You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
338 lines
9.6 KiB
338 lines
9.6 KiB
/* Shared library add-on to iptables to add string matching support. |
|
* |
|
* Copyright (C) 2000 Emmanuel Roger <winfield@freegates.be> |
|
* |
|
* 2005-08-05 Pablo Neira Ayuso <pablo@eurodev.net> |
|
* - reimplemented to use new string matching iptables match |
|
* - add functionality to match packets by using window offsets |
|
* - add functionality to select the string matching algorithm |
|
* |
|
* ChangeLog |
|
* 29.12.2003: Michael Rash <mbr@cipherdyne.org> |
|
* Fixed iptables save/restore for ascii strings |
|
* that contain space chars, and hex strings that |
|
* contain embedded NULL chars. Updated to print |
|
* strings in hex mode if any non-printable char |
|
* is contained within the string. |
|
* |
|
* 27.01.2001: Gianni Tedesco <gianni@ecsc.co.uk> |
|
* Changed --tos to --string in save(). Also |
|
* updated to work with slightly modified |
|
* ipt_string_info. |
|
*/ |
|
#define _GNU_SOURCE 1 /* strnlen for older glibcs */ |
|
#include <stdio.h> |
|
#include <string.h> |
|
#include <stdlib.h> |
|
#include <ctype.h> |
|
#include <xtables.h> |
|
#include <linux/netfilter/xt_string.h> |
|
|
|
enum { |
|
O_FROM = 0, |
|
O_TO, |
|
O_ALGO, |
|
O_ICASE, |
|
O_STRING, |
|
O_HEX_STRING, |
|
F_STRING = 1 << O_STRING, |
|
F_HEX_STRING = 1 << O_HEX_STRING, |
|
F_OP_ANY = F_STRING | F_HEX_STRING, |
|
}; |
|
|
|
static void string_help(void) |
|
{ |
|
printf( |
|
"string match options:\n" |
|
"--from Offset to start searching from\n" |
|
"--to Offset to stop searching\n" |
|
"--algo Algorithm\n" |
|
"--icase Ignore case (default: 0)\n" |
|
"[!] --string string Match a string in a packet\n" |
|
"[!] --hex-string string Match a hex string in a packet\n"); |
|
} |
|
|
|
#define s struct xt_string_info |
|
static const struct xt_option_entry string_opts[] = { |
|
{.name = "from", .id = O_FROM, .type = XTTYPE_UINT16, |
|
.flags = XTOPT_PUT, XTOPT_POINTER(s, from_offset)}, |
|
{.name = "to", .id = O_TO, .type = XTTYPE_UINT16, |
|
.flags = XTOPT_PUT, XTOPT_POINTER(s, to_offset)}, |
|
{.name = "algo", .id = O_ALGO, .type = XTTYPE_STRING, |
|
.flags = XTOPT_MAND | XTOPT_PUT, XTOPT_POINTER(s, algo)}, |
|
{.name = "string", .id = O_STRING, .type = XTTYPE_STRING, |
|
.flags = XTOPT_INVERT, .excl = F_HEX_STRING}, |
|
{.name = "hex-string", .id = O_HEX_STRING, .type = XTTYPE_STRING, |
|
.flags = XTOPT_INVERT, .excl = F_STRING}, |
|
{.name = "icase", .id = O_ICASE, .type = XTTYPE_NONE}, |
|
XTOPT_TABLEEND, |
|
}; |
|
#undef s |
|
|
|
static void string_init(struct xt_entry_match *m) |
|
{ |
|
struct xt_string_info *i = (struct xt_string_info *) m->data; |
|
|
|
i->to_offset = UINT16_MAX; |
|
} |
|
|
|
static void |
|
parse_string(const char *s, struct xt_string_info *info) |
|
{ |
|
/* xt_string does not need \0 at the end of the pattern */ |
|
if (strlen(s) <= XT_STRING_MAX_PATTERN_SIZE) { |
|
strncpy(info->pattern, s, XT_STRING_MAX_PATTERN_SIZE); |
|
info->patlen = strnlen(s, XT_STRING_MAX_PATTERN_SIZE); |
|
return; |
|
} |
|
xtables_error(PARAMETER_PROBLEM, "STRING too long \"%s\"", s); |
|
} |
|
|
|
static void |
|
parse_hex_string(const char *s, struct xt_string_info *info) |
|
{ |
|
int i=0, slen, sindex=0, schar; |
|
short hex_f = 0, literal_f = 0; |
|
char hextmp[3]; |
|
|
|
slen = strlen(s); |
|
|
|
if (slen == 0) { |
|
xtables_error(PARAMETER_PROBLEM, |
|
"STRING must contain at least one char"); |
