socket match - add wildcard option [2/4]

socket match - add wildcard option [2/4]

[Nepenthes Development Team]

[-- Attachment #1: Type: text/plain, Size: 185 bytes --]

iptables-socket-match-add-transparent-option.diff
 - apply patch to add the --transparent option from
   http://article.gmane.org/gmane.comp.security.firewalls.netfilter.devel/30246

[-- Attachment #2: iptables-socket-match-add-transparent-option.diff --]
[-- Type: text/x-diff, Size: 4625 bytes --]

Added new revision of the socket match.

if the '--transparent' parameter is specified, the sockets without
set transparent socket option are ignored.

Signed-off-by: Laszlo Attila Toth <panther <at> balabit.hu>
---
 extensions/libxt_socket.c           |   95 +++++++++++++++++++++++++++++-----
 extensions/libxt_socket.man         |    6 ++-
 include/linux/netfilter/xt_socket.h |   12 ++++
 3 files changed, 98 insertions(+), 15 deletions(-)
 create mode 100644 include/linux/netfilter/xt_socket.h

diff --git a/extensions/libxt_socket.c b/extensions/libxt_socket.c
index eebc7c5..2230a93 100644
--- a/extensions/libxt_socket.c
+++ b/extensions/libxt_socket.c
@@ -6,34 +6,101 @@
 #include <stdio.h>
 #include <getopt.h>
 #include <xtables.h>
+#include <linux/netfilter/xt_socket.h>

-static void socket_mt_help(void)
+static void socket_mt_help_v0(void)
 {
-	printf("socket v%s has no options\n\n", XTABLES_VERSION);
+	printf("socket match has no options.\n\n");
 }

-static int socket_mt_parse(int c, char **argv, int invert, unsigned int *flags,
-			const void *entry, struct xt_entry_match **match)
+static void socket_mt_help_v1(void)
+{
+	printf("socket match options:\n"
+"--transparent      Matches only if the socket's transparent option is set\n");
+}
+
+static const struct option socket_opts_v1[] = {
+	{ "transparent", 0, NULL, '1' },
+	{ }
+};
+
+static int socket_mt_parse_v0(int c, char **argv, int invert,
+			      unsigned int *flags, const void *entry,
+			      struct xt_entry_match **match)
 {
 	return 0;
 }

+static int socket_mt_parse_v1(int c, char **argv, int invert,
+			      unsigned int *flags, const void *entry,
+			      struct xt_entry_match **match)
+{
+	struct xt_socket_mtinfo1 *info = (void *) (*match)->data;
+
+	switch (c) {
+	case '1':
+		if (*flags)
+			xtables_error(PARAMETER_PROBLEM,
+				      "Can't specify multiple --transparent");
+		info->flags |= XT_SOCKET_TRANSPARENT;
+		*flags = 1;
+		break;
+	default:
+		return 0;
+	}
+	return 1;
+}
+
 static void socket_mt_check(unsigned int flags)
 {
 }

-static struct xtables_match socket_mt_reg = {
-	.name	       = "socket",
-	.version       = XTABLES_VERSION,
-	.family	       = NFPROTO_IPV4,
-	.size	       = XT_ALIGN(0),
-	.userspacesize = XT_ALIGN(0),
-	.parse	       = socket_mt_parse,
-	.final_check   = socket_mt_check,
-	.help	       = socket_mt_help,
+static void socket_mt_print_v1(const void *ip,
+			       const struct xt_entry_match *match,
+			       int numeric)
+{
+	const struct xt_socket_mtinfo1 *info = (const void *)match->data;
+	printf("socket ");
+	if (info->flags & XT_SOCKET_TRANSPARENT)
+		printf("transparent ");
+}
+
+static void socket_mt_save_v1(const void *ip,
+			      const struct xt_entry_match *match)
+{
+	const struct xt_socket_mtinfo1 *info = (const void *)match->data;
+
+	if (info->flags & XT_SOCKET_TRANSPARENT)
+		printf("--transparent ");
+}
+
+static struct xtables_match socket_mt_reg_v0 = {
+	.name		= "socket",
+	.revision	= 0,
+	.version	= XTABLES_VERSION,
+	.family		= NFPROTO_IPV4,
+	.parse		= socket_mt_parse_v0,
+	.final_check	= socket_mt_check,
+	.help		= socket_mt_help_v0,
+};
+
+static struct xtables_match socket_mt_reg_v1 = {
+	.name		= "socket",
+	.version	= XTABLES_VERSION,
+	.revision	= 1,
+	.family		= NFPROTO_IPV4,
+	.size		= XT_ALIGN(sizeof(struct xt_socket_mtinfo1)),
+	.userspacesize	= XT_ALIGN(sizeof(struct xt_socket_mtinfo1)),
+	.parse		= socket_mt_parse_v1,
+	.print		= socket_mt_print_v1,
+	.save		= socket_mt_save_v1,
+	.final_check	= socket_mt_check,
+	.help		= socket_mt_help_v1,
+	.extra_opts	= socket_opts_v1,
 };

