1 /* Shared library add-on to iptables to add UDP support. */
2 #include <stdio.h>
3 #include <netdb.h>
4 #include <string.h>
5 #include <stdlib.h>
6 #include <getopt.h>
7 #include <ip6tables.h>
8 #include <linux/netfilter_ipv6/ip6_tables.h>
9
10 /* Function which prints out usage message. */
11 static void
help(void)12 help(void)
13 {
14 printf(
15 "UDP v%s options:\n"
16 " --source-port [!] port[:port]\n"
17 " --sport ...\n"
18 " match source port(s)\n"
19 " --destination-port [!] port[:port]\n"
20 " --dport ...\n"
21 " match destination port(s)\n",
22 IPTABLES_VERSION);
23 }
24
25 static struct option opts[] = {
26 { "source-port", 1, 0, '1' },
27 { "sport", 1, 0, '1' }, /* synonym */
28 { "destination-port", 1, 0, '2' },
29 { "dport", 1, 0, '2' }, /* synonym */
30 {0}
31 };
32
33 static void
parse_udp_ports(const char * portstring,u_int16_t * ports)34 parse_udp_ports(const char *portstring, u_int16_t *ports)
35 {
36 char *buffer;
37 char *cp;
38
39 buffer = strdup(portstring);
40 if ((cp = strchr(buffer, ':')) == NULL)
41 ports[0] = ports[1] = parse_port(buffer, "udp");
42 else {
43 *cp = '\0';
44 cp++;
45
46 ports[0] = buffer[0] ? parse_port(buffer, "udp") : 0;
47 ports[1] = cp[0] ? parse_port(cp, "udp") : 0xFFFF;
48
49 if (ports[0] > ports[1])
50 exit_error(PARAMETER_PROBLEM,
51 "invalid portrange (min > max)");
52 }
53 free(buffer);
54 }
55
56 /* Initialize the match. */
57 static void
init(struct ip6t_entry_match * m,unsigned int * nfcache)58 init(struct ip6t_entry_match *m, unsigned int *nfcache)
59 {
60 struct ip6t_udp *udpinfo = (struct ip6t_udp *)m->data;
61
62 udpinfo->spts[1] = udpinfo->dpts[1] = 0xFFFF;
63 }
64
65 #define UDP_SRC_PORTS 0x01
66 #define UDP_DST_PORTS 0x02
67
68 /* Function which parses command options; returns true if it
69 ate an option */
70 static int
parse(int c,char ** argv,int invert,unsigned int * flags,const struct ip6t_entry * entry,unsigned int * nfcache,struct ip6t_entry_match ** match)71 parse(int c, char **argv, int invert, unsigned int *flags,
72 const struct ip6t_entry *entry,
73 unsigned int *nfcache,
74 struct ip6t_entry_match **match)
75 {
76 struct ip6t_udp *udpinfo = (struct ip6t_udp *)(*match)->data;
77
78 switch (c) {
79 case '1':
80 if (*flags & UDP_SRC_PORTS)
81 exit_error(PARAMETER_PROBLEM,
82 "Only one `--source-port' allowed");
83 check_inverse(optarg, &invert, &optind, 0);
84 parse_udp_ports(argv[optind-1], udpinfo->spts);
85 if (invert)
86 udpinfo->invflags |= IP6T_UDP_INV_SRCPT;
87 *flags |= UDP_SRC_PORTS;
88 break;
89
90 case '2':
91 if (*flags & UDP_DST_PORTS)
92 exit_error(PARAMETER_PROBLEM,
93 "Only one `--destination-port' allowed");
94 check_inverse(optarg, &invert, &optind, 0);
95 parse_udp_ports(argv[optind-1], udpinfo->dpts);
96 if (invert)
97 udpinfo->invflags |= IP6T_UDP_INV_DSTPT;
98 *flags |= UDP_DST_PORTS;
99 break;
100
101 default:
102 return 0;
103 }
104
105 return 1;
106 }
107
108 /* Final check; we don't care. */
109 static void
final_check(unsigned int flags)110 final_check(unsigned int flags)
111 {
112 }
113
114 static char *
