From 4808d6bfc74e9cf79609245c0ff3c6e079249ce5 Mon Sep 17 00:00:00 2001
From: Matthias Schiffer <mschiffer@universe-factory.net>
Date: Sun, 4 Mar 2018 09:28:58 +0100
Subject: [PATCH] ebt_ip: add support for matching IGMP type
We already have ICMPv6 type/code matches (which can be used to distinguish
different types of MLD packets). Add support for IPv4 IGMP matches in the
same way.
To reuse as much code as possible, the ICMP type/code handling functions
are extended to allow passing a NULL code range.
Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Phil Sutter <psutter@redhat.com>
---
extensions/ebt_ip.c | 44 +++++++++++++++++++++++++++++++++++++++++++-
useful_functions.c | 35 ++++++++++++++++++++++-------------
2 files changed, 65 insertions(+), 14 deletions(-)
diff --git a/extensions/ebt_ip.c b/extensions/ebt_ip.c
index 42660d4564fbf..1ffdb95f156df 100644
--- a/extensions/ebt_ip.c
+++ b/extensions/ebt_ip.c
@@ -25,6 +25,7 @@
#define IP_SPORT '5'
#define IP_DPORT '6'
#define IP_ICMP '7'
+#define IP_IGMP '8'
static const struct option opts[] =
{
@@ -40,6 +41,7 @@ static const struct option opts[] =
{ "ip-destination-port" , required_argument, 0, IP_DPORT },
{ "ip-dport" , required_argument, 0, IP_DPORT },
{ "ip-icmp-type" , required_argument, 0, IP_ICMP },
+ { "ip-igmp-type" , required_argument, 0, IP_IGMP },
{ 0 }
};
@@ -97,6 +99,14 @@ static const struct ebt_icmp_names icmp_codes[] = {
{ "address-mask-reply", 18, 0, 0xFF }
};
+static const struct ebt_icmp_names igmp_types[] = {
+ { "membership-query", 0x11 },
+ { "membership-report-v1", 0x12 },
+ { "membership-report-v2", 0x16 },
+ { "leave-group", 0x17 },
+ { "membership-report-v3", 0x22 },
+};
+
/* put the mask into 4 bytes */
/* transform a protocol and service name into a port number */
static uint16_t parse_port(const char *protocol, const char *name)
@@ -162,10 +172,13 @@ static void print_help()
"--ip-proto [!] protocol : ip protocol specification\n"
"--ip-sport [!] port[:port] : tcp/udp source port or port range\n"
"--ip-dport [!] port[:port] : tcp/udp destination port or port range\n"
-"--ip-icmp-type [!] type[[:type]/code[:code]] : icmp type/code or type/code range\n");
+"--ip-icmp-type [!] type[[:type]/code[:code]] : icmp type/code or type/code range\n"
+"--ip-igmp-type [!] type[:type] : igmp type or type range\n");
printf("\nValid ICMP Types:\n");
ebt_print_icmp_types(icmp_codes, ARRAY_SIZE(icmp_codes));
+ printf("\nValid IGMP Types:\n");
+ ebt_print_icmp_types(igmp_types, ARRAY_SIZE(igmp_types));
}
static void init(struct ebt_entry_match *match)
@@ -183,6 +196,7 @@ static void init(struct ebt_entry_match *match)
#define OPT_SPORT 0x10
#define OPT_DPORT 0x20
#define OPT_ICMP 0x40
+#define OPT_IGMP 0x80
static int parse(int c, char **argv, int argc, const struct ebt_u_entry *entry,
unsigned int *flags, struct ebt_entry_match **match)
{
@@ -241,6 +255,16 @@ static int parse(int c, char **argv, int argc, const struct ebt_u_entry *entry,
return 0;
break;
+ case IP_IGMP:
+ ebt_check_option2(flags, OPT_IGMP);
+ ipinfo->bitmask |= EBT_IP_IGMP;
+ if (ebt_check_inverse2(optarg))
+ ipinfo->invflags |= EBT_IP_IGMP;
+ if (ebt_parse_icmp(igmp_types, ARRAY_SIZE(igmp_types), optarg,
