Emmanuel Roger | 3071913 | 2000-10-04 15:19:31 +0000 | [diff] [blame] | 1 | /* Shared library add-on to iptables to add string matching support. |
| 2 | * |
| 3 | * Copyright (C) 2000 Emmanuel Roger <winfield@freegates.be> |
András Kis-Szabó | 764316a | 2001-02-26 17:31:20 +0000 | [diff] [blame] | 4 | * |
Pablo Neira | c6fbf41 | 2005-08-28 08:09:44 +0000 | [diff] [blame] | 5 | * 2005-08-05 Pablo Neira Ayuso <pablo@eurodev.net> |
| 6 | * - reimplemented to use new string matching iptables match |
| 7 | * - add functionality to match packets by using window offsets |
| 8 | * - add functionality to select the string matching algorithm |
| 9 | * |
András Kis-Szabó | 764316a | 2001-02-26 17:31:20 +0000 | [diff] [blame] | 10 | * ChangeLog |
Michael Rash | b807fb3 | 2004-01-05 09:50:12 +0000 | [diff] [blame] | 11 | * 29.12.2003: Michael Rash <mbr@cipherdyne.org> |
| 12 | * Fixed iptables save/restore for ascii strings |
| 13 | * that contain space chars, and hex strings that |
| 14 | * contain embedded NULL chars. Updated to print |
| 15 | * strings in hex mode if any non-printable char |
| 16 | * is contained within the string. |
| 17 | * |
András Kis-Szabó | 764316a | 2001-02-26 17:31:20 +0000 | [diff] [blame] | 18 | * 27.01.2001: Gianni Tedesco <gianni@ecsc.co.uk> |
| 19 | * Changed --tos to --string in save(). Also |
| 20 | * updated to work with slightly modified |
| 21 | * ipt_string_info. |
Emmanuel Roger | 3071913 | 2000-10-04 15:19:31 +0000 | [diff] [blame] | 22 | */ |
| 23 | #include <stdio.h> |
| 24 | #include <netdb.h> |
| 25 | #include <string.h> |
| 26 | #include <stdlib.h> |
| 27 | #include <getopt.h> |
Michael Rash | f8ac329 | 2003-02-26 17:34:13 +0000 | [diff] [blame] | 28 | #include <ctype.h> |
Yasuyuki KOZAKAI | 6ac58e3 | 2007-07-24 06:50:03 +0000 | [diff] [blame] | 29 | #include <xtables.h> |
Pablo Neira | c6fbf41 | 2005-08-28 08:09:44 +0000 | [diff] [blame] | 30 | #include <stddef.h> |
Yasuyuki KOZAKAI | 6ac58e3 | 2007-07-24 06:50:03 +0000 | [diff] [blame] | 31 | #include <linux/netfilter/xt_string.h> |
Emmanuel Roger | 3071913 | 2000-10-04 15:19:31 +0000 | [diff] [blame] | 32 | |
Jan Engelhardt | 181dead | 2007-10-04 16:27:07 +0000 | [diff] [blame] | 33 | static void string_help(void) |
Emmanuel Roger | 3071913 | 2000-10-04 15:19:31 +0000 | [diff] [blame] | 34 | { |
| 35 | printf( |
Jan Engelhardt | 8b7c64d | 2008-04-15 11:48:25 +0200 | [diff] [blame] | 36 | "string match options:\n" |
Pablo Neira | c6fbf41 | 2005-08-28 08:09:44 +0000 | [diff] [blame] | 37 | "--from Offset to start searching from\n" |
| 38 | "--to Offset to stop searching\n" |
Joonwoo Park | 78d2d14 | 2008-07-07 13:32:25 +0200 | [diff] [blame] | 39 | "--algo Algorithm\n" |
| 40 | "--icase Ignore case (default: 0)\n" |
Jan Engelhardt | 9b488b9 | 2008-06-08 19:11:51 +0200 | [diff] [blame] | 41 | "[!] --string string Match a string in a packet\n" |
| 42 | "[!] --hex-string string Match a hex string in a packet\n"); |
