]>
Commit | Line | Data |
---|---|---|
7f651772 | 1 | diff -NurpP --minimal linux-2.6.21.a/include/linux/netfilter_ipv4/ipt_ipv4options.h linux-2.6.21.b/include/linux/netfilter_ipv4/ipt_ipv4options.h |
2 | --- linux-2.6.21.a/include/linux/netfilter_ipv4/ipt_ipv4options.h 1970-01-01 01:00:00.000000000 +0100 | |
3 | +++ linux-2.6.21.b/include/linux/netfilter_ipv4/ipt_ipv4options.h 2007-05-30 11:22:30.000000000 +0200 | |
4 | @@ -0,0 +1,21 @@ | |
5 | +#ifndef __ipt_ipv4options_h_included__ | |
6 | +#define __ipt_ipv4options_h_included__ | |
7 | + | |
8 | +#define IPT_IPV4OPTION_MATCH_SSRR 0x01 /* For strict source routing */ | |
9 | +#define IPT_IPV4OPTION_MATCH_LSRR 0x02 /* For loose source routing */ | |
10 | +#define IPT_IPV4OPTION_DONT_MATCH_SRR 0x04 /* any source routing */ | |
11 | +#define IPT_IPV4OPTION_MATCH_RR 0x08 /* For Record route */ | |
12 | +#define IPT_IPV4OPTION_DONT_MATCH_RR 0x10 | |
13 | +#define IPT_IPV4OPTION_MATCH_TIMESTAMP 0x20 /* For timestamp request */ | |
14 | +#define IPT_IPV4OPTION_DONT_MATCH_TIMESTAMP 0x40 | |
15 | +#define IPT_IPV4OPTION_MATCH_ROUTER_ALERT 0x80 /* For router-alert */ | |
16 | +#define IPT_IPV4OPTION_DONT_MATCH_ROUTER_ALERT 0x100 | |
17 | +#define IPT_IPV4OPTION_MATCH_ANY_OPT 0x200 /* match packet with any option */ | |
18 | +#define IPT_IPV4OPTION_DONT_MATCH_ANY_OPT 0x400 /* match packet with no option */ | |
19 | + | |
20 | +struct ipt_ipv4options_info { | |
21 | + u_int16_t options; | |
22 | +}; | |
23 | + | |
24 | + | |
25 | +#endif /* __ipt_ipv4options_h_included__ */ | |
26 | diff -NurpP --minimal linux-2.6.21.a/net/ipv4/netfilter/Kconfig linux-2.6.21.b/net/ipv4/netfilter/Kconfig | |
27 | --- linux-2.6.21.a/net/ipv4/netfilter/Kconfig 2007-05-30 11:18:08.000000000 +0200 | |
28 | +++ linux-2.6.21.b/net/ipv4/netfilter/Kconfig 2007-05-30 11:22:30.000000000 +0200 | |
29 | @@ -678,5 +678,18 @@ config IP_NF_TARGET_IPV4OPTSSTRIP | |
30 | If you want to compile it as a module, say M here and read | |
31 | Documentation/modules.txt. If unsure, say `N'. | |
32 | ||
33 | +config IP_NF_MATCH_IPV4OPTIONS | |
34 | + tristate 'IPV4OPTIONS match support' | |
35 | + depends on IP_NF_IPTABLES | |
36 | + help | |
37 | + This option adds a IPV4OPTIONS match. | |
38 | + It allows you to filter options like source routing, | |
39 | + record route, timestamp and router-altert. | |
40 | + | |
41 | + If you say Y here, try iptables -m ipv4options --help for more information. | |
42 | + | |
43 | + If you want to compile it as a module, say M here and read | |
44 | + Documentation/modules.txt. If unsure, say `N'. | |
45 | + | |
46 | endmenu | |
47 | ||
48 | diff -NurpP --minimal linux-2.6.21.a/net/ipv4/netfilter/Makefile linux-2.6.21.b/net/ipv4/netfilter/Makefile | |
49 | --- linux-2.6.21.a/net/ipv4/netfilter/Makefile 2007-05-30 11:18:08.000000000 +0200 | |
50 | +++ linux-2.6.21.b/net/ipv4/netfilter/Makefile 2007-05-30 11:22:30.000000000 +0200 | |
51 | @@ -86,6 +86,9 @@ obj-$(CONFIG_IP_NF_RAW) += iptable_raw.o | |
52 | obj-$(CONFIG_IP_NF_MATCH_IPRANGE) += ipt_iprange.o | |
53 | obj-$(CONFIG_IP_NF_MATCH_OWNER) += ipt_owner.o | |
