From ac70a5bea1b3b8068eb515dfd13368549959c66e Mon Sep 17 00:00:00 2001 From: laforge Date: Mon, 25 Mar 2002 08:38:26 +0000 Subject: Add AH/ESP match for ipv6 --- extensions/.ah-test6 | 2 + extensions/.esp-test6 | 2 + extensions/libip6t_ah.c | 238 +++++++++++++++++++++++++++++++++++++++++++++++ extensions/libip6t_esp.c | 190 +++++++++++++++++++++++++++++++++++++ 4 files changed, 432 insertions(+) create mode 100755 extensions/.ah-test6 create mode 100755 extensions/.esp-test6 create mode 100644 extensions/libip6t_ah.c create mode 100644 extensions/libip6t_esp.c (limited to 'extensions') diff --git a/extensions/.ah-test6 b/extensions/.ah-test6 new file mode 100755 index 0000000..1812c56 --- /dev/null +++ b/extensions/.ah-test6 @@ -0,0 +1,2 @@ +#!/bin/sh +[ -f $KERNEL_DIR/net/ipv6/netfilter/ip6t_ah.c -a -f $KERNEL_DIR/include/linux/netfilter_ipv6/ip6t_ah.h ] && echo ah diff --git a/extensions/.esp-test6 b/extensions/.esp-test6 new file mode 100755 index 0000000..ff63ca4 --- /dev/null +++ b/extensions/.esp-test6 @@ -0,0 +1,2 @@ +#!/bin/sh +[ -f $KERNEL_DIR/net/ipv6/netfilter/ip6t_esp.c -a -f $KERNEL_DIR/include/linux/netfilter_ipv6/ip6t_esp.h ] && echo esp diff --git a/extensions/libip6t_ah.c b/extensions/libip6t_ah.c new file mode 100644 index 0000000..f169659 --- /dev/null +++ b/extensions/libip6t_ah.c @@ -0,0 +1,238 @@ +/* Shared library add-on to ip6tables to add AH support. */ +#include +#include +#include +#include +#include +#include +#include +#include + +/* Function which prints out usage message. */ +static void +help(void) +{ + printf( +"AH v%s options:\n" +" --ahspi [!] spi[:spi] match spi (range)\n" +" --ahlen [!] length total length of this header\n" +" --ahres check the reserved filed, too\n", +NETFILTER_VERSION); +} + +static struct option opts[] = { + { "ahspi", 1, 0, '1' }, + { "ahlen", 1, 0, '2' }, + { "ahres", 0, 0, '3' }, + {0} +}; + +static u_int32_t +parse_ah_spi(const char *spistr, const char *typestr) +{ + unsigned long int spi; + char* ep; + + spi = strtoul(spistr,&ep,0) ; + + if ( spistr == ep ) { + exit_error(PARAMETER_PROBLEM, + "AH no valid digits in %s `%s'", typestr, spistr); + } + if ( spi == ULONG_MAX && errno == ERANGE ) { + exit_error(PARAMETER_PROBLEM, + "%s `%s' specified too big: would overflow", + typestr, spistr); + } + if ( *spistr != '\0' && *ep != '\0' ) { + exit_error(PARAMETER_PROBLEM, + "AH error parsing %s `%s'", typestr, spistr); + } + return (u_int32_t) spi; +} + +static void +parse_ah_spis(const char *spistring, u_int32_t *spis) +{ + char *buffer; + char *cp; + + buffer = strdup(spistring); + if ((cp = strchr(buffer, ':')) == NULL) + spis[0] = spis[1] = parse_ah_spi(buffer,"spi"); + else { + *cp = '\0'; + cp++; + + spis[0] = buffer[0] ? parse_ah_spi(buffer,"spi") : 0; + spis[1] = cp[0] ? parse_ah_spi(cp,"spi") : 0xFFFFFFFF; + } + free(buffer); +} + +/* Initialize the match. */ +static void +init(struct ip6t_entry_match *m, unsigned int *nfcache) +{ + struct ip6t_ah *ahinfo = (struct ip6t_ah *)m->data; + + ahinfo->spis[1] = 0xFFFFFFFF; + ahinfo->hdrlen = 0; + ahinfo->hdrres = 0; +} + +/* Function which parses command options; returns true if it + ate an option */ +static int +parse(int c, char **argv, int invert, unsigned int *flags, + const struct ip6t_entry *entry, + unsigned int *nfcache, + struct ip6t_entry_match **match) +{ + struct ip6t_ah *ahinfo = (struct ip6t_ah *)(*match)->data; + + switch (c) { + case '1': + if (*flags & IP6T_AH_SPI) + exit_error(PARAMETER_PROBLEM, + "Only one `--ahspi' allowed"); + check_inverse(optarg, &invert, &optind, 0); + parse_ah_spis(argv[optind-1], ahinfo->spis); + if (invert) + ahinfo->invflags |= IP6T_AH_INV_SPI; + *flags |= IP6T_AH_SPI; + break; + case '2': + if (*flags & IP6T_AH_LEN) + exit_error(PARAMETER_PROBLEM, + "Only one `--ahlen' allowed"); + check_inverse(optarg, &invert, &optind, 0); + ahinfo->hdrlen = parse_ah_spi(argv[optind-1], "length"); + if (invert) + ahinfo->invflags |= IP6T_AH_INV_LEN; + *flags |= IP6T_AH_LEN; + break; + case '3': + if (*flags & IP6T_AH_RES) + exit_error(PARAMETER_PROBLEM, + "Only one `--ahres' allowed"); + ahinfo->hdrres = 1; + *flags |= IP6T_AH_RES; + break; + default: + return 0; + } + + return 1; +} + +/* Final check; we don't care. */ +static void +final_check(unsigned int flags) +{ +} + +static void +print_spis(const char *name, u_int32_t min, u_int32_t max, + int invert) +{ + const char *inv = invert ? "!" : ""; + + if (min != 0 || max != 0xFFFFFFFF || invert) { + printf("%s", name); + if (min == max) { + printf(":%s", inv); + printf("%u", min); + } else { + printf("s:%s", inv); + printf("%u",min); + printf(":"); + printf("%u",max); + } + printf(" "); + } +} + +static void +print_len(const char *name, u_int32_t len, int invert) +{ + const char *inv = invert ? "!" : ""; + + if (len != 0 || invert) { + printf("%s", name); + printf(":%s", inv); + printf("%u", len); + printf(" "); + } +} + +/* Prints out the union ip6t_matchinfo. */ +static void +print(const struct ip6t_ip6 *ip, + const struct ip6t_entry_match *match, int numeric) +{ + const struct ip6t_ah *ah = (struct ip6t_ah *)match->data; + + printf("ah "); + print_spis("spi", ah->spis[0], ah->spis[1], + ah->invflags & IP6T_AH_INV_SPI); + print_len("length", ah->hdrlen, + ah->invflags & IP6T_AH_INV_LEN); + if (ah->hdrres) printf("reserved "); + if (ah->invflags & ~IP6T_AH_INV_MASK) + printf("Unknown invflags: 0x%X ", + ah->invflags & ~IP6T_AH_INV_MASK); +} + +/* Saves the union ip6t_matchinfo in parsable form to stdout. */ +static void save(const struct ip6t_ip6 *ip, const struct ip6t_entry_match *match) +{ + const struct ip6t_ah *ahinfo = (struct ip6t_ah *)match->data; + + if (!(ahinfo->spis[0] == 0 + && ahinfo->spis[1] == 0xFFFFFFFF)) { + printf("--ahspi %s", + (ahinfo->invflags & IP6T_AH_INV_SPI) ? "! " : ""); + if (ahinfo->spis[0] + != ahinfo->spis[1]) + printf("%u:%u ", + ahinfo->spis[0], + ahinfo->spis[1]); + else + printf("%u ", + ahinfo->spis[0]); + } + + if (ahinfo->hdrlen != 0 ) { + printf("--ahlen %s%u ", + (ahinfo->invflags & IP6T_AH_INV_LEN) ? "! " : "", + ahinfo->hdrlen); + } + + if (ahinfo->hdrres != 0 ) { + printf("--ahres "); + } + +} + +static +struct ip6tables_match ah += { NULL, + "ah", + NETFILTER_VERSION, + IP6T_ALIGN(sizeof(struct ip6t_ah)), + IP6T_ALIGN(sizeof(struct ip6t_ah)), + &help, + &init, + &parse, + &final_check, + &print, + &save, + opts +}; + +void +_init(void) +{ + register_match6(&ah); +} diff --git a/extensions/libip6t_esp.c b/extensions/libip6t_esp.c new file mode 100644 index 0000000..973338f --- /dev/null +++ b/extensions/libip6t_esp.c @@ -0,0 +1,190 @@ +/* Shared library add-on to ip6tables to add ESP support. */ +#include +#include +#include +#include +#include +#include +#include +#include + +/* Function which prints out usage message. */ +static void +help(void) +{ + printf( +"ESP v%s options:\n" +" --espspi [!] spi[:spi] match spi (range)\n", +NETFILTER_VERSION); +} + +static struct option opts[] = { + { "espspi", 1, 0, '1' }, + {0} +}; + +static u_int32_t +parse_esp_spi(const char *spistr) +{ + unsigned long int spi; + char* ep; + + spi = strtoul(spistr,&ep,0) ; + + if ( spistr == ep ) { + exit_error(PARAMETER_PROBLEM, + "ESP no valid digits in spi `%s'", spistr); + } + if ( spi == ULONG_MAX && errno == ERANGE ) { + exit_error(PARAMETER_PROBLEM, + "spi `%s' specified too big: would overflow", spistr); + } + if ( *spistr != '\0' && *ep != '\0' ) { + exit_error(PARAMETER_PROBLEM, + "ESP error parsing spi `%s'", spistr); + } + return (u_int32_t) spi; +} + +static void +parse_esp_spis(const char *spistring, u_int32_t *spis) +{ + char *buffer; + char *cp; + + buffer = strdup(spistring); + if ((cp = strchr(buffer, ':')) == NULL) + spis[0] = spis[1] = parse_esp_spi(buffer); + else { + *cp = '\0'; + cp++; + + spis[0] = buffer[0] ? parse_esp_spi(buffer) : 0; + spis[1] = cp[0] ? parse_esp_spi(cp) : 0xFFFFFFFF; + } + free(buffer); +} + +/* Initialize the match. */ +static void +init(struct ip6t_entry_match *m, unsigned int *nfcache) +{ + struct ip6t_esp *espinfo = (struct ip6t_esp *)m->data; + + espinfo->spis[1] = 0xFFFFFFFF; +} + +#define ESP_SPI 0x01 + +/* Function which parses command options; returns true if it + ate an option */ +static int +parse(int c, char **argv, int invert, unsigned int *flags, + const struct ip6t_entry *entry, + unsigned int *nfcache, + struct ip6t_entry_match **match) +{ + struct ip6t_esp *espinfo = (struct ip6t_esp *)(*match)->data; + + switch (c) { + case '1': + if (*flags & ESP_SPI) + exit_error(PARAMETER_PROBLEM, + "Only one `--espspi' allowed"); + check_inverse(optarg, &invert, &optind, 0); + parse_esp_spis(argv[optind-1], espinfo->spis); + if (invert) + espinfo->invflags |= IP6T_ESP_INV_SPI; + *flags |= ESP_SPI; + break; + default: + return 0; + } + + return 1; +} + +/* Final check; we don't care. */ +static void +final_check(unsigned int flags) +{ +} + +static void +print_spis(const char *name, u_int32_t min, u_int32_t max, + int invert) +{ + const char *inv = invert ? "!" : ""; + + if (min != 0 || max != 0xFFFFFFFF || invert) { + printf("%s", name); + if (min == max) { + printf(":%s", inv); + printf("%u", min); + } else { + printf("s:%s", inv); + printf("%u",min); + printf(":"); + printf("%u",max); + } + printf(" "); + } +} + +/* Prints out the union ip6t_matchinfo. */ +static void +print(const struct ip6t_ip6 *ip, + const struct ip6t_entry_match *match, int numeric) +{ + const struct ip6t_esp *esp = (struct ip6t_esp *)match->data; + + printf("esp "); + print_spis("spi", esp->spis[0], esp->spis[1], + esp->invflags & IP6T_ESP_INV_SPI); + if (esp->invflags & ~IP6T_ESP_INV_MASK) + printf("Unknown invflags: 0x%X ", + esp->invflags & ~IP6T_ESP_INV_MASK); +} + +/* Saves the union ip6t_matchinfo in parsable form to stdout. */ +static void save(const struct ip6t_ip6 *ip, const struct ip6t_entry_match *match) +{ + const struct ip6t_esp *espinfo = (struct ip6t_esp *)match->data; + + if (!(espinfo->spis[0] == 0 + && espinfo->spis[1] == 0xFFFFFFFF)) { + printf("--espspi %s", + (espinfo->invflags & IP6T_ESP_INV_SPI) ? "! " : ""); + if (espinfo->spis[0] + != espinfo->spis[1]) + printf("%u:%u ", + espinfo->spis[0], + espinfo->spis[1]); + else + printf("%u ", + espinfo->spis[0]); + } + +} + +static +struct ip6tables_match esp += { NULL, + "esp", + NETFILTER_VERSION, + IP6T_ALIGN(sizeof(struct ip6t_esp)), + IP6T_ALIGN(sizeof(struct ip6t_esp)), + &help, + &init, + &parse, + &final_check, + &print, + &save, + opts +}; + +void +_init(void) +{ + register_match6(&esp); +} -- cgit v1.2.3