1 /* Ugly hack to make state matching for ipv6 work before iptables-1.4.x is finished */ 2 #include <stdio.h> 3 #include <netdb.h> 4 #include <string.h> 5 #include <stdlib.h> 6 #include <getopt.h> 7 #include <ip6tables.h> 8 #include <linux/netfilter_ipv4/ip_conntrack.h> 9 #include <linux/netfilter_ipv4/ipt_state.h> 10 11 #ifndef IPT_STATE_UNTRACKED 12 #define IPT_STATE_UNTRACKED (1 << (IP_CT_NUMBER + 1)) 13 #endif 14 15 /* Function which prints out usage message. */ 16 static void 17 help(void) 18 { 19 printf( 20 "state v%s options:\n" 21 " [!] --state [INVALID|ESTABLISHED|NEW|RELATED|UNTRACKED][,...]\n" 22 " State(s) to match\n" 23 "\n", IPTABLES_VERSION); 24 } 25 26 static struct option opts[] = { 27 { "state", 1, 0, '1' }, 28 {0} 29 }; 30 31 static int 32 parse_state(const char *state, size_t strlen, struct ipt_state_info *sinfo) 33 { 34 if (strncasecmp(state, "INVALID", strlen) == 0) 35 sinfo->statemask |= IPT_STATE_INVALID; 36 else if (strncasecmp(state, "NEW", strlen) == 0) 37 sinfo->statemask |= IPT_STATE_BIT(IP_CT_NEW); 38 else if (strncasecmp(state, "ESTABLISHED", strlen) == 0) 39 sinfo->statemask |= IPT_STATE_BIT(IP_CT_ESTABLISHED); 40 else if (strncasecmp(state, "RELATED", strlen) == 0) 41 sinfo->statemask |= IPT_STATE_BIT(IP_CT_RELATED); 42 else if (strncasecmp(state, "UNTRACKED", strlen) == 0) 43 sinfo->statemask |= IPT_STATE_UNTRACKED; 44 else 45 return 0; 46 return 1; 47 } 48 49 static void 50 parse_states(const char *arg, struct ipt_state_info *sinfo) 51 { 52 const char *comma; 53 54 while ((comma = strchr(arg, ',')) != NULL) { 55 if (comma == arg || !parse_state(arg, comma-arg, sinfo)) 56 exit_error(PARAMETER_PROBLEM, "Bad state `%s'", arg); 57 arg = comma+1; 58 } 59 60 if (strlen(arg) == 0 || !parse_state(arg, strlen(arg), sinfo)) 61 exit_error(PARAMETER_PROBLEM, "Bad state `%s'", arg); 62 } 63 64 /* Function which parses command options; returns true if it 65 ate an option */ 66 static int 67 parse(int c, char **argv, int invert, unsigned int *flags, 68 const struct ip6t_entry *entry, 69 unsigned int *nfcache, 70 struct ip6t_entry_match **match) 71 { 72 struct ipt_state_info *sinfo = (struct ipt_state_info *)(*match)->data; 73 74 switch (c) { 75 case '1': 76 check_inverse(optarg, &invert, &optind, 0); 77 78 parse_states(argv[optind-1], sinfo); 79 if (invert) 80 sinfo->statemask = ~sinfo->statemask; 81 *flags = 1; 82 break; 83 84 default: 85 return 0; 86 } 87 88 return 1; 89 } 90 91 /* Final check; must have specified --state. */ 92 static void final_check(unsigned int flags) 93 { 94 if (!flags) 95 exit_error(PARAMETER_PROBLEM, "You must specify `--state'"); 96 } 97 98 static void print_state(unsigned int statemask) 99 { 100 const char *sep = ""; 101 102 if (statemask & IPT_STATE_INVALID) { 103 printf("%sINVALID", sep); 104 sep = ","; 105 } 106 if (statemask & IPT_STATE_BIT(IP_CT_NEW)) { 107 printf("%sNEW", sep); 108 sep = ","; 109 } 110 if (statemask & IPT_STATE_BIT(IP_CT_RELATED)) { 111 printf("%sRELATED", sep); 112 sep = ","; 113 } 114 if (statemask & IPT_STATE_BIT(IP_CT_ESTABLISHED)) { 115 printf("%sESTABLISHED", sep); 116 sep = ","; 117 } 118 if (statemask & IPT_STATE_UNTRACKED) { 119 printf("%sUNTRACKED", sep); 120 sep = ","; 121 } 122 printf(" "); 123 } 124 125 /* Prints out the matchinfo. */ 126 static void 127 print(const struct ip6t_ip6 *ip, 128 const struct ip6t_entry_match *match, 129 int numeric) 130 { 131 struct ipt_state_info *sinfo = (struct ipt_state_info *)match->data; 132 133 printf("state "); 134 print_state(sinfo->statemask); 135 } 136 137 /* Saves the matchinfo in parsable form to stdout. */ 138 static void save(const struct ip6t_ip6 *ip, const struct ip6t_entry_match *match) 139 { 140 struct ipt_state_info *sinfo = (struct ipt_state_info *)match->data; 141 142 printf("--state "); 143 print_state(sinfo->statemask); 144 } 145 146 static struct ip6tables_match state = { 147 .next = NULL, 148 .name = "state", 149 .version = IPTABLES_VERSION, 150 .size = IP6T_ALIGN(sizeof(struct ipt_state_info)), 151 .userspacesize = IP6T_ALIGN(sizeof(struct ipt_state_info)), 152 .help = &help, 153 .parse = &parse, 154 .final_check = &final_check, 155 .print = &print, 156 .save = &save, 157 .extra_opts = opts 158 }; 159 160 void _init(void) 161 { 162 register_match6(&state); 163 } 164