733 lines
18 KiB
C
733 lines
18 KiB
C
/* ebt_ip
|
|
*
|
|
* Authors:
|
|
* Bart De Schuymer <bdschuym@pandora.be>
|
|
*
|
|
* Changes:
|
|
* added ip-sport and ip-dport; parsing of port arguments is
|
|
* based on code from iptables-1.2.7a
|
|
* Innominate Security Technologies AG <mhopf@innominate.com>
|
|
* September, 2002
|
|
*
|
|
* Adapted by Arturo Borrero Gonzalez <arturo@debian.org>
|
|
* to use libxtables for ebtables-compat in 2015.
|
|
*/
|
|
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
#include <string.h>
|
|
#include <getopt.h>
|
|
#include <netdb.h>
|
|
#include <inttypes.h>
|
|
#include <xtables.h>
|
|
|
|
#include "libxt_icmp.h"
|
|
|
|
#define EBT_IP_SOURCE 0x01
|
|
#define EBT_IP_DEST 0x02
|
|
#define EBT_IP_TOS 0x04
|
|
#define EBT_IP_PROTO 0x08
|
|
#define EBT_IP_SPORT 0x10
|
|
#define EBT_IP_DPORT 0x20
|
|
#define EBT_IP_ICMP 0x40
|
|
#define EBT_IP_IGMP 0x80
|
|
#define EBT_IP_MASK (EBT_IP_SOURCE | EBT_IP_DEST | EBT_IP_TOS | EBT_IP_PROTO |\
|
|
EBT_IP_SPORT | EBT_IP_DPORT | EBT_IP_ICMP | EBT_IP_IGMP)
|
|
|
|
struct ebt_ip_info {
|
|
__be32 saddr;
|
|
__be32 daddr;
|
|
__be32 smsk;
|
|
__be32 dmsk;
|
|
__u8 tos;
|
|
__u8 protocol;
|
|
__u8 bitmask;
|
|
__u8 invflags;
|
|
union {
|
|
__u16 sport[2];
|
|
__u8 icmp_type[2];
|
|
__u8 igmp_type[2];
|
|
};
|
|
union {
|
|
__u16 dport[2];
|
|
__u8 icmp_code[2];
|
|
};
|
|
};
|
|
|
|
#define IP_SOURCE '1'
|
|
#define IP_DEST '2'
|
|
#define IP_EBT_TOS '3' /* include/bits/in.h seems to already define IP_TOS */
|
|
#define IP_PROTO '4'
|
|
#define IP_SPORT '5'
|
|
#define IP_DPORT '6'
|
|
#define IP_EBT_ICMP '7'
|
|
#define IP_EBT_IGMP '8'
|
|
|
|
static const struct option brip_opts[] = {
|
|
{ .name = "ip-source", .has_arg = true, .val = IP_SOURCE },
|
|
{ .name = "ip-src", .has_arg = true, .val = IP_SOURCE },
|
|
{ .name = "ip-destination", .has_arg = true, .val = IP_DEST },
|
|
{ .name = "ip-dst", .has_arg = true, .val = IP_DEST },
|
|
{ .name = "ip-tos", .has_arg = true, .val = IP_EBT_TOS },
|
|
{ .name = "ip-protocol", .has_arg = true, .val = IP_PROTO },
|
|
{ .name = "ip-proto", .has_arg = true, .val = IP_PROTO },
|
|
{ .name = "ip-source-port", .has_arg = true, .val = IP_SPORT },
|
|
{ .name = "ip-sport", .has_arg = true, .val = IP_SPORT },
|
|
{ .name = "ip-destination-port",.has_arg = true, .val = IP_DPORT },
|
|
{ .name = "ip-dport", .has_arg = true, .val = IP_DPORT },
|
|
{ .name = "ip-icmp-type", .has_arg = true, .val = IP_EBT_ICMP },
|
|
{ .name = "ip-igmp-type", .has_arg = true, .val = IP_EBT_IGMP },
|
|
XT_GETOPT_TABLEEND,
|
|
};
|
|
|
|
static const struct xt_icmp_names icmp_codes[] = {
|
|
{ "echo-reply", 0, 0, 0xFF },
|
|
/* Alias */ { "pong", 0, 0, 0xFF },
|
|
|
|
{ "destination-unreachable", 3, 0, 0xFF },
|
|
{ "network-unreachable", 3, 0, 0 },
|
|
{ "host-unreachable", 3, 1, 1 },
|
|
