1 /* Shared library add-on to iptables to add CONNMARK target support.
3 * (C) 2002,2004 MARA Systems AB <http://www.marasystems.com>
4 * by Henrik Nordstrom <hno@marasystems.com>
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
27 #include <ip6tables.h>
28 #include <linux/netfilter_ipv6/ip6_tables.h>
29 #include "../include/linux/netfilter_ipv4/ipt_CONNMARK.h"
33 struct ipt_entry_target t
;
34 struct ipt_connmark_target_info mark
;
38 /* Function which prints out usage message. */
43 "CONNMARK target v%s options:\n"
44 " --set-mark value[/mask] Set conntrack mark value\n"
45 " --save-mark [--mask mask] Save the packet nfmark in the connection\n"
46 " --restore-mark [--mask mask] Restore saved nfmark value\n"
51 static struct option opts
[] = {
52 { "set-mark", 1, 0, '1' },
53 { "save-mark", 0, 0, '2' },
54 { "restore-mark", 0, 0, '3' },
55 { "mask", 1, 0, '4' },
59 /* Initialize the target. */
61 init(struct ip6t_entry_target
*t
, unsigned int *nfcache
)
65 /* Function which parses command options; returns true if it
68 parse(int c
, char **argv
, int invert
, unsigned int *flags
,
69 const struct ip6t_entry
*entry
,
70 struct ip6t_entry_target
**target
)
72 struct ipt_connmark_target_info
*markinfo
73 = (struct ipt_connmark_target_info
*)(*target
)->data
;
75 markinfo
->mask
= 0xffffffffUL
;
80 markinfo
->mode
= IPT_CONNMARK_SET
;
82 markinfo
->mark
= strtoul(optarg
, &end
, 0);
83 if (*end
== '/' && end
[1] != '\0')
84 markinfo
->mask
= strtoul(end
+1, &end
, 0);
86 if (*end
!= '\0' || end
== optarg
)
87 exit_error(PARAMETER_PROBLEM
, "Bad MARK value `%s'", optarg
);
89 exit_error(PARAMETER_PROBLEM
,
90 "CONNMARK target: Can't specify --set-mark twice");
94 markinfo
->mode
= IPT_CONNMARK_SAVE
;
96 exit_error(PARAMETER_PROBLEM
,
97 "CONNMARK target: Can't specify --save-mark twice");
101 markinfo
->mode
= IPT_CONNMARK_RESTORE
;
103 exit_error(PARAMETER_PROBLEM
,
104 "CONNMARK target: Can't specify --restore-mark twice");
109 exit_error(PARAMETER_PROBLEM
,
110 "CONNMARK target: Can't specify --mask without a operation");
111 markinfo
->mask
= strtoul(optarg
, &end
, 0);
113 if (*end
!= '\0' || end
== optarg
)
114 exit_error(PARAMETER_PROBLEM
, "Bad MASK value `%s'", optarg
);
124 final_check(unsigned int flags
)
127 exit_error(PARAMETER_PROBLEM
,
128 "CONNMARK target: No operation specified");
132 print_mark(unsigned long mark
)
134 printf("0x%lx", mark
);
138 print_mask(const char *text
, unsigned long mask
)
140 if (mask
!= 0xffffffffUL
)
141 printf("%s0x%lx", text
, mask
);
145 /* Prints out the target info. */
147 print(const struct ip6t_ip6
*ip
,
148 const struct ip6t_entry_target
*target
,
151 const struct ipt_connmark_target_info
*markinfo
=
152 (const struct ipt_connmark_target_info
*)target
->data
;
153 switch (markinfo
->mode
) {
154 case IPT_CONNMARK_SET
:
155 printf("CONNMARK set ");
156 print_mark(markinfo
->mark
);
157 print_mask("/", markinfo
->mask
);
160 case IPT_CONNMARK_SAVE
:
161 printf("CONNMARK save ");
162 print_mask("mask ", markinfo
->mask
);
165 case IPT_CONNMARK_RESTORE
:
166 printf("CONNMARK restore ");
167 print_mask("mask ", markinfo
->mask
);
170 printf("ERROR: UNKNOWN CONNMARK MODE ");
175 /* Saves the target into in parsable form to stdout. */
177 save(const struct ip6t_ip6
*ip
, const struct ip6t_entry_target
*target
)
179 const struct ipt_connmark_target_info
*markinfo
=
180 (const struct ipt_connmark_target_info
*)target
->data
;
182 switch (markinfo
->mode
) {
183 case IPT_CONNMARK_SET
:
184 printf("--set-mark ");
185 print_mark(markinfo
->mark
);
186 print_mask("/", markinfo
->mask
);
189 case IPT_CONNMARK_SAVE
:
190 printf("--save-mark ");
191 print_mask("--mask ", markinfo
->mask
);
193 case IPT_CONNMARK_RESTORE
:
194 printf("--restore-mark ");
195 print_mask("--mask ", markinfo
->mask
);
198 printf("ERROR: UNKNOWN CONNMARK MODE ");
203 static struct ip6tables_target connmark_target
= {
205 .version
= IPTABLES_VERSION
,
206 .size
= IP6T_ALIGN(sizeof(struct ipt_connmark_target_info
)),
207 .userspacesize
= IP6T_ALIGN(sizeof(struct ipt_connmark_target_info
)),
211 .final_check
= &final_check
,
219 register_target6(&connmark_target
);