You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
439 lines
12 KiB
439 lines
12 KiB
/*
|
|
* Copyright (c) 2005-2013 Patrick McHardy <kaber@trash.net>
|
|
*/
|
|
|
|
#include <stdbool.h>
|
|
#include <stdint.h>
|
|
#include <stdio.h>
|
|
#include <string.h>
|
|
#include <netdb.h>
|
|
#include <xtables.h>
|
|
#include <linux/netfilter/xt_policy.h>
|
|
|
|
enum {
|
|
O_DIRECTION = 0,
|
|
O_POLICY,
|
|
O_STRICT,
|
|
O_REQID,
|
|
O_SPI,
|
|
O_PROTO,
|
|
O_MODE,
|
|
O_TUNNELSRC,
|
|
O_TUNNELDST,
|
|
O_NEXT,
|
|
F_STRICT = 1 << O_STRICT,
|
|
};
|
|
|
|
static void policy_help(void)
|
|
{
|
|
printf(
|
|
"policy match options:\n"
|
|
" --dir in|out match policy applied during decapsulation/\n"
|
|
" policy to be applied during encapsulation\n"
|
|
" --pol none|ipsec match policy\n"
|
|
" --strict match entire policy instead of single element\n"
|
|
" at any position\n"
|
|
"These options may be used repeatedly, to describe policy elements:\n"
|
|
"[!] --reqid reqid match reqid\n"
|
|
"[!] --spi spi match SPI\n"
|
|
"[!] --proto proto match protocol (ah/esp/ipcomp)\n"
|
|
"[!] --mode mode match mode (transport/tunnel)\n"
|
|
"[!] --tunnel-src addr/mask match tunnel source\n"
|
|
"[!] --tunnel-dst addr/mask match tunnel destination\n"
|
|
" --next begin next element in policy\n");
|
|
}
|
|
|
|
static const struct xt_option_entry policy_opts[] = {
|
|
{.name = "dir", .id = O_DIRECTION, .type = XTTYPE_STRING},
|
|
{.name = "pol", .id = O_POLICY, .type = XTTYPE_STRING},
|
|
{.name = "strict", .id = O_STRICT, .type = XTTYPE_NONE},
|
|
{.name = "reqid", .id = O_REQID, .type = XTTYPE_UINT32,
|
|
.flags = XTOPT_MULTI | XTOPT_INVERT},
|
|
{.name = "spi", .id = O_SPI, .type = XTTYPE_UINT32,
|
|
.flags = XTOPT_MULTI | XTOPT_INVERT},
|
|
{.name = "tunnel-src", .id = O_TUNNELSRC, .type = XTTYPE_HOSTMASK,
|
|
.flags = XTOPT_MULTI | XTOPT_INVERT},
|
|
{.name = "tunnel-dst", .id = O_TUNNELDST, .type = XTTYPE_HOSTMASK,
|
|
.flags = XTOPT_MULTI | XTOPT_INVERT},
|
|
{.name = "proto", .id = O_PROTO, .type = XTTYPE_PROTOCOL,
|
|
.flags = XTOPT_MULTI | XTOPT_INVERT},
|
|
{.name = "mode", .id = O_MODE, .type = XTTYPE_STRING,
|
|
.flags = XTOPT_MULTI | XTOPT_INVERT},
|
|
{.name = "next", .id = O_NEXT, .type = XTTYPE_NONE,
|
|
.flags = XTOPT_MULTI, .also = F_STRICT},
|
|
XTOPT_TABLEEND,
|
|
};
|
|
|
|
static int parse_direction(const char *s)
|
|
{
|
|
if (strcmp(s, "in") == 0)
|
|
return XT_POLICY_MATCH_IN;
|
|
if (strcmp(s, "out") == 0)
|
|
return XT_POLICY_MATCH_OUT;
|
|
xtables_error(PARAMETER_PROBLEM, "policy_match: invalid dir \"%s\"", s);
|
|
}
|
|
|
|
static int parse_policy(const char *s)
|
|
{
|
|
if (strcmp(s, "none") == 0)
|
|
return XT_POLICY_MATCH_NONE;
|
|
if (strcmp(s, "ipsec") == 0)
|
|
return 0;
|
|
xtables_error(PARAMETER_PROBLEM, "policy match: invalid policy \"%s\"", s);
|
|
}
|
|
|
|
static int parse_mode(const char *s)
|
|
{
|
|
if (strcmp(s, "transport") == 0)
|
|
return XT_POLICY_MODE_TRANSPORT;
|
|
if (strcmp(s, "tunnel") == 0)
|
|
return XT_POLICY_MODE_TUNNEL;
|
|
xtables_error(PARAMETER_PROBLEM, "policy match: invalid mode \"%s\"", s);
|
|
}
|
|
|
|
static void policy_parse(struct xt_option_call *cb)
|
|
{
|
|
struct xt_policy_info *info = cb->data;