{ "protocol-unreachable", 3, 2, 2 },
|
|
{ "port-unreachable", 3, 3, 3 },
|
|
{ "fragmentation-needed", 3, 4, 4 },
|
|
{ "source-route-failed", 3, 5, 5 },
|
|
{ "network-unknown", 3, 6, 6 },
|
|
{ "host-unknown", 3, 7, 7 },
|
|
{ "network-prohibited", 3, 9, 9 },
|
|
{ "host-prohibited", 3, 10, 10 },
|
|
{ "TOS-network-unreachable", 3, 11, 11 },
|
|
{ "TOS-host-unreachable", 3, 12, 12 },
|
|
{ "communication-prohibited", 3, 13, 13 },
|
|
{ "host-precedence-violation", 3, 14, 14 },
|
|
{ "precedence-cutoff", 3, 15, 15 },
|
|
|
|
{ "source-quench", 4, 0, 0xFF },
|
|
|
|
{ "redirect", 5, 0, 0xFF },
|
|
{ "network-redirect", 5, 0, 0 },
|
|
{ "host-redirect", 5, 1, 1 },
|
|
{ "TOS-network-redirect", 5, 2, 2 },
|
|
{ "TOS-host-redirect", 5, 3, 3 },
|
|
|
|
{ "echo-request", 8, 0, 0xFF },
|
|
/* Alias */ { "ping", 8, 0, 0xFF },
|
|
|
|
{ "router-advertisement", 9, 0, 0xFF },
|
|
|
|
{ "router-solicitation", 10, 0, 0xFF },
|
|
|
|
{ "time-exceeded", 11, 0, 0xFF },
|
|
/* Alias */ { "ttl-exceeded", 11, 0, 0xFF },
|
|
{ "ttl-zero-during-transit", 11, 0, 0 },
|
|
{ "ttl-zero-during-reassembly", 11, 1, 1 },
|
|
|
|
{ "parameter-problem", 12, 0, 0xFF },
|
|
{ "ip-header-bad", 12, 0, 0 },
|
|
{ "required-option-missing", 12, 1, 1 },
|
|
|
|
{ "timestamp-request", 13, 0, 0xFF },
|
|
|
|
{ "timestamp-reply", 14, 0, 0xFF },
|
|
|
|
{ "address-mask-request", 17, 0, 0xFF },
|
|
|
|
{ "address-mask-reply", 18, 0, 0xFF }
|
|
};
|
|
|
|
static const struct xt_icmp_names igmp_types[] = {
|
|
{ "membership-query", 0x11 },
|
|
{ "membership-report-v1", 0x12 },
|
|
{ "membership-report-v2", 0x16 },
|
|
{ "leave-group", 0x17 },
|
|
{ "membership-report-v3", 0x22 },
|
|
};
|
|
|
|
static void brip_print_help(void)
|
|
{
|
|
printf(
|
|
"ip options:\n"
|
|
"--ip-src [!] address[/mask]: ip source specification\n"
|
|
"--ip-dst [!] address[/mask]: ip destination specification\n"
|
|
"--ip-tos [!] tos : ip tos specification\n"
|
|
"--ip-proto [!] protocol : ip protocol specification\n"
|
|
"--ip-sport [!] port[:port] : tcp/udp source port or port range\n"
|
|
"--ip-dport [!] port[:port] : tcp/udp destination port or port range\n"
|
|
"--ip-icmp-type [!] type[[:type]/code[:code]] : icmp type/code or type/code range\n"
|
|
"--ip-igmp-type [!] type[:type] : igmp type or type range\n");
|
|
|
|
printf("\nValid ICMP Types:\n");
|
|
xt_print_icmp_types(icmp_codes, ARRAY_SIZE(icmp_codes));
|
|
printf("\nValid IGMP Types:\n");
|
|
xt_print_icmp_types(igmp_types, ARRAY_SIZE(igmp_types));
|
|
}
|
|
|
|
static void brip_init(struct xt_entry_match *match)
|
|
{
|
|
struct ebt_ip_info *info = (struct ebt_ip_info *)match->data;
|
|
|
|
info->invflags = 0;
|
|
info->bitmask = 0;
|
|
}
|
|
|
|
static void
|
|
parse_port_range(const char *protocol, const char *portstring, uint16_t *ports)
|
|
{
|
|
char *buffer;
|
|
char *cp;
|
|
|
|
