source: freewrt/package/iptables/patches/02-layer7-1.5nbd.patch@ d419478

freewrt_1_0 freewrt_2_0
Last change on this file since d419478 was 475ad56, checked in by Waldemar Brodkorb <wbx@…>, 20 years ago

add OpenWrt trunk revision 3830.

git-svn-id: ​svn://www.freewrt.org/trunk/freewrt@1 afb5a338-a214-0410-bd46-81f09a774fd1
  • Property mode set to 100644
File size: 11.5 KB
RevLine 
[475ad56]1diff -urN iptables.old/extensions/.layer7-test iptables.dev/extensions/.layer7-test
2--- iptables.old/extensions/.layer7-test 1970-01-01 01:00:00.000000000 +0100
3+++ iptables.dev/extensions/.layer7-test 2005-11-10 16:57:51.819381000 +0100
4@@ -0,0 +1,2 @@
5+#! /bin/sh
6+[ -f $KERNEL_DIR/include/linux/netfilter_ipv4/ipt_layer7.h ] && echo layer7
7diff -urN iptables.old/extensions/ipt_layer7.h iptables.dev/extensions/ipt_layer7.h
8--- iptables.old/extensions/ipt_layer7.h 1970-01-01 01:00:00.000000000 +0100
9+++ iptables.dev/extensions/ipt_layer7.h 2005-11-10 17:46:32.933599750 +0100
10@@ -0,0 +1,27 @@
11+/*
12+ By Matthew Strait <quadong@users.sf.net>, Dec 2003.
13+ http://l7-filter.sf.net
14+
15+ This program is free software; you can redistribute it and/or
16+ modify it under the terms of the GNU General Public License
17+ as published by the Free Software Foundation; either version
18+ 2 of the License, or (at your option) any later version.
19+ http://www.gnu.org/licenses/gpl.txt
20+*/
21+
22+#ifndef _IPT_LAYER7_H
23+#define _IPT_LAYER7_H
24+
25+#define MAX_PATTERN_LEN 8192
26+#define MAX_PROTOCOL_LEN 256
27+
28+typedef char *(*proc_ipt_search) (char *, char, char *);
29+
30+struct ipt_layer7_info {
31+ char protocol[MAX_PROTOCOL_LEN];
32+ char invert:1;
33+ char pattern[MAX_PATTERN_LEN];
34+ char pkt;
35+};
36+
37+#endif /* _IPT_LAYER7_H */
38diff -urN iptables.old/extensions/libipt_layer7.c iptables.dev/extensions/libipt_layer7.c
39--- iptables.old/extensions/libipt_layer7.c 1970-01-01 01:00:00.000000000 +0100
40+++ iptables.dev/extensions/libipt_layer7.c 2005-11-10 17:47:01.399378750 +0100
41@@ -0,0 +1,358 @@
42+/*
43+ Shared library add-on to iptables to add layer 7 matching support.
44+
45+ By Matthew Strait <quadong@users.sf.net>, Oct 2003.
46+
47+ http://l7-filter.sf.net
48+
49+ This program is free software; you can redistribute it and/or
50+ modify it under the terms of the GNU General Public License
51+ as published by the Free Software Foundation; either version
52+ 2 of the License, or (at your option) any later version.