 void _init(void)
 {
-	xtables_register_match(&socket_mt_reg);
+	xtables_register_match(&socket_mt_reg_v0);
+	xtables_register_match(&socket_mt_reg_v1);
 }
diff --git a/extensions/libxt_socket.man b/extensions/libxt_socket.man
index 50c8854..edc9d75 100644
--- a/extensions/libxt_socket.man
+++ b/extensions/libxt_socket.man
@@ -1,2 +1,6 @@
 This matches if an open socket can be found by doing a socket lookup on the
-packet.
+packet which doesn\'t listen on the \'any\' IP address (0.0.0.0).
+.TP
+.BI "\-\-transparent"
+Enables additional check, that the actual socket's transparent socket option
+has to be set.
diff --git a/include/linux/netfilter/xt_socket.h b/include/linux/netfilter/xt_socket.h
new file mode 100644
index 0000000..f6ba866
--- /dev/null
+++ b/include/linux/netfilter/xt_socket.h
@@ -0,0 +1,12 @@
+#ifndef _XT_SOCKET_H_match
+#define _XT_SOCKET_H_match
+
+enum {
+	XT_SOCKET_TRANSPARENT = 1 << 0,
+};
+
+struct xt_socket_mtinfo1 {
+	__u8 flags;
+};
+
+#endif /* _XT_SOCKET_H_match */
-- 
1.6.2.2.404.ge96f3

Re: socket match - add wildcard option [2/4]

[Jan Engelhardt]

On Sunday 2010-07-25 16:50, Nepenthes Development Team wrote:

>iptables-socket-match-add-transparent-option.diff
> - apply patch to add the --transparent option from
>   http://article.gmane.org/gmane.comp.security.firewalls.netfilter.devel/30246
>

>Added new revision of the socket match.
>
>if the '--transparent' parameter is specified, the sockets without
>set transparent socket option are ignored.
>
>Signed-off-by: Laszlo Attila Toth <panther <at> balabit.hu>

This needs your own SOB.

>diff --git a/extensions/libxt_socket.c b/extensions/libxt_socket.c
>index eebc7c5..2230a93 100644
>--- a/extensions/libxt_socket.c
>+++ b/extensions/libxt_socket.c
>@@ -6,34 +6,101 @@
> #include <stdio.h>
> #include <getopt.h>
> #include <xtables.h>
>+#include <linux/netfilter/xt_socket.h>
>
>-static void socket_mt_help(void)
>+static void socket_mt_help_v0(void)
> {
>-	printf("socket v%s has no options\n\n", XTABLES_VERSION);
>+	printf("socket match has no options.\n\n");
> }

Since the function is not essential, I see no point in adding it
in the first place - the "has no options" text is autogenerated.

>
>-static int socket_mt_parse(int c, char **argv, int invert, unsigned int *flags,
>-			const void *entry, struct xt_entry_match **match)
>+static void socket_mt_help_v1(void)
>+{
>+	printf("socket match options:\n"
>+"--transparent      Matches only if the socket's transparent option is set\n");
>+}
>+
>+static const struct option socket_opts_v1[] = {
>+	{ "transparent", 0, NULL, '1' },
>+	{ }
>+};

Try to use the C99 version.

>+
>+static int socket_mt_parse_v0(int c, char **argv, int invert,
>+			      unsigned int *flags, const void *entry,
>+			      struct xt_entry_match **match)
> {
> 	return 0;
> }

Similarly pointless.

