| /* |
| * Copyright (c) 2005-2013 Patrick McHardy <kaber@trash.net> |
| */ |
| |
| #include <stdbool.h> |
| #include <stdint.h> |
| #include <stdio.h> |
| #include <string.h> |
| #include <netdb.h> |
| #include <xtables.h> |
| #include <linux/netfilter/xt_policy.h> |
| |
| enum { |
| O_DIRECTION = 0, |
| O_POLICY, |
| O_STRICT, |
| O_REQID, |
| O_SPI, |
| O_PROTO, |
| O_MODE, |
| O_TUNNELSRC, |
| O_TUNNELDST, |
| O_NEXT, |
| F_STRICT = 1 << O_STRICT, |
| }; |
| |
| static void policy_help(void) |
| { |
| printf( |
| "policy match options:\n" |
| " --dir in|out match policy applied during decapsulation/\n" |
| " policy to be applied during encapsulation\n" |
| " --pol none|ipsec match policy\n" |
| " --strict match entire policy instead of single element\n" |
| " at any position\n" |
| "These options may be used repeatedly, to describe policy elements:\n" |
| "[!] --reqid reqid match reqid\n" |
| "[!] --spi spi match SPI\n" |
| "[!] --proto proto match protocol (ah/esp/ipcomp)\n" |
| "[!] --mode mode match mode (transport/tunnel)\n" |
| "[!] --tunnel-src addr/mask match tunnel source\n" |
| "[!] --tunnel-dst addr/mask match tunnel destination\n" |
| " --next begin next element in policy\n"); |
| } |
| |
| static const struct xt_option_entry policy_opts[] = { |
| {.name = "dir", .id = O_DIRECTION, .type = XTTYPE_STRING}, |
| {.name = "pol", .id = O_POLICY, .type = XTTYPE_STRING}, |
| {.name = "strict", .id = O_STRICT, .type = XTTYPE_NONE}, |
| {.name = "reqid", .id = O_REQID, .type = XTTYPE_UINT32, |
| .flags = XTOPT_MULTI | XTOPT_INVERT}, |
| {.name = "spi", .id = O_SPI, .type = XTTYPE_UINT32, |
| .flags = XTOPT_MULTI | XTOPT_INVERT}, |
| {.name = "tunnel-src", .id = O_TUNNELSRC, .type = XTTYPE_HOSTMASK, |
| .flags = XTOPT_MULTI | XTOPT_INVERT}, |
| {.name = "tunnel-dst", .id = O_TUNNELDST, .type = XTTYPE_HOSTMASK, |
| .flags = XTOPT_MULTI | XTOPT_INVERT}, |
| {.name = "proto", .id = O_PROTO, .type = XTTYPE_PROTOCOL, |
| .flags = XTOPT_MULTI | XTOPT_INVERT}, |
| {.name = "mode", .id = O_MODE, .type = XTTYPE_STRING, |
| .flags = XTOPT_MULTI | XTOPT_INVERT}, |
| {.name = "next", .id = O_NEXT, .type = XTTYPE_NONE, |
| .flags = XTOPT_MULTI, .also = F_STRICT}, |
| XTOPT_TABLEEND, |
| }; |
| |
| static int parse_direction(const char *s) |
| { |
| if (strcmp(s, "in") == 0) |
| return XT_POLICY_MATCH_IN; |
| if (strcmp(s, "out") == 0) |
| return XT_POLICY_MATCH_OUT; |
| xtables_error(PARAMETER_PROBLEM, "policy_match: invalid dir \"%s\"", s); |
| } |
| |
| static int parse_policy(const char *s) |
| { |
| if (strcmp(s, "none") == 0) |
| return XT_POLICY_MATCH_NONE; |
| if (strcmp(s, "ipsec") == 0) |
| return 0; |
| xtables_error(PARAMETER_PROBLEM, "policy match: invalid policy \"%s\"", s); |
| } |
| |
| static int parse_mode(const char *s) |
| { |
| if (strcmp(s, "transport") == 0) |
| return XT_POLICY_MODE_TRANSPORT; |
| if (strcmp(s, "tunnel") == 0) |
| return XT_POLICY_MODE_TUNNEL; |
| xtables_error(PARAMETER_PROBLEM, "policy match: invalid mode \"%s\"", s); |
| } |
| |
| static void policy_parse(struct xt_option_call *cb) |
| { |
| struct xt_policy_info *info = cb->data; |
| struct xt_policy_elem *e = &info->pol[info->len]; |
| |
| xtables_option_parse(cb); |