|
|
struct xt_policy_elem *e = &info->pol[info->len];
|
|
|
|
xtables_option_parse(cb);
|
|
switch (cb->entry->id) {
|
|
case O_DIRECTION:
|
|
info->flags |= parse_direction(cb->arg);
|
|
break;
|
|
case O_POLICY:
|
|
info->flags |= parse_policy(cb->arg);
|
|
break;
|
|
case O_STRICT:
|
|
info->flags |= XT_POLICY_MATCH_STRICT;
|
|
break;
|
|
case O_REQID:
|
|
if (e->match.reqid)
|
|
xtables_error(PARAMETER_PROBLEM,
|
|
"policy match: double --reqid option");
|
|
e->match.reqid = 1;
|
|
e->invert.reqid = cb->invert;
|
|
e->reqid = cb->val.u32;
|
|
break;
|
|
case O_SPI:
|
|
if (e->match.spi)
|
|
xtables_error(PARAMETER_PROBLEM,
|
|
"policy match: double --spi option");
|
|
e->match.spi = 1;
|
|
e->invert.spi = cb->invert;
|
|
e->spi = cb->val.u32;
|
|
break;
|
|
case O_TUNNELSRC:
|
|
if (e->match.saddr)
|
|
xtables_error(PARAMETER_PROBLEM,
|
|
"policy match: double --tunnel-src option");
|
|
|
|
e->match.saddr = 1;
|
|
e->invert.saddr = cb->invert;
|
|
memcpy(&e->saddr, &cb->val.haddr, sizeof(cb->val.haddr));
|
|
memcpy(&e->smask, &cb->val.hmask, sizeof(cb->val.hmask));
|
|
break;
|
|
case O_TUNNELDST:
|
|
if (e->match.daddr)
|
|
xtables_error(PARAMETER_PROBLEM,
|
|
"policy match: double --tunnel-dst option");
|
|
e->match.daddr = 1;
|
|
e->invert.daddr = cb->invert;
|
|
memcpy(&e->daddr, &cb->val.haddr, sizeof(cb->val.haddr));
|
|
memcpy(&e->dmask, &cb->val.hmask, sizeof(cb->val.hmask));
|
|
break;
|
|
case O_PROTO:
|
|
if (e->match.proto)
|
|
xtables_error(PARAMETER_PROBLEM,
|
|
"policy match: double --proto option");
|
|
e->proto = cb->val.protocol;
|
|
if (e->proto != IPPROTO_AH && e->proto != IPPROTO_ESP &&
|
|
e->proto != IPPROTO_COMP)
|
|
xtables_error(PARAMETER_PROBLEM,
|
|
"policy match: protocol must be ah/esp/ipcomp");
|
|
e->match.proto = 1;
|
|
e->invert.proto = cb->invert;
|
|
break;
|
|
case O_MODE:
|
|
if (e->match.mode)
|
|
xtables_error(PARAMETER_PROBLEM,
|
|
"policy match: double --mode option");
|
|
e->match.mode = 1;
|
|
e->invert.mode = cb->invert;
|
|
e->mode = parse_mode(cb->arg);
|
|
break;
|
|
case O_NEXT:
|
|
if (++info->len == XT_POLICY_MAX_ELEM)
|
|
xtables_error(PARAMETER_PROBLEM,
|
|
"policy match: maximum policy depth reached");
|
|
break;
|
|
}
|
|
}
|
|
|
|
static void policy_check(struct xt_fcheck_call *cb)
|
|
{
|
|
struct xt_policy_info *info = cb->data;
|
|
const struct xt_policy_elem *e;
|
|
int i;
|
|
|
|
/*
|
|
* The old "no parameters given" check is carried out
|
|
* by testing for --dir.
|
|
*/
|
|
if (!(info->flags & (XT_POLICY_MATCH_IN | XT_POLICY_MATCH_OUT)))
|
|
xtables_error(PARAMETER_PROBLEM,
|
|
"policy match: neither --dir in nor --dir out specified");
|
|
|
|
if (info->flags & XT_POLICY_MATCH_NONE) {
|
|
if (info->flags & XT_POLICY_MATCH_STRICT)
|
|
xtables_error(PARAMETER_PROBLEM,
|
|
"policy match: policy none but --strict given");
|
|
|
|
if (info->len != 0)
|
|
xtables_error(PARAMETER_PROBLEM,
|
|
"policy match: policy none but policy given");
|
|
} else
|
|
info->len++; /* increase len by 1, no --next after last element */
|
|
|
|
/*
|
|
* This is already represented with O_NEXT requiring F_STRICT in the
|
|
* options table, but will keep this code as a comment for reference.
