1 /* Shared library add-on to iptables to add TCP support. */
8 #include <linux/netfilter_ipv4/ip_tables.h>
10 /* Function which prints out usage message. */
16 " --tcp-flags [!] mask comp match when TCP flags & mask == comp\n"
17 " (Flags: SYN ACK FIN RST URG PSH ALL NONE)\n"
18 "[!] --syn match when only SYN flag set\n"
19 " (equivalent to --tcp-flags SYN,RST,ACK SYN)\n"
20 " --source-port [!] port[:port]\n"
22 " match source port(s)\n"
23 " --destination-port [!] port[:port]\n"
25 " match destination port(s)\n"
26 " --tcp-option [!] number match if TCP option set\n\n",
30 static struct option opts[] = {
31 { "source-port", 1, 0, '1' },
32 { "sport", 1, 0, '1' }, /* synonym */
33 { "destination-port", 1, 0, '2' },
34 { "dport", 1, 0, '2' }, /* synonym */
36 { "tcp-flags", 1, 0, '4' },
37 { "tcp-option", 1, 0, '5' },
42 service_to_port(const char *name)
44 struct servent *service;
46 if ((service = getservbyname(name, "tcp")) != NULL)
47 return ntohs((unsigned short) service->s_port);
53 parse_tcp_port(const char *port)
57 if (string_to_number(port, 0, 65535, &portnum) != -1 ||
58 (portnum = service_to_port(port)) != -1)
59 return (u_int16_t)portnum;
61 exit_error(PARAMETER_PROBLEM,
62 "invalid TCP port/service `%s' specified", port);
66 parse_tcp_ports(const char *portstring, u_int16_t *ports)
71 buffer = strdup(portstring);
72 if ((cp = strchr(buffer, ':')) == NULL)
73 ports[0] = ports[1] = parse_tcp_port(buffer);
78 ports[0] = buffer[0] ? parse_tcp_port(buffer) : 0;
79 ports[1] = cp[0] ? parse_tcp_port(cp) : 0xFFFF;
81 if (ports[0] > ports[1])
82 exit_error(PARAMETER_PROBLEM,
83 "invalid portrange (min > max)");
88 struct tcp_flag_names {
93 static struct tcp_flag_names tcp_flag_names[]
105 parse_tcp_flag(const char *flags)
107 unsigned int ret = 0;
111 buffer = strdup(flags);
113 for (ptr = strtok(buffer, ","); ptr; ptr = strtok(NULL, ",")) {
116 i < sizeof(tcp_flag_names)/sizeof(struct tcp_flag_names);
118 if (strcasecmp(tcp_flag_names[i].name, ptr) == 0) {
119 ret |= tcp_flag_names[i].flag;
123 if (i == sizeof(tcp_flag_names)/sizeof(struct tcp_flag_names))
124 exit_error(PARAMETER_PROBLEM,
125 "Unknown TCP flag `%s'", ptr);
133 parse_tcp_flags(struct ipt_tcp *tcpinfo,
138 tcpinfo->flg_mask = parse_tcp_flag(mask);
139 tcpinfo->flg_cmp = parse_tcp_flag(cmp);
142 tcpinfo->invflags |= IPT_TCP_INV_FLAGS;
146 parse_tcp_option(const char *option, u_int8_t *result)
150 if (string_to_number(option, 1, 255, &ret) == -1)
151 exit_error(PARAMETER_PROBLEM, "Bad TCP option `%s'", option);
153 *result = (u_int8_t)ret;
156 /* Initialize the match. */
158 init(struct ipt_entry_match *m, unsigned int *nfcache)
160 struct ipt_tcp *tcpinfo = (struct ipt_tcp *)m->data;
162 tcpinfo->spts[1] = tcpinfo->dpts[1] = 0xFFFF;
165 #define TCP_SRC_PORTS 0x01
166 #define TCP_DST_PORTS 0x02
167 #define TCP_FLAGS 0x04
168 #define TCP_OPTION 0x08
170 /* Function which parses command options; returns true if it
173 parse(int c, char **argv, int invert, unsigned int *flags,
174 const struct ipt_entry *entry,
175 unsigned int *nfcache,
176 struct ipt_entry_match **match)
178 struct ipt_tcp *tcpinfo = (struct ipt_tcp *)(*match)->data;
182 if (*flags & TCP_SRC_PORTS)
183 exit_error(PARAMETER_PROBLEM,
184 "Only one `--source-port' allowed");
185 check_inverse(optarg, &invert, &optind, 0);
186 parse_tcp_ports(argv[optind-1], tcpinfo->spts);
188 tcpinfo->invflags |= IPT_TCP_INV_SRCPT;
189 *flags |= TCP_SRC_PORTS;
193 if (*flags & TCP_DST_PORTS)
194 exit_error(PARAMETER_PROBLEM,
195 "Only one `--destination-port' allowed");
196 check_inverse(optarg, &invert, &optind, 0);
197 parse_tcp_ports(argv[optind-1], tcpinfo->dpts);
199 tcpinfo->invflags |= IPT_TCP_INV_DSTPT;
200 *flags |= TCP_DST_PORTS;
204 if (*flags & TCP_FLAGS)
205 exit_error(PARAMETER_PROBLEM,
206 "Only one of `--syn' or `--tcp-flags' "
208 parse_tcp_flags(tcpinfo, "SYN,RST,ACK,FIN", "SYN", invert);
213 if (*flags & TCP_FLAGS)
214 exit_error(PARAMETER_PROBLEM,
215 "Only one of `--syn' or `--tcp-flags' "
217 check_inverse(optarg, &invert, &optind, 0);
220 || argv[optind][0] == '-' || argv[optind][0] == '!')