53+ http://www.gnu.org/licenses/gpl.txt
54+
55+ Based on libipt_string.c (C) 2000 Emmanuel Roger <winfield@freegates.be>
56+*/
57+
58+#define _GNU_SOURCE
59+#include <stdio.h>
60+#include <netdb.h>
61+#include <string.h>
62+#include <stdlib.h>
63+#include <getopt.h>
64+#include <ctype.h>
65+#include <dirent.h>
66+
67+#include <iptables.h>
68+#include "ipt_layer7.h"
69+
70+#define MAX_FN_LEN 256
71+
72+static char l7dir[MAX_FN_LEN] = "\0";
73+
74+/* Function which prints out usage message. */
75+static void help(void)
76+{
77+ printf(
78+ "LAYER7 match v%s options:\n"
79+ "--l7dir <directory> : Look for patterns here instead of /etc/l7-protocols/\n"
80+ " (--l7dir must be specified before --l7proto if used!)\n"
81+ "--l7proto [!] <name> : Match the protocol defined in /etc/l7-protocols/name.pat\n"
82+ "--l7pkt : Skip connection tracking and match individual packets\n",
83+ IPTABLES_VERSION);
84+ fputc('\n', stdout);
85+}
86+
87+static struct option opts[] = {
88+ { .name = "l7proto", .has_arg = 1, .flag = 0, .val = '1' },
89+ { .name = "l7dir", .has_arg = 1, .flag = 0, .val = '2' },
90+ { .name = "l7pkt", .has_arg = 0, .flag = 0, .val = '3' },
91+ { .name = 0 }
92+};
93+
94+/* reads filename, puts protocol info into layer7_protocol_info, number of protocols to numprotos */
95+int parse_protocol_file(char * filename, const unsigned char * protoname, struct ipt_layer7_info *info)
96+{
97+ FILE * f;
98+ char * line = NULL;
99+ size_t len = 0;
100+
101+ enum { protocol, pattern, done } datatype = protocol;
102+
103+ f = fopen(filename, "r");
104+
105+ if(!f)
106+ return 0;
107+
108+ while(getline(&line, &len, f) != -1)
109+ {
110+ if(strlen(line) < 2 || line[0] == '#')
111+ continue;
112+
113+ /* strip the pesky newline... */
114+ if(line[strlen(line) - 1] == '\n')
115+ line[strlen(line) - 1] = '\0';
116+
117+ if(datatype == protocol)
118+ {
119+ if(strcmp(line, protoname))
120+ exit_error(OTHER_PROBLEM,
121+ "Protocol name (%s) doesn't match file name (%s). Bailing out\n",
122+ protoname, filename);
123+
124+ if(strlen(line) >= MAX_PROTOCOL_LEN)
125+ exit_error(PARAMETER_PROBLEM,
126+ "Protocol name in %s too long!", filename);
127+ strncpy(info->protocol, line, MAX_PROTOCOL_LEN);
128+
129+ datatype = pattern;
130+ }
131+ else if(datatype == pattern)
132+ {
133+ if(strlen(line) >= MAX_PATTERN_LEN)
134+ exit_error(PARAMETER_PROBLEM, "Pattern in %s too long!", filename);
135+ strncpy(info->pattern, line, MAX_PATTERN_LEN);
136+
137+ datatype = done;
138+ break;
139+ }
140+ else
141+ exit_error(OTHER_PROBLEM, "Internal error");
142+ }
143+
144+ if(datatype != done)
145+ exit_error(OTHER_PROBLEM, "Failed to get all needed data from %s", filename);
146+
147+ if(line) free(line);
148+ fclose(f);
149+
150+ return 1;
151+
152+/*
153+ fprintf(stderr, "protocol: %s\npattern: %s\n\n",
154+ info->protocol,
155+ info->pattern);
156+*/
157+}
158+
159+static int hex2dec(char c)
160+{
161+ switch (c)
162+ {
163+ case '0' ... '9':
164+ return c - '0';
165+ case 'a' ... 'f':
166+ return c - 'a' + 10;
167+ case 'A' ... 'F':
168+ return c - 'A' + 10;
169+ default:
170+ exit_error(OTHER_PROBLEM, "hex2dec: bad value!\n");
171+ return 0;
172+ }
173+}
174+
175+/* takes a string with \xHH escapes and returns one with the characters
176+they stand for */
