anonfunc/xtables-addons
1
0
Fork 0
mirror of git://git.code.sf.net/p/xtables-addons/xtables-addons synced 2025-09-07 13:15:12 +02:00
Code Issues Releases Wiki Activity

ipaddr match (from "Writing your own Netfilter module" PDF)

Browse Source
This commit is contained in:
Jan Engelhardt
2009-03-25 21:53:11 +01:00
committed by Jan Engelhardt
parent 48ebf55444
commit 867a920fd7
7 changed files with 424 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
extensions/Kbuild
View File

@@ -34,5 +34,7 @@ obj-${build_pknock} += pknock/
obj-${build_psd} += xt_psd.o
obj-${build_quota2} += xt_quota2.o
obj-${build_ipaddr} += xt_ipaddr.o
-include ${M}/*.Kbuild
-include ${M}/Kbuild.*

1
extensions/Mbuild
View File

@@ -16,6 +16,7 @@ obj-${build_condition} += libxt_condition.so
obj-${build_fuzzy} += libxt_fuzzy.so
obj-${build_geoip} += libxt_geoip.so
obj-${build_iface} += libxt_iface.so
obj-${build_ipaddr} += libxt_ipaddr.so
obj-${build_ipp2p} += libxt_ipp2p.so
obj-${build_ipv4options} += libxt_ipv4options.so
obj-${build_length2} += libxt_length2.so

