Open Port match
Subsystems (2)
PATCH 1/1 Open Port match
Ssokolow asked for this. Someone can enhance to cover UDP and put in patch-o-matic if they're enthusiastic about it.
Works for me!
Rusty.
Signature · 1 line
A bad analogy is like a leaky screwdriver -- Richard Braakman
.open_port-test +2 -0
@@ -0,0 +1,2 @@ +#! /bin/sh +[ -f $KERNEL_DIR/include/linux/netfilter_ipv4/ipt_open_port.h ] && echo open_port
Property changes on: extensions/.open_port-test
___________________________________________________________________
Name: svn:executable
+ *
libipt_open_port.man +4 -0
@@ -0,0 +1,4 @@ +This allows you to match whether a TCP port is open to receive a +packet. You must specify "-p tcp" in your rule. This mathc takes no +options, can be inverted, and can currently only be used from the INPUT +chain.
libipt_open_port.c +67 -0
67 lines not on this page · raw message
include/linux/netfilter_ipv4/ipt_open_port.h new file +5 -0
@@ -0,0 +1,5 @@ +#ifndef _IPT_OPEN_PORT_H +#define _IPT_OPEN_PORT_H + +/* For future expansion, and to indicate that this extension exists. */ +#endif /*_IPT_OPEN_PORT_H */
net/ipv4/netfilter/Kconfig +10 -0
@@ -375,6 +375,16 @@ destination IP' or `500pps from any given source IP' with a single IPtables rule. +config IP_NF_MATCH_OPEN_PORT + tristate 'TCP open port match support' + depends on IP_NF_IPTABLES && EXPERIMENTAL + help + This option adds a new iptables `open_port' match. + + This matches TCP packets in the INPUT (LOCAL_IN) chain which + are headed for an open TCP port. Some users like to drop packets + which would otherwise simply generate TCP RST responses. + # `filter', generic and specific targets config IP_NF_FILTER tristate "Packet filtering"
net/ipv4/netfilter/Makefile +1 -0
@@ -59,6 +59,7 @@ obj-$(CONFIG_IP_NF_MATCH_ADDRTYPE) += ipt_addrtype.o obj-$(CONFIG_IP_NF_MATCH_PHYSDEV) += ipt_physdev.o obj-$(CONFIG_IP_NF_MATCH_COMMENT) += ipt_comment.o +obj-$(CONFIG_IP_NF_MATCH_OPEN_PORT) += ipt_open_port.o # targets obj-$(CONFIG_IP_NF_TARGET_REJECT) += ipt_REJECT.o
net/ipv4/netfilter/ipt_open_port.c new file +111 -0
111 lines not on this page · raw message
Hello,
This is starting to make me wonder.
Why do we all duplicate similar checks for packet validity in netfilter matches?
Should not we move this into functions like:
int skb_is_fine(struct sk_buff *sk,...)
int th_is_fine(struct tcphdr, ...)
int uh_is_fine(struct udphdr, ...)
int ih_is_fine(struct icmphdr, ...)
And use them consistenly throughout the matches?
if (!th_is_fine(th))
goto dropit;I am refering to code like below:
+ /* If we don't have the whole header, drop packet. */
+ th = skb_header_pointer(skb, skb->nh.iph->ihl * 4,
+ sizeof(_tcph), &_tcph);
+ if (th == NULL)
+ goto dropit;
+
+ /* Malformed. */
+ if (th->doff*4 < sizeof(*th))
+ goto dropit;
+
It would give less duplication, less occasions to make a mistake and more readable code, no need for lots of comments around.
--
Regards,
Maciej
Quoted 2 lines · Rusty Russell
Ssokolow asked for this. Someone can enhance to cover UDP and put in patch-o-matic if they're enthusiastic about it.
I think this feature should be added to the owner match. I have a couple of patches coming up that add hooks to the protocols, which get the socket as argument. This gets rid of exporting the lookup-functions. I'll post them within the next couple of days.
Regards
Patrick