1*a71a9546SAutomerger Merge Worker /*
2*a71a9546SAutomerger Merge Worker * Shared library add-on to iptables to add CONNSECMARK target support.
3*a71a9546SAutomerger Merge Worker *
4*a71a9546SAutomerger Merge Worker * Based on the MARK and CONNMARK targets.
5*a71a9546SAutomerger Merge Worker *
6*a71a9546SAutomerger Merge Worker * Copyright (C) 2006 Red Hat, Inc., James Morris <[email protected]>
7*a71a9546SAutomerger Merge Worker */
8*a71a9546SAutomerger Merge Worker #include <stdio.h>
9*a71a9546SAutomerger Merge Worker #include <xtables.h>
10*a71a9546SAutomerger Merge Worker #include <linux/netfilter/xt_CONNSECMARK.h>
11*a71a9546SAutomerger Merge Worker
12*a71a9546SAutomerger Merge Worker #define PFX "CONNSECMARK target: "
13*a71a9546SAutomerger Merge Worker
14*a71a9546SAutomerger Merge Worker enum {
15*a71a9546SAutomerger Merge Worker O_SAVE = 0,
16*a71a9546SAutomerger Merge Worker O_RESTORE,
17*a71a9546SAutomerger Merge Worker F_SAVE = 1 << O_SAVE,
18*a71a9546SAutomerger Merge Worker F_RESTORE = 1 << O_RESTORE,
19*a71a9546SAutomerger Merge Worker };
20*a71a9546SAutomerger Merge Worker
CONNSECMARK_help(void)21*a71a9546SAutomerger Merge Worker static void CONNSECMARK_help(void)
22*a71a9546SAutomerger Merge Worker {
23*a71a9546SAutomerger Merge Worker printf(
24*a71a9546SAutomerger Merge Worker "CONNSECMARK target options:\n"
25*a71a9546SAutomerger Merge Worker " --save Copy security mark from packet to conntrack\n"
26*a71a9546SAutomerger Merge Worker " --restore Copy security mark from connection to packet\n");
27*a71a9546SAutomerger Merge Worker }
28*a71a9546SAutomerger Merge Worker
29*a71a9546SAutomerger Merge Worker static const struct xt_option_entry CONNSECMARK_opts[] = {
30*a71a9546SAutomerger Merge Worker {.name = "save", .id = O_SAVE, .excl = F_RESTORE, .type = XTTYPE_NONE},
31*a71a9546SAutomerger Merge Worker {.name = "restore", .id = O_RESTORE, .excl = F_SAVE,
32*a71a9546SAutomerger Merge Worker .type = XTTYPE_NONE},
33*a71a9546SAutomerger Merge Worker XTOPT_TABLEEND,
34*a71a9546SAutomerger Merge Worker };
35*a71a9546SAutomerger Merge Worker
CONNSECMARK_parse(struct xt_option_call * cb)36*a71a9546SAutomerger Merge Worker static void CONNSECMARK_parse(struct xt_option_call *cb)
37*a71a9546SAutomerger Merge Worker {
38*a71a9546SAutomerger Merge Worker struct xt_connsecmark_target_info *info = cb->data;
39*a71a9546SAutomerger Merge Worker
40*a71a9546SAutomerger Merge Worker xtables_option_parse(cb);
41*a71a9546SAutomerger Merge Worker switch (cb->entry->id) {
42*a71a9546SAutomerger Merge Worker case O_SAVE:
43*a71a9546SAutomerger Merge Worker info->mode = CONNSECMARK_SAVE;
44*a71a9546SAutomerger Merge Worker break;
45*a71a9546SAutomerger Merge Worker case O_RESTORE:
46*a71a9546SAutomerger Merge Worker info->mode = CONNSECMARK_RESTORE;
47*a71a9546SAutomerger Merge Worker break;
48*a71a9546SAutomerger Merge Worker }
49*a71a9546SAutomerger Merge Worker }
50*a71a9546SAutomerger Merge Worker
CONNSECMARK_check(struct xt_fcheck_call * cb)51*a71a9546SAutomerger Merge Worker static void CONNSECMARK_check(struct xt_fcheck_call *cb)
52*a71a9546SAutomerger Merge Worker {
53*a71a9546SAutomerger Merge Worker if (cb->xflags == 0)
54*a71a9546SAutomerger Merge Worker xtables_error(PARAMETER_PROBLEM, PFX "parameter required");
55*a71a9546SAutomerger Merge Worker }
56*a71a9546SAutomerger Merge Worker
print_connsecmark(const struct xt_connsecmark_target_info * info)57*a71a9546SAutomerger Merge Worker static void print_connsecmark(const struct xt_connsecmark_target_info *info)
