1/*
2 * Shared library add-on to iptables to add CONNSECMARK target support.
3 *
4 * Based on the MARK and CONNMARK targets.
5 *
6 * Copyright (C) 2006 Red Hat, Inc., James Morris <jmorris@redhat.com>
7 */
8#include <stdio.h>
9#include <xtables.h>
10#include <linux/netfilter/xt_CONNSECMARK.h>
11
12#define PFX "CONNSECMARK target: "
13
14enum {
15	O_SAVE = 0,
16	O_RESTORE,
17	F_SAVE    = 1 << O_SAVE,
18	F_RESTORE = 1 << O_RESTORE,
19};
20
21static void CONNSECMARK_help(void)
22{
23	printf(
24"CONNSECMARK target options:\n"
25"  --save                   Copy security mark from packet to conntrack\n"
26"  --restore                Copy security mark from connection to packet\n");
27}
28
29static const struct xt_option_entry CONNSECMARK_opts[] = {
30	{.name = "save", .id = O_SAVE, .excl = F_RESTORE, .type = XTTYPE_NONE},
31	{.name = "restore", .id = O_RESTORE, .excl = F_SAVE,
32	 .type = XTTYPE_NONE},
33	XTOPT_TABLEEND,
34};
35
36static void CONNSECMARK_parse(struct xt_option_call *cb)
37{
38	struct xt_connsecmark_target_info *info = cb->data;
39
40	xtables_option_parse(cb);
41	switch (cb->entry->id) {
42	case O_SAVE:
43		info->mode = CONNSECMARK_SAVE;
44		break;
45	case O_RESTORE:
46		info->mode = CONNSECMARK_RESTORE;
47		break;
48	}
49}
50
51static void CONNSECMARK_check(struct xt_fcheck_call *cb)
52{
53	if (cb->xflags == 0)
54		xtables_error(PARAMETER_PROBLEM, PFX "parameter required");
55}
56
57static void print_connsecmark(const struct xt_connsecmark_target_info *info)
58{
59	switch (info->mode) {
60	case CONNSECMARK_SAVE:
61		printf("save");
62		break;
63
64	case CONNSECMARK_RESTORE:
65		printf("restore");
66		break;
67
68	default:
69		xtables_error(OTHER_PROBLEM, PFX "invalid mode %hhu\n", info->mode);
70	}
71}
72
73static void
74CONNSECMARK_print(const void *ip, const struct xt_entry_target *target,
75                  int numeric)
76{
77	const struct xt_connsecmark_target_info *info =
78		(struct xt_connsecmark_target_info*)(target)->data;
79
80	printf(" CONNSECMARK ");
81	print_connsecmark(info);
82}
83
84static void
85CONNSECMARK_save(const void *ip, const struct xt_entry_target *target)
86{
87	const struct xt_connsecmark_target_info *info =
88		(struct xt_connsecmark_target_info*)target->data;
89
90	printf(" --");
91	print_connsecmark(info);
92}
93
94static struct xtables_target connsecmark_target = {
95	.family		= NFPROTO_UNSPEC,
96	.name		= "CONNSECMARK",
97	.version	= XTABLES_VERSION,
98	.revision	= 0,
99	.size		= XT_ALIGN(sizeof(struct xt_connsecmark_target_info)),
100	.userspacesize	= XT_ALIGN(sizeof(struct xt_connsecmark_target_info)),
101	.help		= CONNSECMARK_help,
102	.print		= CONNSECMARK_print,
103	.save		= CONNSECMARK_save,
104	.x6_parse	= CONNSECMARK_parse,
105	.x6_fcheck	= CONNSECMARK_check,
106	.x6_options	= CONNSECMARK_opts,
107};
108
109void _init(void)
110{
111	xtables_register_target(&connsecmark_target);
112}
113