port_to_service(int port)115 port_to_service(int port)
116 {
117 struct servent *service;
118
119 if ((service = getservbyport(htons(port), "udp")))
120 return service->s_name;
121
122 return NULL;
123 }
124
125 static void
print_port(u_int16_t port,int numeric)126 print_port(u_int16_t port, int numeric)
127 {
128 char *service;
129
130 if (numeric || (service = port_to_service(port)) == NULL)
131 printf("%u", port);
132 else
133 printf("%s", service);
134 }
135
136 static void
print_ports(const char * name,u_int16_t min,u_int16_t max,int invert,int numeric)137 print_ports(const char *name, u_int16_t min, u_int16_t max,
138 int invert, int numeric)
139 {
140 const char *inv = invert ? "!" : "";
141
142 if (min != 0 || max != 0xFFFF || invert) {
143 printf("%s", name);
144 if (min == max) {
145 printf(":%s", inv);
146 print_port(min, numeric);
147 } else {
148 printf("s:%s", inv);
149 print_port(min, numeric);
150 printf(":");
151 print_port(max, numeric);
152 }
153 printf(" ");
154 }
155 }
156
157 /* Prints out the union ipt_matchinfo. */
158 static void
print(const struct ip6t_ip6 * ip,const struct ip6t_entry_match * match,int numeric)159 print(const struct ip6t_ip6 *ip,
160 const struct ip6t_entry_match *match, int numeric)
161 {
162 const struct ip6t_udp *udp = (struct ip6t_udp *)match->data;
163
164 printf("udp ");
165 print_ports("spt", udp->spts[0], udp->spts[1],
166 udp->invflags & IP6T_UDP_INV_SRCPT,
167 numeric);
168 print_ports("dpt", udp->dpts[0], udp->dpts[1],
169 udp->invflags & IP6T_UDP_INV_DSTPT,
170 numeric);
171 if (udp->invflags & ~IP6T_UDP_INV_MASK)
172 printf("Unknown invflags: 0x%X ",
173 udp->invflags & ~IP6T_UDP_INV_MASK);
174 }
175
176 /* Saves the union ipt_matchinfo in parsable form to stdout. */
save(const struct ip6t_ip6 * ip,const struct ip6t_entry_match * match)177 static void save(const struct ip6t_ip6 *ip, const struct ip6t_entry_match *match)
178 {
179 const struct ip6t_udp *udpinfo = (struct ip6t_udp *)match->data;
180
181 if (udpinfo->spts[0] != 0
182 || udpinfo->spts[1] != 0xFFFF) {
183 if (udpinfo->invflags & IP6T_UDP_INV_SRCPT)
184 printf("! ");
185 if (udpinfo->spts[0]
186 != udpinfo->spts[1])
187 printf("--sport %u:%u ",
188 udpinfo->spts[0],
189 udpinfo->spts[1]);
190 else
191 printf("--sport %u ",
192 udpinfo->spts[0]);
193 }
194
195 if (udpinfo->dpts[0] != 0
196 || udpinfo->dpts[1] != 0xFFFF) {
197 if (udpinfo->invflags & IP6T_UDP_INV_DSTPT)
198 printf("! ");
199 if (udpinfo->dpts[0]
200 != udpinfo->dpts[1])
201 printf("--dport %u:%u ",
202 udpinfo->dpts[0],
203 udpinfo->dpts[1]);
204 else
205 printf("--dport %u ",
206 udpinfo->dpts[0]);
207 }
208 }
209
210 static struct ip6tables_match udp = {
211 .name = "udp",
212 .version = IPTABLES_VERSION,
213 .size = IP6T_ALIGN(sizeof(struct ip6t_udp)),
214 .userspacesize = IP6T_ALIGN(sizeof(struct ip6t_udp)),
215 .help = &help,
216 .init = &init,
217 .parse = &parse,
218 .final_check = &final_check,
219 .print = &print,
220 .save = &save,
221 .extra_opts = opts,
222 };
223
224 void
_init(void)225 _init(void)
226 {
227 register_match6(&udp);
228 }
229