- variable size of the pool of addresses, no limit to 256
- IP/MAC correspondences matching available
- negation mark '!' handled
NOTE: incompatible with older version!
diff --git a/extensions/ebt_among.c b/extensions/ebt_among.c
index 5ec8a45..df98b9a 100644
--- a/extensions/ebt_among.c
+++ b/extensions/ebt_among.c
@@ -9,9 +9,7 @@
#include <linux/if_ether.h>
#include <linux/netfilter_bridge/ebt_among.h>
-/*
-#define DEBUG
-*/
+//#define DEBUG
#define AMONG_DST '1'
#define AMONG_SRC '2'
@@ -33,7 +31,7 @@
if (i % 32 == 0) {
printf("\n%04x: ", i);
}
- printf("%2.2x ", p[i]);
+ printf("%2.2x%c", p[i], ". "[i%4==3]);
}
printf("\n");
}
@@ -46,11 +44,11 @@
"--among-dst list : matches if ether dst is in list\n"
"--among-src list : matches if ether src is in list\n"
"list has form:\n"
-"\txx:xx:xx:xx:xx:xx,yy:yy:yy:yy:yy:yy,...,zz:zz:zz:zz:zz:zz\n"
-"i.e. MAC addresses separated by commas, without spaces.\n"
-"Optional comma can be included after the last MAC address, i.e.:\n"
-"\txx:xx:xx:xx:xx:xx,yy:yy:yy:yy:yy:yy,...,zz:zz:zz:zz:zz:zz,\n"
-"Each list can contain up to 256 addresses.\n"
+" xx:xx:xx:xx:xx:xx[=ip.ip.ip.ip],yy:yy:yy:yy:yy:yy[=ip.ip.ip.ip],...,zz:zz:zz:zz:zz:zz[=ip.ip.ip.ip][,]\n"
+"Things in brackets are optional.\n"
+"If you want to allow two (or more) IP addresses to one MAC address, you can\n"
+"specify two (or more) pairs witch the same MAC, e.g.\n"
+" 00:00:00:fa:eb:fe=153.19.120.250,00:00:00:fa:eb:fe=192.168.0.1\n"
);
}
@@ -61,75 +59,165 @@
memset(amonginfo, 0, sizeof(struct ebt_among_info));
}
-static int fill_mac(char *mac, const char *string)
+static struct ebt_mac_wormhash *new_wormhash(int n)
{
- char xnum[3];
- const char *p = string;
- int i = 0;
- int j = 0;
- while (1) {
- if (isxdigit(*p)) {
- xnum[j] = *p;
- j++;
- if (j >= 3) {
- /* 3 or more hex digits for a single byte */
- return -3;
- }
- }
- else {
- xnum[j] = 0;
- j = 0;
- mac[i] = strtol(xnum, 0, 16);
- i++;
- if (i >= 6) {
- if (*p == ':') {
- /* MAC address too long */
- return -2;
- }
- else {
- return 0;
- }
- }
- else {
- if (*p != ':') {
- /* MAC address too short */
- return -1;
- }
- }
- }
- p++;
- }
-
+ int size = sizeof(struct ebt_mac_wormhash) + n * sizeof(struct ebt_mac_wormhash_tuple);
+ struct ebt_mac_wormhash *result = (struct ebt_mac_wormhash *)malloc(size);
+ memset(result, 0, size);
+ result->poolsize = n;
+ return result;
}
-static void fill_wormhash(struct ebt_mac_wormhash *wh, const char *arg)
+static void copy_wormhash(struct ebt_mac_wormhash *d, const struct ebt_mac_wormhash *s)
+{
+ int dpoolsize = d->poolsize;
+ int dsize, ssize, amount;
+ dsize = ebt_mac_wormhash_size(d);
+ ssize = ebt_mac_wormhash_size(s);
+ amount = dsize < ssize ? dsize : ssize;
+ memcpy(d, s, amount);
+ d->poolsize = dpoolsize;
+}
+
+/* Returns:
+ * -1 when '\0' reached
+ * -2 when `n' bytes read and no delimiter found
+ * 0 when no less than `n' bytes read and delimiter found
+ * if `destbuf' is not NULL, it is filled by read bytes and ended with '\0'
+ * *pp is set on the first byte not copied to `destbuf'
+ */
+static int read_until(const char **pp, const char *delimiters, char *destbuf, int n)
+{
+ int count = 0;
+ int ret = 0;
+ char c;
+ while (1) {
+ c = **pp;
+ if (!c) {
+ ret = -1;
+ break;
+ }
+ if (strchr(delimiters, c)) {
+ ret = 0;
+ break;
+ }
+ if (count == n) {
+ ret = -2;
+ break;
+ }
+ if (destbuf) destbuf[count++] = c;
+ (*pp)++;
+ }
+ if (destbuf) destbuf[count] = 0;
+ return ret;
+}
+
+static struct ebt_mac_wormhash *create_wormhash(const char *arg)
{
const char *pc = arg;
const char *anchor;
- char mac[6];
+ char *endptr;