buffer = strdup(portstring);
|
|
if ((cp = strchr(buffer, ':')) == NULL)
|
|
ports[0] = ports[1] = xtables_parse_port(buffer, NULL);
|
|
else {
|
|
*cp = '\0';
|
|
cp++;
|
|
|
|
ports[0] = buffer[0] ? xtables_parse_port(buffer, NULL) : 0;
|
|
ports[1] = cp[0] ? xtables_parse_port(cp, NULL) : 0xFFFF;
|
|
|
|
if (ports[0] > ports[1])
|
|
xtables_error(PARAMETER_PROBLEM,
|
|
"invalid portrange (min > max)");
|
|
}
|
|
free(buffer);
|
|
}
|
|
|
|
/* original code from ebtables: useful_functions.c */
|
|
static int undot_ip(char *ip, unsigned char *ip2)
|
|
{
|
|
char *p, *q, *end;
|
|
long int onebyte;
|
|
int i;
|
|
char buf[20];
|
|
|
|
strncpy(buf, ip, sizeof(buf) - 1);
|
|
|
|
p = buf;
|
|
for (i = 0; i < 3; i++) {
|
|
if ((q = strchr(p, '.')) == NULL)
|
|
return -1;
|
|
*q = '\0';
|
|
onebyte = strtol(p, &end, 10);
|
|
if (*end != '\0' || onebyte > 255 || onebyte < 0)
|
|
return -1;
|
|
ip2[i] = (unsigned char)onebyte;
|
|
p = q + 1;
|
|
}
|
|
|
|
onebyte = strtol(p, &end, 10);
|
|
if (*end != '\0' || onebyte > 255 || onebyte < 0)
|
|
return -1;
|
|
ip2[3] = (unsigned char)onebyte;
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int ip_mask(char *mask, unsigned char *mask2)
|
|
{
|
|
char *end;
|
|
long int bits;
|
|
uint32_t mask22;
|
|
|
|
if (undot_ip(mask, mask2)) {
|
|
/* not the /a.b.c.e format, maybe the /x format */
|
|
bits = strtol(mask, &end, 10);
|
|
if (*end != '\0' || bits > 32 || bits < 0)
|
|
return -1;
|
|
if (bits != 0) {
|
|
mask22 = htonl(0xFFFFFFFF << (32 - bits));
|
|
memcpy(mask2, &mask22, 4);
|
|
} else {
|
|
mask22 = 0xFFFFFFFF;
|
|
memcpy(mask2, &mask22, 4);
|
|
}
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
static void ebt_parse_ip_address(char *address, uint32_t *addr, uint32_t *msk)
|
|
{
|
|
char *p;
|
|
|
|
/* first the mask */
|
|
if ((p = strrchr(address, '/')) != NULL) {
|
|
*p = '\0';
|
|
if (ip_mask(p + 1, (unsigned char *)msk)) {
|
|
xtables_error(PARAMETER_PROBLEM,
|
|
"Problem with the IP mask '%s'", p + 1);
|
|
return;
|
|
}
|
|
} else
|
|
*msk = 0xFFFFFFFF;
|
|
|
|
if (undot_ip(address, (unsigned char *)addr)) {
|
|
xtables_error(PARAMETER_PROBLEM,
|
|
"Problem with the IP address '%s'", address);
|
|
return;
|
|
}
|
|
*addr = *addr & *msk;
|
|
}
|
|
|
|
static char *parse_range(const char *str, unsigned int res[])
|
|
{
|
|
char *next;
|
|
|
|
if (!xtables_strtoui(str, &next, &res[0], 0, 255))
|
|
return NULL;
|
|
|
|
res[1] = res[0];
|
|
if (*next == ':') {
|
|
str = next + 1;
|
|
if (!xtables_strtoui(str, &next, &res[1], 0, 255))
|
|
return NULL;
|
|
}
|
|
|
|
return next;
|
|
}
|
|
|
|
static int ebt_parse_icmp(const struct xt_icmp_names *codes, size_t n_codes,
|
|
const char *icmptype, uint8_t type[], uint8_t code[])
|
|
{
|
|
unsigned int match = n_codes;
|
|
unsigned int i, number[2];
|
|
|
|
for (i = 0; i < n_codes; i++) {
