release/src/router/iptables/extensions/libip6t_CONNMARK.c

   1 /* Shared library add-on to iptables to add CONNMARK target support.
   2  *
   3  * (C) 2002,2004 MARA Systems AB <http://www.marasystems.com>
   4  * by Henrik Nordstrom <hno@marasystems.com>
   5  *
   6  * Version 1.1
   7  *
   8  * This program is free software; you can redistribute it and/or modify
   9  * it under the terms of the GNU General Public License as published by
  10  * the Free Software Foundation; either version 2 of the License, or
  11  * (at your option) any later version.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  * GNU General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * along with this program; if not, write to the Free Software
  20  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  21  */
  22 #include <stdio.h>
  23 #include <string.h>
  24 #include <stdlib.h>
  25 #include <getopt.h>
  26
  27 #include <ip6tables.h>
  28 #include <linux/netfilter_ipv6/ip6_tables.h>
  29 #include <linux/netfilter_ipv4/ipt_CONNMARK.h>
  30
  31 #if 0
  32 struct markinfo {
  33         struct ipt_entry_target t;
  34         struct ipt_connmark_target_info mark;
  35 };
  36 #endif
  37
  38 /* Function which prints out usage message. */
  39 static void
  40 help(void)
  41 {
  42         printf(
  43 "CONNMARK target v%s options:\n"
  44 "  --set-mark value[/mask]       Set conntrack mark value\n"
  45 "  --set-return [--mask mask]    Set conntrack mark & nfmark, RETURN\n"
  46 "  --save-mark [--mask mask]     Save the packet nfmark in the connection\n"
  47 "  --restore-mark [--mask mask]  Restore saved nfmark value\n"
  48 "\n",
  49 IPTABLES_VERSION);
  50 }
  51
  52 static struct option opts[] = {
  53         { "set-mark", 1, 0, '1' },
  54         { "save-mark", 0, 0, '2' },
  55         { "restore-mark", 0, 0, '3' },
  56         { "mask", 1, 0, '4' },
  57         { "set-return", 1, 0, '9' },
  58         { 0 }
  59 };
  60
  61 /* Initialize the target. */
  62 static void
  63 init(struct ip6t_entry_target *t, unsigned int *nfcache)
  64 {
  65         struct ipt_connmark_target_info *markinfo
  66                 = (struct ipt_connmark_target_info *)t->data;
  67
  68         markinfo->mask = 0xffffffffUL;
  69
  70 }
  71
  72 /* Function which parses command options; returns true if it
  73    ate an option */
  74 static int
  75 parse(int c, char **argv, int invert, unsigned int *flags,
  76       const struct ip6t_entry *entry,
  77       struct ip6t_entry_target **target)
  78 {
  79         struct ipt_connmark_target_info *markinfo
  80                 = (struct ipt_connmark_target_info *)(*target)->data;
  81
  82         switch (c) {
  83                 char *end;
  84         case '1':
  85         case '9':
  86                 markinfo->mode = (c == '1') ? IPT_CONNMARK_SET : IPT_CONNMARK_SET_RETURN;
  87
  88                 markinfo->mark = strtoul(optarg, &end, 0);
  89                 if (*end == '/' && end[1] != '\0')
  90                     markinfo->mask = strtoul(end+1, &end, 0);
  91
  92                 if (*end != '\0' || end == optarg)
  93                         exit_error(PARAMETER_PROBLEM, "Bad MARK value `%s'", optarg);
  94                 if (*flags)
  95                         exit_error(PARAMETER_PROBLEM,
  96                                    "CONNMARK target: Can't specify --set-mark twice");
  97                 *flags = 1;
  98                 break;
  99         case '2':
 100                 markinfo->mode = IPT_CONNMARK_SAVE;
 101                 if (*flags)
 102                         exit_error(PARAMETER_PROBLEM,
 103                                    "CONNMARK target: Can't specify --save-mark twice");
 104                 *flags = 1;
 105                 break;
 106         case '3':
 107                 markinfo->mode = IPT_CONNMARK_RESTORE;
 108                 if (*flags)
 109                         exit_error(PARAMETER_PROBLEM,
 110                                    "CONNMARK target: Can't specify --restore-mark twice");