|
|
*
|
|
if (!(info->flags & XT_POLICY_MATCH_STRICT) && info->len > 1)
|
|
xtables_error(PARAMETER_PROBLEM,
|
|
"policy match: multiple elements but no --strict");
|
|
*/
|
|
|
|
for (i = 0; i < info->len; i++) {
|
|
e = &info->pol[i];
|
|
|
|
if (info->flags & XT_POLICY_MATCH_STRICT &&
|
|
!(e->match.reqid || e->match.spi || e->match.saddr ||
|
|
e->match.daddr || e->match.proto || e->match.mode))
|
|
xtables_error(PARAMETER_PROBLEM,
|
|
"policy match: empty policy element %u. "
|
|
"--strict is in effect, but at least one of "
|
|
"reqid, spi, tunnel-src, tunnel-dst, proto or "
|
|
"mode is required.", i);
|
|
|
|
if ((e->match.saddr || e->match.daddr)
|
|
&& ((e->mode == XT_POLICY_MODE_TUNNEL && e->invert.mode) ||
|
|
(e->mode == XT_POLICY_MODE_TRANSPORT && !e->invert.mode)))
|
|
xtables_error(PARAMETER_PROBLEM,
|
|
"policy match: --tunnel-src/--tunnel-dst "
|
|
"is only valid in tunnel mode");
|
|
}
|
|
}
|
|
|
|
static void print_mode(const char *prefix, uint8_t mode, int numeric)
|
|
{
|
|
printf(" %smode ", prefix);
|
|
|
|
switch (mode) {
|
|
case XT_POLICY_MODE_TRANSPORT:
|
|
printf("transport");
|
|
break;
|
|
case XT_POLICY_MODE_TUNNEL:
|
|
printf("tunnel");
|
|
break;
|
|
default:
|
|
printf("???");
|
|
break;
|
|
}
|
|
}
|
|
|
|
static void print_proto(const char *prefix, uint8_t proto, int numeric)
|
|
{
|
|
const struct protoent *p = NULL;
|
|
|
|
printf(" %sproto ", prefix);
|
|
if (!numeric)
|
|
p = getprotobynumber(proto);
|
|
if (p != NULL)
|
|
printf("%s", p->p_name);
|
|
else
|
|
printf("%u", proto);
|
|
}
|
|
|
|
#define PRINT_INVERT(x) \
|
|
do { \
|
|
if (x) \
|
|
printf(" !"); \
|
|
} while(0)
|
|
|
|
static void print_entry(const char *prefix, const struct xt_policy_elem *e,
|
|
bool numeric, uint8_t family)
|
|
{
|
|
if (e->match.reqid) {
|
|
PRINT_INVERT(e->invert.reqid);
|
|
printf(" %sreqid %u", prefix, e->reqid);
|
|
}
|
|
if (e->match.spi) {
|
|
PRINT_INVERT(e->invert.spi);
|
|
printf(" %sspi 0x%x", prefix, e->spi);
|
|
}
|
|
if (e->match.proto) {
|
|
PRINT_INVERT(e->invert.proto);
|
|
print_proto(prefix, e->proto, numeric);
|
|
}
|
|
if (e->match.mode) {
|
|
PRINT_INVERT(e->invert.mode);
|
|
print_mode(prefix, e->mode, numeric);
|
|
}
|
|
if (e->match.daddr) {
|
|
PRINT_INVERT(e->invert.daddr);
|
|
if (family == NFPROTO_IPV6)
|
|
printf(" %stunnel-dst %s%s", prefix,
|
|
xtables_ip6addr_to_numeric(&e->daddr.a6),
|
|
xtables_ip6mask_to_numeric(&e->dmask.a6));
|
|
else
|
|
printf(" %stunnel-dst %s%s", prefix,
|
|
xtables_ipaddr_to_numeric(&e->daddr.a4),
|
|
xtables_ipmask_to_numeric(&e->dmask.a4));
|
|
}
|
|
if (e->match.saddr) {
|
|
PRINT_INVERT(e->invert.saddr);
|
|
if (family == NFPROTO_IPV6)
|
|
printf(" %stunnel-src %s%s", prefix,
|
|
xtables_ip6addr_to_numeric(&e->saddr.a6),
|
|
xtables_ip6mask_to_numeric(&e->smask.a6));
|
|
else
|
|
printf(" %stunnel-src %s%s", prefix,
|
|
xtables_ipaddr_to_numeric(&e->saddr.a4),
|
|
xtables_ipmask_to_numeric(&e->smask.a4));
|
|
}
|
|
}
|
|
|
|
static void print_flags(const char *prefix, const struct xt_policy_info *info)
|
|
{
|
|
if (info->flags & XT_POLICY_MATCH_IN)
|
|
printf(" %sdir in", prefix);
|
|
else
|
|
printf(" %sdir out", prefix);
|
|
|
|
if (info->flags & XT_POLICY_MATCH_NONE)
|
|
printf(" %spol none", prefix);
|
|
else
|
|
printf(" %spol ipsec", prefix);
