1 /* Shared library add-on to iptables to add TCP support. */
8 #include <linux/netfilter_ipv4/ip_tables.h>
10 /* Function which prints out usage message. */
16 " --tcp-flags [!] mask comp match when TCP flags & mask == comp\n"
17 " (Flags: SYN ACK FIN RST URG PSH ALL NONE)\n"
18 "[!] --syn match when only SYN flag set\n"
19 " (equivalent to --tcp-flags SYN,RST,ACK SYN)\n"
20 " --source-port [!] port[:port]\n"
22 " match source port(s)\n"
23 " --destination-port [!] port[:port]\n"
25 " match destination port(s)\n"
26 " --tcp-option [!] number match if TCP option set\n\n",
30 static struct option opts[] = {
31 { "source-port", 1, 0, '1' },
32 { "sport", 1, 0, '1' }, /* synonym */
33 { "destination-port", 1, 0, '2' },
34 { "dport", 1, 0, '2' }, /* synonym */
36 { "tcp-flags", 1, 0, '4' },
37 { "tcp-option", 1, 0, '5' },
42 service_to_port(const char *name)
44 struct servent *service;
46 if ((service = getservbyname(name, "tcp")) != NULL)
47 return ntohs((unsigned short) service->s_port);
53 parse_tcp_port(const char *port)
57 if (string_to_number(port, 0, 65535, &portnum) != -1 ||
58 (portnum = service_to_port(port)) != -1)
59 return (u_int16_t)portnum;
61 exit_error(PARAMETER_PROBLEM,
62 "invalid TCP port/service `%s' specified", port);
66 parse_tcp_ports(const char *portstring, u_int16_t *ports)
71 buffer = strdup(portstring);
72 if ((cp = strchr(buffer, ':')) == NULL)
73 ports[0] = ports[1] = parse_tcp_port(buffer);
78 ports[0] = buffer[0] ? parse_tcp_port(buffer) : 0;
79 ports[1] = cp[0] ? parse_tcp_port(cp) : 0xFFFF;
81 if (ports[0] > ports[1])
82 exit_error(PARAMETER_PROBLEM,
83 "invalid portrange (min > max)");
88 struct tcp_flag_names {
93 static struct tcp_flag_names tcp_flag_names[]
105 parse_tcp_flag(const char *flags)
107 unsigned int ret = 0;
111 buffer = strdup(flags);
113 for (ptr = strtok(buffer, ","); ptr; ptr = strtok(NULL, ",")) {
116 i < sizeof(tcp_flag_names)/sizeof(struct tcp_flag_names);
118 if (strcasecmp(tcp_flag_names[i].name, ptr) == 0) {
119 ret |= tcp_flag_names[i].flag;
123 if (i == sizeof(tcp_flag_names)/sizeof(struct tcp_flag_names))
124 exit_error(PARAMETER_PROBLEM,
125 "Unknown TCP flag `%s'", ptr);
133 parse_tcp_flags(struct ipt_tcp *tcpinfo,
138 tcpinfo->flg_mask = parse_tcp_flag(mask);
139 tcpinfo->flg_cmp = parse_tcp_flag(cmp);
142 tcpinfo->invflags |= IPT_TCP_INV_FLAGS;
146 parse_tcp_option(const char *option, u_int8_t *result)
150 if (string_to_number(option, 1, 255, &ret) == -1)
151 exit_error(PARAMETER_PROBLEM, "Bad TCP option `%s'", option);
153 *result = (u_int8_t)ret;
156 /* Initialize the match. */
158 init(struct ipt_entry_match *m, unsigned int *nfcache)
160 struct ipt_tcp *tcpinfo = (struct ipt_tcp *)m->data;
162 tcpinfo->spts[1] = tcpinfo->dpts[1] = 0xFFFF;
165 #define TCP_SRC_PORTS 0x01
166 #define TCP_DST_PORTS 0x02
167 #define TCP_FLAGS 0x04
168 #define TCP_OPTION 0x08
170 /* Function which parses command options; returns true if it
173 parse(int c, char **argv, int invert, unsigned int *flags,
174 const struct ipt_entry *entry,
175 unsigned int *nfcache,
176 struct ipt_entry_match **match)
178 struct ipt_tcp *tcpinfo = (struct ipt_tcp *)(*match)->data;
182 if (*flags & TCP_SRC_PORTS)
183 exit_error(PARAMETER_PROBLEM,
184 "Only one `--source-port' allowed");
185 check_inverse(optarg, &invert, &optind, 0);
186 parse_tcp_ports(argv[optind-1], tcpinfo->spts);
188 tcpinfo->invflags |= IPT_TCP_INV_SRCPT;
189 *flags |= TCP_SRC_PORTS;
190 *nfcache |= NFC_IP_SRC_PT;
194 if (*flags & TCP_DST_PORTS)
195 exit_error(PARAMETER_PROBLEM,
196 "Only one `--destination-port' allowed");
197 check_inverse(optarg, &invert, &optind, 0);
198 parse_tcp_ports(argv[optind-1], tcpinfo->dpts);
200 tcpinfo->invflags |= IPT_TCP_INV_DSTPT;
201 *flags |= TCP_DST_PORTS;
202 *nfcache |= NFC_IP_DST_PT;
206 if (*flags & TCP_FLAGS)
207 exit_error(PARAMETER_PROBLEM,
208 "Only one of `--syn' or `--tcp-flags' "
210 parse_tcp_flags(tcpinfo, "SYN,RST,ACK", "SYN", invert);
212 *nfcache |= NFC_IP_TCPFLAGS;
216 if (*flags & TCP_FLAGS)
217 exit_error(PARAMETER_PROBLEM,
218 "Only one of `--syn' or `--tcp-flags' "
220 check_inverse(optarg, &invert, &optind, 0);
223 || argv[optind][0] == '-' || argv[optind][0] == '!')
