[PATCH 1/2] iptables: PKTTYPE target support

[PATCH 1/2] iptables: PKTTYPE target support

[Pablo Neira Ayuso]

This patch adds support for the PKTTYPE target to iptables.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---

 extensions/libxt_PKTTYPE.c           |  113 ++++++++++++++++++++++++++++++++++
 include/linux/netfilter/xt_PKTTYPE.h |    8 ++
 2 files changed, 121 insertions(+), 0 deletions(-)
 create mode 100644 extensions/libxt_PKTTYPE.c
 create mode 100644 include/linux/netfilter/xt_PKTTYPE.h

diff --git a/extensions/libxt_PKTTYPE.c b/extensions/libxt_PKTTYPE.c
new file mode 100644
index 0000000..878897d
--- /dev/null
+++ b/extensions/libxt_PKTTYPE.c
@@ -0,0 +1,113 @@
+/*
+ * (C) 2008 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <stdio.h>
+#include <netdb.h>
+#include <string.h>
+#include <stdlib.h>
+#include <getopt.h>
+#if defined(__GLIBC__) && __GLIBC__ == 2
+#include <net/ethernet.h>
+#else
+#include <linux/if_ether.h>
+#endif
+#include <xtables.h>
+#include <linux/if_packet.h>
+#include <linux/netfilter/xt_PKTTYPE.h>
+
+static void
+pkttype_help(void)
+{
+	printf(
+"PKTTYPE target options:\n"
+"  --to-pkt-type packettype		new packet type\n"
+"Valid packet types:\n"
+"	unicast			to us\n");
+}
+
+enum {
+	PKTTYPE_OPT_PKTTYPE,
+};
+
+static const struct option pkttype_opts[] = {
+	{ "to-pkt-type", 	1, NULL, PKTTYPE_OPT_PKTTYPE },
+	{ .name = NULL }
+};
+
+static int 
+pkttype_parse(int c, char **argv, int invert, unsigned int *flags,
+	      const void *entry, struct xt_entry_target **target)
+{
+	struct xt_pkttype_target_info *info = (void *)(*target)->data;
+
+	switch (c) {
+	case PKTTYPE_OPT_PKTTYPE:
+		if (*flags & (1 << c))
+			exit_error(PARAMETER_PROBLEM,
+				   "Can only specify `--to-pkttype' once");
+
+		if (strncmp(optarg, "unicast", strlen("unicast")) != 0)
+			exit_error(PARAMETER_PROBLEM,
+				   "Unknown packet type `%s'", optarg);
+
+		info->pkt_type = PACKET_HOST;
+		*flags |= 1 << c;
+		break;
+	default:
+		return 0;
+	}
+
+	return 1;
+}
+
+static void
+pkttype_check(unsigned int flags)
+{
+	if ((flags & ((1 << PKTTYPE_OPT_PKTTYPE)))
+		== ((1 << PKTTYPE_OPT_PKTTYPE))) {
+		return;
+	}
+
+	exit_error(PARAMETER_PROBLEM,
+		   "PKTTYPE target: Invalid parameter combination");
+}
+
+static void
+pkttype_print(const void *ip, const struct xt_entry_target *target, int numeric)
+{
+	const struct xt_pkttype_target_info *info = (void *)target->data;
+
+	printf("PKTTYPE to-pkt-type=%s",
+		info->pkt_type == PACKET_HOST ? "unicast" : "unknown");
+}
+
+static void
+pkttype_save(const void *ip, const struct xt_entry_target *target)
+{
+	const struct xt_pkttype_target_info *info = (void *)target->data;
+
+	printf("--to-pkt-type %s", 
+		info->pkt_type == PACKET_HOST ? "unicast" : "unknown");
+}
+
+static struct xtables_target pkttype_tg_reg = {
+	.family		= AF_UNSPEC,
+	.name		= "PKTTYPE",
+	.version	= XTABLES_VERSION,
+	.size		= XT_ALIGN(sizeof(struct xt_pkttype_target_info)),
+ 	.help		= pkttype_help,
+	.parse		= pkttype_parse,
+	.final_check	= pkttype_check,
+	.print		= pkttype_print,
+	.save		= pkttype_save,
+	.extra_opts	= pkttype_opts,
+};
+
+void _init(void)
+{
+	xtables_register_target(&pkttype_tg_reg);
+}
diff --git a/include/linux/netfilter/xt_PKTTYPE.h b/include/linux/netfilter/xt_PKTTYPE.h
new file mode 100644
index 0000000..cc67cbf
--- /dev/null
+++ b/include/linux/netfilter/xt_PKTTYPE.h
@@ -0,0 +1,8 @@
+#ifndef _XT_PKTTYPE_TARGET_H
+#define _XT_PKTTYPE_TARGET_H
+
+struct xt_pkttype_target_info {
+	u_int8_t pkt_type;
+};
+
+#endif /* _XT_PKTTYPE_TARGET_H */

[PATCH 2/2] iptables: cluster match support

[Pablo Neira Ayuso]

This patch adds support for the cluster match to iptables.

