ebt_ip: add support for matching IGMP type

We already have ICMPv6 type/code matches (which can be used to distinguish
different types of MLD packets). Add support for IPv4 IGMP matches in the
same way.

To reuse as much code as possible, the ICMP type/code handling functions
are extended to allow passing a NULL code range.

Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

2 files changed, 65 insertions, 14 deletions

diff --git a/extensions/ebt_ip.c b/extensions/ebt_ip.c
index 42660d4..1ffdb95 100644
--- a/extensions/ebt_ip.c
+++ b/extensions/ebt_ip.c
@@ -25,6 +25,7 @@
 #define IP_SPORT  '5'
 #define IP_DPORT  '6'
 #define IP_ICMP   '7'
+#define IP_IGMP   '8'
 
 static const struct option opts[] =
 {
@@ -40,6 +41,7 @@ static const struct option opts[] =
 	{ "ip-destination-port" , required_argument, 0, IP_DPORT  },
 	{ "ip-dport"            , required_argument, 0, IP_DPORT  },
 	{ "ip-icmp-type"        , required_argument, 0, IP_ICMP   },
+	{ "ip-igmp-type"        , required_argument, 0, IP_IGMP   },
 	{ 0 }
 };
 
@@ -97,6 +99,14 @@ static const struct ebt_icmp_names icmp_codes[] = {
 	{ "address-mask-reply", 18, 0, 0xFF }
 };
 
+static const struct ebt_icmp_names igmp_types[] = {
+	{ "membership-query", 0x11 },
+	{ "membership-report-v1", 0x12 },
+	{ "membership-report-v2", 0x16 },
+	{ "leave-group", 0x17 },
+	{ "membership-report-v3", 0x22 },
+};
+
 /* put the mask into 4 bytes */
 /* transform a protocol and service name into a port number */
 static uint16_t parse_port(const char *protocol, const char *name)
@@ -162,10 +172,13 @@ static void print_help()
 "--ip-proto  [!] protocol      : ip protocol specification\n"
 "--ip-sport  [!] port[:port]   : tcp/udp source port or port range\n"
 "--ip-dport  [!] port[:port]   : tcp/udp destination port or port range\n"
-"--ip-icmp-type [!] type[[:type]/code[:code]] : icmp type/code or type/code range\n");
+"--ip-icmp-type [!] type[[:type]/code[:code]] : icmp type/code or type/code range\n"
+"--ip-igmp-type [!] type[:type]               : igmp type or type range\n");
 
 	printf("\nValid ICMP Types:\n");
 	ebt_print_icmp_types(icmp_codes, ARRAY_SIZE(icmp_codes));
+	printf("\nValid IGMP Types:\n");
+	ebt_print_icmp_types(igmp_types, ARRAY_SIZE(igmp_types));
 }
 
 static void init(struct ebt_entry_match *match)
@@ -183,6 +196,7 @@ static void init(struct ebt_entry_match *match)
 #define OPT_SPORT  0x10
 #define OPT_DPORT  0x20
 #define OPT_ICMP   0x40
+#define OPT_IGMP   0x80
 static int parse(int c, char **argv, int argc, const struct ebt_u_entry *entry,
    unsigned int *flags, struct ebt_entry_match **match)
 {
@@ -241,6 +255,16 @@ static int parse(int c, char **argv, int argc, const struct ebt_u_entry *entry,
 			return 0;
 		break;
 
+	case IP_IGMP:
+		ebt_check_option2(flags, OPT_IGMP);
+		ipinfo->bitmask |= EBT_IP_IGMP;
+		if (ebt_check_inverse2(optarg))
+			ipinfo->invflags |= EBT_IP_IGMP;
+		if (ebt_parse_icmp(igmp_types, ARRAY_SIZE(igmp_types), optarg,
+				   ipinfo->igmp_type, NULL))
+			return 0;
+		break;
+
 	case IP_myTOS:
 		ebt_check_option2(flags, OPT_TOS);
 		if (ebt_check_inverse2(optarg))
@@ -300,6 +324,12 @@ static void final_check(const struct ebt_u_entry *entry,
 	            ipinfo->protocol != IPPROTO_ICMP)) {
 		ebt_print_error("For ICMP filtering the IP protocol must be "
 				"1 (icmp)");
+	} else if ((ipinfo->bitmask & EBT_IP_IGMP) &&
+	         (!(ipinfo->bitmask & EBT_IP_PROTO) ||
+	            ipinfo->invflags & EBT_IP_PROTO ||
+	            ipinfo->protocol != IPPROTO_IGMP)) {
+		ebt_print_error("For IGMP filtering the IP protocol must be "
+				"2 (igmp)");
 	}
 }
 