|
|
|
|
if (info->flags & XT_POLICY_MATCH_STRICT)
|
|
printf(" %sstrict", prefix);
|
|
}
|
|
|
|
static void policy4_print(const void *ip, const struct xt_entry_match *match,
|
|
int numeric)
|
|
{
|
|
const struct xt_policy_info *info = (void *)match->data;
|
|
unsigned int i;
|
|
|
|
printf(" policy match");
|
|
print_flags("", info);
|
|
for (i = 0; i < info->len; i++) {
|
|
if (info->len > 1)
|
|
printf(" [%u]", i);
|
|
print_entry("", &info->pol[i], numeric, NFPROTO_IPV4);
|
|
}
|
|
}
|
|
|
|
static void policy6_print(const void *ip, const struct xt_entry_match *match,
|
|
int numeric)
|
|
{
|
|
const struct xt_policy_info *info = (void *)match->data;
|
|
unsigned int i;
|
|
|
|
printf(" policy match");
|
|
print_flags("", info);
|
|
for (i = 0; i < info->len; i++) {
|
|
if (info->len > 1)
|
|
printf(" [%u]", i);
|
|
print_entry("", &info->pol[i], numeric, NFPROTO_IPV6);
|
|
}
|
|
}
|
|
|
|
static void policy4_save(const void *ip, const struct xt_entry_match *match)
|
|
{
|
|
const struct xt_policy_info *info = (void *)match->data;
|
|
unsigned int i;
|
|
|
|
print_flags("--", info);
|
|
for (i = 0; i < info->len; i++) {
|
|
print_entry("--", &info->pol[i], false, NFPROTO_IPV4);
|
|
if (i + 1 < info->len)
|
|
printf(" --next");
|
|
}
|
|
}
|
|
|
|
static void policy6_save(const void *ip, const struct xt_entry_match *match)
|
|
{
|
|
const struct xt_policy_info *info = (void *)match->data;
|
|
unsigned int i;
|
|
|
|
print_flags("--", info);
|
|
for (i = 0; i < info->len; i++) {
|
|
print_entry("--", &info->pol[i], false, NFPROTO_IPV6);
|
|
if (i + 1 < info->len)
|
|
printf(" --next");
|
|
}
|
|
}
|
|
|
|
static int policy_xlate(struct xt_xlate *xl,
|
|
const struct xt_xlate_mt_params *params)
|
|
{
|
|
static const unsigned int allowed = XT_POLICY_MATCH_STRICT |
|
|
XT_POLICY_MATCH_NONE |
|
|
XT_POLICY_MATCH_IN;
|
|
static const struct xt_policy_elem empty;
|
|
const struct xt_policy_info *info = (const void *)params->match->data;
|
|
|
|
if ((info->flags & ~allowed) || info->len > 1)
|
|
return 0;
|
|
|
|
if (memcmp(&info->pol[0], &empty, sizeof(empty)))
|
|
return 0;
|
|
|
|
xt_xlate_add(xl, "meta secpath ");
|
|
|
|
if (info->flags & XT_POLICY_MATCH_NONE)
|
|
xt_xlate_add(xl, "missing");
|
|
else
|
|
xt_xlate_add(xl, "exists");
|
|
|
|
return 1;
|
|
}
|
|
|
|
static struct xtables_match policy_mt_reg[] = {
|
|
{
|
|
.name = "policy",
|
|
.version = XTABLES_VERSION,
|
|
.family = NFPROTO_IPV4,
|
|
.size = XT_ALIGN(sizeof(struct xt_policy_info)),
|
|
.userspacesize = XT_ALIGN(sizeof(struct xt_policy_info)),
|
|
.help = policy_help,
|
|
.x6_parse = policy_parse,
|
|
.x6_fcheck = policy_check,
|
|
.print = policy4_print,
|
|
.save = policy4_save,
|
|
.x6_options = policy_opts,
|
|
.xlate = policy_xlate,
|
|
},
|
|
{
|
|
.name = "policy",
|
|
.version = XTABLES_VERSION,
|
|
.family = NFPROTO_IPV6,
|
|
.size = XT_ALIGN(sizeof(struct xt_policy_info)),
|
|
.userspacesize = XT_ALIGN(sizeof(struct xt_policy_info)),
|
|
.help = policy_help,
|
|
.x6_parse = policy_parse,
|
|
.x6_fcheck = policy_check,
|
|
.print = policy6_print,
|
|
.save = policy6_save,
|
|
.x6_options = policy_opts,
|
|
.xlate = policy_xlate,
|
|
},
|
|
};
|
|
|
|
void _init(void)
|
|
{
|
|
xtables_register_matches(policy_mt_reg, ARRAY_SIZE(policy_mt_reg));
|
|
}
|