Jan Engelhardt | 32b8e61 | 2010-07-23 21:16:14 +0200 | [diff] [blame] | 1 | #include <stdbool.h> |
Jan Engelhardt | d441ad6 | 2011-05-06 17:45:12 +0200 | [diff] [blame] | 2 | #include <stdint.h> |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 3 | #include <stdio.h> |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 4 | #include <string.h> |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 5 | #include <netdb.h> |
Jan Engelhardt | 5d9678a | 2008-11-20 10:15:35 +0100 | [diff] [blame] | 6 | #include <xtables.h> |
Jan Engelhardt | cd30054 | 2009-05-31 22:43:12 +0200 | [diff] [blame] | 7 | #include <linux/netfilter/xt_policy.h> |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 8 | |
Jan Engelhardt | d441ad6 | 2011-05-06 17:45:12 +0200 | [diff] [blame] | 9 | enum { |
| 10 | O_DIRECTION = 0, |
| 11 | O_POLICY, |
| 12 | O_STRICT, |
| 13 | O_REQID, |
| 14 | O_SPI, |
| 15 | O_PROTO, |
| 16 | O_MODE, |
| 17 | O_TUNNELSRC, |
| 18 | O_TUNNELDST, |
Jan Engelhardt | 1539293 | 2011-05-12 12:46:40 +0200 | [diff] [blame] | 19 | O_NEXT, |
| 20 | F_STRICT = 1 << O_STRICT, |
Jan Engelhardt | d441ad6 | 2011-05-06 17:45:12 +0200 | [diff] [blame] | 21 | }; |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 22 | |
Jan Engelhardt | 59d1640 | 2007-10-04 16:28:39 +0000 | [diff] [blame] | 23 | static void policy_help(void) |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 24 | { |
| 25 | printf( |
Jan Engelhardt | 8b7c64d | 2008-04-15 11:48:25 +0200 | [diff] [blame] | 26 | "policy match options:\n" |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 27 | " --dir in|out match policy applied during decapsulation/\n" |
| 28 | " policy to be applied during encapsulation\n" |
| 29 | " --pol none|ipsec match policy\n" |
| 30 | " --strict match entire policy instead of single element\n" |
| 31 | " at any position\n" |
Jan Engelhardt | 1539293 | 2011-05-12 12:46:40 +0200 | [diff] [blame] | 32 | "These options may be used repeatedly, to describe policy elements:\n" |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 33 | "[!] --reqid reqid match reqid\n" |
| 34 | "[!] --spi spi match SPI\n" |
| 35 | "[!] --proto proto match protocol (ah/esp/ipcomp)\n" |
| 36 | "[!] --mode mode match mode (transport/tunnel)\n" |
| 37 | "[!] --tunnel-src addr/mask match tunnel source\n" |
| 38 | "[!] --tunnel-dst addr/mask match tunnel destination\n" |
Jan Engelhardt | 8b7c64d | 2008-04-15 11:48:25 +0200 | [diff] [blame] | 39 | " --next begin next element in policy\n"); |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 40 | } |
| 41 | |
Jan Engelhardt | d441ad6 | 2011-05-06 17:45:12 +0200 | [diff] [blame] | 42 | static const struct xt_option_entry policy_opts[] = { |
| 43 | {.name = "dir", .id = O_DIRECTION, .type = XTTYPE_STRING, |
| 44 | .flags = XTOPT_INVERT}, |
| 45 | {.name = "pol", .id = O_POLICY, .type = XTTYPE_STRING}, |
| 46 | {.name = "strict", .id = O_STRICT, .type = XTTYPE_NONE}, |
Jan Engelhardt | 1539293 | 2011-05-12 12:46:40 +0200 | [diff] [blame] | 47 | {.name = "reqid", .id = O_REQID, .type = XTTYPE_UINT32, |
| 48 | .flags = XTOPT_MULTI | XTOPT_INVERT}, |
| 49 | {.name = "spi", .id = O_SPI, .type = XTTYPE_UINT32, |
| 50 | .flags = XTOPT_MULTI | XTOPT_INVERT}, |
| 51 | {.name = "tunnel-src", .id = O_TUNNELSRC, .type = XTTYPE_HOSTMASK, |
| 52 | .flags = XTOPT_MULTI | XTOPT_INVERT}, |
| 53 | {.name = "tunnel-dst", .id = O_TUNNELDST, .type = XTTYPE_HOSTMASK, |
| 54 | .flags = XTOPT_MULTI | XTOPT_INVERT}, |
Jan Engelhardt | cdc8e0b | 2011-05-12 13:59:38 +0200 | [diff] [blame] | 55 | {.name = "proto", .id = O_PROTO, .type = XTTYPE_PROTOCOL, |
