1 /* Shared library add-on to iptables to add string matching support.
3 * Copyright (C) 2000 Emmanuel Roger <winfield@freegates.be>
5 * 2005-08-05 Pablo Neira Ayuso <pablo@eurodev.net>
6 * - reimplemented to use new string matching iptables match
7 * - add functionality to match packets by using window offsets
8 * - add functionality to select the string matching algorithm
11 * 29.12.2003: Michael Rash <mbr@cipherdyne.org>
12 * Fixed iptables save/restore for ascii strings
13 * that contain space chars, and hex strings that
14 * contain embedded NULL chars. Updated to print
15 * strings in hex mode if any non-printable char
16 * is contained within the string.
18 * 27.01.2001: Gianni Tedesco <gianni@ecsc.co.uk>
19 * Changed --tos to --string in save(). Also
20 * updated to work with slightly modified
31 #include <linux/netfilter_ipv4/ipt_string.h>
33 /* Function which prints out usage message. */
38 "STRING match v%s options:\n"
39 "--from Offset to start searching from\n"
40 "--to Offset to stop searching\n"
42 "--string [!] string Match a string in a packet\n"
43 "--hex-string [!] string Match a hex string in a packet\n",
47 static struct option opts
[] = {
48 { "from", 1, 0, '1' },
50 { "algo", 1, 0, '3' },
51 { "string", 1, 0, '4' },
52 { "hex-string", 1, 0, '5' },
57 init(struct ipt_entry_match
*m
, unsigned int *nfcache
)
59 struct ipt_string_info
*i
= (struct ipt_string_info
*) m
->data
;
61 if (i
->to_offset
== 0)
62 i
->to_offset
= (u_int16_t
) ~0UL;
66 parse_string(const char *s
, struct ipt_string_info
*info
)
68 if (strlen(s
) <= IPT_STRING_MAX_PATTERN_SIZE
) {
69 strncpy(info
->pattern
, s
, IPT_STRING_MAX_PATTERN_SIZE
);
70 info
->patlen
= strlen(s
);
73 exit_error(PARAMETER_PROBLEM
, "STRING too long `%s'", s
);
77 parse_algo(const char *s
, struct ipt_string_info
*info
)
79 if (strlen(s
) <= IPT_STRING_MAX_ALGO_NAME_SIZE
) {
80 strncpy(info
->algo
, s
, IPT_STRING_MAX_ALGO_NAME_SIZE
);
83 exit_error(PARAMETER_PROBLEM
, "ALGO too long `%s'", s
);
87 parse_hex_string(const char *s
, struct ipt_string_info
*info
)
89 int i
=0, slen
, sindex
=0, schar
;
90 short hex_f
= 0, literal_f
= 0;
96 exit_error(PARAMETER_PROBLEM
,
97 "STRING must contain at least one char");
101 if (s
[i
] == '\\' && !hex_f
) {
103 } else if (s
[i
] == '\\') {
104 exit_error(PARAMETER_PROBLEM
,
105 "Cannot include literals in hex data");
106 } else if (s
[i
] == '|') {
111 /* get past any initial whitespace just after the '|' */
112 while (s
[i
+1] == ' ')
118 i
++; /* advance to the next character */
123 exit_error(PARAMETER_PROBLEM
,
124 "Bad literal placement at end of string");
126 info
->pattern
[sindex
] = s
[i
+1];
127 i
+= 2; /* skip over literal char */
131 exit_error(PARAMETER_PROBLEM
,
132 "Odd number of hex digits");
135 /* must end with a "|" */
136 exit_error(PARAMETER_PROBLEM
, "Invalid hex block");
138 if (! isxdigit(s
[i
])) /* check for valid hex char */
139 exit_error(PARAMETER_PROBLEM
, "Invalid hex char `%c'", s
[i
]);
140 if (! isxdigit(s
[i
+1])) /* check for valid hex char */
141 exit_error(PARAMETER_PROBLEM
, "Invalid hex char `%c'", s
[i
+1]);
145 if (! sscanf(hextmp
, "%x", &schar
))
146 exit_error(PARAMETER_PROBLEM
,
147 "Invalid hex char `%c'", s
[i
]);
148 info
->pattern
[sindex
] = (char) schar
;
150 i
+= 3; /* spaces included in the hex block */
153 } else { /* the char is not part of hex data, so just copy */
154 info
->pattern
[sindex
] = s
[i
];
157 if (sindex
> IPT_STRING_MAX_PATTERN_SIZE
)
158 exit_error(PARAMETER_PROBLEM
, "STRING too long `%s'", s
);
161 info
->patlen
= sindex
;
169 /* Function which parses command options; returns true if it
172 parse(int c
, char **argv
, int invert
, unsigned int *flags
,
173 const struct ipt_entry
*entry
,
174 unsigned int *nfcache
,
175 struct ipt_entry_match
**match
)
177 struct ipt_string_info
*stringinfo
= (struct ipt_string_info
*)(*match
