summaryrefslogtreecommitdiffstats
path: root/extensions
diff options
context:
space:
mode:
Diffstat (limited to 'extensions')
-rw-r--r--extensions/Makefile.am4
-rw-r--r--extensions/libct_proto_icmp.c56
-rw-r--r--extensions/libct_proto_sctp.c164
-rw-r--r--extensions/libct_proto_tcp.c157
-rw-r--r--extensions/libct_proto_udp.c93
5 files changed, 191 insertions, 283 deletions
diff --git a/extensions/Makefile.am b/extensions/Makefile.am
index 5366ee3..db97c4d 100644
--- a/extensions/Makefile.am
+++ b/extensions/Makefile.am
@@ -4,7 +4,7 @@ AM_CFLAGS=-fPIC -Wall
LIBS=
pkglib_LTLIBRARIES = ct_proto_tcp.la ct_proto_udp.la \
- ct_proto_icmp.la ct_proto_sctp.la
+ ct_proto_icmp.la
ct_proto_tcp_la_SOURCES = libct_proto_tcp.c
ct_proto_tcp_la_LDFLAGS = -module -avoid-version
@@ -12,5 +12,3 @@ ct_proto_udp_la_SOURCES = libct_proto_udp.c
ct_proto_udp_la_LDFLAGS = -module -avoid-version
ct_proto_icmp_la_SOURCES = libct_proto_icmp.c
ct_proto_icmp_la_LDFLAGS = -module -avoid-version
-ct_proto_sctp_la_SOURCES = libct_proto_sctp.c
-ct_proto_sctp_la_LDFLAGS = -module -avoid-version
diff --git a/extensions/libct_proto_icmp.c b/extensions/libct_proto_icmp.c
index e7cb04d..7b02dec 100644
--- a/extensions/libct_proto_icmp.c
+++ b/extensions/libct_proto_icmp.c
@@ -1,6 +1,6 @@
/*
- * (C) 2005 by Pablo Neira Ayuso <pablo@eurodev.net>
- * Harald Welte <laforge@netfilter.org>
+ * (C) 2005-2007 by Pablo Neira Ayuso <pablo@netfilter.org>
+ * 2005 by Harald Welte <laforge@netfilter.org>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@@ -43,35 +43,42 @@ static u_int8_t invmap[]
[ICMP_ADDRESSREPLY] = ICMP_ADDRESS + 1};
static int parse(char c, char *argv[],
- struct nfct_tuple *orig,
- struct nfct_tuple *reply,
- struct nfct_tuple *exptuple,
- struct nfct_tuple *mask,
- union nfct_protoinfo *proto,
+ struct nf_conntrack *ct,
+ struct nf_conntrack *exptuple,
+ struct nf_conntrack *mask,
unsigned int *flags)
{
switch(c) {
case '1':
- if (optarg) {
- orig->l4dst.icmp.type = atoi(optarg);
- reply->l4dst.icmp.type =
- invmap[orig->l4dst.icmp.type] - 1;
- *flags |= ICMP_TYPE;
- }
+ if (!optarg)
+ break;
+
+ nfct_set_attr_u8(ct,
+ ATTR_ICMP_TYPE,
+ atoi(optarg));
+ /* FIXME:
+ reply->l4dst.icmp.type =
+ invmap[orig->l4dst.icmp.type] - 1;
+ */
+ *flags |= ICMP_TYPE;
break;
case '2':
- if (optarg) {
- orig->l4dst.icmp.code = atoi(optarg);
- reply->l4dst.icmp.code = 0;
- *flags |= ICMP_CODE;
- }
+ if (!optarg)
+ break;
+
+ nfct_set_attr_u8(ct,
+ ATTR_ICMP_CODE,
+ atoi(optarg));
+ *flags |= ICMP_CODE;
break;
case '3':
- if (optarg) {
- orig->l4src.icmp.id = htons(atoi(optarg));
- reply->l4dst.icmp.id = 0;
- *flags |= ICMP_ID;
- }
+ if (!optarg)
+ break;
+
+ nfct_set_attr_u16(ct,
+ ATTR_ICMP_ID,
+ htons(atoi(optarg)));
+ *flags |= ICMP_ID;
break;
}
return 1;
@@ -79,8 +86,7 @@ static int parse(char c, char *argv[],
static int final_check(unsigned int flags,
unsigned int command,
- struct nfct_tuple *orig,
- struct nfct_tuple *reply)
