You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
451 lines
14 KiB
451 lines
14 KiB
/*
|
|
* (C) 2012 by Hans Schillstrom <hans.schillstrom@ericsson.com>
|
|
* (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org>
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License version 2 as
|
|
* published by the Free Software Foundation.
|
|
*
|
|
* Description: shared library add-on to iptables to add HMARK target support
|
|
*
|
|
* Initial development by Hans Schillstrom. Pablo's improvements to this piece
|
|
* of software has been sponsored by Sophos Astaro <http://www.sophos.com>.
|
|
*/
|
|
|
|
#include <stdbool.h>
|
|
#include <stdio.h>
|
|
#include <string.h>
|
|
|
|
#include "xtables.h"
|
|
#include <linux/netfilter/xt_HMARK.h>
|
|
|
|
static void HMARK_help(void)
|
|
{
|
|
printf(
|
|
"HMARK target options, i.e. modify hash calculation by:\n"
|
|
" --hmark-tuple [src|dst|sport|dport|spi|proto|ct][,...]\n"
|
|
" --hmark-mod value nfmark modulus value\n"
|
|
" --hmark-offset value Last action add value to nfmark\n\n"
|
|
" --hmark-rnd Random see for hashing\n"
|
|
" Alternatively, fine tuning of what will be included in hash calculation\n"
|
|
" --hmark-src-prefix length Source address mask CIDR prefix\n"
|
|
" --hmark-dst-prefix length Dest address mask CIDR prefix\n"
|
|
" --hmark-sport-mask value Mask src port with value\n"
|
|
" --hmark-dport-mask value Mask dst port with value\n"
|
|
" --hmark-spi-mask value For esp and ah AND spi with value\n"
|
|
" --hmark-sport value OR src port with value\n"
|
|
" --hmark-dport value OR dst port with value\n"
|
|
" --hmark-spi value For esp and ah OR spi with value\n"
|
|
" --hmark-proto-mask value Mask Protocol with value\n");
|
|
}
|
|
|
|
#define hi struct xt_hmark_info
|
|
|
|
enum {
|
|
O_HMARK_SADDR_MASK,
|
|
O_HMARK_DADDR_MASK,
|
|
O_HMARK_SPI,
|
|
O_HMARK_SPI_MASK,
|
|
O_HMARK_SPORT,
|
|
O_HMARK_DPORT,
|
|
O_HMARK_SPORT_MASK,
|
|
O_HMARK_DPORT_MASK,
|
|
O_HMARK_PROTO_MASK,
|
|
O_HMARK_RND,
|
|
O_HMARK_MODULUS,
|
|
O_HMARK_OFFSET,
|
|
O_HMARK_CT,
|
|
O_HMARK_TYPE,
|
|
};
|
|
|
|
#define HMARK_OPT_PKT_MASK \
|
|
((1 << O_HMARK_SADDR_MASK) | \
|
|
(1 << O_HMARK_DADDR_MASK) | \
|
|
(1 << O_HMARK_SPI_MASK) | \
|
|
(1 << O_HMARK_SPORT_MASK) | \
|
|
(1 << O_HMARK_DPORT_MASK) | \
|
|
(1 << O_HMARK_PROTO_MASK) | \
|
|
(1 << O_HMARK_SPI_MASK) | \
|
|
(1 << O_HMARK_SPORT) | \
|
|
(1 << O_HMARK_DPORT) | \
|
|
(1 << O_HMARK_SPI))
|
|
|
|
static const struct xt_option_entry HMARK_opts[] = {
|
|
{ .name = "hmark-tuple",
|
|
.type = XTTYPE_STRING,
|
|
