[PATCH iptables-next 0/2] extensions: add condition match and target extensions

[PATCH iptables-next 0/2] extensions: add condition match and target extensions

[luciano.coelho]

From: Luciano Coelho <luciano.coelho@nokia.com>

Hi,

These patches add the condition match and target extensions to the iptables
tool.  These are the corresponding user space changes for the kernel patches I
sent previously (they work regardless of whether the capabilities patch is
applied or not).

This patches should be released in the iptables tool when the condition kernel
patches are released, so they should go to the iptables-next tree.

Cheers,
Luca.

Luciano Coelho (2):
  extensions: add condition match extension
  extensions: add condition target extension.

 extensions/libxt_CONDITION.c   |  144 ++++++++++++++++++++++++++++++++++++++++
 extensions/libxt_CONDITION.man |    9 +++
 extensions/libxt_condition.c   |  128 +++++++++++++++++++++++++++++++++++
 extensions/libxt_condition.man |   10 +++
 4 files changed, 291 insertions(+), 0 deletions(-)
 create mode 100644 extensions/libxt_CONDITION.c
 create mode 100644 extensions/libxt_CONDITION.man
 create mode 100644 extensions/libxt_condition.c
 create mode 100644 extensions/libxt_condition.man

[PATCH iptables-next 1/2] extensions: add condition match extension

[luciano.coelho]

From: Luciano Coelho <luciano.coelho@nokia.com>

This match extension was taken from xtables-addons and it has been
modified to implement the change from boolean conditions to u32 values.
It is possible to match when the condition is equal to the value passed
or when it is not equal to the value passed (by using the invert
option).

Signed-off-by: Luciano Coelho <luciano.coelho@nokia.com>
---
 extensions/libxt_condition.c   |  128 ++++++++++++++++++++++++++++++++++++++++
 extensions/libxt_condition.man |   10 +++
 2 files changed, 138 insertions(+), 0 deletions(-)
 create mode 100644 extensions/libxt_condition.c
 create mode 100644 extensions/libxt_condition.man