|
} |
|
|
|
while (i < slen) { |
|
if (s[i] == '\\' && !hex_f) { |
|
literal_f = 1; |
|
} else if (s[i] == '\\') { |
|
xtables_error(PARAMETER_PROBLEM, |
|
"Cannot include literals in hex data"); |
|
} else if (s[i] == '|') { |
|
if (hex_f) |
|
hex_f = 0; |
|
else { |
|
hex_f = 1; |
|
/* get past any initial whitespace just after the '|' */ |
|
while (s[i+1] == ' ') |
|
i++; |
|
} |
|
if (i+1 >= slen) |
|
break; |
|
else |
|
i++; /* advance to the next character */ |
|
} |
|
|
|
if (literal_f) { |
|
if (i+1 >= slen) { |
|
xtables_error(PARAMETER_PROBLEM, |
|
"Bad literal placement at end of string"); |
|
} |
|
info->pattern[sindex] = s[i+1]; |
|
i += 2; /* skip over literal char */ |
|
literal_f = 0; |
|
} else if (hex_f) { |
|
if (i+1 >= slen) { |
|
xtables_error(PARAMETER_PROBLEM, |
|
"Odd number of hex digits"); |
|
} |
|
if (i+2 >= slen) { |
|
/* must end with a "|" */ |
|
xtables_error(PARAMETER_PROBLEM, "Invalid hex block"); |
|
} |
|
if (! isxdigit(s[i])) /* check for valid hex char */ |
|
xtables_error(PARAMETER_PROBLEM, "Invalid hex char '%c'", s[i]); |
|
if (! isxdigit(s[i+1])) /* check for valid hex char */ |
|
xtables_error(PARAMETER_PROBLEM, "Invalid hex char '%c'", s[i+1]); |
|
hextmp[0] = s[i]; |
|
hextmp[1] = s[i+1]; |
|
hextmp[2] = '\0'; |
|
if (! sscanf(hextmp, "%x", &schar)) |
|
xtables_error(PARAMETER_PROBLEM, |
|
"Invalid hex char `%c'", s[i]); |
|
info->pattern[sindex] = (char) schar; |
|
if (s[i+2] == ' ') |
|
i += 3; /* spaces included in the hex block */ |
|
else |
|
i += 2; |
|
} else { /* the char is not part of hex data, so just copy */ |
|
info->pattern[sindex] = s[i]; |
|
i++; |
|
} |
|
if (sindex > XT_STRING_MAX_PATTERN_SIZE) |
|
xtables_error(PARAMETER_PROBLEM, "STRING too long \"%s\"", s); |
|
sindex++; |
|
} |
|
info->patlen = sindex; |
|
} |
|
|
|
static void string_parse(struct xt_option_call *cb) |
|
{ |
|
struct xt_string_info *stringinfo = cb->data; |
|
const unsigned int revision = (*cb->match)->u.user.revision; |
|
|
|
xtables_option_parse(cb); |
|
switch (cb->entry->id) { |
|
case O_STRING: |
|
parse_string(cb->arg, stringinfo); |
|
if (cb->invert) { |
|
if (revision == 0) |
|
stringinfo->u.v0.invert = 1; |
|
else |
|
stringinfo->u.v1.flags |= XT_STRING_FLAG_INVERT; |
|
} |
|
break; |
|
case O_HEX_STRING: |
|
parse_hex_string(cb->arg, stringinfo); /* sets length */ |
|
if (cb->invert) { |
|
if (revision == 0) |
|
stringinfo->u.v0.invert = 1; |
|
else |
|
stringinfo->u.v1.flags |= XT_STRING_FLAG_INVERT; |
|
} |
|
break; |
|
case O_ICASE: |
|
if (revision == 0) |
|
xtables_error(VERSION_PROBLEM, |
|
"Kernel doesn't support --icase"); |
|
|
|
stringinfo->u.v1.flags |= XT_STRING_FLAG_IGNORECASE; |
|
break; |
|
} |
|
} |
|
|
|
static void string_check(struct xt_fcheck_call *cb) |
|
{ |
|
if (!(cb->xflags & F_OP_ANY)) |
|
xtables_error(PARAMETER_PROBLEM, |
|
"STRING match: You must specify `--string' or " |
|
"`--hex-string'"); |
|
} |
|
|
|
/* Test to see if the string contains non-printable chars or quotes */ |
|
static unsigned short int |
|
is_hex_string(const char *str, const unsigned short int len) |
|
{ |
|
unsigned int i; |
|
for (i=0; i < len; i++) |
|
if (! isprint(str[i])) |
|
return 1; /* string contains at least one non-printable char */ |
|
/* use hex output if the last char is a "\" */ |
|
if (str[len-1] == '\\') |
|
return 1; |
|
return 0; |
|
} |
|
|
|
/* Print string with "|" chars included as one would pass to --hex-string */ |