.id = O_HMARK_TYPE,
|
|
},
|
|
{ .name = "hmark-src-prefix",
|
|
.type = XTTYPE_PLENMASK,
|
|
.id = O_HMARK_SADDR_MASK,
|
|
.flags = XTOPT_PUT, XTOPT_POINTER(hi, src_mask)
|
|
},
|
|
{ .name = "hmark-dst-prefix",
|
|
.type = XTTYPE_PLENMASK,
|
|
.id = O_HMARK_DADDR_MASK,
|
|
.flags = XTOPT_PUT, XTOPT_POINTER(hi, dst_mask)
|
|
},
|
|
{ .name = "hmark-sport-mask",
|
|
.type = XTTYPE_UINT16,
|
|
.id = O_HMARK_SPORT_MASK,
|
|
.flags = XTOPT_PUT, XTOPT_POINTER(hi, port_mask.p16.src)
|
|
},
|
|
{ .name = "hmark-dport-mask",
|
|
.type = XTTYPE_UINT16,
|
|
.id = O_HMARK_DPORT_MASK,
|
|
.flags = XTOPT_PUT, XTOPT_POINTER(hi, port_mask.p16.dst)
|
|
},
|
|
{ .name = "hmark-spi-mask",
|
|
.type = XTTYPE_UINT32,
|
|
.id = O_HMARK_SPI_MASK,
|
|
.flags = XTOPT_PUT, XTOPT_POINTER(hi, port_mask.v32)
|
|
},
|
|
{ .name = "hmark-sport",
|
|
.type = XTTYPE_UINT16,
|
|
.id = O_HMARK_SPORT,
|
|
.flags = XTOPT_PUT, XTOPT_POINTER(hi, port_set.p16.src)
|
|
},
|
|
{ .name = "hmark-dport",
|
|
.type = XTTYPE_UINT16,
|
|
.id = O_HMARK_DPORT,
|
|
.flags = XTOPT_PUT, XTOPT_POINTER(hi, port_set.p16.dst)
|
|
},
|
|
{ .name = "hmark-spi",
|
|
.type = XTTYPE_UINT32,
|
|
.id = O_HMARK_SPI,
|
|
.flags = XTOPT_PUT, XTOPT_POINTER(hi, port_set.v32)
|
|
},
|
|
{ .name = "hmark-proto-mask",
|
|
.type = XTTYPE_UINT16,
|
|
.id = O_HMARK_PROTO_MASK,
|
|
.flags = XTOPT_PUT, XTOPT_POINTER(hi, proto_mask)
|
|
},
|
|
{ .name = "hmark-rnd",
|
|
.type = XTTYPE_UINT32,
|
|
.id = O_HMARK_RND,
|
|
.flags = XTOPT_PUT, XTOPT_POINTER(hi, hashrnd)
|
|
},
|
|
{ .name = "hmark-mod",
|
|
.type = XTTYPE_UINT32,
|
|
.id = O_HMARK_MODULUS,
|
|
.min = 1,
|
|
.flags = XTOPT_PUT | XTOPT_MAND, XTOPT_POINTER(hi, hmodulus)
|
|
},
|
|
{ .name = "hmark-offset",
|
|
.type = XTTYPE_UINT32,
|
|
.id = O_HMARK_OFFSET,
|
|
.flags = XTOPT_PUT, XTOPT_POINTER(hi, hoffset)
|
|
},
|
|
XTOPT_TABLEEND,
|
|
};
|
|
|
|
static int
|
|
hmark_parse(const char *type, size_t len, struct xt_hmark_info *info,
|
|
unsigned int *xflags)
|
|
{
|
|
if (strncasecmp(type, "ct", len) == 0) {
|
|
info->flags |= XT_HMARK_FLAG(XT_HMARK_CT);
|
|
*xflags |= (1 << O_HMARK_CT);
|
|
} else if (strncasecmp(type, "src", len) == 0) {
|
|
memset(&info->src_mask, 0xff, sizeof(info->src_mask));
|
|
info->flags |= XT_HMARK_FLAG(XT_HMARK_SADDR_MASK);
|
|
*xflags |= (1 << O_HMARK_SADDR_MASK);
|
|
} else if (strncasecmp(type, "dst", len) == 0) {
|
|
memset(&info->dst_mask, 0xff, sizeof(info->dst_mask));
|
|
info->flags |= XT_HMARK_FLAG(XT_HMARK_DADDR_MASK);
|
|
*xflags |= (1 << O_HMARK_DADDR_MASK);
|
|
} else if (strncasecmp(type, "sport", len) == 0) {