+ struct nf_conntrack *ct)
{
if (!(flags & ICMP_TYPE))
return 0;
diff --git a/extensions/libct_proto_sctp.c b/extensions/libct_proto_sctp.c
deleted file mode 100644
index 1c8f0d1..0000000
--- a/extensions/libct_proto_sctp.c
+++ /dev/null
@@ -1,164 +0,0 @@
-/*
- * (C) 2005 by Harald Welte <laforge@netfilter.org>
- * 2006 by Pablo Neira Ayuso <pablo@netfilter.org>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- */
-#include <stdio.h>
-#include <getopt.h>
-#include <stdlib.h>
-#include <string.h>
-#include <netinet/in.h> /* For htons */
-#include "conntrack.h"
-#include <libnetfilter_conntrack/libnetfilter_conntrack.h>
-#include <libnetfilter_conntrack/libnetfilter_conntrack_sctp.h>
-
-static struct option opts[] = {
- {"orig-port-src", 1, 0, '1'},
- {"orig-port-dst", 1, 0, '2'},
- {"reply-port-src", 1, 0, '3'},
- {"reply-port-dst", 1, 0, '4'},
- {"state", 1, 0, '5'},
- {"tuple-port-src", 1, 0, '6'},
- {"tuple-port-dst", 1, 0, '7'},
- {0, 0, 0, 0}
-};
-
-static const char *states[] = {
- "NONE",
- "CLOSED",
- "COOKIE_WAIT",
- "COOKIE_ECHOED",
- "ESTABLISHED",
- "SHUTDOWN_SENT",
- "SHUTDOWN_RECV",
- "SHUTDOWN_ACK_SENT",
-};
-
-static void help()
-{
- fprintf(stdout, "--orig-port-src original source port\n");
- fprintf(stdout, "--orig-port-dst original destination port\n");
- fprintf(stdout, "--reply-port-src reply source port\n");
- fprintf(stdout, "--reply-port-dst reply destination port\n");
- fprintf(stdout, "--state SCTP state, fe. ESTABLISHED\n");
- fprintf(stdout, "--tuple-port-src expectation tuple src port\n");
- fprintf(stdout, "--tuple-port-src expectation tuple dst port\n");
-}
-
-static int parse_options(char c, char *argv[],
- struct nfct_tuple *orig,
- struct nfct_tuple *reply,
- struct nfct_tuple *exptuple,
- struct nfct_tuple *mask,
- union nfct_protoinfo *proto,
- unsigned int *flags)
-{
- switch(c) {
- case '1':
- if (optarg) {
- orig->l4src.sctp.port = htons(atoi(optarg));
- *flags |= SCTP_ORIG_SPORT;
- }
- break;
- case '2':
- if (optarg) {
- orig->l4dst.sctp.port = htons(atoi(optarg));
- *flags |= SCTP_ORIG_DPORT;
- }
- break;
- case '3':
- if (optarg) {
- reply->l4src.sctp.port = htons(atoi(optarg));
- *flags |= SCTP_REPL_SPORT;
- }
- break;
- case '4':
- if (optarg) {
- reply->l4dst.sctp.port = htons(atoi(optarg));
- *flags |= SCTP_REPL_DPORT;
- }
- break;
- case '5':
- if (optarg) {
- int i;
- for (i=0; i<10; i++) {
- if (strcmp(optarg, states[i]) == 0) {
- /* FIXME: Add state to
- * nfct_protoinfo
- proto->sctp.state = i; */
- break;
- }
- }
- if (i == 10) {
- printf("doh?\n");
- return 0;
- }
- *flags |= SCTP_STATE;
- }
- break;
- case '6':
- if (optarg) {
- exptuple->l4src.sctp.port = htons(atoi(optarg));
- *flags |= SCTP_EXPTUPLE_SPORT;
- }
- break;
- case '7':
- if (optarg) {
- exptuple->l4dst.sctp.port = htons(atoi(optarg));
- *flags |= SCTP_EXPTUPLE_DPORT;
- }
-
- }
- return 1;
-}
-
-static int final_check(unsigned int flags,
- unsigned int command,
- struct nfct_tuple *orig,