|
static void |
|
print_hex_string(const char *str, const unsigned short int len) |
|
{ |
|
unsigned int i; |
|
/* start hex block */ |
|
printf(" \"|"); |
|
for (i=0; i < len; i++) |
|
printf("%02x", (unsigned char)str[i]); |
|
/* close hex block */ |
|
printf("|\""); |
|
} |
|
|
|
static void |
|
print_string(const char *str, const unsigned short int len) |
|
{ |
|
unsigned int i; |
|
printf(" \""); |
|
for (i=0; i < len; i++) { |
|
if (str[i] == '\"' || str[i] == '\\') |
|
putchar('\\'); |
|
printf("%c", (unsigned char) str[i]); |
|
} |
|
printf("\""); /* closing quote */ |
|
} |
|
|
|
static void |
|
string_print(const void *ip, const struct xt_entry_match *match, int numeric) |
|
{ |
|
const struct xt_string_info *info = |
|
(const struct xt_string_info*) match->data; |
|
const int revision = match->u.user.revision; |
|
int invert = (revision == 0 ? info->u.v0.invert : |
|
info->u.v1.flags & XT_STRING_FLAG_INVERT); |
|
|
|
if (is_hex_string(info->pattern, info->patlen)) { |
|
printf(" STRING match %s", invert ? "!" : ""); |
|
print_hex_string(info->pattern, info->patlen); |
|
} else { |
|
printf(" STRING match %s", invert ? "!" : ""); |
|
print_string(info->pattern, info->patlen); |
|
} |
|
printf(" ALGO name %s", info->algo); |
|
if (info->from_offset != 0) |
|
printf(" FROM %u", info->from_offset); |
|
if (info->to_offset != 0) |
|
printf(" TO %u", info->to_offset); |
|
if (revision > 0 && info->u.v1.flags & XT_STRING_FLAG_IGNORECASE) |
|
printf(" ICASE"); |
|
} |
|
|
|
static void string_save(const void *ip, const struct xt_entry_match *match) |
|
{ |
|
const struct xt_string_info *info = |
|
(const struct xt_string_info*) match->data; |
|
const int revision = match->u.user.revision; |
|
int invert = (revision == 0 ? info->u.v0.invert : |
|
info->u.v1.flags & XT_STRING_FLAG_INVERT); |
|
|
|
if (is_hex_string(info->pattern, info->patlen)) { |
|
printf("%s --hex-string", (invert) ? " !" : ""); |
|
print_hex_string(info->pattern, info->patlen); |
|
} else { |
|
printf("%s --string", (invert) ? " !": ""); |
|
print_string(info->pattern, info->patlen); |
|
} |
|
printf(" --algo %s", info->algo); |
|
if (info->from_offset != 0) |
|
printf(" --from %u", info->from_offset); |
|
if (info->to_offset != 0) |
|
printf(" --to %u", info->to_offset); |
|
if (revision > 0 && info->u.v1.flags & XT_STRING_FLAG_IGNORECASE) |
|
printf(" --icase"); |
|
} |
|
|
|
|
|
static struct xtables_match string_mt_reg[] = { |
|
{ |
|
.name = "string", |
|
.revision = 0, |
|
.family = NFPROTO_UNSPEC, |
|
.version = XTABLES_VERSION, |
|
.size = XT_ALIGN(sizeof(struct xt_string_info)), |
|
.userspacesize = offsetof(struct xt_string_info, config), |
|
.help = string_help, |
|
.init = string_init, |
|
.print = string_print, |
|
.save = string_save, |
|
.x6_parse = string_parse, |
|
.x6_fcheck = string_check, |
|
.x6_options = string_opts, |
|
}, |
|
{ |
|
.name = "string", |
|
.revision = 1, |
|
.family = NFPROTO_UNSPEC, |
|
.version = XTABLES_VERSION, |
|
.size = XT_ALIGN(sizeof(struct xt_string_info)), |
|
.userspacesize = offsetof(struct xt_string_info, config), |
|
.help = string_help, |
|
.init = string_init, |
|
.print = string_print, |
|
.save = string_save, |
|
.x6_parse = string_parse, |
|
.x6_fcheck = string_check, |
|
.x6_options = string_opts, |
|
}, |
|
}; |
|
|
|
void _init(void) |
|
{ |
|
xtables_register_matches(string_mt_reg, ARRAY_SIZE(string_mt_reg)); |
|
}
|
|
|