extensions/libipt_tcp.c

   1 /* Shared library add-on to iptables to add TCP support. */
   2 #include <stdio.h>
   3 #include <netdb.h>
   4 #include <string.h>
   5 #include <stdlib.h>
   6 #include <getopt.h>
   7 #include <iptables.h>
   8 #include <linux/netfilter_ipv4/ip_tables.h>
   9
  10 /* Function which prints out usage message. */
  11 static void
  12 help(void)
  13 {
  14         printf(
  15 "TCP v%s options:\n"
  16 " --tcp-flags [!] mask comp     match when TCP flags & mask == comp\n"
  17 "                               (Flags: SYN ACK FIN RST URG PSH ALL NONE)\n"
  18 "[!] --syn                      match when only SYN flag set\n"
  19 "                               (equivalent to --tcp-flags SYN,RST,ACK SYN)\n"
  20 " --source-port [!] port[:port]\n"
  21 " --sport ...\n"
  22 "                               match source port(s)\n"
  23 " --destination-port [!] port[:port]\n"
  24 " --dport ...\n"
  25 "                               match destination port(s)\n"
  26 " --tcp-option [!] number       match if TCP option set\n\n",
  27 IPTABLES_VERSION);
  28 }
  29
  30 static struct option opts[] = {
  31         { "source-port", 1, 0, '1' },
  32         { "sport", 1, 0, '1' }, /* synonym */
  33         { "destination-port", 1, 0, '2' },
  34         { "dport", 1, 0, '2' }, /* synonym */
  35         { "syn", 0, 0, '3' },
  36         { "tcp-flags", 1, 0, '4' },
  37         { "tcp-option", 1, 0, '5' },
  38         {0}
  39 };
  40
  41 static int
  42 service_to_port(const char *name)
  43 {
  44         struct servent *service;
  45
  46         if ((service = getservbyname(name, "tcp")) != NULL)
  47                 return ntohs((unsigned short) service->s_port);
  48
  49         return -1;
  50 }
  51
  52 static u_int16_t
  53 parse_tcp_port(const char *port)
  54 {
  55         unsigned int portnum;
  56
  57         if (string_to_number(port, 0, 65535, &portnum) != -1 ||
  58             (portnum = service_to_port(port)) != -1)
  59                 return (u_int16_t)portnum;
  60
  61         exit_error(PARAMETER_PROBLEM,
  62                    "invalid TCP port/service `%s' specified", port);
  63 }
  64
  65 static void
  66 parse_tcp_ports(const char *portstring, u_int16_t *ports)
  67 {
  68         char *buffer;
  69         char *cp;
  70
  71         buffer = strdup(portstring);
  72         if ((cp = strchr(buffer, ':')) == NULL)
  73                 ports[0] = ports[1] = parse_tcp_port(buffer);
  74         else {
  75                 *cp = '\0';
  76                 cp++;
  77
  78                 ports[0] = buffer[0] ? parse_tcp_port(buffer) : 0;
  79                 ports[1] = cp[0] ? parse_tcp_port(cp) : 0xFFFF;
  80
  81                 if (ports[0] > ports[1])
  82                         exit_error(PARAMETER_PROBLEM,
  83                                    "invalid portrange (min > max)");
  84         }
  85         free(buffer);
  86 }
  87
  88 struct tcp_flag_names {
  89         const char *name;
  90         unsigned int flag;
  91 };
  92
  93 static struct tcp_flag_names tcp_flag_names[]
  94 = { { "FIN", 0x01 },
  95     { "SYN", 0x02 },
  96     { "RST", 0x04 },
  97     { "PSH", 0x08 },
  98     { "ACK", 0x10 },
  99     { "URG", 0x20 },
 100     { "ALL", 0x3F },
 101     { "NONE", 0 },
 102 };
 103
 104 static unsigned int
 105 parse_tcp_flag(const char *flags)
 106 {
 107         unsigned int ret = 0;
 108         char *ptr;
 109         char *buffer;
 110
 111         buffer = strdup(flags);
 112
 113         for (ptr = strtok(buffer, ","); ptr; ptr = strtok(NULL, ",")) {
 114                 unsigned int i;
 115                 for (i = 0;
 116                      i < sizeof(tcp_flag_names)/sizeof(struct tcp_flag_names);
 117                      i++) {
 118                         if (strcasecmp(tcp_flag_names[i].name, ptr) == 0) {