Jan Engelhardt | 1539293 | 2011-05-12 12:46:40 +0200 | [diff] [blame] | 56 | .flags = XTOPT_MULTI | XTOPT_INVERT}, |
| 57 | {.name = "mode", .id = O_MODE, .type = XTTYPE_STRING, |
| 58 | .flags = XTOPT_MULTI | XTOPT_INVERT}, |
| 59 | {.name = "next", .id = O_NEXT, .type = XTTYPE_NONE, |
| 60 | .flags = XTOPT_MULTI, .also = F_STRICT}, |
Jan Engelhardt | d441ad6 | 2011-05-06 17:45:12 +0200 | [diff] [blame] | 61 | XTOPT_TABLEEND, |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 62 | }; |
| 63 | |
Jan Engelhardt | d441ad6 | 2011-05-06 17:45:12 +0200 | [diff] [blame] | 64 | static int parse_direction(const char *s) |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 65 | { |
| 66 | if (strcmp(s, "in") == 0) |
Jan Engelhardt | cd30054 | 2009-05-31 22:43:12 +0200 | [diff] [blame] | 67 | return XT_POLICY_MATCH_IN; |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 68 | if (strcmp(s, "out") == 0) |
Jan Engelhardt | cd30054 | 2009-05-31 22:43:12 +0200 | [diff] [blame] | 69 | return XT_POLICY_MATCH_OUT; |
Jan Engelhardt | 1829ed4 | 2009-02-21 03:29:44 +0100 | [diff] [blame] | 70 | xtables_error(PARAMETER_PROBLEM, "policy_match: invalid dir \"%s\"", s); |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 71 | } |
| 72 | |
Jan Engelhardt | d441ad6 | 2011-05-06 17:45:12 +0200 | [diff] [blame] | 73 | static int parse_policy(const char *s) |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 74 | { |
| 75 | if (strcmp(s, "none") == 0) |
Jan Engelhardt | cd30054 | 2009-05-31 22:43:12 +0200 | [diff] [blame] | 76 | return XT_POLICY_MATCH_NONE; |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 77 | if (strcmp(s, "ipsec") == 0) |
| 78 | return 0; |
Jan Engelhardt | 1829ed4 | 2009-02-21 03:29:44 +0100 | [diff] [blame] | 79 | xtables_error(PARAMETER_PROBLEM, "policy match: invalid policy \"%s\"", s); |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 80 | } |
| 81 | |
Jan Engelhardt | d441ad6 | 2011-05-06 17:45:12 +0200 | [diff] [blame] | 82 | static int parse_mode(const char *s) |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 83 | { |
| 84 | if (strcmp(s, "transport") == 0) |
Jan Engelhardt | cd30054 | 2009-05-31 22:43:12 +0200 | [diff] [blame] | 85 | return XT_POLICY_MODE_TRANSPORT; |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 86 | if (strcmp(s, "tunnel") == 0) |
Jan Engelhardt | cd30054 | 2009-05-31 22:43:12 +0200 | [diff] [blame] | 87 | return XT_POLICY_MODE_TUNNEL; |
Jan Engelhardt | 1829ed4 | 2009-02-21 03:29:44 +0100 | [diff] [blame] | 88 | xtables_error(PARAMETER_PROBLEM, "policy match: invalid mode \"%s\"", s); |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 89 | } |
| 90 | |
Jan Engelhardt | d441ad6 | 2011-05-06 17:45:12 +0200 | [diff] [blame] | 91 | static void policy_parse(struct xt_option_call *cb) |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 92 | { |
Jan Engelhardt | d441ad6 | 2011-05-06 17:45:12 +0200 | [diff] [blame] | 93 | struct xt_policy_info *info = cb->data; |
Jan Engelhardt | cd30054 | 2009-05-31 22:43:12 +0200 | [diff] [blame] | 94 | struct xt_policy_elem *e = &info->pol[info->len]; |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 95 | |
Jan Engelhardt | d441ad6 | 2011-05-06 17:45:12 +0200 | [diff] [blame] | 96 | xtables_option_parse(cb); |
| 97 | switch (cb->entry->id) { |
| 98 | case O_DIRECTION: |
| 99 | info->flags |= parse_direction(cb->arg); |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 100 | break; |
Jan Engelhardt | d441ad6 | 2011-05-06 17:45:12 +0200 | [diff] [blame] | 101 | case O_POLICY: |
| 102 | info->flags |= parse_policy(cb->arg); |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 103 | break; |
