Lines Matching +full:- +full:match
2 * Copyright (c) 2005-2013 Patrick McHardy <kaber@trash.net>
30 "policy match options:\n" in policy_help()
31 " --dir in|out match policy applied during decapsulation/\n" in policy_help()
33 " --pol none|ipsec match policy\n" in policy_help()
34 " --strict match entire policy instead of single element\n" in policy_help()
37 "[!] --reqid reqid match reqid\n" in policy_help()
38 "[!] --spi spi match SPI\n" in policy_help()
39 "[!] --proto proto match protocol (ah/esp/ipcomp)\n" in policy_help()
40 "[!] --mode mode match mode (transport/tunnel)\n" in policy_help()
41 "[!] --tunnel-src addr/mask match tunnel source\n" in policy_help()
42 "[!] --tunnel-dst addr/mask match tunnel destination\n" in policy_help()
43 " --next begin next element in policy\n"); in policy_help()
54 {.name = "tunnel-src", .id = O_TUNNELSRC, .type = XTTYPE_HOSTMASK,
56 {.name = "tunnel-dst", .id = O_TUNNELDST, .type = XTTYPE_HOSTMASK,
82 xtables_error(PARAMETER_PROBLEM, "policy match: invalid policy \"%s\"", s); in parse_policy()
91 xtables_error(PARAMETER_PROBLEM, "policy match: invalid mode \"%s\"", s); in parse_mode()
96 struct xt_policy_info *info = cb->data; in policy_parse()
97 struct xt_policy_elem *e = &info->pol[info->len]; in policy_parse()
100 switch (cb->entry->id) { in policy_parse()
102 info->flags |= parse_direction(cb->arg); in policy_parse()
105 info->flags |= parse_policy(cb->arg); in policy_parse()
108 info->flags |= XT_POLICY_MATCH_STRICT; in policy_parse()
111 if (e->match.reqid) in policy_parse()
113 "policy match: double --reqid option"); in policy_parse()
114 e->match.reqid = 1; in policy_parse()
115 e->invert.reqid = cb->invert; in policy_parse()
116 e->reqid = cb->val.u32; in policy_parse()
119 if (e->match.spi) in policy_parse()
121 "policy match: double --spi option"); in policy_parse()
122 e->match.spi = 1; in policy_parse()
123 e->invert.spi = cb->invert; in policy_parse()
124 e->spi = cb->val.u32; in policy_parse()
127 if (e->match.saddr) in policy_parse()
129 "policy match: double --tunnel-src option"); in policy_parse()
131 e->match.saddr = 1; in policy_parse()
132 e->invert.saddr = cb->invert; in policy_parse()
133 memcpy(&e->saddr, &cb->val.haddr, sizeof(cb->val.haddr)); in policy_parse()
134 memcpy(&e->smask, &cb->val.hmask, sizeof(cb->val.hmask)); in policy_parse()
137 if (e->match.daddr) in policy_parse()
139 "policy match: double --tunnel-dst option"); in policy_parse()
140 e->match.daddr = 1; in policy_parse()
141 e->invert.daddr = cb->invert; in policy_parse()
142 memcpy(&e->daddr, &cb->val.haddr, sizeof(cb->val.haddr)); in policy_parse()
143 memcpy(&e->dmask, &cb->val.hmask, sizeof(cb->val.hmask)); in policy_parse()
146 if (e->match.proto) in policy_parse()
148 "policy match: double --proto option"); in policy_parse()
149 e->proto = cb->val.protocol; in policy_parse()
150 if (e->proto != IPPROTO_AH && e->proto != IPPROTO_ESP && in policy_parse()
151 e->proto != IPPROTO_COMP) in policy_parse()
153 "policy match: protocol must be ah/esp/ipcomp"); in policy_parse()
154 e->match.proto = 1; in policy_parse()
155 e->invert.proto = cb->invert; in policy_parse()
158 if (e->match.mode) in policy_parse()
160 "policy match: double --mode option"); in policy_parse()
161 e->match.mode = 1; in policy_parse()
162 e->invert.mode = cb->invert; in policy_parse()
163 e->mode = parse_mode(cb->arg); in policy_parse()
166 if (++info->len == XT_POLICY_MAX_ELEM) in policy_parse()
168 "policy match: maximum policy depth reached"); in policy_parse()
175 struct xt_policy_info *info = cb->data; in policy_check()
181 * by testing for --dir. in policy_check()
183 if (!(info->flags & (XT_POLICY_MATCH_IN | XT_POLICY_MATCH_OUT))) in policy_check()
185 "policy match: neither --dir in nor --dir out specified"); in policy_check()
187 if (info->flags & XT_POLICY_MATCH_NONE) { in policy_check()
188 if (info->flags & XT_POLICY_MATCH_STRICT) in policy_check()
190 "policy match: policy none but --strict given"); in policy_check()
192 if (info->len != 0) in policy_check()
194 "policy match: policy none but policy given"); in policy_check()
196 info->len++; /* increase len by 1, no --next after last element */ in policy_check()
202 if (!(info->flags & XT_POLICY_MATCH_STRICT) && info->len > 1) in policy_check()
204 "policy match: multiple elements but no --strict"); in policy_check()
207 for (i = 0; i < info->len; i++) { in policy_check()
208 e = &info->pol[i]; in policy_check()
