2 Shared library add-on to iptables to add layer 7 matching support.
4 By Matthew Strait <quadong@users.sf.net>, Oct 2003.
6 http://l7-filter.sf.net
8 This program is free software; you can redistribute it and/or
9 modify it under the terms of the GNU General Public License
10 as published by the Free Software Foundation; either version
11 2 of the License, or (at your option) any later version.
12 http://www.gnu.org/licenses/gpl.txt
14 Based on libipt_string.c (C) 2000 Emmanuel Roger <winfield@freegates.be>
27 #include <linux/netfilter_ipv4/ipt_layer7.h>
29 #define MAX_FN_LEN 256
31 static char l7dir
[MAX_FN_LEN
] = "\0";
33 /* Function which prints out usage message. */
34 static void help(void)
37 "LAYER7 match v%s options:\n"
38 "--l7dir <directory> : Look for patterns here instead of /etc/l7-protocols/\n"
39 " (--l7dir must be specified before --l7proto if used!)\n"
40 "--l7proto [!] <name> : Match the protocol defined in /etc/l7-protocols/name.pat\n"
41 "--l7pkt : Skip connection tracking and match individual packets\n",
47 static struct option opts
[] = {
48 { .name
= "l7proto", .has_arg
= 1, .flag
= 0, .val
= '1' },
49 { .name
= "l7dir", .has_arg
= 1, .flag
= 0, .val
= '2' },
50 { .name
= "l7pkt", .has_arg
= 0, .flag
= 0, .val
= '3' },
54 /* reads filename, puts protocol info into layer7_protocol_info, number of protocols to numprotos */
55 int parse_protocol_file(char * filename
, const unsigned char * protoname
, struct ipt_layer7_info
*info
)
61 enum { protocol
, pattern
, done
} datatype
= protocol
;
63 f
= fopen(filename
, "r");
68 while(getline(&line
, &len
, f
) != -1)
70 if(strlen(line
) < 2 || line
[0] == '#')
73 /* strip the pesky newline... */
74 if(line
[strlen(line
) - 1] == '\n')
75 line
[strlen(line
) - 1] = '\0';
77 if(datatype
== protocol
)
79 /* Ignore everything on the line beginning with the
80 first space or tab . For instance, this allows the
81 protocol line in http.pat to be "http " (or
82 "http I am so cool") instead of just "http". */
83 if(strchr(line
, ' ')){
84 char * space
= strchr(line
, ' ');
87 if(strchr(line
, '\t')){
88 char * space
= strchr(line
, '\t');
92 /* sanity check. First non-comment non-blank
93 line must be the same as the file name. */
94 if(strcmp(line
, protoname
))
95 exit_error(OTHER_PROBLEM
,
96 "Protocol name (%s) doesn't match file name (%s). Bailing out\n",
99 if(strlen(line
) >= MAX_PROTOCOL_LEN
)
100 exit_error(PARAMETER_PROBLEM
,
101 "Protocol name in %s too long!", filename
);
102 strncpy(info
->protocol
, line
, MAX_PROTOCOL_LEN
);
106 else if(datatype
== pattern
)
108 if(strlen(line
) >= MAX_PATTERN_LEN
)
109 exit_error(PARAMETER_PROBLEM
, "Pattern in %s too long!", filename
);
110 strncpy(info
->pattern
, line
, MAX_PATTERN_LEN
);
116 exit_error(OTHER_PROBLEM
, "Internal error");
120 exit_error(OTHER_PROBLEM
, "Failed to get all needed data from %s", filename
);
128 fprintf(stderr, "protocol: %s\npattern: %s\n\n",
134 static int hex2dec(char c
)
145 exit_error(OTHER_PROBLEM
, "hex2dec: bad value!\n");
150 /* takes a string with \xHH escapes and returns one with the characters
152 static char * pre_process(char * s
)
154 char * result
= malloc(strlen(s
) + 1);
155 int sindex
= 0, rindex
= 0;
156 while( sindex
< strlen(s
) )
158 if( sindex
+ 3 < strlen(s
) &&
159 s
[sindex
] == '\\' && s
[sindex
+1] == 'x' &&
160 isxdigit(s
[sindex
+ 2]) && isxdigit(s
[sindex
+ 3]) )
162 /* carefully remember to call tolower here... */
163 result
[rindex
] = tolower( hex2dec(s
[sindex
+ 2])*16 +
164 hex2dec(s
[sindex
+ 3] ) );
166 switch ( result
[rindex
] )
181 "Warning: layer7 regexp contains a control character, %c, in hex (\\x%c%c).\n"
182 "I recommend that you write this as %c or \\%c, depending on what you meant.\n",
183 result
[rindex
], s
[sindex
+ 2], s
[sindex
+ 3], result
[rindex
], result
[rindex
]);
187 "Warning: null (\\x00) in layer7 regexp. A null terminates the regexp string!\n");
194 sindex
+= 3; /* 4 total */
197 result
[rindex
] = tolower(s
[sindex
]);
202 result
[rindex
] = '\0';
207 #define MAX_SUBDIRS 128
208 char ** readl7dir(char * dirname
)
211 struct dirent
** namelist
;
212 char ** subdirs
= malloc(MAX_SUBDIRS
* sizeof(char *));
217 n
= scandir(dirname
, &namelist
, 0, alphasort
);
222 exit_error(OTHER_PROBLEM
, "Couldn't open %s\n", dirname
);
228 char fulldirname
[MAX_FN_LEN
];
230 snprintf(fulldirname
, MAX_FN_LEN
, "%s/%s", dirname
, namelist
[n
]->d_name
);
232 if((scratchdir
= opendir(fulldirname
)) != NULL
)
234 closedir(scratchdir
);
236 if(!strcmp(namelist
[n
]->d_name
, ".") ||
237 !strcmp(namelist
[n
]->d_name
, ".."))