Jan Engelhardt | d441ad6 | 2011-05-06 17:45:12 +0200 | [diff] [blame] | 104 | case O_STRICT: |
Jan Engelhardt | cd30054 | 2009-05-31 22:43:12 +0200 | [diff] [blame] | 105 | info->flags |= XT_POLICY_MATCH_STRICT; |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 106 | break; |
Jan Engelhardt | d441ad6 | 2011-05-06 17:45:12 +0200 | [diff] [blame] | 107 | case O_REQID: |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 108 | if (e->match.reqid) |
Jan Engelhardt | 1829ed4 | 2009-02-21 03:29:44 +0100 | [diff] [blame] | 109 | xtables_error(PARAMETER_PROBLEM, |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 110 | "policy match: double --reqid option"); |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 111 | e->match.reqid = 1; |
Jan Engelhardt | d441ad6 | 2011-05-06 17:45:12 +0200 | [diff] [blame] | 112 | e->invert.reqid = cb->invert; |
| 113 | e->reqid = cb->val.u32; |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 114 | break; |
Jan Engelhardt | d441ad6 | 2011-05-06 17:45:12 +0200 | [diff] [blame] | 115 | case O_SPI: |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 116 | if (e->match.spi) |
Jan Engelhardt | 1829ed4 | 2009-02-21 03:29:44 +0100 | [diff] [blame] | 117 | xtables_error(PARAMETER_PROBLEM, |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 118 | "policy match: double --spi option"); |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 119 | e->match.spi = 1; |
Jan Engelhardt | d441ad6 | 2011-05-06 17:45:12 +0200 | [diff] [blame] | 120 | e->invert.spi = cb->invert; |
| 121 | e->spi = cb->val.u32; |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 122 | break; |
Jan Engelhardt | d441ad6 | 2011-05-06 17:45:12 +0200 | [diff] [blame] | 123 | case O_TUNNELSRC: |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 124 | if (e->match.saddr) |
Jan Engelhardt | 1829ed4 | 2009-02-21 03:29:44 +0100 | [diff] [blame] | 125 | xtables_error(PARAMETER_PROBLEM, |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 126 | "policy match: double --tunnel-src option"); |
| 127 | |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 128 | e->match.saddr = 1; |
Jan Engelhardt | d441ad6 | 2011-05-06 17:45:12 +0200 | [diff] [blame] | 129 | e->invert.saddr = cb->invert; |
| 130 | memcpy(&e->saddr, &cb->val.haddr, sizeof(cb->val.haddr)); |
| 131 | memcpy(&e->smask, &cb->val.hmask, sizeof(cb->val.hmask)); |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 132 | break; |
Jan Engelhardt | d441ad6 | 2011-05-06 17:45:12 +0200 | [diff] [blame] | 133 | case O_TUNNELDST: |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 134 | if (e->match.daddr) |
Jan Engelhardt | 1829ed4 | 2009-02-21 03:29:44 +0100 | [diff] [blame] | 135 | xtables_error(PARAMETER_PROBLEM, |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 136 | "policy match: double --tunnel-dst option"); |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 137 | e->match.daddr = 1; |
Jan Engelhardt | d441ad6 | 2011-05-06 17:45:12 +0200 | [diff] [blame] | 138 | e->invert.daddr = cb->invert; |
| 139 | memcpy(&e->daddr, &cb->val.haddr, sizeof(cb->val.haddr)); |
| 140 | memcpy(&e->dmask, &cb->val.hmask, sizeof(cb->val.hmask)); |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 141 | break; |
Jan Engelhardt | d441ad6 | 2011-05-06 17:45:12 +0200 | [diff] [blame] | 142 | case O_PROTO: |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 143 | if (e->match.proto) |
Jan Engelhardt | 1829ed4 | 2009-02-21 03:29:44 +0100 | [diff] [blame] | 144 | xtables_error(PARAMETER_PROBLEM, |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 145 | "policy match: double --proto option"); |