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---

 extensions/libxt_cluster.c           |  200 ++++++++++++++++++++++++++++++++++
 include/linux/netfilter/xt_cluster.h |   21 ++++
 2 files changed, 221 insertions(+), 0 deletions(-)
 create mode 100644 extensions/libxt_cluster.c
 create mode 100644 include/linux/netfilter/xt_cluster.h

diff --git a/extensions/libxt_cluster.c b/extensions/libxt_cluster.c
new file mode 100644
index 0000000..1f82ac3
--- /dev/null
+++ b/extensions/libxt_cluster.c
@@ -0,0 +1,200 @@
+/*
+ * (C) 2008 by Pablo Neira Ayuso <pablo@netfilter.org>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+#include <getopt.h>
+#include <stddef.h>
+
+#include <xtables.h>
+#include <linux/netfilter/x_tables.h>
+#include <linux/netfilter/xt_cluster.h>
+
+/* maximum 16 nodes */
+#define CLUSTER_MAX_NODES	16
+
+/* hack to keep for check */
+static int total_nodes;
+static int local_node;
+
+static void
+cluster_help(void)
+{
+	printf(
+"cluster match options:\n"
+"  --cluster-total-nodes <num>		Set number of total nodes in cluster\n"
+"  --cluster-local-node <num>		Set the local node number\n"
+"  --cluster-hash-seed <num>		Set seed value of the Jenkins hash\n"
+"  --cluster-proc-name <string>		Proc interface name\n");
+}
+
+enum {
+	CLUSTER_OPT_DEVICE,
+	CLUSTER_OPT_TOTAL_NODES,
+	CLUSTER_OPT_LOCAL_NODE,
+	CLUSTER_OPT_HASH_SEED,
+	CLUSTER_OPT_PROC_NAME,
+};
+
+static const struct option cluster_opts[] = {
+	{ "cluster-total-nodes", 	1, NULL, CLUSTER_OPT_TOTAL_NODES },
+	{ "cluster-local-node", 	1, NULL, CLUSTER_OPT_LOCAL_NODE },
+	{ "cluster-hash-seed",		1, NULL, CLUSTER_OPT_HASH_SEED },
+	{ "cluster-proc-name",		1, NULL, CLUSTER_OPT_PROC_NAME },
+	{ .name = NULL }
+};
+
+static int 
+cluster_parse(int c, char **argv, int invert, unsigned int *flags,
+	      const void *entry, struct xt_entry_match **match)
+{
+	struct xt_cluster_match_info *info = (void *)(*match)->data;
+	unsigned int num;
+
+	switch (c) {
+	case CLUSTER_OPT_TOTAL_NODES:
+		if (*flags & (1 << c))
+			exit_error(PARAMETER_PROBLEM,
+				   "Can only specify "
+				   "`--cluster-total-nodes' once");
+
+		if (string_to_number(optarg, 1, CLUSTER_MAX_NODES, &num) < 0)
+			exit_error(PARAMETER_PROBLEM, 
+				    "Unable to parse `%s' in "
+				    "`--cluster-total-nodes'", optarg);
+
+		total_nodes = num;
+		info->total_nodes = (u_int16_t)num;
+		*flags |= 1 << c;
+		break;
+	case CLUSTER_OPT_LOCAL_NODE:
+		if (*flags & (1 << c))
+			exit_error(PARAMETER_PROBLEM,
+				   "Can only specify "
+				   "`--cluster-local-node' once");
+
+		check_inverse(optarg, &invert, &optind, 0);
+
+		if (string_to_number(optarg, 1, CLUSTER_MAX_NODES, &num) < 0)
+			exit_error(PARAMETER_PROBLEM,
+				   "Unable to parse `%s' in "
+				   "`--cluster-local-node'", optarg);
+
+		if (invert)
+			info->flags |= (1 << XT_CLUSTER_F_INV);
+
+		info->node_id = (u_int16_t)num;
+		*flags |= 1 << c;
+		break;
+	case CLUSTER_OPT_HASH_SEED:
+		if (*flags & (1 << c))
+			exit_error(PARAMETER_PROBLEM,
+				   "Can only specify "
+				   "`--cluster-hash-seed' once");
+
+		if (string_to_number(optarg, 0, UINT_MAX, &num) < 0)
+			exit_error(PARAMETER_PROBLEM,
