release/src/router/iptables/extensions/libipt_layer7.c

   1 /*
   2    Shared library add-on to iptables to add layer 7 matching support.
   3
   4    By Matthew Strait <quadong@users.sf.net>, Oct 2003.
   5
   6    http://l7-filter.sf.net
   7
   8    This program is free software; you can redistribute it and/or
   9    modify it under the terms of the GNU General Public License
  10    as published by the Free Software Foundation; either version
  11    2 of the License, or (at your option) any later version.
  12    http://www.gnu.org/licenses/gpl.txt
  13
  14    Based on libipt_string.c (C) 2000 Emmanuel Roger <winfield@freegates.be>
  15 */
  16
  17 #define _GNU_SOURCE
  18 #include <stdio.h>
  19 #include <netdb.h>
  20 #include <string.h>
  21 #include <stdlib.h>
  22 #include <getopt.h>
  23 #include <ctype.h>
  24 #include <dirent.h>
  25
  26 #include <iptables.h>
  27 #include <linux/netfilter_ipv4/ipt_layer7.h>
  28
  29 #define MAX_FN_LEN 256
  30
  31 static char l7dir[MAX_FN_LEN] = "\0";
  32
  33 /* Function which prints out usage message. */
  34 static void help(void)
  35 {
  36         printf(
  37         "LAYER7 match v%s options:\n"
  38         "--l7dir <directory>  : Look for patterns here instead of /etc/l7-protocols/\n"
  39         "                       (--l7dir must be specified before --l7proto if used!)\n"
  40         "--l7proto [!] <name> : Match the protocol defined in /etc/l7-protocols/name.pat\n",
  41         IPTABLES_VERSION);
  42         fputc('\n', stdout);
  43 }
  44
  45 static struct option opts[] = {
  46         { .name = "l7proto", .has_arg = 1, .flag = 0, .val = '1' },
  47         { .name = "l7dir",   .has_arg = 1, .flag = 0, .val = '2' },
  48         { .name = 0 }
  49 };
  50
  51 /* reads filename, puts protocol info into layer7_protocol_info, number of protocols to numprotos */
  52 int parse_protocol_file(char * filename, const unsigned char * protoname, struct ipt_layer7_info *info)
  53 {
  54         FILE * f;
  55         char * line = NULL;
  56         size_t len = 0;
  57
  58         enum { protocol, pattern, done } datatype = protocol;
  59
  60         f = fopen(filename, "r");
  61
  62         if(!f)
  63                 return 0;
  64
  65         while(getline(&line, &len, f) != -1)
  66         {
  67                 if(strlen(line) < 2 || line[0] == '#')
  68                         continue;
  69
  70                 /* strip the pesky newline... */
  71                 if(line[strlen(line) - 1] == '\n')
  72                         line[strlen(line) - 1] = '\0';
  73
  74                 if(datatype == protocol)
  75                 {
  76                         /* Ignore everything on the line beginning with the
  77                         first space or tab . For instance, this allows the
  78                         protocol line in http.pat to be "http " (or
  79                         "http I am so cool") instead of just "http". */
  80                         if(strchr(line, ' ')){
  81                                 char * space = strchr(line, ' ');
  82                                 space[0] = '\0';
  83                         }
  84                         if(strchr(line, '\t')){
  85                                 char * space = strchr(line, '\t');
  86                                 space[0] = '\0';
  87                         }
  88
  89                         /* sanity check.  First non-comment non-blank
  90                         line must be the same as the file name. */
  91                         if(strcmp(line, protoname))
  92                                 exit_error(OTHER_PROBLEM,
  93                                         "Protocol name (%s) doesn't match file name (%s).  Bailing out\n",
  94                                         line, filename);
  95
  96                         if(strlen(line) >= MAX_PROTOCOL_LEN)
  97                                  exit_error(PARAMETER_PROBLEM,
  98                                         "Protocol name in %s too long!", filename);
  99                         strncpy(info->protocol, line, MAX_PROTOCOL_LEN);
 100
 101                         datatype = pattern;
 102                 }
 103                 else if(datatype == pattern)
 104                 {
 105                         if(strlen(line) >= MAX_PATTERN_LEN)
 106                                  exit_error(PARAMETER_PROBLEM, "Pattern in %s too long!", filename);
 107                         strncpy(info->pattern, line, MAX_PATTERN_LEN);
 108
 109                         datatype = done;
 110                         break;
 111                 }