Jan Engelhardt | cdc8e0b | 2011-05-12 13:59:38 +0200 | [diff] [blame] | 146 | e->proto = cb->val.protocol; |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 147 | if (e->proto != IPPROTO_AH && e->proto != IPPROTO_ESP && |
| 148 | e->proto != IPPROTO_COMP) |
Jan Engelhardt | 1829ed4 | 2009-02-21 03:29:44 +0100 | [diff] [blame] | 149 | xtables_error(PARAMETER_PROBLEM, |
Jan Engelhardt | d441ad6 | 2011-05-06 17:45:12 +0200 | [diff] [blame] | 150 | "policy match: protocol must be ah/esp/ipcomp"); |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 151 | e->match.proto = 1; |
Jan Engelhardt | d441ad6 | 2011-05-06 17:45:12 +0200 | [diff] [blame] | 152 | e->invert.proto = cb->invert; |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 153 | break; |
Jan Engelhardt | d441ad6 | 2011-05-06 17:45:12 +0200 | [diff] [blame] | 154 | case O_MODE: |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 155 | if (e->match.mode) |
Jan Engelhardt | 1829ed4 | 2009-02-21 03:29:44 +0100 | [diff] [blame] | 156 | xtables_error(PARAMETER_PROBLEM, |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 157 | "policy match: double --mode option"); |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 158 | e->match.mode = 1; |
Jan Engelhardt | d441ad6 | 2011-05-06 17:45:12 +0200 | [diff] [blame] | 159 | e->invert.mode = cb->invert; |
| 160 | e->mode = parse_mode(cb->arg); |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 161 | break; |
Jan Engelhardt | d441ad6 | 2011-05-06 17:45:12 +0200 | [diff] [blame] | 162 | case O_NEXT: |
Jan Engelhardt | cd30054 | 2009-05-31 22:43:12 +0200 | [diff] [blame] | 163 | if (++info->len == XT_POLICY_MAX_ELEM) |
Jan Engelhardt | 1829ed4 | 2009-02-21 03:29:44 +0100 | [diff] [blame] | 164 | xtables_error(PARAMETER_PROBLEM, |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 165 | "policy match: maximum policy depth reached"); |
| 166 | break; |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 167 | } |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 168 | } |
| 169 | |
Jan Engelhardt | d441ad6 | 2011-05-06 17:45:12 +0200 | [diff] [blame] | 170 | static void policy_check(struct xt_fcheck_call *cb) |
Jan Engelhardt | 67cf1a9 | 2009-06-01 11:46:12 +0200 | [diff] [blame] | 171 | { |
Jan Engelhardt | d441ad6 | 2011-05-06 17:45:12 +0200 | [diff] [blame] | 172 | struct xt_policy_info *info = cb->data; |
| 173 | const struct xt_policy_elem *e; |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 174 | int i; |
| 175 | |
Jan Engelhardt | d441ad6 | 2011-05-06 17:45:12 +0200 | [diff] [blame] | 176 | /* |
| 177 | * The old "no parameters given" check is carried out |
| 178 | * by testing for --dir. |
| 179 | */ |
Jan Engelhardt | cd30054 | 2009-05-31 22:43:12 +0200 | [diff] [blame] | 180 | if (!(info->flags & (XT_POLICY_MATCH_IN | XT_POLICY_MATCH_OUT))) |
Jan Engelhardt | 1829ed4 | 2009-02-21 03:29:44 +0100 | [diff] [blame] | 181 | xtables_error(PARAMETER_PROBLEM, |
Jan Engelhardt | 028ad9e | 2010-01-31 16:49:50 +0100 | [diff] [blame] | 182 | "policy match: neither --dir in nor --dir out specified"); |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 183 | |
Jan Engelhardt | cd30054 | 2009-05-31 22:43:12 +0200 | [diff] [blame] | 184 | if (info->flags & XT_POLICY_MATCH_NONE) { |
| 185 | if (info->flags & XT_POLICY_MATCH_STRICT) |
Jan Engelhardt | 1829ed4 | 2009-02-21 03:29:44 +0100 | [diff] [blame] | 186 | xtables_error(PARAMETER_PROBLEM, |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 187 | "policy match: policy none but --strict given"); |
| 188 | |
| 189 | if (info->len != 0) |
