475 lines
13 KiB
C
475 lines
13 KiB
C
/* ebt_ip
|
|
*
|
|
* Authors:
|
|
* Bart De Schuymer <bdschuym@pandora.be>
|
|
*
|
|
* Changes:
|
|
* added ip-sport and ip-dport; parsing of port arguments is
|
|
* based on code from iptables-1.2.7a
|
|
* Innominate Security Technologies AG <mhopf@innominate.com>
|
|
* September, 2002
|
|
*/
|
|
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <string.h>
|
|
#include <getopt.h>
|
|
#include <netdb.h>
|
|
#include "../include/ebtables_u.h"
|
|
#include <linux/netfilter_bridge/ebt_ip.h>
|
|
|
|
#define IP_SOURCE '1'
|
|
#define IP_DEST '2'
|
|
#define IP_myTOS '3' /* include/bits/in.h seems to already define IP_TOS */
|
|
#define IP_PROTO '4'
|
|
#define IP_SPORT '5'
|
|
#define IP_DPORT '6'
|
|
#define IP_ICMP '7'
|
|
#define IP_IGMP '8'
|
|
|
|
static const struct option opts[] =
|
|
{
|
|
{ "ip-source" , required_argument, 0, IP_SOURCE },
|
|
{ "ip-src" , required_argument, 0, IP_SOURCE },
|
|
{ "ip-destination" , required_argument, 0, IP_DEST },
|
|
{ "ip-dst" , required_argument, 0, IP_DEST },
|
|
{ "ip-tos" , required_argument, 0, IP_myTOS },
|
|
{ "ip-protocol" , required_argument, 0, IP_PROTO },
|
|
{ "ip-proto" , required_argument, 0, IP_PROTO },
|
|
{ "ip-source-port" , required_argument, 0, IP_SPORT },
|
|
{ "ip-sport" , required_argument, 0, IP_SPORT },
|
|
{ "ip-destination-port" , required_argument, 0, IP_DPORT },
|
|
{ "ip-dport" , required_argument, 0, IP_DPORT },
|
|
{ "ip-icmp-type" , required_argument, 0, IP_ICMP },
|
|
{ "ip-igmp-type" , required_argument, 0, IP_IGMP },
|
|
{ 0 }
|
|
};
|
|
|
|
static const struct ebt_icmp_names icmp_codes[] = {
|
|
{ "echo-reply", 0, 0, 0xFF },
|
|
/* Alias */ { "pong", 0, 0, 0xFF },
|
|
|
|
{ "destination-unreachable", 3, 0, 0xFF },
|
|
{ "network-unreachable", 3, 0, 0 },
|
|
{ "host-unreachable", 3, 1, 1 },
|
|
{ "protocol-unreachable", 3, 2, 2 },
|
|
{ "port-unreachable", 3, 3, 3 },
|
|
{ "fragmentation-needed", 3, 4, 4 },
|
|
{ "source-route-failed", 3, 5, 5 },
|
|
{ "network-unknown", 3, 6, 6 },
|
|
{ "host-unknown", 3, 7, 7 },
|
|
{ "network-prohibited", 3, 9, 9 },
|
|
{ "host-prohibited", 3, 10, 10 },
|
|
{ "TOS-network-unreachable", 3, 11, 11 },
|
|
{ "TOS-host-unreachable", 3, 12, 12 },
|
|
{ "communication-prohibited", 3, 13, 13 },
|
|
{ "host-precedence-violation", 3, 14, 14 },
|
|
{ "precedence-cutoff", 3, 15, 15 },
|
|
|
|
{ "source-quench", 4, 0, 0xFF },
|
|
|
|
{ "redirect", 5, 0, 0xFF },
|
|
{ "network-redirect", 5, 0, 0 },
|
|
{ "host-redirect", 5, 1, 1 },
|
|
{ "TOS-network-redirect", 5, 2, 2 },
|
|
{ "TOS-host-redirect", 5, 3, 3 },
|
|
|
|
{ "echo-request", 8, 0, 0xFF },
|
|
/* Alias */ { "ping", 8, 0, 0xFF },
|
|
|
|
{ "router-advertisement", 9, 0, 0xFF },
|
|
|
|
{ "router-solicitation", 10, 0, 0xFF },
|
|
|
|
{ "time-exceeded", 11, 0, 0xFF },
|
|
/* Alias */ { "ttl-exceeded", 11, 0, 0xFF },
|
|
