| /* ebt_ip |
| * |
| * Authors: |
| * Bart De Schuymer <bdschuym@pandora.be> |
| * |
| * Changes: |
| * added ip-sport and ip-dport; parsing of port arguments is |
| * based on code from iptables-1.2.7a |
| * Innominate Security Technologies AG <mhopf@innominate.com> |
| * September, 2002 |
| */ |
| |
| #include <stdio.h> |
| #include <stdlib.h> |
| #include <string.h> |
| #include <getopt.h> |
| #include <netdb.h> |
| #include "../include/ebtables_u.h" |
| #include <linux/netfilter_bridge/ebt_ip.h> |
| |
| #define IP_SOURCE '1' |
| #define IP_DEST '2' |
| #define IP_myTOS '3' /* include/bits/in.h seems to already define IP_TOS */ |
| #define IP_PROTO '4' |
| #define IP_SPORT '5' |
| #define IP_DPORT '6' |
| #define IP_ICMP '7' |
| #define IP_IGMP '8' |
| |
| static const struct option opts[] = |
| { |
| { "ip-source" , required_argument, 0, IP_SOURCE }, |
| { "ip-src" , required_argument, 0, IP_SOURCE }, |
| { "ip-destination" , required_argument, 0, IP_DEST }, |
| { "ip-dst" , required_argument, 0, IP_DEST }, |
| { "ip-tos" , required_argument, 0, IP_myTOS }, |
| { "ip-protocol" , required_argument, 0, IP_PROTO }, |
| { "ip-proto" , required_argument, 0, IP_PROTO }, |
| { "ip-source-port" , required_argument, 0, IP_SPORT }, |
| { "ip-sport" , required_argument, 0, IP_SPORT }, |
| { "ip-destination-port" , required_argument, 0, IP_DPORT }, |
| { "ip-dport" , required_argument, 0, IP_DPORT }, |
| { "ip-icmp-type" , required_argument, 0, IP_ICMP }, |
| { "ip-igmp-type" , required_argument, 0, IP_IGMP }, |
| { 0 } |
| }; |
| |
| static const struct ebt_icmp_names icmp_codes[] = { |
| { "echo-reply", 0, 0, 0xFF }, |
| /* Alias */ { "pong", 0, 0, 0xFF }, |
| |
| { "destination-unreachable", 3, 0, 0xFF }, |
| { "network-unreachable", 3, 0, 0 }, |
| { "host-unreachable", 3, 1, 1 }, |
| { "protocol-unreachable", 3, 2, 2 }, |
| { "port-unreachable", 3, 3, 3 }, |
| { "fragmentation-needed", 3, 4, 4 }, |
| { "source-route-failed", 3, 5, 5 }, |
| { "network-unknown", 3, 6, 6 }, |
| { "host-unknown", 3, 7, 7 }, |
| { "network-prohibited", 3, 9, 9 }, |
| { "host-prohibited", 3, 10, 10 }, |
| { "TOS-network-unreachable", 3, 11, 11 }, |
| { "TOS-host-unreachable", 3, 12, 12 }, |
| { "communication-prohibited", 3, 13, 13 }, |
| { "host-precedence-violation", 3, 14, 14 }, |
| { "precedence-cutoff", 3, 15, 15 }, |
| |
| { "source-quench", 4, 0, 0xFF }, |
| |
| { "redirect", 5, 0, 0xFF }, |
| { "network-redirect", 5, 0, 0 }, |
| { "host-redirect", 5, 1, 1 }, |
| { "TOS-network-redirect", 5, 2, 2 }, |
| { "TOS-host-redirect", 5, 3, 3 }, |
| |
| { "echo-request", 8, 0, 0xFF }, |
| /* Alias */ { "ping", 8, 0, 0xFF }, |
| |
| { "router-advertisement", 9, 0, 0xFF }, |
| |
| { "router-solicitation", 10, 0, 0xFF }, |
| |
| { "time-exceeded", 11, 0, 0xFF }, |
| /* Alias */ { "ttl-exceeded", 11, 0, 0xFF }, |
| { "ttl-zero-during-transit", 11, 0, 0 }, |
