1 /*
2 * Arturo Borrero Gonzalez <arturo@debian.org> adapted
3 * this code to libxtables for arptables-compat in 2015
4 */
5
6 #include <stdio.h>
7 #include <netdb.h>
8 #include <string.h>
9 #include <stdlib.h>
10 #include <limits.h>
11 #include <getopt.h>
12 #include <netinet/ether.h>
13 #include <xtables.h>
14 #include <linux/netfilter_arp/arpt_mangle.h>
15 #include "iptables/nft.h"
16 #include "iptables/nft-arp.h"
17
arpmangle_print_help(void)18 static void arpmangle_print_help(void)
19 {
20 printf(
21 "mangle target options:\n"
22 "--mangle-ip-s IP address\n"
23 "--mangle-ip-d IP address\n"
24 "--mangle-mac-s MAC address\n"
25 "--mangle-mac-d MAC address\n"
26 "--mangle-target target (DROP, CONTINUE or ACCEPT -- default is ACCEPT)\n");
27 }
28
29 #define MANGLE_IPS '1'
30 #define MANGLE_IPT '2'
31 #define MANGLE_DEVS '3'
32 #define MANGLE_DEVT '4'
33 #define MANGLE_TARGET '5'
34
35 static const struct option arpmangle_opts[] = {
36 { .name = "mangle-ip-s", .has_arg = true, .val = MANGLE_IPS },
37 { .name = "mangle-ip-d", .has_arg = true, .val = MANGLE_IPT },
38 { .name = "mangle-mac-s", .has_arg = true, .val = MANGLE_DEVS },
39 { .name = "mangle-mac-d", .has_arg = true, .val = MANGLE_DEVT },
40 { .name = "mangle-target", .has_arg = true, .val = MANGLE_TARGET },
41 XT_GETOPT_TABLEEND,
42 };
43
arpmangle_init(struct xt_entry_target * target)44 static void arpmangle_init(struct xt_entry_target *target)
45 {
46 struct arpt_mangle *mangle = (struct arpt_mangle *)target->data;
47
48 mangle->target = NF_ACCEPT;
49 }
50
51 static int
arpmangle_parse(int c,char ** argv,int invert,unsigned int * flags,const void * entry,struct xt_entry_target ** target)52 arpmangle_parse(int c, char **argv, int invert, unsigned int *flags,
53 const void *entry, struct xt_entry_target **target)
54 {
55 struct arpt_mangle *mangle = (struct arpt_mangle *)(*target)->data;
56 struct in_addr *ipaddr, mask;
57 struct ether_addr *macaddr;
58 const struct arpt_entry *e = (const struct arpt_entry *)entry;
59 unsigned int nr;
60 int ret = 1;
61
62 memset(&mask, 0, sizeof(mask));
63
64 switch (c) {
65 case MANGLE_IPS:
66 xtables_ipparse_any(optarg, &ipaddr, &mask, &nr);
67 mangle->u_s.src_ip.s_addr = ipaddr->s_addr;
68 free(ipaddr);
69 mangle->flags |= ARPT_MANGLE_SIP;
70 break;
71 case MANGLE_IPT:
72 xtables_ipparse_any(optarg, &ipaddr, &mask, &nr);
73 mangle->u_t.tgt_ip.s_addr = ipaddr->s_addr;
74 free(ipaddr);
75 mangle->flags |= ARPT_MANGLE_TIP;
76 break;
77 case MANGLE_DEVS:
78 if (e->arp.arhln_mask == 0)
79 xtables_error(PARAMETER_PROBLEM,
80 "no --h-length defined");
81 if (e->arp.invflags & ARPT_INV_ARPHLN)
82 xtables_error(PARAMETER_PROBLEM,
83 "! --h-length not allowed for "
84 "--mangle-mac-s");
85 if (e->arp.arhln != 6)
86 xtables_error(PARAMETER_PROBLEM,
87 "only --h-length 6 supported");
88 macaddr = ether_aton(optarg);
89 if (macaddr == NULL)
90 xtables_error(PARAMETER_PROBLEM,
91 "invalid source MAC");
92 memcpy(mangle->src_devaddr, macaddr, e->arp.arhln);
93 mangle->flags |= ARPT_MANGLE_SDEV;
94 break;