+ struct ebt_mac_wormhash *workcopy, *result, *h;
+ unsigned char mac[6];
+ unsigned char ip[4];
int index;
int nmacs = 0;
- char *base = (char*)wh;
- memset(wh, 0, sizeof(struct ebt_mac_wormhash));
+ int i;
+ char token[4];
+ if (!(workcopy = new_wormhash(1024))) {
+ print_error("memory problem");
+ }
while (1) {
+ /* remember current position, we'll need it on error */
anchor = pc;
- while (*pc && *pc != ',') pc++;
- while (*pc && *pc == ',') pc++;
- if (fill_mac(mac, anchor)) {
- print_error("problem with MAC %20s...", anchor);
+
+ /* collect MAC; all its bytes are followed by ':' (colon), except for
+ * the last one which can be followed by ',' (comma), '=' or '\0' */
+ for (i = 0; i < 5; i++) {
+ if (read_until(&pc, ":", token, 2) < 0 || token[0] == 0) {
+ print_error("MAC parse error: %.20s", anchor);
+ }
+ mac[i] = strtol(token, &endptr, 16);
+ if (*endptr) {
+ print_error("MAC parse error: %.20s", anchor);
+ }
+ pc++;
}
+ if (read_until(&pc, "=,", token, 2) == -2 || token[0] == 0) {
+ print_error("MAC parse error: %.20s", anchor);
+ }
+ mac[i] = strtol(token, &endptr, 16);
+ if (*endptr) {
+ print_error("MAC parse error: %.20s", anchor);
+ }
+ if (*pc == '=') {
+ /* an IP follows the MAC; collect similarly to MAC */
+ pc++;
+ anchor = pc;
+ for (i = 0; i < 3; i++) {
+ if (read_until(&pc, ".", token, 3) < 0 || token[0] == 0) {
+ print_error("IP parse error: %.20s", anchor);
+ }
+ ip[i] = strtol(token, &endptr, 10);
+ if (*endptr) {
+ print_error("IP parse error: %.20s", anchor);
+ }
+ pc++;
+ }
+ if (read_until(&pc, ",", token, 3) == -2 || token[0] == 0) {
+ print_error("IP parse error: %.20s", anchor);
+ }
+ ip[3] = strtol(token, &endptr, 10);
+ if (*endptr) {
+ print_error("IP parse error: %.20s", anchor);
+ }
+ }
+ else {
+ /* no IP, we set it to 0.0.0.0 */
+ memset(ip, 0, 4);
+ }
+
+ /* we have collected MAC and IP, so we add an entry */
index = (unsigned char)mac[5];
- memcpy(((char*)wh->pool[nmacs].cmp)+2, mac, 6);
- wh->pool[nmacs].next_ofs = wh->table[index];
- wh->table[index] = ((const char*)&wh->pool[nmacs]) - base;
+ memcpy(((char*)workcopy->pool[nmacs].cmp)+2, mac, 6);
+ workcopy->pool[nmacs].ip = *(const uint32_t*)ip;
+ workcopy->pool[nmacs].next_ofs = workcopy->table[index];
+ workcopy->table[index] = ((const char*)&workcopy->pool[nmacs]) - (const char*)workcopy;
nmacs++;
- if (*pc && nmacs >= 256) {
- print_error("--among-src/--among-dst list can contain no more than 256 addresses\n");
+
+ /* re-allocate memory if needed */
+ if (*pc && nmacs >= workcopy->poolsize) {
+ if (!(h = new_wormhash(nmacs * 2))) {
+ print_error("memory problem");
+ }
+ copy_wormhash(h, workcopy);
+ free(workcopy);
+ workcopy = h;
}
+
+ /* check if end of string was reached */
+ if (!*pc) {
+ break;
+ }
+
+ /* now `pc' points to comma if we are here; increment this to the next char */
+ /* but first assert :-> */
+ if (*pc != ',') {
+ print_error("Something went wrong; no comma...\n");
+ }
+ pc++;
+
+ /* again check if end of string was reached; we allow an ending comma */
if (!*pc) {
break;
}
}
+ if (!(result = new_wormhash(nmacs))) {
+ print_error("memory problem");
+ }
+ copy_wormhash(result, workcopy);
+ free(workcopy);
+ return result;
}
#define OPT_DST 0x01
@@ -137,24 +225,39 @@
static int parse(int c, char **argv, int argc, const struct ebt_u_entry *entry,
unsigned int *flags, struct ebt_entry_match **match)
{
- struct ebt_among_info *amonginfo = (struct ebt_among_info *)(*match)->data;
+ struct ebt_among_info *info = (struct ebt_among_info *)(*match)->data;
struct ebt_mac_wormhash *wh;
+ struct ebt_entry_match *h;
+ int new_size, old_size;
