--- /dev/null
+/*
+ * accounting match helper (libipt_account.c)
+ * (C) 2003,2004 by Piotr Gasid³o (quaker@barbara.eu.org)
+ *
+ * Version: 0.1.6
+ *
+ * This software is distributed under the terms of GNU GPL
+ */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <iptables.h>
+#include <string.h>
+#include <getopt.h>
+
+#include <linux/netfilter_ipv4/ipt_account.h>
+
+#ifndef HIPQUAD
+#define HIPQUAD(addr) \
+ ((unsigned char *)&addr)[3], \
+ ((unsigned char *)&addr)[2], \
+ ((unsigned char *)&addr)[1], \
+ ((unsigned char *)&addr)[0]
+#endif
+
+static void help(void) {
+ printf(
+ "account v%s options:\n"
+ "--aaddr network/netmask\n"
+ " defines network/netmask for which make statistics.\n"
+ "--aname name\n"
+ " defines name of list where statistics will be kept. If no is\n"
+ " specified DEFAULT will be used.\n"
+ "--ashort\n"
+ " table will colect only short statistics (only total counters\n"
+ " without splitting it into protocols.\n"
+ ,
+ IPTABLES_VERSION);
+};
+
+static struct option opts[] = {
+ { .name = "aaddr", .has_arg = 1, .flag = NULL, .val = 201 },
+ { .name = "aname", .has_arg = 1, .flag = NULL, .val = 202 },
+ { .name = "ashort", .has_arg = 0, .flag = NULL, .val = 203 },
+ { .name = 0, .has_arg = 0, .flag = 0, .val = 0 }
+};
+
+/* Helper functions for parse_network */
+int parseip(const char *parameter, u_int32_t *ip) {
+
+ char buffer[16], *bufferptr, *dot;
+ unsigned int i, shift, part;
+
+ if (strlen(parameter) > 15)
+ return 0;
+
+ strncpy(buffer, parameter, 15);
+ buffer[15] = 0;
+
+ bufferptr = buffer;
+
+ for (i = 0, shift = 24, *ip = 0; i < 3; i++, shift -= 8) {
+ /* no dot */
+ if ((dot = strchr(bufferptr, '.')) == NULL)
+ return 0;
+ /* not a number */
+ if ((part = strtol(bufferptr, (char**)NULL, 10)) < 0)
+ return 0;
+ /* to big number */
+ if (part > 255)
+ return 0;
+ *ip |= part << shift;
+ bufferptr = dot + 1;
+ }
+ /* not a number */
+ if ((part = strtol(bufferptr, (char**)NULL, 10)) < 0)
+ return 0;
+ /* to big number */
+ if (part > 255)
+ return 0;
+ *ip |= part;
+ return 1;
+}
+
+static void parsenetwork(const char *parameter, u_int32_t *network) {
+ if (!parseip(parameter, network))
+ exit_error(PARAMETER_PROBLEM, "account: wrong ip in network");
+}
+
+static void parsenetmaskasbits(const char *parameter, u_int32_t *netmask) {
+
+ u_int32_t bits;
+
+ if ((bits = strtol(parameter, (char **)NULL, 10)) < 0 || bits > 32)
+ exit_error(PARAMETER_PROBLEM, "account: wrong netmask");
+
+ *netmask = 0xffffffff << (32 - bits);
+}
+
+static void parsenetmaskasip(const char *parameter, u_int32_t *netmask) {
+ if (!parseip(parameter, netmask))
+ exit_error(PARAMETER_PROBLEM, "account: wrong ip in netmask");
+}
+
+static void parsenetmask(const char *parameter, u_int32_t *netmask)
+{
+ if (strchr(parameter, '.') != NULL)
+ parsenetmaskasip(parameter, netmask);
+ else
+ parsenetmaskasbits(parameter, netmask);
+}
+
+static void parsenetworkandnetmask(const char *parameter, u_int32_t *network, u_int32_t *netmask)
+{
+
+ char buffer[32], *slash;
+
+ if (strlen(parameter) > 31)
+ /* text is to long, even for 255.255.255.255/255.255.255.255 */
+ exit_error(PARAMETER_PROBLEM, "account: wrong network/netmask");
+
+ strncpy(buffer, parameter, 31);
+ buffer[31] = 0;
+
+ /* check whether netmask is given */
+ if ((slash = strchr(buffer, '/')) != NULL) {
+ parsenetmask(slash + 1, netmask);
+ *slash = 0;
+ } else
+ *netmask = 0xffffffff;
+ parsenetwork(buffer, network);
+
+ if ((*network & *netmask) != *network)