|
|
memset(&info->port_mask.p16.src, 0xff,
|
|
sizeof(info->port_mask.p16.src));
|
|
info->flags |= XT_HMARK_FLAG(XT_HMARK_SPORT_MASK);
|
|
*xflags |= (1 << O_HMARK_SPORT_MASK);
|
|
} else if (strncasecmp(type, "dport", len) == 0) {
|
|
memset(&info->port_mask.p16.dst, 0xff,
|
|
sizeof(info->port_mask.p16.dst));
|
|
info->flags |= XT_HMARK_FLAG(XT_HMARK_DPORT_MASK);
|
|
*xflags |= (1 << O_HMARK_DPORT_MASK);
|
|
} else if (strncasecmp(type, "proto", len) == 0) {
|
|
memset(&info->proto_mask, 0xff, sizeof(info->proto_mask));
|
|
info->flags |= XT_HMARK_FLAG(XT_HMARK_PROTO_MASK);
|
|
*xflags |= (1 << O_HMARK_PROTO_MASK);
|
|
} else if (strncasecmp(type, "spi", len) == 0) {
|
|
memset(&info->port_mask.v32, 0xff, sizeof(info->port_mask.v32));
|
|
info->flags |= XT_HMARK_FLAG(XT_HMARK_SPI_MASK);
|
|
*xflags |= (1 << O_HMARK_SPI_MASK);
|
|
} else
|
|
return 0;
|
|
|
|
return 1;
|
|
}
|
|
|
|
static void
|
|
hmark_parse_type(struct xt_option_call *cb)
|
|
{
|
|
const char *arg = cb->arg;
|
|
struct xt_hmark_info *info = cb->data;
|
|
const char *comma;
|
|
|
|
while ((comma = strchr(arg, ',')) != NULL) {
|
|
if (comma == arg ||
|
|
!hmark_parse(arg, comma-arg, info, &cb->xflags))
|
|
xtables_error(PARAMETER_PROBLEM, "Bad type \"%s\"", arg);
|
|
arg = comma+1;
|
|
}
|
|
if (!*arg)
|
|
xtables_error(PARAMETER_PROBLEM, "\"--hmark-tuple\" requires "
|
|
"a list of types with no "
|
|
"spaces, e.g. "
|
|
"src,dst,sport,dport,proto");
|
|
if (strlen(arg) == 0 ||
|
|
!hmark_parse(arg, strlen(arg), info, &cb->xflags))
|
|
xtables_error(PARAMETER_PROBLEM, "Bad type \"%s\"", arg);
|
|
}
|
|
|
|
static void HMARK_parse(struct xt_option_call *cb, int plen)
|
|
{
|
|
struct xt_hmark_info *info = cb->data;
|
|
|
|
xtables_option_parse(cb);
|
|
|
|
switch (cb->entry->id) {
|
|
case O_HMARK_TYPE:
|
|
hmark_parse_type(cb);
|
|
break;
|
|
case O_HMARK_SADDR_MASK:
|
|
info->flags |= XT_HMARK_FLAG(XT_HMARK_SADDR_MASK);
|
|
break;
|
|
case O_HMARK_DADDR_MASK:
|
|
info->flags |= XT_HMARK_FLAG(XT_HMARK_DADDR_MASK);
|
|
break;
|
|
case O_HMARK_SPI:
|
|
info->port_set.v32 = htonl(cb->val.u32);
|
|
info->flags |= XT_HMARK_FLAG(XT_HMARK_SPI);
|
|
break;
|
|
case O_HMARK_SPORT:
|
|
info->port_set.p16.src = htons(cb->val.u16);
|
|
info->flags |= XT_HMARK_FLAG(XT_HMARK_SPORT);
|
|
break;
|
|
case O_HMARK_DPORT:
|
|
info->port_set.p16.dst = htons(cb->val.u16);
|
|
info->flags |= XT_HMARK_FLAG(XT_HMARK_DPORT);
|
|
break;
|
|
case O_HMARK_SPORT_MASK:
|
|
info->port_mask.p16.src = htons(cb->val.u16);
|
|