{ "ttl-zero-during-transit", 11, 0, 0 },
|
|
{ "ttl-zero-during-reassembly", 11, 1, 1 },
|
|
|
|
{ "parameter-problem", 12, 0, 0xFF },
|
|
{ "ip-header-bad", 12, 0, 0 },
|
|
{ "required-option-missing", 12, 1, 1 },
|
|
|
|
{ "timestamp-request", 13, 0, 0xFF },
|
|
|
|
{ "timestamp-reply", 14, 0, 0xFF },
|
|
|
|
{ "address-mask-request", 17, 0, 0xFF },
|
|
|
|
{ "address-mask-reply", 18, 0, 0xFF }
|
|
};
|
|
|
|
static const struct ebt_icmp_names igmp_types[] = {
|
|
{ "membership-query", 0x11 },
|
|
{ "membership-report-v1", 0x12 },
|
|
{ "membership-report-v2", 0x16 },
|
|
{ "leave-group", 0x17 },
|
|
{ "membership-report-v3", 0x22 },
|
|
};
|
|
|
|
/* put the mask into 4 bytes */
|
|
/* transform a protocol and service name into a port number */
|
|
static uint16_t parse_port(const char *protocol, const char *name)
|
|
{
|
|
struct servent *service;
|
|
char *end;
|
|
int port;
|
|
|
|
port = strtol(name, &end, 10);
|
|
if (*end != '\0') {
|
|
if (protocol &&
|
|
(service = getservbyname(name, protocol)) != NULL)
|
|
return ntohs(service->s_port);
|
|
}
|
|
else if (port >= 0 || port <= 0xFFFF) {
|
|
return port;
|
|
}
|
|
ebt_print_error("Problem with specified %s port '%s'",
|
|
protocol?protocol:"", name);
|
|
return 0;
|
|
}
|
|
|
|
static void
|
|
parse_port_range(const char *protocol, const char *portstring, uint16_t *ports)
|
|
{
|
|
char *buffer;
|
|
char *cp;
|
|
|
|
buffer = strdup(portstring);
|
|
if ((cp = strchr(buffer, ':')) == NULL)
|
|
ports[0] = ports[1] = parse_port(protocol, buffer);
|
|
else {
|
|
*cp = '\0';
|
|
cp++;
|
|
ports[0] = buffer[0] ? parse_port(protocol, buffer) : 0;
|
|
ports[1] = cp[0] ? parse_port(protocol, cp) : 0xFFFF;
|
|
|
|
if (ports[0] > ports[1])
|
|
ebt_print_error("Invalid portrange (min > max)");
|
|
}
|
|
free(buffer);
|
|
}
|
|
|
|
static void print_port_range(uint16_t *ports)
|
|
{
|
|
if (ports[0] == ports[1])
|
|
printf("%d ", ports[0]);
|
|
else
|
|
printf("%d:%d ", ports[0], ports[1]);
|
|
}
|
|
|
|
static void print_help()
|
|
{
|
|
printf(
|
|
"ip options:\n"
|
|
"--ip-src [!] address[/mask]: ip source specification\n"
|
|
"--ip-dst [!] address[/mask]: ip destination specification\n"
|
|
"--ip-tos [!] tos : ip tos specification\n"
|
|
"--ip-proto [!] protocol : ip protocol specification\n"
|
|
"--ip-sport [!] port[:port] : tcp/udp source port or port range\n"
|
|
"--ip-dport [!] port[:port] : tcp/udp destination port or port range\n"
|
|
"--ip-icmp-type [!] type[[:type]/code[:code]] : icmp type/code or type/code range\n"
|
|
"--ip-igmp-type [!] type[:type] : igmp type or type range\n");
|
|
|
|
printf("\nValid ICMP Types:\n");
|
|
ebt_print_icmp_types(icmp_codes, ARRAY_SIZE(icmp_codes));
|
|
printf("\nValid IGMP Types:\n");
|
|
ebt_print_icmp_types(igmp_types, ARRAY_SIZE(igmp_types));
|
|
}
|
|
|
|
static void init(struct ebt_entry_match *match)
|
|
{
|
|
struct ebt_ip_info *ipinfo = (struct ebt_ip_info *)match->data;
