From 2ea56498b07506c00a511ddee39cb1c4bd85457d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andr=C3=A1s=20Kis-Szab=C3=B3?= Date: Mon, 29 Apr 2002 13:51:37 +0000 Subject: new HBH and DSTopts match for IPv6 by kisza --- extensions/.opts-test6 | 2 + extensions/libip6t_dst.c | 285 +++++++++++++++++++++++++++++++++++++++++++++++ extensions/libip6t_hbh.c | 285 +++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 572 insertions(+) create mode 100755 extensions/.opts-test6 create mode 100644 extensions/libip6t_dst.c create mode 100644 extensions/libip6t_hbh.c (limited to 'extensions') diff --git a/extensions/.opts-test6 b/extensions/.opts-test6 new file mode 100755 index 00000000..1ed20135 --- /dev/null +++ b/extensions/.opts-test6 @@ -0,0 +1,2 @@ +#!/bin/sh +[ -f $KERNEL_DIR/net/ipv6/netfilter/ip6t_hbh.c -a -f $KERNEL_DIR/net/ipv6/netfilter/ip6t_dst.c -a -f $KERNEL_DIR/include/linux/netfilter_ipv6/ip6t_opts.h ] && echo hbh dst diff --git a/extensions/libip6t_dst.c b/extensions/libip6t_dst.c new file mode 100644 index 00000000..cd1f23b5 --- /dev/null +++ b/extensions/libip6t_dst.c @@ -0,0 +1,285 @@ +/* Shared library add-on to ip6tables to add Hop-by-Hop and Dst headers support. */ +#include +#include +#include +#include +#include +#include +#include +/*#include */ +#include +#include +#include +#include + +#define DEBUG 0 +#define HOPBYHOP 0 +#define UNAME (HOPBYHOP ? "HBH" : "DST") +#define LNAME (HOPBYHOP ? "hbh" : "dst") + +/* Function which prints out usage message. */ +static void +help(void) +{ + printf( +"%s v%s options:\n" +" --%s-len [!] length total length of this header\n" +" --%s-opts TYPE[:LEN][,TYPE[:LEN]...] \n" +" Options and its length (list, max: %d)\n", +UNAME , NETFILTER_VERSION, LNAME, LNAME, IP6T_OPTS_OPTSNR); +} + +#if HOPBYHOP +static struct option opts[] = { + { "hbh-len", 1, 0, '1' }, + { "hbh-opts", 1, 0, '2' }, + { "hbh-not-strict", 1, 0, '3' }, + {0} +}; +#else +static struct option opts[] = { + { "dst-len", 1, 0, '1' }, + { "dst-opts", 1, 0, '2' }, + { "dst-not-strict", 1, 0, '3' }, + {0} +}; +#endif + +static u_int32_t +parse_opts_num(const char *idstr, const char *typestr) +{ + unsigned long int id; + char* ep; + + id = strtoul(idstr,&ep,0) ; + + if ( idstr == ep ) { + exit_error(PARAMETER_PROBLEM, + "%s no valid digits in %s `%s'", UNAME, typestr, idstr); + } + if ( id == ULONG_MAX && errno == ERANGE ) { + exit_error(PARAMETER_PROBLEM, + "%s `%s' specified too big: would overflow", + typestr, idstr); + } + if ( *idstr != '\0' && *ep != '\0' ) { + exit_error(PARAMETER_PROBLEM, + "%s error parsing %s `%s'", UNAME, typestr, idstr); + } + return (u_int32_t) id; +} + +static int +parse_options(const char *optsstr, u_int16_t *opts) +{ + char *buffer, *cp, *next, *range; + unsigned int i; + + buffer = strdup(optsstr); + if (!buffer) exit_error(OTHER_PROBLEM, "strdup failed"); + + for (cp=buffer, i=0; cp && idata; + + optinfo->hdrlen = 0; + optinfo->flags = 0; + optinfo->invflags = 0; + optinfo->optsnr = 0; +} + +/* Function which parses command options; returns true if it + ate an option */ +static int +parse(int c, char **argv, int invert, unsigned int *flags, + const struct