Emmanuel Roger | 3071913 | 2000-10-04 15:19:31 +0000 | [diff] [blame] | 43 | } |
| 44 | |
Jan Engelhardt | 181dead | 2007-10-04 16:27:07 +0000 | [diff] [blame] | 45 | static const struct option string_opts[] = { |
Patrick McHardy | 500f483 | 2007-09-08 15:59:04 +0000 | [diff] [blame] | 46 | { "from", 1, NULL, '1' }, |
| 47 | { "to", 1, NULL, '2' }, |
| 48 | { "algo", 1, NULL, '3' }, |
| 49 | { "string", 1, NULL, '4' }, |
| 50 | { "hex-string", 1, NULL, '5' }, |
Joonwoo Park | 78d2d14 | 2008-07-07 13:32:25 +0200 | [diff] [blame] | 51 | { "icase", 0, NULL, '6' }, |
Max Kellermann | 9ee386a | 2008-01-29 13:48:05 +0000 | [diff] [blame] | 52 | { .name = NULL } |
Emmanuel Roger | 3071913 | 2000-10-04 15:19:31 +0000 | [diff] [blame] | 53 | }; |
| 54 | |
Jan Engelhardt | 181dead | 2007-10-04 16:27:07 +0000 | [diff] [blame] | 55 | static void string_init(struct xt_entry_match *m) |
Pablo Neira | c6fbf41 | 2005-08-28 08:09:44 +0000 | [diff] [blame] | 56 | { |
Yasuyuki KOZAKAI | 6ac58e3 | 2007-07-24 06:50:03 +0000 | [diff] [blame] | 57 | struct xt_string_info *i = (struct xt_string_info *) m->data; |
Pablo Neira | c6fbf41 | 2005-08-28 08:09:44 +0000 | [diff] [blame] | 58 | |
| 59 | if (i->to_offset == 0) |
Jan Engelhardt | a809754 | 2009-01-27 17:39:01 +0100 | [diff] [blame] | 60 | i->to_offset = UINT16_MAX; |
Pablo Neira | c6fbf41 | 2005-08-28 08:09:44 +0000 | [diff] [blame] | 61 | } |
| 62 | |
| 63 | static void |
Yasuyuki KOZAKAI | 6ac58e3 | 2007-07-24 06:50:03 +0000 | [diff] [blame] | 64 | parse_string(const char *s, struct xt_string_info *info) |
Emmanuel Roger | 3071913 | 2000-10-04 15:19:31 +0000 | [diff] [blame] | 65 | { |
Yasuyuki KOZAKAI | 6ac58e3 | 2007-07-24 06:50:03 +0000 | [diff] [blame] | 66 | if (strlen(s) <= XT_STRING_MAX_PATTERN_SIZE) { |
| 67 | strncpy(info->pattern, s, XT_STRING_MAX_PATTERN_SIZE); |
Pablo Neira | c6fbf41 | 2005-08-28 08:09:44 +0000 | [diff] [blame] | 68 | info->patlen = strlen(s); |
| 69 | return; |
| 70 | } |
| 71 | exit_error(PARAMETER_PROBLEM, "STRING too long `%s'", s); |
Michael Rash | 96d8593 | 2003-04-21 07:27:03 +0000 | [diff] [blame] | 72 | } |
| 73 | |
Pablo Neira | c6fbf41 | 2005-08-28 08:09:44 +0000 | [diff] [blame] | 74 | static void |
Yasuyuki KOZAKAI | 6ac58e3 | 2007-07-24 06:50:03 +0000 | [diff] [blame] | 75 | parse_algo(const char *s, struct xt_string_info *info) |
Pablo Neira | c6fbf41 | 2005-08-28 08:09:44 +0000 | [diff] [blame] | 76 | { |
Yasuyuki KOZAKAI | 6ac58e3 | 2007-07-24 06:50:03 +0000 | [diff] [blame] | 77 | if (strlen(s) <= XT_STRING_MAX_ALGO_NAME_SIZE) { |
| 78 | strncpy(info->algo, s, XT_STRING_MAX_ALGO_NAME_SIZE); |
Pablo Neira | c6fbf41 | 2005-08-28 08:09:44 +0000 | [diff] [blame] | 79 | return; |
| 80 | } |
| 81 | exit_error(PARAMETER_PROBLEM, "ALGO too long `%s'", s); |
| 82 | } |
Stephane Ouellette | 451f3ea | 2003-04-27 12:59:00 +0000 | [diff] [blame] | 83 | |