|
|
|
|
ipinfo->invflags = 0;
|
|
ipinfo->bitmask = 0;
|
|
}
|
|
|
|
#define OPT_SOURCE 0x01
|
|
#define OPT_DEST 0x02
|
|
#define OPT_TOS 0x04
|
|
#define OPT_PROTO 0x08
|
|
#define OPT_SPORT 0x10
|
|
#define OPT_DPORT 0x20
|
|
#define OPT_ICMP 0x40
|
|
#define OPT_IGMP 0x80
|
|
static int parse(int c, char **argv, int argc, const struct ebt_u_entry *entry,
|
|
unsigned int *flags, struct ebt_entry_match **match)
|
|
{
|
|
struct ebt_ip_info *ipinfo = (struct ebt_ip_info *)(*match)->data;
|
|
char *end;
|
|
long int i;
|
|
|
|
switch (c) {
|
|
case IP_SOURCE:
|
|
ebt_check_option2(flags, OPT_SOURCE);
|
|
ipinfo->bitmask |= EBT_IP_SOURCE;
|
|
|
|
case IP_DEST:
|
|
if (c == IP_DEST) {
|
|
ebt_check_option2(flags, OPT_DEST);
|
|
ipinfo->bitmask |= EBT_IP_DEST;
|
|
}
|
|
if (ebt_check_inverse2(optarg)) {
|
|
if (c == IP_SOURCE)
|
|
ipinfo->invflags |= EBT_IP_SOURCE;
|
|
else
|
|
ipinfo->invflags |= EBT_IP_DEST;
|
|
}
|
|
if (c == IP_SOURCE)
|
|
ebt_parse_ip_address(optarg, &ipinfo->saddr, &ipinfo->smsk);
|
|
else
|
|
ebt_parse_ip_address(optarg, &ipinfo->daddr, &ipinfo->dmsk);
|
|
break;
|
|
|
|
case IP_SPORT:
|
|
case IP_DPORT:
|
|
if (c == IP_SPORT) {
|
|
ebt_check_option2(flags, OPT_SPORT);
|
|
ipinfo->bitmask |= EBT_IP_SPORT;
|
|
if (ebt_check_inverse2(optarg))
|
|
ipinfo->invflags |= EBT_IP_SPORT;
|
|
} else {
|
|
ebt_check_option2(flags, OPT_DPORT);
|
|
ipinfo->bitmask |= EBT_IP_DPORT;
|
|
if (ebt_check_inverse2(optarg))
|
|
ipinfo->invflags |= EBT_IP_DPORT;
|
|
}
|
|
if (c == IP_SPORT)
|
|
parse_port_range(NULL, optarg, ipinfo->sport);
|
|
else
|
|
parse_port_range(NULL, optarg, ipinfo->dport);
|
|
break;
|
|
|
|
case IP_ICMP:
|
|
ebt_check_option2(flags, OPT_ICMP);
|
|
ipinfo->bitmask |= EBT_IP_ICMP;
|
|
if (ebt_check_inverse2(optarg))
|
|
ipinfo->invflags |= EBT_IP_ICMP;
|
|
if (ebt_parse_icmp(icmp_codes, ARRAY_SIZE(icmp_codes), optarg,
|
|
ipinfo->icmp_type, ipinfo->icmp_code))
|
|
return 0;
|
|
break;
|
|
|
|
case IP_IGMP:
|
|
ebt_check_option2(flags, OPT_IGMP);
|
|
ipinfo->bitmask |= EBT_IP_IGMP;
|
|
if (ebt_check_inverse2(optarg))
|
|
ipinfo->invflags |= EBT_IP_IGMP;
|
|
if (ebt_parse_icmp(igmp_types, ARRAY_SIZE(igmp_types), optarg,
|
|
ipinfo->igmp_type, NULL))
|
|
return 0;
|
|
break;
|
|
|
|
case IP_myTOS:
|
|
ebt_check_option2(flags, OPT_TOS);
|
|
if (ebt_check_inverse2(optarg))
|
|
ipinfo->invflags |= EBT_IP_TOS;
|
|
i = strtol(optarg, &end, 16);
|
|
if (i < 0 || i > 255 || *end != '\0')
|
|
ebt_print_error2("Problem with specified IP tos");
|
|
ipinfo->tos = i;
|
|
ipinfo->bitmask |= EBT_IP_TOS;
|
|
break;
|
|
|
|
case IP_PROTO:
|
|
ebt_check_option2(flags, OPT_PROTO);
|
|
if (ebt_check_inverse2(optarg))
|
|
ipinfo->invflags |= EBT_IP_PROTO;
|
|
i = strtoul(optarg, &end, 10);
|
|
if (*end != '\0') {
|
|
struct protoent *pe;
|
|
|
|
pe = getprotobyname(optarg);
|
|
if (pe == NULL)
|
|
