1 /* Shared library add-on to iptables to add TCP support. */
2 #include <stdio.h>
3 #include <netdb.h>
4 #include <string.h>
5 #include <stdlib.h>
6 #include <getopt.h>
7 #include <ip6tables.h>
8 #include <linux/netfilter_ipv6/ip6_tables.h>
9
10 /* Function which prints out usage message. */
11 static void
help(void)12 help(void)
13 {
14 printf(
15 "TCP v%s options:\n"
16 " --tcp-flags [!] mask comp match when TCP flags & mask == comp\n"
17 " (Flags: SYN ACK FIN RST URG PSH ALL NONE)\n"
18 "[!] --syn match when only SYN flag set\n"
19 " (equivalent to --tcp-flags SYN,RST,ACK SYN)\n"
20 " --source-port [!] port[:port]\n"
21 " --sport ...\n"
22 " match source port(s)\n"
23 " --destination-port [!] port[:port]\n"
24 " --dport ...\n"
25 " match destination port(s)\n"
26 " --tcp-option [!] number match if TCP option set\n\n",
27 IPTABLES_VERSION);
28 }
29
30 static struct option opts[] = {
31 { "source-port", 1, 0, '1' },
32 { "sport", 1, 0, '1' }, /* synonym */
33 { "destination-port", 1, 0, '2' },
34 { "dport", 1, 0, '2' }, /* synonym */
35 { "syn", 0, 0, '3' },
36 { "tcp-flags", 1, 0, '4' },
37 { "tcp-option", 1, 0, '5' },
38 {0}
39 };
40
41 static void
parse_tcp_ports(const char * portstring,u_int16_t * ports)42 parse_tcp_ports(const char *portstring, u_int16_t *ports)
43 {
44 char *buffer;
45 char *cp;
46
47 buffer = strdup(portstring);
48 if ((cp = strchr(buffer, ':')) == NULL)
49 ports[0] = ports[1] = parse_port(buffer, "tcp");
50 else {
51 *cp = '\0';
52 cp++;
53
54 ports[0] = buffer[0] ? parse_port(buffer, "tcp") : 0;
55 ports[1] = cp[0] ? parse_port(cp, "tcp") : 0xFFFF;
56
57 if (ports[0] > ports[1])
58 exit_error(PARAMETER_PROBLEM,
59 "invalid portrange (min > max)");
60 }
61 free(buffer);
62 }
63
64 struct tcp_flag_names {
65 const char *name;
66 unsigned int flag;
67 };
68
69 static struct tcp_flag_names tcp_flag_names[]
70 = { { "FIN", 0x01 },
71 { "SYN", 0x02 },
72 { "RST", 0x04 },
73 { "PSH", 0x08 },
74 { "ACK", 0x10 },
75 { "URG", 0x20 },
76 { "ALL", 0x3F },
77 { "NONE", 0 },
78 };
79
80 static unsigned int
parse_tcp_flag(const char * flags)81 parse_tcp_flag(const char *flags)
82 {
83 unsigned int ret = 0;
84 char *ptr;
85 char *buffer;
86
87 buffer = strdup(flags);
88
89 for (ptr = strtok(buffer, ","); ptr; ptr = strtok(NULL, ",")) {
90 unsigned int i;
91 for (i = 0;
92 i < sizeof(tcp_flag_names)/sizeof(struct tcp_flag_names);
93 i++) {
94 if (strcasecmp(tcp_flag_names[i].name, ptr) == 0) {
95 ret |= tcp_flag_names[i].flag;
96 break;
97 }
98 }
99 if (i == sizeof(tcp_flag_names)/sizeof(struct tcp_flag_names))
100 exit_error(PARAMETER_PROBLEM,
101 "Unknown TCP flag `%s'", ptr);
102 }
103
104 free(buffer);
105 return ret;
106 }
107
108 static void
parse_tcp_flags(struct ip6t_tcp * tcpinfo,const char * mask,const char * cmp,int invert)109 parse_tcp_flags(struct ip6t_tcp *tcpinfo,
110 const char *mask,
111 const char *cmp,
112 int invert)
113 {
114 tcpinfo->flg_mask = parse_tcp_flag(mask);
115 tcpinfo->flg_cmp = parse_tcp_flag(cmp);
116
117 if (invert)
118 tcpinfo->invflags |= IP6T_TCP_INV_FLAGS;
119 }
120
121 static void
parse_tcp_option(const char * option,u_int8_t * result)122 parse_tcp_option(const char *option, u_int8_t *result)
123 {
124 unsigned int ret;
125
126 if (string_to_number(option, 1, 255, &ret) == -1)
127 exit_error(PARAMETER_PROBLEM, "Bad TCP option `%s'", option);
128
129 *result = (u_int8_t)ret;
130 }
131
132 /* Initialize the match. */
133 static void
init(struct ip6t_entry_match * m,unsigned int * nfcache)134 init(struct ip6t_entry_match *m, unsigned int *nfcache)
135 {
136 struct ip6t_tcp *tcpinfo = (struct ip6t_tcp *)m->data;
137
138 tcpinfo->spts[1] = tcpinfo->dpts[1] = 0xFFFF;
139 }