 119                                 ret |= tcp_flag_names[i].flag;
 120                                 break;
 121                         }
 122                 }
 123                 if (i == sizeof(tcp_flag_names)/sizeof(struct tcp_flag_names))
 124                         exit_error(PARAMETER_PROBLEM,
 125                                    "Unknown TCP flag `%s'", ptr);
 126                 }
 127
 128         free(buffer);
 129         return ret;
 130 }
 131
 132 static void
 133 parse_tcp_flags(struct ipt_tcp *tcpinfo,
 134                 const char *mask,
 135                 const char *cmp,
 136                 int invert)
 137 {
 138         tcpinfo->flg_mask = parse_tcp_flag(mask);
 139         tcpinfo->flg_cmp = parse_tcp_flag(cmp);
 140
 141         if (invert)
 142                 tcpinfo->invflags |= IPT_TCP_INV_FLAGS;
 143 }
 144
 145 static void
 146 parse_tcp_option(const char *option, u_int8_t *result)
 147 {
 148         unsigned int ret;
 149
 150         if (string_to_number(option, 1, 255, &ret) == -1)
 151                 exit_error(PARAMETER_PROBLEM, "Bad TCP option `%s'", option);
 152
 153         *result = (u_int8_t)ret;
 154 }
 155
 156 /* Initialize the match. */
 157 static void
 158 init(struct ipt_entry_match *m, unsigned int *nfcache)
 159 {
 160         struct ipt_tcp *tcpinfo = (struct ipt_tcp *)m->data;
 161
 162         tcpinfo->spts[1] = tcpinfo->dpts[1] = 0xFFFF;
 163 }
 164
 165 #define TCP_SRC_PORTS 0x01
 166 #define TCP_DST_PORTS 0x02
 167 #define TCP_FLAGS 0x04
 168 #define TCP_OPTION      0x08
 169
 170 /* Function which parses command options; returns true if it
 171    ate an option. */
 172 static int
 173 parse(int c, char **argv, int invert, unsigned int *flags,
 174       const struct ipt_entry *entry,
 175       unsigned int *nfcache,
 176       struct ipt_entry_match **match)
 177 {
 178         struct ipt_tcp *tcpinfo = (struct ipt_tcp *)(*match)->data;
 179
 180         switch (c) {
 181         case '1':
 182                 if (*flags & TCP_SRC_PORTS)
 183                         exit_error(PARAMETER_PROBLEM,
 184                                    "Only one `--source-port' allowed");
 185                 check_inverse(optarg, &invert, &optind, 0);
 186                 parse_tcp_ports(argv[optind-1], tcpinfo->spts);
 187                 if (invert)
 188                         tcpinfo->invflags |= IPT_TCP_INV_SRCPT;
 189                 *flags |= TCP_SRC_PORTS;
 190                 break;
 191
 192         case '2':
 193                 if (*flags & TCP_DST_PORTS)
 194                         exit_error(PARAMETER_PROBLEM,
 195                                    "Only one `--destination-port' allowed");
 196                 check_inverse(optarg, &invert, &optind, 0);
 197                 parse_tcp_ports(argv[optind-1], tcpinfo->dpts);
 198                 if (invert)
 199                         tcpinfo->invflags |= IPT_TCP_INV_DSTPT;
 200                 *flags |= TCP_DST_PORTS;
 201                 break;
 202
 203         case '3':
 204                 if (*flags & TCP_FLAGS)
 205                         exit_error(PARAMETER_PROBLEM,
 206                                    "Only one of `--syn' or `--tcp-flags' "
 207                                    " allowed");
 208                 parse_tcp_flags(tcpinfo, "SYN,RST,ACK,FIN", "SYN", invert);
 209                 *flags |= TCP_FLAGS;
 210                 break;
 211
 212         case '4':
 213                 if (*flags & TCP_FLAGS)
 214                         exit_error(PARAMETER_PROBLEM,
 215                                    "Only one of `--syn' or `--tcp-flags' "
 216                                    " allowed");
 217                 check_inverse(optarg, &invert, &optind, 0);
 218
 219                 if (!argv[optind]
 220                     || argv[optind][0] == '-' || argv[optind][0] == '!')