ebt_print_error("Unknown specified IP protocol - %s", argv[optind - 1]);
|
|
ipinfo->protocol = pe->p_proto;
|
|
} else {
|
|
ipinfo->protocol = (unsigned char) i;
|
|
}
|
|
ipinfo->bitmask |= EBT_IP_PROTO;
|
|
break;
|
|
default:
|
|
return 0;
|
|
}
|
|
return 1;
|
|
}
|
|
|
|
static void final_check(const struct ebt_u_entry *entry,
|
|
const struct ebt_entry_match *match, const char *name,
|
|
unsigned int hookmask, unsigned int time)
|
|
{
|
|
struct ebt_ip_info *ipinfo = (struct ebt_ip_info *)match->data;
|
|
|
|
if (entry->ethproto != ETH_P_IP || entry->invflags & EBT_IPROTO) {
|
|
ebt_print_error("For IP filtering the protocol must be "
|
|
"specified as IPv4");
|
|
} else if (ipinfo->bitmask & (EBT_IP_SPORT|EBT_IP_DPORT) &&
|
|
(!(ipinfo->bitmask & EBT_IP_PROTO) ||
|
|
ipinfo->invflags & EBT_IP_PROTO ||
|
|
(ipinfo->protocol!=IPPROTO_TCP &&
|
|
ipinfo->protocol!=IPPROTO_UDP &&
|
|
ipinfo->protocol!=IPPROTO_SCTP &&
|
|
ipinfo->protocol!=IPPROTO_DCCP))) {
|
|
ebt_print_error("For port filtering the IP protocol must be "
|
|
"either 6 (tcp), 17 (udp), 33 (dccp) or "
|
|
"132 (sctp)");
|
|
} else if ((ipinfo->bitmask & EBT_IP_ICMP) &&
|
|
(!(ipinfo->bitmask & EBT_IP_PROTO) ||
|
|
ipinfo->invflags & EBT_IP_PROTO ||
|
|
ipinfo->protocol != IPPROTO_ICMP)) {
|
|
ebt_print_error("For ICMP filtering the IP protocol must be "
|
|
"1 (icmp)");
|
|
} else if ((ipinfo->bitmask & EBT_IP_IGMP) &&
|
|
(!(ipinfo->bitmask & EBT_IP_PROTO) ||
|
|
ipinfo->invflags & EBT_IP_PROTO ||
|
|
ipinfo->protocol != IPPROTO_IGMP)) {
|
|
ebt_print_error("For IGMP filtering the IP protocol must be "
|
|
"2 (igmp)");
|
|
}
|
|
}
|
|
|
|
static void print(const struct ebt_u_entry *entry,
|
|
const struct ebt_entry_match *match)
|
|
{
|
|
struct ebt_ip_info *ipinfo = (struct ebt_ip_info *)match->data;
|
|
int j;
|
|
|
|
if (ipinfo->bitmask & EBT_IP_SOURCE) {
|
|
printf("--ip-src ");
|
|
if (ipinfo->invflags & EBT_IP_SOURCE)
|
|
printf("! ");
|
|
for (j = 0; j < 4; j++)
|
|
printf("%d%s",((unsigned char *)&ipinfo->saddr)[j],
|
|
(j == 3) ? "" : ".");
|
|
printf("%s ", ebt_mask_to_dotted(ipinfo->smsk));
|
|
}
|
|
if (ipinfo->bitmask & EBT_IP_DEST) {
|
|
printf("--ip-dst ");
|
|
if (ipinfo->invflags & EBT_IP_DEST)
|
|
printf("! ");
|
|
for (j = 0; j < 4; j++)
|
|
printf("%d%s", ((unsigned char *)&ipinfo->daddr)[j],
|
|
(j == 3) ? "" : ".");
|
|
printf("%s ", ebt_mask_to_dotted(ipinfo->dmsk));
|
|
}
|
|
if (ipinfo->bitmask & EBT_IP_TOS) {
|
|
printf("--ip-tos ");
|
|
if (ipinfo->invflags & EBT_IP_TOS)
|
|
printf("! ");
|
|
printf("0x%02X ", ipinfo->tos);
|
|
}
|
|
if (ipinfo->bitmask & EBT_IP_PROTO) {
|
|
struct protoent *pe;
|
|
|
|
printf("--ip-proto ");
|
|
if (ipinfo->invflags & EBT_IP_PROTO)
|
|
printf("! ");
|
|
pe = getprotobynumber(ipinfo->protocol);
|
|
if (pe == NULL) {
|
|
printf("%d ", ipinfo->protocol);
|
|
} else {
|
|
printf("%s ", pe->p_name);
|
|
}
|
|
}
|