210 if (info->flags & XT_POLICY_MATCH_STRICT && in policy_check()
211 !(e->match.reqid || e->match.spi || e->match.saddr || in policy_check()
212 e->match.daddr || e->match.proto || e->match.mode)) in policy_check()
214 "policy match: empty policy element %u. " in policy_check()
215 "--strict is in effect, but at least one of " in policy_check()
216 "reqid, spi, tunnel-src, tunnel-dst, proto or " in policy_check()
219 if ((e->match.saddr || e->match.daddr) in policy_check()
220 && ((e->mode == XT_POLICY_MODE_TUNNEL && e->invert.mode) || in policy_check()
221 (e->mode == XT_POLICY_MODE_TRANSPORT && !e->invert.mode))) in policy_check()
223 "policy match: --tunnel-src/--tunnel-dst " in policy_check()
253 printf("%s", p->p_name); in print_proto()
267 if (e->match.reqid) { in print_entry()
268 PRINT_INVERT(e->invert.reqid); in print_entry()
269 printf(" %sreqid %u", prefix, e->reqid); in print_entry()
271 if (e->match.spi) { in print_entry()
272 PRINT_INVERT(e->invert.spi); in print_entry()
273 printf(" %sspi 0x%x", prefix, e->spi); in print_entry()
275 if (e->match.proto) { in print_entry()
276 PRINT_INVERT(e->invert.proto); in print_entry()
277 print_proto(prefix, e->proto, numeric); in print_entry()
279 if (e->match.mode) { in print_entry()
280 PRINT_INVERT(e->invert.mode); in print_entry()
281 print_mode(prefix, e->mode, numeric); in print_entry()
283 if (e->match.daddr) { in print_entry()
284 PRINT_INVERT(e->invert.daddr); in print_entry()
286 printf(" %stunnel-dst %s%s", prefix, in print_entry()
287 xtables_ip6addr_to_numeric(&e->daddr.a6), in print_entry()
288 xtables_ip6mask_to_numeric(&e->dmask.a6)); in print_entry()
290 printf(" %stunnel-dst %s%s", prefix, in print_entry()
291 xtables_ipaddr_to_numeric(&e->daddr.a4), in print_entry()
292 xtables_ipmask_to_numeric(&e->dmask.a4)); in print_entry()
294 if (e->match.saddr) { in print_entry()
295 PRINT_INVERT(e->invert.saddr); in print_entry()
297 printf(" %stunnel-src %s%s", prefix, in print_entry()
298 xtables_ip6addr_to_numeric(&e->saddr.a6), in print_entry()
299 xtables_ip6mask_to_numeric(&e->smask.a6)); in print_entry()
301 printf(" %stunnel-src %s%s", prefix, in print_entry()
302 xtables_ipaddr_to_numeric(&e->saddr.a4), in print_entry()
303 xtables_ipmask_to_numeric(&e->smask.a4)); in print_entry()
309 if (info->flags & XT_POLICY_MATCH_IN) in print_flags()
314 if (info->flags & XT_POLICY_MATCH_NONE) in print_flags()
319 if (info->flags & XT_POLICY_MATCH_STRICT) in print_flags()
323 static void policy4_print(const void *ip, const struct xt_entry_match *match, in policy4_print() argument
326 const struct xt_policy_info *info = (void *)match->data; in policy4_print()
329 printf(" policy match"); in policy4_print()
331 for (i = 0; i < info->len; i++) { in policy4_print()
332 if (info->len > 1) in policy4_print()
334 print_entry("", &info->pol[i], numeric, NFPROTO_IPV4); in policy4_print()
338 static void policy6_print(const void *ip, const struct xt_entry_match *match, in policy6_print() argument
341 const struct xt_policy_info *info = (void *)match->data; in policy6_print()
344 printf(" policy match"); in policy6_print()
346 for (i = 0; i < info->len; i++) { in policy6_print()
347 if (info->len > 1) in policy6_print()
349 print_entry("", &info->pol[i], numeric, NFPROTO_IPV6); in policy6_print()
353 static void policy4_save(const void *ip, const struct xt_entry_match *match) in policy4_save() argument
355 const struct xt_policy_info *info = (void *)match->data; in policy4_save()
358 print_flags("--", info); in policy4_save()
359 for (i = 0; i < info->len; i++) { in policy4_save()
360 print_entry("--", &info->pol[i], false, NFPROTO_IPV4); in policy4_save()
361 if (i + 1 < info->len) in policy4_save()
362 printf(" --next"); in policy4_save()
366 static void policy6_save(const void *ip, const struct xt_entry_match *match) in policy6_save() argument
368 const struct xt_policy_info *info = (void *)match->data; in policy6_save()
371 print_flags("--", info); in policy6_save()
372 for (i = 0; i < info->len; i++) { in policy6_save()
373 print_entry("--", &info->pol[i], false, NFPROTO_IPV6); in policy6_save()
374 if (i + 1 < info->len) in policy6_save()
375 printf(" --next"); in policy6_save()
386 const struct xt_policy_info *info = (const void *)params->match->data; in policy_xlate()
388 if ((info->flags & ~allowed) || info->len > 1) in policy_xlate()
391 if (memcmp(&info->pol[0], &empty, sizeof(empty))) in policy_xlate()
396 if (info->flags & XT_POLICY_MATCH_NONE) in policy_xlate()