|
|
if (strncasecmp(codes[i].name, icmptype, strlen(icmptype)))
|
|
continue;
|
|
if (match != n_codes)
|
|
xtables_error(PARAMETER_PROBLEM, "Ambiguous ICMP type `%s':"
|
|
" `%s' or `%s'?",
|
|
icmptype, codes[match].name,
|
|
codes[i].name);
|
|
match = i;
|
|
}
|
|
|
|
if (match < n_codes) {
|
|
type[0] = type[1] = codes[match].type;
|
|
if (code) {
|
|
code[0] = codes[match].code_min;
|
|
code[1] = codes[match].code_max;
|
|
}
|
|
} else {
|
|
char *next = parse_range(icmptype, number);
|
|
if (!next) {
|
|
xtables_error(PARAMETER_PROBLEM, "Unknown ICMP type `%s'",
|
|
icmptype);
|
|
return -1;
|
|
}
|
|
|
|
type[0] = (uint8_t) number[0];
|
|
type[1] = (uint8_t) number[1];
|
|
switch (*next) {
|
|
case 0:
|
|
if (code) {
|
|
code[0] = 0;
|
|
code[1] = 255;
|
|
}
|
|
return 0;
|
|
case '/':
|
|
if (code) {
|
|
next = parse_range(next+1, number);
|
|
code[0] = (uint8_t) number[0];
|
|
code[1] = (uint8_t) number[1];
|
|
if (next == NULL)
|
|
return -1;
|
|
if (next && *next == 0)
|
|
return 0;
|
|
}
|
|
/* fallthrough */
|
|
default:
|
|
xtables_error(PARAMETER_PROBLEM, "unknown character %c", *next);
|
|
return -1;
|
|
}
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
static void print_icmp_code(uint8_t *code)
|
|
{
|
|
if (!code)
|
|
return;
|
|
|
|
if (code[0] == code[1])
|
|
printf("/%"PRIu8 " ", code[0]);
|
|
else
|
|
printf("/%"PRIu8":%"PRIu8 " ", code[0], code[1]);
|
|
}
|
|
|
|
static void ebt_print_icmp_type(const struct xt_icmp_names *codes,
|
|
size_t n_codes, uint8_t *type, uint8_t *code)
|
|
{
|
|
unsigned int i;
|
|
|
|
if (type[0] != type[1]) {
|
|
printf("%"PRIu8 ":%" PRIu8, type[0], type[1]);
|
|
print_icmp_code(code);
|
|
return;
|
|
}
|
|
|
|
for (i = 0; i < n_codes; i++) {
|
|
if (codes[i].type != type[0])
|
|
continue;
|
|
|
|
if (!code || (codes[i].code_min == code[0] &&
|
|
codes[i].code_max == code[1])) {
|
|
printf("%s ", codes[i].name);
|
|
return;
|
|
}
|
|
}
|
|
printf("%"PRIu8, type[0]);
|
|
print_icmp_code(code);
|
|
}
|
|
|
|
static int
|
|
brip_parse(int c, char **argv, int invert, unsigned int *flags,
|
|
const void *entry, struct xt_entry_match **match)
|
|
{
|
|
struct ebt_ip_info *info = (struct ebt_ip_info *)(*match)->data;
|
|
|
|
switch (c) {
|
|
case IP_SOURCE:
|
|
if (invert)
|
|
info->invflags |= EBT_IP_SOURCE;
|
|
ebt_parse_ip_address(optarg, &info->saddr, &info->smsk);
|
|
info->bitmask |= EBT_IP_SOURCE;
|
|
break;
|
|
case IP_DEST:
|
|
if (invert)
|
|
info->invflags |= EBT_IP_DEST;
|
|
ebt_parse_ip_address(optarg, &info->daddr, &info->dmsk);
|
|
info->bitmask |= EBT_IP_DEST;
|
|
break;
|
|
case IP_SPORT:
|
|
if (invert)
|
|
info->invflags |= EBT_IP_SPORT;
|
|
parse_port_range(NULL, optarg, info->sport);
|
|
info->bitmask |= EBT_IP_SPORT;
|
|
break;
|
|
case IP_DPORT:
|
|
if (invert)
|
|
info->invflags |= EBT_IP_DPORT;
|
|