254
extensions/libxt_ipaddr.c Normal file
View File

@@ -0,0 +1,254 @@
/*
* "ipaddr" demo match extension for iptables
* written by Jan Engelhardt <jengelh [at] medozas de>, 2008 - 2009
* released in the Public Domain
*/
#include <arpa/inet.h>
#include <getopt.h>
#include <stdbool.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <xtables.h>
#include <linux/netfilter.h>
#include "xt_ipaddr.h"
static const struct option ipaddr_mt_opts[] = {
{.name = "ipsrc", .has_arg = true, .val = '1'},
{.name = "ipdst", .has_arg = true, .val = '2'},
{NULL},
};
static void ipaddr_mt_help(void)
{
printf(
"ipaddr match options:\n"
"[!] --ipsrc addr Match source address of packet\n"
"[!] --ipdst addr Match destination address of packet\n"
);
}
static void ipaddr_mt_init(struct xt_entry_match *match)
{
struct xt_ipaddr_mtinfo *info = (void *)match->data;
inet_pton(PF_INET, "192.0.2.137", &info->dst.in);
}
static int ipaddr_mt4_parse(int c, char **argv, int invert,
unsigned int *flags, const void *entry, struct xt_entry_match **match)
{
struct xt_ipaddr_mtinfo *info = (void *)(*match)->data;
struct in_addr *addrs, mask;
unsigned int naddrs;
switch (c) {
case '1': /* --ipsrc */
if (*flags & XT_IPADDR_SRC)
xtables_error(PARAMETER_PROBLEM, "xt_ipaddr: "
"Only use \"--ipsrc\" once!");
*flags |= XT_IPADDR_SRC;
info->flags |= XT_IPADDR_SRC;
if (invert)
info->flags |= XT_IPADDR_SRC_INV;
xtables_ipparse_any(optarg, &addrs, &mask, &naddrs);
if (naddrs != 1)
xtables_error(PARAMETER_PROBLEM,
"%s does not resolve to exactly "
"one address", optarg);
memcpy(&info->src.in, addrs, sizeof(*addrs));
return true;
case '2': /* --ipdst */
if (*flags & XT_IPADDR_DST)
xtables_error(PARAMETER_PROBLEM, "xt_ipaddr: "
"Only use \"--ipdst\" once!");
*flags |= XT_IPADDR_DST;
info->flags |= XT_IPADDR_DST;
if (invert)
info->flags |= XT_IPADDR_DST_INV;
addrs = xtables_numeric_to_ipaddr(optarg);
if (addrs == NULL)
xtables_error(PARAMETER_PROBLEM, "xt_ipaddr: "
"Parse error at %s\n", optarg);
memcpy(&info->dst.in, addrs, sizeof(*addrs));
return true;
}
return false;
}
static int ipaddr_mt6_parse(int c, char **argv, int invert,
unsigned int *flags, const void *entry, struct xt_entry_match **match)
{
struct xt_ipaddr_mtinfo *info = (void *)(*match)->data;
struct in6_addr *addrs;
switch (c) {
case '1': /* --ipsrc */
if (*flags & XT_IPADDR_SRC)
xtables_error(PARAMETER_PROBLEM, "xt_ipaddr: "
"Only use \"--ipsrc\" once!");
*flags |= XT_IPADDR_SRC;
info->flags |= XT_IPADDR_SRC;
if (invert)
info->flags |= XT_IPADDR_SRC_INV;
addrs = xtables_numeric_to_ip6addr(optarg);
if (addrs == NULL)
xtables_error(PARAMETER_PROBLEM, "xt_ipaddr: "
"Parse error at %s", optarg);
memcpy(&info->src.in6, addrs, sizeof(*addrs));
return true;
case '2': /* --ipdst */
if (*flags & XT_IPADDR_DST)
xtables_error(PARAMETER_PROBLEM, "xt_ipaddr: "
"Only use \"--ipdst\" once!");
*flags |= XT_IPADDR_DST;
info->flags |= XT_IPADDR_DST;
if (invert)
info->flags |= XT_IPADDR_DST_INV;
addrs = xtables_numeric_to_ip6addr(optarg);
if (addrs == NULL)
xtables_error(PARAMETER_PROBLEM, "xt_ipaddr: "
"Parse error at %s", optarg);
memcpy(&info->dst.in6, addrs, sizeof(*addrs));
return true;
}
return false;
}
static void ipaddr_mt_check(unsigned int flags)
{