Michael Rash | 96d8593 | 2003-04-21 07:27:03 +0000 | [diff] [blame] | 84 | static void |
Yasuyuki KOZAKAI | 6ac58e3 | 2007-07-24 06:50:03 +0000 | [diff] [blame] | 85 | parse_hex_string(const char *s, struct xt_string_info *info) |
Michael Rash | 96d8593 | 2003-04-21 07:27:03 +0000 | [diff] [blame] | 86 | { |
Michael Rash | f8ac329 | 2003-02-26 17:34:13 +0000 | [diff] [blame] | 87 | int i=0, slen, sindex=0, schar; |
| 88 | short hex_f = 0, literal_f = 0; |
| 89 | char hextmp[3]; |
| 90 | |
| 91 | slen = strlen(s); |
| 92 | |
| 93 | if (slen == 0) { |
| 94 | exit_error(PARAMETER_PROBLEM, |
| 95 | "STRING must contain at least one char"); |
| 96 | } |
| 97 | |
| 98 | while (i < slen) { |
| 99 | if (s[i] == '\\' && !hex_f) { |
| 100 | literal_f = 1; |
| 101 | } else if (s[i] == '\\') { |
| 102 | exit_error(PARAMETER_PROBLEM, |
| 103 | "Cannot include literals in hex data"); |
| 104 | } else if (s[i] == '|') { |
| 105 | if (hex_f) |
| 106 | hex_f = 0; |
Michael Rash | b807fb3 | 2004-01-05 09:50:12 +0000 | [diff] [blame] | 107 | else { |
Michael Rash | f8ac329 | 2003-02-26 17:34:13 +0000 | [diff] [blame] | 108 | hex_f = 1; |
Michael Rash | b807fb3 | 2004-01-05 09:50:12 +0000 | [diff] [blame] | 109 | /* get past any initial whitespace just after the '|' */ |
| 110 | while (s[i+1] == ' ') |
| 111 | i++; |
| 112 | } |
Michael Rash | f8ac329 | 2003-02-26 17:34:13 +0000 | [diff] [blame] | 113 | if (i+1 >= slen) |
| 114 | break; |
| 115 | else |
| 116 | i++; /* advance to the next character */ |
| 117 | } |
| 118 | |
| 119 | if (literal_f) { |
| 120 | if (i+1 >= slen) { |
| 121 | exit_error(PARAMETER_PROBLEM, |
| 122 | "Bad literal placement at end of string"); |
| 123 | } |
Pablo Neira | c6fbf41 | 2005-08-28 08:09:44 +0000 | [diff] [blame] | 124 | info->pattern[sindex] = s[i+1]; |
Michael Rash | f8ac329 | 2003-02-26 17:34:13 +0000 | [diff] [blame] | 125 | i += 2; /* skip over literal char */ |
| 126 | literal_f = 0; |
| 127 | } else if (hex_f) { |
| 128 | if (i+1 >= slen) { |
| 129 | exit_error(PARAMETER_PROBLEM, |
| 130 | "Odd number of hex digits"); |
| 131 | } |
| 132 | if (i+2 >= slen) { |
| 133 | /* must end with a "|" */ |
| 134 | exit_error(PARAMETER_PROBLEM, "Invalid hex block"); |
| 135 | } |
Michael Rash | 96d8593 | 2003-04-21 07:27:03 +0000 | [diff] [blame] | 136 | if (! isxdigit(s[i])) /* check for valid hex char */ |
| 137 | exit_error(PARAMETER_PROBLEM, "Invalid hex char `%c'", s[i]); |
| 138 | if (! isxdigit(s[i+1])) /* check for valid hex char */ |
| 139 | exit_error(PARAMETER_PROBLEM, "Invalid hex char `%c'", s[i+1]); |
Michael Rash | f8ac329 | 2003-02-26 17:34:13 +0000 | [diff] [blame] | 140 | hextmp[0] = s[i]; |
| 141 | hextmp[1] = s[i+1]; |
| 142 | hextmp[2] = '\0'; |
| 143 | if (! sscanf(hextmp, "%x", &schar)) |
| 144 | exit_error(PARAMETER_PROBLEM, |
| 145 | "Invalid hex char `%c'", s[i]); |
Pablo Neira | c6fbf41 | 2005-08-28 08:09:44 +0000 | [diff] [blame] | 146 | info->pattern[sindex] = (char) schar; |