- struct nfct_tuple *reply)
-{
- int ret = 0;
-
- if ((flags & (SCTP_ORIG_SPORT|SCTP_ORIG_DPORT))
- && !(flags & (SCTP_REPL_SPORT|SCTP_REPL_DPORT))) {
- reply->l4src.sctp.port = orig->l4dst.sctp.port;
- reply->l4dst.sctp.port = orig->l4src.sctp.port;
- ret = 1;
- } else if (!(flags & (SCTP_ORIG_SPORT|SCTP_ORIG_DPORT))
- && (flags & (SCTP_REPL_SPORT|SCTP_REPL_DPORT))) {
- orig->l4src.sctp.port = reply->l4dst.sctp.port;
- orig->l4dst.sctp.port = reply->l4src.sctp.port;
- ret = 1;
- }
- if ((flags & (SCTP_ORIG_SPORT|SCTP_ORIG_DPORT))
- && ((flags & (SCTP_REPL_SPORT|SCTP_REPL_DPORT))))
- ret = 1;
-
- /* --state is missing and we are trying to create a conntrack */
- if (ret && (command & CT_CREATE) && (!(flags & SCTP_STATE)))
- ret = 0;
-
- return ret;
-}
-
-static struct ctproto_handler sctp = {
- .name = "sctp",
- .protonum = IPPROTO_SCTP,
- .parse_opts = parse_options,
- .final_check = final_check,
- .help = help,
- .opts = opts,
- .version = VERSION,
-};
-
-static void __attribute__ ((constructor)) init(void);
-
-static void init(void)
-{
- register_proto(&sctp);
-}
diff --git a/extensions/libct_proto_tcp.c b/extensions/libct_proto_tcp.c
index ee24206..736bcff 100644
--- a/extensions/libct_proto_tcp.c
+++ b/extensions/libct_proto_tcp.c
@@ -1,5 +1,5 @@
/*
- * (C) 2005 by Pablo Neira Ayuso <pablo@eurodev.net>
+ * (C) 2005-2007 by Pablo Neira Ayuso <pablo@netfilter.org>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@@ -56,78 +56,112 @@ static void help()
fprintf(stdout, "--state TCP state, fe. ESTABLISHED\n");
}
-static int parse_options(char c, char *argv[],
- struct nfct_tuple *orig,
- struct nfct_tuple *reply,
- struct nfct_tuple *exptuple,
- struct nfct_tuple *mask,
- union nfct_protoinfo *proto,
+static int parse_options(char c, char *argv[],
+ struct nf_conntrack *ct,
+ struct nf_conntrack *exptuple,
+ struct nf_conntrack *mask,
unsigned int *flags)
{
+ int i;
+
switch(c) {
case '1':
- if (optarg) {
- orig->l4src.tcp.port = htons(atoi(optarg));
- *flags |= TCP_ORIG_SPORT;
- }
+ if (!optarg)
+ break;
+
+ nfct_set_attr_u16(ct,
+ ATTR_ORIG_PORT_SRC,
+ htons(atoi(optarg)));
+
+ *flags |= TCP_ORIG_SPORT;
break;
case '2':
- if (optarg) {
- orig->l4dst.tcp.port = htons(atoi(optarg));
- *flags |= TCP_ORIG_DPORT;
- }
+ if (!optarg)
+ break;
+
+ nfct_set_attr_u16(ct,
+ ATTR_ORIG_PORT_DST,
+ htons(atoi(optarg)));
+
+ *flags |= TCP_ORIG_DPORT;
break;
case '3':
- if (optarg) {
- reply->l4src.tcp.port = htons(atoi(optarg));
- *flags |= TCP_REPL_SPORT;
- }
+ if (!optarg)
+ break;
+
+ nfct_set_attr_u16(ct,
+ ATTR_REPL_PORT_SRC,
+ htons(atoi(optarg)));
+
+ *flags |= TCP_REPL_SPORT;
break;
case '4':
- if (optarg) {
- reply->l4dst.tcp.port = htons(atoi(optarg));
- *flags |= TCP_REPL_DPORT;
- }
+ if (!optarg)
+ break;
+
+ nfct_set_attr_u16(ct,
+ ATTR_REPL_PORT_DST,
+ htons(atoi(optarg)));
+
+ *flags |= TCP_REPL_DPORT;
break;
case '5':
- if (optarg) {
- mask->l4src.tcp.port = htons(atoi(optarg));
