1 /* Copyright (C) 2000-2002 Joakim Axelsson <gozem@linux.nu>
2 * Patrick Schaaf <bof@bof.de>
3 * Martin Josefsson <gandalf@wlug.westbo.se>
4 * Copyright (C) 2003-2004 Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
9 */
10
11 /* Shared library add-on to iptables to add IP set matching. */
12 #include <stdio.h>
13 #include <netdb.h>
14 #include <string.h>
15 #include <stdlib.h>
16 #include <getopt.h>
17 #include <ctype.h>
18 #include <errno.h>
19
20 #include <iptables.h>
21 #include <linux/netfilter_ipv4/ip_conntrack.h>
22 #include <linux/netfilter_ipv4/ipt_set.h>
23 #include "libipt_2set.h"
24
25 /* Function which prints out usage message. */
help(void)26 static void help(void)
27 {
28 printf("set v%s options:\n"
29 " [!] --set name flags\n"
30 " 'name' is the set name from to match,\n"
31 " 'flags' are the comma separated list of\n"
32 " 'src' and 'dst'.\n"
33 "\n", IPTABLES_VERSION);
34 }
35
36 static struct option opts[] = {
37 {"set", 1, 0, '1'},
38 {0}
39 };
40
41 /* Initialize the match. */
init(struct ipt_entry_match * match,unsigned int * nfcache)42 static void init(struct ipt_entry_match *match, unsigned int *nfcache)
43 {
44 struct ipt_set_info_match *info =
45 (struct ipt_set_info_match *) match->data;
46
47
48 memset(info, 0, sizeof(struct ipt_set_info_match));
49
50 }
51
52 /* Function which parses command options; returns true if it ate an option */
53 static int
parse(int c,char ** argv,int invert,unsigned int * flags,const struct ipt_entry * entry,unsigned int * nfcache,struct ipt_entry_match ** match)54 parse(int c, char **argv, int invert, unsigned int *flags,
55 const struct ipt_entry *entry,
56 unsigned int *nfcache, struct ipt_entry_match **match)
57 {
58 struct ipt_set_info_match *myinfo =
59 (struct ipt_set_info_match *) (*match)->data;
60 struct ipt_set_info *info = &myinfo->match_set;
61
62 switch (c) {
63 case '1': /* --set <set> <flag>[,<flag> */
64 if (info->flags[0])
65 exit_error(PARAMETER_PROBLEM,
66 "--set can be specified only once");
67
68 check_inverse(optarg, &invert, &optind, 0);
69 if (invert)
70 info->flags[0] |= IPSET_MATCH_INV;
71
72 if (!argv[optind]
73 || argv[optind][0] == '-'
74 || argv[optind][0] == '!')
75 exit_error(PARAMETER_PROBLEM,
76 "--set requires two args.");
77
78 if (strlen(argv[optind-1]) > IP_SET_MAXNAMELEN - 1)
79 exit_error(PARAMETER_PROBLEM,
80 "setname `%s' too long, max %d characters.",
81 argv[optind-1], IP_SET_MAXNAMELEN - 1);
82
83 get_set_byname(argv[optind - 1], info);
84 parse_bindings(argv[optind], info);
85 DEBUGP("parse: set index %u\n", info->index);
86 optind++;
87
88 *flags = 1;
89 break;
90
91 default:
92 return 0;
93 }
94
95 return 1;
96 }
97
98 /* Final check; must have specified --set. */
final_check(unsigned int flags)99 static void final_check(unsigned int flags)
100 {
101 if (!flags)
102 exit_error(PARAMETER_PROBLEM,
103 "You must specify `--set' with proper arguments");
104 DEBUGP("final check OK\n");
105 }
106
107 static void
print_match(const char * prefix,const struct ipt_set_info * info)108 print_match(const char *prefix, const struct ipt_set_info *info)
109 {
110 int i;
111 char setname[IP_SET_MAXNAMELEN];
112
113 get_set_byid(setname, info->index);
114 printf("%s%s %s",
115 (info->flags[0] & IPSET_MATCH_INV) ? "! " : "",
116 prefix,
117 setname);
118 for (i = 0; i < IP_SET_MAX_BINDINGS; i++) {
119 if (!info->flags[i])
120 break;
121 printf("%s%s",
122 i == 0 ? " " : ",",
123 info->flags[i] & IPSET_SRC ? "src" : "dst");
124 }
125 printf(" ");
126 }
127
128 /* Prints out the matchinfo. */
129 static void
print(const struct ipt_ip * ip,const struct ipt_entry_match * match,int numeric)130 print(const struct ipt_ip *ip,
131 const struct ipt_entry_match *match, int numeric)
132 {
133 struct ipt_set_info_match *info =
134 (struct ipt_set_info_match *) match->data;
135
136 print_match("set", &info->match_set);
137 }
138
139 /* Saves the matchinfo in parsable form to stdout. */
save(const struct ipt_ip * ip,const struct ipt_entry_match * match)140 static void save(const struct ipt_ip *ip,
141 const struct ipt_entry_match *match)
142 {
143 struct ipt_set_info_match *info =
144 (struct ipt_set_info_match *) match->data;
145
146 print_match("--set", &info->match_set);
147 }
148
149 static
150 struct iptables_match set = {
151 .name = "set",
152 .version = IPTABLES_VERSION,
153 .size = IPT_ALIGN(sizeof(struct ipt_set_info_match)),
154 .userspacesize = IPT_ALIGN(sizeof(struct ipt_set_info_match)),
155 .help = &help,
156 .init = &init,
157 .parse = &parse,
158 .final_check = &final_check,
159 .print = &print,
160 .save = &save,
161 .extra_opts = opts
162 };
163
ipt_2set_init(void)164 void ipt_2set_init(void)
165 {
166 register_match(&set);
167 }
168