Michael Rash | f8ac329 | 2003-02-26 17:34:13 +0000 | [diff] [blame] | 147 | if (s[i+2] == ' ') |
| 148 | i += 3; /* spaces included in the hex block */ |
| 149 | else |
| 150 | i += 2; |
| 151 | } else { /* the char is not part of hex data, so just copy */ |
Pablo Neira | c6fbf41 | 2005-08-28 08:09:44 +0000 | [diff] [blame] | 152 | info->pattern[sindex] = s[i]; |
Michael Rash | f8ac329 | 2003-02-26 17:34:13 +0000 | [diff] [blame] | 153 | i++; |
| 154 | } |
Yasuyuki KOZAKAI | 6ac58e3 | 2007-07-24 06:50:03 +0000 | [diff] [blame] | 155 | if (sindex > XT_STRING_MAX_PATTERN_SIZE) |
Michael Rash | f8ac329 | 2003-02-26 17:34:13 +0000 | [diff] [blame] | 156 | exit_error(PARAMETER_PROBLEM, "STRING too long `%s'", s); |
| 157 | sindex++; |
| 158 | } |
Pablo Neira | c6fbf41 | 2005-08-28 08:09:44 +0000 | [diff] [blame] | 159 | info->patlen = sindex; |
Emmanuel Roger | 3071913 | 2000-10-04 15:19:31 +0000 | [diff] [blame] | 160 | } |
| 161 | |
Pablo Neira | c6fbf41 | 2005-08-28 08:09:44 +0000 | [diff] [blame] | 162 | #define STRING 0x1 |
| 163 | #define ALGO 0x2 |
| 164 | #define FROM 0x4 |
| 165 | #define TO 0x8 |
Joonwoo Park | 78d2d14 | 2008-07-07 13:32:25 +0200 | [diff] [blame] | 166 | #define ICASE 0x10 |
Stephane Ouellette | 451f3ea | 2003-04-27 12:59:00 +0000 | [diff] [blame] | 167 | |
Emmanuel Roger | 3071913 | 2000-10-04 15:19:31 +0000 | [diff] [blame] | 168 | static int |
Jan Engelhardt | 181dead | 2007-10-04 16:27:07 +0000 | [diff] [blame] | 169 | string_parse(int c, char **argv, int invert, unsigned int *flags, |
| 170 | const void *entry, struct xt_entry_match **match) |
Emmanuel Roger | 3071913 | 2000-10-04 15:19:31 +0000 | [diff] [blame] | 171 | { |
Joonwoo Park | 78d2d14 | 2008-07-07 13:32:25 +0200 | [diff] [blame] | 172 | struct xt_string_info *stringinfo = |
| 173 | (struct xt_string_info *)(*match)->data; |
| 174 | const int revision = (*match)->u.user.revision; |
Emmanuel Roger | 3071913 | 2000-10-04 15:19:31 +0000 | [diff] [blame] | 175 | |
| 176 | switch (c) { |
| 177 | case '1': |
Pablo Neira | c6fbf41 | 2005-08-28 08:09:44 +0000 | [diff] [blame] | 178 | if (*flags & FROM) |
Stephane Ouellette | 451f3ea | 2003-04-27 12:59:00 +0000 | [diff] [blame] | 179 | exit_error(PARAMETER_PROBLEM, |
Pablo Neira | c6fbf41 | 2005-08-28 08:09:44 +0000 | [diff] [blame] | 180 | "Can't specify multiple --from"); |
| 181 | stringinfo->from_offset = atoi(optarg); |
| 182 | *flags |= FROM; |
| 183 | break; |
| 184 | case '2': |
| 185 | if (*flags & TO) |
| 186 | exit_error(PARAMETER_PROBLEM, |
| 187 | "Can't specify multiple --to"); |
| 188 | stringinfo->to_offset = atoi(optarg); |
| 189 | *flags |= TO; |
| 190 | break; |
| 191 | case '3': |
| 192 | if (*flags & ALGO) |
| 193 | exit_error(PARAMETER_PROBLEM, |
| 194 | "Can't specify multiple --algo"); |
| 195 | parse_algo(optarg, stringinfo); |
| 196 | *flags |= ALGO; |
| 197 | break; |