- *flags |= TCP_MASK_SPORT;
- }
+ if (!optarg)
+ break;
+
+ nfct_set_attr_u16(mask,
+ ATTR_ORIG_PORT_SRC,
+ htons(atoi(optarg)));
+
+ *flags |= TCP_MASK_SPORT;
break;
case '6':
- if (optarg) {
- mask->l4dst.tcp.port = htons(atoi(optarg));
- *flags |= TCP_MASK_DPORT;
- }
+ if (!optarg)
+ break;
+
+ nfct_set_attr_u16(mask,
+ ATTR_ORIG_PORT_DST,
+ htons(atoi(optarg)));
+
+ *flags |= TCP_MASK_DPORT;
break;
case '7':
- if (optarg) {
- int i;
- for (i=0; i<10; i++) {
- if (strcmp(optarg, states[i]) == 0) {
- proto->tcp.state = i;
- break;
- }
- }
- if (i == 10) {
- printf("doh?\n");
- return 0;
+ if (!optarg)
+ break;
+
+ for (i=0; i<10; i++) {
+ if (strcmp(optarg, states[i]) == 0) {
+ nfct_set_attr_u8(ct,
+ ATTR_TCP_STATE,
+ i);
+ break;
}
- *flags |= TCP_STATE;
}
+ if (i == 10) {
+ printf("doh?\n");
+ return 0;
+ }
+ *flags |= TCP_STATE;
break;
case '8':
- if (optarg) {
- exptuple->l4src.tcp.port = htons(atoi(optarg));
- *flags |= TCP_EXPTUPLE_SPORT;
- }
+ if (!optarg)
+ break;
+
+ nfct_set_attr_u16(exptuple,
+ ATTR_ORIG_PORT_SRC,
+ htons(atoi(optarg)));
+
+ *flags |= TCP_EXPTUPLE_SPORT;
break;
case '9':
- if (optarg) {
- exptuple->l4dst.tcp.port = htons(atoi(optarg));
- *flags |= TCP_EXPTUPLE_DPORT;
- }
+ if (!optarg)
+ break;
+
+ nfct_set_attr_u16(exptuple,
+ ATTR_ORIG_PORT_DST,
+ htons(atoi(optarg)));
+
+ *flags |= TCP_EXPTUPLE_DPORT;
break;
}
return 1;
@@ -135,20 +169,27 @@ static int parse_options(char c, char *argv[],
static int final_check(unsigned int flags,
unsigned int command,
- struct nfct_tuple *orig,
- struct nfct_tuple *reply)
+ struct nf_conntrack *ct)
{
int ret = 0;
-
+
if ((flags & (TCP_ORIG_SPORT|TCP_ORIG_DPORT))
&& !(flags & (TCP_REPL_SPORT|TCP_REPL_DPORT))) {
- reply->l4src.tcp.port = orig->l4dst.tcp.port;
- reply->l4dst.tcp.port = orig->l4src.tcp.port;
+ nfct_set_attr_u16(ct,
+ ATTR_REPL_PORT_SRC,
+ nfct_get_attr_u16(ct, ATTR_ORIG_PORT_DST));
+ nfct_set_attr_u16(ct,
+ ATTR_REPL_PORT_DST,
+ nfct_get_attr_u16(ct, ATTR_ORIG_PORT_SRC));
ret = 1;
} else if (!(flags & (TCP_ORIG_SPORT|TCP_ORIG_DPORT))
&& (flags & (TCP_REPL_SPORT|TCP_REPL_DPORT))) {
- orig->l4src.tcp.port = reply->l4dst.tcp.port;
- orig->l4dst.tcp.port = reply->l4src.tcp.port;
+ nfct_set_attr_u16(ct,
+ ATTR_ORIG_PORT_SRC,
+ nfct_get_attr_u16(ct, ATTR_REPL_PORT_DST));
+ nfct_set_attr_u16(ct,
+ ATTR_ORIG_PORT_DST,
+ nfct_get_attr_u16(ct, ATTR_REPL_PORT_SRC));
ret = 1;
}
if ((flags & (TCP_ORIG_SPORT|TCP_ORIG_DPORT))
diff --git a/extensions/libct_proto_udp.c b/extensions/libct_proto_udp.c
index 48079e0..1bc70d4 100644
--- a/extensions/libct_proto_udp.c
+++ b/extensions/libct_proto_udp.c
@@ -1,5 +1,5 @@
/*
- * (C) 2005 by Pablo Neira Ayuso <pablo@eurodev.net>
+ * (C) 2005-2007 by Pablo Neira Ayuso <pablo@netfilter.org>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@@ -10,11 +10,13 @@
#include <stdio.h>
#include <getopt.h>
#include <stdlib.h>
+#include <string.h>
#include <netinet/in.h> /* For htons */
-#include "conntrack.h"
