diff options
-rw-r--r-- | extensions/Makefile | 6 | ||||
-rw-r--r-- | extensions/libip6t_CONNSECMARK.c | 124 | ||||
-rw-r--r-- | extensions/libxt_CONNSECMARK.c (renamed from extensions/libipt_CONNSECMARK.c) | 29 | ||||
-rw-r--r-- | include/linux/netfilter/xt_CONNSECMARK.h | 13 |
4 files changed, 39 insertions, 133 deletions
diff --git a/extensions/Makefile b/extensions/Makefile index d903d7f..6c9f64b 100644 --- a/extensions/Makefile +++ b/extensions/Makefile @@ -10,9 +10,9 @@ PF6_EXT_SLIB:=connmark eui64 hl icmp6 owner policy state HL LOG MARK TRACE PFX_EXT_SLIB:=comment connlimit dscp esp length limit mac mark multiport physdev pkttype sctp standard tcp tcpmss udp CONNMARK NFQUEUE NOTRACK TCPMSS ifeq ($(DO_SELINUX), 1) -PF_EXT_SE_SLIB:=CONNSECMARK -PF6_EXT_SE_SLIB:=CONNSECMARK -PFX_EXT_SE_SLIB:=SECMARK +PF_EXT_SE_SLIB:= +PF6_EXT_SE_SLIB:= +PFX_EXT_SE_SLIB:=CONNSECMARK SECMARK endif # Optionals diff --git a/extensions/libip6t_CONNSECMARK.c b/extensions/libip6t_CONNSECMARK.c deleted file mode 100644 index 93d0c96..0000000 --- a/extensions/libip6t_CONNSECMARK.c +++ /dev/null @@ -1,124 +0,0 @@ -/* - * Shared library add-on to ip6tables to add CONNSECMARK target support. - * - * Based on the MARK and CONNMARK targets. - * - * Copyright (C) 2006 Red Hat, Inc., James Morris <jmorris@redhat.com> - */ -#include <stdio.h> -#include <string.h> -#include <stdlib.h> -#include <getopt.h> -#include <ip6tables.h> -#include <linux/netfilter/xt_CONNSECMARK.h> - -#define PFX "CONNSECMARK target: " - -static void help(void) -{ - printf( -"CONNSECMARK target v%s options:\n" -" --save Copy security mark from packet to conntrack\n" -" --restore Copy security mark from connection to packet\n" -"\n", -IPTABLES_VERSION); -} - -static const struct option opts[] = { - { "save", 0, 0, '1' }, - { "restore", 0, 0, '2' }, - { 0 } -}; - -static int parse(int c, char **argv, int invert, unsigned int *flags, - const void *entry, struct xt_entry_target **target) -{ - struct xt_connsecmark_target_info *info = - (struct xt_connsecmark_target_info*)(*target)->data; - - switch (c) { - case '1': - if (*flags & CONNSECMARK_SAVE) - exit_error(PARAMETER_PROBLEM, PFX - "Can't specify --save twice"); - info->mode = CONNSECMARK_SAVE; - *flags |= CONNSECMARK_SAVE; - break; - - case '2': - if (*flags & CONNSECMARK_RESTORE) - exit_error(PARAMETER_PROBLEM, PFX - "Can't specify --restore twice"); - info->mode = CONNSECMARK_RESTORE; - *flags |= CONNSECMARK_RESTORE; - break; - - default: - return 0; - } - - return 1; -} - -static void final_check(unsigned int flags) -{ - if (!flags) - exit_error(PARAMETER_PROBLEM, PFX "parameter required"); - - if (flags == (CONNSECMARK_SAVE|CONNSECMARK_RESTORE)) - exit_error(PARAMETER_PROBLEM, PFX "only one flag of --save " - "or --restore is allowed"); -} - -static void print_connsecmark(struct xt_connsecmark_target_info *info) -{ - switch (info->mode) { - case CONNSECMARK_SAVE: - printf("save "); - break; - - case CONNSECMARK_RESTORE: - printf("restore "); - break; - - default: - exit_error(OTHER_PROBLEM, PFX "invalid mode %hhu\n", info->mode); - } -} - -static void print(const void *ip, - const struct xt_entry_target *target, int numeric) -{ - struct xt_connsecmark_target_info *info = - (struct xt_connsecmark_target_info*)(target)->data; - - printf("CONNSECMARK "); - print_connsecmark(info); -} - -static void save(const void *ip, const struct xt_entry_target *target) -{ - struct xt_connsecmark_target_info *info = - (struct xt_connsecmark_target_info*)target->data; - - printf("--"); - print_connsecmark(info); -} - -static struct ip6tables_target connsecmark = { - .name = "CONNSECMARK", - .version = IPTABLES_VERSION, - .size = IP6T_ALIGN(sizeof(struct xt_connsecmark_target_info)), - .userspacesize = IP6T_ALIGN(sizeof(struct xt_connsecmark_target_info)), - .parse = &parse, - .help = &help, - .final_check = &final_check, - .print = &print, - .save = &save, - .extra_opts = opts -}; - -void _init(void) -{ - register_target6(&connsecmark); -} diff --git a/extensions/libipt_CONNSECMARK.c b/extensions/libxt_CONNSECMARK.c index 07b8527..bf3b1a1 100644 --- a/extensions/libipt_CONNSECMARK.c +++ b/extensions/libxt_CONNSECMARK.c @@ -9,7 +9,7 @@ #include <string.h> #include <stdlib.h> #include <getopt.h> -#include <iptables.h> +#include <xtables.h> #include <linux/netfilter/xt_CONNSECMARK.h> #define PFX "CONNSECMARK target: " @@ -105,21 +105,38 @@ static void save(const void *ip, const struct xt_entry_target *target) print_connsecmark(info); } -static struct iptables_target connsecmark = { +static struct xtables_target connsecmark = { + .family = AF_INET, .name = "CONNSECMARK", .version = IPTABLES_VERSION, .revision = 0, - .size = IPT_ALIGN(sizeof(struct xt_connsecmark_target_info)), - .userspacesize = IPT_ALIGN(sizeof(struct xt_connsecmark_target_info)), + .size = XT_ALIGN(sizeof(struct xt_connsecmark_target_info)), + .userspacesize = XT_ALIGN(sizeof(struct xt_connsecmark_target_info)), .parse = &parse, .help = &help, .final_check = &final_check, .print = &print, .save = &save, - .extra_opts = opts + .extra_opts = opts, +}; + +static struct xtables_target connsecmark6 = { + .family = AF_INET6, + .name = "CONNSECMARK", + .version = IPTABLES_VERSION, + .revision = 0, + .size = XT_ALIGN(sizeof(struct xt_connsecmark_target_info)), + .userspacesize = XT_ALIGN(sizeof(struct xt_connsecmark_target_info)), + .parse = &parse, + .help = &help, + .final_check = &final_check, + .print = &print, + .save = &save, + .extra_opts = opts, }; void _init(void) { - register_target(&connsecmark); + xtables_register_target(&connsecmark); + xtables_register_target(&connsecmark6); } diff --git a/include/linux/netfilter/xt_CONNSECMARK.h b/include/linux/netfilter/xt_CONNSECMARK.h new file mode 100644 index 0000000..c6bd754 --- /dev/null +++ b/include/linux/netfilter/xt_CONNSECMARK.h @@ -0,0 +1,13 @@ +#ifndef _XT_CONNSECMARK_H_target +#define _XT_CONNSECMARK_H_target + +enum { + CONNSECMARK_SAVE = 1, + CONNSECMARK_RESTORE, +}; + +struct xt_connsecmark_target_info { + u_int8_t mode; +}; + +#endif /*_XT_CONNSECMARK_H_target */ |