| { "ttl-zero-during-reassembly", 11, 1, 1 }, |
| |
| { "parameter-problem", 12, 0, 0xFF }, |
| { "ip-header-bad", 12, 0, 0 }, |
| { "required-option-missing", 12, 1, 1 }, |
| |
| { "timestamp-request", 13, 0, 0xFF }, |
| |
| { "timestamp-reply", 14, 0, 0xFF }, |
| |
| { "address-mask-request", 17, 0, 0xFF }, |
| |
| { "address-mask-reply", 18, 0, 0xFF } |
| }; |
| |
| static const struct ebt_icmp_names igmp_types[] = { |
| { "membership-query", 0x11 }, |
| { "membership-report-v1", 0x12 }, |
| { "membership-report-v2", 0x16 }, |
| { "leave-group", 0x17 }, |
| { "membership-report-v3", 0x22 }, |
| }; |
| |
| /* put the mask into 4 bytes */ |
| /* transform a protocol and service name into a port number */ |
| static uint16_t parse_port(const char *protocol, const char *name) |
| { |
| struct servent *service; |
| char *end; |
| int port; |
| |
| port = strtol(name, &end, 10); |
| if (*end != '\0') { |
| if (protocol && |
| (service = getservbyname(name, protocol)) != NULL) |
| return ntohs(service->s_port); |
| } |
| else if (port >= 0 || port <= 0xFFFF) { |
| return port; |
| } |
| ebt_print_error("Problem with specified %s port '%s'", |
| protocol?protocol:"", name); |
| return 0; |
| } |
| |
| static void |
| parse_port_range(const char *protocol, const char *portstring, uint16_t *ports) |
| { |
| char *buffer; |
| char *cp; |
| |
| buffer = strdup(portstring); |
| if ((cp = strchr(buffer, ':')) == NULL) |
| ports[0] = ports[1] = parse_port(protocol, buffer); |
| else { |
| *cp = '\0'; |
| cp++; |
| ports[0] = buffer[0] ? parse_port(protocol, buffer) : 0; |
| if (ebt_errormsg[0] != '\0') |
| return; |
| ports[1] = cp[0] ? parse_port(protocol, cp) : 0xFFFF; |
| if (ebt_errormsg[0] != '\0') |
| return; |
| |
| if (ports[0] > ports[1]) |
| ebt_print_error("Invalid portrange (min > max)"); |
| } |
| free(buffer); |
| } |
| |
| static void print_port_range(uint16_t *ports) |
| { |
| if (ports[0] == ports[1]) |
| printf("%d ", ports[0]); |
| else |
| printf("%d:%d ", ports[0], ports[1]); |
| } |
| |
| static void print_help() |
| { |
| printf( |
| "ip options:\n" |
| "--ip-src [!] address[/mask]: ip source specification\n" |
| "--ip-dst [!] address[/mask]: ip destination specification\n" |
| "--ip-tos [!] tos : ip tos specification\n" |
| "--ip-proto [!] protocol : ip protocol specification\n" |
| "--ip-sport [!] port[:port] : tcp/udp source port or port range\n" |
| "--ip-dport [!] port[:port] : tcp/udp destination port or port range\n" |
| "--ip-icmp-type [!] type[[:type]/code[:code]] : icmp type/code or type/code range\n" |
| "--ip-igmp-type [!] type[:type] : igmp type or type range\n"); |
| |
| printf("\nValid ICMP Types:\n"); |
| ebt_print_icmp_types(icmp_codes, ARRAY_SIZE(icmp_codes)); |
| printf("\nValid IGMP Types:\n"); |
| ebt_print_icmp_types(igmp_types, ARRAY_SIZE(igmp_types)); |
| } |
| |
| static void init(struct ebt_entry_match *match) |