#include <libnetfilter_conntrack/libnetfilter_conntrack.h>
#include <libnetfilter_conntrack/libnetfilter_conntrack_udp.h>
+#include "conntrack.h"
+
static struct option opts[] = {
{"orig-port-src", 1, 0, '1'},
{"orig-port-dst", 1, 0, '2'},
@@ -39,38 +41,54 @@ static void help()
fprintf(stdout, "--tuple-port-src expectation tuple dst port\n");
}
-static int parse_options(char c, char *argv[],
- struct nfct_tuple *orig,
- struct nfct_tuple *reply,
+static int parse_options(char c, char *argv[],
+ struct nf_conntrack *ct,
struct nfct_tuple *exptuple,
struct nfct_tuple *mask,
- union nfct_protoinfo *proto,
unsigned int *flags)
{
+ int i;
+
switch(c) {
case '1':
- if (optarg) {
- orig->l4src.udp.port = htons(atoi(optarg));
- *flags |= UDP_ORIG_SPORT;
- }
+ if (!optarg)
+ break;
+
+ nfct_set_attr_u16(ct,
+ ATTR_ORIG_PORT_SRC,
+ htons(atoi(optarg)));
+
+ *flags |= UDP_ORIG_SPORT;
break;
case '2':
- if (optarg) {
- orig->l4dst.udp.port = htons(atoi(optarg));
- *flags |= UDP_ORIG_DPORT;
- }
+ if (!optarg)
+ break;
+
+ nfct_set_attr_u16(ct,
+ ATTR_ORIG_PORT_DST,
+ htons(atoi(optarg)));
+
+ *flags |= UDP_ORIG_DPORT;
break;
case '3':
- if (optarg) {
- reply->l4src.udp.port = htons(atoi(optarg));
- *flags |= UDP_REPL_SPORT;
- }
+ if (!optarg)
+ break;
+
+ nfct_set_attr_u16(ct,
+ ATTR_REPL_PORT_SRC,
+ htons(atoi(optarg)));
+
+ *flags |= UDP_REPL_SPORT;
break;
case '4':
- if (optarg) {
- reply->l4dst.udp.port = htons(atoi(optarg));
- *flags |= UDP_REPL_DPORT;
- }
+ if (!optarg)
+ break;
+
+ nfct_set_attr_u16(ct,
+ ATTR_REPL_PORT_DST,
+ htons(atoi(optarg)));
+
+ *flags |= UDP_REPL_DPORT;
break;
case '5':
if (optarg) {
@@ -95,32 +113,41 @@ static int parse_options(char c, char *argv[],
exptuple->l4dst.udp.port = htons(atoi(optarg));
*flags |= UDP_EXPTUPLE_DPORT;
}
-
+ break;
}
return 1;
}
static int final_check(unsigned int flags,
unsigned int command,
- struct nfct_tuple *orig,
- struct nfct_tuple *reply)
+ struct nf_conntrack *ct)
{
+ int ret = 0;
+
if ((flags & (UDP_ORIG_SPORT|UDP_ORIG_DPORT))
&& !(flags & (UDP_REPL_SPORT|UDP_REPL_DPORT))) {
- reply->l4src.udp.port = orig->l4dst.udp.port;
- reply->l4dst.udp.port = orig->l4src.udp.port;
- return 1;
+ nfct_set_attr_u16(ct,
+ ATTR_REPL_PORT_SRC,
+ nfct_get_attr_u16(ct, ATTR_ORIG_PORT_DST));
+ nfct_set_attr_u16(ct,
+ ATTR_REPL_PORT_DST,
+ nfct_get_attr_u16(ct, ATTR_ORIG_PORT_SRC));
+ ret = 1;
} else if (!(flags & (UDP_ORIG_SPORT|UDP_ORIG_DPORT))
&& (flags & (UDP_REPL_SPORT|UDP_REPL_DPORT))) {
- orig->l4src.udp.port = reply->l4dst.udp.port;
- orig->l4dst.udp.port = reply->l4src.udp.port;
- return 1;
+ nfct_set_attr_u16(ct,
+ ATTR_ORIG_PORT_SRC,
+ nfct_get_attr_u16(ct, ATTR_REPL_PORT_DST));
+ nfct_set_attr_u16(ct,
+ ATTR_ORIG_PORT_DST,
+ nfct_get_attr_u16(ct, ATTR_REPL_PORT_SRC));
+ ret = 1;
}
if ((flags & (UDP_ORIG_SPORT|UDP_ORIG_DPORT))
&& ((flags & (UDP_REPL_SPORT|UDP_REPL_DPORT))))
- return 1;
+ ret = 1;
- return 0;
+ return ret;
}
static struct ctproto_handler udp = {