From: Richard Weinberger <richard@nod.at>
To: netfilter-devel@vger.kernel.org
Cc: Richard Weinberger <richard@nod.at>
Subject: [PATCH] iptables: Add APPROVE target
Date: Thu, 20 Jan 2011 23:47:08 +0100 [thread overview]
Message-ID: <1295563629-14996-5-git-send-email-richard@nod.at> (raw)
In-Reply-To: <1295563629-14996-4-git-send-email-richard@nod.at>
Signed-off-by: Richard Weinberger <richard@nod.at>
---
extensions/libxt_APPROVE.c | 83 ++++++++++++++++++++++++++++++++++
extensions/libxt_APPROVE.man | 1 +
include/linux/netfilter/xt_APPROVE.h | 8 +++
3 files changed, 92 insertions(+), 0 deletions(-)
create mode 100644 extensions/libxt_APPROVE.c
create mode 100644 extensions/libxt_APPROVE.man
create mode 100644 include/linux/netfilter/xt_APPROVE.h
diff --git a/extensions/libxt_APPROVE.c b/extensions/libxt_APPROVE.c
new file mode 100644
index 0000000..4142bfa
--- /dev/null
+++ b/extensions/libxt_APPROVE.c
@@ -0,0 +1,83 @@
+#include <stdbool.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <getopt.h>
+#include <stddef.h>
+
+#include <xtables.h>
+
+#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter/xt_APPROVE.h>
+
+static const struct option approve_opts[] = {
+ {.name = "rule-id", .has_arg = true, .val = 'i'},
+ XT_GETOPT_TABLEEND
+};
+
+static void approve_help(void)
+{
+ printf("APPROVE target options:\n"
+ "--rule-id id assign numberic id to the rule.\n");
+}
+
+static int approve_parse(int c, char **argv, int invert, unsigned int *flags,
+ const void *entry, struct xt_entry_target **target)
+{
+ struct nf_approve_info *ridi = (void *)(*target)->data;
+
+ if(c == 'i') {
+ xtables_param_act(XTF_NO_INVERT, "APPROVE", "--rule-id", invert);
+ ridi->ruleid = strtoul(optarg, NULL, 0);
+
+ if(ridi->ruleid < 1)
+ xtables_error(PARAMETER_PROBLEM,
+ "--rule-id must be greater than 0");
+
+ *flags = 1;
+
+ return true;
+ }
+
+ return false;
+}
+
+static void approve_print(const void *ip, const struct xt_entry_target *target,
+ int numeric)
+{
+ struct nf_approve_info *ridi = (void *)target->data;
+
+ printf("--rule-id %i\n", ridi->ruleid);
+}
+
+static void approve_save(const void *ip, const struct xt_entry_target *target)
+{
+ struct nf_approve_info *ridi = (void *)target->data;
+
+ printf("--rule-id %i\n", ridi->ruleid);
+}
+
+static void approve_final_check(unsigned int flags)
+{
+ if(flags != 1)
+ xtables_error(PARAMETER_PROBLEM,
+ "--rule-id must be specified");
+}
+
+static struct xtables_target approve_target = {
+ .family = NFPROTO_UNSPEC,
+ .name = "APPROVE",
+ .version = XTABLES_VERSION,
+ .size = XT_ALIGN(sizeof(struct nf_approve_info)),
+ .userspacesize = XT_ALIGN(sizeof(struct nf_approve_info)),
+ .help = approve_help,
+ .parse = approve_parse,
+ .final_check = approve_final_check,
+ .extra_opts = approve_opts,
+ .print = approve_print,
+ .save = approve_save
+};
+
+void _init(void)
+{
+ xtables_register_target(&approve_target);
+}
diff --git a/extensions/libxt_APPROVE.man b/extensions/libxt_APPROVE.man
new file mode 100644
index 0000000..ce08911
--- /dev/null
+++ b/extensions/libxt_APPROVE.man
@@ -0,0 +1 @@
+Richard was too lazy to write a manpage...
diff --git a/include/linux/netfilter/xt_APPROVE.h b/include/linux/netfilter/xt_APPROVE.h
new file mode 100644
index 0000000..c62c6bc
--- /dev/null
+++ b/include/linux/netfilter/xt_APPROVE.h
@@ -0,0 +1,8 @@
+#ifndef _XT_APPROVE_H
+#define _XT_APPROVE_H
+
+struct nf_approve_info {
+ u_int16_t ruleid;
+};
+
+#endif /* _XT_APPROVE_H */
--
1.6.6.1
next prev parent reply other threads:[~2011-01-20 22:47 UTC|newest]
Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-01-20 22:47 [PATCH 0/3][RFC] Relationship between conntrack and firewall rules Richard Weinberger
2011-01-20 22:47 ` [PATCH 1/3] netfilter: add ruleid extension Richard Weinberger
2011-01-20 22:47 ` [PATCH 2/3] netfilter: add APPROVE target Richard Weinberger
2011-01-20 22:47 ` [PATCH 3/3] netfilter: implement ctnetlink_dump_ruleid() Richard Weinberger
2011-01-20 22:47 ` Richard Weinberger [this message]
2011-01-20 22:47 ` [PATCH] conntrack: Implement ruleid support Richard Weinberger
2011-01-20 23:17 ` [PATCH 2/3] netfilter: add APPROVE target Jan Engelhardt
2011-01-20 23:22 ` Richard Weinberger
2011-01-20 23:27 ` Jan Engelhardt
2011-01-20 23:30 ` Richard Weinberger
2011-01-20 22:52 ` [PATCH 0/3][RFC] Relationship between conntrack and firewall rules Jan Engelhardt
2011-01-20 23:02 ` Richard Weinberger
2011-01-21 10:00 ` Pablo Neira Ayuso
2011-01-21 11:13 ` Richard Weinberger
2011-01-21 11:26 ` Pablo Neira Ayuso
2011-01-21 11:56 ` Richard Weinberger
2011-01-21 12:24 ` Pablo Neira Ayuso
2011-01-21 12:53 ` Richard Weinberger
2011-01-21 13:25 ` Pablo Neira Ayuso
2011-01-21 13:38 ` Richard Weinberger
2011-01-21 13:57 ` Pablo Neira Ayuso
2011-01-21 14:11 ` Richard Weinberger
2011-01-21 15:09 ` Mr Dash Four
2011-01-21 0:04 ` Mr Dash Four
2011-01-21 0:10 ` Richard Weinberger
2011-01-21 0:13 ` Mr Dash Four
2011-01-21 9:58 ` secctx support for conntrack-tools [was Re: [PATCH 0/3][RFC] Relationship between conntrack and firewall rules] Pablo Neira Ayuso
2011-01-21 9:56 ` [PATCH 0/3][RFC] Relationship between conntrack and firewall rules Pablo Neira Ayuso
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1295563629-14996-5-git-send-email-richard@nod.at \
--to=richard@nod.at \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).