libipt_ah.c revision d09b6d591ca7d7d7575cb6aa20384c9830f777ab 
1/* Shared library add-on to iptables to add AH support. */
2#include <stdbool.h>
3#include <stdio.h>
4#include <netdb.h>
5#include <string.h>
6#include <stdlib.h>
7#include <getopt.h>
8#include <errno.h>
9#include <xtables.h>
10#include <linux/netfilter_ipv4/ipt_ah.h>
11
12static void ah_help(void)
13{
14	printf(
15"ah match options:\n"
16"[!] --ahspi spi[:spi]\n"
17"				match spi (range)\n");
18}
19
20static const struct option ah_opts[] = {
21	{.name = "ahspi", .has_arg = true, .val = '1'},
22	XT_GETOPT_TABLEEND,
23};
24
25static uint32_t
26parse_ah_spi(const char *spistr)
27{
28	unsigned long int spi;
29	char* ep;
30
31	spi =  strtoul(spistr,&ep,0) ;
32
33	if ( spistr == ep ) {
34		xtables_error(PARAMETER_PROBLEM,
35			   "AH no valid digits in spi `%s'", spistr);
36	}
37	if ( spi == ULONG_MAX  && errno == ERANGE ) {
38		xtables_error(PARAMETER_PROBLEM,
39			   "spi `%s' specified too big: would overflow", spistr);
40	}
41	if ( *spistr != '\0'  && *ep != '\0' ) {
42		xtables_error(PARAMETER_PROBLEM,
43			   "AH error parsing spi `%s'", spistr);
44	}
45	return spi;
46}
47
48static void
49parse_ah_spis(const char *spistring, uint32_t *spis)
50{
51	char *buffer;
52	char *cp;
53
54	buffer = strdup(spistring);
55	if ((cp = strchr(buffer, ':')) == NULL)
56		spis[0] = spis[1] = parse_ah_spi(buffer);
57	else {
58		*cp = '\0';
59		cp++;
60
61		spis[0] = buffer[0] ? parse_ah_spi(buffer) : 0;
62		spis[1] = cp[0] ? parse_ah_spi(cp) : 0xFFFFFFFF;
63	}
64	free(buffer);
65}
66
67static void ah_init(struct xt_entry_match *m)
68{
69	struct ipt_ah *ahinfo = (struct ipt_ah *)m->data;
70
71	ahinfo->spis[1] = 0xFFFFFFFF;
72}
73
74#define AH_SPI 0x01
75
76static int ah_parse(int c, char **argv, int invert, unsigned int *flags,
77                    const void *entry, struct xt_entry_match **match)
78{
79	struct ipt_ah *ahinfo = (struct ipt_ah *)(*match)->data;
80
81	switch (c) {
82	case '1':
83		if (*flags & AH_SPI)
84			xtables_error(PARAMETER_PROBLEM,
85				   "Only one `--ahspi' allowed");
86		xtables_check_inverse(optarg, &invert, &optind, 0, argv);
87		parse_ah_spis(optarg, ahinfo->spis);
88		if (invert)
89			ahinfo->invflags |= IPT_AH_INV_SPI;
90		*flags |= AH_SPI;
91		break;
92	}
93
94	return 1;
95}
96
97static void
98print_spis(const char *name, uint32_t min, uint32_t max,
99	    int invert)
100{
101	const char *inv = invert ? "!" : "";
102
103	if (min != 0 || max != 0xFFFFFFFF || invert) {
104		printf("%s", name);
105		if (min == max) {
106			printf(":%s", inv);
107			printf("%u", min);
108		} else {
109			printf("s:%s", inv);
110			printf("%u",min);
111			printf(":");
112			printf("%u",max);
113		}
114		printf(" ");
115	}
116}
117
118static void ah_print(const void *ip, const struct xt_entry_match *match,
119                     int numeric)
120{
121	const struct ipt_ah *ah = (struct ipt_ah *)match->data;
122
123	printf("ah ");
124	print_spis("spi", ah->spis[0], ah->spis[1],
125		    ah->invflags & IPT_AH_INV_SPI);
126	if (ah->invflags & ~IPT_AH_INV_MASK)
127		printf("Unknown invflags: 0x%X ",
128		       ah->invflags & ~IPT_AH_INV_MASK);
129}
130
131static void ah_save(const void *ip, const struct xt_entry_match *match)
132{
133	const struct ipt_ah *ahinfo = (struct ipt_ah *)match->data;
134
135	if (!(ahinfo->spis[0] == 0
136	    && ahinfo->spis[1] == 0xFFFFFFFF)) {
137		printf("%s--ahspi ",
138			(ahinfo->invflags & IPT_AH_INV_SPI) ? "! " : "");
139		if (ahinfo->spis[0]
140		    != ahinfo->spis[1])
141			printf("%u:%u ",
142			       ahinfo->spis[0],
143			       ahinfo->spis[1]);
144		else
145			printf("%u ",
146			       ahinfo->spis[0]);
147	}
148
149}
150
151static struct xtables_match ah_mt_reg = {
152	.name 		= "ah",
153	.version 	= XTABLES_VERSION,
154	.family		= NFPROTO_IPV4,
155	.size		= XT_ALIGN(sizeof(struct ipt_ah)),
156	.userspacesize 	= XT_ALIGN(sizeof(struct ipt_ah)),
157	.help 		= ah_help,
158	.init 		= ah_init,
159	.parse 		= ah_parse,
160	.print 		= ah_print,
161	.save 		= ah_save,
162	.extra_opts 	= ah_opts,
163};
164
165void
166_init(void)
167{
168	xtables_register_match(&ah_mt_reg);
169}
170