From dda749a352a17d88b1ce8480e31ebab62cc81d1c Mon Sep 17 00:00:00 2001 From: "/C=DE/ST=Berlin/L=Berlin/O=Netfilter Project/OU=Development/CN=kadlec/emailAddress=kadlec@netfilter.org" Date: Wed, 1 Dec 2004 09:11:33 +0000 Subject: ipset 2 related updates (JK) --- extensions/libipt_set.h | 104 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 104 insertions(+) create mode 100644 extensions/libipt_set.h (limited to 'extensions/libipt_set.h') diff --git a/extensions/libipt_set.h b/extensions/libipt_set.h new file mode 100644 index 0000000..0d6b329 --- /dev/null +++ b/extensions/libipt_set.h @@ -0,0 +1,104 @@ +#ifndef _LIBIPT_SET_H +#define _LIBIPT_SET_H + +#include +#include +#include + +#ifdef DEBUG +#define DEBUGP(x, args...) fprintf(stderr, x, ## args) +#else +#define DEBUGP(x, args...) +#endif + +static void +parse_bindings(const char *optarg, struct ipt_set_info *info) +{ + char *saved = strdup(optarg); + char *ptr, *tmp = saved; + int i = 0; + + while (i < (IP_SET_MAX_BINDINGS - 1) && tmp != NULL) { + ptr = strsep(&tmp, ","); + if (strncmp(ptr, "src", 3) == 0) + info->flags[i++] |= IPSET_SRC; + else if (strncmp(ptr, "dst", 3) == 0) + info->flags[i++] |= IPSET_DST; + else + exit_error(PARAMETER_PROBLEM, + "You must spefify (the comma separated list of) 'src' or 'dst'."); + } + + if (tmp) + exit_error(PARAMETER_PROBLEM, + "Can't follow bindings deeper than %i.", + IP_SET_MAX_BINDINGS - 1); + + free(saved); +} + +static int get_set_getsockopt(void *data, size_t * size) +{ + int sockfd = -1; + sockfd = socket(AF_INET, SOCK_RAW, IPPROTO_RAW); + if (sockfd < 0) + exit_error(OTHER_PROBLEM, + "Can't open socket to ipset.\n"); + /* Send! */ + return getsockopt(sockfd, SOL_IP, SO_IP_SET, data, size); +} + +static void get_set_byname(const char *setname, struct ipt_set_info *info) +{ + struct ip_set_req_get_set req; + int size = sizeof(struct ip_set_req_get_set); + int res; + + req.op = IP_SET_OP_GET_BYNAME; + req.version = IP_SET_PROTOCOL_VERSION; + strncpy(req.set.name, setname, IP_SET_MAXNAMELEN); + req.set.name[IP_SET_MAXNAMELEN - 1] = '\0'; + res = get_set_getsockopt(&req, &size); + if (res != 0) + exit_error(OTHER_PROBLEM, + "Problem when communicating with ipset, errno=%d.\n", + errno); + if (size != sizeof(struct ip_set_req_get_set)) + exit_error(OTHER_PROBLEM, + "Incorrect return size from kernel during ipset lookup, " + "(want %d, got %d)\n", + sizeof(struct ip_set_req_get_set), size); + if (req.set.index == IP_SET_INVALID_ID) + exit_error(PARAMETER_PROBLEM, + "Set %s doesn't exist.\n", setname); + + info->index = req.set.index; +} + +static void get_set_byid(char * setname, ip_set_id_t index) +{ + struct ip_set_req_get_set req; + int size = sizeof(struct ip_set_req_get_set); + int res; + + req.op = IP_SET_OP_GET_BYINDEX; + req.version = IP_SET_PROTOCOL_VERSION; + req.set.index = index; + res = get_set_getsockopt(&req, &size); + if (res != 0) + exit_error(OTHER_PROBLEM, + "Problem when communicating with ipset, errno=%d.\n", + errno); + if (size != sizeof(struct ip_set_req_get_set)) + exit_error(OTHER_PROBLEM, + "Incorrect return size from kernel during ipset lookup, " + "(want %d, got %d)\n", + sizeof(struct ip_set_req_get_set), size); + if (req.set.name[0] == '\0') + exit_error(PARAMETER_PROBLEM, + "Set id %i in kernel doesn't exist.\n", index); + + strncpy(setname, req.set.name, IP_SET_MAXNAMELEN); +} + +#endif /*_LIBIPT_SET_H*/ -- cgit v1.2.3