 221                         exit_error(PARAMETER_PROBLEM,
 222                                    "--tcp-flags requires two args.");
 223
 224                 parse_tcp_flags(tcpinfo, argv[optind-1], argv[optind],
 225                                 invert);
 226                 optind++;
 227                 *flags |= TCP_FLAGS;
 228                 break;
 229
 230         case '5':
 231                 if (*flags & TCP_OPTION)
 232                         exit_error(PARAMETER_PROBLEM,
 233                                    "Only one `--tcp-option' allowed");
 234                 check_inverse(optarg, &invert, &optind, 0);
 235                 parse_tcp_option(argv[optind-1], &tcpinfo->option);
 236                 if (invert)
 237                         tcpinfo->invflags |= IPT_TCP_INV_OPTION;
 238                 *flags |= TCP_OPTION;
 239                 break;
 240
 241         default:
 242                 return 0;
 243         }
 244
 245         return 1;
 246 }
 247
 248 /* Final check; we don't care. */
 249 static void
 250 final_check(unsigned int flags)
 251 {
 252 }
 253
 254 static char *
 255 port_to_service(int port)
 256 {
 257         struct servent *service;
 258
 259         if ((service = getservbyport(htons(port), "tcp")))
 260                 return service->s_name;
 261
 262         return NULL;
 263 }
 264
 265 static void
 266 print_port(u_int16_t port, int numeric)
 267 {
 268         char *service;
 269
 270         if (numeric || (service = port_to_service(port)) == NULL)
 271                 printf("%u", port);
 272         else
 273                 printf("%s", service);
 274 }
 275
 276 static void
 277 print_ports(const char *name, u_int16_t min, u_int16_t max,
 278             int invert, int numeric)
 279 {
 280         const char *inv = invert ? "!" : "";
 281
 282         if (min != 0 || max != 0xFFFF || invert) {
 283                 printf("%s", name);
 284                 if (min == max) {
 285                         printf(":%s", inv);
 286                         print_port(min, numeric);
 287                 } else {
 288                         printf("s:%s", inv);
 289                         print_port(min, numeric);
 290                         printf(":");
 291                         print_port(max, numeric);
 292                 }
 293                 printf(" ");
 294         }
 295 }
 296
 297 static void
 298 print_option(u_int8_t option, int invert, int numeric)
 299 {
 300         if (option || invert)
 301                 printf("option=%s%u ", invert ? "!" : "", option);
 302 }
 303
 304 static void
 305 print_tcpf(u_int8_t flags)
 306 {
 307         int have_flag = 0;
 308
 309         while (flags) {
 310                 unsigned int i;
 311
 312                 for (i = 0; (flags & tcp_flag_names[i].flag) == 0; i++);
 313
 314                 if (have_flag)
 315                         printf(",");
 316                 printf("%s", tcp_flag_names[i].name);
 317                 have_flag = 1;
 318
 319                 flags &= ~tcp_flag_names[i].flag;
 320         }
 321
 322         if (!have_flag)
 323                 printf("NONE");
 324 }
 325
 326 static void
 327 print_flags(u_int8_t mask, u_int8_t cmp, int invert, int numeric)
 328 {
 329         if (mask || invert) {
 330                 printf("flags:%s", invert ? "!" : "");
 331                 if (numeric)
 332                         printf("0x%02X/0x%02X ", mask, cmp);
 333                 else {
 334                         print_tcpf(mask);
 335                         printf("/");
 336                         print_tcpf(cmp);
 337                         printf(" ");
 338                 }
 339         }
 340 }
 341
 342 /* Prints out the union ipt_matchinfo. */
 343 static void
 344 print(const struct ipt_ip *ip,