info->flags |= XT_HMARK_FLAG(XT_HMARK_SPORT_MASK);
|
|
break;
|
|
case O_HMARK_DPORT_MASK:
|
|
info->port_mask.p16.dst = htons(cb->val.u16);
|
|
info->flags |= XT_HMARK_FLAG(XT_HMARK_DPORT_MASK);
|
|
break;
|
|
case O_HMARK_SPI_MASK:
|
|
info->port_mask.v32 = htonl(cb->val.u32);
|
|
info->flags |= XT_HMARK_FLAG(XT_HMARK_SPI_MASK);
|
|
break;
|
|
case O_HMARK_PROTO_MASK:
|
|
info->flags |= XT_HMARK_FLAG(XT_HMARK_PROTO_MASK);
|
|
break;
|
|
case O_HMARK_RND:
|
|
info->flags |= XT_HMARK_FLAG(XT_HMARK_RND);
|
|
break;
|
|
case O_HMARK_MODULUS:
|
|
info->flags |= XT_HMARK_FLAG(XT_HMARK_MODULUS);
|
|
break;
|
|
case O_HMARK_OFFSET:
|
|
info->flags |= XT_HMARK_FLAG(XT_HMARK_OFFSET);
|
|
break;
|
|
case O_HMARK_CT:
|
|
info->flags |= XT_HMARK_FLAG(XT_HMARK_CT);
|
|
break;
|
|
}
|
|
cb->xflags |= (1 << cb->entry->id);
|
|
}
|
|
|
|
static void HMARK_ip4_parse(struct xt_option_call *cb)
|
|
{
|
|
HMARK_parse(cb, 32);
|
|
}
|
|
static void HMARK_ip6_parse(struct xt_option_call *cb)
|
|
{
|
|
HMARK_parse(cb, 128);
|
|
}
|
|
|
|
static void HMARK_check(struct xt_fcheck_call *cb)
|
|
{
|
|
if (!(cb->xflags & (1 << O_HMARK_MODULUS)))
|
|
xtables_error(PARAMETER_PROBLEM, "--hmark-mod is mandatory");
|
|
if (!(cb->xflags & (1 << O_HMARK_RND)))
|
|
xtables_error(PARAMETER_PROBLEM, "--hmark-rnd is mandatory");
|
|
if (cb->xflags & (1 << O_HMARK_SPI_MASK) &&
|
|
(cb->xflags & ((1 << O_HMARK_SPORT_MASK) |
|
|
(1 << O_HMARK_DPORT_MASK))))
|
|
xtables_error(PARAMETER_PROBLEM, "you cannot use "
|
|
"--hmark-spi-mask and --hmark-?port-mask,"
|
|
"at the same time");
|
|
if (!((cb->xflags & HMARK_OPT_PKT_MASK) ||
|
|
cb->xflags & (1 << O_HMARK_CT)))
|
|
xtables_error(PARAMETER_PROBLEM, "you have to specify "
|
|
"--hmark-tuple at least");
|
|
}
|
|
|
|
static void HMARK_print(const struct xt_hmark_info *info)
|
|
{
|
|
if (info->flags & XT_HMARK_FLAG(XT_HMARK_SPORT_MASK))
|
|
printf("sport-mask 0x%x ", htons(info->port_mask.p16.src));
|
|
if (info->flags & XT_HMARK_FLAG(XT_HMARK_DPORT_MASK))
|
|
printf("dport-mask 0x%x ", htons(info->port_mask.p16.dst));
|
|
if (info->flags & XT_HMARK_FLAG(XT_HMARK_SPI_MASK))
|
|
printf("spi-mask 0x%x ", htonl(info->port_mask.v32));
|
|
if (info->flags & XT_HMARK_FLAG(XT_HMARK_SPORT))
|
|
printf("sport 0x%x ", htons(info->port_set.p16.src));
|
|
if (info->flags & XT_HMARK_FLAG(XT_HMARK_DPORT))
|
|
printf("dport 0x%x ", htons(info->port_set.p16.dst));
|
|
if (info->flags & XT_HMARK_FLAG(XT_HMARK_SPI))
|
|
printf("spi 0x%x ", htonl(info->port_set.v32));
|
|
if (info->flags & XT_HMARK_FLAG(XT_HMARK_PROTO_MASK))
|
|