140
141 #define TCP_SRC_PORTS 0x01
142 #define TCP_DST_PORTS 0x02
143 #define TCP_FLAGS 0x04
144 #define TCP_OPTION 0x08
145
146 /* Function which parses command options; returns true if it
147 ate an option. */
148 static int
parse(int c,char ** argv,int invert,unsigned int * flags,const struct ip6t_entry * entry,unsigned int * nfcache,struct ip6t_entry_match ** match)149 parse(int c, char **argv, int invert, unsigned int *flags,
150 const struct ip6t_entry *entry,
151 unsigned int *nfcache,
152 struct ip6t_entry_match **match)
153 {
154 struct ip6t_tcp *tcpinfo = (struct ip6t_tcp *)(*match)->data;
155
156 switch (c) {
157 case '1':
158 if (*flags & TCP_SRC_PORTS)
159 exit_error(PARAMETER_PROBLEM,
160 "Only one `--source-port' allowed");
161 check_inverse(optarg, &invert, &optind, 0);
162 parse_tcp_ports(argv[optind-1], tcpinfo->spts);
163 if (invert)
164 tcpinfo->invflags |= IP6T_TCP_INV_SRCPT;
165 *flags |= TCP_SRC_PORTS;
166 break;
167
168 case '2':
169 if (*flags & TCP_DST_PORTS)
170 exit_error(PARAMETER_PROBLEM,
171 "Only one `--destination-port' allowed");
172 check_inverse(optarg, &invert, &optind, 0);
173 parse_tcp_ports(argv[optind-1], tcpinfo->dpts);
174 if (invert)
175 tcpinfo->invflags |= IP6T_TCP_INV_DSTPT;
176 *flags |= TCP_DST_PORTS;
177 break;
178
179 case '3':
180 if (*flags & TCP_FLAGS)
181 exit_error(PARAMETER_PROBLEM,
182 "Only one of `--syn' or `--tcp-flags' "
183 " allowed");
184 parse_tcp_flags(tcpinfo, "SYN,RST,ACK", "SYN", invert);
185 *flags |= TCP_FLAGS;
186 break;
187
188 case '4':
189 if (*flags & TCP_FLAGS)
190 exit_error(PARAMETER_PROBLEM,
191 "Only one of `--syn' or `--tcp-flags' "
192 " allowed");
193 check_inverse(optarg, &invert, &optind, 0);
194
195 if (!argv[optind]
196 || argv[optind][0] == '-' || argv[optind][0] == '!')
197 exit_error(PARAMETER_PROBLEM,
198 "--tcp-flags requires two args.");
199
200 parse_tcp_flags(tcpinfo, argv[optind-1], argv[optind],
201 invert);
202 optind++;
203 *flags |= TCP_FLAGS;
204 break;
205
206 case '5':
207 if (*flags & TCP_OPTION)
208 exit_error(PARAMETER_PROBLEM,
209 "Only one `--tcp-option' allowed");
210 check_inverse(optarg, &invert, &optind, 0);
211 parse_tcp_option(argv[optind-1], &tcpinfo->option);
212 if (invert)
213 tcpinfo->invflags |= IP6T_TCP_INV_OPTION;
214 *flags |= TCP_OPTION;
215 break;
216
217 default:
218 return 0;
219 }
220
221 return 1;
222 }
223
224 /* Final check; we don't care. */
225 static void
final_check(unsigned int flags)226 final_check(unsigned int flags)
227 {
228 }
229
230 static char *
port_to_service(int port)231 port_to_service(int port)
232 {
233 struct servent *service;
234
235 if ((service = getservbyport(htons(port), "tcp")))
236 return service->s_name;
237
238 return NULL;
239 }
240
241 static void
print_port(u_int16_t port,int numeric)242 print_port(u_int16_t port, int numeric)
243 {
244 char *service;
245
246 if (numeric || (service = port_to_service(port)) == NULL)
247 printf("%u", port);
248 else
249 printf("%s", service);
250 }
251
252 static void
print_ports(const char * name,u_int16_t min,u_int16_t max,int invert,int numeric)253 print_ports(const char *name, u_int16_t min, u_int16_t max,
254 int invert, int numeric)
255 {
256 const char *inv = invert ? "!" : "";
257
258 if (min != 0 || max != 0xFFFF || invert) {
259 printf("%s", name);
260 if (min == max) {
261 printf(":%s", inv);
262 print_port(min, numeric);
263 } else {
264 printf("s:%s", inv);
265 print_port(min, numeric);
266 printf(":");
267 print_port(max, numeric);
268 }
269 printf(" ");
270 }
271 }
272
273 static void
print_option(u_int8_t option,int invert,int numeric)274 print_option(u_int8_t option, int invert, int numeric)
275 {