177+static char * pre_process(char * s)
178+{
179+ char * result = malloc(strlen(s) + 1);
180+ int sindex = 0, rindex = 0;
181+ while( sindex < strlen(s) )
182+ {
183+ if( sindex + 3 < strlen(s) &&
184+ s[sindex] == '\\' && s[sindex+1] == 'x' &&
185+ isxdigit(s[sindex + 2]) && isxdigit(s[sindex + 3]) )
186+ {
187+ /* carefully remember to call tolower here... */
188+ result[rindex] = tolower( hex2dec(s[sindex + 2])*16 +
189+ hex2dec(s[sindex + 3] ) );
190+ sindex += 3; /* 4 total */
191+ }
192+ else
193+ result[rindex] = tolower(s[sindex]);
194+
195+ sindex++;
196+ rindex++;
197+ }
198+ result[rindex] = '\0';
199+
200+ return result;
201+}
202+
203+#define MAX_SUBDIRS 128
204+char ** readl7dir(char * dirname)
205+{
206+ DIR * scratchdir;
207+ struct dirent ** namelist;
208+ char ** subdirs = malloc(MAX_SUBDIRS * sizeof(char *));
209+
210+ int n, d = 1;
211+ subdirs[0] = "";
212+
213+ n = scandir(dirname, &namelist, 0, alphasort);
214+
215+ if (n < 0)
216+ {
217+ perror("scandir");
218+ exit_error(OTHER_PROBLEM, "Couldn't open %s\n", dirname);
219+ }
220+ else
221+ {
222+ while(n--)
223+ {
224+ char fulldirname[MAX_FN_LEN];
225+
226+ snprintf(fulldirname, MAX_FN_LEN, "%s/%s", dirname, namelist[n]->d_name);
227+
228+ if((scratchdir = opendir(fulldirname)) != NULL)
229+ {
230+ closedir(scratchdir);
231+
232+ if(!strcmp(namelist[n]->d_name, ".") ||
233+ !strcmp(namelist[n]->d_name, ".."))
234+ /* do nothing */ ;
235+ else
236+ {
237+ subdirs[d] = malloc(strlen(namelist[n]->d_name) + 1);
238+ strcpy(subdirs[d], namelist[n]->d_name);
239+ d++;
240+ if(d >= MAX_SUBDIRS - 1)
241+ {
242+ fprintf(stderr,
243+ "Too many subdirectories, skipping the rest!\n");
244+ break;
245+ }
246+ }
247+ }
248+ free(namelist[n]);
249+ }
250+ free(namelist);
251+ }
252+
253+ subdirs[d] = NULL;
254+
255+ return subdirs;
256+}
257+
258+static void
259+parse_layer7_protocol(const unsigned char *s, struct ipt_layer7_info *info)
260+{
261+ char filename[MAX_FN_LEN];
262+ char * dir = NULL;
263+ char ** subdirs;
264+ int n = 0, done = 0;
265+
266+ if(strlen(l7dir) > 0)
267+ dir = l7dir;
268+ else
269+ dir = "/etc/l7-protocols";
270+
271+ subdirs = readl7dir(dir);
272+
273+ while(subdirs[n] != NULL)
274+ {
275+ int c = snprintf(filename, MAX_FN_LEN, "%s/%s/%s.pat", dir, subdirs[n], s);
276+
277+ //fprintf(stderr, "Trying to find pattern in %s ... ", filename);
278+
279+ if(c > MAX_FN_LEN)
280+ {
281+ exit_error(OTHER_PROBLEM,
282+ "Filename beginning with %s is too long!\n", filename);
283+ }
284+
285+ /* read in the pattern from the file */
286+ if(parse_protocol_file(filename, s, info))
287+ {
288+ //fprintf(stderr, "found\n");
289+ done = 1;
290+ break;
291+ }
292+
293+ //fprintf(stderr, "not found\n");
294+
295+ n++;
296+ }
297+
298+ if(!done)
299+ exit_error(OTHER_PROBLEM,
300+ "Couldn't find a pattern definition file for %s.\n", s);
301+
302+ /* process \xHH escapes and tolower everything. (our regex lib has no
303+ case insensitivity option.) */
304+ strncpy(info->pattern, pre_process(info->pattern), MAX_PATTERN_LEN);
305+}
306+
307+/* Function which parses command options; returns true if it ate an option */
308+static int parse(int c, char **argv, int invert, unsigned int *flags,
309+ const struct ipt_entry *entry, unsigned int *nfcache,
310+ struct ipt_entry_match **match)
311+{