54 | obj-$(CONFIG_IP_NF_MATCH_TOS) += ipt_tos.o | |
55 | + | |
56 | +obj-$(CONFIG_IP_NF_MATCH_IPV4OPTIONS) += ipt_ipv4options.o | |
57 | + | |
58 | obj-$(CONFIG_IP_NF_MATCH_RECENT) += ipt_recent.o | |
59 | obj-$(CONFIG_IP_NF_MATCH_ECN) += ipt_ecn.o | |
60 | obj-$(CONFIG_IP_NF_MATCH_AH) += ipt_ah.o | |
61 | diff -NurpP --minimal linux-2.6.21.a/net/ipv4/netfilter/ipt_ipv4options.c linux-2.6.21.b/net/ipv4/netfilter/ipt_ipv4options.c | |
62 | --- linux-2.6.21.a/net/ipv4/netfilter/ipt_ipv4options.c 1970-01-01 01:00:00.000000000 +0100 | |
63 | +++ linux-2.6.21.b/net/ipv4/netfilter/ipt_ipv4options.c 2007-05-30 11:22:30.000000000 +0200 | |
64 | @@ -0,0 +1,177 @@ | |
65 | +/* | |
66 | + This is a module which is used to match ipv4 options. | |
67 | + This file is distributed under the terms of the GNU General Public | |
68 | + License (GPL). Copies of the GPL can be obtained from: | |
69 | + ftp://prep.ai.mit.edu/pub/gnu/GPL | |
70 | + | |
71 | + 11-mars-2001 Fabrice MARIE <fabrice@netfilter.org> : initial development. | |
72 | + 12-july-2001 Fabrice MARIE <fabrice@netfilter.org> : added router-alert otions matching. Fixed a bug with no-srr | |
73 | + 12-august-2001 Imran Patel <ipatel@crosswinds.net> : optimization of the match. | |
74 | + 18-november-2001 Fabrice MARIE <fabrice@netfilter.org> : added [!] 'any' option match. | |
75 | + 19-february-2004 Harald Welte <laforge@netfilter.org> : merge with 2.6.x | |
76 | +*/ | |
77 | + | |
78 | +#include <linux/module.h> | |
79 | +#include <linux/skbuff.h> | |
80 | +#include <net/ip.h> | |
81 | +#include <linux/netfilter/x_tables.h> | |
82 | +#include <linux/netfilter_ipv4/ip_tables.h> | |
83 | +#include <linux/netfilter_ipv4/ipt_ipv4options.h> | |
84 | + | |
85 | +MODULE_LICENSE("GPL"); | |
86 | +MODULE_AUTHOR("Fabrice Marie <fabrice@netfilter.org>"); | |
87 | + | |
88 | +static int | |
89 | +match(const struct sk_buff *skb, | |
90 | + const struct net_device *in, | |
91 | + const struct net_device *out, | |
92 | + const struct xt_match *match, | |
93 | + const void *matchinfo, | |
94 | + int offset, | |
95 | + unsigned int protoff, | |
96 | + int *hotdrop) | |
97 | +{ | |
98 | + const struct ipt_ipv4options_info *info = matchinfo; /* match info for rule */ | |
99 | + const struct iphdr *iph = ip_hdr(skb); | |
100 | + const struct ip_options *opt; | |
101 | + | |
102 | + if (iph->ihl * 4 == sizeof(struct iphdr)) { | |
103 | + /* No options, so we match only the "DONTs" and the "IGNOREs" */ | |
104 | + | |
105 | + if (((info->options & IPT_IPV4OPTION_MATCH_ANY_OPT) == IPT_IPV4OPTION_MATCH_ANY_OPT) || | |
106 | + ((info->options & IPT_IPV4OPTION_MATCH_SSRR) == IPT_IPV4OPTION_MATCH_SSRR) || | |
107 | + ((info->options & IPT_IPV4OPTION_MATCH_LSRR) == IPT_IPV4OPTION_MATCH_LSRR) || | |
108 | + ((info->options & IPT_IPV4OPTION_MATCH_RR) == IPT_IPV4OPTION_MATCH_RR) || | |
109 | + ((info->options & IPT_IPV4OPTION_MATCH_TIMESTAMP) == IPT_IPV4OPTION_MATCH_TIMESTAMP) || | |
110 | + ((info->options & IPT_IPV4OPTION_MATCH_ROUTER_ALERT) == IPT_IPV4OPTION_MATCH_ROUTER_ALERT)) | |
111 | + return 0; | |
