ip6tables support for the CONDITION MATCH

Harald,

here is a patch to the condition match to support ip6tables. IPv6
support will be compiled only if selected in the kernel configuration.

There is also a patch for userspace/extensions/Makefile.

Regards,

Stephane Ouellette

@@ -0,0 +1,11 @@
+#ifndef __IPT_CONDITION_MATCH__
+#define __IPT_CONDITION_MATCH__
+
+#define VARIABLE_NAME_LEN  32
+
+struct condition_info {
+  char	name[VARIABLE_NAME_LEN];
+  int   invert;
+};
+
+#endif

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <getopt.h>
#include <ip6tables.h>

#include<linux/netfilter_ipv6/ip6_tables.h>
#include<linux/netfilter_ipv4/ipt_condition.h>

static void help(void)
{
printf("condition match v%s options:\n"
"--condition [!] filename Match on boolean value stored in /proc file"
"\n", IPTABLES_VERSION);
}

static struct option opts[] = { { "condition", 1, 0, 'X' }, { 0 } };

static void init(struct ip6t_entry_match *m, unsigned int *nfcache) {
*nfcache |= NFC_UNKNOWN;
}

static int parse(int c, char **argv, int invert, unsigned int *flags,
const struct ip6t_entry *entry, unsigned int *nfcache, struct ip6t_entry_match **match)
{
struct condition_info *info = (struct condition_info*)(*match)->data;

  check_inverse(optarg, &invert, &optind, 0);

  if(*flags)
    exit_error(PARAMETER_PROBLEM, "Can't specify multiple conditions");

  if(c == 'X')
  {
    if(strlen(argv[optind-1]) < VARIABLE_NAME_LEN)
      strcpy(info->name, argv[optind-1]);
    else
      exit_error(PARAMETER_PROBLEM, "File name too long");

    info->invert = invert;
    *flags = 1;
    return 1;

}

return 0;
}

static void final_check(unsigned int flags)
{
if(!flags)

    exit_error(PARAMETER_PROBLEM, "Condition match: must specify --condition");
}

static void print(const struct ip6t_ip6 *ip,
const struct ip6t_entry_match *match, int numeric)
{
const struct condition_info *info = (const struct condition_info*)match->data;

printf("condition %s%s ", (info->invert) ? "!" : "", info->name);
}

static void save(const struct ip6t_ip6 *ip, const struct ip6t_entry_match *match) {
const struct condition_info *info = (const struct condition_info*)match->data;

printf("--condition %s%s ", (info->invert) ? "! " : "", info->name);
}

static struct ip6tables_match condition = {
NULL,
"condition",
IPTABLES_VERSION,
IP6T_ALIGN(sizeof(struct condition_info)),
IP6T_ALIGN(sizeof(struct condition_info)),
&help,
&init,
&parse,
&final_check,
&print,
&save,
opts
};

void _init(void)
{
register_match6(&condition);
}

CONFIG_IP_NF_MATCH_TOS
condition match support
CONFIG_IP_NF_MATCH_CONDITION
This option allows you to match firewall rules against condition variables stored in the /proc/net/ipt_condition directory.

This module also supports IPv6. Condition variables can be shared by IPv4 and IPv6 firewall rules.

If you want to compile it as a module, say M here and read Documentation/modules.txt. If unsure, say `N'.

Author: Stephane Ouellette <[email protected]>
Status: ItWorksForMe(tm)

This patch adds CONFIG_IP_NF_MATCH_CONDITION which allows you to match firewall rules against condition variables stored in the /proc/net/ipt_condition directory.

This module now supports IPv6. Condition variables can be shared by IPv4 and IPv6 firewall rules.

@@ -4,6 +4,7 @@
 PF6_EXT_SLIB:=eui64 icmpv6 length limit mac mark multiport owner standard tcp udp LOG MARK
 
 # The following may not be present, but compile them anyway.
+PF6_EXT_SLIB+=condition
 PF_EXT_SLIB+=TTL iplimit
 
 # Optionals

sorry, but although this is the most efficient way to implement it (implement ipv4 and ipv6 part in one module), it confuses users (and iptables itself).

imagine autoloading. we always try to load ip6t_condition.o, but in your case everything is in ipt_condition.o :((

I think you can understand that I cannot accept it this way :((

Live long and prosper
- Harald Welte / [email protected]               http://www.gnumonks.org/
============================================================================
GCS/E/IT d- s-: a-- C+++ UL++++$ P+++ L++++$ E--- W- N++ o? K- w--- O- M- 
V-- PS+ PE-- Y+ PGP++ t++ 5-- !X !R tv-- b+++ DI? !D G+ e* h+ r% y+(*)