276 if (option || invert)
277 printf("option=%s%u ", invert ? "!" : "", option);
278 }
279
280 static void
print_tcpf(u_int8_t flags)281 print_tcpf(u_int8_t flags)
282 {
283 int have_flag = 0;
284
285 while (flags) {
286 unsigned int i;
287
288 for (i = 0; (flags & tcp_flag_names[i].flag) == 0; i++);
289
290 if (have_flag)
291 printf(",");
292 printf("%s", tcp_flag_names[i].name);
293 have_flag = 1;
294
295 flags &= ~tcp_flag_names[i].flag;
296 }
297
298 if (!have_flag)
299 printf("NONE");
300 }
301
302 static void
print_flags(u_int8_t mask,u_int8_t cmp,int invert,int numeric)303 print_flags(u_int8_t mask, u_int8_t cmp, int invert, int numeric)
304 {
305 if (mask || invert) {
306 printf("flags:%s", invert ? "!" : "");
307 if (numeric)
308 printf("0x%02X/0x%02X ", mask, cmp);
309 else {
310 print_tcpf(mask);
311 printf("/");
312 print_tcpf(cmp);
313 printf(" ");
314 }
315 }
316 }
317
318 /* Prints out the union ipt_matchinfo. */
319 static void
print(const struct ip6t_ip6 * ip,const struct ip6t_entry_match * match,int numeric)320 print(const struct ip6t_ip6 *ip,
321 const struct ip6t_entry_match *match, int numeric)
322 {
323 const struct ip6t_tcp *tcp = (struct ip6t_tcp *)match->data;
324
325 printf("tcp ");
326 print_ports("spt", tcp->spts[0], tcp->spts[1],
327 tcp->invflags & IP6T_TCP_INV_SRCPT,
328 numeric);
329 print_ports("dpt", tcp->dpts[0], tcp->dpts[1],
330 tcp->invflags & IP6T_TCP_INV_DSTPT,
331 numeric);
332 print_option(tcp->option,
333 tcp->invflags & IP6T_TCP_INV_OPTION,
334 numeric);
335 print_flags(tcp->flg_mask, tcp->flg_cmp,
336 tcp->invflags & IP6T_TCP_INV_FLAGS,
337 numeric);
338 if (tcp->invflags & ~IP6T_TCP_INV_MASK)
339 printf("Unknown invflags: 0x%X ",
340 tcp->invflags & ~IP6T_TCP_INV_MASK);
341 }
342
343 /* Saves the union ipt_matchinfo in parsable form to stdout. */
save(const struct ip6t_ip6 * ip,const struct ip6t_entry_match * match)344 static void save(const struct ip6t_ip6 *ip, const struct ip6t_entry_match *match)
345 {
346 const struct ip6t_tcp *tcpinfo = (struct ip6t_tcp *)match->data;
347
348 if (tcpinfo->spts[0] != 0
349 || tcpinfo->spts[1] != 0xFFFF) {
350 if (tcpinfo->invflags & IP6T_TCP_INV_SRCPT)
351 printf("! ");
352 if (tcpinfo->spts[0]
353 != tcpinfo->spts[1])
354 printf("--sport %u:%u ",
355 tcpinfo->spts[0],
356 tcpinfo->spts[1]);
357 else
358 printf("--sport %u ",
359 tcpinfo->spts[0]);
360 }
361
362 if (tcpinfo->dpts[0] != 0
363 || tcpinfo->dpts[1] != 0xFFFF) {
364 if (tcpinfo->invflags & IP6T_TCP_INV_DSTPT)
365 printf("! ");
366 if (tcpinfo->dpts[0]
367 != tcpinfo->dpts[1])
368 printf("--dport %u:%u ",
369 tcpinfo->dpts[0],
370 tcpinfo->dpts[1]);
371 else
372 printf("--dport %u ",
373 tcpinfo->dpts[0]);
374 }
375
376 if (tcpinfo->option
377 || (tcpinfo->invflags & IP6T_TCP_INV_OPTION)) {
378 if (tcpinfo->invflags & IP6T_TCP_INV_OPTION)
379 printf("! ");
380 printf("--tcp-option %u ", tcpinfo->option);
381 }
382
383 if (tcpinfo->flg_mask
384 || (tcpinfo->invflags & IP6T_TCP_INV_FLAGS)) {
385 if (tcpinfo->invflags & IP6T_TCP_INV_FLAGS)
386 printf("! ");
387
388 printf("--tcp-flags ");
389 if (tcpinfo->flg_mask != 0xFF) {
390 print_tcpf(tcpinfo->flg_mask);
391 }
392 printf(" ");
393 print_tcpf(tcpinfo->flg_cmp);
394 printf(" ");
395 }
396 }
397
398 static struct ip6tables_match tcp = {
399 .name = "tcp",
400 .version = IPTABLES_VERSION,
401 .size = IP6T_ALIGN(sizeof(struct ip6t_tcp)),
402 .userspacesize = IP6T_ALIGN(sizeof(struct ip6t_tcp)),
403 .help = &help,
404 .init = &init,
405 .parse = &parse,
406 .final_check = &final_check,
407 .print = &print,
408 .save = &save,
409 .extra_opts = opts,
410 };
411
412 void
_init(void)413 _init(void)
414 {
415 register_match6(&tcp);
416 }
417