if (flags == 0)
xtables_error(PARAMETER_PROBLEM, "xt_ipaddr: You need to "
"specify at least \"--ipsrc\" or \"--ipdst\".");
}
static void ipaddr_mt4_print(const void *entry,
const struct xt_entry_match *match, int numeric)
{
const struct xt_ipaddr_mtinfo *info = (const void *)match->data;
if (info->flags & XT_IPADDR_SRC) {
printf("src IP ");
if (info->flags & XT_IPADDR_SRC_INV)
printf("! ");
printf("%s ", numeric ?
xtables_ipaddr_to_numeric(&info->src.in) :
xtables_ipaddr_to_anyname(&info->src.in));
}
if (info->flags & XT_IPADDR_DST) {
printf("dst IP ");
if (info->flags & XT_IPADDR_DST_INV)
printf("! ");
printf("%s ", numeric ?
xtables_ipaddr_to_numeric(&info->dst.in) :
xtables_ipaddr_to_anyname(&info->dst.in));
}
}
static void ipaddr_mt6_print(const void *entry,
const struct xt_entry_match *match, int numeric)
{
const struct xt_ipaddr_mtinfo *info = (const void *)match->data;
if (info->flags & XT_IPADDR_SRC) {
printf("src IP ");
if (info->flags & XT_IPADDR_SRC_INV)
printf("! ");
printf("%s ", numeric ?
xtables_ip6addr_to_numeric(&info->src.in6) :
xtables_ip6addr_to_anyname(&info->src.in6));
}
if (info->flags & XT_IPADDR_DST) {
printf("dst IP ");
if (info->flags & XT_IPADDR_DST_INV)
printf("! ");
printf("%s ", numeric ?
xtables_ip6addr_to_numeric(&info->dst.in6) :
xtables_ip6addr_to_anyname(&info->dst.in6));
}
}
static void ipaddr_mt4_save(const void *entry,
const struct xt_entry_match *match)
{
const struct xt_ipaddr_mtinfo *info = (const void *)match->data;
if (info->flags & XT_IPADDR_SRC) {
if (info->flags & XT_IPADDR_SRC_INV)
printf("! ");
printf("--ipsrc %s ",
xtables_ipaddr_to_numeric(&info->src.in));
}
if (info->flags & XT_IPADDR_DST) {
if (info->flags & XT_IPADDR_DST_INV)
printf("! ");
printf("--ipdst %s ",
xtables_ipaddr_to_numeric(&info->dst.in));
}
}
static void ipaddr_mt6_save(const void *entry,
const struct xt_entry_match *match)
{
const struct xt_ipaddr_mtinfo *info = (const void *)match->data;
if (info->flags & XT_IPADDR_SRC) {
if (info->flags & XT_IPADDR_SRC_INV)
printf("! ");
printf("--ipsrc %s ",
xtables_ip6addr_to_numeric(&info->src.in6));
}
if (info->flags & XT_IPADDR_DST) {
if (info->flags & XT_IPADDR_DST_INV)
printf("! ");
printf("--ipdst %s ",
xtables_ip6addr_to_numeric(&info->dst.in6));
}
}
static struct xtables_match ipaddr_mt_reg = {
.version = XTABLES_VERSION,
.name = "ipaddr",
.revision = 0,
.family = PF_INET,
.size = XT_ALIGN(sizeof(struct xt_ipaddr_mtinfo)),
.userspacesize = XT_ALIGN(sizeof(struct xt_ipaddr_mtinfo)),
.help = ipaddr_mt_help,
.init = ipaddr_mt_init,
.parse = ipaddr_mt4_parse,
.final_check = ipaddr_mt_check,
.print = ipaddr_mt4_print,
.save = ipaddr_mt4_save,
.extra_opts = ipaddr_mt_opts,
};
static struct xtables_match ipaddr_mt6_reg = {
.version = XTABLES_VERSION,
.name = "ipaddr",
.revision = 0,
.family = PF_INET6,
.size = XT_ALIGN(sizeof(struct xt_ipaddr_mtinfo)),
.userspacesize = XT_ALIGN(sizeof(struct xt_ipaddr_mtinfo)),
.help = ipaddr_mt_help,
.init = ipaddr_mt_init,
.parse = ipaddr_mt6_parse,
.final_check = ipaddr_mt_check,
.print = ipaddr_mt6_print,
.save = ipaddr_mt6_save,
.extra_opts = ipaddr_mt_opts,
};
static void _init(void)
{
xtables_register_match(&ipaddr_mt_reg);
xtables_register_match(&ipaddr_mt6_reg);
}

