iptables匹配multiport

multiport匹配帮助信息如下。multiport有三个选项。其中，–source-port（简写–sports）用于指定源端口，多个源端口使用逗号分隔，当指定源端口范围时，使用分号表示区间（port:port）。

选项–destination-ports（简写为–dports）用于指定目的端口。选项–ports可匹配源或者目的端口。

multiport仅支持带有端口号的协议，如tcp，udp，udplite，dccp和sctp。

# iptables -m multiport -h

multiport match options:
[!] --source-ports port[,port:port,port...]
 --sports ...
                                match source port(s)
[!] --destination-ports port[,port:port,port...]
 --dports ...
                                match destination port(s)
[!] --ports port[,port:port,port]
                                match both source and destination port(s)

如下策略，丢弃目的端口号：23,24,25以及135,136,137,138,139。在另外的主机上不能访问其中的任何一个端口。

# iptables -A INPUT -p tcp -m multiport --dports 23:25,135:139 -j DROP 
# 
# iptables -L -n -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    8   480 DROP       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 23:25,135:139

multiport匹配

函数xt_register_matches注册匹配结构multiport_mt_reg。

static struct xt_match multiport_mt_reg[] __read_mostly = {
    {   
        .name       = "multiport",
        .family     = NFPROTO_IPV4,
        .revision   = 1,
        .checkentry = multiport_mt_check,
        .match      = multiport_mt, 
        .matchsize  = sizeof(struct xt_multiport_v1),
        .me     = THIS_MODULE,
    },
    {   
        .name       = "multiport",
        .family     = NFPROTO_IPV6,
        .revision   = 1,
        .checkentry = multiport_mt6_check,
        .match      = multiport_mt, 
        .matchsize  = sizeof(struct xt_multiport_v1),
        .me     = THIS_MODULE,
    },
};
static int __init multiport_mt_init(void)
{
    return xt_register_matches(multiport_mt_reg,
           ARRAY_SIZE(multiport_mt_reg));

如下IPv4策略检测函数，首先协议必须合法；其次端口配置项数量不能超过15个（XT_MULTI_PORTS），注意，配置端口范围时占用2个配置项。

static inline bool
check(u_int16_t proto, u_int8_t ip_invflags, u_int8_t match_flags, u_int8_t count)
{
    /* Must specify supported protocol, no unknown flags or bad count */
    return (proto == IPPROTO_TCP || proto == IPPROTO_UDP
        || proto == IPPROTO_UDPLITE
        || proto == IPPROTO_SCTP || proto == IPPROTO_DCCP)
        && !(ip_invflags & XT_INV_PROTO)
        && (match_flags == XT_MULTIPORT_SOURCE
            || match_flags == XT_MULTIPORT_DESTINATION
            || match_flags == XT_MULTIPORT_EITHER)
        && count <= XT_MULTI_PORTS;
}
static int multiport_mt_check(const struct xt_mtchk_param *par)
{
    const struct ipt_ip *ip = par->entryinfo;
    const struct xt_multiport_v1 *multiinfo = par->matchinfo;

    return check(ip->proto, ip->invflags, multiinfo->flags,
             multiinfo->count) ? 0 : -EINVAL;

对于IPv6策略配置，同样使用以上的check判断函数。

static int multiport_mt6_check(const struct xt_mtchk_param *par)
{
    const struct ip6t_ip6 *ip = par->entryinfo;
    const struct xt_multiport_v1 *multiinfo = par->matchinfo;

    return check(ip->proto, ip->invflags, multiinfo->flags,
             multiinfo->count) ? 0 : -EINVAL;

匹配处理函数multiport_mt，对于非首个分片报文，由于可能没有四层头部信息，认为不匹配。否则，获取四层报文开始位置，有函数ports_match_v1进行处理。

static bool
multiport_mt(const struct sk_buff *skb, struct xt_action_param *par)
{
    const __be16 *pptr;
    __be16 _ports[2];
    const struct xt_multiport_v1 *multiinfo = par->matchinfo;

    if (par->fragoff != 0)
        return false;

    pptr = skb_header_pointer(skb, par->thoff, sizeof(_ports), _ports);
    if (pptr == NULL) {
        /* We've been asked to examine this packet, and we
         * can't.  Hence, no choice but to drop.
         */
        pr_debug("Dropping evil offset=0 tinygram.\n");
        par->hotdrop = true;
        return false;
    }

    return ports_match_v1(multiinfo, ntohs(pptr[0]), ntohs(pptr[1]));

遍历策略中配置的所有端口。

static inline bool
ports_match_v1(const struct xt_multiport_v1 *minfo,
           u_int16_t src, u_int16_t dst)
{
    unsigned int i;
    u_int16_t s, e;

    for (i = 0; i < minfo->count; i++) {
        s = minfo->ports[i];

首先处理配置的端口范围项，对于源端口检查，判断是否在配置的源端口范围内；对于目的端口检查，判断是否在配置的目的端口范围内。在不指定源/目的端口的情况下，只要端口位于源端口范围或者目的端口范围之内，都是匹配的。

        if (minfo->pflags[i]) {
            /* range port matching */
            e = minfo->ports[++i];
            pr_debug("src or dst matches with %d-%d?\n", s, e);

            switch (minfo->flags) {
            case XT_MULTIPORT_SOURCE:
                if (src >= s && src <= e)
                    return true ^ minfo->invert;
                break;
            case XT_MULTIPORT_DESTINATION:
                if (dst >= s && dst <= e)
                    return true ^ minfo->invert;
                break;
            case XT_MULTIPORT_EITHER:
                if ((dst >= s && dst <= e) ||
                    (src >= s && src <= e))
                    return true ^ minfo->invert;
                break;
            default:
                break;
            }

以下处理非范围的端口号匹配，判断是否相等即可。

        } else {
            /* exact port matching */
            pr_debug("src or dst matches with %d?\n", s);

            switch (minfo->flags) {
            case XT_MULTIPORT_SOURCE:
                if (src == s)
                    return true ^ minfo->invert;
                break;
            case XT_MULTIPORT_DESTINATION:
                if (dst == s)
                    return true ^ minfo->invert;
                break;
            case XT_MULTIPORT_EITHER:
                if (src == s || dst == s)
                    return true ^ minfo->invert;
                break;
            default:
                break;
            }
        }
    }
    return minfo->invert;

内核版本 5.10