58*a71a9546SAutomerger Merge Worker {
59*a71a9546SAutomerger Merge Worker switch (info->mode) {
60*a71a9546SAutomerger Merge Worker case CONNSECMARK_SAVE:
61*a71a9546SAutomerger Merge Worker printf("save");
62*a71a9546SAutomerger Merge Worker break;
63*a71a9546SAutomerger Merge Worker
64*a71a9546SAutomerger Merge Worker case CONNSECMARK_RESTORE:
65*a71a9546SAutomerger Merge Worker printf("restore");
66*a71a9546SAutomerger Merge Worker break;
67*a71a9546SAutomerger Merge Worker
68*a71a9546SAutomerger Merge Worker default:
69*a71a9546SAutomerger Merge Worker xtables_error(OTHER_PROBLEM,
70*a71a9546SAutomerger Merge Worker PFX "invalid mode %hhu", info->mode);
71*a71a9546SAutomerger Merge Worker }
72*a71a9546SAutomerger Merge Worker }
73*a71a9546SAutomerger Merge Worker
74*a71a9546SAutomerger Merge Worker static void
CONNSECMARK_print(const void * ip,const struct xt_entry_target * target,int numeric)75*a71a9546SAutomerger Merge Worker CONNSECMARK_print(const void *ip, const struct xt_entry_target *target,
76*a71a9546SAutomerger Merge Worker int numeric)
77*a71a9546SAutomerger Merge Worker {
78*a71a9546SAutomerger Merge Worker const struct xt_connsecmark_target_info *info =
79*a71a9546SAutomerger Merge Worker (struct xt_connsecmark_target_info*)(target)->data;
80*a71a9546SAutomerger Merge Worker
81*a71a9546SAutomerger Merge Worker printf(" CONNSECMARK ");
82*a71a9546SAutomerger Merge Worker print_connsecmark(info);
83*a71a9546SAutomerger Merge Worker }
84*a71a9546SAutomerger Merge Worker
85*a71a9546SAutomerger Merge Worker static void
CONNSECMARK_save(const void * ip,const struct xt_entry_target * target)86*a71a9546SAutomerger Merge Worker CONNSECMARK_save(const void *ip, const struct xt_entry_target *target)
87*a71a9546SAutomerger Merge Worker {
88*a71a9546SAutomerger Merge Worker const struct xt_connsecmark_target_info *info =
89*a71a9546SAutomerger Merge Worker (struct xt_connsecmark_target_info*)target->data;
90*a71a9546SAutomerger Merge Worker
91*a71a9546SAutomerger Merge Worker printf(" --");
92*a71a9546SAutomerger Merge Worker print_connsecmark(info);
93*a71a9546SAutomerger Merge Worker }
94*a71a9546SAutomerger Merge Worker
95*a71a9546SAutomerger Merge Worker static struct xtables_target connsecmark_target = {
96*a71a9546SAutomerger Merge Worker .family = NFPROTO_UNSPEC,
97*a71a9546SAutomerger Merge Worker .name = "CONNSECMARK",
98*a71a9546SAutomerger Merge Worker .version = XTABLES_VERSION,
99*a71a9546SAutomerger Merge Worker .revision = 0,
100*a71a9546SAutomerger Merge Worker .size = XT_ALIGN(sizeof(struct xt_connsecmark_target_info)),
101*a71a9546SAutomerger Merge Worker .userspacesize = XT_ALIGN(sizeof(struct xt_connsecmark_target_info)),
102*a71a9546SAutomerger Merge Worker .help = CONNSECMARK_help,
103*a71a9546SAutomerger Merge Worker .print = CONNSECMARK_print,
104*a71a9546SAutomerger Merge Worker .save = CONNSECMARK_save,
105*a71a9546SAutomerger Merge Worker .x6_parse = CONNSECMARK_parse,
106*a71a9546SAutomerger Merge Worker .x6_fcheck = CONNSECMARK_check,
107*a71a9546SAutomerger Merge Worker .x6_options = CONNSECMARK_opts,
108*a71a9546SAutomerger Merge Worker };
109*a71a9546SAutomerger Merge Worker
_init(void)110*a71a9546SAutomerger Merge Worker void _init(void)
111*a71a9546SAutomerger Merge Worker {
112*a71a9546SAutomerger Merge Worker xtables_register_target(&connsecmark_target);
113*a71a9546SAutomerger Merge Worker }
114