release/src/router/iptables/extensions/libipt_state.c

   1 /* Shared library add-on to iptables to add state tracking support. */
   2 #include <stdio.h>
   3 #include <netdb.h>
   4 #include <string.h>
   5 #include <stdlib.h>
   6 #include <getopt.h>
   7 #include <iptables.h>
   8 #include <linux/netfilter/nf_conntrack_common.h>
   9 #include <linux/netfilter_ipv4/ipt_state.h>
  10
  11 #ifndef IPT_STATE_UNTRACKED
  12 #define IPT_STATE_UNTRACKED (1 << (IP_CT_NUMBER + 1))
  13 #endif
  14
  15 /* Function which prints out usage message. */
  16 static void
  17 help(void)
  18 {
  19         printf(
  20 "state v%s options:\n"
  21 " [!] --state [INVALID|ESTABLISHED|NEW|RELATED|UNTRACKED][,...]\n"
  22 "                               State(s) to match\n"
  23 "\n", IPTABLES_VERSION);
  24 }
  25
  26 static struct option opts[] = {
  27         { "state", 1, 0, '1' },
  28         {0}
  29 };
  30
  31 static int
  32 parse_state(const char *state, size_t strlen, struct ipt_state_info *sinfo)
  33 {
  34         if (strncasecmp(state, "INVALID", strlen) == 0)
  35                 sinfo->statemask |= IPT_STATE_INVALID;
  36         else if (strncasecmp(state, "NEW", strlen) == 0)
  37                 sinfo->statemask |= IPT_STATE_BIT(IP_CT_NEW);
  38         else if (strncasecmp(state, "ESTABLISHED", strlen) == 0)
  39                 sinfo->statemask |= IPT_STATE_BIT(IP_CT_ESTABLISHED);
  40         else if (strncasecmp(state, "RELATED", strlen) == 0)
  41                 sinfo->statemask |= IPT_STATE_BIT(IP_CT_RELATED);
  42         else if (strncasecmp(state, "UNTRACKED", strlen) == 0)
  43                 sinfo->statemask |= IPT_STATE_UNTRACKED;
  44         else
  45                 return 0;
  46         return 1;
  47 }
  48
  49 static void
  50 parse_states(const char *arg, struct ipt_state_info *sinfo)
  51 {
  52         const char *comma;
  53
  54         while ((comma = strchr(arg, ',')) != NULL) {
  55                 if (comma == arg || !parse_state(arg, comma-arg, sinfo))
  56                         exit_error(PARAMETER_PROBLEM, "Bad state `%s'", arg);
  57                 arg = comma+1;
  58         }
  59
  60         if (strlen(arg) == 0 || !parse_state(arg, strlen(arg), sinfo))
  61                 exit_error(PARAMETER_PROBLEM, "Bad state `%s'", arg);
  62 }
  63
  64 /* Function which parses command options; returns true if it
  65    ate an option */
  66 static int
  67 parse(int c, char **argv, int invert, unsigned int *flags,
  68       const struct ipt_entry *entry,
  69       unsigned int *nfcache,
  70       struct ipt_entry_match **match)
  71 {
  72         struct ipt_state_info *sinfo = (struct ipt_state_info *)(*match)->data;
  73
  74         switch (c) {
  75         case '1':
  76                 check_inverse(optarg, &invert, &optind, 0);
  77
  78                 parse_states(argv[optind-1], sinfo);
  79                 if (invert)
  80                         sinfo->statemask = ~sinfo->statemask;
  81                 *flags = 1;
  82                 break;
  83
  84         default:
  85                 return 0;
  86         }
  87
  88         return 1;
  89 }
  90
  91 /* Final check; must have specified --state. */
  92 static void final_check(unsigned int flags)
  93 {
  94         if (!flags)
  95                 exit_error(PARAMETER_PROBLEM, "You must specify `--state'");
  96 }
  97
  98 static void print_state(unsigned int statemask)
  99 {
 100         const char *sep = "";
 101
 102         if (statemask & IPT_STATE_INVALID) {
 103                 printf("%sINVALID", sep);
 104                 sep = ",";
 105         }
 106         if (statemask & IPT_STATE_BIT(IP_CT_NEW)) {
 107                 printf("%sNEW", sep);
 108                 sep = ",";
 109         }
 110         if (statemask & IPT_STATE_BIT(IP_CT_RELATED)) {
 111                 printf("%sRELATED", sep);
 112                 sep = ",";
 113         }
 114         if (statemask & IPT_STATE_BIT(IP_CT_ESTABLISHED)) {
 115                 printf("%sESTABLISHED", sep);
 116                 sep = ",";
 117         }
 118         if (statemask & IPT_STATE_UNTRACKED) {
 119                 printf("%sUNTRACKED", sep);
 120                 sep = ",";
 121         }
 122         printf(" ");
 123 }
 124
 125 /* Prints out the matchinfo. */
 126 static void
 127 print(const struct ipt_ip *ip,
 128       const struct ipt_entry_match *match,
 129       int numeric)
 130 {
 131         struct ipt_state_info *sinfo = (struct ipt_state_info *)match->data;
 132
 133         printf("state ");
 134         print_state(sinfo->statemask);
 135 }
 136
 137 /* Saves the matchinfo in parsable form to stdout. */
 138 static void save(const struct ipt_ip *ip, const struct ipt_entry_match *match)
 139 {
 140         struct ipt_state_info *sinfo = (struct ipt_state_info *)match->data;
 141
 142         printf("--state ");
 143         print_state(sinfo->statemask);
 144 }
 145
 146 static struct iptables_match state = {
 147         .next           = NULL,
 148         .name           = "state",
 149         .version        = IPTABLES_VERSION,
 150         .size           = IPT_ALIGN(sizeof(struct ipt_state_info)),
 151         .userspacesize  = IPT_ALIGN(sizeof(struct ipt_state_info)),
 152         .help           = &help,
 153         .parse          = &parse,
 154         .final_check    = &final_check,
 155         .print          = &print,
 156         .save           = &save,
 157         .extra_opts     = opts
 158 };
 159
 160 void _init(void)
 161 {
 162         register_match(&state);
 163 }