1 #include <stdio.h>
2 #include <xtables.h>
3 #include <linux/netfilter_ipv4/ipt_ah.h>
4
5 enum {
6 O_AHSPI = 0,
7 };
8
ah_help(void)9 static void ah_help(void)
10 {
11 printf(
12 "ah match options:\n"
13 "[!] --ahspi spi[:spi]\n"
14 " match spi (range)\n");
15 }
16
17 static const struct xt_option_entry ah_opts[] = {
18 {.name = "ahspi", .id = O_AHSPI, .type = XTTYPE_UINT32RC,
19 .flags = XTOPT_INVERT | XTOPT_PUT,
20 XTOPT_POINTER(struct ipt_ah, spis)},
21 XTOPT_TABLEEND,
22 };
23
ah_init(struct xt_entry_match * m)24 static void ah_init(struct xt_entry_match *m)
25 {
26 struct ipt_ah *ahinfo = (void *)m->data;
27
28 ahinfo->spis[1] = ~0U;
29 }
30
ah_parse(struct xt_option_call * cb)31 static void ah_parse(struct xt_option_call *cb)
32 {
33 struct ipt_ah *ahinfo = cb->data;
34
35 xtables_option_parse(cb);
36 if (cb->nvals == 1)
37 ahinfo->spis[1] = ahinfo->spis[0];
38 if (cb->invert)
39 ahinfo->invflags |= IPT_AH_INV_SPI;
40 }
41
skip_spi_match(uint32_t min,uint32_t max,bool inv)42 static bool skip_spi_match(uint32_t min, uint32_t max, bool inv)
43 {
44 return min == 0 && max == UINT32_MAX && !inv;
45 }
46
47 static void
print_spis(const char * name,uint32_t min,uint32_t max,int invert)48 print_spis(const char *name, uint32_t min, uint32_t max,
49 int invert)
50 {
51 const char *inv = invert ? "!" : "";
52
53 if (!skip_spi_match(min, max, invert)) {
54 printf("%s", name);
55 if (min == max) {
56 printf(":%s", inv);
57 printf("%u", min);
58 } else {
59 printf("s:%s", inv);
60 printf("%u",min);
61 printf(":");
62 printf("%u",max);
63 }
64 }
65 }
66
ah_print(const void * ip,const struct xt_entry_match * match,int numeric)67 static void ah_print(const void *ip, const struct xt_entry_match *match,
68 int numeric)
69 {
70 const struct ipt_ah *ah = (struct ipt_ah *)match->data;
71
72 printf(" ah ");
73 print_spis("spi", ah->spis[0], ah->spis[1],
74 ah->invflags & IPT_AH_INV_SPI);
75 if (ah->invflags & ~IPT_AH_INV_MASK)
76 printf(" Unknown invflags: 0x%X",
77 ah->invflags & ~IPT_AH_INV_MASK);
78 }
79
ah_save(const void * ip,const struct xt_entry_match * match)80 static void ah_save(const void *ip, const struct xt_entry_match *match)
81 {
82 const struct ipt_ah *ahinfo = (struct ipt_ah *)match->data;
83 bool inv_spi = ahinfo->invflags & IPT_AH_INV_SPI;
84
85 if (!skip_spi_match(ahinfo->spis[0], ahinfo->spis[1], inv_spi)) {
86 printf("%s --ahspi ", inv_spi ? " !" : "");
87 if (ahinfo->spis[0]
88 != ahinfo->spis[1])
89 printf("%u:%u",
90 ahinfo->spis[0],
91 ahinfo->spis[1]);
92 else
93 printf("%u",
94 ahinfo->spis[0]);
95 }
96
97 }
98
ah_xlate(struct xt_xlate * xl,const struct xt_xlate_mt_params * params)99 static int ah_xlate(struct xt_xlate *xl,
100 const struct xt_xlate_mt_params *params)
101 {
102 const struct ipt_ah *ahinfo = (struct ipt_ah *)params->match->data;
103 bool inv_spi = ahinfo->invflags & IPT_AH_INV_SPI;
104
105 if (!skip_spi_match(ahinfo->spis[0], ahinfo->spis[1], inv_spi)) {
106 xt_xlate_add(xl, "ah spi%s ", inv_spi ? " !=" : "");
107 if (ahinfo->spis[0] != ahinfo->spis[1])
108 xt_xlate_add(xl, "%u-%u", ahinfo->spis[0],
109 ahinfo->spis[1]);
110 else
111 xt_xlate_add(xl, "%u", ahinfo->spis[0]);
112 } else {
113 xt_xlate_add(xl, "meta l4proto ah");
114 }
115
116 return 1;
117 }
118
119 static struct xtables_match ah_mt_reg = {
120 .name = "ah",
121 .version = XTABLES_VERSION,
122 .family = NFPROTO_IPV4,
123 .size = XT_ALIGN(sizeof(struct ipt_ah)),
124 .userspacesize = XT_ALIGN(sizeof(struct ipt_ah)),
125 .help = ah_help,
126 .init = ah_init,
127 .print = ah_print,
128 .save = ah_save,
129 .x6_parse = ah_parse,
130 .x6_options = ah_opts,
131 .xlate = ah_xlate,
132 };
133
134 void
_init(void)135 _init(void)
136 {
137 xtables_register_match(&ah_mt_reg);
138 }
139