From 3af08228012b1e79b7f47457f606911f3064dcbd Mon Sep 17 00:00:00 2001 From: John Hodge Date: Sat, 31 Jul 2010 19:52:46 +0800 Subject: [PATCH] Updating IPStack to have firewall hooks (well, the start of them) --- Modules/IPStack/Makefile | 1 + Modules/IPStack/firewall.c | 38 +++++++++++++++++ Modules/IPStack/firewall.h | 23 +++++++++++ Modules/IPStack/ipv4.c | 84 ++++++++++++++++++++++++++++---------- Modules/IPStack/ipv4.h | 4 +- 5 files changed, 127 insertions(+), 23 deletions(-) create mode 100644 Modules/IPStack/firewall.c create mode 100644 Modules/IPStack/firewall.h diff --git a/Modules/IPStack/Makefile b/Modules/IPStack/Makefile index a8380f48..1ca39476 100644 --- a/Modules/IPStack/Makefile +++ b/Modules/IPStack/Makefile @@ -4,6 +4,7 @@ OBJ := main.o link.o arp.o OBJ += ipv4.o icmp.o OBJ += ipv6.o +OBJ += firewall.o OBJ += udp.o tcp.o NAME := IPStack CATEGORY := diff --git a/Modules/IPStack/firewall.c b/Modules/IPStack/firewall.c new file mode 100644 index 00000000..c250dd08 --- /dev/null +++ b/Modules/IPStack/firewall.c @@ -0,0 +1,38 @@ +/* + * Acess2 IP Stack + * - Firewall Rules + */ +#include "ipstack.h" + +// === IMPORTS === + +// === PROTOTYPES === + int IPTablesV4_TestChain( + const char *RuleName, + const tIPv4 *Src, const tIPv4 *Dest, + Uint8 Type, Uint32 Flags, + size_t Length, const void *Data + ); + int IPTablesV6_TestChain( + const char *RuleName, + const tIPv6 *Src, const tIPv6 *Dest, + Uint8 Type, Uint32 Flags, + size_t Length, const void *Data + ); + +// === GLOBALS === + +// === CODE === +/** + * \brief Tests an IPv4 chain on a packet + * \return Boolean Disallow (0: Packet Allowed, 1: Drop, 2: Reject) + */ + int IPTablesV4_TestChain( + const char *RuleName, + const tIPv4 *Src, const tIPv4 *Dest, + Uint8 Type, Uint32 Flags, + size_t Length, const void *Data + ) +{ + return 0; // Accept all for now +} diff --git a/Modules/IPStack/firewall.h b/Modules/IPStack/firewall.h new file mode 100644 index 00000000..a82362b0 --- /dev/null +++ b/Modules/IPStack/firewall.h @@ -0,0 +1,23 @@ +/* + */ +#ifndef _FIREWALL_H_ +#define _FIREWALL_H_ + +/** + * \brief Tests a packet on a chain + */ +extern int IPTablesV4_TestChain( + const char *RuleName, + const tIPv4 *Src, const tIPv4 *Dest, + Uint8 Type, Uint32 Flags, + size_t Length, const void *Data + ); + +extern int IPTablesV6_TestChain( + const char *RuleName, + const tIPv6 *Src, const tIPv6 *Dest, + Uint8 Type, Uint32 Flags, + size_t Length, const void *Data + ); + +#endif diff --git a/Modules/IPStack/ipv4.c b/Modules/IPStack/ipv4.c index aff593a6..b6c70858 100644 --- a/Modules/IPStack/ipv4.c +++ b/Modules/IPStack/ipv4.c @@ -5,6 +5,7 @@ #include "ipstack.h" #include "link.h" #include "ipv4.h" +#include "firewall.h" #define DEFAULT_TTL 32 @@ -20,7 +21,7 @@ extern tMacAddr ARP_Resolve4(tInterface *Interface, tIPv4 Address); void IPv4_int_GetPacket(tAdapter *Interface, tMacAddr From, int Length, void *Buffer); tInterface *IPv4_GetInterface(tAdapter *Adapter, tIPv4 Address, int Broadcast); Uint32 IPv4_Netmask(int FixedBits); -Uint16 IPv4_Checksum(void *Buf, int Size); +Uint16 IPv4_Checksum(const void *Buf, int Size); int IPv4_Ping(tInterface *Iface, tIPv4 Addr); // === GLOBALS === @@ -58,12 +59,25 @@ int IPv4_RegisterCallback(int ID, tIPCallback Callback) * \param Length Data Length * \param Data Packet Data */ -int IPv4_SendPacket(tInterface *Iface, tIPv4 Address, int Protocol, int ID, int Length, void *Data) +int IPv4_SendPacket(tInterface *Iface, tIPv4 Address, int Protocol, int ID, int Length, const void *Data) { tMacAddr to = ARP_Resolve4(Iface, Address); int bufSize = sizeof(tIPv4Header) + Length; char buf[bufSize]; tIPv4Header *hdr = (void*)buf; + int ret; + + // TODO: OUTPUT Firewall rule go here + ret = IPTablesV4_TestChain("OUTPUT", + &Iface->IP4.Address, &Address, + Protocol, 0, + Length, Data); + + if(ret != 0) + { + // Just drop it + return 0; + } memcpy(&hdr->Options[0], Data, Length); hdr->Version = 4; @@ -101,6 +115,8 @@ void IPv4_int_GetPacket(tAdapter *Adapter, tMacAddr From, int Length, void *Buff tInterface *iface; Uint8 *data; int dataLength; + int ret; + if(Length < sizeof(tIPv4Header)) return; #if 0 @@ -134,19 +150,52 @@ void IPv4_int_GetPacket(tAdapter *Adapter, tMacAddr From, int Length, void *Buff return; } - // Get Interface (allowing broadcasts) - iface = IPv4_GetInterface(Adapter, hdr->Destination, 1); - if(!iface) { - Log_Log("IPv4", "Ignoring Packet (Not for us)"); - return; // Not for us? Well, let's ignore it - } - // Defragment - //TODO + // TODO: Handle packet fragmentation + // Get Data and Data Length dataLength = ntohs(hdr->TotalLength) - sizeof(tIPv4Header); data = &hdr->Options[0]; + // Get Interface (allowing broadcasts) + iface = IPv4_GetInterface(Adapter, hdr->Destination, 1); + + // TODO: INPUT Firewall Rule + if( iface ) { + ret = IPTablesV4_TestChain("INPUT", + &hdr->Source, &hdr->Destination, + hdr->Protocol, 0, + dataLength, data + ); + } + else { + ret = IPTablesV4_TestChain("FORWARD", + &hdr->Source, &hdr->Destination, + hdr->Protocol, 0, + dataLength, data + ); + } + switch(ret) + { + // 0 - Allow + case 0: break; + // 1 - Silent Drop + case 1: return ; + // Unknown, silent drop + default: + return ; + } + + // Routing + if(!iface) + { + Log_Log("IPv4", "Route the packet"); + + // TODO: Parse Routing tables and determine where to send it + + return ; + } + // Send it on if( gaIPv4_Callbacks[hdr->Protocol] ) gaIPv4_Callbacks[hdr->Protocol] (iface, &hdr->Source, dataLength, data); @@ -180,13 +229,6 @@ tInterface *IPv4_GetInterface(tAdapter *Adapter, tIPv4 Address, int Broadcast) // Check for broadcast netmask = IPv4_Netmask(iface->IP4.SubnetBits); - //Log("netmask = 0x%08x", netmask); - //Log("addr = 0x%08x", addr); - //Log("this = 0x%08x", this); - //Log("%08x == %08x && %08x == %08x", - // (addr & netmask), (this & netmask), - // (addr & ~netmask), (0xFFFFFFFF & ~netmask) - // ); if( (addr & netmask) == (this & netmask) && (addr & ~netmask) == (0xFFFFFFFF & ~netmask) ) return iface; @@ -204,20 +246,20 @@ Uint32 IPv4_Netmask(int FixedBits) Uint32 ret = 0xFFFFFFFF; ret >>= (32-FixedBits); ret <<= (32-FixedBits); - // Returs a little endian netmask + // Returns a native endian netmask return ret; } /** * \brief Calculate the IPv4 Checksum */ -Uint16 IPv4_Checksum(void *Buf, int Size) +Uint16 IPv4_Checksum(const void *Buf, int Size) { Uint16 sum = 0; - Uint16 *arr = Buf; + const Uint16 *arr = Buf; int i; - Size = (Size + 1) >> 1; + Size = (Size + 1) >> 1; // 16-bit word count for(i = 0; i < Size; i++ ) { if((int)sum + arr[i] > 0xFFFF) diff --git a/Modules/IPStack/ipv4.h b/Modules/IPStack/ipv4.h index b40caa70..d9bc0f77 100644 --- a/Modules/IPStack/ipv4.h +++ b/Modules/IPStack/ipv4.h @@ -46,7 +46,7 @@ struct sIPv4Header // === FUNCTIONS === extern int IPv4_RegisterCallback(int ID, tIPCallback Callback); -extern Uint16 IPv4_Checksum(void *Buf, int Size); -extern int IPv4_SendPacket(tInterface *Iface, tIPv4 Address, int Protocol, int ID, int Length, void *Data); +extern Uint16 IPv4_Checksum(const void *Buf, int Size); +extern int IPv4_SendPacket(tInterface *Iface, tIPv4 Address, int Protocol, int ID, int Length, const void *Data); #endif -- 2.20.1