1 /* Shared library add-on to iptables to add CONNMARK target support.
3 * (C) 2002,2004 MARA Systems AB <http://www.marasystems.com>
4 * by Henrik Nordstrom <hno@marasystems.com>
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
27 #include <ip6tables.h>
28 #include <linux/netfilter_ipv6/ip6_tables.h>
29 #include <linux/netfilter_ipv4/ipt_CONNMARK.h>
33 struct ipt_entry_target t
;
34 struct ipt_connmark_target_info mark
;
38 /* Function which prints out usage message. */
43 "CONNMARK target v%s options:\n"
44 " --set-mark value[/mask] Set conntrack mark value\n"
45 " --set-return [--mask mask] Set conntrack mark & nfmark, RETURN\n"
46 " --save-mark [--mask mask] Save the packet nfmark in the connection\n"
47 " --restore-mark [--mask mask] Restore saved nfmark value\n"
52 static struct option opts
[] = {
53 { "set-mark", 1, 0, '1' },
54 { "save-mark", 0, 0, '2' },
55 { "restore-mark", 0, 0, '3' },
56 { "mask", 1, 0, '4' },
57 { "set-return", 1, 0, '9' },
61 /* Initialize the target. */
63 init(struct ip6t_entry_target
*t
, unsigned int *nfcache
)
65 struct ipt_connmark_target_info
*markinfo
66 = (struct ipt_connmark_target_info
*)t
->data
;
68 markinfo
->mask
= 0xffffffffUL
;
72 /* Function which parses command options; returns true if it
75 parse(int c
, char **argv
, int invert
, unsigned int *flags
,
76 const struct ip6t_entry
*entry
,
77 struct ip6t_entry_target
**target
)
79 struct ipt_connmark_target_info
*markinfo
80 = (struct ipt_connmark_target_info
*)(*target
)->data
;
86 markinfo
->mode
= (c
== '1') ? IPT_CONNMARK_SET
: IPT_CONNMARK_SET_RETURN
;
88 markinfo
->mark
= strtoul(optarg
, &end
, 0);
89 if (*end
== '/' && end
[1] != '\0')
90 markinfo
->mask
= strtoul(end
+1, &end
, 0);
92 if (*end
!= '\0' || end
== optarg
)
93 exit_error(PARAMETER_PROBLEM
, "Bad MARK value `%s'", optarg
);
95 exit_error(PARAMETER_PROBLEM
,
96 "CONNMARK target: Can't specify --set-mark twice");
100 markinfo
->mode
= IPT_CONNMARK_SAVE
;
102 exit_error(PARAMETER_PROBLEM
,
103 "CONNMARK target: Can't specify --save-mark twice");
107 markinfo
->mode
= IPT_CONNMARK_RESTORE
;
109 exit_error(PARAMETER_PROBLEM
,
110 "CONNMARK target: Can't specify --restore-mark twice");
115 exit_error(PARAMETER_PROBLEM
,
116 "CONNMARK target: Can't specify --mask without a operation");
117 markinfo
->mask
= strtoul(optarg
, &end
, 0);
119 if (*end
!= '\0' || end
== optarg
)
120 exit_error(PARAMETER_PROBLEM
, "Bad MASK value `%s'", optarg
);
130 final_check(unsigned int flags
)
133 exit_error(PARAMETER_PROBLEM
,
134 "CONNMARK target: No operation specified");
138 print_mark(unsigned long mark
)
140 printf("0x%lx", mark
);
144 print_mask(const char *text
, unsigned long mask
)
146 if (mask
!= 0xffffffffUL
)
147 printf("%s0x%lx", text
, mask
);
151 /* Prints out the target info. */
153 print(const struct ip6t_ip6
*ip
,
154 const struct ip6t_entry_target
*target
,
157 const struct ipt_connmark_target_info
*markinfo
=
158 (const struct ipt_connmark_target_info
*)target
->data
;
159 switch (markinfo
->mode
) {
160 case IPT_CONNMARK_SET
:
161 case IPT_CONNMARK_SET_RETURN
:
162 printf("CONNMARK set%s ", (markinfo
->mode
== IPT_CONNMARK_SET_RETURN
) ? "-return" : "");
164 print_mark(markinfo
->mark
);
165 print_mask("/", markinfo
->mask
);
168 case IPT_CONNMARK_SAVE
:
169 printf("CONNMARK save ");
170 print_mask("mask ", markinfo
->mask
);
173 case IPT_CONNMARK_RESTORE
:
174 printf("CONNMARK restore ");
175 print_mask("mask ", markinfo
->mask
);
178 printf("ERROR: UNKNOWN CONNMARK MODE ");
183 /* Saves the target into in parsable form to stdout. */
185 save(const struct ip6t_ip6
*ip
, const struct ip6t_entry_target
*target
)
187 const struct ipt_connmark_target_info
*markinfo
=
188 (const struct ipt_connmark_target_info
*)target
->data
;
190 switch (markinfo
->mode
) {
191 case IPT_CONNMARK_SET
:
192 case IPT_CONNMARK_SET_RETURN
:
193 printf("--set-%s ", (markinfo
->mode
== IPT_CONNMARK_SET_RETURN
) ? "return" : "mark");
195 print_mark(markinfo
->mark
);
196 print_mask("/", markinfo
->mask
);
199 case IPT_CONNMARK_SAVE
:
200 printf("--save-mark ");
201 print_mask("--mask ", markinfo
->mask
);
203 case IPT_CONNMARK_RESTORE
:
204 printf("--restore-mark ");
205 print_mask("--mask ", markinfo
->mask
);
208 printf("ERROR: UNKNOWN CONNMARK MODE ");
213 static struct ip6tables_target connmark_target
= {
215 .version
= IPTABLES_VERSION
,
216 .size
= IP6T_ALIGN(sizeof(struct ipt_connmark_target_info
)),
217 .userspacesize
= IP6T_ALIGN(sizeof(struct ipt_connmark_target_info
)),
221 .final_check
= &final_check
,
229 register_target6(&connmark_target
);