Jan Engelhardt | 1829ed4 | 2009-02-21 03:29:44 +0100 | [diff] [blame] | 190 | xtables_error(PARAMETER_PROBLEM, |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 191 | "policy match: policy none but policy given"); |
| 192 | } else |
| 193 | info->len++; /* increase len by 1, no --next after last element */ |
| 194 | |
Jan Engelhardt | 1539293 | 2011-05-12 12:46:40 +0200 | [diff] [blame] | 195 | /* |
| 196 | * This is already represented with O_NEXT requiring F_STRICT in the |
| 197 | * options table, but will keep this code as a comment for reference. |
| 198 | * |
Jan Engelhardt | cd30054 | 2009-05-31 22:43:12 +0200 | [diff] [blame] | 199 | if (!(info->flags & XT_POLICY_MATCH_STRICT) && info->len > 1) |
Jan Engelhardt | 1829ed4 | 2009-02-21 03:29:44 +0100 | [diff] [blame] | 200 | xtables_error(PARAMETER_PROBLEM, |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 201 | "policy match: multiple elements but no --strict"); |
Jan Engelhardt | 1539293 | 2011-05-12 12:46:40 +0200 | [diff] [blame] | 202 | */ |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 203 | |
| 204 | for (i = 0; i < info->len; i++) { |
| 205 | e = &info->pol[i]; |
Patrick McHardy | a46d88d | 2006-01-12 09:43:18 +0000 | [diff] [blame] | 206 | |
Jan Engelhardt | cd30054 | 2009-05-31 22:43:12 +0200 | [diff] [blame] | 207 | if (info->flags & XT_POLICY_MATCH_STRICT && |
Noticed by Tom Eastep | 3f34756 | 2006-01-22 13:47:07 +0000 | [diff] [blame] | 208 | !(e->match.reqid || e->match.spi || e->match.saddr || |
Patrick McHardy | a46d88d | 2006-01-12 09:43:18 +0000 | [diff] [blame] | 209 | e->match.daddr || e->match.proto || e->match.mode)) |
Jan Engelhardt | 1829ed4 | 2009-02-21 03:29:44 +0100 | [diff] [blame] | 210 | xtables_error(PARAMETER_PROBLEM, |
Jan Engelhardt | 1539293 | 2011-05-12 12:46:40 +0200 | [diff] [blame] | 211 | "policy match: empty policy element %u. " |
| 212 | "--strict is in effect, but at least one of " |
| 213 | "reqid, spi, tunnel-src, tunnel-dst, proto or " |
| 214 | "mode is required.", i); |
Patrick McHardy | a46d88d | 2006-01-12 09:43:18 +0000 | [diff] [blame] | 215 | |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 216 | if ((e->match.saddr || e->match.daddr) |
Jan Engelhardt | cd30054 | 2009-05-31 22:43:12 +0200 | [diff] [blame] | 217 | && ((e->mode == XT_POLICY_MODE_TUNNEL && e->invert.mode) || |
| 218 | (e->mode == XT_POLICY_MODE_TRANSPORT && !e->invert.mode))) |
Jan Engelhardt | 1829ed4 | 2009-02-21 03:29:44 +0100 | [diff] [blame] | 219 | xtables_error(PARAMETER_PROBLEM, |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 220 | "policy match: --tunnel-src/--tunnel-dst " |
| 221 | "is only valid in tunnel mode"); |
| 222 | } |
| 223 | } |
| 224 | |
Jan Engelhardt | 7ac4052 | 2011-01-07 12:34:04 +0100 | [diff] [blame] | 225 | static void print_mode(const char *prefix, uint8_t mode, int numeric) |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 226 | { |
Jan Engelhardt | 7386635 | 2010-12-18 02:04:59 +0100 | [diff] [blame] | 227 | printf(" %smode ", prefix); |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 228 | |
| 229 | switch (mode) { |
Jan Engelhardt | cd30054 | 2009-05-31 22:43:12 +0200 | [diff] [blame] | 230 | case XT_POLICY_MODE_TRANSPORT: |
Jan Engelhardt | 7386635 | 2010-12-18 02:04:59 +0100 | [diff] [blame] | 231 | printf("transport"); |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 232 | break; |
Jan Engelhardt | cd30054 | 2009-05-31 22:43:12 +0200 | [diff] [blame] | 233 | case XT_POLICY_MODE_TUNNEL: |
Jan Engelhardt | 7386635 | 2010-12-18 02:04:59 +0100 | [diff] [blame] | 234 | printf("tunnel"); |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 235 | break; |
| 236 | default: |
