diff --git a/src/common/types.h b/src/common/types.h index c02477b..23ada6a 100644 --- a/src/common/types.h +++ b/src/common/types.h @@ -33,11 +33,17 @@ struct filter_tcp { unsigned int enabled : 1; - unsigned int do_sport : 1; - u16 sport; + unsigned int do_sport_min : 1; + u16 sport_min; - unsigned int do_dport : 1; - u16 dport; + unsigned int do_sport_max : 1; + u16 sport_max; + + unsigned int do_dport_min : 1; + u16 dport_min; + + unsigned int do_dport_max : 1; + u16 dport_max; // TCP flags. unsigned int do_urg : 1; @@ -69,11 +75,17 @@ struct filter_udp { unsigned int enabled : 1; - unsigned int do_sport : 1; - u16 sport; + unsigned int do_sport_min : 1; + u16 sport_min; - unsigned int do_dport : 1; - u16 dport; + unsigned int do_sport_max : 1; + u16 sport_max; + + unsigned int do_dport_min : 1; + u16 dport_min; + + unsigned int do_dport_max : 1; + u16 dport_max; } typedef filter_udp_t; struct filter_icmp diff --git a/src/loader/utils/xdp.c b/src/loader/utils/xdp.c index a736d12..4e762cb 100644 --- a/src/loader/utils/xdp.c +++ b/src/loader/utils/xdp.c @@ -231,6 +231,11 @@ int update_filter(int map_filters, filter_rule_cfg_t* filter_cfg, int idx) filter_t filter = {0}; filter.set = filter_cfg->set; + + if (!filter_cfg->enabled) + { + return 0; + } if (filter_cfg->enabled > -1) { @@ -340,18 +345,26 @@ int update_filter(int map_filters, filter_rule_cfg_t* filter_cfg, int idx) filter.tcp.enabled = filter_cfg->tcp.enabled; } - if (filter_cfg->tcp.sport > -1) - { - filter.tcp.do_sport = 1; + port_range_t tcp_src_port_range = parse_port_range(filter_cfg->tcp.sport); - filter.tcp.sport = htons((u16)filter_cfg->tcp.sport); + if (tcp_src_port_range.success) + { + filter.tcp.do_sport_min = 1; + filter.tcp.do_sport_max = 1; + + filter.tcp.sport_min = htons(tcp_src_port_range.min); + filter.tcp.sport_max = htons(tcp_src_port_range.max); } - if (filter_cfg->tcp.dport > -1) - { - filter.tcp.do_dport = 1; + port_range_t tcp_dst_port_range = parse_port_range(filter_cfg->tcp.dport); - filter.tcp.dport = htons((u16)filter_cfg->tcp.dport); + if (tcp_dst_port_range.success) + { + filter.tcp.do_dport_min = 1; + filter.tcp.do_dport_max = 1; + + filter.tcp.dport_min = htons(tcp_dst_port_range.min); + filter.tcp.dport_max = htons(tcp_dst_port_range.max); } if (filter_cfg->tcp.urg > -1) @@ -415,18 +428,26 @@ int update_filter(int map_filters, filter_rule_cfg_t* filter_cfg, int idx) filter.udp.enabled = filter_cfg->udp.enabled; } - if (filter_cfg->udp.sport > -1) - { - filter.udp.do_sport = 1; + port_range_t udp_src_port_range = parse_port_range(filter_cfg->udp.sport); - filter.udp.sport = htons((u16)filter_cfg->udp.sport); + if (udp_src_port_range.success) + { + filter.udp.do_sport_min = 1; + filter.udp.do_sport_max = 1; + + filter.udp.sport_min = htons(udp_src_port_range.min); + filter.udp.sport_max = htons(udp_src_port_range.max); } - if (filter_cfg->udp.dport > -1) - { - filter.udp.do_dport = 1; + port_range_t udp_dst_port_range = parse_port_range(filter_cfg->udp.dport); - filter.udp.dport = htons((u16)filter_cfg->udp.dport); + if (udp_dst_port_range.success) + { + filter.udp.do_dport_min = 1; + filter.udp.do_dport_max = 1; + + filter.udp.dport_min = htons(udp_dst_port_range.min); + filter.udp.dport_max = htons(udp_dst_port_range.max); } if (filter_cfg->icmp.enabled > -1) diff --git a/src/xdp/prog.c b/src/xdp/prog.c index d88461d..184d773 100644 --- a/src/xdp/prog.c +++ b/src/xdp/prog.c @@ -446,14 +446,24 @@ int xdp_prog_main(struct xdp_md *ctx) continue; } - // Source port. - if (filter->tcp.do_sport && filter->tcp.sport != tcph->source) + // Source port checks. + if (filter->tcp.do_sport_min && tcph->source < filter->tcp.sport_min) { continue; } - // Destination port. - if (filter->tcp.do_dport && filter->tcp.dport != tcph->dest) + if (filter->tcp.do_sport_max && tcph->source > filter->tcp.sport_max) + { + continue; + } + + // Destination port checks. + if (filter->tcp.do_dport_min && tcph->dest < filter->tcp.dport_min) + { + continue; + } + + if (filter->tcp.do_dport_max && tcph->dest > filter->tcp.dport_max) { continue; } @@ -513,16 +523,25 @@ int xdp_prog_main(struct xdp_md *ctx) continue; } - // Source port. - if (filter->udp.do_sport && filter->udp.sport != udph->source) + // Source port checks. + if (filter->udp.do_sport_min && udph->source < filter->udp.sport_min) { continue; } - // Destination port. - if (filter->udp.do_dport && filter->udp.dport != udph->dest) + if (filter->udp.do_sport_max && udph->source > filter->udp.sport_max) { + continue; + } + // Destination port checks. + if (filter->udp.do_dport_min && udph->source < filter->udp.dport_min) + { + continue; + } + + if (filter->udp.do_dport_max && udph->source > filter->udp.dport_max) + { continue; } }