>+static int socket_mt_parse_v1(int c, char **argv, int invert,
>+			      unsigned int *flags, const void *entry,
>+			      struct xt_entry_match **match)
>+{
>+	struct xt_socket_mtinfo1 *info = (void *) (*match)->data;
>+
>+	switch (c) {
>+	case '1':
>+		if (*flags)
>+			xtables_error(PARAMETER_PROBLEM,
>+				      "Can't specify multiple --transparent");

See existing code for xtables_param_act(..)

>+		info->flags |= XT_SOCKET_TRANSPARENT;
>+		*flags = 1;
>+		break;
>+	default:
>+		return 0;
>+	}
>+	return 1;
>+}
>+


> static void socket_mt_check(unsigned int flags)
> {
> }

This one is not needed either

>+	.name		= "socket",
>+	.revision	= 0,
>+	.version	= XTABLES_VERSION,
>+	.family		= NFPROTO_IPV4,
>+	.parse		= socket_mt_parse_v0,
>+	.final_check	= socket_mt_check,
>+	.help		= socket_mt_help_v0,
>+};
>+
>+static struct xtables_match socket_mt_reg_v1 = {
>+	.name		= "socket",
>+	.version	= XTABLES_VERSION,
>+	.revision	= 1,
>+	.family		= NFPROTO_IPV4,
>+	.size		= XT_ALIGN(sizeof(struct xt_socket_mtinfo1)),
>+	.userspacesize	= XT_ALIGN(sizeof(struct xt_socket_mtinfo1)),
>+	.parse		= socket_mt_parse_v1,
>+	.print		= socket_mt_print_v1,
>+	.save		= socket_mt_save_v1,
>+	.final_check	= socket_mt_check,
>+	.help		= socket_mt_help_v1,
>+	.extra_opts	= socket_opts_v1,

Actually, xt_socket should be NFPROTO_UNSPEC.

> };
>
> void _init(void)
> {
>-	xtables_register_match(&socket_mt_reg);
>+	xtables_register_match(&socket_mt_reg_v0);
>+	xtables_register_match(&socket_mt_reg_v1);

xtables_register_matches

> }
>diff --git a/extensions/libxt_socket.man b/extensions/libxt_socket.man
>index 50c8854..edc9d75 100644
>--- a/extensions/libxt_socket.man
>+++ b/extensions/libxt_socket.man
>@@ -1,2 +1,6 @@
> This matches if an open socket can be found by doing a socket lookup on the
>-packet.
>+packet which doesn\'t listen on the \'any\' IP address (0.0.0.0).
>+.TP
>+.BI "\-\-transparent"
>+Enables additional check, that the actual socket's transparent socket option
>+has to be set.

' does not need to be escaped, to my knowledge.

>diff --git a/include/linux/netfilter/xt_socket.h b/include/linux/netfilter/xt_socket.h
>new file mode 100644
>index 0000000..f6ba866
>--- /dev/null
>+++ b/include/linux/netfilter/xt_socket.h
>@@ -0,0 +1,12 @@
>+#ifndef _XT_SOCKET_H_match
>+#define _XT_SOCKET_H_match
>+
>+enum {
>+	XT_SOCKET_TRANSPARENT = 1 << 0,
>+};
>+
>+struct xt_socket_mtinfo1 {
>+	__u8 flags;
>+};

I'm sure Eric Dumazet will remind us that u32 is a better idea.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: socket match - add wildcard option [2/4]

[Nepenthes Development Team]

[-- Attachment #1: Type: text/plain, Size: 1138 bytes --]

Hi,

thanks for your reply.

>>+static const struct option socket_opts_v1[] = {
>>+      { "transparent", 0, NULL, '1' },
>>+      { }
>>+};
>
> Try to use the C99 version.

Not sure what C99 shall mean in this context,
> { .name = NULL }
?

> ' does not need to be escaped, to my knowledge.

I adopted the syntax from the original manpage, which escapes ', shall
I remove it altogether?

>>+struct xt_socket_mtinfo1 {
>>+      __u8 flags;
>>+};
>
> I'm sure Eric Dumazet will remind us that u32 is a better idea.

Adopted, as the kernel already uses __u8 for the socket match flags
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=blob;f=include/linux/netfilter/xt_socket.h;h=6f475b8ff34be81caa612bf1a947d3ad627290ab;hb=962400e8fd29981a7b166e463dd143b6ac6a3e76#l8
shall I change it to u32?

Attached is current version for iptables, I remembered being able to
invert a match would be great, therefore I added the invertible
implicit --exists option.