224 exit_error(PARAMETER_PROBLEM,
225 "--tcp-flags requires two args.");
227 parse_tcp_flags(tcpinfo, argv[optind-1], argv[optind],
231 *nfcache |= NFC_IP_TCPFLAGS;
235 if (*flags & TCP_OPTION)
236 exit_error(PARAMETER_PROBLEM,
237 "Only one `--tcp-option' allowed");
238 check_inverse(optarg, &invert, &optind, 0);
239 parse_tcp_option(argv[optind-1], &tcpinfo->option);
241 tcpinfo->invflags |= IPT_TCP_INV_OPTION;
242 *flags |= TCP_OPTION;
243 *nfcache |= NFC_IP_PROTO_UNKNOWN;
253 /* Final check; we don't care. */
255 final_check(unsigned int flags)
260 port_to_service(int port)
262 struct servent *service;
264 if ((service = getservbyport(htons(port), "tcp")))
265 return service->s_name;
271 print_port(u_int16_t port, int numeric)
275 if (numeric || (service = port_to_service(port)) == NULL)
278 printf("%s", service);
282 print_ports(const char *name, u_int16_t min, u_int16_t max,
283 int invert, int numeric)
285 const char *inv = invert ? "!" : "";
287 if (min != 0 || max != 0xFFFF || invert) {
291 print_port(min, numeric);
294 print_port(min, numeric);
296 print_port(max, numeric);
303 print_option(u_int8_t option, int invert, int numeric)
305 if (option || invert)
306 printf("option=%s%u ", invert ? "!" : "", option);
310 print_tcpf(u_int8_t flags)
317 for (i = 0; (flags & tcp_flag_names[i].flag) == 0; i++);
321 printf("%s", tcp_flag_names[i].name);
324 flags &= ~tcp_flag_names[i].flag;
332 print_flags(u_int8_t mask, u_int8_t cmp, int invert, int numeric)
334 if (mask || invert) {
335 printf("flags:%s", invert ? "!" : "");
337 printf("0x%02X/0x%02X ", mask, cmp);
347 /* Prints out the union ipt_matchinfo. */
349 print(const struct ipt_ip *ip,
350 const struct ipt_entry_match *match, int numeric)
352 const struct ipt_tcp *tcp = (struct ipt_tcp *)match->data;
355 print_ports("spt", tcp->spts[0], tcp->spts[1],
356 tcp->invflags & IPT_TCP_INV_SRCPT,
358 print_ports("dpt", tcp->dpts[0], tcp->dpts[1],
359 tcp->invflags & IPT_TCP_INV_DSTPT,
361 print_option(tcp->option,
362 tcp->invflags & IPT_TCP_INV_OPTION,
364 print_flags(tcp->flg_mask, tcp->flg_cmp,
365 tcp->invflags & IPT_TCP_INV_FLAGS,
367 if (tcp->invflags & ~IPT_TCP_INV_MASK)
368 printf("Unknown invflags: 0x%X ",
369 tcp->invflags & ~IPT_TCP_INV_MASK);
372 /* Saves the union ipt_matchinfo in parsable form to stdout. */
373 static void save(const struct ipt_ip *ip, const struct ipt_entry_match *match)
375 const struct ipt_tcp *tcpinfo = (struct ipt_tcp *)match->data;
377 if (tcpinfo->spts[0] != 0
378 || tcpinfo->spts[1] != 0xFFFF) {
379 if (tcpinfo->invflags & IPT_TCP_INV_SRCPT)
383 printf("--sport %u:%u ",
387 printf("--sport %u ",
391 if (tcpinfo->dpts[0] != 0
392 || tcpinfo->dpts[1] != 0xFFFF) {
393 if (tcpinfo->invflags & IPT_TCP_INV_DSTPT)
397 printf("--dport %u:%u ",
401 printf("--dport %u ",
406 || (tcpinfo->invflags & IPT_TCP_INV_OPTION)) {
407 if (tcpinfo->invflags & IPT_TCP_INV_OPTION)
409 printf("--tcp-option %u ", tcpinfo->option);
412 if (tcpinfo->flg_mask
413 || (tcpinfo->invflags & IPT_TCP_INV_FLAGS)) {
414 if (tcpinfo->invflags & IPT_TCP_INV_FLAGS)
416 printf("--tcp-flags ");
417 if (tcpinfo->flg_mask != 0xFF) {
418 print_tcpf(tcpinfo->flg_mask);
421 print_tcpf(tcpinfo->flg_cmp);
427 struct iptables_match tcp
431 IPT_ALIGN(sizeof(struct ipt_tcp)),
432 IPT_ALIGN(sizeof(struct ipt_tcp)),
444 register_match(&tcp);