1/* Shared library add-on to iptables to add UDP support. */ 2#include <stdio.h> 3#include <netdb.h> 4#include <string.h> 5#include <stdlib.h> 6#include <getopt.h> 7#include <iptables.h> 8#include <linux/netfilter_ipv4/ip_tables.h> 9 10/* Function which prints out usage message. */ 11static void 12help(void) 13{ 14 printf( 15"UDP v%s options:\n" 16" --source-port [!] port[:port]\n" 17" --sport ...\n" 18" match source port(s)\n" 19" --destination-port [!] port[:port]\n" 20" --dport ...\n" 21" match destination port(s)\n", 22IPTABLES_VERSION); 23} 24 25static struct option opts[] = { 26 { "source-port", 1, 0, '1' }, 27 { "sport", 1, 0, '1' }, /* synonym */ 28 { "destination-port", 1, 0, '2' }, 29 { "dport", 1, 0, '2' }, /* synonym */ 30 {0} 31}; 32 33static void 34parse_udp_ports(const char *portstring, u_int16_t *ports) 35{ 36 char *buffer; 37 char *cp; 38 39 buffer = strdup(portstring); 40 if ((cp = strchr(buffer, ':')) == NULL) 41 ports[0] = ports[1] = parse_port(buffer, "udp"); 42 else { 43 *cp = '\0'; 44 cp++; 45 46 ports[0] = buffer[0] ? parse_port(buffer, "udp") : 0; 47 ports[1] = cp[0] ? parse_port(cp, "udp") : 0xFFFF; 48 49 if (ports[0] > ports[1]) 50 exit_error(PARAMETER_PROBLEM, 51 "invalid portrange (min > max)"); 52 } 53 free(buffer); 54} 55 56/* Initialize the match. */ 57static void 58init(struct ipt_entry_match *m, unsigned int *nfcache) 59{ 60 struct ipt_udp *udpinfo = (struct ipt_udp *)m->data; 61 62 udpinfo->spts[1] = udpinfo->dpts[1] = 0xFFFF; 63} 64 65#define UDP_SRC_PORTS 0x01 66#define UDP_DST_PORTS 0x02 67 68/* Function which parses command options; returns true if it 69 ate an option */ 70static int 71parse(int c, char **argv, int invert, unsigned int *flags, 72 const struct ipt_entry *entry, 73 unsigned int *nfcache, 74 struct ipt_entry_match **match) 75{ 76 struct ipt_udp *udpinfo = (struct ipt_udp *)(*match)->data; 77 78 switch (c) { 79 case '1': 80 if (*flags & UDP_SRC_PORTS) 81 exit_error(PARAMETER_PROBLEM, 82 "Only one `--source-port' allowed"); 83 check_inverse(optarg, &invert, &optind, 0); 84 parse_udp_ports(argv[optind-1], udpinfo->spts); 85 if (invert) 86 udpinfo->invflags |= IPT_UDP_INV_SRCPT; 87 *flags |= UDP_SRC_PORTS; 88 break; 89 90 case '2': 91 if (*flags & UDP_DST_PORTS) 92 exit_error(PARAMETER_PROBLEM, 93 "Only one `--destination-port' allowed"); 94 check_inverse(optarg, &invert, &optind, 0); 95 parse_udp_ports(argv[optind-1], udpinfo->dpts); 96 if (invert) 97 udpinfo->invflags |= IPT_UDP_INV_DSTPT; 98 *flags |= UDP_DST_PORTS; 99 break; 100 101 default: 102 return 0; 103 } 104 105 return 1; 106} 107 108/* Final check; we don't care. */ 109static void 110final_check(unsigned int flags) 111{ 112} 113 114static char * 115port_to_service(int port) 116{ 117 struct servent *service; 118 119 if ((service = getservbyport(htons(port), "udp"))) 120 return service->s_name; 121 122 return NULL; 123} 124 125static void 126print_port(u_int16_t port, int numeric) 127{ 128 char *service; 129 130 if (numeric || (service = port_to_service(port)) == NULL) 131 printf("%u", port); 132 else 133 printf("%s", service); 134} 135 136static void 137print_ports(const char *name, u_int16_t min, u_int16_t max, 138 int invert, int numeric) 139{ 140 const char *inv = invert ? "!" : ""; 141 142 if (min != 0 || max != 0xFFFF || invert) { 143 printf("%s", name); 144 if (min == max) { 145 printf(":%s", inv); 146 print_port(min, numeric); 147 } else { 148 printf("s:%s", inv); 149 print_port(min, numeric); 150 printf(":"); 151 print_port(max, numeric); 152 } 153 printf(" "); 154 } 155} 156 157/* Prints out the union ipt_matchinfo. */ 158static void 159print(const struct ipt_ip *ip, 160 const struct ipt_entry_match *match, int numeric) 161{ 162 const struct ipt_udp *udp = (struct ipt_udp *)match->data; 163 164 printf("udp "); 165 print_ports("spt", udp->spts[0], udp->spts[1], 166 udp->invflags & IPT_UDP_INV_SRCPT, 167 numeric); 168 print_ports("dpt", udp->dpts[0], udp->dpts[1], 169 udp->invflags & IPT_UDP_INV_DSTPT, 170 numeric); 171 if (udp->invflags & ~IPT_UDP_INV_MASK) 172 printf("Unknown invflags: 0x%X ", 173 udp->invflags & ~IPT_UDP_INV_MASK); 174} 175 176/* Saves the union ipt_matchinfo in parsable form to stdout. */ 177static void save(const struct ipt_ip *ip, const struct ipt_entry_match *match) 178{ 179 const struct ipt_udp *udpinfo = (struct ipt_udp *)match->data; 180 181 if (udpinfo->spts[0] != 0 182 || udpinfo->spts[1] != 0xFFFF) { 183 if (udpinfo->invflags & IPT_UDP_INV_SRCPT) 184 printf("! "); 185 if (udpinfo->spts[0] 186 != udpinfo->spts[1]) 187 printf("--sport %u:%u ", 188 udpinfo->spts[0], 189 udpinfo->spts[1]); 190 else 191 printf("--sport %u ", 192 udpinfo->spts[0]); 193 } 194 195 if (udpinfo->dpts[0] != 0 196 || udpinfo->dpts[1] != 0xFFFF) { 197 if (udpinfo->invflags & IPT_UDP_INV_DSTPT) 198 printf("! "); 199 if (udpinfo->dpts[0] 200 != udpinfo->dpts[1]) 201 printf("--dport %u:%u ", 202 udpinfo->dpts[0], 203 udpinfo->dpts[1]); 204 else 205 printf("--dport %u ", 206 udpinfo->dpts[0]); 207 } 208} 209 210static 211struct iptables_match udp = { 212 .next = NULL, 213 .name = "udp", 214 .version = IPTABLES_VERSION, 215 .size = IPT_ALIGN(sizeof(struct ipt_udp)), 216 .userspacesize = IPT_ALIGN(sizeof(struct ipt_udp)), 217 .help = &help, 218 .init = &init, 219 .parse = &parse, 220 .final_check = &final_check, 221 .print = &print, 222 .save = &save, 223 .extra_opts = opts 224}; 225 226void 227_init(void) 228{ 229 register_match(&udp); 230} 231