1/* Ugly hack to make state matching for ipv6 work before iptables-1.4.x is finished */
2#include <stdio.h>
3#include <netdb.h>
4#include <string.h>
5#include <stdlib.h>
6#include <getopt.h>
7#include <ip6tables.h>
8#include <linux/netfilter/nf_conntrack_common.h>
9#include <linux/netfilter_ipv4/ipt_state.h>
10
11#ifndef IPT_STATE_UNTRACKED
12#define IPT_STATE_UNTRACKED (1 << (IP_CT_NUMBER + 1))
13#endif
14
15/* Function which prints out usage message. */
16static void
17help(void)
18{
19	printf(
20"state v%s options:\n"
21" [!] --state [INVALID|ESTABLISHED|NEW|RELATED|UNTRACKED][,...]\n"
22"				State(s) to match\n"
23"\n", IPTABLES_VERSION);
24}
25
26static struct option opts[] = {
27	{ "state", 1, 0, '1' },
28	{0}
29};
30
31static int
32parse_state(const char *state, size_t strlen, struct ipt_state_info *sinfo)
33{
34	if (strncasecmp(state, "INVALID", strlen) == 0)
35		sinfo->statemask |= IPT_STATE_INVALID;
36	else if (strncasecmp(state, "NEW", strlen) == 0)
37		sinfo->statemask |= IPT_STATE_BIT(IP_CT_NEW);
38	else if (strncasecmp(state, "ESTABLISHED", strlen) == 0)
39		sinfo->statemask |= IPT_STATE_BIT(IP_CT_ESTABLISHED);
40	else if (strncasecmp(state, "RELATED", strlen) == 0)
41		sinfo->statemask |= IPT_STATE_BIT(IP_CT_RELATED);
42	else if (strncasecmp(state, "UNTRACKED", strlen) == 0)
43		sinfo->statemask |= IPT_STATE_UNTRACKED;
44	else
45		return 0;
46	return 1;
47}
48
49static void
50parse_states(const char *arg, struct ipt_state_info *sinfo)
51{
52	const char *comma;
53
54	while ((comma = strchr(arg, ',')) != NULL) {
55		if (comma == arg || !parse_state(arg, comma-arg, sinfo))
56			exit_error(PARAMETER_PROBLEM, "Bad state `%s'", arg);
57		arg = comma+1;
58	}
59
60	if (strlen(arg) == 0 || !parse_state(arg, strlen(arg), sinfo))
61		exit_error(PARAMETER_PROBLEM, "Bad state `%s'", arg);
62}
63
64/* Function which parses command options; returns true if it
65   ate an option */
66static int
67parse(int c, char **argv, int invert, unsigned int *flags,
68      const struct ip6t_entry *entry,
69      unsigned int *nfcache,
70      struct ip6t_entry_match **match)
71{
72	struct ipt_state_info *sinfo = (struct ipt_state_info *)(*match)->data;
73
74	switch (c) {
75	case '1':
76		check_inverse(optarg, &invert, &optind, 0);
77
78		parse_states(argv[optind-1], sinfo);
79		if (invert)
80			sinfo->statemask = ~sinfo->statemask;
81		*flags = 1;
82		break;
83
84	default:
85		return 0;
86	}
87
88	return 1;
89}
90
91/* Final check; must have specified --state. */
92static void final_check(unsigned int flags)
93{
94	if (!flags)
95		exit_error(PARAMETER_PROBLEM, "You must specify `--state'");
96}
97
98static void print_state(unsigned int statemask)
99{
100	const char *sep = "";
101
102	if (statemask & IPT_STATE_INVALID) {
103		printf("%sINVALID", sep);
104		sep = ",";
105	}
106	if (statemask & IPT_STATE_BIT(IP_CT_NEW)) {
107		printf("%sNEW", sep);
108		sep = ",";
109	}
110	if (statemask & IPT_STATE_BIT(IP_CT_RELATED)) {
111		printf("%sRELATED", sep);
112		sep = ",";
113	}
114	if (statemask & IPT_STATE_BIT(IP_CT_ESTABLISHED)) {
115		printf("%sESTABLISHED", sep);
116		sep = ",";
117	}
118	if (statemask & IPT_STATE_UNTRACKED) {
119		printf("%sUNTRACKED", sep);
120		sep = ",";
121	}
122	printf(" ");
123}
124
125/* Prints out the matchinfo. */
126static void
127print(const struct ip6t_ip6 *ip,
128      const struct ip6t_entry_match *match,
129      int numeric)
130{
131	struct ipt_state_info *sinfo = (struct ipt_state_info *)match->data;
132
133	printf("state ");
134	print_state(sinfo->statemask);
135}
136
137/* Saves the matchinfo in parsable form to stdout. */
138static void save(const struct ip6t_ip6 *ip, const struct ip6t_entry_match *match)
139{
140	struct ipt_state_info *sinfo = (struct ipt_state_info *)match->data;
141
142	printf("--state ");
143	print_state(sinfo->statemask);
144}
145
146static struct ip6tables_match state = {
147	.next		= NULL,
148	.name		= "state",
149	.version	= IPTABLES_VERSION,
150	.size		= IP6T_ALIGN(sizeof(struct ipt_state_info)),
151	.userspacesize	= IP6T_ALIGN(sizeof(struct ipt_state_info)),
152	.help		= &help,
153	.parse		= &parse,
154	.final_check	= &final_check,
155	.print		= &print,
156	.save		= &save,
157	.extra_opts	= opts
158};
159
160void _init(void)
161{
162	register_match6(&state);
163}
164