From 18bbf19becaab7dc4137406928f96ad089192f69 Mon Sep 17 00:00:00 2001 From: "/C=EU/ST=EU/CN=Pablo Neira Ayuso/emailAddress=pablo@netfilter.org" Date: Wed, 18 Jul 2007 20:04:00 +0000 Subject: conntrackd: - use buffer of MTU size conntrack: - better protocol argument checkings - fix per-protocol filtering, eg. conntrack -[L|E] -p tcp now works - show per-protocol help, ie. conntrack -h -p tcp - add alias --src for --orig-src and alias --dst for --orig-dst --- extensions/libct_proto_icmp.c | 45 ++++++++++++++++++++++++------- extensions/libct_proto_tcp.c | 63 +++++++++++++++++++++++++++++-------------- extensions/libct_proto_udp.c | 50 +++++++++++++++++++++++++++------- 3 files changed, 118 insertions(+), 40 deletions(-) (limited to 'extensions') diff --git a/extensions/libct_proto_icmp.c b/extensions/libct_proto_icmp.c index 765ced4..09fd8da 100644 --- a/extensions/libct_proto_icmp.c +++ b/extensions/libct_proto_icmp.c @@ -24,6 +24,33 @@ static struct option opts[] = { {0, 0, 0, 0} }; +#define ICMP_NUMBER_OF_OPT 4 + +static const char *icmp_optflags[ICMP_NUMBER_OF_OPT] = { +"icmp-type", "icmp-code", "icmp-id" +}; + +static char icmp_commands_v_options[NUMBER_OF_CMD][ICMP_NUMBER_OF_OPT] = +/* Well, it's better than "Re: Maradona vs Pele" */ +{ + /* 1 2 3 */ +/*CT_LIST*/ {2,2,2}, +/*CT_CREATE*/ {1,1,2}, +/*CT_UPDATE*/ {1,1,2}, +/*CT_DELETE*/ {1,1,2}, +/*CT_GET*/ {1,1,2}, +/*CT_FLUSH*/ {0,0,0}, +/*CT_EVENT*/ {2,2,2}, +/*CT_VERSION*/ {0,0,0}, +/*CT_HELP*/ {0,0,0}, +/*EXP_LIST*/ {0,0,0}, +/*EXP_CREATE*/ {0,0,0}, +/*EXP_DELETE*/ {0,0,0}, +/*EXP_GET*/ {0,0,0}, +/*EXP_FLUSH*/ {0,0,0}, +/*EXP_EVENT*/ {0,0,0}, +}; + static void help() { fprintf(stdout, " --icmp-type\t\t\ticmp type\n"); @@ -31,7 +58,7 @@ static void help() fprintf(stdout, " --icmp-id\t\t\ticmp id\n"); } -static int parse(char c, char *argv[], +static int parse(char c, struct nf_conntrack *ct, struct nf_conntrack *exptuple, struct nf_conntrack *mask, @@ -69,16 +96,14 @@ static int parse(char c, char *argv[], return 1; } -static int final_check(unsigned int flags, - unsigned int command, - struct nf_conntrack *ct) +static void final_check(unsigned int flags, + unsigned int cmd, + struct nf_conntrack *ct) { - if (!(flags & ICMP_TYPE)) - return 0; - else if (!(flags & ICMP_CODE)) - return 0; - - return 1; + generic_opt_check(flags, + ICMP_NUMBER_OF_OPT, + icmp_commands_v_options[cmd], + icmp_optflags); } static struct ctproto_handler icmp = { diff --git a/extensions/libct_proto_tcp.c b/extensions/libct_proto_tcp.c index 5a40cef..1f630b3 100644 --- a/extensions/libct_proto_tcp.c +++ b/extensions/libct_proto_tcp.c @@ -32,6 +32,34 @@ static struct option opts[] = { {0, 0, 0, 0} }; +#define TCP_NUMBER_OF_OPT 10 + +static const char *tcp_optflags[TCP_NUMBER_OF_OPT] = { +"sport", "dport", "reply-port-src", "reply-port-dst", "mask-port-src", +"mask-port-dst", "state", "tuple-port-src", "tuple-port-dst" +}; + +static char tcp_commands_v_options[NUMBER_OF_CMD][TCP_NUMBER_OF_OPT] = +/* Well, it's better than "Re: Sevilla vs Betis" */ +{ + /* 1 2 3 4 5 6 7 8 9 */ +/*CT_LIST*/ {2,2,2,2,0,0,2,0,0}, +/*CT_CREATE*/ {1,1,1,1,0,0,1,0,0}, +/*CT_UPDATE*/ {1,1,1,1,0,0,2,0,0}, +/*CT_DELETE*/ {1,1,1,1,0,0,0,0,0}, +/*CT_GET*/ {1,1,1,1,0,0,2,0,0}, +/*CT_FLUSH*/ {0,0,0,0,0,0,0,0,0}, +/*CT_EVENT*/ {2,2,2,2,0,0,2,0,0}, +/*CT_VERSION*/ {0,0,0,0,0,0,0,0,0}, +/*CT_HELP*/ {0,0,0,0,0,0,0,0,0}, +/*EXP_LIST*/ {0,0,0,0,0,0,0,0,0}, +/*EXP_CREATE*/ {1,1,1,1,1,1,0,1,1}, +/*EXP_DELETE*/ {1,1,1,1,0,0,0,0,0}, +/*EXP_GET*/ {1,1,1,1,0,0,0,0,0}, +/*EXP_FLUSH*/ {0,0,0,0,0,0,0,0,0}, +/*EXP_EVENT*/ {0,0,0,0,0,0,0,0,0}, +}; + static const char *states[] = { "NONE", "SYN_SENT", @@ -58,7 +86,7 @@ static void help() fprintf(stdout, " --state\t\t\tTCP state, fe. ESTABLISHED\n"); } -static int parse_options(char c, char *argv[], +static int parse_options(char c, struct nf_conntrack *ct, struct nf_conntrack *exptuple, struct nf_conntrack *mask, @@ -139,10 +167,9 @@ static int parse_options(char c, char *argv[], break; } } - if (i == 10) { - printf("doh?\n"); - return 0; - } + if (i == 10) + exit_error(PARAMETER_PROBLEM, + "Unknown TCP state %s\n", optarg); *flags |= TCP_STATE; break; case '8': @@ -169,12 +196,10 @@ static int parse_options(char c, char *argv[], return 1; } -static int final_check(unsigned int flags, - unsigned int command, - struct nf_conntrack *ct) +static void final_check(unsigned int flags, + unsigned int cmd, + struct nf_conntrack *ct) { - int ret = 0; - if ((flags & (TCP_ORIG_SPORT|TCP_ORIG_DPORT)) && !(flags & (TCP_REPL_SPORT|TCP_REPL_DPORT))) { nfct_set_attr_u16(ct, @@ -183,7 +208,8 @@ static int final_check(unsigned int flags, nfct_set_attr_u16(ct, ATTR_REPL_PORT_DST, nfct_get_attr_u16(ct, ATTR_ORIG_PORT_SRC)); - ret = 1; + flags |= TCP_REPL_SPORT; + flags |= TCP_REPL_DPORT; } else if (!(flags & (TCP_ORIG_SPORT|TCP_ORIG_DPORT)) && (flags & (TCP_REPL_SPORT|TCP_REPL_DPORT))) { nfct_set_attr_u16(ct, @@ -192,17 +218,14 @@ static int final_check(unsigned int flags, nfct_set_attr_u16(ct, ATTR_ORIG_PORT_DST, nfct_get_attr_u16(ct, ATTR_REPL_PORT_SRC)); - ret = 1; + flags |= TCP_ORIG_SPORT; + flags |= TCP_ORIG_DPORT; } - if ((flags & (TCP_ORIG_SPORT|TCP_ORIG_DPORT)) - && ((flags & (TCP_REPL_SPORT|TCP_REPL_DPORT)))) - ret = 1; - - /* --state is missing and we are trying to create a conntrack */ - if (ret && (command & CT_CREATE) && (!