parse_port_range(NULL, optarg, info->dport);
|
|
info->bitmask |= EBT_IP_DPORT;
|
|
break;
|
|
case IP_EBT_ICMP:
|
|
if (invert)
|
|
info->invflags |= EBT_IP_ICMP;
|
|
ebt_parse_icmp(icmp_codes, ARRAY_SIZE(icmp_codes), optarg,
|
|
info->icmp_type, info->icmp_code);
|
|
info->bitmask |= EBT_IP_ICMP;
|
|
break;
|
|
case IP_EBT_IGMP:
|
|
if (invert)
|
|
info->invflags |= EBT_IP_IGMP;
|
|
ebt_parse_icmp(igmp_types, ARRAY_SIZE(igmp_types), optarg,
|
|
info->igmp_type, NULL);
|
|
info->bitmask |= EBT_IP_IGMP;
|
|
break;
|
|
case IP_EBT_TOS: {
|
|
uintmax_t tosvalue;
|
|
|
|
if (invert)
|
|
info->invflags |= EBT_IP_TOS;
|
|
if (!xtables_strtoul(optarg, NULL, &tosvalue, 0, 255))
|
|
xtables_error(PARAMETER_PROBLEM,
|
|
"Problem with specified IP tos");
|
|
info->tos = tosvalue;
|
|
info->bitmask |= EBT_IP_TOS;
|
|
}
|
|
break;
|
|
case IP_PROTO:
|
|
if (invert)
|
|
info->invflags |= EBT_IP_PROTO;
|
|
info->protocol = xtables_parse_protocol(optarg);
|
|
info->bitmask |= EBT_IP_PROTO;
|
|
break;
|
|
default:
|
|
return 0;
|
|
}
|
|
|
|
*flags |= info->bitmask;
|
|
return 1;
|
|
}
|
|
|
|
static void brip_final_check(unsigned int flags)
|
|
{
|
|
if (!flags)
|
|
xtables_error(PARAMETER_PROBLEM,
|
|
"You must specify proper arguments");
|
|
}
|
|
|
|
static void print_port_range(uint16_t *ports)
|
|
{
|
|
if (ports[0] == ports[1])
|
|
printf("%d ", ports[0]);
|
|
else
|
|
printf("%d:%d ", ports[0], ports[1]);
|
|
}
|
|
|
|
static void brip_print(const void *ip, const struct xt_entry_match *match,
|
|
int numeric)
|
|
{
|
|
struct ebt_ip_info *info = (struct ebt_ip_info *)match->data;
|
|
struct in_addr *addrp, *maskp;
|
|
|
|
if (info->bitmask & EBT_IP_SOURCE) {
|
|
printf("--ip-src ");
|
|
if (info->invflags & EBT_IP_SOURCE)
|
|
printf("! ");
|
|
addrp = (struct in_addr *)&info->saddr;
|
|
maskp = (struct in_addr *)&info->smsk;
|
|
printf("%s%s ", xtables_ipaddr_to_numeric(addrp),
|
|
xtables_ipmask_to_numeric(maskp));
|
|
}
|
|
if (info->bitmask & EBT_IP_DEST) {
|
|
printf("--ip-dst ");
|
|
if (info->invflags & EBT_IP_DEST)
|
|
printf("! ");
|
|
addrp = (struct in_addr *)&info->daddr;
|
|
maskp = (struct in_addr *)&info->dmsk;
|
|
printf("%s%s ", xtables_ipaddr_to_numeric(addrp),
|
|
xtables_ipmask_to_numeric(maskp));
|
|
}
|
|
if (info->bitmask & EBT_IP_TOS) {
|
|
printf("--ip-tos ");
|
|
if (info->invflags & EBT_IP_TOS)
|
|
printf("! ");
|
|
printf("0x%02X ", info->tos);
|
|
}
|
|
if (info->bitmask & EBT_IP_PROTO) {
|
|
struct protoent *pe;
|
|
|
|
printf("--ip-proto ");
|
|
if (info->invflags & EBT_IP_PROTO)
|
|
printf("! ");
|
|
pe = getprotobynumber(info->protocol);
|
|
if (pe == NULL) {
|
|
printf("%d ", info->protocol);
|
|
} else {
|
|
printf("%s ", pe->p_name);
|
|
}
|
|
}
|
|
if (info->bitmask & EBT_IP_SPORT) {
|
|
printf("--ip-sport ");
|
|
if (info->invflags & EBT_IP_SPORT)
|
|
printf("! ");