diff --git a/extensions/libxt_condition.c b/extensions/libxt_condition.c
new file mode 100644
index 0000000..6132083
--- /dev/null
+++ b/extensions/libxt_condition.c
@@ -0,0 +1,128 @@
+/*
+ *	"condition" match extension for iptables
+ *	Stephane Ouellette <ouellettes [at] videotron ca>, 2002-10-22
+ *	Massimiliano Hofer <max [at] nucleus it>, 2006-05-15
+ *	Jan Engelhardt <jengelh [at] medozas de>, 2008
+ *
+ *	This program is free software; you can redistribute it and/or modify it
+ *	under the terms of the GNU General Public License; either version 2
+ *	or 3 of the License, as published by the Free Software Foundation.
+ */
+#include <stdbool.h>
+#include <stddef.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <getopt.h>
+#include <xtables.h>
+#include <linux/netfilter/xt_condition.h>
+
+enum {
+	CONDITION_MT_OPT_NAME  = 1 << 0,
+	CONDITION_MT_OPT_VALUE = 1 << 1,
+};
+
+static void condition_help(void)
+{
+	printf(
+"condition match options:\n"
+"    --name string	Unique identifier (file name used in procfs)\n"
+"[!] --value uint	Value to match\n"
+);
+}
+
+static const struct option condition_opts[] = {
+	{.name = "name",  .has_arg = true, .val = 'n'},
+	{.name = "value", .has_arg = true, .val = 'v'},
+	{NULL},
+};
+
+static int condition_parse(int c, char **argv, int invert, unsigned int *flags,
+                           const void *entry, struct xt_entry_match **match)
+{
+	struct xt_condition_mtinfo *info = (void *)(*match)->data;
+
+	switch (c) {
+	case 'n':
+		xtables_param_act(XTF_ONLY_ONCE, "condition", "--name",
+				  *flags & CONDITION_MT_OPT_NAME);
+
+		if (strlen(optarg) < sizeof(info->name))
+			strcpy(info->name, optarg);
+		else
+			xtables_param_act(XTF_BAD_VALUE, "condition", "--name",
+					  optarg);
+
+		xtables_param_act(XTF_NO_INVERT, "condition", "--name", invert);
+
+		*flags |= CONDITION_MT_OPT_NAME;
+
+		break;
+
+	case 'v':
+		xtables_param_act(XTF_ONLY_ONCE, "condition", "--value",
+				  *flags & CONDITION_MT_OPT_VALUE);
+		if (!xtables_strtoui(optarg, NULL, &info->value, 0, UINT32_MAX))
+			xtables_param_act(XTF_BAD_VALUE, "condition",
+					  "--value", optarg);
+
+		info->invert = invert;
+
+		*flags |= CONDITION_MT_OPT_VALUE;
+
+		break;
+
+	default:
+		return false;
+	}
+
+	return true;
+}
+
+static void condition_check(unsigned int flags)
+{
+	if (!(flags & CONDITION_MT_OPT_NAME))
+		xtables_error(PARAMETER_PROBLEM, "condition match: "
+			      "--name parameter required");
+	if (!(flags & CONDITION_MT_OPT_VALUE))
+		xtables_error(PARAMETER_PROBLEM, "condition match: "
+			      "--value parameter required");
+}
+
+static void condition_print(const void *ip, const struct xt_entry_match *match,
+                            int numeric)
+{
+	const struct xt_condition_mtinfo *info = (const void *)match->data;
+
+	printf("condition %s %s %u ", info->name, (info->invert) ? "!=" : "==",
+	       info->value);
+}
+
+
+static void condition_save(const void *ip, const struct xt_entry_match *match)
+{
+	const struct xt_condition_mtinfo *info = (const void *)match->data;
+
+	printf("%s--name \"%s\" --value %u ", info->invert ? "! " : "",
+	       info->name, info->value);
+}
+
+static struct xtables_match condition_mt_reg = {
+	.name 		= "condition",
+	.revision	= 2,
+	.family		= NFPROTO_UNSPEC,
+	.version 	= XTABLES_VERSION,
+	.size 		= XT_ALIGN(sizeof(struct xt_condition_mtinfo)),
+	.userspacesize 	= XT_ALIGN(sizeof(struct xt_condition_mtinfo)),
+	.help 		= condition_help,
+	.parse 		= condition_parse,
+	.final_check	= condition_check,
+	.print 		= condition_print,
+	.save 		= condition_save,
+	.extra_opts 	= condition_opts,
+};
+
+static __attribute__((constructor)) void condition_mt_ldr(void)
+{
+	xtables_register_match(&condition_mt_reg);
+}
diff --git a/extensions/libxt_condition.man b/extensions/libxt_condition.man
new file mode 100644
index 0000000..63d7e7e
--- /dev/null
+++ b/extensions/libxt_condition.man
@@ -0,0 +1,10 @@
+Match if the condition variable is equal to the value specified.  If
+the inverse flag is used, match if the variable is not equal to the
+value.
+.TP
+[\fB!\fP] \fB\-\-value\fP \fIinteger\fP
+The unsigned integer value to be used in the comparison.
+.TP
+\fB\-\-name\fP \fIstring\fP
+This is a unique identifier for the condition.  It is the file name
+that will be used in procfs (max length 27 chars).
-- 
1.7.0.4

[PATCH iptables-next 2/2] extensions: add condition target extension.

[luciano.coelho]

From: Luciano Coelho <luciano.coelho@nokia.com>

Add support for condition targets.  The condition targets allow the
condition variables to be changed to the specified value when the target
is hit.  This allows for automatically changing the condition without
intervention from the userspace.

Signed-off-by: Luciano Coelho <luciano.coelho@nokia.com>
---
 extensions/libxt_CONDITION.c   |  144 ++++++++++++++++++++++++++++++++++++++++
 extensions/libxt_CONDITION.man |    9 +++
 2 files changed, 153 insertions(+), 0 deletions(-)
 create mode 100644 extensions/libxt_CONDITION.c
 create mode 100644 extensions/libxt_CONDITION.man

