1 /* Shared library add-on to iptables to add string matching support.
3 * Copyright (C) 2000 Emmanuel Roger <winfield@freegates.be>
5 * 2005-08-05 Pablo Neira Ayuso <pablo@eurodev.net>
6 * - reimplemented to use new string matching iptables match
7 * - add functionality to match packets by using window offsets
8 * - add functionality to select the string matching algorithm
11 * 29.12.2003: Michael Rash <mbr@cipherdyne.org>
12 * Fixed iptables save/restore for ascii strings
13 * that contain space chars, and hex strings that
14 * contain embedded NULL chars. Updated to print
15 * strings in hex mode if any non-printable char
16 * is contained within the string.
18 * 27.01.2001: Gianni Tedesco <gianni@ecsc.co.uk>
19 * Changed --tos to --string in save(). Also
20 * updated to work with slightly modified
32 #include <linux/netfilter/xt_string.h>
34 static void string_help(void)
37 "string match options:\n"
38 "--from Offset to start searching from\n"
39 "--to Offset to stop searching\n"
41 "--icase Ignore case (default: 0)\n"
42 "[!] --string string Match a string in a packet\n"
43 "[!] --hex-string string Match a hex string in a packet\n");
46 static const struct option string_opts[] = {
47 { "from", 1, NULL, '1' },
48 { "to", 1, NULL, '2' },
49 { "algo", 1, NULL, '3' },
50 { "string", 1, NULL, '4' },
51 { "hex-string", 1, NULL, '5' },
52 { "icase", 0, NULL, '6' },
56 static void string_init(struct xt_entry_match *m)
58 struct xt_string_info *i = (struct xt_string_info *) m->data;
60 if (i->to_offset == 0)
61 i->to_offset = UINT16_MAX;
65 parse_string(const char *s, struct xt_string_info *info)
67 /* xt_string does not need \0 at the end of the pattern */
68 if (strlen(s) <= XT_STRING_MAX_PATTERN_SIZE) {
69 strncpy(info->pattern, s, XT_STRING_MAX_PATTERN_SIZE);
70 info->patlen = strnlen(s, XT_STRING_MAX_PATTERN_SIZE);
73 xtables_error(PARAMETER_PROBLEM, "STRING too long \"%s\"", s);
77 parse_algo(const char *s, struct xt_string_info *info)
79 /* xt_string needs \0 for algo name */
80 if (strlen(s) < XT_STRING_MAX_ALGO_NAME_SIZE) {
81 strncpy(info->algo, s, XT_STRING_MAX_ALGO_NAME_SIZE);
84 xtables_error(PARAMETER_PROBLEM, "ALGO too long \"%s\"", s);
88 parse_hex_string(const char *s, struct xt_string_info *info)
90 int i=0, slen, sindex=0, schar;
91 short hex_f = 0, literal_f = 0;
97 xtables_error(PARAMETER_PROBLEM,
98 "STRING must contain at least one char");
102 if (s[i] == '\\' && !hex_f) {
104 } else if (s[i] == '\\') {
105 xtables_error(PARAMETER_PROBLEM,
106 "Cannot include literals in hex data");
107 } else if (s[i] == '|') {
112 /* get past any initial whitespace just after the '|' */
113 while (s[i+1] == ' ')
119 i++; /* advance to the next character */
124 xtables_error(PARAMETER_PROBLEM,
125 "Bad literal placement at end of string");
127 info->pattern[sindex] = s[i+1];
128 i += 2; /* skip over literal char */
132 xtables_error(PARAMETER_PROBLEM,
133 "Odd number of hex digits");
136 /* must end with a "|" */
137 xtables_error(PARAMETER_PROBLEM, "Invalid hex block");
139 if (! isxdigit(s[i])) /* check for valid hex char */
140 xtables_error(PARAMETER_PROBLEM, "Invalid hex char '%c'", s[i]);
141 if (! isxdigit(s[i+1])) /* check for valid hex char */
142 xtables_error(PARAMETER_PROBLEM, "Invalid hex char '%c'", s[i+1]);
146 if (! sscanf(hextmp, "%x", &schar))
147 xtables_error(PARAMETER_PROBLEM,
148 "Invalid hex char `%c'", s[i]);
149 info->pattern[sindex] = (char) schar;
151 i += 3; /* spaces included in the hex block */
154 } else { /* the char is not part of hex data, so just copy */
155 info->pattern[sindex] = s[i];
158 if (sindex > XT_STRING_MAX_PATTERN_SIZE)
159 xtables_error(PARAMETER_PROBLEM, "STRING too long \"%s\"", s);
162 info->patlen = sindex;
172 string_parse(int c, char **argv, int invert, unsigned int *flags,
173 const void *entry, struct xt_entry_match **match)
175 struct xt_string_info *stringinfo =
176 (struct xt_string_info *)(*match)->data;
177 const int revision = (*match)->u.user.revision;
182 xtables_error(PARAMETER_PROBLEM,
183 "Can't specify multiple --from");
184 stringinfo->from_offset = atoi(optarg);
189 xtables_error(PARAMETER_PROBLEM,
190 "Can't specify multiple --to");
191 stringinfo->to_offset = atoi(optarg);
196 xtables_error(PARAMETER_PROBLEM,
197 "Can't specify multiple --algo");
198 parse_algo(optarg, stringinfo);