Jan Engelhardt | 7386635 | 2010-12-18 02:04:59 +0100 | [diff] [blame] | 237 | printf("???"); |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 238 | break; |
| 239 | } |
| 240 | } |
| 241 | |
Jan Engelhardt | 7ac4052 | 2011-01-07 12:34:04 +0100 | [diff] [blame] | 242 | static void print_proto(const char *prefix, uint8_t proto, int numeric) |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 243 | { |
Jan Engelhardt | dd6e4b9 | 2011-05-07 00:05:24 +0200 | [diff] [blame] | 244 | const struct protoent *p = NULL; |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 245 | |
Jan Engelhardt | 7386635 | 2010-12-18 02:04:59 +0100 | [diff] [blame] | 246 | printf(" %sproto ", prefix); |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 247 | if (!numeric) |
| 248 | p = getprotobynumber(proto); |
| 249 | if (p != NULL) |
Jan Engelhardt | 7386635 | 2010-12-18 02:04:59 +0100 | [diff] [blame] | 250 | printf("%s", p->p_name); |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 251 | else |
Jan Engelhardt | 7386635 | 2010-12-18 02:04:59 +0100 | [diff] [blame] | 252 | printf("%u", proto); |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 253 | } |
| 254 | |
| 255 | #define PRINT_INVERT(x) \ |
| 256 | do { \ |
| 257 | if (x) \ |
Jan Engelhardt | 7386635 | 2010-12-18 02:04:59 +0100 | [diff] [blame] | 258 | printf(" !"); \ |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 259 | } while(0) |
| 260 | |
Jan Engelhardt | 67cf1a9 | 2009-06-01 11:46:12 +0200 | [diff] [blame] | 261 | static void print_entry(const char *prefix, const struct xt_policy_elem *e, |
| 262 | bool numeric, uint8_t family) |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 263 | { |
| 264 | if (e->match.reqid) { |
| 265 | PRINT_INVERT(e->invert.reqid); |
Jan Engelhardt | 7386635 | 2010-12-18 02:04:59 +0100 | [diff] [blame] | 266 | printf(" %sreqid %u", prefix, e->reqid); |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 267 | } |
| 268 | if (e->match.spi) { |
| 269 | PRINT_INVERT(e->invert.spi); |
Jan Engelhardt | 7386635 | 2010-12-18 02:04:59 +0100 | [diff] [blame] | 270 | printf(" %sspi 0x%x", prefix, e->spi); |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 271 | } |
| 272 | if (e->match.proto) { |
| 273 | PRINT_INVERT(e->invert.proto); |
| 274 | print_proto(prefix, e->proto, numeric); |
| 275 | } |
| 276 | if (e->match.mode) { |
| 277 | PRINT_INVERT(e->invert.mode); |
| 278 | print_mode(prefix, e->mode, numeric); |
| 279 | } |
| 280 | if (e->match.daddr) { |
| 281 | PRINT_INVERT(e->invert.daddr); |
Jan Engelhardt | 67cf1a9 | 2009-06-01 11:46:12 +0200 | [diff] [blame] | 282 | if (family == NFPROTO_IPV6) |
Jan Engelhardt | 7386635 | 2010-12-18 02:04:59 +0100 | [diff] [blame] | 283 | printf(" %stunnel-dst %s%s", prefix, |
Jan Engelhardt | 67cf1a9 | 2009-06-01 11:46:12 +0200 | [diff] [blame] | 284 | xtables_ip6addr_to_numeric(&e->daddr.a6), |
| 285 | xtables_ip6mask_to_numeric(&e->dmask.a6)); |
| 286 | else |
Jan Engelhardt | 7386635 | 2010-12-18 02:04:59 +0100 | [diff] [blame] | 287 | printf(" %stunnel-dst %s%s", prefix, |
Jan Engelhardt | 67cf1a9 | 2009-06-01 11:46:12 +0200 | [diff] [blame] | 288 | xtables_ipaddr_to_numeric(&e->daddr.a4), |
| 289 | xtables_ipmask_to_numeric(&e->dmask.a4)); |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 290 | } |
| 291 | if (e->match.saddr) { |
| 292 | PRINT_INVERT(e->invert.saddr); |
Jan Engelhardt | 67cf1a9 | 2009-06-01 11:46:12 +0200 | [diff] [blame] | 293 | if (family == NFPROTO_IPV6) |
Jan Engelhardt | 7386635 | 2010-12-18 02:04:59 +0100 | [diff] [blame] | 294 | printf(" %stunnel-src %s%s", prefix, |