| 198 | case '4': |
| 199 | if (*flags & STRING) |
| 200 | exit_error(PARAMETER_PROBLEM, |
| 201 | "Can't specify multiple --string"); |
Harald Welte | b77f1da | 2002-03-14 11:35:58 +0000 | [diff] [blame] | 202 | check_inverse(optarg, &invert, &optind, 0); |
Emmanuel Roger | 3071913 | 2000-10-04 15:19:31 +0000 | [diff] [blame] | 203 | parse_string(argv[optind-1], stringinfo); |
Joonwoo Park | 78d2d14 | 2008-07-07 13:32:25 +0200 | [diff] [blame] | 204 | if (invert) { |
| 205 | if (revision == 0) |
| 206 | stringinfo->u.v0.invert = 1; |
| 207 | else |
| 208 | stringinfo->u.v1.flags |= XT_STRING_FLAG_INVERT; |
| 209 | } |
Pablo Neira | c6fbf41 | 2005-08-28 08:09:44 +0000 | [diff] [blame] | 210 | stringinfo->patlen=strlen((char *)&stringinfo->pattern); |
| 211 | *flags |= STRING; |
Michael Rash | 96d8593 | 2003-04-21 07:27:03 +0000 | [diff] [blame] | 212 | break; |
| 213 | |
Pablo Neira | c6fbf41 | 2005-08-28 08:09:44 +0000 | [diff] [blame] | 214 | case '5': |
| 215 | if (*flags & STRING) |
Stephane Ouellette | 451f3ea | 2003-04-27 12:59:00 +0000 | [diff] [blame] | 216 | exit_error(PARAMETER_PROBLEM, |
Pablo Neira | c6fbf41 | 2005-08-28 08:09:44 +0000 | [diff] [blame] | 217 | "Can't specify multiple --hex-string"); |
Stephane Ouellette | 451f3ea | 2003-04-27 12:59:00 +0000 | [diff] [blame] | 218 | |
Michael Rash | 96d8593 | 2003-04-21 07:27:03 +0000 | [diff] [blame] | 219 | check_inverse(optarg, &invert, &optind, 0); |
| 220 | parse_hex_string(argv[optind-1], stringinfo); /* sets length */ |
Joonwoo Park | 78d2d14 | 2008-07-07 13:32:25 +0200 | [diff] [blame] | 221 | if (invert) { |
| 222 | if (revision == 0) |
| 223 | stringinfo->u.v0.invert = 1; |
| 224 | else |
| 225 | stringinfo->u.v1.flags |= XT_STRING_FLAG_INVERT; |
| 226 | } |
Pablo Neira | c6fbf41 | 2005-08-28 08:09:44 +0000 | [diff] [blame] | 227 | *flags |= STRING; |
Emmanuel Roger | 3071913 | 2000-10-04 15:19:31 +0000 | [diff] [blame] | 228 | break; |
| 229 | |
Joonwoo Park | 78d2d14 | 2008-07-07 13:32:25 +0200 | [diff] [blame] | 230 | case '6': |
| 231 | if (revision == 0) |
| 232 | exit_error(VERSION_PROBLEM, |
| 233 | "Kernel doesn't support --icase"); |
| 234 | |
| 235 | stringinfo->u.v1.flags |= XT_STRING_FLAG_IGNORECASE; |
| 236 | *flags |= ICASE; |
| 237 | break; |
| 238 | |
Emmanuel Roger | 3071913 | 2000-10-04 15:19:31 +0000 | [diff] [blame] | 239 | default: |
| 240 | return 0; |
| 241 | } |
| 242 | return 1; |
| 243 | } |
| 244 | |
Jan Engelhardt | 181dead | 2007-10-04 16:27:07 +0000 | [diff] [blame] | 245 | static void string_check(unsigned int flags) |
Emmanuel Roger | 3071913 | 2000-10-04 15:19:31 +0000 | [diff] [blame] | 246 | { |
Pablo Neira | c6fbf41 | 2005-08-28 08:09:44 +0000 | [diff] [blame] | 247 | if (!(flags & STRING)) |
Emmanuel Roger | 3071913 | 2000-10-04 15:19:31 +0000 | [diff] [blame] | 248 | exit_error(PARAMETER_PROBLEM, |