112 | + return 1; | |
113 | + } | |
114 | + else { | |
115 | + if ((info->options & IPT_IPV4OPTION_MATCH_ANY_OPT) == IPT_IPV4OPTION_MATCH_ANY_OPT) | |
116 | + /* there are options, and we don't need to care which one */ | |
117 | + return 1; | |
118 | + else { | |
119 | + if ((info->options & IPT_IPV4OPTION_DONT_MATCH_ANY_OPT) == IPT_IPV4OPTION_DONT_MATCH_ANY_OPT) | |
120 | + /* there are options but we don't want any ! */ | |
121 | + return 0; | |
122 | + } | |
123 | + } | |
124 | + | |
125 | + opt = &(IPCB(skb)->opt); | |
126 | + | |
127 | + /* source routing */ | |
128 | + if ((info->options & IPT_IPV4OPTION_MATCH_SSRR) == IPT_IPV4OPTION_MATCH_SSRR) { | |
129 | + if (!((opt->srr) && (opt->is_strictroute))) | |
130 | + return 0; | |
131 | + } | |
132 | + else if ((info->options & IPT_IPV4OPTION_MATCH_LSRR) == IPT_IPV4OPTION_MATCH_LSRR) { | |
133 | + if (!((opt->srr) && (!opt->is_strictroute))) | |
134 | + return 0; | |
135 | + } | |
136 | + else if ((info->options & IPT_IPV4OPTION_DONT_MATCH_SRR) == IPT_IPV4OPTION_DONT_MATCH_SRR) { | |
137 | + if (opt->srr) | |
138 | + return 0; | |
139 | + } | |
140 | + /* record route */ | |
141 | + if ((info->options & IPT_IPV4OPTION_MATCH_RR) == IPT_IPV4OPTION_MATCH_RR) { | |
142 | + if (!opt->rr) | |
143 | + return 0; | |
144 | + } | |
145 | + else if ((info->options & IPT_IPV4OPTION_DONT_MATCH_RR) == IPT_IPV4OPTION_DONT_MATCH_RR) { | |
146 | + if (opt->rr) | |
147 | + return 0; | |
148 | + } | |
149 | + /* timestamp */ | |
150 | + if ((info->options & IPT_IPV4OPTION_MATCH_TIMESTAMP) == IPT_IPV4OPTION_MATCH_TIMESTAMP) { | |
151 | + if (!opt->ts) | |
152 | + return 0; | |
153 | + } | |
154 | + else if ((info->options & IPT_IPV4OPTION_DONT_MATCH_TIMESTAMP) == IPT_IPV4OPTION_DONT_MATCH_TIMESTAMP) { | |
155 | + if (opt->ts) | |
156 | + return 0; | |
157 | + } | |
158 | + /* router-alert option */ | |
159 | + if ((info->options & IPT_IPV4OPTION_MATCH_ROUTER_ALERT) == IPT_IPV4OPTION_MATCH_ROUTER_ALERT) { | |
160 | + if (!opt->router_alert) | |
161 | + return 0; | |
162 | + } | |
163 | + else if ((info->options & IPT_IPV4OPTION_DONT_MATCH_ROUTER_ALERT) == IPT_IPV4OPTION_DONT_MATCH_ROUTER_ALERT) { | |
164 | + if (opt->router_alert) | |
165 | + return 0; | |
166 | + } | |
167 | + | |
168 | + /* we match ! */ | |
169 | + return 1; | |
170 | +} | |
171 | + | |
172 | +static int | |
173 | +checkentry(const char *tablename, | |
174 | + const void *ip, | |
175 | + const struct xt_match *match, | |
176 | + void *matchinfo, | |
177 | + | |
178 | + unsigned int hook_mask) | |
179 | +{ | |
180 | + const struct ipt_ipv4options_info *info = matchinfo; /* match info for rule */ | |
181 | + | |
182 | + | |
183 | + | |
184 | + /* Now check the coherence of the data ... */ | |
185 | + if (((info->options & IPT_IPV4OPTION_MATCH_ANY_OPT) == IPT_IPV4OPTION_MATCH_ANY_OPT) && | |
186 | + (((info->options & IPT_IPV4OPTION_DONT_MATCH_SRR) == IPT_IPV4OPTION_DONT_MATCH_SRR) || | |
187 | + ((info->options & IPT_IPV4OPTION_DONT_MATCH_RR) == IPT_IPV4OPTION_DONT_MATCH_RR) || | |
