diff --git a/extensions/libxt_route.c b/extensions/libxt_route.c new file mode 100644 index 0000000..5add129 --- /dev/null +++ b/extensions/libxt_route.c @@ -0,0 +1,267 @@ +/* Shared library add-on to iptables for route matching support + * (C) 2008 Phil Oester + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as + * published by the Free Software Foundation. + */ + +#include +#include +#include +#include +#include + +#include +#include + +static void route_help(void) +{ + printf( +"route match options:\n" +" [!] --route-src-exists Route for src exists\n" +" [!] --route-src-eq value Route for src exists with prefix-length == value\n" +" [!] --route-src-gt value Route for src exists with prefix-length > value\n" +" [!] --route-src-lt value Route for src exists with prefix-length < value\n" +" [!] --route-dst-exists Route for dst exists\n" +" [!] --route-dst-eq value Route for dst exists with prefix-length == value\n" +" [!] --route-dst-gt value Route for dst exists with prefix-length > value\n" +" [!] --route-dst-lt value Route for dst exists with prefix-length < value\n"); +} + +static const struct option route_opts[] = { + { .name = "route-src-exists", .has_arg = 0, .val = '1' }, + { .name = "route-src-eq", .has_arg = 1, .val = '2' }, + { .name = "route-src-gt", .has_arg = 1, .val = '3' }, + { .name = "route-src-lt", .has_arg = 1, .val = '4' }, + { .name = "route-dst-exists", .has_arg = 0, .val = '5' }, + { .name = "route-dst-eq", .has_arg = 1, .val = '6' }, + { .name = "route-dst-gt", .has_arg = 1, .val = '7' }, + { .name = "route-dst-lt", .has_arg = 1, .val = '8' }, + { .name = NULL } +}; + +static int route_parse(int c, int invert, unsigned int *flags, + struct xt_route_info *info, unsigned int maxplen) +{ + unsigned int value; + + switch (c) { + case '1': + if (invert) + info->invert = 1; + + info->mode = XT_ROUTE_SRC_EXISTS; + break; + case '2': + if (invert) + info->invert = 1; + + if (string_to_number(optarg, 1, maxplen, &value) == -1) + exit_error(PARAMETER_PROBLEM, + "route: Expected prefix between 1 and %u", maxplen); + + info->mode = XT_ROUTE_SRC_EQ; + info->value = value; + break; + case '3': + if (invert) + info->invert = 1; + + if (string_to_number(optarg, 0, maxplen-1, &value) == -1) + exit_error(PARAMETER_PROBLEM, + "route: Expected prefix between 0 and %u", maxplen-1); + + info->mode = XT_ROUTE_SRC_GT; + info->value = value; + break; + case '4': + if (invert) + info->invert = 1; + + if (string_to_number(optarg, 2, maxplen, &value) == -1) + exit_error(PARAMETER_PROBLEM, + "route: Expected prefix between 2 and %u", maxplen); + + info->mode = XT_ROUTE_SRC_LT; + info->value = value; + break; + case '5': + if (invert) + info->invert = 1; + + info->mode = XT_ROUTE_DST_EXISTS; + break; + case '6': + if (invert) + info->invert = 1; + + if (string_to_number(optarg, 1, maxplen, &value) == -1) + exit_error(PARAMETER_PROBLEM, + "route: Expected prefix between 1 and %u", maxplen); + + info->mode = XT_ROUTE_DST_EQ; + info->value = value; + break; + case '7': + if (invert) + info->invert = 1; + + if (string_to_number(optarg, 0, maxplen-1, &value) == -1) + exit_error(PARAMETER_PROBLEM, + "route: Expected prefix between 0 and %u", maxplen-1); + + info->mode = XT_ROUTE_DST_GT; + info->value = value; + break; + case '8': + if (invert) + info->invert = 1; + + if (string_to_number(optarg, 2, maxplen, &value) == -1) + exit_error(PARAMETER_PROBLEM, + "route: Expected prefix between 2 and %u", maxplen); + + info->mode = XT_ROUTE_DST_LT; + info->value = value; + break; + default: + return 0; + + } + + if (*flags) + exit_error(PARAMETER_PROBLEM, + "Can't specify route match twice"); + *flags = 1; + + return 