printf("proto-mask 0x%x ", info->proto_mask);
|
|
if (info->flags & XT_HMARK_FLAG(XT_HMARK_RND))
|
|
printf("rnd 0x%x ", info->hashrnd);
|
|
}
|
|
|
|
static void HMARK_ip6_print(const void *ip,
|
|
const struct xt_entry_target *target, int numeric)
|
|
{
|
|
const struct xt_hmark_info *info =
|
|
(const struct xt_hmark_info *)target->data;
|
|
|
|
printf(" HMARK ");
|
|
if (info->flags & XT_HMARK_FLAG(XT_HMARK_MODULUS))
|
|
printf("mod %u ", info->hmodulus);
|
|
if (info->flags & XT_HMARK_FLAG(XT_HMARK_OFFSET))
|
|
printf("+ 0x%x ", info->hoffset);
|
|
if (info->flags & XT_HMARK_FLAG(XT_HMARK_CT))
|
|
printf("ct, ");
|
|
if (info->flags & XT_HMARK_FLAG(XT_HMARK_SADDR_MASK))
|
|
printf("src-prefix %s ",
|
|
xtables_ip6mask_to_numeric(&info->src_mask.in6) + 1);
|
|
if (info->flags & XT_HMARK_FLAG(XT_HMARK_DADDR_MASK))
|
|
printf("dst-prefix %s ",
|
|
xtables_ip6mask_to_numeric(&info->dst_mask.in6) + 1);
|
|
HMARK_print(info);
|
|
}
|
|
static void HMARK_ip4_print(const void *ip,
|
|
const struct xt_entry_target *target, int numeric)
|
|
{
|
|
const struct xt_hmark_info *info =
|
|
(const struct xt_hmark_info *)target->data;
|
|
|
|
printf(" HMARK ");
|
|
if (info->flags & XT_HMARK_FLAG(XT_HMARK_MODULUS))
|
|
printf("mod %u ", info->hmodulus);
|
|
if (info->flags & XT_HMARK_FLAG(XT_HMARK_OFFSET))
|
|
printf("+ 0x%x ", info->hoffset);
|
|
if (info->flags & XT_HMARK_FLAG(XT_HMARK_CT))
|
|
printf("ct, ");
|
|
if (info->flags & XT_HMARK_FLAG(XT_HMARK_SADDR_MASK))
|
|
printf("src-prefix %u ",
|
|
xtables_ipmask_to_cidr(&info->src_mask.in));
|
|
if (info->flags & XT_HMARK_FLAG(XT_HMARK_DADDR_MASK))
|
|
printf("dst-prefix %u ",
|
|
xtables_ipmask_to_cidr(&info->dst_mask.in));
|
|
HMARK_print(info);
|
|
}
|
|
|
|
static void HMARK_save(const struct xt_hmark_info *info)
|
|
{
|
|
if (info->flags & XT_HMARK_FLAG(XT_HMARK_SPORT_MASK))
|
|
printf(" --hmark-sport-mask 0x%04x",
|
|
htons(info->port_mask.p16.src));
|
|
if (info->flags & XT_HMARK_FLAG(XT_HMARK_DPORT_MASK))
|
|
printf(" --hmark-dport-mask 0x%04x",
|
|
htons(info->port_mask.p16.dst));
|
|
if (info->flags & XT_HMARK_FLAG(XT_HMARK_SPI_MASK))
|
|
printf(" --hmark-spi-mask 0x%08x",
|
|
htonl(info->port_mask.v32));
|
|
if (info->flags & XT_HMARK_FLAG(XT_HMARK_SPORT))
|
|
printf(" --hmark-sport 0x%04x",
|
|
htons(info->port_set.p16.src));
|
|
if (info->flags & XT_HMARK_FLAG(XT_HMARK_DPORT))
|
|
printf(" --hmark-dport 0x%04x",
|
|
htons(info->port_set.p16.dst));
|
|
if (info->flags & XT_HMARK_FLAG(XT_HMARK_SPI))
|
|
printf(" --hmark-spi 0x%08x", htonl(info->port_set.v32));
|
