register_matches(length2_mt_reg, ARRAY_SIZE(length2_mt_reg));
}

static void __exit length2_mt_exit(void)
{
	xt_unregister_matches(length2_mt_reg, ARRAY_SIZE(length2_mt_reg));
}

module_init(length2_mt_init);
module_exit(length2_mt_exit);

${this.title}

Code Editor : xt_length2.c