 112                 else
 113                         exit_error(OTHER_PROBLEM, "Internal error");
 114         }
 115
 116         if(datatype != done)
 117                 exit_error(OTHER_PROBLEM, "Failed to get all needed data from %s", filename);
 118
 119         if(line) free(line);
 120         fclose(f);
 121
 122         return 1;
 123
 124 /*
 125         fprintf(stderr, "protocol: %s\npattern: %s\n\n",
 126                         info->protocol,
 127                         info->pattern);
 128 */
 129 }
 130
 131 static int hex2dec(char c)
 132 {
 133         switch (c)
 134         {
 135                 case '0' ... '9':
 136                         return c - '0';
 137                 case 'a' ... 'f':
 138                         return c - 'a' + 10;
 139                 case 'A' ... 'F':
 140                         return c - 'A' + 10;
 141                 default:
 142                         exit_error(OTHER_PROBLEM, "hex2dec: bad value!\n");
 143                         return 0;
 144         }
 145 }
 146
 147 /* takes a string with \xHH escapes and returns one with the characters
 148 they stand for */
 149 static char * pre_process(char * s)
 150 {
 151         char * result = malloc(strlen(s) + 1);
 152         int sindex = 0, rindex = 0;
 153         while( sindex < strlen(s) )
 154         {
 155             if( sindex + 3 < strlen(s) &&
 156                 s[sindex] == '\\' && s[sindex+1] == 'x' &&
 157                 isxdigit(s[sindex + 2]) && isxdigit(s[sindex + 3]) )
 158                 {
 159                         /* carefully remember to call tolower here... */
 160                         result[rindex] = tolower( hex2dec(s[sindex + 2])*16 +
 161                                                   hex2dec(s[sindex + 3] ) );
 162
 163                         switch ( result[rindex] )
 164                         {
 165                         case 0x24:
 166                         case 0x28:
 167                         case 0x29:
 168                         case 0x2a:
 169                         case 0x2b:
 170                         case 0x2e:
 171                         case 0x3f:
 172                         case 0x5b:
 173                         case 0x5c:
 174                         case 0x5e:
 175                         case 0x7c:
 176                                 fprintf(stderr,
 177                                         "Warning: layer7 regexp contains a control character, %c, in hex (\\x%c%c).\n"
 178                                         "I recommend that you write this as %c or \\%c, depending on what you meant.\n",
 179                                         result[rindex], s[sindex + 2], s[sindex + 3], result[rindex], result[rindex]);
 180                                 break;
 181                         case 0x00:
 182                                 fprintf(stderr,
 183                                         "Warning: null (\\x00) in layer7 regexp.  A null terminates the regexp string!\n");
 184                                 break;
 185                         default:
 186                                 break;
 187                         }
 188
 189
 190                         sindex += 3; /* 4 total */
 191                 }
 192                 else
 193                         result[rindex] = tolower(s[sindex]);
 194
 195                 sindex++;
 196                 rindex++;
 197         }
 198         result[rindex] = '\0';
 199
 200         return result;
 201 }
 202
 203 #define MAX_SUBDIRS 128
 204 char ** readl7dir(char * dirname)
 205 {
 206         DIR             * scratchdir;
 207         struct dirent   ** namelist;
 208         char ** subdirs = malloc(MAX_SUBDIRS * sizeof(char *));
 209
 210         int n, d = 1;
 211         subdirs[0] = "";
 212
 213         n = scandir(dirname, &namelist, 0, alphasort);
 214
 215         if (n < 0)
 216         {
 217             perror("scandir");
 218             exit_error(OTHER_PROBLEM, "Couldn't open %s\n", dirname);
 219         }
 220         else
 221         {
 222                 while(n--)
 223                 {
 224                         char fulldirname[MAX_FN_LEN];
 225
 226                         snprintf(fulldirname, MAX_FN_LEN, "%s/%s", dirname, namelist[n]->d_name);
 227
 228                         if((scratchdir = opendir(fulldirname)) != NULL)
 229                         {
 230                                 closedir(scratchdir);
 231
 232                                 if(!strcmp(namelist[n]->d_name, ".") ||
 233                                    !strcmp(namelist[n]->d_name, ".."))
