#include "ipstack.h"
#include "link.h"
#include "ipv4.h"
+#include "firewall.h"
#define DEFAULT_TTL 32
void IPv4_int_GetPacket(tAdapter *Interface, tMacAddr From, int Length, void *Buffer);
tInterface *IPv4_GetInterface(tAdapter *Adapter, tIPv4 Address, int Broadcast);
Uint32 IPv4_Netmask(int FixedBits);
-Uint16 IPv4_Checksum(void *Buf, int Size);
+Uint16 IPv4_Checksum(const void *Buf, int Size);
int IPv4_Ping(tInterface *Iface, tIPv4 Addr);
// === GLOBALS ===
// === CODE ===
/**
- * \fn int IPv4_Initialise()
+ * \brief Initialise the IPv4 Code
*/
int IPv4_Initialise()
{
}
/**
- * \fn int IPv4_RegisterCallback( int ID, tIPCallback Callback )
* \brief Registers a callback
+ * \param ID 8-bit packet type ID
+ * \param Callback Callback function
*/
int IPv4_RegisterCallback(int ID, tIPCallback Callback)
{
* \param ID Some random ID number
* \param Length Data Length
* \param Data Packet Data
+ * \return Boolean Success
*/
-int IPv4_SendPacket(tInterface *Iface, tIPv4 Address, int Protocol, int ID, int Length, void *Data)
+int IPv4_SendPacket(tInterface *Iface, tIPv4 Address, int Protocol, int ID, int Length, const void *Data)
{
tMacAddr to = ARP_Resolve4(Iface, Address);
int bufSize = sizeof(tIPv4Header) + Length;
char buf[bufSize];
tIPv4Header *hdr = (void*)buf;
+ int ret;
+
+ // OUTPUT Firewall rule go here
+ ret = IPTablesV4_TestChain("OUTPUT",
+ &Iface->IP4.Address, &Address,
+ Protocol, 0,
+ Length, Data);
+ if(ret != 0) {
+ // Just drop it (with an error)
+ return 0;
+ }
memcpy(&hdr->Options[0], Data, Length);
hdr->Version = 4;
tInterface *iface;
Uint8 *data;
int dataLength;
+ int ret;
+
if(Length < sizeof(tIPv4Header)) return;
+ #if 0
//Log_Log("IPv4", "Version = %i", hdr->Version);
//Log_Log("IPv4", "HeaderLength = %i", hdr->HeaderLength);
//Log_Log("IPv4", "DiffServices = %i", hdr->DiffServices);
- Log_Log("IPv4", "TotalLength = %i", ntohs(hdr->TotalLength) );
+ Log_Debug("IPv4", "TotalLength = %i", ntohs(hdr->TotalLength) );
//Log_Log("IPv4", "Identifcation = %i", ntohs(hdr->Identifcation) );
//Log_Log("IPv4", "TTL = %i", hdr->TTL );
- Log_Log("IPv4", "Protocol = %i", hdr->Protocol );
+ Log_Debug("IPv4", "Protocol = %i", hdr->Protocol );
//Log_Log("IPv4", "HeaderChecksum = 0x%x", ntohs(hdr->HeaderChecksum) );
- Log_Log("IPv4", "Source = %i.%i.%i.%i",
+ Log_Debug("IPv4", "Source = %i.%i.%i.%i",
hdr->Source.B[0], hdr->Source.B[1], hdr->Source.B[2], hdr->Source.B[3] );
- Log_Log("IPv4", "Destination = %i.%i.%i.%i",
+ Log_Debug("IPv4", "Destination = %i.%i.%i.%i",
hdr->Destination.B[0], hdr->Destination.B[1],
hdr->Destination.B[2], hdr->Destination.B[3] );
-
+ #endif
+
// Check that the version IS IPv4
if(hdr->Version != 4) {
Log_Log("IPv4", "hdr->Version(%i) != 4", hdr->Version);
}
// Check Header checksum
- //TODO
+ {
+ Uint16 hdrVal, compVal;
+ hdrVal = hdr->HeaderChecksum;
+ hdr->HeaderChecksum = 0;
+ compVal = IPv4_Checksum(hdr, hdr->HeaderLength);
+ if(hdrVal != compVal) {
+ Log_Log("IPv4", "Header checksum fails (%04x != %04x)", hdrVal, compVal);
+ return ;
+ }
+ hdr->HeaderChecksum = hdrVal;
+ }
// Check Packet length
if( ntohs(hdr->TotalLength) > Length) {
return;
}
- // Get Interface (allowing broadcasts)
- iface = IPv4_GetInterface(Adapter, hdr->Destination, 1);