@@ -365,6 +395,13 @@ static void print(const struct ebt_u_entry *entry,
 		ebt_print_icmp_type(icmp_codes, ARRAY_SIZE(icmp_codes),
 				    ipinfo->icmp_type, ipinfo->icmp_code);
 	}
+	if (ipinfo->bitmask & EBT_IP_IGMP) {
+		printf("--ip-igmp-type ");
+		if (ipinfo->invflags & EBT_IP_IGMP)
+			printf("! ");
+		ebt_print_icmp_type(igmp_types, ARRAY_SIZE(igmp_types),
+				    ipinfo->igmp_type, NULL);
+	}
 }
 
 static int compare(const struct ebt_entry_match *m1,
@@ -414,6 +451,11 @@ static int compare(const struct ebt_entry_match *m1,
 		    ipinfo1->icmp_code[1] != ipinfo2->icmp_code[1])
 			return 0;
 	}
+	if (ipinfo1->bitmask & EBT_IP_IGMP) {
+		if (ipinfo1->igmp_type[0] != ipinfo2->igmp_type[0] ||
+		    ipinfo1->igmp_type[1] != ipinfo2->igmp_type[1])
+			return 0;
+	}
 	return 1;
 }
 
diff --git a/useful_functions.c b/useful_functions.c
index 8f54bae..8a34f82 100644
--- a/useful_functions.c
+++ b/useful_functions.c
@@ -486,8 +486,10 @@ int ebt_parse_icmp(const struct ebt_icmp_names *icmp_codes, size_t n_codes,
 
 	if (match < n_codes) {
 		type[0] = type[1] = icmp_codes[match].type;
-		code[0] = icmp_codes[match].code_min;
-		code[1] = icmp_codes[match].code_max;
+		if (code) {
+			code[0] = icmp_codes[match].code_min;
+			code[1] = icmp_codes[match].code_max;
+		}
 	} else {
 		char *next = parse_range(icmptype, 0, 255, number);
 		if (!next) {
@@ -499,17 +501,21 @@ int ebt_parse_icmp(const struct ebt_icmp_names *icmp_codes, size_t n_codes,
 		type[1] = (uint8_t) number[1];
 		switch (*next) {
 		case 0:
-			code[0] = 0;
-			code[1] = 255;
+			if (code) {
+				code[0] = 0;
+				code[1] = 255;
+			}
 			return 0;
 		case '/':
-			next = parse_range(next+1, 0, 255, number);
-			code[0] = (uint8_t) number[0];
-			code[1] = (uint8_t) number[1];
-			if (next == NULL)
-				return -1;
-			if (next && *next == 0)
-				return 0;
+			if (code) {
+				next = parse_range(next+1, 0, 255, number);
+				code[0] = (uint8_t) number[0];
+				code[1] = (uint8_t) number[1];
+				if (next == NULL)
+					return -1;
+				if (next && *next == 0)
+					return 0;
+			}
 		/* fallthrough */
 		default:
 			ebt_print_error("unknown character %c", *next);
@@ -521,6 +527,9 @@ int ebt_parse_icmp(const struct ebt_icmp_names *icmp_codes, size_t n_codes,
 
 static void print_icmp_code(uint8_t *code)
 {
+	if (!code)
+		return;
+
 	if (code[0] == code[1])
 		printf("/%"PRIu8 " ", code[0]);
 	else
@@ -542,8 +551,8 @@ void ebt_print_icmp_type(const struct ebt_icmp_names *icmp_codes,
 		if (icmp_codes[i].type != type[0])
 			continue;
 
-		if (icmp_codes[i].code_min == code[0] &&
-		    icmp_codes[i].code_max == code[1]) {
+		if (!code || (icmp_codes[i].code_min == code[0] &&
+			      icmp_codes[i].code_max == code[1])) {
 			printf("%s ", icmp_codes[i].name);
 			return;
 		}