+ ipinfo->igmp_type, NULL))
+ return 0;
+ break;
+
case IP_myTOS:
ebt_check_option2(flags, OPT_TOS);
if (ebt_check_inverse2(optarg))
@@ -300,6 +324,12 @@ static void final_check(const struct ebt_u_entry *entry,
ipinfo->protocol != IPPROTO_ICMP)) {
ebt_print_error("For ICMP filtering the IP protocol must be "
"1 (icmp)");
+ } else if ((ipinfo->bitmask & EBT_IP_IGMP) &&
+ (!(ipinfo->bitmask & EBT_IP_PROTO) ||
+ ipinfo->invflags & EBT_IP_PROTO ||
+ ipinfo->protocol != IPPROTO_IGMP)) {
+ ebt_print_error("For IGMP filtering the IP protocol must be "
+ "2 (igmp)");
}
}
@@ -365,6 +395,13 @@ static void print(const struct ebt_u_entry *entry,
ebt_print_icmp_type(icmp_codes, ARRAY_SIZE(icmp_codes),
ipinfo->icmp_type, ipinfo->icmp_code);
}
+ if (ipinfo->bitmask & EBT_IP_IGMP) {
+ printf("--ip-igmp-type ");
+ if (ipinfo->invflags & EBT_IP_IGMP)
+ printf("! ");
+ ebt_print_icmp_type(igmp_types, ARRAY_SIZE(igmp_types),
+ ipinfo->igmp_type, NULL);
+ }
}
static int compare(const struct ebt_entry_match *m1,
@@ -414,6 +451,11 @@ static int compare(const struct ebt_entry_match *m1,
ipinfo1->icmp_code[1] != ipinfo2->icmp_code[1])
return 0;
}
+ if (ipinfo1->bitmask & EBT_IP_IGMP) {
+ if (ipinfo1->igmp_type[0] != ipinfo2->igmp_type[0] ||
+ ipinfo1->igmp_type[1] != ipinfo2->igmp_type[1])
+ return 0;
+ }
return 1;
}
diff --git a/useful_functions.c b/useful_functions.c
index 8f54bae83fae8..8a34f820f230b 100644
--- a/useful_functions.c
+++ b/useful_functions.c
@@ -486,8 +486,10 @@ int ebt_parse_icmp(const struct ebt_icmp_names *icmp_codes, size_t n_codes,
if (match < n_codes) {
type[0] = type[1] = icmp_codes[match].type;
- code[0] = icmp_codes[match].code_min;
- code[1] = icmp_codes[match].code_max;
+ if (code) {
+ code[0] = icmp_codes[match].code_min;
+ code[1] = icmp_codes[match].code_max;
+ }
} else {
char *next = parse_range(icmptype, 0, 255, number);
if (!next) {
@@ -499,17 +501,21 @@ int ebt_parse_icmp(const struct ebt_icmp_names *icmp_codes, size_t n_codes,
type[1] = (uint8_t) number[1];
switch (*next) {
case 0:
- code[0] = 0;
- code[1] = 255;
+ if (code) {
+ code[0] = 0;
+ code[1] = 255;
+ }
return 0;
case '/':
- next = parse_range(next+1, 0, 255, number);
- code[0] = (uint8_t) number[0];
- code[1] = (uint8_t) number[1];
- if (next == NULL)
- return -1;
- if (next && *next == 0)
- return 0;
+ if (code) {
+ next = parse_range(next+1, 0, 255, number);
+ code[0] = (uint8_t) number[0];
+ code[1] = (uint8_t) number[1];
+ if (next == NULL)
+ return -1;
+ if (next && *next == 0)
+ return 0;
+ }
/* fallthrough */
default:
ebt_print_error("unknown character %c", *next);
@@ -521,6 +527,9 @@ int ebt_parse_icmp(const struct ebt_icmp_names *icmp_codes, size_t n_codes,
static void print_icmp_code(uint8_t *code)
{
+ if (!code)
+ return;
+
if (code[0] == code[1])
printf("/%"PRIu8 " ", code[0]);
else
@@ -542,8 +551,8 @@ void ebt_print_icmp_type(const struct ebt_icmp_names *icmp_codes,
if (icmp_codes[i].type != type[0])
continue;
- if (icmp_codes[i].code_min == code[0] &&
- icmp_codes[i].code_max == code[1]) {
+ if (!code || (icmp_codes[i].code_min == code[0] &&
+ icmp_codes[i].code_max == code[1])) {
printf("%s ", icmp_codes[i].name);
return;
}
--
2.21.0