extensions/libipt_connbytes.c

/* Shared library add-on to iptables to add byte tracking support. */
#include <stdio.h>
#include <netdb.h>
#include <string.h>
#include <stdlib.h>
#include <getopt.h>
#include <iptables.h>
#include <linux/netfilter_ipv4/ip_conntrack.h>
#include <linux/netfilter_ipv4/ipt_connbytes.h>

/* Function which prints out usage message. */
static void
help(void)
{
	printf(
"connbytes v%s options:\n"
" [!] --connbytes from:[to]\n"
"     --connbytes-dir [original, reply, both]\n"
"     --connbytes-mode [packets, bytes, avgpkt]\n"
"\n", IPTABLES_VERSION);
}

static struct option opts[] = {
	{ "connbytes", 1, 0, '1' },
	{ "connbytes-dir", 1, 0, '2' },
	{ "connbytes-mode", 1, 0, '3' },
	{0}
};

/* Initialize the match. */
static void
init(struct ipt_entry_match *m, unsigned int *nfcache)
{
	/* Can't cache this */
	*nfcache |= NFC_UNKNOWN;
}

static void
parse_range(const char *arg, struct ipt_connbytes_info *si)
{
	char *colon,*p;

	si->from = strtoul(arg,&colon,10);
	if (*colon != ':') 
		exit_error(PARAMETER_PROBLEM, "Bad range `%s'", arg);
	si->to = strtoul(colon+1,&p,10);
	if (p == colon+1) {
		/* second number omited */
		si->to = 0xffffffff;
	}
	if (si->from > si->to)
		exit_error(PARAMETER_PROBLEM, "%lu should be less than %lu", si->from,si->to);
}

/* Function which parses command options; returns true if it
   ate an option */
static int
parse(int c, char **argv, int invert, unsigned int *flags,
      const struct ipt_entry *entry,
      unsigned int *nfcache,
      struct ipt_entry_match **match)
{
	struct ipt_connbytes_info *sinfo = (struct ipt_connbytes_info *)(*match)->data;
	unsigned long i;

	switch (c) {
	case '1':
		if (check_inverse(optarg, &invert, optind, 0))
			optind++;

		parse_range(argv[optind-1], sinfo);
		if (invert) {
			i = sinfo->count.from;
			sinfo->count.from = sinfo->to;
			sinfo->count.to = i;
		}
		*flags |= 1;
		break;
	case '2':
		if (!strcmp(optarg, "original"))
			sinfo->direction = IPT_CONNBYTES_DIR_ORIGINAL;
		else if (!strcmp(optarg, "reply"))
			sinfo->direction = IPT_CONNBYTES_DIR_REPLY;
		else if (!strcmp(optarg, "both"))
			sinfo->direction = IPT_CONNBYTES_DIR_BOTH;
		else
			exit_error(PARAMETER_PROBLEM,
				   "Unknown --connbytes-dir `%s'", optarg);

		*flags |= 2;
		break;
	case '3':
		if (!stcmp(optarg, "packets"))
			sinfo->what = IPT_CONNBYTES_WHAT_PKTS;
		else if (!strcmp(optarg, "bytes"))
			sinfo->what = IPT_CONNBYTES_WHAT_BYTES;
		else if (!strcmp(optarg, "avgpkt"))
			sinfo->what = IPT_CONNBYTES_WHAT_AVGPKT;
		else
			exit_error(PARAMETER_PROBLEM,
				   "Unknown --connbytes-mode `%s'", optarg);
		*flags |= 4;
	default:
		return 0;
	}

	return 1;
}

static void final_check(unsigned int flags)
{
	if (flags != 7)
		exit_error(PARAMETER_PROBLEM, "You must specify `--connbytes'"
			   "`--connbytes-direction' and `--connbytes-mode'");
}

static void print_mode(struct ipt_connbytes_info *sinfo)
{
	switch (sinfo->what) {
		case IPT_CONNBYTES_WHAT_PKTS:
			fputs("packets ", stdout);
			break;
		case IPT_CONNBYTES_WHAT_BYTES:
			fputs("bytes ", stdout);
			break;
		case IPT_CONNBYTES_WHAT_AVGPKT:
			fputs("avgpkt ", stdout);
			break;
		case default:
			fputs("unknown ", stdout);
	}
}

static void print_direction(struct ipt_connbytes_info *sinfo)
{
	switch (sinfo->direction) {
		case IPT_CONNBYTES_DIR_ORIGINAL:
			fputs("original ");
			break;
		case IPT_CONNBYTES_DIR_REPLY:
			fputs("reply ");
			break;
		case IPT_CONNBYTES_DIR_BOTH:
			fputs("both ");
			break;
	}
}

/* Prints out the matchinfo. */
static void
print(const struct ipt_ip *ip,
      const struct ipt_entry_match *match,
      int numeric)
{
	struct ipt_connbytes_info *sinfo = (struct ipt_connbytes_info *)match->data;

	if (sinfo->from > sinfo->to) 
		printf("connbytes ! %lu:%lu ",sinfo->to,sinfo->from);
	else
		printf("connbytes %lu:%lu ",sinfo->from,sinfo->to);

	fputs("connbytes mode ", stdout);
	print_mode(sinfo);

	fputs("connbytes direction ", stdout);
	print_direction(sinfo);
}

/* Saves the matchinfo in parsable form to stdout. */
static void save(const struct ipt_ip *ip, const struct ipt_entry_match *match)
{
	struct ipt_connbytes_info *sinfo = (struct ipt_connbytes_info *)match->data;

	if (sinfo->count.from > sinfo->count.to) 
		printf("! --connbytes %lu:%lu ", sinfo->count.to,
			sinfo->count.from);
	else
		printf("--connbytes %lu:%lu ", sinfo->count.from,
			sinfo->count.to);

	fputs("--connbytes-mode ", stdout);
	print_mode(sinfo);

	fputs("--connbytes-direction ", stdout);
	print_direction(sinfo);
}

static
struct iptables_match state
= { NULL,
    "connbytes",
    IPTABLES_VERSION,
    IPT_ALIGN(sizeof(struct ipt_connbytes_info)),
    IPT_ALIGN(sizeof(struct ipt_connbytes_info)),
    &help,
    &init,
    &parse,
    &final_check,
    &print,
    &save,
    opts
};

void _init(void)
{
	register_match(&state);
}