312+ struct ipt_layer7_info *layer7info =
313+ (struct ipt_layer7_info *)(*match)->data;
314+
315+ switch (c) {
316+ case '1':
317+ check_inverse(optarg, &invert, &optind, 0);
318+ parse_layer7_protocol(argv[optind-1], layer7info);
319+ if (invert)
320+ layer7info->invert = 1;
321+ *flags = 1;
322+ break;
323+
324+ case '2':
325+ /* not going to use this, but maybe we need to strip a ! anyway (?) */
326+ check_inverse(optarg, &invert, &optind, 0);
327+
328+ if(strlen(argv[optind-1]) >= MAX_FN_LEN)
329+ exit_error(PARAMETER_PROBLEM, "directory name too long\n");
330+
331+ strncpy(l7dir, argv[optind-1], MAX_FN_LEN);
332+
333+ *flags = 1;
334+ break;
335+ case '3':
336+ layer7info->pkt = 1;
337+ break;
338+
339+ default:
340+ return 0;
341+ }
342+
343+ return 1;
344+}
345+
346+/* Final check; must have specified --pattern. */
347+static void final_check(unsigned int flags)
348+{
349+ if (!flags)
350+ exit_error(PARAMETER_PROBLEM,
351+ "LAYER7 match: You must specify `--pattern'");
352+}
353+
354+static void print_protocol(char s[], int invert, int numeric)
355+{
356+ fputs("l7proto ", stdout);
357+ if (invert) fputc('!', stdout);
358+ printf("%s ", s);
359+}
360+
361+/* Prints out the matchinfo. */
362+static void print(const struct ipt_ip *ip,
363+ const struct ipt_entry_match *match,
364+ int numeric)
365+{
366+ printf("LAYER7 ");
367+
368+ print_protocol(((struct ipt_layer7_info *)match->data)->protocol,
369+ ((struct ipt_layer7_info *)match->data)->invert, numeric);
370+
371+ if (((struct ipt_layer7_info *)match->data)->pkt)
372+ printf("l7pkt ");
373+}
374+/* Saves the union ipt_matchinfo in parsable form to stdout. */
375+static void save(const struct ipt_ip *ip, const struct ipt_entry_match *match)
376+{
377+ const struct ipt_layer7_info *info =
378+ (const struct ipt_layer7_info*) match->data;
379+
380+ printf("--l7proto %s%s ", (info->invert) ? "! ": "", info->protocol);
381+}
382+
383+static struct iptables_match layer7 = {
384+ .name = "layer7",
385+ .version = IPTABLES_VERSION,
386+ .size = IPT_ALIGN(sizeof(struct ipt_layer7_info)),
387+ .userspacesize = IPT_ALIGN(sizeof(struct ipt_layer7_info)),
388+ .help = &help,
389+ .parse = &parse,
390+ .final_check = &final_check,
391+ .print = &print,
392+ .save = &save,
393+ .extra_opts = opts
394+};
395+
396+void _init(void)
397+{
398+ register_match(&layer7);
399+}
400diff -urN iptables.old/extensions/libipt_layer7.man iptables.dev/extensions/libipt_layer7.man
401--- iptables.old/extensions/libipt_layer7.man 1970-01-01 01:00:00.000000000 +0100
402+++ iptables.dev/extensions/libipt_layer7.man 2005-11-10 16:57:51.823381250 +0100
403@@ -0,0 +1,13 @@
404+This module matches packets based on the application layer data of
405+their connections. It uses regular expression matching to compare
406+the application layer data to regular expressions found it the layer7
407+configuration files. This is an experimental module which can be found at
408+http://l7-filter.sf.net. It takes two options.
409+.TP
410+.BI "--l7proto " "\fIprotocol\fP"
411+Match the specified protocol. The protocol name must match a file
412+name in /etc/l7-protocols/
413+.TP
414+.BI "--l7dir " "\fIdirectory\fP"
415+Use \fIdirectory\fP instead of /etc/l7-protocols/
416+
Note: See TracBrowser for help on using the repository browser.