So now, this patch covers all changes, adding the options
[!] --exists
--transparent
--wildcard
to the socket match.


Markus

[-- Attachment #2: iptables-socket-match-exists-wildcard-transparent-options.diff --]
[-- Type: text/x-diff, Size: 4417 bytes --]

diff --git a/extensions/libxt_socket.c b/extensions/libxt_socket.c
index 1490473..03a4f8f 100644
--- a/extensions/libxt_socket.c
+++ b/extensions/libxt_socket.c
@@ -3,17 +3,106 @@
  *
  * Copyright (C) 2007 BalaBit IT Ltd.
  */
+#include <stdio.h>
+#include <getopt.h>
 #include <xtables.h>
+#include <linux/netfilter/xt_socket.h>
 
-static struct xtables_match socket_mt_reg = {
-	.name	       = "socket",
-	.version       = XTABLES_VERSION,
-	.family	       = NFPROTO_IPV4,
-	.size	       = XT_ALIGN(0),
-	.userspacesize = XT_ALIGN(0),
+static void socket_mt_help_v1(void)
+{
+	printf("socket match options:\n"
+"--transparent      Matches only if the socket's transparent option is set\n"
+"--wildcard         Match wildcard socket's too\n"
+"[!] --exists       Match if socket exists (optional), allows inversion\n"
+	);
+}
+
+static const struct option socket_opts_v1[] = {
+	{ "transparent", 0, NULL, '1' },
+	{ "wildcard",    0, NULL, '2' },
+	{ "exists",      0, NULL, '3' },
+	{ .name = NULL }
+};
+
+static int socket_mt_parse_v1(int c, char **argv, int invert,
+			      unsigned int *flags, const void *entry,
+			      struct xt_entry_match **match)
+{
+	struct xt_socket_mtinfo1 *info = (void *) (*match)->data;
+
+	switch (c) {
+	case '1':
+		xtables_param_act(XTF_ONLY_ONCE, "socket", "--transparent", *flags & XT_SOCKET_TRANSPARENT);
+		info->flags |= XT_SOCKET_TRANSPARENT;
+		*flags |= XT_SOCKET_TRANSPARENT;
+		break;
+	case '2':
+		xtables_param_act(XTF_ONLY_ONCE, "socket", "--wildcard", *flags & XT_SOCKET_WILDCARD);
+		info->flags |= XT_SOCKET_WILDCARD;
+		*flags |= XT_SOCKET_WILDCARD;
+		break;
+	case '3':
+		xtables_param_act(XTF_ONLY_ONCE, "socket", "--exists", *flags & XT_SOCKET_INVERT);
+		if (invert)
+			info->flags |= XT_SOCKET_INVERT;
+		*flags |= XT_SOCKET_INVERT;
+		break;
+	default:
+		return 0;
+	}
+	return 1;
+}
+
+static void socket_mt_print_v1(const void *ip,
+			       const struct xt_entry_match *match,
+			       int numeric)
+{
+	const struct xt_socket_mtinfo1 *info = (const void *)match->data;
+	printf("socket ");
+	if (info->flags & XT_SOCKET_TRANSPARENT)
+		printf("transparent ");
+	if (info->flags & XT_SOCKET_WILDCARD)
+		printf("wildcard ");
+	printf("%sexists ", (info->flags & XT_SOCKET_INVERT) ? "! " : "");
+}
+
+static void socket_mt_save_v1(const void *ip,
+			      const struct xt_entry_match *match)
+{
+	const struct xt_socket_mtinfo1 *info = (const void *)match->data;
+
+	if (info->flags & XT_SOCKET_TRANSPARENT)
+		printf("--transparent ");
+
+	if (info->flags & XT_SOCKET_WILDCARD)
+		printf("--wildcard ");
+
+	printf("%s--exists ", info->flags & XT_SOCKET_INVERT ? "! " : "");
+}
+
+static struct xtables_match socket_mt_reg[] = {
+	{
+		.name		= "socket",
+		.revision	= 0,
+		.version	= XTABLES_VERSION,
+		.family		= NFPROTO_UNSPEC,
+	},
+	{
+		.name		= "socket",
+		.version	= XTABLES_VERSION,
+		.revision	= 1,
+		.family		= NFPROTO_UNSPEC,
+		.size		= XT_ALIGN(sizeof(struct xt_socket_mtinfo1)),
+		.userspacesize	= XT_ALIGN(sizeof(struct xt_socket_mtinfo1)),
+		.parse		= socket_mt_parse_v1,
+		.print		= socket_mt_print_v1,
+		.save		= socket_mt_save_v1,
+		.help		= socket_mt_help_v1,
+		.extra_opts	= socket_opts_v1,
+	}
 };
 