- if(!iface) {
- Log_Log("IPv4", "Ignoring Packet (Not for us)");
- return; // Not for us? Well, let's ignore it
- }
+ // TODO: Handle packet fragmentation
- // Defragment
- //TODO
+ // Get Data and Data Length
dataLength = ntohs(hdr->TotalLength) - sizeof(tIPv4Header);
data = &hdr->Options[0];
+ // Get Interface (allowing broadcasts)
+ iface = IPv4_GetInterface(Adapter, hdr->Destination, 1);
+
+ // Firewall rules
+ if( iface ) {
+ // Incoming Packets
+ ret = IPTablesV4_TestChain("INPUT",
+ &hdr->Source, &hdr->Destination,
+ hdr->Protocol, 0,
+ dataLength, data
+ );
+ }
+ else {
+ // Routed packets
+ ret = IPTablesV4_TestChain("FORWARD",
+ &hdr->Source, &hdr->Destination,
+ hdr->Protocol, 0,
+ dataLength, data
+ );
+ }
+ switch(ret)
+ {
+ // 0 - Allow
+ case 0: break;
+ // 1 - Silent Drop
+ case 1:
+ Log_Debug("IPv4", "Silently dropping packet");
+ return ;
+ // Unknown, silent drop
+ default:
+ return ;
+ }
+
+ // Routing
+ if(!iface)
+ {
+ Log_Debug("IPv4", "Route the packet");
+
+ // TODO: Parse Routing tables and determine where to send it
+
+ return ;
+ }
+
// Send it on
if( gaIPv4_Callbacks[hdr->Protocol] )
- gaIPv4_Callbacks[hdr->Protocol] (iface, &hdr->Source, dataLength, data);
+ gaIPv4_Callbacks[hdr->Protocol]( iface, &hdr->Source, dataLength, data );
else
Log_Log("IPv4", "Unknown Protocol %i", hdr->Protocol);
}
/**
* \fn tInterface *IPv4_GetInterface(tAdapter *Adapter, tIPv4 Address)
* \brief Searches an adapter for a matching address
+ * \param Adapter Incoming Adapter
+ * \param Address Destination Address
+ * \param Broadcast Allow broadcast packets
*/
tInterface *IPv4_GetInterface(tAdapter *Adapter, tIPv4 Address, int Broadcast)
{
// Check for broadcast
netmask = IPv4_Netmask(iface->IP4.SubnetBits);
- //Log("netmask = 0x%08x", netmask);
- //Log("addr = 0x%08x", addr);
- //Log("this = 0x%08x", this);
- //Log("%08x == %08x && %08x == %08x",
- // (addr & netmask), (this & netmask),
- // (addr & ~netmask), (0xFFFFFFFF & ~netmask)
- // );
if( (addr & netmask) == (this & netmask)
&& (addr & ~netmask) == (0xFFFFFFFF & ~netmask) )
return iface;
/**
* \brief Convert a network prefix to a netmask
+ * \param FixedBits Netmask size (/n)
*
* For example /24 will become 255.255.255.0
*/
Uint32 ret = 0xFFFFFFFF;
ret >>= (32-FixedBits);
ret <<= (32-FixedBits);
- // Returs a little endian netmask
+ // Returns a native endian netmask
return ret;
}
/**
* \brief Calculate the IPv4 Checksum
+ * \param Buf Input buffer
+ * \param Size Size of input
+ *
+ * One's complement sum of all 16-bit words (bitwise inverted)
*/
-Uint16 IPv4_Checksum(void *Buf, int Size)
+Uint16 IPv4_Checksum(const void *Buf, int Size)
{
Uint16 sum = 0;
- Uint16 *arr = Buf;
+ const Uint16 *arr = Buf;
int i;
- Log("IPv4_Checksum: (%p, %i)", Buf, Size);
-
- Size = (Size + 1) >> 1;
+ Size = (Size + 1) >> 1; // 16-bit word count
for(i = 0; i < Size; i++ )
{
if((int)sum + arr[i] > 0xFFFF)
/**
* \brief Sends an ICMP Echo and waits for a reply
+ * \param IFace Interface
+ * \param Addr Destination address
*/
-int IPv4_Ping(tInterface *Iface, tIPv4 Addr)
+int IPv4_Ping(tInterface *IFace, tIPv4 Addr)
{
- return ICMP_Ping(Iface, Addr);
+ return ICMP_Ping(IFace, Addr);
}