|
|
print_port_range(info->sport);
|
|
}
|
|
if (info->bitmask & EBT_IP_DPORT) {
|
|
printf("--ip-dport ");
|
|
if (info->invflags & EBT_IP_DPORT)
|
|
printf("! ");
|
|
print_port_range(info->dport);
|
|
}
|
|
if (info->bitmask & EBT_IP_ICMP) {
|
|
printf("--ip-icmp-type ");
|
|
if (info->invflags & EBT_IP_ICMP)
|
|
printf("! ");
|
|
ebt_print_icmp_type(icmp_codes, ARRAY_SIZE(icmp_codes),
|
|
info->icmp_type, info->icmp_code);
|
|
}
|
|
if (info->bitmask & EBT_IP_IGMP) {
|
|
printf("--ip-igmp-type ");
|
|
if (info->invflags & EBT_IP_IGMP)
|
|
printf("! ");
|
|
ebt_print_icmp_type(igmp_types, ARRAY_SIZE(igmp_types),
|
|
info->igmp_type, NULL);
|
|
}
|
|
}
|
|
|
|
static const char *brip_xlate_proto_to_name(uint8_t proto)
|
|
{
|
|
switch (proto) {
|
|
case IPPROTO_TCP:
|
|
return "tcp";
|
|
case IPPROTO_UDP:
|
|
return "udp";
|
|
case IPPROTO_UDPLITE:
|
|
return "udplite";
|
|
case IPPROTO_SCTP:
|
|
return "sctp";
|
|
case IPPROTO_DCCP:
|
|
return "dccp";
|
|
default:
|
|
return NULL;
|
|
}
|
|
}
|
|
|
|
static void brip_xlate_icmp(struct xt_xlate *xl,
|
|
const struct ebt_ip_info *info, int bit)
|
|
{
|
|
if ((info->bitmask & bit) == 0)
|
|
return;
|
|
|
|
xt_xlate_add(xl, "icmp type ");
|
|
if (info->invflags & bit)
|
|
xt_xlate_add(xl, "!= ");
|
|
if (info->icmp_type[0] == info->icmp_type[1])
|
|
xt_xlate_add(xl, "%d ", info->icmp_type[0]);
|
|
else
|
|
xt_xlate_add(xl, "%d-%d ", info->icmp_type[0],
|
|
info->icmp_type[1]);
|
|
if (info->icmp_code[0] == 0 &&
|
|
info->icmp_code[1] == 0xff)
|
|
return;
|
|
|
|
xt_xlate_add(xl, "icmp code ");
|
|
if (info->invflags & bit)
|
|
xt_xlate_add(xl, "!= ");
|
|
if (info->icmp_code[0] == info->icmp_code[1])
|
|
xt_xlate_add(xl, "%d ", info->icmp_code[0]);
|
|
else
|
|
xt_xlate_add(xl, "%d-%d ", info->icmp_code[0],
|
|
info->icmp_code[1]);
|
|
}
|
|
|
|
static void brip_xlate_igmp(struct xt_xlate *xl,
|
|
const struct ebt_ip_info *info, int bit)
|
|
{
|
|
if ((info->bitmask & bit) == 0)
|
|
return;
|
|
|
|
xt_xlate_add(xl, "@th,0,8 ");
|
|
if (info->invflags & bit)
|
|
xt_xlate_add(xl, "!= ");
|
|
if (info->icmp_type[0] == info->icmp_type[1])
|
|
xt_xlate_add(xl, "%d ", info->icmp_type[0]);
|
|
else
|
|
xt_xlate_add(xl, "%d-%d ", info->icmp_type[0],
|
|
info->icmp_type[1]);
|
|
}
|
|
|
|
static void brip_xlate_th(struct xt_xlate *xl,
|
|
const struct ebt_ip_info *info, int bit,
|
|
const char *pname)
|
|
{
|
|
const uint16_t *ports;
|
|
|
|
if ((info->bitmask & bit) == 0)
|
|
return;
|
|
|
|
switch (bit) {
|
|
case EBT_IP_SPORT:
|
|
if (pname)
|
|
xt_xlate_add(xl, "%s sport ", pname);
|
|
else
|
|
xt_xlate_add(xl, "@th,0,16 ");
|
|
|
|
ports = info->sport;
|
|
break;
|
|
case EBT_IP_DPORT:
|
|
if (pname)
|
|
xt_xlate_add(xl, "%s dport ", pname);
|
|
else
|
|
xt_xlate_add(xl, "@th,16,16 ");
|
|
|
|
ports = info->dport;
|
|
break;
|
|