| { |
| struct ebt_ip_info *ipinfo = (struct ebt_ip_info *)match->data; |
| |
| ipinfo->invflags = 0; |
| ipinfo->bitmask = 0; |
| } |
| |
| #define OPT_SOURCE 0x01 |
| #define OPT_DEST 0x02 |
| #define OPT_TOS 0x04 |
| #define OPT_PROTO 0x08 |
| #define OPT_SPORT 0x10 |
| #define OPT_DPORT 0x20 |
| #define OPT_ICMP 0x40 |
| #define OPT_IGMP 0x80 |
| static int parse(int c, char **argv, int argc, const struct ebt_u_entry *entry, |
| unsigned int *flags, struct ebt_entry_match **match) |
| { |
| struct ebt_ip_info *ipinfo = (struct ebt_ip_info *)(*match)->data; |
| char *end; |
| long int i; |
| |
| switch (c) { |
| case IP_SOURCE: |
| ebt_check_option2(flags, OPT_SOURCE); |
| ipinfo->bitmask |= EBT_IP_SOURCE; |
| |
| case IP_DEST: |
| if (c == IP_DEST) { |
| ebt_check_option2(flags, OPT_DEST); |
| ipinfo->bitmask |= EBT_IP_DEST; |
| } |
| if (ebt_check_inverse2(optarg)) { |
| if (c == IP_SOURCE) |
| ipinfo->invflags |= EBT_IP_SOURCE; |
| else |
| ipinfo->invflags |= EBT_IP_DEST; |
| } |
| if (c == IP_SOURCE) |
| ebt_parse_ip_address(optarg, &ipinfo->saddr, &ipinfo->smsk); |
| else |
| ebt_parse_ip_address(optarg, &ipinfo->daddr, &ipinfo->dmsk); |
| break; |
| |
| case IP_SPORT: |
| case IP_DPORT: |
| if (c == IP_SPORT) { |
| ebt_check_option2(flags, OPT_SPORT); |
| ipinfo->bitmask |= EBT_IP_SPORT; |
| if (ebt_check_inverse2(optarg)) |
| ipinfo->invflags |= EBT_IP_SPORT; |
| } else { |
| ebt_check_option2(flags, OPT_DPORT); |
| ipinfo->bitmask |= EBT_IP_DPORT; |
| if (ebt_check_inverse2(optarg)) |
| ipinfo->invflags |= EBT_IP_DPORT; |
| } |
| if (c == IP_SPORT) |
| parse_port_range(NULL, optarg, ipinfo->sport); |
| else |
| parse_port_range(NULL, optarg, ipinfo->dport); |
| break; |
| |
| case IP_ICMP: |
| ebt_check_option2(flags, OPT_ICMP); |
| ipinfo->bitmask |= EBT_IP_ICMP; |
| if (ebt_check_inverse2(optarg)) |
| ipinfo->invflags |= EBT_IP_ICMP; |
| if (ebt_parse_icmp(icmp_codes, ARRAY_SIZE(icmp_codes), optarg, |
| ipinfo->icmp_type, ipinfo->icmp_code)) |
| return 0; |
| break; |
| |
| case IP_IGMP: |
| ebt_check_option2(flags, OPT_IGMP); |
| ipinfo->bitmask |= EBT_IP_IGMP; |
| if (ebt_check_inverse2(optarg)) |
| ipinfo->invflags |= EBT_IP_IGMP; |
| if (ebt_parse_icmp(igmp_types, ARRAY_SIZE(igmp_types), optarg, |
| ipinfo->igmp_type, NULL)) |
| return 0; |
| break; |
| |
| case IP_myTOS: |
| ebt_check_option2(flags, OPT_TOS); |
| if (ebt_check_inverse2(optarg)) |
| ipinfo->invflags |= EBT_IP_TOS; |
| i = strtol(optarg, &end, 16); |
| if (i < 0 || i > 255 || *end != '\0') |
| ebt_print_error2("Problem with specified IP tos"); |
| ipinfo->tos = i; |
| ipinfo->bitmask |= EBT_IP_TOS; |
| break; |
| |
| case IP_PROTO: |
| ebt_check_option2(flags, OPT_PROTO); |
| if (ebt_check_inverse2(optarg)) |
| ipinfo->invflags |= EBT_IP_PROTO; |
| i = strtoul(optarg, &end, 10); |
| if (*end != '\0') { |
| struct protoent *pe; |
| |
