libxt_socket.c revision 73866357e4a7a0fdc1b293bf8863fee2bd56da9e
131d157ae1ac2cd9c787dc3c1d28e64c682803844Jia Liu/* 2b4b54153ad760c69a00a08531abef4ed434a5092Tony Linthicum * Shared library add-on to iptables to add early socket matching support. 3b4b54153ad760c69a00a08531abef4ed434a5092Tony Linthicum * 4b4b54153ad760c69a00a08531abef4ed434a5092Tony Linthicum * Copyright (C) 2007 BalaBit IT Ltd. 5b4b54153ad760c69a00a08531abef4ed434a5092Tony Linthicum */ 6b4b54153ad760c69a00a08531abef4ed434a5092Tony Linthicum#include <getopt.h> 7b4b54153ad760c69a00a08531abef4ed434a5092Tony Linthicum#include <stdbool.h> 8b4b54153ad760c69a00a08531abef4ed434a5092Tony Linthicum#include <stdio.h> 9b4b54153ad760c69a00a08531abef4ed434a5092Tony Linthicum#include <xtables.h> 10b4b54153ad760c69a00a08531abef4ed434a5092Tony Linthicum#include <linux/netfilter/xt_socket.h> 11b4b54153ad760c69a00a08531abef4ed434a5092Tony Linthicum 12b4b54153ad760c69a00a08531abef4ed434a5092Tony Linthicumstatic const struct option socket_mt_opts[] = { 13b4b54153ad760c69a00a08531abef4ed434a5092Tony Linthicum {.name = "transparent", .has_arg = false, .val = 't'}, 14b4b54153ad760c69a00a08531abef4ed434a5092Tony Linthicum XT_GETOPT_TABLEEND, 15b4b54153ad760c69a00a08531abef4ed434a5092Tony Linthicum}; 16b4b54153ad760c69a00a08531abef4ed434a5092Tony Linthicum 17b4b54153ad760c69a00a08531abef4ed434a5092Tony Linthicumstatic void socket_mt_help(void) 18b4b54153ad760c69a00a08531abef4ed434a5092Tony Linthicum{ 19b4b54153ad760c69a00a08531abef4ed434a5092Tony Linthicum printf( 20b4b54153ad760c69a00a08531abef4ed434a5092Tony Linthicum "socket match options:\n" 21b4b54153ad760c69a00a08531abef4ed434a5092Tony Linthicum " --transparent Ignore non-transparent sockets\n\n"); 2236b56886974eae4f9c5ebc96befd3e7bfe5de338Stephen Hines} 23b4b54153ad760c69a00a08531abef4ed434a5092Tony Linthicum 24b4b54153ad760c69a00a08531abef4ed434a5092Tony Linthicumstatic int socket_mt_parse(int c, char **argv, int invert, unsigned int *flags, 25b4b54153ad760c69a00a08531abef4ed434a5092Tony Linthicum const void *entry, struct xt_entry_match **match) 26b4b54153ad760c69a00a08531abef4ed434a5092Tony Linthicum{ 27b4b54153ad760c69a00a08531abef4ed434a5092Tony Linthicum struct xt_socket_mtinfo1 *info = (void *)(*match)->data; 28b4b54153ad760c69a00a08531abef4ed434a5092Tony Linthicum 29b4b54153ad760c69a00a08531abef4ed434a5092Tony Linthicum switch (c) { 30b4b54153ad760c69a00a08531abef4ed434a5092Tony Linthicum case 't': 31b4b54153ad760c69a00a08531abef4ed434a5092Tony Linthicum info->flags |= XT_SOCKET_TRANSPARENT; 32f931f691ee23d431135481fcf23a58658824ca67Jyotsna Verma return true; 3336b56886974eae4f9c5ebc96befd3e7bfe5de338Stephen Hines } 3436b56886974eae4f9c5ebc96befd3e7bfe5de338Stephen Hines return false; 3536b56886974eae4f9c5ebc96befd3e7bfe5de338Stephen Hines} 36b4b54153ad760c69a00a08531abef4ed434a5092Tony Linthicum 37b4b54153ad760c69a00a08531abef4ed434a5092Tony Linthicumstatic void 38b4b54153ad760c69a00a08531abef4ed434a5092Tony Linthicumsocket_mt_save(const void *ip, const struct xt_entry_match *match) 39b4b54153ad760c69a00a08531abef4ed434a5092Tony Linthicum{ 40b4b54153ad760c69a00a08531abef4ed434a5092Tony Linthicum const struct xt_socket_mtinfo1 *info = (const void *)match->data; 41 42 if (info->flags & XT_SOCKET_TRANSPARENT) 43 printf(" --transparent"); 44} 45 46static void 47socket_mt_print(const void *ip, const struct xt_entry_match *match, 48 int numeric) 49{ 50 printf(" socket"); 51 socket_mt_save(ip, match); 52} 53 54static struct xtables_match socket_mt_reg[] = { 55 { 56 .name = "socket", 57 .revision = 0, 58 .family = NFPROTO_IPV4, 59 .version = XTABLES_VERSION, 60 .size = XT_ALIGN(0), 61 .userspacesize = XT_ALIGN(0), 62 }, 63 { 64 .name = "socket", 65 .revision = 1, 66 .family = NFPROTO_UNSPEC, 67 .version = XTABLES_VERSION, 68 .size = XT_ALIGN(sizeof(struct xt_socket_mtinfo1)), 69 .userspacesize = XT_ALIGN(sizeof(struct xt_socket_mtinfo1)), 70 .help = socket_mt_help, 71 .parse = socket_mt_parse, 72 .print = socket_mt_print, 73 .save = socket_mt_save, 74 .extra_opts = socket_mt_opts, 75 }, 76}; 77 78void _init(void) 79{ 80 xtables_register_matches(socket_mt_reg, ARRAY_SIZE(socket_mt_reg)); 81} 82