diff --git a/extensions/libxt_CONDITION.c b/extensions/libxt_CONDITION.c
new file mode 100644
index 0000000..3c2ead8
--- /dev/null
+++ b/extensions/libxt_CONDITION.c
@@ -0,0 +1,144 @@
+/*
+ * Shared library add-on for iptables to add IDLETIMER support.
+ *
+ * Copyright (C) 2010 Nokia Corporation. All rights reserved.
+ *
+ * Contact: Luciano Coelho <luciano.coelho@nokia.com>
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.	 See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA
+ * 02110-1301 USA
+ *
+ */
+
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <getopt.h>
+#include <stddef.h>
+
+#include <xtables.h>
+#include <linux/netfilter/xt_condition.h>
+
+enum {
+	CONDITION_TG_OPT_NAME  = 1 << 0,
+	CONDITION_TG_OPT_VALUE = 1 << 1,
+};
+
+static const struct option condition_tg_opts[] = {
+	{ .name = "name",   .has_arg = true, .val = 'n' },
+	{ .name = "value",  .has_arg = true, .val = 'v' },
+	{ .name = NULL }
+};
+
+static void condition_tg_help(void)
+{
+	printf(
+"CONDITION target options:\n"
+" --name  string		Unique identifier (file name used in procfs)\n"
+" --value uint			Set the condition value\n"
+"\n");
+}
+
+static int condition_tg_parse(int c, char **argv, int invert,
+			      unsigned int *flags,
+			      const void *entry,
+			      struct xt_entry_target **target)
+{
+	struct condition_tginfo *info =
+		(struct condition_tginfo *)(*target)->data;
+	bool ret;
+	unsigned int value;
+
+	switch (c) {
+	case 'v':
+		xtables_param_act(XTF_ONLY_ONCE, "CONDITION", "--value",
+				  *flags & CONDITION_TG_OPT_VALUE);
+
+		*flags |= CONDITION_TG_OPT_VALUE;
+		ret =  xtables_strtoui(optarg, NULL, &value, 0, 1);
+		if (!ret)
+			return false;
+
+		info->value = value;
+		break;
+
+	case 'n':
+		xtables_param_act(XTF_ONLY_ONCE, "CONDITION", "--name",
+				  *flags & CONDITION_TG_OPT_NAME);
+
+		if (strlen(optarg) > XT_CONDITION_MAX_NAME_SIZE)
+			xtables_param_act(XTF_BAD_VALUE, "CONDITION", "--name",
+					 optarg);
+
+		strcpy(info->name, optarg);
+		*flags |= CONDITION_TG_OPT_NAME;
+		break;
+
+	default:
+		return false;
+	}
+
+	return true;
+}
+
+static void condition_tg_final_check(unsigned int flags)
+{
+	if (!(flags & CONDITION_TG_OPT_NAME))
+		xtables_error(PARAMETER_PROBLEM, "CONDITION target: "
+			      "--name parameter required");
+	if (!(flags & CONDITION_TG_OPT_VALUE))
+		xtables_error(PARAMETER_PROBLEM, "CONDITION target: "
+			      "--value parameter required");
+}
+
+static void condition_tg_print(const void *ip,
+			       const struct xt_entry_target *target,
+			       int numeric)
+{
+	struct condition_tginfo *info =
+		(struct condition_tginfo *) target->data;
+
+	printf("value:%u ", info->value);
+	printf("name:%s ", info->name);
+}
+
+static void condition_tg_save(const void *ip,
+			      const struct xt_entry_target *target)
+{
+	struct condition_tginfo *info =
+		(struct condition_tginfo *) target->data;
+
+	printf("--value %u ", info->value);
+	printf("--name %s ", info->name);
+}
+
+static struct xtables_target condition_tg_reg = {
+	.family	       = NFPROTO_UNSPEC,
+	.name	       = "CONDITION",
+	.version       = XTABLES_VERSION,
+	.revision      = 0,
+	.size	       = XT_ALIGN(sizeof(struct condition_tginfo)),
+	.userspacesize = offsetof(struct condition_tginfo, condvar),
+	.help	       = condition_tg_help,
+	.parse	       = condition_tg_parse,
+	.final_check   = condition_tg_final_check,
+	.print	       = condition_tg_print,
+	.save	       = condition_tg_save,
+	.extra_opts    = condition_tg_opts,
+};
+
+static __attribute__((constructor)) void condition_tg_ldr(void)
+{
+	xtables_register_target(&condition_tg_reg);
+}
diff --git a/extensions/libxt_CONDITION.man b/extensions/libxt_CONDITION.man
new file mode 100644
index 0000000..348814a
--- /dev/null
+++ b/extensions/libxt_CONDITION.man
@@ -0,0 +1,9 @@
+This target allows a condition to be changed to the specified u32
+value when the target is hit.
+.TP
+\fB\-\-value\fP \fIinteger\fP
+The unsigned integer value to set the condition variable to.
+.TP
+\fB\-\-name\fP \fIstring\fP
+This is a unique identifier for the condition.  It is the file name
+that will be used in procfs (max length 27 chars).
-- 
1.7.0.4