Pablo Neira | c6fbf41 | 2005-08-28 08:09:44 +0000 | [diff] [blame] | 249 | "STRING match: You must specify `--string' or " |
| 250 | "`--hex-string'"); |
| 251 | if (!(flags & ALGO)) |
| 252 | exit_error(PARAMETER_PROBLEM, |
| 253 | "STRING match: You must specify `--algo'"); |
Emmanuel Roger | 3071913 | 2000-10-04 15:19:31 +0000 | [diff] [blame] | 254 | } |
| 255 | |
Michael Rash | b807fb3 | 2004-01-05 09:50:12 +0000 | [diff] [blame] | 256 | /* Test to see if the string contains non-printable chars or quotes */ |
| 257 | static unsigned short int |
| 258 | is_hex_string(const char *str, const unsigned short int len) |
| 259 | { |
| 260 | unsigned int i; |
| 261 | for (i=0; i < len; i++) |
| 262 | if (! isprint(str[i])) |
| 263 | return 1; /* string contains at least one non-printable char */ |
| 264 | /* use hex output if the last char is a "\" */ |
| 265 | if ((unsigned char) str[len-1] == 0x5c) |
| 266 | return 1; |
| 267 | return 0; |
| 268 | } |
| 269 | |
| 270 | /* Print string with "|" chars included as one would pass to --hex-string */ |
| 271 | static void |
| 272 | print_hex_string(const char *str, const unsigned short int len) |
| 273 | { |
| 274 | unsigned int i; |
| 275 | /* start hex block */ |
| 276 | printf("\"|"); |
| 277 | for (i=0; i < len; i++) { |
| 278 | /* see if we need to prepend a zero */ |
| 279 | if ((unsigned char) str[i] <= 0x0F) |
| 280 | printf("0%x", (unsigned char) str[i]); |
| 281 | else |
| 282 | printf("%x", (unsigned char) str[i]); |
| 283 | } |
| 284 | /* close hex block */ |
| 285 | printf("|\" "); |
| 286 | } |
| 287 | |
| 288 | static void |
| 289 | print_string(const char *str, const unsigned short int len) |
| 290 | { |
| 291 | unsigned int i; |
| 292 | printf("\""); |
| 293 | for (i=0; i < len; i++) { |
| 294 | if ((unsigned char) str[i] == 0x22) /* escape any embedded quotes */ |
| 295 | printf("%c", 0x5c); |
| 296 | printf("%c", (unsigned char) str[i]); |
| 297 | } |
| 298 | printf("\" "); /* closing space and quote */ |
| 299 | } |
Stephane Ouellette | 451f3ea | 2003-04-27 12:59:00 +0000 | [diff] [blame] | 300 | |
Emmanuel Roger | 3071913 | 2000-10-04 15:19:31 +0000 | [diff] [blame] | 301 | static void |
Jan Engelhardt | 181dead | 2007-10-04 16:27:07 +0000 | [diff] [blame] | 302 | string_print(const void *ip, const struct xt_entry_match *match, int numeric) |
Emmanuel Roger | 3071913 | 2000-10-04 15:19:31 +0000 | [diff] [blame] | 303 | { |
Yasuyuki KOZAKAI | 6ac58e3 | 2007-07-24 06:50:03 +0000 | [diff] [blame] | 304 | const struct xt_string_info *info = |
| 305 | (const struct xt_string_info*) match->data; |
Joonwoo Park | 78d2d14 | 2008-07-07 13:32:25 +0200 | [diff] [blame] | 306 | const int revision = match->u.user.revision; |
| 307 | int invert = (revision == 0 ? info->u.v0.invert : |
| 308 | info->u.v1.flags & XT_STRING_FLAG_INVERT); |
Stephane Ouellette | 451f3ea | 2003-04-27 12:59:00 +0000 | [diff] [blame] | 309 | |
