From d32980df1da9d81a93280b4f0e023c58055c4b0c Mon Sep 17 00:00:00 2001 From: Harald Welte Date: Mon, 25 Mar 2002 08:38:26 +0000 Subject: Add AH/ESP match for ipv6 --- extensions/.ah-test6 | 2 + extensions/.esp-test6 | 2 + extensions/libip6t_ah.c | 238 ++++++++++++++++++++++++++++++++ extensions/libip6t_esp.c | 190 +++++++++++++++++++++++++ include/linux/netfilter_ipv6/ip6t_ah.h | 21 +++ include/linux/netfilter_ipv6/ip6t_esp.h | 23 +++ 6 files changed, 476 insertions(+) create mode 100755 extensions/.ah-test6 create mode 100755 extensions/.esp-test6 create mode 100644 extensions/libip6t_ah.c create mode 100644 extensions/libip6t_esp.c create mode 100644 include/linux/netfilter_ipv6/ip6t_ah.h create mode 100644 include/linux/netfilter_ipv6/ip6t_esp.h diff --git a/extensions/.ah-test6 b/extensions/.ah-test6 new file mode 100755 index 00000000..1812c56d --- /dev/null +++ b/extensions/.ah-test6 @@ -0,0 +1,2 @@ +#!/bin/sh +[ -f $KERNEL_DIR/net/ipv6/netfilter/ip6t_ah.c -a -f $KERNEL_DIR/include/linux/netfilter_ipv6/ip6t_ah.h ] && echo ah diff --git a/extensions/.esp-test6 b/extensions/.esp-test6 new file mode 100755 index 00000000..ff63ca4b --- /dev/null +++ b/extensions/.esp-test6 @@ -0,0 +1,2 @@ +#!/bin/sh +[ -f $KERNEL_DIR/net/ipv6/netfilter/ip6t_esp.c -a -f $KERNEL_DIR/include/linux/netfilter_ipv6/ip6t_esp.h ] && echo esp diff --git a/extensions/libip6t_ah.c b/extensions/libip6t_ah.c new file mode 100644 index 00000000..f1696597 --- /dev/null +++ b/extensions/libip6t_ah.c @@ -0,0 +1,238 @@ +/* Shared library add-on to ip6tables to add AH support. */ +#include +#include +#include +#include +#include +#include +#include +#include + +/* Function which prints out usage message. */ +static void +help(void) +{ + printf( +"AH v%s options:\n" +" --ahspi [!] spi[:spi] match spi (range)\n" +" --ahlen [!] length total length of this header\n" +" --ahres check the reserved filed, too\n", +NETFILTER_VERSION); +} + +static struct option opts[] = { + { "ahspi", 1, 0, '1' }, + { "ahlen", 1, 0, '2' }, + { "ahres", 0, 0, '3' }, + {0} +}; + +static u_int32_t +parse_ah_spi(const char *spistr, const char *typestr) +{ + unsigned long int spi; + char* ep; + + spi = strtoul(spistr,&ep,0) ; + + if ( spistr == ep ) { + exit_error(PARAMETER_PROBLEM, + "AH no valid digits in %s `%s'", typestr, spistr); + } + if ( spi == ULONG_MAX && errno == ERANGE ) { + exit_error(PARAMETER_PROBLEM, + "%s `%s' specified too big: would overflow", + typestr, spistr); + } + if ( *spistr != '\0' && *ep != '\0' ) { + exit_error(PARAMETER_PROBLEM, + "AH error parsing %s `%s'", typestr, spistr); + } + return (u_int32_t) spi; +} + +static void +parse_ah_spis(const char *spistring, u_int32_t *spis) +{ + char *buffer; + char *cp; + + buffer = strdup(spistring); + if ((cp = strchr(buffer, ':')) == NULL) + spis[0] = spis[1] = parse_ah_spi(buffer,"spi"); + else { + *cp = '\0'; + cp++; + + spis[0] = buffer[0] ? parse_ah_spi(buffer,"spi") : 0; + spis[1] = cp[0] ? parse_ah_spi(cp,"spi") : 0xFFFFFFFF; + } + free(buffer); +} + +/* Initialize the match. */ +static void +init(struct ip6t_entry_match *m, unsigned int *nfcache) +{ + struct ip6t_ah *ahinfo = (struct ip6t_ah *)m->data; + + ahinfo->spis[1] = 0xFFFFFFFF; + ahinfo->hdrlen = 0; + ahinfo->hdrres = 0; +} + +/* Function which parses command options; returns true if it + ate an option */ +static int +parse(int c, char **argv, int invert, unsigned int *flags, + const struct ip6t_entry *entry, + unsigned int *nfcache, + struct ip6t_entry_match **match) +{ + struct ip6t_ah *ahinfo = (struct ip6t_ah *)(*match)->data; + + switch (c) { + case '1': + if (*flags & IP6T_AH_SPI) + exit_error(PARAMETER_PROBLEM, + "Only one `--ahspi' allowed"); + check_inverse(optarg, &invert, &optind, 0); + parse_ah_spis(argv[optind-1], ahinfo->spis); + if (invert) + ahinfo->invflags |= IP6T_AH_INV_SPI; + *flags |= IP6T_AH_SPI; + break; + case '2': + if (*flags & IP6T_AH_LEN) + exit_error(PARAMETER_PROBLEM, + "Only one `--ahlen' allowed"); + check_inverse(optarg, &invert, &optind, 0); + ahinfo->hdrlen = parse_ah_spi(argv[optind-1], "length"); + if (invert) + ahinfo->invflags |= IP6T_AH_INV_LEN; + *flags |= IP6T_AH_LEN; + break; + case '3': + if (*flags & IP6T_AH_RES) + exit_error(PARAMETER_PROBLEM, + "Only one `--ahres' allowed"); + ahinfo->hdrres = 1; + *flags |= IP6T_AH_RES; + break; + default: + return 0; + } + + return 1; +} + +/* Final check; we don't care. */ +static void +final_check(unsigned int flags) +{ +} + +static void +print_spis(const char *name, u_int32_t min, u_int32_t max, + int invert) +{ + const char *inv = invert ? "!" : ""; + + if (min != 0 || max != 0xFFFFFFFF || invert) { + printf("%s", name); + if (min == max) { + printf(":%s", inv); + printf("%u", min); + } else { + printf("s:%s", inv); + printf("%u",min); + printf(":"); + printf("%u",max); + } + printf(" "); + } +} + +static void +print_len(const char *name, u_int32_t len, int invert) +{ + const char *inv = invert ? "!" : ""; + + if (len != 0 || invert) { + printf("%s", name); + printf(":%s", inv); + printf("%u", len); + printf(" "); + } +} + +/* Prints out the union ip6t_matchinfo. */ +static void +print(const struct ip6t_ip6 *ip, + const struct ip6t_entry_match *match, int numeric) +{ + const struct ip6t_ah *ah = (struct ip6t_ah *)match->data; + + printf("ah "); + print_spis("spi", ah->spis[0], ah->spis[1], + ah->invflags & IP6T_AH_INV_SPI); + print_len("length", ah->hdrlen, + ah->invflags & IP6T_AH_INV_LEN); + if (ah->hdrres) printf("reserved "); + if (ah->invflags & ~IP6T_AH_INV_MASK) + printf("Unknown invflags: 0x%X ", + ah->invflags & ~IP6T_AH_INV_MASK); +} + +/* Saves the union ip6t_matchinfo in parsable form to stdout. */ +static void save(const struct ip6t_ip6 *ip, const struct ip6t_entry_match *match) +{ + const struct ip6t_ah *ahinfo = (struct ip6t_ah *)match->data; + + if (!