| pe = getprotobyname(optarg); |
| if (pe == NULL) |
| ebt_print_error("Unknown specified IP protocol - %s", argv[optind - 1]); |
| ipinfo->protocol = pe->p_proto; |
| } else { |
| ipinfo->protocol = (unsigned char) i; |
| } |
| ipinfo->bitmask |= EBT_IP_PROTO; |
| break; |
| default: |
| return 0; |
| } |
| return 1; |
| } |
| |
| static void final_check(const struct ebt_u_entry *entry, |
| const struct ebt_entry_match *match, const char *name, |
| unsigned int hookmask, unsigned int time) |
| { |
| struct ebt_ip_info *ipinfo = (struct ebt_ip_info *)match->data; |
| |
| if (entry->ethproto != ETH_P_IP || entry->invflags & EBT_IPROTO) { |
| ebt_print_error("For IP filtering the protocol must be " |
| "specified as IPv4"); |
| } else if (ipinfo->bitmask & (EBT_IP_SPORT|EBT_IP_DPORT) && |
| (!(ipinfo->bitmask & EBT_IP_PROTO) || |
| ipinfo->invflags & EBT_IP_PROTO || |
| (ipinfo->protocol!=IPPROTO_TCP && |
| ipinfo->protocol!=IPPROTO_UDP && |
| ipinfo->protocol!=IPPROTO_SCTP && |
| ipinfo->protocol!=IPPROTO_DCCP))) { |
| ebt_print_error("For port filtering the IP protocol must be " |
| "either 6 (tcp), 17 (udp), 33 (dccp) or " |
| "132 (sctp)"); |
| } else if ((ipinfo->bitmask & EBT_IP_ICMP) && |
| (!(ipinfo->bitmask & EBT_IP_PROTO) || |
| ipinfo->invflags & EBT_IP_PROTO || |
| ipinfo->protocol != IPPROTO_ICMP)) { |
| ebt_print_error("For ICMP filtering the IP protocol must be " |
| "1 (icmp)"); |
| } else if ((ipinfo->bitmask & EBT_IP_IGMP) && |
| (!(ipinfo->bitmask & EBT_IP_PROTO) || |
| ipinfo->invflags & EBT_IP_PROTO || |
| ipinfo->protocol != IPPROTO_IGMP)) { |
| ebt_print_error("For IGMP filtering the IP protocol must be " |
| "2 (igmp)"); |
| } |
| } |
| |
| static void print(const struct ebt_u_entry *entry, |
| const struct ebt_entry_match *match) |
| { |
| struct ebt_ip_info *ipinfo = (struct ebt_ip_info *)match->data; |
| int j; |
| |
| if (ipinfo->bitmask & EBT_IP_SOURCE) { |
| printf("--ip-src "); |
| if (ipinfo->invflags & EBT_IP_SOURCE) |
| printf("! "); |
| for (j = 0; j < 4; j++) |
| printf("%d%s",((unsigned char *)&ipinfo->saddr)[j], |
| (j == 3) ? "" : "."); |
| printf("%s ", ebt_mask_to_dotted(ipinfo->smsk)); |
| } |
| if (ipinfo->bitmask & EBT_IP_DEST) { |
| printf("--ip-dst "); |
| if (ipinfo->invflags & EBT_IP_DEST) |
| printf("! "); |
| for (j = 0; j < 4; j++) |
| printf("%d%s", ((unsigned char *)&ipinfo->daddr)[j], |
| (j == 3) ? "" : "."); |
| printf("%s ", ebt_mask_to_dotted(ipinfo->dmsk)); |
| } |
| if (ipinfo->bitmask & EBT_IP_TOS) { |
| printf("--ip-tos "); |
| if (ipinfo->invflags & EBT_IP_TOS) |
| printf("! "); |
| printf("0x%02X ", ipinfo->tos); |
| } |
| if (ipinfo->bitmask & EBT_IP_PROTO) { |
| struct protoent *pe; |
| |
| printf("--ip-proto "); |
| if (ipinfo->invflags & EBT_IP_PROTO) |
| printf("! "); |
| pe = getprotobynumber(ipinfo->protocol); |
| if (pe == NULL) { |
| printf("%d ", ipinfo->protocol); |
| } else { |