221 exit_error(PARAMETER_PROBLEM,
222 "--tcp-flags requires two args.");
224 parse_tcp_flags(tcpinfo, argv[optind-1], argv[optind],
231 if (*flags & TCP_OPTION)
232 exit_error(PARAMETER_PROBLEM,
233 "Only one `--tcp-option' allowed");
234 check_inverse(optarg, &invert, &optind, 0);
235 parse_tcp_option(argv[optind-1], &tcpinfo->option);
237 tcpinfo->invflags |= IPT_TCP_INV_OPTION;
238 *flags |= TCP_OPTION;
248 /* Final check; we don't care. */
250 final_check(unsigned int flags)
255 port_to_service(int port)
257 struct servent *service;
259 if ((service = getservbyport(htons(port), "tcp")))
260 return service->s_name;
266 print_port(u_int16_t port, int numeric)
270 if (numeric || (service = port_to_service(port)) == NULL)
273 printf("%s", service);
277 print_ports(const char *name, u_int16_t min, u_int16_t max,
278 int invert, int numeric)
280 const char *inv = invert ? "!" : "";
282 if (min != 0 || max != 0xFFFF || invert) {
286 print_port(min, numeric);
289 print_port(min, numeric);
291 print_port(max, numeric);
298 print_option(u_int8_t option, int invert, int numeric)
300 if (option || invert)
301 printf("option=%s%u ", invert ? "!" : "", option);
305 print_tcpf(u_int8_t flags)
312 for (i = 0; (flags & tcp_flag_names[i].flag) == 0; i++);
316 printf("%s", tcp_flag_names[i].name);
319 flags &= ~tcp_flag_names[i].flag;
327 print_flags(u_int8_t mask, u_int8_t cmp, int invert, int numeric)
329 if (mask || invert) {
330 printf("flags:%s", invert ? "!" : "");
332 printf("0x%02X/0x%02X ", mask, cmp);
342 /* Prints out the union ipt_matchinfo. */
344 print(const struct ipt_ip *ip,
345 const struct ipt_entry_match *match, int numeric)
347 const struct ipt_tcp *tcp = (struct ipt_tcp *)match->data;
350 print_ports("spt", tcp->spts[0], tcp->spts[1],
351 tcp->invflags & IPT_TCP_INV_SRCPT,
353 print_ports("dpt", tcp->dpts[0], tcp->dpts[1],
354 tcp->invflags & IPT_TCP_INV_DSTPT,
356 print_option(tcp->option,
357 tcp->invflags & IPT_TCP_INV_OPTION,
359 print_flags(tcp->flg_mask, tcp->flg_cmp,
360 tcp->invflags & IPT_TCP_INV_FLAGS,
362 if (tcp->invflags & ~IPT_TCP_INV_MASK)
363 printf("Unknown invflags: 0x%X ",
364 tcp->invflags & ~IPT_TCP_INV_MASK);
367 /* Saves the union ipt_matchinfo in parsable form to stdout. */
368 static void save(const struct ipt_ip *ip, const struct ipt_entry_match *match)
370 const struct ipt_tcp *tcpinfo = (struct ipt_tcp *)match->data;
372 if (tcpinfo->spts[0] != 0
373 || tcpinfo->spts[1] != 0xFFFF) {
374 if (tcpinfo->invflags & IPT_TCP_INV_SRCPT)
378 printf("--sport %u:%u ",
382 printf("--sport %u ",
386 if (tcpinfo->dpts[0] != 0
387 || tcpinfo->dpts[1] != 0xFFFF) {
388 if (tcpinfo->invflags & IPT_TCP_INV_DSTPT)
392 printf("--dport %u:%u ",
396 printf("--dport %u ",
401 || (tcpinfo->invflags & IPT_TCP_INV_OPTION)) {
402 if (tcpinfo->invflags & IPT_TCP_INV_OPTION)
404 printf("--tcp-option %u ", tcpinfo->option);
407 if (tcpinfo->flg_mask
408 || (tcpinfo->invflags & IPT_TCP_INV_FLAGS)) {
409 if (tcpinfo->invflags & IPT_TCP_INV_FLAGS)
411 printf("--tcp-flags ");
412 if (tcpinfo->flg_mask != 0xFF) {
413 print_tcpf(tcpinfo->flg_mask);
416 print_tcpf(tcpinfo->flg_cmp);
421 static struct iptables_match tcp = {
424 .version = IPTABLES_VERSION,
425 .size = IPT_ALIGN(sizeof(struct ipt_tcp)),
426 .userspacesize = IPT_ALIGN(sizeof(struct ipt_tcp)),
430 .final_check = &final_check,
439 register_match(&tcp);