+				   "Unable to parse `%s'", optarg);
+
+		info->hash_seed = num;
+		*flags |= 1 << c;
+		break;
+	case CLUSTER_OPT_PROC_NAME:
+		if (*flags & (1 << c))
+			exit_error(PARAMETER_PROBLEM,
+				   "Can only specify "
+				   "`--cluster-proc-name' once");
+
+		if (strlen(optarg) > sizeof(info->proc_name))
+			exit_error(PARAMETER_PROBLEM,
+				   "--cluster-proc-name string too long");
+
+		strncpy(info->proc_name, optarg, sizeof(info->proc_name));
+		info->proc_name[sizeof(info->proc_name)-1] = '\0';
+		*flags |= 1 << c;
+		break;
+	default:
+		return 0;
+	}
+
+	return 1;
+}
+
+static void
+cluster_check(unsigned int flags)
+{
+	if ((flags & ((1 << CLUSTER_OPT_TOTAL_NODES) |
+		      (1 << CLUSTER_OPT_LOCAL_NODE)  |
+		      (1 << CLUSTER_OPT_PROC_NAME)))
+		== ((1 << CLUSTER_OPT_TOTAL_NODES) |
+		    (1 << CLUSTER_OPT_LOCAL_NODE) |
+		    (1 << CLUSTER_OPT_PROC_NAME))) {
+		if (local_node > total_nodes)
+			exit_error(PARAMETER_PROBLEM,
+				   "cluster match: `--cluster-local-node' "
+				   "must be <= `--cluster-total-nodes'");
+		return;
+	}
+
+	exit_error(PARAMETER_PROBLEM,
+		   "cluster match: Invalid parameter combination");
+}
+
+static void
+cluster_print(const void *ip, const struct xt_entry_match *match, int numeric)
+{
+	const struct xt_cluster_match_info *info = (void *)match->data;
+
+	printf("cluster ");
+	if (info->flags & XT_CLUSTER_F_INV)
+		printf("!node_id=%u ", info->node_id);
+	else
+		printf("node_id=%u ", info->node_id);
+
+	printf("total_nodes=%u hash_seed=%u proc=%s ", 
+		info->total_nodes,
+		info->hash_seed,
+		info->proc_name);
+}
+
+static void
+cluster_save(const void *ip, const struct xt_entry_match *match)
+{
+	const struct xt_cluster_match_info *info = (void *)match->data;
+
+	if (info->flags & XT_CLUSTER_F_INV)
+		printf("! --cluster-this-node %u ", info->node_id);
+	else
+		printf("--cluster-this-node %u ", info->node_id);
+
+	printf("--cluster-total-nodes %u "
+	       "--cluster-hash-seed %u "
+	       "--cluster-proc-entry %s ",
+		info->total_nodes,
+		info->hash_seed,
+		info->proc_name);
+}
+
+static struct xtables_match cluster_mt_reg = {
+	.family		= AF_UNSPEC,
+	.name		= "cluster",
+	.version	= XTABLES_VERSION,
+	.size		= XT_ALIGN(sizeof(struct xt_cluster_match_info)),
+	.userspacesize  = XT_ALIGN(offsetof(struct xt_cluster_match_info,data)),
+ 	.help		= cluster_help,
+	.parse		= cluster_parse,
+	.final_check	= cluster_check,
+	.print		= cluster_print,
+	.save		= cluster_save,
+	.extra_opts	= cluster_opts,
+};
+
+void _init(void)
+{
+	xtables_register_match(&cluster_mt_reg);
+}
diff --git a/include/linux/netfilter/xt_cluster.h b/include/linux/netfilter/xt_cluster.h
new file mode 100644
index 0000000..a06401d
--- /dev/null
+++ b/include/linux/netfilter/xt_cluster.h
@@ -0,0 +1,21 @@
+#ifndef _XT_CLUSTER_MATCH_H
+#define _XT_CLUSTER_MATCH_H
+
+struct proc_dir_entry;
+
+enum xt_cluster_flags {
+	XT_CLUSTER_F_INV = 0,
+};
+
+struct xt_cluster_match_info {
+	u_int16_t		total_nodes;
+	u_int16_t		node_id;
+	u_int32_t		hash_seed;
+	char			proc_name[16];
+	u_int32_t		flags;
+
+	/* Used internally by the kernel */
+	void			*data __attribute__((aligned(8)));
+};
+
+#endif /* _XT_CLUSTER_MATCH_H */