| printf("%s ", pe->p_name); |
| } |
| } |
| if (ipinfo->bitmask & EBT_IP_SPORT) { |
| printf("--ip-sport "); |
| if (ipinfo->invflags & EBT_IP_SPORT) |
| printf("! "); |
| print_port_range(ipinfo->sport); |
| } |
| if (ipinfo->bitmask & EBT_IP_DPORT) { |
| printf("--ip-dport "); |
| if (ipinfo->invflags & EBT_IP_DPORT) |
| printf("! "); |
| print_port_range(ipinfo->dport); |
| } |
| if (ipinfo->bitmask & EBT_IP_ICMP) { |
| printf("--ip-icmp-type "); |
| if (ipinfo->invflags & EBT_IP_ICMP) |
| printf("! "); |
| ebt_print_icmp_type(icmp_codes, ARRAY_SIZE(icmp_codes), |
| ipinfo->icmp_type, ipinfo->icmp_code); |
| } |
| if (ipinfo->bitmask & EBT_IP_IGMP) { |
| printf("--ip-igmp-type "); |
| if (ipinfo->invflags & EBT_IP_IGMP) |
| printf("! "); |
| ebt_print_icmp_type(igmp_types, ARRAY_SIZE(igmp_types), |
| ipinfo->igmp_type, NULL); |
| } |
| } |
| |
| static int compare(const struct ebt_entry_match *m1, |
| const struct ebt_entry_match *m2) |
| { |
| struct ebt_ip_info *ipinfo1 = (struct ebt_ip_info *)m1->data; |
| struct ebt_ip_info *ipinfo2 = (struct ebt_ip_info *)m2->data; |
| |
| if (ipinfo1->bitmask != ipinfo2->bitmask) |
| return 0; |
| if (ipinfo1->invflags != ipinfo2->invflags) |
| return 0; |
| if (ipinfo1->bitmask & EBT_IP_SOURCE) { |
| if (ipinfo1->saddr != ipinfo2->saddr) |
| return 0; |
| if (ipinfo1->smsk != ipinfo2->smsk) |
| return 0; |
| } |
| if (ipinfo1->bitmask & EBT_IP_DEST) { |
| if (ipinfo1->daddr != ipinfo2->daddr) |
| return 0; |
| if (ipinfo1->dmsk != ipinfo2->dmsk) |
| return 0; |
| } |
| if (ipinfo1->bitmask & EBT_IP_TOS) { |
| if (ipinfo1->tos != ipinfo2->tos) |
| return 0; |
| } |
| if (ipinfo1->bitmask & EBT_IP_PROTO) { |
| if (ipinfo1->protocol != ipinfo2->protocol) |
| return 0; |
| } |
| if (ipinfo1->bitmask & EBT_IP_SPORT) { |
| if (ipinfo1->sport[0] != ipinfo2->sport[0] || |
| ipinfo1->sport[1] != ipinfo2->sport[1]) |
| return 0; |
| } |
| if (ipinfo1->bitmask & EBT_IP_DPORT) { |
| if (ipinfo1->dport[0] != ipinfo2->dport[0] || |
| ipinfo1->dport[1] != ipinfo2->dport[1]) |
| return 0; |
| } |
| if (ipinfo1->bitmask & EBT_IP_ICMP) { |
| if (ipinfo1->icmp_type[0] != ipinfo2->icmp_type[0] || |
| ipinfo1->icmp_type[1] != ipinfo2->icmp_type[1] || |
| ipinfo1->icmp_code[0] != ipinfo2->icmp_code[0] || |
| ipinfo1->icmp_code[1] != ipinfo2->icmp_code[1]) |
| return 0; |
| } |
| if (ipinfo1->bitmask & EBT_IP_IGMP) { |
| if (ipinfo1->igmp_type[0] != ipinfo2->igmp_type[0] || |
| ipinfo1->igmp_type[1] != ipinfo2->igmp_type[1]) |
| return 0; |
| } |
| return 1; |
| } |
| |
| static struct ebt_u_match ip_match = |
| { |
| .name = "ip", |
| .size = sizeof(struct ebt_ip_info), |
| .help = print_help, |
| .init = init, |
| .parse = parse, |
| .final_check = final_check, |
| .print = print, |
| .compare = compare, |
| .extra_ops = opts, |
| }; |
| |
| static void _INIT(void) |
| { |
| ebt_register_match(&ip_match); |
| } |