Jan Engelhardt | 67cf1a9 | 2009-06-01 11:46:12 +0200 | [diff] [blame] | 295 | xtables_ip6addr_to_numeric(&e->saddr.a6), |
| 296 | xtables_ip6mask_to_numeric(&e->smask.a6)); |
| 297 | else |
Jan Engelhardt | 7386635 | 2010-12-18 02:04:59 +0100 | [diff] [blame] | 298 | printf(" %stunnel-src %s%s", prefix, |
Jan Engelhardt | 67cf1a9 | 2009-06-01 11:46:12 +0200 | [diff] [blame] | 299 | xtables_ipaddr_to_numeric(&e->saddr.a4), |
| 300 | xtables_ipmask_to_numeric(&e->smask.a4)); |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 301 | } |
| 302 | } |
| 303 | |
Jan Engelhardt | dd6e4b9 | 2011-05-07 00:05:24 +0200 | [diff] [blame] | 304 | static void print_flags(const char *prefix, const struct xt_policy_info *info) |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 305 | { |
Jan Engelhardt | cd30054 | 2009-05-31 22:43:12 +0200 | [diff] [blame] | 306 | if (info->flags & XT_POLICY_MATCH_IN) |
Jan Engelhardt | 7386635 | 2010-12-18 02:04:59 +0100 | [diff] [blame] | 307 | printf(" %sdir in", prefix); |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 308 | else |
Jan Engelhardt | 7386635 | 2010-12-18 02:04:59 +0100 | [diff] [blame] | 309 | printf(" %sdir out", prefix); |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 310 | |
Jan Engelhardt | cd30054 | 2009-05-31 22:43:12 +0200 | [diff] [blame] | 311 | if (info->flags & XT_POLICY_MATCH_NONE) |
Jan Engelhardt | 7386635 | 2010-12-18 02:04:59 +0100 | [diff] [blame] | 312 | printf(" %spol none", prefix); |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 313 | else |
Jan Engelhardt | 7386635 | 2010-12-18 02:04:59 +0100 | [diff] [blame] | 314 | printf(" %spol ipsec", prefix); |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 315 | |
Jan Engelhardt | cd30054 | 2009-05-31 22:43:12 +0200 | [diff] [blame] | 316 | if (info->flags & XT_POLICY_MATCH_STRICT) |
Jan Engelhardt | 7386635 | 2010-12-18 02:04:59 +0100 | [diff] [blame] | 317 | printf(" %sstrict", prefix); |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 318 | } |
| 319 | |
Jan Engelhardt | 67cf1a9 | 2009-06-01 11:46:12 +0200 | [diff] [blame] | 320 | static void policy4_print(const void *ip, const struct xt_entry_match *match, |
| 321 | int numeric) |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 322 | { |
Jan Engelhardt | cd30054 | 2009-05-31 22:43:12 +0200 | [diff] [blame] | 323 | const struct xt_policy_info *info = (void *)match->data; |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 324 | unsigned int i; |
| 325 | |
Jan Engelhardt | 7386635 | 2010-12-18 02:04:59 +0100 | [diff] [blame] | 326 | printf(" policy match"); |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 327 | print_flags("", info); |
| 328 | for (i = 0; i < info->len; i++) { |
| 329 | if (info->len > 1) |
Jan Engelhardt | 7386635 | 2010-12-18 02:04:59 +0100 | [diff] [blame] | 330 | printf(" [%u]", i); |
Jan Engelhardt | 67cf1a9 | 2009-06-01 11:46:12 +0200 | [diff] [blame] | 331 | print_entry("", &info->pol[i], numeric, NFPROTO_IPV4); |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 332 | } |
| 333 | } |
| 334 | |
Jan Engelhardt | 67cf1a9 | 2009-06-01 11:46:12 +0200 | [diff] [blame] | 335 | static void policy6_print(const void *ip, const struct xt_entry_match *match, |
| 336 | int numeric) |
| 337 | { |
| 338 | const struct xt_policy_info *info = (void *)match->data; |
| 339 | unsigned int i; |
| 340 | |
Jan Engelhardt | 7386635 | 2010-12-18 02:04:59 +0100 | [diff] [blame] | 341 | printf(" policy match"); |
Jan Engelhardt | 67cf1a9 | 2009-06-01 11:46:12 +0200 | [diff] [blame] | 342 | print_flags("", info); |
| 343 | for (i = 0; i < info->len; i++) { |
| 344 | if (info->len > 1) |