)->data
;
182 exit_error(PARAMETER_PROBLEM
,
183 "Can't specify multiple --from");
184 stringinfo
->from_offset
= atoi(optarg
);
189 exit_error(PARAMETER_PROBLEM
,
190 "Can't specify multiple --to");
191 stringinfo
->to_offset
= atoi(optarg
);
196 exit_error(PARAMETER_PROBLEM
,
197 "Can't specify multiple --algo");
198 parse_algo(optarg
, stringinfo
);
203 exit_error(PARAMETER_PROBLEM
,
204 "Can't specify multiple --string");
205 check_inverse(optarg
, &invert
, &optind
, 0);
206 parse_string(argv
[optind
-1], stringinfo
);
208 stringinfo
->invert
= 1;
209 stringinfo
->patlen
=strlen((char *)&stringinfo
->pattern
);
215 exit_error(PARAMETER_PROBLEM
,
216 "Can't specify multiple --hex-string");
218 check_inverse(optarg
, &invert
, &optind
, 0);
219 parse_hex_string(argv
[optind
-1], stringinfo
); /* sets length */
221 stringinfo
->invert
= 1;
232 /* Final check; must have specified --string. */
234 final_check(unsigned int flags
)
236 if (!(flags
& STRING
))
237 exit_error(PARAMETER_PROBLEM
,
238 "STRING match: You must specify `--string' or "
241 exit_error(PARAMETER_PROBLEM
,
242 "STRING match: You must specify `--algo'");
245 /* Test to see if the string contains non-printable chars or quotes */
246 static unsigned short int
247 is_hex_string(const char *str
, const unsigned short int len
)
250 for (i
=0; i
< len
; i
++)
251 if (! isprint(str
[i
]))
252 return 1; /* string contains at least one non-printable char */
253 /* use hex output if the last char is a "\" */
254 if ((unsigned char) str
[len
-1] == 0x5c)
259 /* Print string with "|" chars included as one would pass to --hex-string */
261 print_hex_string(const char *str
, const unsigned short int len
)
264 /* start hex block */
266 for (i
=0; i
< len
; i
++) {
267 /* see if we need to prepend a zero */
268 if ((unsigned char) str
[i
] <= 0x0F)
269 printf("0%x", (unsigned char) str
[i
]);
271 printf("%x", (unsigned char) str
[i
]);
273 /* close hex block */
278 print_string(const char *str
, const unsigned short int len
)
282 for (i
=0; i
< len
; i
++) {
283 if ((unsigned char) str
[i
] == 0x22) /* escape any embedded quotes */
285 printf("%c", (unsigned char) str
[i
]);
287 printf("\" "); /* closing space and quote */
290 /* Prints out the matchinfo. */
292 print(const struct ipt_ip
*ip
,
293 const struct ipt_entry_match
*match
,
296 const struct ipt_string_info
*info
=
297 (const struct ipt_string_info
*) match
->data
;
299 if (is_hex_string(info
->pattern
, info
->patlen
)) {
300 printf("STRING match %s", (info
->invert
) ? "!" : "");
301 print_hex_string(info
->pattern
, info
->patlen
);
303 printf("STRING match %s", (info
->invert
) ? "!" : "");
304 print_string(info
->pattern
, info
->patlen
);
306 printf("ALGO name %s ", info
->algo
);
307 if (info
->from_offset
!= 0)
308 printf("FROM %u ", info
->from_offset
);
309 if (info
->to_offset
!= 0)
310 printf("TO %u ", info
->to_offset
);
314 /* Saves the union ipt_matchinfo in parseable form to stdout. */
316 save(const struct ipt_ip
*ip
, const struct ipt_entry_match
*match
)
318 const struct ipt_string_info
*info
=
319 (const struct ipt_string_info
*) match
->data
;
321 if (is_hex_string(info
->pattern
, info
->patlen
)) {
322 printf("--hex-string %s", (info
->invert
) ? "! ": "");
323 print_hex_string(info
->pattern
, info
->patlen
);
325 printf("--string %s", (info
->invert
) ? "! ": "");
326 print_string(info
->pattern
, info
->patlen
);
328 printf("--algo %s ", info
->algo
);
329 if (info
->from_offset
!= 0)
330 printf("--from %u ", info
->from_offset
);
331 if (info
->to_offset
!= 0)
332 printf("--to %u ", info
->to_offset
);
336 static struct iptables_match string
= {
338 .version
= IPTABLES_VERSION
,
339 .size
= IPT_ALIGN(sizeof(struct ipt_string_info
)),
340 .userspacesize
= offsetof(struct ipt_string_info
, config
),
344 .final_check
= final_check
,
353 register_match(&string
);