| switch (cb->entry->id) { |
| case O_DIRECTION: |
| info->flags |= parse_direction(cb->arg); |
| break; |
| case O_POLICY: |
| info->flags |= parse_policy(cb->arg); |
| break; |
| case O_STRICT: |
| info->flags |= XT_POLICY_MATCH_STRICT; |
| break; |
| case O_REQID: |
| if (e->match.reqid) |
| xtables_error(PARAMETER_PROBLEM, |
| "policy match: double --reqid option"); |
| e->match.reqid = 1; |
| e->invert.reqid = cb->invert; |
| e->reqid = cb->val.u32; |
| break; |
| case O_SPI: |
| if (e->match.spi) |
| xtables_error(PARAMETER_PROBLEM, |
| "policy match: double --spi option"); |
| e->match.spi = 1; |
| e->invert.spi = cb->invert; |
| e->spi = cb->val.u32; |
| break; |
| case O_TUNNELSRC: |
| if (e->match.saddr) |
| xtables_error(PARAMETER_PROBLEM, |
| "policy match: double --tunnel-src option"); |
| |
| e->match.saddr = 1; |
| e->invert.saddr = cb->invert; |
| memcpy(&e->saddr, &cb->val.haddr, sizeof(cb->val.haddr)); |
| memcpy(&e->smask, &cb->val.hmask, sizeof(cb->val.hmask)); |
| break; |
| case O_TUNNELDST: |
| if (e->match.daddr) |
| xtables_error(PARAMETER_PROBLEM, |
| "policy match: double --tunnel-dst option"); |
| e->match.daddr = 1; |
| e->invert.daddr = cb->invert; |
| memcpy(&e->daddr, &cb->val.haddr, sizeof(cb->val.haddr)); |
| memcpy(&e->dmask, &cb->val.hmask, sizeof(cb->val.hmask)); |
| break; |
| case O_PROTO: |
| if (e->match.proto) |
| xtables_error(PARAMETER_PROBLEM, |
| "policy match: double --proto option"); |
| e->proto = cb->val.protocol; |
| if (e->proto != IPPROTO_AH && e->proto != IPPROTO_ESP && |
| e->proto != IPPROTO_COMP) |
| xtables_error(PARAMETER_PROBLEM, |
| "policy match: protocol must be ah/esp/ipcomp"); |
| e->match.proto = 1; |
| e->invert.proto = cb->invert; |
| break; |
| case O_MODE: |
| if (e->match.mode) |
| xtables_error(PARAMETER_PROBLEM, |
| "policy match: double --mode option"); |
| e->match.mode = 1; |
| e->invert.mode = cb->invert; |
| e->mode = parse_mode(cb->arg); |
| break; |
| case O_NEXT: |
| if (++info->len == XT_POLICY_MAX_ELEM) |
| xtables_error(PARAMETER_PROBLEM, |
| "policy match: maximum policy depth reached"); |
| break; |
| } |
| } |
| |
| static void policy_check(struct xt_fcheck_call *cb) |
| { |
| struct xt_policy_info *info = cb->data; |
| const struct xt_policy_elem *e; |
| int i; |
| |
| /* |
| * The old "no parameters given" check is carried out |
| * by testing for --dir. |
| */ |
| if (!(info->flags & (XT_POLICY_MATCH_IN | XT_POLICY_MATCH_OUT))) |
| xtables_error(PARAMETER_PROBLEM, |
| "policy match: neither --dir in nor --dir out specified"); |
| |
| if (info->flags & XT_POLICY_MATCH_NONE) { |
| if (info->flags & XT_POLICY_MATCH_STRICT) |
| xtables_error(PARAMETER_PROBLEM, |
| "policy match: policy none but --strict given"); |
| |
| if (info->len != 0) |
| xtables_error(PARAMETER_PROBLEM, |
| "policy match: policy none but policy given"); |
| } else |
| info->len++; /* increase len by 1, no --next after last element */ |
| |
| /* |
| * This is already represented with O_NEXT requiring F_STRICT in the |
| * options table, but will keep this code as a comment for reference. |
| * |
| if (!(info->flags & XT_POLICY_MATCH_STRICT) && info->len > 1) |
| xtables_error(PARAMETER_PROBLEM, |