Pablo Neira | c6fbf41 | 2005-08-28 08:09:44 +0000 | [diff] [blame] | 310 | if (is_hex_string(info->pattern, info->patlen)) { |
Joonwoo Park | 78d2d14 | 2008-07-07 13:32:25 +0200 | [diff] [blame] | 311 | printf("STRING match %s", invert ? "!" : ""); |
Pablo Neira | c6fbf41 | 2005-08-28 08:09:44 +0000 | [diff] [blame] | 312 | print_hex_string(info->pattern, info->patlen); |
Michael Rash | b807fb3 | 2004-01-05 09:50:12 +0000 | [diff] [blame] | 313 | } else { |
Joonwoo Park | 78d2d14 | 2008-07-07 13:32:25 +0200 | [diff] [blame] | 314 | printf("STRING match %s", invert ? "!" : ""); |
Pablo Neira | c6fbf41 | 2005-08-28 08:09:44 +0000 | [diff] [blame] | 315 | print_string(info->pattern, info->patlen); |
Michael Rash | b807fb3 | 2004-01-05 09:50:12 +0000 | [diff] [blame] | 316 | } |
Pablo Neira | c6fbf41 | 2005-08-28 08:09:44 +0000 | [diff] [blame] | 317 | printf("ALGO name %s ", info->algo); |
| 318 | if (info->from_offset != 0) |
| 319 | printf("FROM %u ", info->from_offset); |
| 320 | if (info->to_offset != 0) |
Patrick McHardy | 8a0b6ea | 2007-01-11 08:23:17 +0000 | [diff] [blame] | 321 | printf("TO %u ", info->to_offset); |
Joonwoo Park | 78d2d14 | 2008-07-07 13:32:25 +0200 | [diff] [blame] | 322 | if (revision > 0 && info->u.v1.flags & XT_STRING_FLAG_IGNORECASE) |
| 323 | printf("ICASE "); |
Emmanuel Roger | 3071913 | 2000-10-04 15:19:31 +0000 | [diff] [blame] | 324 | } |
| 325 | |
Jan Engelhardt | 181dead | 2007-10-04 16:27:07 +0000 | [diff] [blame] | 326 | static void string_save(const void *ip, const struct xt_entry_match *match) |
Emmanuel Roger | 3071913 | 2000-10-04 15:19:31 +0000 | [diff] [blame] | 327 | { |
Yasuyuki KOZAKAI | 6ac58e3 | 2007-07-24 06:50:03 +0000 | [diff] [blame] | 328 | const struct xt_string_info *info = |
| 329 | (const struct xt_string_info*) match->data; |
Joonwoo Park | 78d2d14 | 2008-07-07 13:32:25 +0200 | [diff] [blame] | 330 | const int revision = match->u.user.revision; |
| 331 | int invert = (revision == 0 ? info->u.v0.invert : |
| 332 | info->u.v1.flags & XT_STRING_FLAG_INVERT); |
Stephane Ouellette | 451f3ea | 2003-04-27 12:59:00 +0000 | [diff] [blame] | 333 | |
Pablo Neira | c6fbf41 | 2005-08-28 08:09:44 +0000 | [diff] [blame] | 334 | if (is_hex_string(info->pattern, info->patlen)) { |
Jan Engelhardt | cea9f71 | 2008-12-09 15:06:20 +0100 | [diff] [blame] | 335 | printf("%s--hex-string ", (invert) ? "! ": ""); |
Pablo Neira | c6fbf41 | 2005-08-28 08:09:44 +0000 | [diff] [blame] | 336 | print_hex_string(info->pattern, info->patlen); |
Michael Rash | b807fb3 | 2004-01-05 09:50:12 +0000 | [diff] [blame] | 337 | } else { |
Jan Engelhardt | cea9f71 | 2008-12-09 15:06:20 +0100 | [diff] [blame] | 338 | printf("%s--string ", (invert) ? "! ": ""); |
Pablo Neira | c6fbf41 | 2005-08-28 08:09:44 +0000 | [diff] [blame] | 339 | print_string(info->pattern, info->patlen); |
Michael Rash | b807fb3 | 2004-01-05 09:50:12 +0000 | [diff] [blame] | 340 | } |