1; +} + +static int route_parse4(int c, char **argv, int invert, unsigned int *flags, + const void *entry, struct xt_entry_match **match) +{ + return route_parse(c, invert, flags, (void *)(*match)->data, 32); +} + +static int route_parse6(int c, char **argv, int invert, unsigned int *flags, + const void *entry, struct xt_entry_match **match) +{ + return route_parse(c, invert, flags, (void *)(*match)->data, 128); +} + +static void route_check(unsigned int flags) +{ + if (!flags) + exit_error(PARAMETER_PROBLEM, + "Route match: You must specify an option"); +} + +static void route_print(const void *ip, const struct xt_entry_match *match, + int numeric) +{ + const struct xt_route_info *info = + (struct xt_route_info *) match->data; + + printf("Route: "); + if (info->invert) + printf("! "); + switch (info->mode) { + case XT_ROUTE_SRC_EXISTS: + printf("Src exists "); + break; + case XT_ROUTE_SRC_EQ: + printf("Src prefix == %u ", info->value); + break; + case XT_ROUTE_SRC_GT: + printf("Src prefix > %u ", info->value); + break; + case XT_ROUTE_SRC_LT: + printf("Src prefix < %u ", info->value); + break; + case XT_ROUTE_DST_EXISTS: + printf("Dst exists "); + break; + case XT_ROUTE_DST_EQ: + printf("Dst prefix == %u ", info->value); + break; + case XT_ROUTE_DST_GT: + printf("Dst prefix > %u ", info->value); + break; + case XT_ROUTE_DST_LT: + printf("Dst prefix < %u ", info->value); + break; + } +} + +static void route_save(const void *ip, const struct xt_entry_match *match) +{ + const struct xt_route_info *info = + (struct xt_route_info *) match->data; + + if (info->invert) + printf("! "); + switch (info->mode) { + case XT_ROUTE_SRC_EXISTS: + printf("--route-src-exists "); + break; + case XT_ROUTE_SRC_EQ: + printf("--route-src-eq %u ", info->value); + break; + case XT_ROUTE_SRC_GT: + printf("--route-src-gt %u ", info->value); + break; + case XT_ROUTE_SRC_LT: + printf("--route-src-lt %u ", info->value); + break; + case XT_ROUTE_DST_EXISTS: + printf("--route-dst-exists "); + break; + case XT_ROUTE_DST_EQ: + printf("--route-dst-eq %u ", info->value); + break; + case XT_ROUTE_DST_GT: + printf("--route-dst-gt %u ", info->value); + break; + case XT_ROUTE_DST_LT: + printf("--route-dst-lt %u ", info->value); + break; + default: + break; + } +} + +static struct xtables_match route_mt = { + .name = "route", + .version = XTABLES_VERSION, + .family = AF_INET, + .size = XT_ALIGN(sizeof(struct xt_route_info)), + .userspacesize = XT_ALIGN(sizeof(struct xt_route_info)), + .help = route_help, + .parse = route_parse4, + .final_check = route_check, + .print = route_print, + .save = route_save, + .extra_opts = route_opts, +}; + +static struct xtables_match route_mt6 = { + .name = "route", + .version = XTABLES_VERSION, + .family = AF_INET6, + .size = XT_ALIGN(sizeof(struct xt_route_info)), + .userspacesize = XT_ALIGN(sizeof(struct xt_route_info)), + .help = route_help, + .parse = route_parse6, + .final_check = route_check, + .print = route_print, + .save = route_save, + .extra_opts = route_opts, +}; + + +void _init(void) +{ + xtables_register_match(&route_mt); + xtables_register_match(&route_mt6); +} diff --git a/include/linux/netfilter/xt_route.h b/include/linux/netfilter/xt_route.h new file mode 100644 index 0000000..0c90494 --- /dev/null +++ b/include/linux/netfilter/xt_route.h @@ -0,0 +1,21 @@ +#ifndef _XT_ROUTE_H +#define _XT_ROUTE_H + +enum { + XT_ROUTE_SRC_EXISTS = 0, + XT_ROUTE_SRC_EQ, + XT_ROUTE_SRC_GT, + XT_ROUTE_SRC_LT, + XT_ROUTE_DST_EXISTS, + XT_ROUTE_DST_EQ, + XT_ROUTE_DST_GT, + XT_ROUTE_DST_LT, +}; + +struct xt_route_info { + u_int8_t invert; + u_int8_t mode; + u_int8_t prefixlen; +}; + +#endif /*_XT_ROUTE_H*/