|
if (info->flags & XT_HMARK_FLAG(XT_HMARK_PROTO_MASK))
|
|
printf(" --hmark-proto-mask 0x%02x", info->proto_mask);
|
|
if (info->flags & XT_HMARK_FLAG(XT_HMARK_RND))
|
|
printf(" --hmark-rnd 0x%08x", info->hashrnd);
|
|
if (info->flags & XT_HMARK_FLAG(XT_HMARK_MODULUS))
|
|
printf(" --hmark-mod %u", info->hmodulus);
|
|
if (info->flags & XT_HMARK_FLAG(XT_HMARK_OFFSET))
|
|
printf(" --hmark-offset %u", info->hoffset);
|
|
if (info->flags & XT_HMARK_FLAG(XT_HMARK_CT))
|
|
printf(" --hmark-tuple ct");
|
|
}
|
|
|
|
static void HMARK_ip6_save(const void *ip, const struct xt_entry_target *target)
|
|
{
|
|
const struct xt_hmark_info *info =
|
|
(const struct xt_hmark_info *)target->data;
|
|
int ret;
|
|
|
|
if (info->flags & XT_HMARK_FLAG(XT_HMARK_SADDR_MASK)) {
|
|
ret = xtables_ip6mask_to_cidr(&info->src_mask.in6);
|
|
printf(" --hmark-src-prefix %d", ret);
|
|
}
|
|
if (info->flags & XT_HMARK_FLAG(XT_HMARK_DADDR_MASK)) {
|
|
ret = xtables_ip6mask_to_cidr(&info->dst_mask.in6);
|
|
printf(" --hmark-dst-prefix %d", ret);
|
|
}
|
|
HMARK_save(info);
|
|
}
|
|
|
|
static void HMARK_ip4_save(const void *ip, const struct xt_entry_target *target)
|
|
{
|
|
const struct xt_hmark_info *info =
|
|
(const struct xt_hmark_info *)target->data;
|
|
int ret;
|
|
|
|
if (info->flags & XT_HMARK_FLAG(XT_HMARK_SADDR_MASK)) {
|
|
ret = xtables_ipmask_to_cidr(&info->src_mask.in);
|
|
printf(" --hmark-src-prefix %d", ret);
|
|
}
|
|
if (info->flags & XT_HMARK_FLAG(XT_HMARK_DADDR_MASK)) {
|
|
ret = xtables_ipmask_to_cidr(&info->dst_mask.in);
|
|
printf(" --hmark-dst-prefix %d", ret);
|
|
}
|
|
HMARK_save(info);
|
|
}
|
|
|
|
static struct xtables_target mark_tg_reg[] = {
|
|
{
|
|
.family = NFPROTO_IPV4,
|
|
.name = "HMARK",
|
|
.version = XTABLES_VERSION,
|
|
.size = XT_ALIGN(sizeof(struct xt_hmark_info)),
|
|
.userspacesize = XT_ALIGN(sizeof(struct xt_hmark_info)),
|
|
.help = HMARK_help,
|
|
.print = HMARK_ip4_print,
|
|
.save = HMARK_ip4_save,
|
|
.x6_parse = HMARK_ip4_parse,
|
|
.x6_fcheck = HMARK_check,
|
|
.x6_options = HMARK_opts,
|
|
},
|
|
{
|
|
.family = NFPROTO_IPV6,
|
|
.name = "HMARK",
|
|
.version = XTABLES_VERSION,
|
|
.size = XT_ALIGN(sizeof(struct xt_hmark_info)),
|
|
.userspacesize = XT_ALIGN(sizeof(struct xt_hmark_info)),
|
|
.help = HMARK_help,
|
|
.print = HMARK_ip6_print,
|
|
.save = HMARK_ip6_save,
|
|
.x6_parse = HMARK_ip6_parse,
|
|
.x6_fcheck = HMARK_check,
|
|
.x6_options = HMARK_opts,
|
|
},
|
|
};
|
|
|
|
void _init(void)
|
|
{
|
|
xtables_register_targets(mark_tg_reg, ARRAY_SIZE(mark_tg_reg));
|
|
}
|