Pablo Neira | c6fbf41 | 2005-08-28 08:09:44 +0000 | [diff] [blame] | 341 | printf("--algo %s ", info->algo); |
| 342 | if (info->from_offset != 0) |
Michael Rash | 0829a2b | 2006-01-30 09:02:45 +0000 | [diff] [blame] | 343 | printf("--from %u ", info->from_offset); |
Pablo Neira | c6fbf41 | 2005-08-28 08:09:44 +0000 | [diff] [blame] | 344 | if (info->to_offset != 0) |
Michael Rash | 0829a2b | 2006-01-30 09:02:45 +0000 | [diff] [blame] | 345 | printf("--to %u ", info->to_offset); |
Joonwoo Park | 78d2d14 | 2008-07-07 13:32:25 +0200 | [diff] [blame] | 346 | if (revision > 0 && info->u.v1.flags & XT_STRING_FLAG_IGNORECASE) |
| 347 | printf("--icase "); |
Emmanuel Roger | 3071913 | 2000-10-04 15:19:31 +0000 | [diff] [blame] | 348 | } |
| 349 | |
Stephane Ouellette | 451f3ea | 2003-04-27 12:59:00 +0000 | [diff] [blame] | 350 | |
Jan Engelhardt | 181dead | 2007-10-04 16:27:07 +0000 | [diff] [blame] | 351 | static struct xtables_match string_match = { |
Pablo Neira | c6fbf41 | 2005-08-28 08:09:44 +0000 | [diff] [blame] | 352 | .name = "string", |
Joonwoo Park | 78d2d14 | 2008-07-07 13:32:25 +0200 | [diff] [blame] | 353 | .revision = 0, |
| 354 | .family = AF_UNSPEC, |
| 355 | .version = XTABLES_VERSION, |
| 356 | .size = XT_ALIGN(sizeof(struct xt_string_info)), |
| 357 | .userspacesize = offsetof(struct xt_string_info, config), |
| 358 | .help = string_help, |
| 359 | .init = string_init, |
| 360 | .parse = string_parse, |
| 361 | .final_check = string_check, |
| 362 | .print = string_print, |
| 363 | .save = string_save, |
| 364 | .extra_opts = string_opts, |
| 365 | }; |
| 366 | |
| 367 | static struct xtables_match string_match_v1 = { |
| 368 | .name = "string", |
| 369 | .revision = 1, |
Jan Engelhardt | 23545c2 | 2008-02-14 04:23:04 +0100 | [diff] [blame] | 370 | .family = AF_UNSPEC, |
Jan Engelhardt | 8b7c64d | 2008-04-15 11:48:25 +0200 | [diff] [blame] | 371 | .version = XTABLES_VERSION, |
Yasuyuki KOZAKAI | 4ccb6f5 | 2007-07-24 06:52:16 +0000 | [diff] [blame] | 372 | .size = XT_ALIGN(sizeof(struct xt_string_info)), |
| 373 | .userspacesize = offsetof(struct xt_string_info, config), |
Jan Engelhardt | 181dead | 2007-10-04 16:27:07 +0000 | [diff] [blame] | 374 | .help = string_help, |
| 375 | .init = string_init, |
| 376 | .parse = string_parse, |
| 377 | .final_check = string_check, |
| 378 | .print = string_print, |
| 379 | .save = string_save, |
| 380 | .extra_opts = string_opts, |
Yasuyuki KOZAKAI | 4ccb6f5 | 2007-07-24 06:52:16 +0000 | [diff] [blame] | 381 | }; |
| 382 | |
Emmanuel Roger | 3071913 | 2000-10-04 15:19:31 +0000 | [diff] [blame] | 383 | void _init(void) |
| 384 | { |
Jan Engelhardt | 181dead | 2007-10-04 16:27:07 +0000 | [diff] [blame] | 385 | xtables_register_match(&string_match); |
Joonwoo Park | 78d2d14 | 2008-07-07 13:32:25 +0200 | [diff] [blame] | 386 | xtables_register_match(&string_match_v1); |
Emmanuel Roger | 3071913 | 2000-10-04 15:19:31 +0000 | [diff] [blame] | 387 | } |