diff options
author | Yasuyuki KOZAKAI <yasuyuki@netfilter.org> | 2007-08-04 08:05:46 +0000 |
---|---|---|
committer | Yasuyuki KOZAKAI <yasuyuki@netfilter.org> | 2007-08-04 08:05:46 +0000 |
commit | 5679958c748087a3e21fbfa26d2ea08a6572ee4f (patch) | |
tree | 99f64ed3624ab479a0e3db817b5f28105be60855 /extensions/libxt_CONNSECMARK.c | |
parent | f36f4a8844132cbaacf3bbd5ec0254c17fcc97ae (diff) |
Unifies libip[6]t_CONNSECMARK into libxt_CONNSECMARK
Diffstat (limited to 'extensions/libxt_CONNSECMARK.c')
-rw-r--r-- | extensions/libxt_CONNSECMARK.c | 142 |
1 files changed, 142 insertions, 0 deletions
diff --git a/extensions/libxt_CONNSECMARK.c b/extensions/libxt_CONNSECMARK.c new file mode 100644 index 00000000..bf3b1a1a --- /dev/null +++ b/extensions/libxt_CONNSECMARK.c @@ -0,0 +1,142 @@ +/* + * Shared library add-on to iptables to add CONNSECMARK target support. + * + * Based on the MARK and CONNMARK targets. + * + * Copyright (C) 2006 Red Hat, Inc., James Morris <jmorris@redhat.com> + */ +#include <stdio.h> +#include <string.h> +#include <stdlib.h> +#include <getopt.h> +#include <xtables.h> +#include <linux/netfilter/xt_CONNSECMARK.h> + +#define PFX "CONNSECMARK target: " + +static void help(void) +{ + printf( +"CONNSECMARK target v%s options:\n" +" --save Copy security mark from packet to conntrack\n" +" --restore Copy security mark from connection to packet\n" +"\n", +IPTABLES_VERSION); +} + +static const struct option opts[] = { + { "save", 0, 0, '1' }, + { "restore", 0, 0, '2' }, + { 0 } +}; + +static int parse(int c, char **argv, int invert, unsigned int *flags, + const void *entry, struct xt_entry_target **target) +{ + struct xt_connsecmark_target_info *info = + (struct xt_connsecmark_target_info*)(*target)->data; + + switch (c) { + case '1': + if (*flags & CONNSECMARK_SAVE) + exit_error(PARAMETER_PROBLEM, PFX + "Can't specify --save twice"); + info->mode = CONNSECMARK_SAVE; + *flags |= CONNSECMARK_SAVE; + break; + + case '2': + if (*flags & CONNSECMARK_RESTORE) + exit_error(PARAMETER_PROBLEM, PFX + "Can't specify --restore twice"); + info->mode = CONNSECMARK_RESTORE; + *flags |= CONNSECMARK_RESTORE; + break; + + default: + return 0; + } + + return 1; +} + +static void final_check(unsigned int flags) +{ + if (!flags) + exit_error(PARAMETER_PROBLEM, PFX "parameter required"); + + if (flags == (CONNSECMARK_SAVE|CONNSECMARK_RESTORE)) + exit_error(PARAMETER_PROBLEM, PFX "only one flag of --save " + "or --restore is allowed"); +} + +static void print_connsecmark(struct xt_connsecmark_target_info *info) +{ + switch (info->mode) { + case CONNSECMARK_SAVE: + printf("save "); + break; + + case CONNSECMARK_RESTORE: + printf("restore "); + break; + + default: + exit_error(OTHER_PROBLEM, PFX "invalid mode %hhu\n", info->mode); + } +} + +static void print(const void *ip, + const struct xt_entry_target *target, int numeric) +{ + struct xt_connsecmark_target_info *info = + (struct xt_connsecmark_target_info*)(target)->data; + + printf("CONNSECMARK "); + print_connsecmark(info); +} + +static void save(const void *ip, const struct xt_entry_target *target) +{ + struct xt_connsecmark_target_info *info = + (struct xt_connsecmark_target_info*)target->data; + + printf("--"); + print_connsecmark(info); +} + +static struct xtables_target connsecmark = { + .family = AF_INET, + .name = "CONNSECMARK", + .version = IPTABLES_VERSION, + .revision = 0, + .size = XT_ALIGN(sizeof(struct xt_connsecmark_target_info)), + .userspacesize = XT_ALIGN(sizeof(struct xt_connsecmark_target_info)), + .parse = &parse, + .help = &help, + .final_check = &final_check, + .print = &print, + .save = &save, + .extra_opts = opts, +}; + +static struct xtables_target connsecmark6 = { + .family = AF_INET6, + .name = "CONNSECMARK", + .version = IPTABLES_VERSION, + .revision = 0, + .size = XT_ALIGN(sizeof(struct xt_connsecmark_target_info)), + .userspacesize = XT_ALIGN(sizeof(struct xt_connsecmark_target_info)), + .parse = &parse, + .help = &help, + .final_check = &final_check, + .print = &print, + .save = &save, + .extra_opts = opts, +}; + +void _init(void) +{ + xtables_register_target(&connsecmark); + xtables_register_target(&connsecmark6); +} |