(ahinfo->spis[0] == 0 + && ahinfo->spis[1] == 0xFFFFFFFF)) { + printf("--ahspi %s", + (ahinfo->invflags & IP6T_AH_INV_SPI) ? "! " : ""); + if (ahinfo->spis[0] + != ahinfo->spis[1]) + printf("%u:%u ", + ahinfo->spis[0], + ahinfo->spis[1]); + else + printf("%u ", + ahinfo->spis[0]); + } + + if (ahinfo->hdrlen != 0 ) { + printf("--ahlen %s%u ", + (ahinfo->invflags & IP6T_AH_INV_LEN) ? "! " : "", + ahinfo->hdrlen); + } + + if (ahinfo->hdrres != 0 ) { + printf("--ahres "); + } + +} + +static +struct ip6tables_match ah += { NULL, + "ah", + NETFILTER_VERSION, + IP6T_ALIGN(sizeof(struct ip6t_ah)), + IP6T_ALIGN(sizeof(struct ip6t_ah)), + &help, + &init, + &parse, + &final_check, + &print, + &save, + opts +}; + +void +_init(void) +{ + register_match6(&ah); +} diff --git a/extensions/libip6t_esp.c b/extensions/libip6t_esp.c new file mode 100644 index 00000000..973338f8 --- /dev/null +++ b/extensions/libip6t_esp.c @@ -0,0 +1,190 @@ +/* Shared library add-on to ip6tables to add ESP support. */ +#include +#include +#include +#include +#include +#include +#include +#include + +/* Function which prints out usage message. */ +static void +help(void) +{ + printf( +"ESP v%s options:\n" +" --espspi [!] spi[:spi] match spi (range)\n", +NETFILTER_VERSION); +} + +static struct option opts[] = { + { "espspi", 1, 0, '1' }, + {0} +}; + +static u_int32_t +parse_esp_spi(const char *spistr) +{ + unsigned long int spi; + char* ep; + + spi = strtoul(spistr,&ep,0) ; + + if ( spistr == ep ) { + exit_error(PARAMETER_PROBLEM, + "ESP no valid digits in spi `%s'", spistr); + } + if ( spi == ULONG_MAX && errno == ERANGE ) { + exit_error(PARAMETER_PROBLEM, + "spi `%s' specified too big: would overflow", spistr); + } + if ( *spistr != '\0' && *ep != '\0' ) { + exit_error(PARAMETER_PROBLEM, + "ESP error parsing spi `%s'", spistr); + } + return (u_int32_t) spi; +} + +static void +parse_esp_spis(const char *spistring, u_int32_t *spis) +{ + char *buffer; + char *cp; + + buffer = strdup(spistring); + if ((cp = strchr(buffer, ':')) == NULL) + spis[0] = spis[1] = parse_esp_spi(buffer); + else { + *cp = '\0'; + cp++; + + spis[0] = buffer[0] ? parse_esp_spi(buffer) : 0; + spis[1] = cp[0] ? parse_esp_spi(cp) : 0xFFFFFFFF; + } + free(buffer); +} + +/* Initialize the match. */ +static void +init(struct ip6t_entry_match *m, unsigned int *nfcache) +{ + struct ip6t_esp *espinfo = (struct ip6t_esp *)m->data; + + espinfo->spis[1] = 0xFFFFFFFF; +} + +#define ESP_SPI 0x01 + +/* Function which parses command options; returns true if it + ate an option */ +static int +parse(int c, char **argv, int invert, unsigned int *flags, + const struct ip6t_entry *entry, + unsigned int *nfcache, + struct ip6t_entry_match **match) +{ + struct ip6t_esp *espinfo = (struct ip6t_esp *)(*match)->data; + + switch (c) { + case '1': + if (*flags & ESP_SPI) + exit_error(PARAMETER_PROBLEM, + "Only one `--espspi' allowed"); + check_inverse(optarg, &invert, &optind, 0); + parse_esp_spis(argv[optind-1], espinfo->spis); + if (invert) + espinfo->invflags |= IP6T_ESP_INV_SPI; + *flags |= ESP_SPI; + break; + default: + return 0; + } + + return 1; +} + +/* Final check; we don't care. */ +static void +final_check(unsigned int flags) +{ +} + +static void +print_spis(const char *name, u_int32_t min, u_int32_t max, + int invert) +{ + const char *inv = invert ? "!" : ""; + + if (min != 0 || max != 