203 xtables_error(PARAMETER_PROBLEM,
204 "Can't specify multiple --string");
205 xtables_check_inverse(optarg, &invert, &optind, 0);
206 parse_string(argv[optind-1], stringinfo);
209 stringinfo->u.v0.invert = 1;
211 stringinfo->u.v1.flags |= XT_STRING_FLAG_INVERT;
218 xtables_error(PARAMETER_PROBLEM,
219 "Can't specify multiple --hex-string");
221 xtables_check_inverse(optarg, &invert, &optind, 0);
222 parse_hex_string(argv[optind-1], stringinfo); /* sets length */
225 stringinfo->u.v0.invert = 1;
227 stringinfo->u.v1.flags |= XT_STRING_FLAG_INVERT;
234 xtables_error(VERSION_PROBLEM,
235 "Kernel doesn't support --icase");
237 stringinfo->u.v1.flags |= XT_STRING_FLAG_IGNORECASE;
247 static void string_check(unsigned int flags)
249 if (!(flags & STRING))
250 xtables_error(PARAMETER_PROBLEM,
251 "STRING match: You must specify `--string' or "
254 xtables_error(PARAMETER_PROBLEM,
255 "STRING match: You must specify `--algo'");
258 /* Test to see if the string contains non-printable chars or quotes */
259 static unsigned short int
260 is_hex_string(const char *str, const unsigned short int len)
263 for (i=0; i < len; i++)
264 if (! isprint(str[i]))
265 return 1; /* string contains at least one non-printable char */
266 /* use hex output if the last char is a "\" */
267 if ((unsigned char) str[len-1] == 0x5c)
272 /* Print string with "|" chars included as one would pass to --hex-string */
274 print_hex_string(const char *str, const unsigned short int len)
277 /* start hex block */
279 for (i=0; i < len; i++) {
280 /* see if we need to prepend a zero */
281 if ((unsigned char) str[i] <= 0x0F)
282 printf("0%x", (unsigned char) str[i]);
284 printf("%x", (unsigned char) str[i]);
286 /* close hex block */
291 print_string(const char *str, const unsigned short int len)
295 for (i=0; i < len; i++) {
296 if ((unsigned char) str[i] == 0x22) /* escape any embedded quotes */
298 printf("%c", (unsigned char) str[i]);
300 printf("\" "); /* closing space and quote */
304 string_print(const void *ip, const struct xt_entry_match *match, int numeric)
306 const struct xt_string_info *info =
307 (const struct xt_string_info*) match->data;
308 const int revision = match->u.user.revision;
309 int invert = (revision == 0 ? info->u.v0.invert :
310 info->u.v1.flags & XT_STRING_FLAG_INVERT);
312 if (is_hex_string(info->pattern, info->patlen)) {
313 printf("STRING match %s", invert ? "!" : "");
314 print_hex_string(info->pattern, info->patlen);
316 printf("STRING match %s", invert ? "!" : "");
317 print_string(info->pattern, info->patlen);
319 printf("ALGO name %s ", info->algo);
320 if (info->from_offset != 0)
321 printf("FROM %u ", info->from_offset);
322 if (info->to_offset != 0)
323 printf("TO %u ", info->to_offset);
324 if (revision > 0 && info->u.v1.flags & XT_STRING_FLAG_IGNORECASE)
328 static void string_save(const void *ip, const struct xt_entry_match *match)
330 const struct xt_string_info *info =
331 (const struct xt_string_info*) match->data;
332 const int revision = match->u.user.revision;
333 int invert = (revision == 0 ? info->u.v0.invert :
334 info->u.v1.flags & XT_STRING_FLAG_INVERT);
336 if (is_hex_string(info->pattern, info->patlen)) {
337 printf("%s--hex-string ", (invert) ? "! ": "");
338 print_hex_string(info->pattern, info->patlen);
340 printf("%s--string ", (invert) ? "! ": "");
341 print_string(info->pattern, info->patlen);
343 printf("--algo %s ", info->algo);
344 if (info->from_offset != 0)
345 printf("--from %u ", info->from_offset);
346 if (info->to_offset != 0)
347 printf("--to %u ", info->to_offset);
348 if (revision > 0 && info->u.v1.flags & XT_STRING_FLAG_IGNORECASE)
353 static struct xtables_match string_match = {
357 .version = XTABLES_VERSION,
358 .size = XT_ALIGN(sizeof(struct xt_string_info)),
359 .userspacesize = offsetof(struct xt_string_info, config),
362 .parse = string_parse,
363 .final_check = string_check,
364 .print = string_print,
366 .extra_opts = string_opts,
369 static struct xtables_match string_match_v1 = {
373 .version = XTABLES_VERSION,
374 .size = XT_ALIGN(sizeof(struct xt_string_info)),
375 .userspacesize = offsetof(struct xt_string_info, config),
378 .parse = string_parse,
379 .final_check = string_check,
380 .print = string_print,
382 .extra_opts = string_opts,
387 xtables_register_match(&string_match);
388 xtables_register_match(&string_match_v1);