9
extensions/libxt_ipaddr.man Normal file
View File

@@ -0,0 +1,9 @@
.TP
[\fB!\fP] \fB--ipsrc\fP \fIaddr\fP
Match packets that have \fIaddr\fP as source address.
.TP
[\fB!\fP] \fB--ipdst\fP \fIaddr\fP
Match packets that have \fIaddr\fP as destination address.
.PP
The ipaddr module serves only as a demonstration. It is equivalent to the
iptables \fB-s\fP and \fB-d\fP options, but ipaddr does not support masks.

141
extensions/xt_ipaddr.c Normal file
View File

@@ -0,0 +1,141 @@
/*
* "ipaddr" demo match for Xtables
* Copyright © Jan Engelhardt, 2008-2009
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the WTF Public License version 2 or
* (at your option) any later version.
*/
#include <linux/ip.h>
#include <linux/ipv6.h>
#include <linux/module.h>
#include <linux/netfilter.h>
#include <linux/netfilter/x_tables.h>
#include <net/ipv6.h>
#include "compat_xtables.h"
#include "xt_ipaddr.h"
static bool ipaddr_mt4(const struct sk_buff *skb, struct xt_action_param *par)
{
const struct xt_ipaddr_mtinfo *info = par->matchinfo;
const struct iphdr *iph = ip_hdr(skb);
printk(KERN_INFO
"xt_ipaddr: IN=%s OUT=%s "
"SRC=" NIPQUAD_FMT " DST=" NIPQUAD_FMT " "
"IPSRC=" NIPQUAD_FMT " IPDST=" NIPQUAD_FMT "\n",
(par->in != NULL) ? par->in->name : "",
(par->out != NULL) ? par->out->name : "",
NIPQUAD(iph->saddr), NIPQUAD(iph->daddr),
NIPQUAD(info->src), NIPQUAD(info->dst));
if (info->flags & XT_IPADDR_SRC)
if ((iph->saddr != info->src.ip) ^
!!(info->flags & XT_IPADDR_SRC_INV)) {
printk(KERN_NOTICE "src IP - no match\n");
return false;
}
if (info->flags & XT_IPADDR_DST)
if ((iph->daddr != info->dst.ip) ^
!!(info->flags & XT_IPADDR_DST_INV)) {
printk(KERN_NOTICE "dst IP - no match\n");
return false;
}
return true;
}
static bool ipaddr_mt6(const struct sk_buff *skb, struct xt_action_param *par)
{
const struct xt_ipaddr_mtinfo *info = par->matchinfo;
const struct ipv6hdr *iph = ipv6_hdr(skb);
printk(KERN_INFO
"xt_ipaddr: IN=%s OUT=%s "
"SRC=" NIP6_FMT " DST=" NIP6_FMT " "
"IPSRC=" NIP6_FMT " IPDST=" NIP6_FMT "\n",
(par->in != NULL) ? par->in->name : "",
(par->out != NULL) ? par->out->name : "",
NIP6(iph->saddr), NIP6(iph->daddr),
NIP6(info->src.in6), NIP6(info->dst.in6));
if (info->flags & XT_IPADDR_SRC)
if ((ipv6_addr_cmp(&iph->saddr, &info->src.in6) != 0) ^
!!(info->flags & XT_IPADDR_SRC_INV)) {
printk(KERN_NOTICE "src IP - no match\n");
return false;
}
if (info->flags & XT_IPADDR_DST)
if ((ipv6_addr_cmp(&iph->daddr, &info->dst.in6) != 0) ^
!!(info->flags & XT_IPADDR_DST_INV)) {
printk(KERN_NOTICE "dst IP - no match\n");
return false;
}
return true;
}
static int ipaddr_mt_check(const struct xt_mtchk_param *par)
{
const struct xt_ipaddr_mtinfo *info = par->matchinfo;
printk(KERN_INFO "xt_ipaddr: Added a rule with -m ipaddr in "
"the %s table; this rule is reachable through hooks 0x%x\n",
par->table, par->hook_mask);
if (par->match->family == NFPROTO_IPV4 &&
ntohl(info->src.ip) == 0xDEADBEEF) {
printk(KERN_INFO "xt_ipaddr: I just thought I do not want "
"to let you match on 222.173.190.239\n");
return -EPERM;
}
return 0;
}
static void ipaddr_mt_destroy(const struct xt_mtdtor_param *par)
{
printk(KERN_INFO "One rule with ipaddr match got deleted\n");
}
static struct xt_match ipaddr_mt_reg[] __read_mostly = {
{
.name = "ipaddr",
.revision = 0,
.family = NFPROTO_IPV4,
.match = ipaddr_mt4,
.checkentry = ipaddr_mt_check,
.destroy = ipaddr_mt_destroy,
.matchsize = XT_ALIGN(sizeof(struct xt_ipaddr_mtinfo)),
.me = THIS_MODULE,
},
{
.name = "ipaddr",
.revision = 0,
.family = NFPROTO_IPV6,
.match = ipaddr_mt6,
.checkentry = ipaddr_mt_check,
.destroy = ipaddr_mt_destroy,
.matchsize = XT_ALIGN(sizeof(struct xt_ipaddr_mtinfo)),
.me = THIS_MODULE,
},
};
static int __init ipaddr_mt_init(void)
{
return xt_register_matches(ipaddr_mt_reg, ARRAY_SIZE(ipaddr_mt_reg));
}
static void __exit ipaddr_mt_exit(void)
{
xt_unregister_matches(ipaddr_mt_reg, ARRAY_SIZE(ipaddr_mt_reg));
}
module_init(ipaddr_mt_init);
module_exit(ipaddr_mt_exit);
MODULE_DESCRIPTION("Xtables: Match source/destination address");
MODULE_LICENSE("GPL");
MODULE_ALIAS("ipt_ipaddr");
MODULE_ALIAS("ip6t_ipaddr");

16
extensions/xt_ipaddr.h Normal file
View File

@@ -0,0 +1,16 @@
#ifndef _LINUX_NETFILTER_XT_IPADDR_H
#define _LINUX_NETFILTER_XT_IPADDR_H 1
enum {
XT_IPADDR_SRC = 1 << 0,
XT_IPADDR_DST = 1 << 1,
XT_IPADDR_SRC_INV = 1 << 2,
XT_IPADDR_DST_INV = 1 << 3,
};
struct xt_ipaddr_mtinfo {
union nf_inet_addr src, dst;
__u8 flags;
};
#endif /* _LINUX_NETFILTER_XT_IPADDR_H */

1
mconfig
View File

@@ -17,6 +17,7 @@ build_fuzzy=m
build_geoip=m
build_gradm=m
build_iface=m
build_ipaddr=m
build_ipp2p=m
build_ipv4options=m
build_length2=m