ip6t_entry *entry, + unsigned int *nfcache, + struct ip6t_entry_match **match) +{ + struct ip6t_opts *optinfo = (struct ip6t_opts *)(*match)->data; + + switch (c) { + case '1': + if (*flags & IP6T_OPTS_LEN) + exit_error(PARAMETER_PROBLEM, + "Only one `--%s-len' allowed", LNAME); + check_inverse(optarg, &invert, &optind, 0); + optinfo->hdrlen = parse_opts_num(argv[optind-1], "length"); + if (invert) + optinfo->invflags |= IP6T_OPTS_INV_LEN; + optinfo->flags |= IP6T_OPTS_LEN; + *flags |= IP6T_OPTS_LEN; + break; + case '2': + if (*flags & IP6T_OPTS_OPTS) + exit_error(PARAMETER_PROBLEM, + "Only one `--%s-opts' allowed", LNAME); + check_inverse(optarg, &invert, &optind, 0); + if (invert) + exit_error(PARAMETER_PROBLEM, + " '!' not allowed with `--%s-opts'", LNAME); + optinfo->optsnr = parse_options(argv[optind-1], optinfo->opts); + optinfo->flags |= IP6T_OPTS_OPTS; + *flags |= IP6T_OPTS_OPTS; + break; + case '3': + if (*flags & IP6T_OPTS_NSTRICT) + exit_error(PARAMETER_PROBLEM, + "Only one `--%s-not-strict' allowed", LNAME); + if ( !(*flags & IP6T_OPTS_OPTS) ) + exit_error(PARAMETER_PROBLEM, + "`--%s-opts ...' required before `--%s-not-strict'", LNAME, LNAME); + optinfo->flags |= IP6T_OPTS_NSTRICT; + *flags |= IP6T_OPTS_NSTRICT; + break; + default: + return 0; + } + + return 1; +} + +/* Final check; we don't care. */ +static void +final_check(unsigned int flags) +{ +} + +static void +print_nums(const char *name, u_int32_t min, u_int32_t max, + int invert) +{ + const char *inv = invert ? "!" : ""; + + if (min != 0 || max != 0xFFFFFFFF || invert) { + printf("%s", name); + if (min == max) { + printf(":%s", inv); + printf("%u", min); + } else { + printf("s:%s", inv); + printf("%u",min); + printf(":"); + printf("%u",max); + } + printf(" "); + } +} + +static void +print_options(int optsnr, u_int16_t *optsp) +{ + unsigned int i; + + for(i=0; i>8); + if ((optsp[i] & 0x00FF) != 0x00FF){ + printf(":%d", (optsp[i] & 0x00FF)); + } + printf("%c", (i!=optsnr-1)?',':' '); + } +} + +/* Prints out the union ip6t_matchinfo. */ +static void +print(const struct ip6t_ip6 *ip, + const struct ip6t_entry_match *match, int numeric) +{ + const struct ip6t_opts *optinfo = (struct ip6t_opts *)match->data; + + printf("%s ", LNAME); + if (optinfo->flags & IP6T_OPTS_LEN) { + printf("length"); + printf(":%s", optinfo->invflags & IP6T_OPTS_INV_LEN ? "!" : ""); + printf("%u", optinfo->hdrlen); + printf(" "); + } + if (optinfo->flags & IP6T_OPTS_OPTS) printf("opts "); + print_options(optinfo->optsnr, optinfo->opts); + if (optinfo->flags & IP6T_OPTS_NSTRICT) printf("not-strict "); + if (optinfo->invflags & ~IP6T_OPTS_INV_MASK) + printf("Unknown invflags: 0x%X ", + optinfo->invflags & ~IP6T_OPTS_INV_MASK); +} + +/* Saves the union ip6t_matchinfo in parsable form to stdout. */ +static void save(const struct ip6t_ip6 *ip, const struct ip6t_entry_match *match) +{ + const struct ip6t_opts *optinfo = (struct ip6t_opts *)match->data; + + if (optinfo->flags & IP6T_OPTS_LEN) { + printf("--%s-len %s%u ", LNAME, + (optinfo->invflags & IP6T_OPTS_INV_LEN) ? "! " : "", + optinfo->hdrlen); + } + + if (optinfo->flags & IP6T_OPTS_OPTS) printf("--%s-opts ", LNAME); + print_options(optinfo->optsnr, optinfo->opts); + if (optinfo->flags & IP6T_OPTS_NSTRICT) printf("--%s-not-strict ", LNAME); + +} + +static +struct ip6tables_match optstruct += { NULL, +#if HOPBYHOP + "hbh", +#else + "dst", +#endif + NETFILTER_VERSION, + IP6T_ALIGN(sizeof(struct ip6t_opts)), + IP6T_ALIGN(sizeof(struct ip6t_opts)), + &help, + &init, + &parse, + &final_check, + &print, + &save, + opts +}; + +void +_init(void) +{ + register_match6(&optstruct); +} diff --git a/extensions/libip6t_hbh.c b/extensions/libip6t_hbh.c new file mode 100644 index 00000000..a10d6a4b --- /dev/null +++ b/extensions/libip6t_hbh.c @@ -0,0 +1,285 @@ +/* Shared library add-on to ip6tables to add Hop-by-Hop and Dst headers support. */ +#include +#include +#include +#include +#include +#include +#include +/*#include */ +#include +#include +#include +#include + +#define DEBUG 0 +#define HOPBYHOP 1 +#define UNAME (HOPBYHOP ? "HBH" : "DST") +#define LNAME (HOPBYHOP ? "hbh" : "dst") + +/* Function which prints out usage message. */ +static void +help(void) +{ + printf( +"%s v%s options:\n" +" --%s-len [!] length total length of this header\n" +" --%s-opts TYPE[:LEN][,TYPE[:LEN]...] \n" +" Options and its length (list, max: %d)\n", +UNAME , NETFILTER_VERSION, LNAME, LNAME, IP6T_OPTS_OPTSNR); +} + +#if HOPBYHOP +static struct option opts[] = { + { "hbh-len", 1, 0, '1' }, + { "hbh-opts", 1, 0, '2' }, + { "hbh-not-strict", 1, 0, '3' }, + {0} +}; +#else +static struct option opts[] = { + { "dst-len", 1, 0, '1' }, + { "dst-opts", 1, 0, '2' }, + { "dst-not-strict", 1, 0, '3' }, + {0} +}; +#endif + +static u_int32_t +parse_opts_num(const char *idstr, const char *typestr) +{ + unsigned long int id; + char* ep; + + id = strtoul(idstr,&ep,0) ; + + if ( idstr == ep ) { + exit_error(PARAMETER_PROBLEM, + "%s no valid digits in %s `%s'", UNAME, typestr, idstr); + } + if ( id == ULONG_MAX && errno == ERANGE ) { + exit_error(PARAMETER_PROBLEM, + "%s `%s' specified too big: would overflow", + typestr, idstr); + } + if ( *idstr != '\0' && *ep != '\0' ) { + exit_error(PARAMETER_PROBLEM, + "%s error parsing %s `%s'", UNAME, typestr, idstr); + } + return (u_int32_t) id; +} + +static int +parse_options(const char *optsstr, u_int16_t *opts) +{ + char *buffer, *cp, *next, *range; + unsigned int i; + + buffer = strdup(optsstr); + if (!buffer) exit_error(OTHER_PROBLEM, "strdup failed"); + + for (cp=buffer, i=0; cp && idata; + + optinfo->hdrlen = 0; + optinfo->flags = 0; + optinfo->invflags = 0; + optinfo->optsnr = 0; +} + +/* Function which parses command options; returns true if it + ate an option */ +static int +parse(int c, char **argv, int invert, unsigned int *flags, + const struct ip6t_entry *entry, + unsigned int *nfcache, + struct ip6t_entry_match **match) +{ + struct ip6t_opts *optinfo = (struct ip6t_opts *)(*match)->data; + + switch (c) { + case '1': + if (*flags & IP6T_OPTS_LEN) + exit_error(PARAMETER_PROBLEM, + "Only one `--%s-len' allowed", LNAME); + check_inverse(optarg, &invert, &optind, 0); + optinfo->hdrlen = parse_opts_num(argv[optind-1], "length"); + if (invert) + optinfo->invflags |= IP6T_OPTS_INV_LEN; + optinfo->flags |= IP6T_OPTS_LEN; + *flags |= IP6T_OPTS_LEN; + break; + case '2': + if (*flags & IP6T_OPTS_OPTS) + exit_error(PARAMETER_PROBLEM, + "Only one `--%s-opts' allowed", LNAME); + check_inverse(optarg, &invert, &optind, 0); + if (invert) + exit_error(PARAMETER_PROBLEM, + " '!' not allowed with `--%s-opts'", LNAME); + optinfo->optsnr = parse_options(argv[optind-1], optinfo->opts); + optinfo->flags |= IP6T_OPTS_OPTS; + *flags |= IP6T_OPTS_OPTS; + break; + case '3': + if (*flags & IP6T_OPTS_NSTRICT) + exit_error(PARAMETER_PROBLEM, + "Only one `--%s-not-strict' allowed", LNAME); + if ( !(*flags & IP6T_OPTS_OPTS) ) + exit_error(PARAMETER_PROBLEM, + "`--%s-opts ...' required before `--%s-not-strict'", LNAME, LNAME); + optinfo->flags |= IP6T_OPTS_NSTRICT; + *flags |= IP6T_OPTS_NSTRICT; + break; + default: + return 0; + } + + return 1; +} + +/* Final check; we don't care. */ +static void +final_check(unsigned int flags) +{ +} + +static void +print_nums(const char *name, u_int32_t min, u_int32_t max, + int invert) +{ + const char *inv = invert ? "!" : ""; + + if (min != 0 || max != 0xFFFFFFFF || invert) { + printf("%s", name); + if (min == max) { + printf(":%s", inv); + printf("%u", min); + } else { + printf("s:%s", inv); + printf("%u",min); + printf(":"); + printf("%u",max); + } + printf(" "); + } +} + +static void +print_options(int optsnr, u_int16_t *optsp) +{ + unsigned int i; + + for(i=0; i>8); + if ((optsp[i] & 0x00FF) != 0x00FF){ + printf(":%d", (optsp[i] & 0x00FF)); + } + printf("%c", (i!=optsnr-1)?',':' '); + } +} + +/* Prints out the union ip6t_matchinfo. */ +static void +print(const struct ip6t_ip6 *ip, + const struct ip6t_entry_match *match, int numeric) +{ + const struct ip6t_opts *optinfo = (struct ip6t_opts *)match->data; + + printf("%s ", LNAME); + if (optinfo->flags & IP6T_OPTS_LEN) { + printf("length"); + printf(":%s", optinfo->invflags & IP6T_OPTS_INV_LEN ? "!" : ""); + printf("%u", optinfo->hdrlen); + printf(" "); + } + if (optinfo->flags & IP6T_OPTS_OPTS) printf("opts "); + print_options(optinfo->optsnr, optinfo->opts); + if (optinfo->flags & IP6T_OPTS_NSTRICT) printf("not-strict "); + if (optinfo->invflags & ~IP6T_OPTS_INV_MASK) + printf("Unknown invflags: 0x%X ", + optinfo->invflags & ~IP6T_OPTS_INV_MASK); +} + +/* Saves the union ip6t_matchinfo in parsable form to stdout. */ +static void save(const struct ip6t_ip6 *ip, const struct ip6t_entry_match *match) +{ + const struct ip6t_opts *optinfo = (struct ip6t_opts *)match->data; + + if (optinfo->flags & IP6T_OPTS_LEN) { + printf("--%s-len %s%u ", LNAME, + (optinfo->invflags & IP6T_OPTS_INV_LEN) ? "! " : "", + optinfo->hdrlen); + } + + if (optinfo->flags & IP6T_OPTS_OPTS) printf("--%s-opts ", LNAME); + print_options(optinfo->optsnr, optinfo->opts); + if (optinfo->flags & IP6T_OPTS_NSTRICT) printf("--%s-not-strict ", LNAME); + +} + +static +struct ip6tables_match optstruct += { NULL, +#if HOPBYHOP + "hbh", +#else + "dst", +#endif + NETFILTER_VERSION, + IP6T_ALIGN(sizeof(struct ip6t_opts)), + IP6T_ALIGN(sizeof(struct ip6t_opts)), + &help, + &init, + &parse, + &final_check, + &print, + &save, + opts +}; + +void +_init(void) +{ + register_match6(&optstruct); +} -- cgit v1.2.3