default:
|
|
return;
|
|
}
|
|
|
|
if (info->invflags & bit)
|
|
xt_xlate_add(xl, "!= ");
|
|
|
|
if (ports[0] == ports[1])
|
|
xt_xlate_add(xl, "%d ", ports[0]);
|
|
else
|
|
xt_xlate_add(xl, "%d-%d ", ports[0], ports[1]);
|
|
}
|
|
|
|
static void brip_xlate_nh(struct xt_xlate *xl,
|
|
const struct ebt_ip_info *info, int bit)
|
|
{
|
|
struct in_addr *addrp, *maskp;
|
|
|
|
if ((info->bitmask & bit) == 0)
|
|
return;
|
|
|
|
switch (bit) {
|
|
case EBT_IP_SOURCE:
|
|
xt_xlate_add(xl, "ip saddr ");
|
|
addrp = (struct in_addr *)&info->saddr;
|
|
maskp = (struct in_addr *)&info->smsk;
|
|
break;
|
|
case EBT_IP_DEST:
|
|
xt_xlate_add(xl, "ip daddr ");
|
|
addrp = (struct in_addr *)&info->daddr;
|
|
maskp = (struct in_addr *)&info->dmsk;
|
|
break;
|
|
default:
|
|
return;
|
|
}
|
|
|
|
if (info->invflags & bit)
|
|
xt_xlate_add(xl, "!= ");
|
|
|
|
xt_xlate_add(xl, "%s%s ", xtables_ipaddr_to_numeric(addrp),
|
|
xtables_ipmask_to_numeric(maskp));
|
|
}
|
|
|
|
static int brip_xlate(struct xt_xlate *xl,
|
|
const struct xt_xlate_mt_params *params)
|
|
{
|
|
const struct ebt_ip_info *info = (const void *)params->match->data;
|
|
const char *pname = NULL;
|
|
|
|
brip_xlate_nh(xl, info, EBT_IP_SOURCE);
|
|
brip_xlate_nh(xl, info, EBT_IP_DEST);
|
|
|
|
if (info->bitmask & EBT_IP_TOS) {
|
|
xt_xlate_add(xl, "ip dscp ");
|
|
if (info->invflags & EBT_IP_TOS)
|
|
xt_xlate_add(xl, "!= ");
|
|
xt_xlate_add(xl, "0x%02x ", info->tos & 0x3f); /* remove ECN bits */
|
|
}
|
|
if (info->bitmask & EBT_IP_PROTO) {
|
|
struct protoent *pe;
|
|
|
|
if (info->bitmask & (EBT_IP_SPORT|EBT_IP_DPORT|EBT_IP_ICMP) &&
|
|
(info->invflags & EBT_IP_PROTO) == 0) {
|
|
/* port number or icmp given and not inverted, no need to print this */
|
|
pname = brip_xlate_proto_to_name(info->protocol);
|
|
} else {
|
|
xt_xlate_add(xl, "ip protocol ");
|
|
if (info->invflags & EBT_IP_PROTO)
|
|
xt_xlate_add(xl, "!= ");
|
|
pe = getprotobynumber(info->protocol);
|
|
if (pe == NULL)
|
|
xt_xlate_add(xl, "%d ", info->protocol);
|
|
else
|
|
xt_xlate_add(xl, "%s ", pe->p_name);
|
|
}
|
|
}
|
|
|
|
brip_xlate_th(xl, info, EBT_IP_SPORT, pname);
|
|
brip_xlate_th(xl, info, EBT_IP_DPORT, pname);
|
|
|
|
brip_xlate_icmp(xl, info, EBT_IP_ICMP);
|
|
brip_xlate_igmp(xl, info, EBT_IP_IGMP);
|
|
|
|
return 1;
|
|
}
|
|
|
|
static struct xtables_match brip_match = {
|
|
.name = "ip",
|
|
.revision = 0,
|
|
.version = XTABLES_VERSION,
|
|
.family = NFPROTO_BRIDGE,
|
|
.size = XT_ALIGN(sizeof(struct ebt_ip_info)),
|
|
.userspacesize = XT_ALIGN(sizeof(struct ebt_ip_info)),
|
|
.init = brip_init,
|
|
.help = brip_print_help,
|
|
.parse = brip_parse,
|
|
.final_check = brip_final_check,
|
|
.print = brip_print,
|
|
.xlate = brip_xlate,
|
|
.extra_opts = brip_opts,
|
|
};
|
|
|
|
void _init(void)
|
|
{
|
|
xtables_register_match(&brip_match);
|
|
}
|