| "policy match: multiple elements but no --strict"); |
| */ |
| |
| for (i = 0; i < info->len; i++) { |
| e = &info->pol[i]; |
| |
| if (info->flags & XT_POLICY_MATCH_STRICT && |
| !(e->match.reqid || e->match.spi || e->match.saddr || |
| e->match.daddr || e->match.proto || e->match.mode)) |
| xtables_error(PARAMETER_PROBLEM, |
| "policy match: empty policy element %u. " |
| "--strict is in effect, but at least one of " |
| "reqid, spi, tunnel-src, tunnel-dst, proto or " |
| "mode is required.", i); |
| |
| if ((e->match.saddr || e->match.daddr) |
| && ((e->mode == XT_POLICY_MODE_TUNNEL && e->invert.mode) || |
| (e->mode == XT_POLICY_MODE_TRANSPORT && !e->invert.mode))) |
| xtables_error(PARAMETER_PROBLEM, |
| "policy match: --tunnel-src/--tunnel-dst " |
| "is only valid in tunnel mode"); |
| } |
| } |
| |
| static void print_mode(const char *prefix, uint8_t mode, int numeric) |
| { |
| printf(" %smode ", prefix); |
| |
| switch (mode) { |
| case XT_POLICY_MODE_TRANSPORT: |
| printf("transport"); |
| break; |
| case XT_POLICY_MODE_TUNNEL: |
| printf("tunnel"); |
| break; |
| default: |
| printf("???"); |
| break; |
| } |
| } |
| |
| static void print_proto(const char *prefix, uint8_t proto, int numeric) |
| { |
| const struct protoent *p = NULL; |
| |
| printf(" %sproto ", prefix); |
| if (!numeric) |
| p = getprotobynumber(proto); |
| if (p != NULL) |
| printf("%s", p->p_name); |
| else |
| printf("%u", proto); |
| } |
| |
| #define PRINT_INVERT(x) \ |
| do { \ |
| if (x) \ |
| printf(" !"); \ |
| } while(0) |
| |
| static void print_entry(const char *prefix, const struct xt_policy_elem *e, |
| bool numeric, uint8_t family) |
| { |
| if (e->match.reqid) { |
| PRINT_INVERT(e->invert.reqid); |
| printf(" %sreqid %u", prefix, e->reqid); |
| } |
| if (e->match.spi) { |
| PRINT_INVERT(e->invert.spi); |
| printf(" %sspi 0x%x", prefix, e->spi); |
| } |
| if (e->match.proto) { |
| PRINT_INVERT(e->invert.proto); |
| print_proto(prefix, e->proto, numeric); |
| } |
| if (e->match.mode) { |
| PRINT_INVERT(e->invert.mode); |
| print_mode(prefix, e->mode, numeric); |
| } |
| if (e->match.daddr) { |
| PRINT_INVERT(e->invert.daddr); |
| if (family == NFPROTO_IPV6) |
| printf(" %stunnel-dst %s%s", prefix, |
| xtables_ip6addr_to_numeric(&e->daddr.a6), |
| xtables_ip6mask_to_numeric(&e->dmask.a6)); |
| else |
| printf(" %stunnel-dst %s%s", prefix, |
| xtables_ipaddr_to_numeric(&e->daddr.a4), |
| xtables_ipmask_to_numeric(&e->dmask.a4)); |
| } |
| if (e->match.saddr) { |
| PRINT_INVERT(e->invert.saddr); |
| if (family == NFPROTO_IPV6) |
| printf(" %stunnel-src %s%s", prefix, |
| xtables_ip6addr_to_numeric(&e->saddr.a6), |
| xtables_ip6mask_to_numeric(&e->smask.a6)); |
| else |
| printf(" %stunnel-src %s%s", prefix, |
| xtables_ipaddr_to_numeric(&e->saddr.a4), |
| xtables_ipmask_to_numeric(&e->smask.a4)); |
| } |
| } |
| |
| static void print_flags(const char *prefix, const struct xt_policy_info *info) |
| { |
| if (info->flags & XT_POLICY_MATCH_IN) |
| printf(" %sdir in", prefix); |
| else |
| printf(" %sdir out", prefix); |
| |
| if (info->flags & XT_POLICY_MATCH_NONE) |
| printf(" %spol none", prefix); |
| else |
| printf(" %spol ipsec", prefix); |
| |
| if (info->flags & XT_POLICY_MATCH_STRICT) |
