libipt_ah.c revision 73866357e4a7a0fdc1b293bf8863fee2bd56da9e
1/* Shared library add-on to iptables to add AH support. */ 2#include <stdbool.h> 3#include <stdio.h> 4#include <netdb.h> 5#include <string.h> 6#include <stdlib.h> 7#include <getopt.h> 8#include <errno.h> 9#include <xtables.h> 10#include <linux/netfilter_ipv4/ipt_ah.h> 11 12static void ah_help(void) 13{ 14 printf( 15"ah match options:\n" 16"[!] --ahspi spi[:spi]\n" 17" match spi (range)\n"); 18} 19 20static const struct option ah_opts[] = { 21 {.name = "ahspi", .has_arg = true, .val = '1'}, 22 XT_GETOPT_TABLEEND, 23}; 24 25static uint32_t 26parse_ah_spi(const char *spistr) 27{ 28 unsigned long int spi; 29 char* ep; 30 31 spi = strtoul(spistr,&ep,0) ; 32 33 if ( spistr == ep ) { 34 xtables_error(PARAMETER_PROBLEM, 35 "AH no valid digits in spi `%s'", spistr); 36 } 37 if ( spi == ULONG_MAX && errno == ERANGE ) { 38 xtables_error(PARAMETER_PROBLEM, 39 "spi `%s' specified too big: would overflow", spistr); 40 } 41 if ( *spistr != '\0' && *ep != '\0' ) { 42 xtables_error(PARAMETER_PROBLEM, 43 "AH error parsing spi `%s'", spistr); 44 } 45 return spi; 46} 47 48static void 49parse_ah_spis(const char *spistring, uint32_t *spis) 50{ 51 char *buffer; 52 char *cp; 53 54 buffer = strdup(spistring); 55 if ((cp = strchr(buffer, ':')) == NULL) 56 spis[0] = spis[1] = parse_ah_spi(buffer); 57 else { 58 *cp = '\0'; 59 cp++; 60 61 spis[0] = buffer[0] ? parse_ah_spi(buffer) : 0; 62 spis[1] = cp[0] ? parse_ah_spi(cp) : 0xFFFFFFFF; 63 } 64 free(buffer); 65} 66 67static void ah_init(struct xt_entry_match *m) 68{ 69 struct ipt_ah *ahinfo = (struct ipt_ah *)m->data; 70 71 ahinfo->spis[1] = 0xFFFFFFFF; 72} 73 74#define AH_SPI 0x01 75 76static int ah_parse(int c, char **argv, int invert, unsigned int *flags, 77 const void *entry, struct xt_entry_match **match) 78{ 79 struct ipt_ah *ahinfo = (struct ipt_ah *)(*match)->data; 80 81 switch (c) { 82 case '1': 83 if (*flags & AH_SPI) 84 xtables_error(PARAMETER_PROBLEM, 85 "Only one `--ahspi' allowed"); 86 xtables_check_inverse(optarg, &invert, &optind, 0, argv); 87 parse_ah_spis(optarg, ahinfo->spis); 88 if (invert) 89 ahinfo->invflags |= IPT_AH_INV_SPI; 90 *flags |= AH_SPI; 91 break; 92 } 93 94 return 1; 95} 96 97static void 98print_spis(const char *name, uint32_t min, uint32_t max, 99 int invert) 100{ 101 const char *inv = invert ? "!" : ""; 102 103 if (min != 0 || max != 0xFFFFFFFF || invert) { 104 printf("%s", name); 105 if (min == max) { 106 printf(":%s", inv); 107 printf("%u", min); 108 } else { 109 printf("s:%s", inv); 110 printf("%u",min); 111 printf(":"); 112 printf("%u",max); 113 } 114 } 115} 116 117static void ah_print(const void *ip, const struct xt_entry_match *match, 118 int numeric) 119{ 120 const struct ipt_ah *ah = (struct ipt_ah *)match->data; 121 122 printf(" ah "); 123 print_spis("spi", ah->spis[0], ah->spis[1], 124 ah->invflags & IPT_AH_INV_SPI); 125 if (ah->invflags & ~IPT_AH_INV_MASK) 126 printf(" Unknown invflags: 0x%X", 127 ah->invflags & ~IPT_AH_INV_MASK); 128} 129 130static void ah_save(const void *ip, const struct xt_entry_match *match) 131{ 132 const struct ipt_ah *ahinfo = (struct ipt_ah *)match->data; 133 134 if (!(ahinfo->spis[0] == 0 135 && ahinfo->spis[1] == 0xFFFFFFFF)) { 136 printf("%s --ahspi ", 137 (ahinfo->invflags & IPT_AH_INV_SPI) ? " !" : ""); 138 if (ahinfo->spis[0] 139 != ahinfo->spis[1]) 140 printf("%u:%u", 141 ahinfo->spis[0], 142 ahinfo->spis[1]); 143 else 144 printf("%u", 145 ahinfo->spis[0]); 146 } 147 148} 149 150static struct xtables_match ah_mt_reg = { 151 .name = "ah", 152 .version = XTABLES_VERSION, 153 .family = NFPROTO_IPV4, 154 .size = XT_ALIGN(sizeof(struct ipt_ah)), 155 .userspacesize = XT_ALIGN(sizeof(struct ipt_ah)), 156 .help = ah_help, 157 .init = ah_init, 158 .parse = ah_parse, 159 .print = ah_print, 160 .save = ah_save, 161 .extra_opts = ah_opts, 162}; 163 164void 165_init(void) 166{ 167 xtables_register_match(&ah_mt_reg); 168} 169