switch (c) {
case AMONG_DST:
case AMONG_SRC:
- if (c == AMONG_DST) {
- check_option(flags, OPT_DST);
- wh = &amonginfo->wh_dst;
- amonginfo->bitmask |= EBT_AMONG_DST;
- } else {
- check_option(flags, OPT_SRC);
- wh = &amonginfo->wh_src;
- amonginfo->bitmask |= EBT_AMONG_SRC;
+ if (check_inverse(optarg)) {
+ if (c == AMONG_DST)
+ info->bitmask |= EBT_AMONG_DST_NEG;
+ else
+ info->bitmask |= EBT_AMONG_SRC_NEG;
}
if (optind > argc)
print_error("No MAC list specified\n");
- fill_wormhash(wh, argv[optind - 1]);
+ wh = create_wormhash(argv[optind - 1]);
+ old_size = sizeof(struct ebt_entry_match) + (**match).match_size;
+ h = malloc((new_size = old_size + ebt_mac_wormhash_size(wh)));
+ memcpy(h, *match, old_size);
+ memcpy((char*)h + old_size, wh, ebt_mac_wormhash_size(wh));
+ h->match_size = new_size - sizeof(struct ebt_entry_match);
+ info = (struct ebt_among_info *)h->data;
+ if (c == AMONG_DST) {
+ check_option(flags, OPT_DST);
+ info->wh_dst_ofs = old_size - sizeof(struct ebt_entry_match);
+ } else {
+ check_option(flags, OPT_SRC);
+ info->wh_src_ofs = old_size - sizeof(struct ebt_entry_match);
+ }
+ free(*match);
+ *match = h;
+ free(wh);
break;
default:
return 0;
@@ -172,12 +275,18 @@
{
int i;
int offset;
+ unsigned char *ip;
for (i = 0; i < 256; i++) {
const struct ebt_mac_wormhash_tuple *p;
offset = wh->table[i];
while (offset) {
p = (const struct ebt_mac_wormhash_tuple*)((const char*)wh + offset);
- printf("%s,", ether_ntoa((const struct ether_addr *)(((const char*)&p->cmp[0]) + 2)));
+ printf("%s", ether_ntoa((const struct ether_addr *)(((const char*)&p->cmp[0]) + 2)));
+ if (p->ip) {
+ ip = (unsigned char*)&p->ip;
+ printf("=%u.%u.%u.%u", ip[0], ip[1], ip[2], ip[3]);
+ }
+ printf(",");
offset = p->next_ofs;
}
}
@@ -187,30 +296,46 @@
static void print(const struct ebt_u_entry *entry,
const struct ebt_entry_match *match)
{
- struct ebt_among_info *amonginfo = (struct ebt_among_info *)match->data;
+ struct ebt_among_info *info = (struct ebt_among_info *)match->data;
- if (amonginfo->bitmask & EBT_AMONG_DST) {
+ if (info->wh_dst_ofs) {
printf("--among-dst ");
- wormhash_printout(&amonginfo->wh_dst);
+ if (info->bitmask && EBT_AMONG_DST_NEG) {
+ printf("! ");
+ }
+ wormhash_printout(ebt_among_wh_dst(info));
}
- if (amonginfo->bitmask & EBT_AMONG_SRC) {
+ if (info->wh_src_ofs) {
printf("--among-src ");
- wormhash_printout(&amonginfo->wh_src);
+ if (info->bitmask && EBT_AMONG_SRC_NEG) {
+ printf("! ");
+ }
+ wormhash_printout(ebt_among_wh_src(info));
}
}
+static int compare_wh(const struct ebt_mac_wormhash *aw, const struct ebt_mac_wormhash *bw)
+{
+ int as, bs;
+ as = ebt_mac_wormhash_size(aw);
+ bs = ebt_mac_wormhash_size(bw);
+ if (as != bs)
+ return 0;
+ if (as && memcmp(aw, bw, as))
+ return 0;
+ return 1;
+}
+
static int compare(const struct ebt_entry_match *m1,
const struct ebt_entry_match *m2)
{
- struct ebt_among_info *amonginfo1 = (struct ebt_among_info *)m1->data;
- struct ebt_among_info *amonginfo2 = (struct ebt_among_info *)m2->data;
+ struct ebt_among_info *a = (struct ebt_among_info *)m1->data;
+ struct ebt_among_info *b = (struct ebt_among_info *)m2->data;
-#ifdef DEBUG
-// hexdump(amonginfo1, sizeof(struct ebt_among_info));
-// hexdump(amonginfo2, sizeof(struct ebt_among_info));
-#endif /* DEBUG */
-
- return memcmp(amonginfo1, amonginfo2, sizeof(struct ebt_among_info)) == 0;
+ if (!compare_wh(ebt_among_wh_dst(a), ebt_among_wh_dst(b))) return 0;
+ if (!compare_wh(ebt_among_wh_src(a), ebt_among_wh_src(b))) return 0;
+ if (a->bitmask != b->bitmask) return 0;
+ return 1;
}
static struct ebt_u_match among_match =