| printf(" %sstrict", prefix); |
| } |
| |
| static void policy4_print(const void *ip, const struct xt_entry_match *match, |
| int numeric) |
| { |
| const struct xt_policy_info *info = (void *)match->data; |
| unsigned int i; |
| |
| printf(" policy match"); |
| print_flags("", info); |
| for (i = 0; i < info->len; i++) { |
| if (info->len > 1) |
| printf(" [%u]", i); |
| print_entry("", &info->pol[i], numeric, NFPROTO_IPV4); |
| } |
| } |
| |
| static void policy6_print(const void *ip, const struct xt_entry_match *match, |
| int numeric) |
| { |
| const struct xt_policy_info *info = (void *)match->data; |
| unsigned int i; |
| |
| printf(" policy match"); |
| print_flags("", info); |
| for (i = 0; i < info->len; i++) { |
| if (info->len > 1) |
| printf(" [%u]", i); |
| print_entry("", &info->pol[i], numeric, NFPROTO_IPV6); |
| } |
| } |
| |
| static void policy4_save(const void *ip, const struct xt_entry_match *match) |
| { |
| const struct xt_policy_info *info = (void *)match->data; |
| unsigned int i; |
| |
| print_flags("--", info); |
| for (i = 0; i < info->len; i++) { |
| print_entry("--", &info->pol[i], false, NFPROTO_IPV4); |
| if (i + 1 < info->len) |
| printf(" --next"); |
| } |
| } |
| |
| static void policy6_save(const void *ip, const struct xt_entry_match *match) |
| { |
| const struct xt_policy_info *info = (void *)match->data; |
| unsigned int i; |
| |
| print_flags("--", info); |
| for (i = 0; i < info->len; i++) { |
| print_entry("--", &info->pol[i], false, NFPROTO_IPV6); |
| if (i + 1 < info->len) |
| printf(" --next"); |
| } |
| } |
| |
| static int policy_xlate(struct xt_xlate *xl, |
| const struct xt_xlate_mt_params *params) |
| { |
| static const unsigned int allowed = XT_POLICY_MATCH_STRICT | |
| XT_POLICY_MATCH_NONE | |
| XT_POLICY_MATCH_IN; |
| static const struct xt_policy_elem empty; |
| const struct xt_policy_info *info = (const void *)params->match->data; |
| |
| if ((info->flags & ~allowed) || info->len > 1) |
| return 0; |
| |
| if (memcmp(&info->pol[0], &empty, sizeof(empty))) |
| return 0; |
| |
| xt_xlate_add(xl, "meta secpath "); |
| |
| if (info->flags & XT_POLICY_MATCH_NONE) |
| xt_xlate_add(xl, "missing"); |
| else |
| xt_xlate_add(xl, "exists"); |
| |
| return 1; |
| } |
| |
| static struct xtables_match policy_mt_reg[] = { |
| { |
| .name = "policy", |
| .version = XTABLES_VERSION, |
| .family = NFPROTO_IPV4, |
| .size = XT_ALIGN(sizeof(struct xt_policy_info)), |
| .userspacesize = XT_ALIGN(sizeof(struct xt_policy_info)), |
| .help = policy_help, |
| .x6_parse = policy_parse, |
| .x6_fcheck = policy_check, |
| .print = policy4_print, |
| .save = policy4_save, |
| .x6_options = policy_opts, |
| .xlate = policy_xlate, |
| }, |
| { |
| .name = "policy", |
| .version = XTABLES_VERSION, |
| .family = NFPROTO_IPV6, |
| .size = XT_ALIGN(sizeof(struct xt_policy_info)), |
| .userspacesize = XT_ALIGN(sizeof(struct xt_policy_info)), |
| .help = policy_help, |
| .x6_parse = policy_parse, |
| .x6_fcheck = policy_check, |
| .print = policy6_print, |
| .save = policy6_save, |
| .x6_options = policy_opts, |
| .xlate = policy_xlate, |
| }, |
| }; |
| |
| void _init(void) |
| { |
| xtables_register_matches(policy_mt_reg, ARRAY_SIZE(policy_mt_reg)); |
| } |