 234                                         /* do nothing */ ;
 235                                 else
 236                                 {
 237                                         subdirs[d] = malloc(strlen(namelist[n]->d_name) + 1);
 238                                         strcpy(subdirs[d], namelist[n]->d_name);
 239                                         d++;
 240                                         if(d >= MAX_SUBDIRS - 1)
 241                                         {
 242                                                 fprintf(stderr,
 243                                                   "Too many subdirectories, skipping the rest!\n");
 244                                                 break;
 245                                         }
 246                                 }
 247                         }
 248                         free(namelist[n]);
 249                 }
 250                 free(namelist);
 251         }
 252
 253         subdirs[d] = NULL;
 254
 255         return subdirs;
 256 }
 257
 258 static void
 259 parse_layer7_protocol(const unsigned char *s, struct ipt_layer7_info *info)
 260 {
 261         char filename[MAX_FN_LEN];
 262         char * dir = NULL;
 263         char ** subdirs;
 264         int n = 0, done = 0;
 265
 266         if(strlen(l7dir) > 0)
 267                 dir = l7dir;
 268         else
 269                 dir = "/etc/l7-protocols";
 270
 271         subdirs = readl7dir(dir);
 272
 273         while(subdirs[n] != NULL)
 274         {
 275                 int c = snprintf(filename, MAX_FN_LEN, "%s/%s/%s.pat", dir, subdirs[n], s);
 276
 277                 //fprintf(stderr, "Trying to find pattern in %s ... ", filename);
 278
 279                 if(c > MAX_FN_LEN)
 280                 {
 281                         exit_error(OTHER_PROBLEM,
 282                                 "Filename beginning with %s is too long!\n", filename);
 283                 }
 284
 285                 /* read in the pattern from the file */
 286                 if(parse_protocol_file(filename, s, info))
 287                 {
 288                         //fprintf(stderr, "found\n");
 289                         done = 1;
 290                         break;
 291                 }
 292
 293                 //fprintf(stderr, "not found\n");
 294
 295                 n++;
 296         }
 297
 298         if(!done)
 299                 exit_error(OTHER_PROBLEM,
 300                         "Couldn't find a pattern definition file for %s.\n", s);
 301
 302         /* process \xHH escapes and tolower everything. (our regex lib has no
 303         case insensitivity option.) */
 304         strncpy(info->pattern, pre_process(info->pattern), MAX_PATTERN_LEN);
 305 }
 306
 307 /* Function which parses command options; returns true if it ate an option */
 308 static int parse(int c, char **argv, int invert, unsigned int *flags,
 309       const struct ipt_entry *entry, unsigned int *nfcache,
 310       struct ipt_entry_match **match)
 311 {
 312         struct ipt_layer7_info *layer7info =
 313                 (struct ipt_layer7_info *)(*match)->data;
 314
 315         switch (c) {
 316         case '1':
 317                 check_inverse(optarg, &invert, &optind, 0);
 318                 parse_layer7_protocol(argv[optind-1], layer7info);
 319                 if (invert)
 320                         layer7info->invert = 1;
 321                 *flags = 1;
 322                 break;
 323
 324         case '2':
 325                 /* not going to use this, but maybe we need to strip a ! anyway (?) */
 326                 check_inverse(optarg, &invert, &optind, 0);
 327
 328                 if(strlen(argv[optind-1]) >= MAX_FN_LEN)
 329                         exit_error(PARAMETER_PROBLEM, "directory name too long\n");
 330
 331                 strncpy(l7dir, argv[optind-1], MAX_FN_LEN);
 332
 333                 *flags = 1;
 334                 break;
 335
 336         default:
 337                 return 0;
 338         }
 339
 340         return 1;
 341 }
 342
 343 /* Final check; must have specified --l7proto */
 344 static void final_check(unsigned int flags)
 345 {
 346         if (!flags)
 347                 exit_error(PARAMETER_PROBLEM,
 348                            "LAYER7 match: You must specify `--l7proto'");
 349 }
 350
 351 static void print_protocol(char s[], int invert, int numeric)
 352 {
 353         fputs("l7proto ", stdout);
 354         if (invert) fputc('!', stdout);
 355         printf("%s ", s);
 356 }
 357
 358 /* Prints out the matchinfo. */
 359 static void print(const struct ipt_ip *ip,
 360       const struct ipt_entry_match *match,
 361       int numeric)
 362 {
 363         printf("LAYER7 ");
 364
 365         print_protocol(((struct ipt_layer7_info *)match->data)->protocol,
 366                   ((struct ipt_layer7_info *)match->data)->invert, numeric);
 367 }
 368 /* Saves the union ipt_matchinfo in parsable form to stdout. */
 369 static void save(const struct ipt_ip *ip, const struct ipt_entry_match *match)
 370 {
 371         const struct ipt_layer7_info *info =
 372             (const struct ipt_layer7_info*) match->data;
 373
 374         printf("--l7proto %s%s ", (info->invert)   ? "! ": "", info->protocol);
 375 }
 376
 377 static struct iptables_match layer7 = {
 378     .name          = "layer7",
 379     .version       = IPTABLES_VERSION,
 380     .size          = IPT_ALIGN(sizeof(struct ipt_layer7_info)),
 381     .userspacesize = IPT_ALIGN(sizeof(struct ipt_layer7_info)),
 382     .help          = &help,
 383     .parse         = &parse,
 384     .final_check   = &final_check,
 385     .print         = &print,
 386     .save          = &save,
 387     .extra_opts    = opts
 388 };
 389
 390 void _init(void)
 391 {
 392         register_match(&layer7);
 393 }