libipt_ah.c revision ea146a982e26c42f9954f140276f8deeb2edbe98 
1/* Shared library add-on to iptables to add AH support. */
2#include <stdio.h>
3#include <netdb.h>
4#include <string.h>
5#include <stdlib.h>
6#include <getopt.h>
7#include <errno.h>
8#include <iptables.h>
9#include <linux/netfilter_ipv4/ipt_ah.h>
10
11/* Function which prints out usage message. */
12static void
13help(void)
14{
15	printf(
16"AH v%s options:\n"
17" --ahspi [!] spi[:spi]\n"
18"				match spi (range)\n",
19IPTABLES_VERSION);
20}
21
22static const struct option opts[] = {
23	{ "ahspi", 1, 0, '1' },
24	{0}
25};
26
27static u_int32_t
28parse_ah_spi(const char *spistr)
29{
30	unsigned long int spi;
31	char* ep;
32
33	spi =  strtoul(spistr,&ep,0) ;
34
35	if ( spistr == ep ) {
36		exit_error(PARAMETER_PROBLEM,
37			   "AH no valid digits in spi `%s'", spistr);
38	}
39	if ( spi == ULONG_MAX  && errno == ERANGE ) {
40		exit_error(PARAMETER_PROBLEM,
41			   "spi `%s' specified too big: would overflow", spistr);
42	}
43	if ( *spistr != '\0'  && *ep != '\0' ) {
44		exit_error(PARAMETER_PROBLEM,
45			   "AH error parsing spi `%s'", spistr);
46	}
47	return (u_int32_t) spi;
48}
49
50static void
51parse_ah_spis(const char *spistring, u_int32_t *spis)
52{
53	char *buffer;
54	char *cp;
55
56	buffer = strdup(spistring);
57	if ((cp = strchr(buffer, ':')) == NULL)
58		spis[0] = spis[1] = parse_ah_spi(buffer);
59	else {
60		*cp = '\0';
61		cp++;
62
63		spis[0] = buffer[0] ? parse_ah_spi(buffer) : 0;
64		spis[1] = cp[0] ? parse_ah_spi(cp) : 0xFFFFFFFF;
65	}
66	free(buffer);
67}
68
69/* Initialize the match. */
70static void
71init(struct xt_entry_match *m)
72{
73	struct ipt_ah *ahinfo = (struct ipt_ah *)m->data;
74
75	ahinfo->spis[1] = 0xFFFFFFFF;
76}
77
78#define AH_SPI 0x01
79
80/* Function which parses command options; returns true if it
81   ate an option */
82static int
83parse(int c, char **argv, int invert, unsigned int *flags,
84      const void *entry,
85      struct xt_entry_match **match)
86{
87	struct ipt_ah *ahinfo = (struct ipt_ah *)(*match)->data;
88
89	switch (c) {
90	case '1':
91		if (*flags & AH_SPI)
92			exit_error(PARAMETER_PROBLEM,
93				   "Only one `--ahspi' allowed");
94		check_inverse(optarg, &invert, &optind, 0);
95		parse_ah_spis(argv[optind-1], ahinfo->spis);
96		if (invert)
97			ahinfo->invflags |= IPT_AH_INV_SPI;
98		*flags |= AH_SPI;
99		break;
100	default:
101		return 0;
102	}
103
104	return 1;
105}
106
107/* Final check; we don't care. */
108static void
109final_check(unsigned int flags)
110{
111}
112
113static void
114print_spis(const char *name, u_int32_t min, u_int32_t max,
115	    int invert)
116{
117	const char *inv = invert ? "!" : "";
118
119	if (min != 0 || max != 0xFFFFFFFF || invert) {
120		printf("%s", name);
121		if (min == max) {
122			printf(":%s", inv);
123			printf("%u", min);
124		} else {
125			printf("s:%s", inv);
126			printf("%u",min);
127			printf(":");
128			printf("%u",max);
129		}
130		printf(" ");
131	}
132}
133
134/* Prints out the union ipt_matchinfo. */
135static void
136print(const void *ip,
137      const struct xt_entry_match *match, int numeric)
138{
139	const struct ipt_ah *ah = (struct ipt_ah *)match->data;
140
141	printf("ah ");
142	print_spis("spi", ah->spis[0], ah->spis[1],
143		    ah->invflags & IPT_AH_INV_SPI);
144	if (ah->invflags & ~IPT_AH_INV_MASK)
145		printf("Unknown invflags: 0x%X ",
146		       ah->invflags & ~IPT_AH_INV_MASK);
147}
148
149/* Saves the union ipt_matchinfo in parsable form to stdout. */
150static void save(const void *ip, const struct xt_entry_match *match)
151{
152	const struct ipt_ah *ahinfo = (struct ipt_ah *)match->data;
153
154	if (!(ahinfo->spis[0] == 0
155	    && ahinfo->spis[1] == 0xFFFFFFFF)) {
156		printf("--ahspi %s",
157			(ahinfo->invflags & IPT_AH_INV_SPI) ? "! " : "");
158		if (ahinfo->spis[0]
159		    != ahinfo->spis[1])
160			printf("%u:%u ",
161			       ahinfo->spis[0],
162			       ahinfo->spis[1]);
163		else
164			printf("%u ",
165			       ahinfo->spis[0]);
166	}
167
168}
169
170static struct iptables_match ah = {
171	.name 		= "ah",
172	.version 	= IPTABLES_VERSION,
173	.size		= IPT_ALIGN(sizeof(struct ipt_ah)),
174	.userspacesize 	= IPT_ALIGN(sizeof(struct ipt_ah)),
175	.help 		= &help,
176	.init 		= &init,
177	.parse 		= &parse,
178	.final_check 	= &final_check,
179	.print 		= &print,
180	.save 		= &save,
181	.extra_opts 	= opts
182};
183
184void
185_init(void)
186{
187	register_match(&ah);
188}
189