(flags & TCP_STATE))) - ret = 0; - return ret; + generic_opt_check(flags, + TCP_NUMBER_OF_OPT, + tcp_commands_v_options[cmd], + tcp_optflags); } static struct ctproto_handler tcp = { diff --git a/extensions/libct_proto_udp.c b/extensions/libct_proto_udp.c index cb131d6..2216b71 100644 --- a/extensions/libct_proto_udp.c +++ b/extensions/libct_proto_udp.c @@ -31,6 +31,13 @@ static struct option opts[] = { {0, 0, 0, 0} }; +#define UDP_NUMBER_OF_OPT 9 + +static const char *udp_optflags[UDP_NUMBER_OF_OPT] = { +"sport", "dport", "reply-port-src", "reply-port-dst", "mask-port-src", +"mask-port-dst", "tuple-port-src", "tuple-port-dst" +}; + static void help() { fprintf(stdout, " --orig-port-src\t\toriginal source port\n"); @@ -43,7 +50,28 @@ static void help() fprintf(stdout, " --tuple-port-src\t\texpectation tuple dst port\n"); } -static int parse_options(char c, char *argv[], +static char udp_commands_v_options[NUMBER_OF_CMD][UDP_NUMBER_OF_OPT] = +/* Well, it's better than "Re: Galeano vs Vargas Llosa" */ +{ + /* 1 2 3 4 5 6 7 8 */ +/*CT_LIST*/ {2,2,2,2,0,0,0,0}, +/*CT_CREATE*/ {1,1,1,1,0,0,0,0}, +/*CT_UPDATE*/ {1,1,1,1,0,0,0,0}, +/*CT_DELETE*/ {1,1,1,1,0,0,0,0}, +/*CT_GET*/ {1,1,1,1,0,0,0,0}, +/*CT_FLUSH*/ {0,0,0,0,0,0,0,0}, +/*CT_EVENT*/ {2,2,2,2,0,0,0,0}, +/*CT_VERSION*/ {0,0,0,0,0,0,0,0}, +/*CT_HELP*/ {0,0,0,0,0,0,0,0}, +/*EXP_LIST*/ {0,0,0,0,0,0,0,0}, +/*EXP_CREATE*/ {1,1,1,1,1,1,1,1}, +/*EXP_DELETE*/ {1,1,1,1,0,0,0,0}, +/*EXP_GET*/ {1,1,1,1,0,0,0,0}, +/*EXP_FLUSH*/ {0,0,0,0,0,0,0,0}, +/*EXP_EVENT*/ {0,0,0,0,0,0,0,0}, +}; + +static int parse_options(char c, struct nf_conntrack *ct, struct nf_conntrack *exptuple, struct nf_conntrack *mask, @@ -134,9 +162,9 @@ static int parse_options(char c, char *argv[], return 1; } -static int final_check(unsigned int flags, - unsigned int command, - struct nf_conntrack *ct) +static void final_check(unsigned int flags, + unsigned int cmd, + struct nf_conntrack *ct) { int ret = 0; @@ -148,7 +176,8 @@ static int final_check(unsigned int flags, nfct_set_attr_u16(ct, ATTR_REPL_PORT_DST, nfct_get_attr_u16(ct, ATTR_ORIG_PORT_SRC)); - ret = 1; + flags |= UDP_REPL_SPORT; + flags |= UDP_REPL_DPORT; } else if (!(flags & (UDP_ORIG_SPORT|UDP_ORIG_DPORT)) && (flags & (UDP_REPL_SPORT|UDP_REPL_DPORT))) { nfct_set_attr_u16(ct, @@ -157,13 +186,14 @@ static int final_check(unsigned int flags, nfct_set_attr_u16(ct, ATTR_ORIG_PORT_DST, nfct_get_attr_u16(ct, ATTR_REPL_PORT_SRC)); - ret = 1; + flags |= UDP_ORIG_SPORT; + flags |= UDP_ORIG_DPORT; } - if ((flags & (UDP_ORIG_SPORT|UDP_ORIG_DPORT)) - && ((flags & (UDP_REPL_SPORT|UDP_REPL_DPORT)))) - ret = 1; - return ret; + generic_opt_check(flags, + UDP_NUMBER_OF_OPT, + udp_commands_v_options[cmd], + udp_optflags); } static struct ctproto_handler udp = { -- cgit v1.2.3