188 | + ((info->options & IPT_IPV4OPTION_DONT_MATCH_TIMESTAMP) == IPT_IPV4OPTION_DONT_MATCH_TIMESTAMP) || | |
189 | + ((info->options & IPT_IPV4OPTION_DONT_MATCH_ROUTER_ALERT) == IPT_IPV4OPTION_DONT_MATCH_ROUTER_ALERT) || | |
190 | + ((info->options & IPT_IPV4OPTION_DONT_MATCH_ANY_OPT) == IPT_IPV4OPTION_DONT_MATCH_ANY_OPT))) | |
191 | + return 0; /* opposites */ | |
192 | + if (((info->options & IPT_IPV4OPTION_DONT_MATCH_ANY_OPT) == IPT_IPV4OPTION_DONT_MATCH_ANY_OPT) && | |
193 | + (((info->options & IPT_IPV4OPTION_MATCH_LSRR) == IPT_IPV4OPTION_MATCH_LSRR) || | |
194 | + ((info->options & IPT_IPV4OPTION_MATCH_SSRR) == IPT_IPV4OPTION_MATCH_SSRR) || | |
195 | + ((info->options & IPT_IPV4OPTION_MATCH_RR) == IPT_IPV4OPTION_MATCH_RR) || | |
196 | + ((info->options & IPT_IPV4OPTION_MATCH_TIMESTAMP) == IPT_IPV4OPTION_MATCH_TIMESTAMP) || | |
197 | + ((info->options & IPT_IPV4OPTION_MATCH_ROUTER_ALERT) == IPT_IPV4OPTION_MATCH_ROUTER_ALERT) || | |
198 | + ((info->options & IPT_IPV4OPTION_MATCH_ANY_OPT) == IPT_IPV4OPTION_MATCH_ANY_OPT))) | |
199 | + return 0; /* opposites */ | |
200 | + if (((info->options & IPT_IPV4OPTION_MATCH_SSRR) == IPT_IPV4OPTION_MATCH_SSRR) && | |
201 | + ((info->options & IPT_IPV4OPTION_MATCH_LSRR) == IPT_IPV4OPTION_MATCH_LSRR)) | |
202 | + return 0; /* cannot match in the same time loose and strict source routing */ | |
203 | + if ((((info->options & IPT_IPV4OPTION_MATCH_SSRR) == IPT_IPV4OPTION_MATCH_SSRR) || | |
204 | + ((info->options & IPT_IPV4OPTION_MATCH_LSRR) == IPT_IPV4OPTION_MATCH_LSRR)) && | |
205 | + ((info->options & IPT_IPV4OPTION_DONT_MATCH_SRR) == IPT_IPV4OPTION_DONT_MATCH_SRR)) | |
206 | + return 0; /* opposites */ | |
207 | + if (((info->options & IPT_IPV4OPTION_MATCH_RR) == IPT_IPV4OPTION_MATCH_RR) && | |
208 | + ((info->options & IPT_IPV4OPTION_DONT_MATCH_RR) == IPT_IPV4OPTION_DONT_MATCH_RR)) | |
209 | + return 0; /* opposites */ | |
210 | + if (((info->options & IPT_IPV4OPTION_MATCH_TIMESTAMP) == IPT_IPV4OPTION_MATCH_TIMESTAMP) && | |
211 | + ((info->options & IPT_IPV4OPTION_DONT_MATCH_TIMESTAMP) == IPT_IPV4OPTION_DONT_MATCH_TIMESTAMP)) | |
212 | + return 0; /* opposites */ | |
213 | + if (((info->options & IPT_IPV4OPTION_MATCH_ROUTER_ALERT) == IPT_IPV4OPTION_MATCH_ROUTER_ALERT) && | |
214 | + ((info->options & IPT_IPV4OPTION_DONT_MATCH_ROUTER_ALERT) == IPT_IPV4OPTION_DONT_MATCH_ROUTER_ALERT)) | |
215 | + return 0; /* opposites */ | |
216 | + | |
217 | + /* everything looks ok. */ | |
218 | + return 1; | |
219 | +} | |
220 | + | |
221 | +static struct xt_match ipv4options_match = { | |
222 | + .name = "ipv4options", | |
223 | + .family = AF_INET, | |
224 | + .match = match, | |
225 | + .matchsize = sizeof(struct ipt_ipv4options_info), | |
226 | + .checkentry = checkentry, | |
227 | + .me = THIS_MODULE | |
228 | +}; | |
229 | + | |
230 | +static int __init init(void) | |
231 | +{ | |
232 | + return xt_register_match(&ipv4options_match); | |
233 | +} | |
234 | + | |
235 | +static void __exit fini(void) | |
236 | +{ | |
237 | + xt_unregister_match(&ipv4options_match); | |
238 | +} | |
239 | + | |
240 | +module_init(init); | |
241 | +module_exit(fini); |