libxt_CONNSECMARK.c revision d09b6d591ca7d7d7575cb6aa20384c9830f777ab
1/* 2 * Shared library add-on to iptables to add CONNSECMARK target support. 3 * 4 * Based on the MARK and CONNMARK targets. 5 * 6 * Copyright (C) 2006 Red Hat, Inc., James Morris <jmorris@redhat.com> 7 */ 8#include <stdbool.h> 9#include <stdio.h> 10#include <string.h> 11#include <stdlib.h> 12#include <getopt.h> 13#include <xtables.h> 14#include <linux/netfilter/xt_CONNSECMARK.h> 15 16#define PFX "CONNSECMARK target: " 17 18static void CONNSECMARK_help(void) 19{ 20 printf( 21"CONNSECMARK target options:\n" 22" --save Copy security mark from packet to conntrack\n" 23" --restore Copy security mark from connection to packet\n"); 24} 25 26static const struct option CONNSECMARK_opts[] = { 27 {.name = "save", .has_arg = false, .val = '1'}, 28 {.name = "restore", .has_arg = false, .val = '2'}, 29 XT_GETOPT_TABLEEND, 30}; 31 32static int 33CONNSECMARK_parse(int c, char **argv, int invert, unsigned int *flags, 34 const void *entry, struct xt_entry_target **target) 35{ 36 struct xt_connsecmark_target_info *info = 37 (struct xt_connsecmark_target_info*)(*target)->data; 38 39 switch (c) { 40 case '1': 41 if (*flags & CONNSECMARK_SAVE) 42 xtables_error(PARAMETER_PROBLEM, PFX 43 "Can't specify --save twice"); 44 info->mode = CONNSECMARK_SAVE; 45 *flags |= CONNSECMARK_SAVE; 46 break; 47 48 case '2': 49 if (*flags & CONNSECMARK_RESTORE) 50 xtables_error(PARAMETER_PROBLEM, PFX 51 "Can't specify --restore twice"); 52 info->mode = CONNSECMARK_RESTORE; 53 *flags |= CONNSECMARK_RESTORE; 54 break; 55 } 56 57 return 1; 58} 59 60static void CONNSECMARK_check(unsigned int flags) 61{ 62 if (!flags) 63 xtables_error(PARAMETER_PROBLEM, PFX "parameter required"); 64 65 if (flags == (CONNSECMARK_SAVE|CONNSECMARK_RESTORE)) 66 xtables_error(PARAMETER_PROBLEM, PFX "only one flag of --save " 67 "or --restore is allowed"); 68} 69 70static void print_connsecmark(const struct xt_connsecmark_target_info *info) 71{ 72 switch (info->mode) { 73 case CONNSECMARK_SAVE: 74 printf("save "); 75 break; 76 77 case CONNSECMARK_RESTORE: 78 printf("restore "); 79 break; 80 81 default: 82 xtables_error(OTHER_PROBLEM, PFX "invalid mode %hhu\n", info->mode); 83 } 84} 85 86static void 87CONNSECMARK_print(const void *ip, const struct xt_entry_target *target, 88 int numeric) 89{ 90 const struct xt_connsecmark_target_info *info = 91 (struct xt_connsecmark_target_info*)(target)->data; 92 93 printf("CONNSECMARK "); 94 print_connsecmark(info); 95} 96 97static void 98CONNSECMARK_save(const void *ip, const struct xt_entry_target *target) 99{ 100 const struct xt_connsecmark_target_info *info = 101 (struct xt_connsecmark_target_info*)target->data; 102 103 printf("--"); 104 print_connsecmark(info); 105} 106 107static struct xtables_target connsecmark_target = { 108 .family = NFPROTO_UNSPEC, 109 .name = "CONNSECMARK", 110 .version = XTABLES_VERSION, 111 .revision = 0, 112 .size = XT_ALIGN(sizeof(struct xt_connsecmark_target_info)), 113 .userspacesize = XT_ALIGN(sizeof(struct xt_connsecmark_target_info)), 114 .parse = CONNSECMARK_parse, 115 .help = CONNSECMARK_help, 116 .final_check = CONNSECMARK_check, 117 .print = CONNSECMARK_print, 118 .save = CONNSECMARK_save, 119 .extra_opts = CONNSECMARK_opts, 120}; 121 122void _init(void) 123{ 124 xtables_register_target(&connsecmark_target); 125} 126