 111                 *flags = 1;
 112                 break;
 113         case '4':
 114                 if (!*flags)
 115                         exit_error(PARAMETER_PROBLEM,
 116                                    "CONNMARK target: Can't specify --mask without a operation");
 117                 markinfo->mask = strtoul(optarg, &end, 0);
 118
 119                 if (*end != '\0' || end == optarg)
 120                         exit_error(PARAMETER_PROBLEM, "Bad MASK value `%s'", optarg);
 121                 break;
 122         default:
 123                 return 0;
 124         }
 125
 126         return 1;
 127 }
 128
 129 static void
 130 final_check(unsigned int flags)
 131 {
 132         if (!flags)
 133                 exit_error(PARAMETER_PROBLEM,
 134                            "CONNMARK target: No operation specified");
 135 }
 136
 137 static void
 138 print_mark(unsigned long mark)
 139 {
 140         printf("0x%lx", mark);
 141 }
 142
 143 static void
 144 print_mask(const char *text, unsigned long mask)
 145 {
 146         if (mask != 0xffffffffUL)
 147                 printf("%s0x%lx", text, mask);
 148 }
 149
 150
 151 /* Prints out the target info. */
 152 static void
 153 print(const struct ip6t_ip6 *ip,
 154       const struct ip6t_entry_target *target,
 155       int numeric)
 156 {
 157         const struct ipt_connmark_target_info *markinfo =
 158                 (const struct ipt_connmark_target_info *)target->data;
 159         switch (markinfo->mode) {
 160         case IPT_CONNMARK_SET:
 161         case IPT_CONNMARK_SET_RETURN:
 162             printf("CONNMARK set%s ", (markinfo->mode == IPT_CONNMARK_SET_RETURN) ? "-return" : "");
 163
 164             print_mark(markinfo->mark);
 165             print_mask("/", markinfo->mask);
 166             printf(" ");
 167             break;
 168         case IPT_CONNMARK_SAVE:
 169             printf("CONNMARK save ");
 170             print_mask("mask ", markinfo->mask);
 171             printf(" ");
 172             break;
 173         case IPT_CONNMARK_RESTORE:
 174             printf("CONNMARK restore ");
 175             print_mask("mask ", markinfo->mask);
 176             break;
 177         default:
 178             printf("ERROR: UNKNOWN CONNMARK MODE ");
 179             break;
 180         }
 181 }
 182
 183 /* Saves the target into in parsable form to stdout. */
 184 static void
 185 save(const struct ip6t_ip6 *ip, const struct ip6t_entry_target *target)
 186 {
 187         const struct ipt_connmark_target_info *markinfo =
 188                 (const struct ipt_connmark_target_info *)target->data;
 189
 190         switch (markinfo->mode) {
 191         case IPT_CONNMARK_SET:
 192         case IPT_CONNMARK_SET_RETURN:
 193             printf("--set-%s ", (markinfo->mode == IPT_CONNMARK_SET_RETURN) ? "return" : "mark");
 194
 195             print_mark(markinfo->mark);
 196             print_mask("/", markinfo->mask);
 197             printf(" ");
 198             break;
 199         case IPT_CONNMARK_SAVE:
 200             printf("--save-mark ");
 201             print_mask("--mask ", markinfo->mask);
 202             break;
 203         case IPT_CONNMARK_RESTORE:
 204             printf("--restore-mark ");
 205             print_mask("--mask ", markinfo->mask);
 206             break;
 207         default:
 208             printf("ERROR: UNKNOWN CONNMARK MODE ");
 209             break;
 210         }
 211 }
 212
 213 static struct ip6tables_target connmark_target = {
 214     .name          = "CONNMARK",
 215     .version       = IPTABLES_VERSION,
 216     .size          = IP6T_ALIGN(sizeof(struct ipt_connmark_target_info)),
 217     .userspacesize = IP6T_ALIGN(sizeof(struct ipt_connmark_target_info)),
 218     .help          = &help,
 219     .init          = &init,
 220     .parse         = &parse,
 221     .final_check   = &final_check,
 222     .print         = &print,
 223     .save          = &save,
 224     .extra_opts    = opts
 225 };
 226
 227 void _init(void)
 228 {
 229         register_target6(&connmark_target);
 230 }