Jan Engelhardt | 7386635 | 2010-12-18 02:04:59 +0100 | [diff] [blame] | 345 | printf(" [%u]", i); |
Jan Engelhardt | 67cf1a9 | 2009-06-01 11:46:12 +0200 | [diff] [blame] | 346 | print_entry("", &info->pol[i], numeric, NFPROTO_IPV6); |
| 347 | } |
| 348 | } |
| 349 | |
| 350 | static void policy4_save(const void *ip, const struct xt_entry_match *match) |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 351 | { |
Jan Engelhardt | cd30054 | 2009-05-31 22:43:12 +0200 | [diff] [blame] | 352 | const struct xt_policy_info *info = (void *)match->data; |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 353 | unsigned int i; |
| 354 | |
| 355 | print_flags("--", info); |
| 356 | for (i = 0; i < info->len; i++) { |
Jan Engelhardt | 67cf1a9 | 2009-06-01 11:46:12 +0200 | [diff] [blame] | 357 | print_entry("--", &info->pol[i], false, NFPROTO_IPV4); |
| 358 | if (i + 1 < info->len) |
Jan Engelhardt | 7386635 | 2010-12-18 02:04:59 +0100 | [diff] [blame] | 359 | printf(" --next"); |
Jan Engelhardt | 67cf1a9 | 2009-06-01 11:46:12 +0200 | [diff] [blame] | 360 | } |
| 361 | } |
| 362 | |
| 363 | static void policy6_save(const void *ip, const struct xt_entry_match *match) |
| 364 | { |
| 365 | const struct xt_policy_info *info = (void *)match->data; |
| 366 | unsigned int i; |
| 367 | |
| 368 | print_flags("--", info); |
| 369 | for (i = 0; i < info->len; i++) { |
| 370 | print_entry("--", &info->pol[i], false, NFPROTO_IPV6); |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 371 | if (i + 1 < info->len) |
Jan Engelhardt | 7386635 | 2010-12-18 02:04:59 +0100 | [diff] [blame] | 372 | printf(" --next"); |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 373 | } |
| 374 | } |
| 375 | |
Jan Engelhardt | f2a7752 | 2009-06-25 20:12:12 +0200 | [diff] [blame] | 376 | static struct xtables_match policy_mt_reg[] = { |
| 377 | { |
| 378 | .name = "policy", |
| 379 | .version = XTABLES_VERSION, |
| 380 | .family = NFPROTO_IPV4, |
| 381 | .size = XT_ALIGN(sizeof(struct xt_policy_info)), |
| 382 | .userspacesize = XT_ALIGN(sizeof(struct xt_policy_info)), |
| 383 | .help = policy_help, |
Jan Engelhardt | d441ad6 | 2011-05-06 17:45:12 +0200 | [diff] [blame] | 384 | .x6_parse = policy_parse, |
| 385 | .x6_fcheck = policy_check, |
Jan Engelhardt | f2a7752 | 2009-06-25 20:12:12 +0200 | [diff] [blame] | 386 | .print = policy4_print, |
| 387 | .save = policy4_save, |
Jan Engelhardt | d441ad6 | 2011-05-06 17:45:12 +0200 | [diff] [blame] | 388 | .x6_options = policy_opts, |
Jan Engelhardt | f2a7752 | 2009-06-25 20:12:12 +0200 | [diff] [blame] | 389 | }, |
| 390 | { |
| 391 | .name = "policy", |
| 392 | .version = XTABLES_VERSION, |
| 393 | .family = NFPROTO_IPV6, |
| 394 | .size = XT_ALIGN(sizeof(struct xt_policy_info)), |
| 395 | .userspacesize = XT_ALIGN(sizeof(struct xt_policy_info)), |
| 396 | .help = policy_help, |
Jan Engelhardt | d441ad6 | 2011-05-06 17:45:12 +0200 | [diff] [blame] | 397 | .x6_parse = policy_parse, |
| 398 | .x6_fcheck = policy_check, |
Jan Engelhardt | f2a7752 | 2009-06-25 20:12:12 +0200 | [diff] [blame] | 399 | .print = policy6_print, |
| 400 | .save = policy6_save, |
Jan Engelhardt | d441ad6 | 2011-05-06 17:45:12 +0200 | [diff] [blame] | 401 | .x6_options = policy_opts, |
Jan Engelhardt | f2a7752 | 2009-06-25 20:12:12 +0200 | [diff] [blame] | 402 | }, |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 403 | }; |
| 404 | |
| 405 | void _init(void) |
| 406 | { |
Jan Engelhardt | f2a7752 | 2009-06-25 20:12:12 +0200 | [diff] [blame] | 407 | xtables_register_matches(policy_mt_reg, ARRAY_SIZE(policy_mt_reg)); |
Patrick McHardy | 524bb80 | 2005-11-19 09:00:03 +0000 | [diff] [blame] | 408 | } |