0xFFFFFFFF || invert) { + printf("%s", name); + if (min == max) { + printf(":%s", inv); + printf("%u", min); + } else { + printf("s:%s", inv); + printf("%u",min); + printf(":"); + printf("%u",max); + } + printf(" "); + } +} + +/* Prints out the union ip6t_matchinfo. */ +static void +print(const struct ip6t_ip6 *ip, + const struct ip6t_entry_match *match, int numeric) +{ + const struct ip6t_esp *esp = (struct ip6t_esp *)match->data; + + printf("esp "); + print_spis("spi", esp->spis[0], esp->spis[1], + esp->invflags & IP6T_ESP_INV_SPI); + if (esp->invflags & ~IP6T_ESP_INV_MASK) + printf("Unknown invflags: 0x%X ", + esp->invflags & ~IP6T_ESP_INV_MASK); +} + +/* Saves the union ip6t_matchinfo in parsable form to stdout. */ +static void save(const struct ip6t_ip6 *ip, const struct ip6t_entry_match *match) +{ + const struct ip6t_esp *espinfo = (struct ip6t_esp *)match->data; + + if (!(espinfo->spis[0] == 0 + && espinfo->spis[1] == 0xFFFFFFFF)) { + printf("--espspi %s", + (espinfo->invflags & IP6T_ESP_INV_SPI) ? "! " : ""); + if (espinfo->spis[0] + != espinfo->spis[1]) + printf("%u:%u ", + espinfo->spis[0], + espinfo->spis[1]); + else + printf("%u ", + espinfo->spis[0]); + } + +} + +static +struct ip6tables_match esp += { NULL, + "esp", + NETFILTER_VERSION, + IP6T_ALIGN(sizeof(struct ip6t_esp)), + IP6T_ALIGN(sizeof(struct ip6t_esp)), + &help, + &init, + &parse, + &final_check, + &print, + &save, + opts +}; + +void +_init(void) +{ + register_match6(&esp); +} diff --git a/include/linux/netfilter_ipv6/ip6t_ah.h b/include/linux/netfilter_ipv6/ip6t_ah.h new file mode 100644 index 00000000..8531879e --- /dev/null +++ b/include/linux/netfilter_ipv6/ip6t_ah.h @@ -0,0 +1,21 @@ +#ifndef _IP6T_AH_H +#define _IP6T_AH_H + +struct ip6t_ah +{ + u_int32_t spis[2]; /* Security Parameter Index */ + u_int32_t hdrlen; /* Header Length */ + u_int8_t hdrres; /* Test of the Reserved Filed */ + u_int8_t invflags; /* Inverse flags */ +}; + +#define IP6T_AH_SPI 0x01 +#define IP6T_AH_LEN 0x02 +#define IP6T_AH_RES 0x04 + +/* Values for "invflags" field in struct ip6t_ah. */ +#define IP6T_AH_INV_SPI 0x01 /* Invert the sense of spi. */ +#define IP6T_AH_INV_LEN 0x02 /* Invert the sense of length. */ +#define IP6T_AH_INV_MASK 0x03 /* All possible flags. */ + +#endif /*_IP6T_AH_H*/ diff --git a/include/linux/netfilter_ipv6/ip6t_esp.h b/include/linux/netfilter_ipv6/ip6t_esp.h new file mode 100644 index 00000000..01142b98 --- /dev/null +++ b/include/linux/netfilter_ipv6/ip6t_esp.h @@ -0,0 +1,23 @@ +#ifndef _IP6T_ESP_H +#define _IP6T_ESP_H + +struct ip6t_esp +{ + u_int32_t spis[2]; /* Security Parameter Index */ + u_int8_t invflags; /* Inverse flags */ +}; + +#define MASK_HOPOPTS 128 +#define MASK_DSTOPTS 64 +#define MASK_ROUTING 32 +#define MASK_FRAGMENT 16 +#define MASK_AH 8 +#define MASK_ESP 4 +#define MASK_NONE 2 +#define MASK_PROTO 1 + +/* Values for "invflags" field in struct ip6t_esp. */ +#define IP6T_ESP_INV_SPI 0x01 /* Invert the sense of spi. */ +#define IP6T_ESP_INV_MASK 0x01 /* All possible flags. */ + +#endif /*_IP6T_ESP_H*/ -- cgit v1.2.3