 345       const struct ipt_entry_match *match, int numeric)
 346 {
 347         const struct ipt_tcp *tcp = (struct ipt_tcp *)match->data;
 348
 349         printf("tcp ");
 350         print_ports("spt", tcp->spts[0], tcp->spts[1],
 351                     tcp->invflags & IPT_TCP_INV_SRCPT,
 352                     numeric);
 353         print_ports("dpt", tcp->dpts[0], tcp->dpts[1],
 354                     tcp->invflags & IPT_TCP_INV_DSTPT,
 355                     numeric);
 356         print_option(tcp->option,
 357                      tcp->invflags & IPT_TCP_INV_OPTION,
 358                      numeric);
 359         print_flags(tcp->flg_mask, tcp->flg_cmp,
 360                     tcp->invflags & IPT_TCP_INV_FLAGS,
 361                     numeric);
 362         if (tcp->invflags & ~IPT_TCP_INV_MASK)
 363                 printf("Unknown invflags: 0x%X ",
 364                        tcp->invflags & ~IPT_TCP_INV_MASK);
 365 }
 366
 367 /* Saves the union ipt_matchinfo in parsable form to stdout. */
 368 static void save(const struct ipt_ip *ip, const struct ipt_entry_match *match)
 369 {
 370         const struct ipt_tcp *tcpinfo = (struct ipt_tcp *)match->data;
 371
 372         if (tcpinfo->spts[0] != 0
 373             || tcpinfo->spts[1] != 0xFFFF) {
 374                 if (tcpinfo->invflags & IPT_TCP_INV_SRCPT)
 375                         printf("! ");
 376                 if (tcpinfo->spts[0]
 377                     != tcpinfo->spts[1])
 378                         printf("--sport %u:%u ",
 379                                tcpinfo->spts[0],
 380                                tcpinfo->spts[1]);
 381                 else
 382                         printf("--sport %u ",
 383                                tcpinfo->spts[0]);
 384         }
 385
 386         if (tcpinfo->dpts[0] != 0
 387             || tcpinfo->dpts[1] != 0xFFFF) {
 388                 if (tcpinfo->invflags & IPT_TCP_INV_DSTPT)
 389                         printf("! ");
 390                 if (tcpinfo->dpts[0]
 391                     != tcpinfo->dpts[1])
 392                         printf("--dport %u:%u ",
 393                                tcpinfo->dpts[0],
 394                                tcpinfo->dpts[1]);
 395                 else
 396                         printf("--dport %u ",
 397                                tcpinfo->dpts[0]);
 398         }
 399
 400         if (tcpinfo->option
 401             || (tcpinfo->invflags & IPT_TCP_INV_OPTION)) {
 402                 if (tcpinfo->invflags & IPT_TCP_INV_OPTION)
 403                         printf("! ");
 404                 printf("--tcp-option %u ", tcpinfo->option);
 405         }
 406
 407         if (tcpinfo->flg_mask
 408             || (tcpinfo->invflags & IPT_TCP_INV_FLAGS)) {
 409                 if (tcpinfo->invflags & IPT_TCP_INV_FLAGS)
 410                         printf("! ");
 411                 printf("--tcp-flags ");
 412                 if (tcpinfo->flg_mask != 0xFF) {
 413                         print_tcpf(tcpinfo->flg_mask);
 414                 }
 415                 printf(" ");
 416                 print_tcpf(tcpinfo->flg_cmp);
 417                 printf(" ");
 418         }
 419 }
 420
 421 static struct iptables_match tcp = {
 422         .next           = NULL,
 423         .name           = "tcp",
 424         .version        = IPTABLES_VERSION,
 425         .size           = IPT_ALIGN(sizeof(struct ipt_tcp)),
 426         .userspacesize  = IPT_ALIGN(sizeof(struct ipt_tcp)),
 427         .help           = &help,
 428         .init           = &init,
 429         .parse          = &parse,
 430         .final_check    = &final_check,
 431         .print          = &print,
 432         .save           = &save,
 433         .extra_opts     = opts
 434 };
 435
 436 void
 437 _init(void)
 438 {
 439         register_match(&tcp);
 440 }