241 subdirs
[d
] = malloc(strlen(namelist
[n
]->d_name
) + 1);
242 strcpy(subdirs
[d
], namelist
[n
]->d_name
);
244 if(d
>= MAX_SUBDIRS
- 1)
247 "Too many subdirectories, skipping the rest!\n");
263 parse_layer7_protocol(const unsigned char *s
, struct ipt_layer7_info
*info
)
265 char filename
[MAX_FN_LEN
];
270 if(strlen(l7dir
) > 0)
273 dir
= "/etc/l7-protocols";
275 subdirs
= readl7dir(dir
);
277 while(subdirs
[n
] != NULL
)
279 int c
= snprintf(filename
, MAX_FN_LEN
, "%s/%s/%s.pat", dir
, subdirs
[n
], s
);
281 //fprintf(stderr, "Trying to find pattern in %s ... ", filename);
285 exit_error(OTHER_PROBLEM
,
286 "Filename beginning with %s is too long!\n", filename
);
289 /* read in the pattern from the file */
290 if(parse_protocol_file(filename
, s
, info
))
292 //fprintf(stderr, "found\n");
297 //fprintf(stderr, "not found\n");
303 exit_error(OTHER_PROBLEM
,
304 "Couldn't find a pattern definition file for %s.\n", s
);
306 /* process \xHH escapes and tolower everything. (our regex lib has no
307 case insensitivity option.) */
308 strncpy(info
->pattern
, pre_process(info
->pattern
), MAX_PATTERN_LEN
);
311 /* Function which parses command options; returns true if it ate an option */
312 static int parse(int c
, char **argv
, int invert
, unsigned int *flags
,
313 const struct ipt_entry
*entry
, unsigned int *nfcache
,
314 struct ipt_entry_match
**match
)
316 struct ipt_layer7_info
*layer7info
=
317 (struct ipt_layer7_info
*)(*match
)->data
;
321 check_inverse(optarg
, &invert
, &optind
, 0);
322 parse_layer7_protocol(argv
[optind
-1], layer7info
);
324 layer7info
->invert
= 1;
329 /* not going to use this, but maybe we need to strip a ! anyway (?) */
330 check_inverse(optarg
, &invert
, &optind
, 0);
332 if(strlen(argv
[optind
-1]) >= MAX_FN_LEN
)
333 exit_error(PARAMETER_PROBLEM
, "directory name too long\n");
335 strncpy(l7dir
, argv
[optind
-1], MAX_FN_LEN
);
351 /* Final check; must have specified --l7proto */
352 static void final_check(unsigned int flags
)
355 exit_error(PARAMETER_PROBLEM
,
356 "LAYER7 match: You must specify `--l7proto'");
359 static void print_protocol(char s
[], int invert
, int numeric
)
361 fputs("l7proto ", stdout
);
362 if (invert
) fputc('!', stdout
);
366 /* Prints out the matchinfo. */
367 static void print(const struct ipt_ip
*ip
,
368 const struct ipt_entry_match
*match
,
373 print_protocol(((struct ipt_layer7_info
*)match
->data
)->protocol
,
374 ((struct ipt_layer7_info
*)match
->data
)->invert
, numeric
);
376 if (((struct ipt_layer7_info
*)match
->data
)->pkt
)
379 /* Saves the union ipt_matchinfo in parsable form to stdout. */
380 static void save(const struct ipt_ip
*ip
, const struct ipt_entry_match
*match
)
382 const struct ipt_layer7_info
*info
=
383 (const struct ipt_layer7_info
*) match
->data
;
385 printf("--l7proto %s%s ", (info
->invert
) ? "! ": "", info
->protocol
);
388 static struct iptables_match layer7
= {
390 .version
= IPTABLES_VERSION
,
391 .size
= IPT_ALIGN(sizeof(struct ipt_layer7_info
)),
392 .userspacesize
= IPT_ALIGN(sizeof(struct ipt_layer7_info
)),
395 .final_check
= &final_check
,
403 register_match(&layer7
);