 void _init(void)
 {
-	xtables_register_match(&socket_mt_reg);
+	xtables_register_matches(socket_mt_reg, ARRAY_SIZE(socket_mt_reg));
 }
diff --git a/extensions/libxt_socket.man b/extensions/libxt_socket.man
index 50c8854..4acd380 100644
--- a/extensions/libxt_socket.man
+++ b/extensions/libxt_socket.man
@@ -1,2 +1,12 @@
 This matches if an open socket can be found by doing a socket lookup on the
-packet.
+packet which doesn\'t listen on the \'any\' IP address (0.0.0.0).
+.TP
+.BI "\-\-transparent"
+Enables additional check, that the actual socket's transparent socket option
+has to be set.
+.BI "\-\-wildcard"
+Matches sockets listening on the \'any\' IP address (0.0.0.0) too.
+.BI "[!] \-\-exists"
+Optional, allows inversion of the match.
+
+
diff --git a/include/linux/netfilter/xt_socket.h b/include/linux/netfilter/xt_socket.h
new file mode 100644
index 0000000..6f492ed
--- /dev/null
+++ b/include/linux/netfilter/xt_socket.h
@@ -0,0 +1,14 @@
+#ifndef _XT_SOCKET_H_match
+#define _XT_SOCKET_H_match
+
+enum {
+	XT_SOCKET_TRANSPARENT = 1 << 0,
+	XT_SOCKET_WILDCARD = 1 << 1,
+	XT_SOCKET_INVERT = 1 << 2,
+};
+
+struct xt_socket_mtinfo1 {
+	__u8 flags;
+};
+
+#endif /* _XT_SOCKET_H_match */

Re: socket match - add wildcard option [2/4]

[Jan Engelhardt]

On Sunday 2010-07-25 21:10, Nepenthes Development Team wrote:
>Hi,
>
>thanks for your reply.
>
>>>+static const struct option socket_opts_v1[] = {
>>>+      { "transparent", 0, NULL, '1' },
>>>+      { }
>>>+};
>>
>> Try to use the C99 version.
>
>Not sure what C99 shall mean in this context,
>> { .name = NULL }

{.name = "transparent", .has_arg = false, .val = '1'},
{NULL},

>> ' does not need to be escaped, to my knowledge.
>
>I adopted the syntax from the original manpage, which escapes ', shall
>I remove it altogether?

Yes, given no other manpage has it. (And I think ' does not need any
escaping, unlike -, but someone feel free to educate me otherwise.)

>>>+struct xt_socket_mtinfo1 {
>>>+      __u8 flags;
>>>+};
>>
>> I'm sure Eric Dumazet will remind us that u32 is a better idea.
>
>Adopted, as the kernel already uses __u8 for the socket match flags
>http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=blob;f=include/linux/netfilter/xt_socket.h;h=6f475b8ff34be81caa612bf1a947d3ad627290ab;hb=962400e8fd29981a7b166e463dd143b6ac6a3e76#l8
>shall I change it to u32?

Pending Eric's comment, I would suggest to include a bump to
revision 2 of the existing kernel parts for revision 1 -
since there is no libxt_socket.c code for revision 1.

>Attached is current version for iptables, I remembered being able to
>invert a match would be great, therefore I added the invertible
>implicit --exists option.

if (invert)
   info->invert |= foo;

or alternatively

xtables_param_act(...NO_INVERT...) /* check existing code */

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: socket match - add wildcard option [2/4]

[Jan Engelhardt]

cc'ing Eric

On Sunday 2010-07-25 21:55, Jan Engelhardt wrote:

>
>On Sunday 2010-07-25 21:10, Nepenthes Development Team wrote:
>>Hi,
>>
>>thanks for your reply.
>>
>>>>+static const struct option socket_opts_v1[] = {
>>>>+      { "transparent", 0, NULL, '1' },
>>>>+      { }
>>>>+};
>>>
>>> Try to use the C99 version.
>>
>>Not sure what C99 shall mean in this context,
>>> { .name = NULL }
>
>{.name = "transparent", .has_arg = false, .val = '1'},
>{NULL},
>
>>> ' does not need to be escaped, to my knowledge.
>>
>>I adopted the syntax from the original manpage, which escapes ', shall
>>I remove it altogether?
>
>Yes, given no other manpage has it. (And I think ' does not need any
>escaping, unlike -, but someone feel free to educate me otherwise.)
>
>>>>+struct xt_socket_mtinfo1 {
>>>>+      __u8 flags;
>>>>+};
>>>
>>> I'm sure Eric Dumazet will remind us that u32 is a better idea.
>>
>>Adopted, as the kernel already uses __u8 for the socket match flags
>>http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=blob;f=include/linux/netfilter/xt_socket.h;h=6f475b8ff34be81caa612bf1a947d3ad627290ab;hb=962400e8fd29981a7b166e463dd143b6ac6a3e76#l8
>>shall I change it to u32?
>
>Pending Eric's comment, I would suggest to include a bump to
>revision 2 of the existing kernel parts for revision 1 -
>since there is no libxt_socket.c code for revision 1.
>
>>Attached is current version for iptables, I remembered being able to
>>invert a match would be great, therefore I added the invertible
>>implicit --exists option.
>
>if (invert)
>   info->invert |= foo;
>
>or alternatively
>
>xtables_param_act(...NO_INVERT...) /* check existing code */
>
>--
>To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
>the body of a message to majordomo@vger.kernel.org
>More majordomo info at  http://vger.kernel.org/majordomo-info.html
>

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: socket match - add wildcard option [2/4]

[Nepenthes Development Team]

[-- Attachment #1: Type: text/plain, Size: 318 bytes --]

Hi,

current version attached,
c99, \', info->invert, xtables_param_act(NO_INVERT) got incorporated/adjusted.

for the u8, may I use it for info->invert, or just create 2 u32 for
flags and invert, bump the revision number to 2?

As invert changes the mtinfo1 struct, changing the revision is required anyway.


Markus

[-- Attachment #2: iptables-socket-match-exists-wildcard-transparent-options-02.diff --]
[-- Type: text/x-diff, Size: 4629 bytes --]

diff --git a/extensions/libxt_socket.c b/extensions/libxt_socket.c
index 1490473..d921655 100644
--- a/extensions/libxt_socket.c
+++ b/extensions/libxt_socket.c
@@ -3,17 +3,108 @@
  *
  * Copyright (C) 2007 BalaBit IT Ltd.
  */
+#include <stdio.h>
+#include <getopt.h>
 #include <xtables.h>
+#include <linux/netfilter/xt_socket.h>
 
