1 /* Shared library add-on to iptables to add CONNMARK target support.
3 * (C) 2002,2004 MARA Systems AB <http://www.marasystems.com>
4 * by Henrik Nordstrom <hno@marasystems.com>
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
28 #include <linux/netfilter_ipv4/ip_tables.h>
29 #include "../include/linux/netfilter_ipv4/ipt_CONNMARK.h"
33 struct ipt_entry_target t;
34 struct ipt_connmark_target_info mark;
38 /* Function which prints out usage message. */
43 "CONNMARK target v%s options:\n"
44 " --set-mark value[/mask] Set conntrack mark value\n"
45 " --save-mark [--mask mask] Save the packet nfmark in the connection\n"
46 " --restore-mark [--mask mask] Restore saved nfmark value\n"
51 static struct option opts[] = {
52 { "set-mark", 1, 0, '1' },
53 { "save-mark", 0, 0, '2' },
54 { "restore-mark", 0, 0, '3' },
55 { "mask", 1, 0, '4' },
59 /* Initialize the target. */
61 init(struct ipt_entry_target *t, unsigned int *nfcache)
65 /* Function which parses command options; returns true if it
68 parse(int c, char **argv, int invert, unsigned int *flags,
69 const struct ipt_entry *entry,
70 struct ipt_entry_target **target)
72 struct ipt_connmark_target_info *markinfo
73 = (struct ipt_connmark_target_info *)(*target)->data;
75 #ifdef KERNEL_64_USERSPACE_32
76 markinfo->mask = ~0ULL;
78 markinfo->mask = ~0UL;
84 markinfo->mode = IPT_CONNMARK_SET;
85 #ifdef KERNEL_64_USERSPACE_32
86 markinfo->mark = strtoull(optarg, &end, 0);
87 if (*end == '/' && end[1] != '\0')
88 markinfo->mask = strtoull(end+1, &end, 0);
90 markinfo->mark = strtoul(optarg, &end, 0);
91 if (*end == '/' && end[1] != '\0')
92 markinfo->mask = strtoul(end+1, &end, 0);
94 if (*end != '\0' || end == optarg)
95 exit_error(PARAMETER_PROBLEM, "Bad MARK value `%s'", optarg);
97 exit_error(PARAMETER_PROBLEM,
98 "CONNMARK target: Can't specify --set-mark twice");
102 markinfo->mode = IPT_CONNMARK_SAVE;
104 exit_error(PARAMETER_PROBLEM,
105 "CONNMARK target: Can't specify --save-mark twice");
109 markinfo->mode = IPT_CONNMARK_RESTORE;
111 exit_error(PARAMETER_PROBLEM,
112 "CONNMARK target: Can't specify --restore-mark twice");
117 exit_error(PARAMETER_PROBLEM,
118 "CONNMARK target: Can't specify --mask without a operation");
119 #ifdef KERNEL_64_USERSPACE_32
120 markinfo->mask = strtoull(optarg, &end, 0);
122 markinfo->mask = strtoul(optarg, &end, 0);
124 if (*end != '\0' || end == optarg)
125 exit_error(PARAMETER_PROBLEM, "Bad MASK value `%s'", optarg);
135 final_check(unsigned int flags)
138 exit_error(PARAMETER_PROBLEM,
139 "CONNMARK target: No operation specified");
142 #ifdef KERNEL_64_USERSPACE_32
144 print_mark(unsigned long long mark)
146 printf("0x%llx", mark);
150 print_mask(const char *text, unsigned long long mask)
153 printf("%s0x%llx", text, mask);
159 print_mark(unsigned long mark)
161 printf("0x%lx", mark);
165 print_mask(const char *text, unsigned long mask)
168 printf("%s0x%lx", text, mask);
173 /* Prints out the target info. */
175 print(const struct ipt_ip *ip,
176 const struct ipt_entry_target *target,
179 const struct ipt_connmark_target_info *markinfo =
180 (const struct ipt_connmark_target_info *)target->data;
181 switch (markinfo->mode) {
182 case IPT_CONNMARK_SET:
183 printf("CONNMARK set ");
184 print_mark(markinfo->mark);
185 print_mask("/", markinfo->mask);
188 case IPT_CONNMARK_SAVE:
189 printf("CONNMARK save ");
190 print_mask("mask ", markinfo->mask);
193 case IPT_CONNMARK_RESTORE:
194 printf("CONNMARK restore ");
195 print_mask("mask ", markinfo->mask);
198 printf("ERROR: UNKNOWN CONNMARK MODE ");
203 /* Saves the target into in parsable form to stdout. */
205 save(const struct ipt_ip *ip, const struct ipt_entry_target *target)
207 const struct ipt_connmark_target_info *markinfo =
208 (const struct ipt_connmark_target_info *)target->data;
210 switch (markinfo->mode) {
211 case IPT_CONNMARK_SET:
212 printf("--set-mark ");
213 print_mark(markinfo->mark);
214 print_mask("/", markinfo->mask);
217 case IPT_CONNMARK_SAVE:
218 printf("--save-mark ");
219 print_mask("--mask ", markinfo->mask);
221 case IPT_CONNMARK_RESTORE:
222 printf("--restore-mark ");
223 print_mask("--mask ", markinfo->mask);
226 printf("ERROR: UNKNOWN CONNMARK MODE ");
231 static struct iptables_target connmark_target = {
233 .version = IPTABLES_VERSION,
234 .size = IPT_ALIGN(sizeof(struct ipt_connmark_target_info)),
235 .userspacesize = IPT_ALIGN(sizeof(struct ipt_connmark_target_info)),
239 .final_check = &final_check,
247 register_target(&connmark_target);