|
if (ipinfo->bitmask & EBT_IP_SPORT) {
|
|
printf("--ip-sport ");
|
|
if (ipinfo->invflags & EBT_IP_SPORT)
|
|
printf("! ");
|
|
print_port_range(ipinfo->sport);
|
|
}
|
|
if (ipinfo->bitmask & EBT_IP_DPORT) {
|
|
printf("--ip-dport ");
|
|
if (ipinfo->invflags & EBT_IP_DPORT)
|
|
printf("! ");
|
|
print_port_range(ipinfo->dport);
|
|
}
|
|
if (ipinfo->bitmask & EBT_IP_ICMP) {
|
|
printf("--ip-icmp-type ");
|
|
if (ipinfo->invflags & EBT_IP_ICMP)
|
|
printf("! ");
|
|
ebt_print_icmp_type(icmp_codes, ARRAY_SIZE(icmp_codes),
|
|
ipinfo->icmp_type, ipinfo->icmp_code);
|
|
}
|
|
if (ipinfo->bitmask & EBT_IP_IGMP) {
|
|
printf("--ip-igmp-type ");
|
|
if (ipinfo->invflags & EBT_IP_IGMP)
|
|
printf("! ");
|
|
ebt_print_icmp_type(igmp_types, ARRAY_SIZE(igmp_types),
|
|
ipinfo->igmp_type, NULL);
|
|
}
|
|
}
|
|
|
|
static int compare(const struct ebt_entry_match *m1,
|
|
const struct ebt_entry_match *m2)
|
|
{
|
|
struct ebt_ip_info *ipinfo1 = (struct ebt_ip_info *)m1->data;
|
|
struct ebt_ip_info *ipinfo2 = (struct ebt_ip_info *)m2->data;
|
|
|
|
if (ipinfo1->bitmask != ipinfo2->bitmask)
|
|
return 0;
|
|
if (ipinfo1->invflags != ipinfo2->invflags)
|
|
return 0;
|
|
if (ipinfo1->bitmask & EBT_IP_SOURCE) {
|
|
if (ipinfo1->saddr != ipinfo2->saddr)
|
|
return 0;
|
|
if (ipinfo1->smsk != ipinfo2->smsk)
|
|
return 0;
|
|
}
|
|
if (ipinfo1->bitmask & EBT_IP_DEST) {
|
|
if (ipinfo1->daddr != ipinfo2->daddr)
|
|
return 0;
|
|
if (ipinfo1->dmsk != ipinfo2->dmsk)
|
|
return 0;
|
|
}
|
|
if (ipinfo1->bitmask & EBT_IP_TOS) {
|
|
if (ipinfo1->tos != ipinfo2->tos)
|
|
return 0;
|
|
}
|
|
if (ipinfo1->bitmask & EBT_IP_PROTO) {
|
|
if (ipinfo1->protocol != ipinfo2->protocol)
|
|
return 0;
|
|
}
|
|
if (ipinfo1->bitmask & EBT_IP_SPORT) {
|
|
if (ipinfo1->sport[0] != ipinfo2->sport[0] ||
|
|
ipinfo1->sport[1] != ipinfo2->sport[1])
|
|
return 0;
|
|
}
|
|
if (ipinfo1->bitmask & EBT_IP_DPORT) {
|
|
if (ipinfo1->dport[0] != ipinfo2->dport[0] ||
|
|
ipinfo1->dport[1] != ipinfo2->dport[1])
|
|
return 0;
|
|
}
|
|
if (ipinfo1->bitmask & EBT_IP_ICMP) {
|
|
if (ipinfo1->icmp_type[0] != ipinfo2->icmp_type[0] ||
|
|
ipinfo1->icmp_type[1] != ipinfo2->icmp_type[1] ||
|
|
ipinfo1->icmp_code[0] != ipinfo2->icmp_code[0] ||
|
|
ipinfo1->icmp_code[1] != ipinfo2->icmp_code[1])
|
|
return 0;
|
|
}
|
|
if (ipinfo1->bitmask & EBT_IP_IGMP) {
|
|
if (ipinfo1->igmp_type[0] != ipinfo2->igmp_type[0] ||
|
|
ipinfo1->igmp_type[1] != ipinfo2->igmp_type[1])
|
|
return 0;
|
|
}
|
|
return 1;
|
|
}
|
|
|
|
static struct ebt_u_match ip_match =
|
|
{
|
|
.name = "ip",
|
|
.size = sizeof(struct ebt_ip_info),
|
|
.help = print_help,
|
|
.init = init,
|
|
.parse = parse,
|
|
.final_check = final_check,
|
|
.print = print,
|
|
.compare = compare,
|
|
.extra_ops = opts,
|
|
};
|
|
|
|
__attribute__((constructor)) static void extension_init(void)
|
|
{
|
|
ebt_register_match(&ip_match);
|
|
}
|