+ exit_error(PARAMETER_PROBLEM, "account: wrong network/netmask");
+}
+
+
+/* Function gets network & netmask from argument after --aaddr */
+static void parse_network(const char *parameter, struct t_ipt_account_info *info) {
+
+ parsenetworkandnetmask(parameter, &info->network, &info->netmask);
+
+}
+
+/* validate netmask */
+inline int valid_netmask(u_int32_t netmask) {
+ while (netmask & 0x80000000)
+ netmask <<= 1;
+ if (netmask != 0)
+ return 0;
+ return 1;
+}
+
+/* validate network/netmask pair */
+inline int valid_network_and_netmask(struct t_ipt_account_info *info) {
+ if (!valid_netmask(info->netmask))
+ return 0;
+ if ((info->network & info->netmask) != info->network)
+ return 0;
+ return 1;
+}
+
+
+
+/* Function initializes match */
+static void init(struct ipt_entry_match *match,
+ unsigned int *nfcache) {
+
+ struct t_ipt_account_info *info = (struct t_ipt_account_info *)(match)->data;
+
+
+ /* set default table name to DEFAULT */
+ strncpy(info->name, "DEFAULT", IPT_ACCOUNT_NAME_LEN);
+ info->shortlisting = 0;
+
+}
+
+/* Function parses match's arguments */
+static int parse(int c, char **argv,
+ int invert,
+ unsigned int *flags,
+ const struct ipt_entry *entry,
+ unsigned int *nfcache,
+ struct ipt_entry_match **match) {
+
+ struct t_ipt_account_info *info = (struct t_ipt_account_info *)(*match)->data;
+
+ switch (c) {
+
+ /* --aaddr */
+ case 201:
+ parse_network(optarg, info);
+ if (!valid_network_and_netmask(info))
+ exit_error(PARAMETER_PROBLEM, "account: wrong network/netmask");
+ *flags = 1;
+ break;
+
+ /* --aname */
+ case 202:
+ if (strlen(optarg) < IPT_ACCOUNT_NAME_LEN)
+ strncpy(info->name, optarg, IPT_ACCOUNT_NAME_LEN);
+ else
+ exit_error(PARAMETER_PROBLEM, "account: Too long table name");
+ break;
+ /* --ashort */
+ case 203:
+ info->shortlisting = 1;
+ break;
+ default:
+ return 0;
+ }
+ return 1;
+}
+
+/* Final check whether network/netmask was specified */
+static void final_check(unsigned int flags) {
+ if (!flags)
+ exit_error(PARAMETER_PROBLEM, "account: You need specify '--aaddr' parameter");
+}
+
+/* Function used for printing rule with account match for iptables -L */
+static void print(const struct ipt_ip *ip,
+ const struct ipt_entry_match *match,
+ int numeric) {
+
+ struct t_ipt_account_info *info = (struct t_ipt_account_info *)match->data;
+
+ printf("account: ");
+ printf("network/netmask: ");
+ printf("%u.%u.%u.%u/%u.%u.%u.%u ",
+ HIPQUAD(info->network),
+ HIPQUAD(info->netmask)
+ );
+
+ printf("name: %s ", info->name);
+ if (info->shortlisting)
+ printf("short-listing ");
+}
+
+/* Function used for saving rule containing account match */
+static void save(const struct ipt_ip *ip,
+ const struct ipt_entry_match *match) {
+
+ struct t_ipt_account_info *info = (struct t_ipt_account_info *)match->data;
+
+ printf("--aaddr ");
+ printf("%u.%u.%u.%u/%u.%u.%u.%u ",
+ HIPQUAD(info->network),
+ HIPQUAD(info->netmask)
+ );
+
+ printf("--aname %s ", info->name);
+ if (info->shortlisting)
+ printf("--ashort ");
+}
+
+static struct iptables_match account = {
+ .next = NULL,
+ .name = "account",
+ .version = IPTABLES_VERSION,
+ .size = IPT_ALIGN(sizeof(struct t_ipt_account_info)),
+ .userspacesize = IPT_ALIGN(sizeof(struct t_ipt_account_info)),
+ .help = &help,
+ .init = &init,
+ .parse = &parse,
+ .final_check = &final_check,
+ .print = &print,
+ .save = &save,
+ .extra_opts = opts
+};
+
+/* Function which registers match */
+void _init(void)
+{
+ register_match(&account);
+}
+
git://git.onelab.eu / iptables.git / blobdiff