-static struct xtables_match socket_mt_reg = {
-	.name	       = "socket",
-	.version       = XTABLES_VERSION,
-	.family	       = NFPROTO_IPV4,
-	.size	       = XT_ALIGN(0),
-	.userspacesize = XT_ALIGN(0),
+static void socket_mt_help_v1(void)
+{
+	printf("socket match options:\n"
+"--transparent      Matches only if the socket's transparent option is set\n"
+"--wildcard         Match wildcard socket's too\n"
+"[!] --exists       Match if socket exists (optional), allows inversion\n"
+	);
+}
+
+static const struct option socket_opts_v1[] = {
+	{ .name = "transparent", .has_arg = false, .flag = NULL, .val = '1' },
+	{ .name = "wildcard",    .has_arg = false, .flag = NULL, .val = '2' },
+	{ .name = "exists",      .has_arg = false, .flag = NULL, .val = '3' },
+	{ }
+};
+
+static int socket_mt_parse_v1(int c, char **argv, int invert,
+			      unsigned int *flags, const void *entry,
+			      struct xt_entry_match **match)
+{
+	struct xt_socket_mtinfo1 *info = (void *) (*match)->data;
+
+	switch (c) {
+	case '1':
+		xtables_param_act(XTF_ONLY_ONCE, "socket", "--transparent", *flags & XT_SOCKET_TRANSPARENT);
+		xtables_param_act(XTF_NO_INVERT, "socket", "--transparent", invert);
+		info->flags |= XT_SOCKET_TRANSPARENT;
+		*flags |= XT_SOCKET_TRANSPARENT;
+		break;
+	case '2':
+		xtables_param_act(XTF_ONLY_ONCE, "socket", "--wildcard", *flags & XT_SOCKET_WILDCARD);
+		xtables_param_act(XTF_NO_INVERT, "socket", "--wildcard", invert);
+		info->flags |= XT_SOCKET_WILDCARD;
+		*flags |= XT_SOCKET_WILDCARD;
+		break;
+	case '3':
+		xtables_param_act(XTF_ONLY_ONCE, "socket", "--exists", *flags & XT_SOCKET_EXISTS);
+		if (invert)
+			info->invert = true;
+		*flags |= XT_SOCKET_EXISTS;
+		break;
+	default:
+		return 0;
+	}
+	return 1;
+}
+
+static void socket_mt_print_v1(const void *ip,
+			       const struct xt_entry_match *match,
+			       int numeric)
+{
+	const struct xt_socket_mtinfo1 *info = (const void *)match->data;
+	printf("socket ");
+	if (info->flags & XT_SOCKET_TRANSPARENT)
+		printf("transparent ");
+	if (info->flags & XT_SOCKET_WILDCARD)
+		printf("wildcard ");
+	printf("%sexists ", info->invert ? "! " : "");
+}
+
+static void socket_mt_save_v1(const void *ip,
+			      const struct xt_entry_match *match)
+{
+	const struct xt_socket_mtinfo1 *info = (const void *)match->data;
+
+	if (info->flags & XT_SOCKET_TRANSPARENT)
+		printf("--transparent ");
+
+	if (info->flags & XT_SOCKET_WILDCARD)
+		printf("--wildcard ");
+
+	printf("%s--exists ", info->invert ? "! " : "");
+}
+
+static struct xtables_match socket_mt_reg[] = {
+	{
+		.name		= "socket",
+		.revision	= 0,
+		.version	= XTABLES_VERSION,
+		.family		= NFPROTO_UNSPEC,
+	},
+	{
+		.name		= "socket",
+		.version	= XTABLES_VERSION,
+		.revision	= 1,
+		.family		= NFPROTO_UNSPEC,
+		.size		= XT_ALIGN(sizeof(struct xt_socket_mtinfo1)),
+		.userspacesize	= XT_ALIGN(sizeof(struct xt_socket_mtinfo1)),
+		.parse		= socket_mt_parse_v1,
+		.print		= socket_mt_print_v1,
+		.save		= socket_mt_save_v1,
+		.help		= socket_mt_help_v1,
+		.extra_opts	= socket_opts_v1,
+	}
 };
 
 void _init(void)
 {
-	xtables_register_match(&socket_mt_reg);
+	xtables_register_matches(socket_mt_reg, ARRAY_SIZE(socket_mt_reg));
 }
diff --git a/extensions/libxt_socket.man b/extensions/libxt_socket.man
index 50c8854..98244f5 100644
--- a/extensions/libxt_socket.man
+++ b/extensions/libxt_socket.man
@@ -1,2 +1,14 @@
 This matches if an open socket can be found by doing a socket lookup on the
-packet.
+packet which doesn't listen on the 'any' IP address (0.0.0.0).
+.TP
+.BI "\-\-transparent"
+Enables additional check, that the actual socket's transparent socket option
+has to be set.
+.TP
+.BI "\-\-wildcard"
+Matches sockets listening on the 'any' IP address (0.0.0.0) too.
+.TP
+.BI "[!] \-\-exists"
+Optional, allows inversion of the match.
+
+
diff --git a/include/linux/netfilter/xt_socket.h b/include/linux/netfilter/xt_socket.h
new file mode 100644
index 0000000..4ee6e7d
--- /dev/null
+++ b/include/linux/netfilter/xt_socket.h
@@ -0,0 +1,15 @@
+#ifndef _XT_SOCKET_H_match
+#define _XT_SOCKET_H_match
+
+enum {
+	XT_SOCKET_TRANSPARENT = 1 << 0,
+	XT_SOCKET_WILDCARD = 1 << 1,
+	XT_SOCKET_EXISTS = 1 << 2,
+};
+
+struct xt_socket_mtinfo1 {
+	__u8 invert;
+	__u8 flags;
+};
+
+#endif /* _XT_SOCKET_H_match */

Re: socket match - add wildcard option [2/4]

[Nepenthes Development Team]

Hi,

how to proceed with the new options for the iptables socket match?


Markus