95 case MANGLE_DEVT:
96 if (e->arp.arhln_mask == 0)
97 xtables_error(PARAMETER_PROBLEM,
98 "no --h-length defined");
99 if (e->arp.invflags & ARPT_INV_ARPHLN)
100 xtables_error(PARAMETER_PROBLEM,
101 "! hln not allowed for --mangle-mac-d");
102 if (e->arp.arhln != 6)
103 xtables_error(PARAMETER_PROBLEM,
104 "only --h-length 6 supported");
105 macaddr = ether_aton(optarg);
106 if (macaddr == NULL)
107 xtables_error(PARAMETER_PROBLEM, "invalid target MAC");
108 memcpy(mangle->tgt_devaddr, macaddr, e->arp.arhln);
109 mangle->flags |= ARPT_MANGLE_TDEV;
110 break;
111 case MANGLE_TARGET:
112 if (!strcmp(optarg, "DROP"))
113 mangle->target = NF_DROP;
114 else if (!strcmp(optarg, "ACCEPT"))
115 mangle->target = NF_ACCEPT;
116 else if (!strcmp(optarg, "CONTINUE"))
117 mangle->target = XT_CONTINUE;
118 else
119 xtables_error(PARAMETER_PROBLEM,
120 "bad target for --mangle-target");
121 break;
122 default:
123 ret = 0;
124 }
125
126 return ret;
127 }
128
arpmangle_final_check(unsigned int flags)129 static void arpmangle_final_check(unsigned int flags)
130 {
131 }
132
ipaddr_to(const struct in_addr * addrp,int numeric)133 static const char *ipaddr_to(const struct in_addr *addrp, int numeric)
134 {
135 if (numeric)
136 return xtables_ipaddr_to_numeric(addrp);
137 else
138 return xtables_ipaddr_to_anyname(addrp);
139 }
140
141 static void
arpmangle_print(const void * ip,const struct xt_entry_target * target,int numeric)142 arpmangle_print(const void *ip, const struct xt_entry_target *target,
143 int numeric)
144 {
145 struct arpt_mangle *m = (struct arpt_mangle *)(target->data);
146
147 if (m->flags & ARPT_MANGLE_SIP) {
148 printf(" --mangle-ip-s %s",
149 ipaddr_to(&(m->u_s.src_ip), numeric));
150 }
151 if (m->flags & ARPT_MANGLE_SDEV) {
152 printf(" --mangle-mac-s ");
153 xtables_print_mac((unsigned char *)m->src_devaddr);
154 }
155 if (m->flags & ARPT_MANGLE_TIP) {
156 printf(" --mangle-ip-d %s",
157 ipaddr_to(&(m->u_t.tgt_ip), numeric));
158 }
159 if (m->flags & ARPT_MANGLE_TDEV) {
160 printf(" --mangle-mac-d ");
161 xtables_print_mac((unsigned char *)m->tgt_devaddr);
162 }
163 if (m->target != NF_ACCEPT) {
164 printf(" --mangle-target %s",
165 m->target == NF_DROP ? "DROP" : "CONTINUE");
166 }
167 }
168
arpmangle_save(const void * ip,const struct xt_entry_target * target)169 static void arpmangle_save(const void *ip, const struct xt_entry_target *target)
170 {
171 arpmangle_print(ip, target, 0);
172 }
173
174 static struct xtables_target arpmangle_target = {
175 .name = "mangle",
176 .revision = 0,
177 .version = XTABLES_VERSION,
178 .family = NFPROTO_ARP,
179 .size = XT_ALIGN(sizeof(struct arpt_mangle)),
180 .userspacesize = XT_ALIGN(sizeof(struct arpt_mangle)),
181 .help = arpmangle_print_help,
182 .init = arpmangle_init,
183 .parse = arpmangle_parse,
184 .final_check = arpmangle_final_check,
185 .print = arpmangle_print,
186 .save = arpmangle_save,
187 .extra_opts = arpmangle_opts,
188 };
189
_init(void)190 void _init(void)
191 {
192 xtables_register_target(&arpmangle_target);
193 }
194