diff options
Diffstat (limited to 'extensions/libipt_esp.c')
| -rw-r--r-- | extensions/libipt_esp.c | 191 |
1 files changed, 191 insertions, 0 deletions
diff --git a/extensions/libipt_esp.c b/extensions/libipt_esp.c new file mode 100644 index 00000000..d60c2a65 --- /dev/null +++ b/extensions/libipt_esp.c @@ -0,0 +1,191 @@ +/* Shared library add-on to iptables to add ESP support. */ +#include <stdio.h> +#include <netdb.h> +#include <string.h> +#include <stdlib.h> +#include <getopt.h> +#include <errno.h> +#include <iptables.h> +#include <linux/netfilter_ipv4/ipt_esp.h> + +/* Function which prints out usage message. */ +static void +help(void) +{ + printf( +"ESP v%s options:\n" +" --espspi [!] spi[:spi]\n" +" match spi (range)\n", +NETFILTER_VERSION); +} + +static struct option opts[] = { + { "espspi", 1, 0, '1' }, + {0} +}; + +static u_int32_t +parse_esp_spi(const char *spistr) +{ + unsigned long int spi; + char* ep; + + spi = strtoul(spistr,&ep,0) ; + + if ( spistr == ep ) { + exit_error(PARAMETER_PROBLEM, + "ESP no valid digits in spi `%s'", spistr); + } + if ( spi == ULONG_MAX && errno == ERANGE ) { + exit_error(PARAMETER_PROBLEM, + "spi `%s' specified too big: would overflow", spistr); + } + if ( *spistr != '\0' && *ep != '\0' ) { + exit_error(PARAMETER_PROBLEM, + "ESP error parsing spi `%s'", spistr); + } + return (u_int32_t) spi; +} + +static void +parse_esp_spis(const char *spistring, u_int32_t *spis) +{ + char *buffer; + char *cp; + + buffer = strdup(spistring); + if ((cp = strchr(buffer, ':')) == NULL) + spis[0] = spis[1] = parse_esp_spi(buffer); + else { + *cp = '\0'; + cp++; + + spis[0] = buffer[0] ? parse_esp_spi(buffer) : 0; + spis[1] = cp[0] ? parse_esp_spi(cp) : 0xFFFFFFFF; + } + free(buffer); +} + +/* Initialize the match. */ +static void +init(struct ipt_entry_match *m, unsigned int *nfcache) +{ + struct ipt_esp *espinfo = (struct ipt_esp *)m->data; + + espinfo->spis[1] = 0xFFFFFFFF; +} + +#define ESP_SPI 0x01 + +/* Function which parses command options; returns true if it + ate an option */ +static int +parse(int c, char **argv, int invert, unsigned int *flags, + const struct ipt_entry *entry, + unsigned int *nfcache, + struct ipt_entry_match **match) +{ + struct ipt_esp *espinfo = (struct ipt_esp *)(*match)->data; + + switch (c) { + case '1': + if (*flags & ESP_SPI) + exit_error(PARAMETER_PROBLEM, + "Only one `--spi' allowed"); + if (check_inverse(optarg, &invert)) + optind++; + parse_esp_spis(argv[optind-1], espinfo->spis); + if (invert) + espinfo->invflags |= IPT_ESP_INV_SPI; + *flags |= ESP_SPI; + break; + default: + return 0; + } + + return 1; +} + +/* Final check; we don't care. */ +static void +final_check(unsigned int flags) +{ +} + +static void +print_spis(const char *name, u_int32_t min, u_int32_t max, + int invert) +{ + const char *inv = invert ? "!" : ""; + + if (min != 0 || max != 0xFFFFFFFF || invert) { + printf("%s", name); + if (min == max) { + printf(":%s", inv); + printf("%u", min); + } else { + printf("s:%s", inv); + printf("%u",min); + printf(":"); + printf("%u",max); + } + printf(" "); + } +} + +/* Prints out the union ipt_matchinfo. */ +static void +print(const struct ipt_ip *ip, + const struct ipt_entry_match *match, int numeric) +{ + const struct ipt_esp *esp = (struct ipt_esp *)match->data; + + printf("esp "); + print_spis("spi", esp->spis[0], esp->spis[1], + esp->invflags & IPT_ESP_INV_SPI); + if (esp->invflags & ~IPT_ESP_INV_MASK) + printf("Unknown invflags: 0x%X ", + esp->invflags & ~IPT_ESP_INV_MASK); +} + +/* Saves the union ipt_matchinfo in parsable form to stdout. */ +static void save(const struct ipt_ip *ip, const struct ipt_entry_match *match) +{ + const struct ipt_esp *espinfo = (struct ipt_esp *)match->data; + + if (espinfo->spis[0] != 0 + && espinfo->spis[1] != 0xFFFFFFFF) { + if (espinfo->invflags & IPT_ESP_INV_SPI) + printf("! "); + if (espinfo->spis[0] + != espinfo->spis[1]) + printf("--spi %u-%u ", + espinfo->spis[0], + espinfo->spis[1]); + else + printf("--spi %u ", + espinfo->spis[0]); + } + +} + +struct iptables_match esp += { NULL, + "esp", + NETFILTER_VERSION, + IPT_ALIGN(sizeof(struct ipt_esp)), + IPT_ALIGN(sizeof(struct ipt_esp)), + &help, + &init, + &parse, + &final_check, + &print, + &save, + opts +}; + +void +_init(void) +{ + register_match(&esp); +} |