static void ipvs_mt_parse_addr_and_mask(const char *arg,
union nf_inet_addr *address,
union nf_inet_addr *mask,
unsigned int family)
{
struct in_addr *addr = NULL;
struct in6_addr *addr6 = NULL;
unsigned int naddrs = 0;
if (family == NFPROTO_IPV4) {
xtables_ipparse_any(arg, &addr, &mask->in, &naddrs);
if (naddrs > 1)
xtables_error(PARAMETER_PROBLEM,
"multiple IP addresses not allowed");
if (naddrs == 1)
memcpy(&address->in, addr, sizeof(*addr));
} else if (family == NFPROTO_IPV6) {
xtables_ip6parse_any(arg, &addr6, &mask->in6, &naddrs);
if (naddrs > 1)
xtables_error(PARAMETER_PROBLEM,
"multiple IP addresses not allowed");
if (naddrs == 1)
memcpy(&address->in6, addr6, sizeof(*addr6));
} else {
/* Hu? */
assert(false);
}
}
static int
conntrack_mt6_parse(int c, bool invert, unsigned int *flags,
struct xt_conntrack_mtinfo2 *info)
{
struct in6_addr *addr = NULL;
unsigned int naddrs = 0;
switch (c) {
case '3': /* --ctorigsrc */
xtables_ip6parse_any(optarg, &addr,
&info->origsrc_mask.in6, &naddrs);
if (naddrs > 1)
xtables_error(PARAMETER_PROBLEM,
"multiple IP addresses not allowed");
if (naddrs == 1)
memcpy(&info->origsrc_addr.in6, addr, sizeof(*addr));
info->match_flags |= XT_CONNTRACK_ORIGSRC;
if (invert)
info->invert_flags |= XT_CONNTRACK_ORIGSRC;
break;
case '4': /* --ctorigdst */
xtables_ip6parse_any(optarg, &addr,
&info->origdst_mask.in6, &naddrs);
if (naddrs > 1)
xtables_error(PARAMETER_PROBLEM,
"multiple IP addresses not allowed");
if (naddrs == 1)
memcpy(&info->origdst_addr.in, addr, sizeof(*addr));
info->match_flags |= XT_CONNTRACK_ORIGDST;
if (invert)
info->invert_flags |= XT_CONNTRACK_ORIGDST;
break;
case '5': /* --ctreplsrc */
xtables_ip6parse_any(optarg, &addr,
&info->replsrc_mask.in6, &naddrs);
if (naddrs > 1)
xtables_error(PARAMETER_PROBLEM,
"multiple IP addresses not allowed");
if (naddrs == 1)
memcpy(&info->replsrc_addr.in, addr, sizeof(*addr));
info->match_flags |= XT_CONNTRACK_REPLSRC;
if (invert)
info->invert_flags |= XT_CONNTRACK_REPLSRC;
break;
case '6': /* --ctrepldst */
xtables_ip6parse_any(optarg, &addr,
&info->repldst_mask.in6, &naddrs);
if (naddrs > 1)
xtables_error(PARAMETER_PROBLEM,
"multiple IP addresses not allowed");
if (naddrs == 1)
memcpy(&info->repldst_addr.in, addr, sizeof(*addr));
info->match_flags |= XT_CONNTRACK_REPLDST;
if (invert)
info->invert_flags |= XT_CONNTRACK_REPLDST;
break;
default:
return conntrack_mt_parse(c, invert, flags, info);
}
*flags = info->match_flags;
return true;
}
static int policy_parse(int c, int invert, unsigned int *flags,
struct xt_policy_info *info, uint8_t family)
{
struct xt_policy_elem *e = &info->pol[info->len];
struct in_addr *addr = NULL, mask;
struct in6_addr *addr6 = NULL, mask6;
unsigned int naddr = 0, num;
int mode;
xtables_check_inverse(optarg, &invert, &optind, 0);
switch (c) {
case '1':
if (info->flags & (XT_POLICY_MATCH_IN | XT_POLICY_MATCH_OUT))
xtables_error(PARAMETER_PROBLEM,
"policy match: double --dir option");
if (invert)
xtables_error(PARAMETER_PROBLEM,
"policy match: can't invert --dir option");
info->flags |= parse_direction(optarg);
break;
case '2':
if (invert)
xtables_error(PARAMETER_PROBLEM,
"policy match: can't invert --policy option");
info->flags |= parse_policy(optarg);
break;
case '3':
if (info->flags & XT_POLICY_MATCH_STRICT)
xtables_error(PARAMETER_PROBLEM,
"policy match: double --strict option");
if (invert)
xtables_error(PARAMETER_PROBLEM,
"policy match: can't invert --strict option");
info->flags |= XT_POLICY_MATCH_STRICT;
break;
case '4':
if (e->match.reqid)
xtables_error(PARAMETER_PROBLEM,
"policy match: double --reqid option");
e->match.reqid = 1;
e->invert.reqid = invert;
if (!xtables_strtoui(optarg, NULL, &num, 0, UINT32_MAX))
xtables_param_act(XTF_BAD_VALUE, "policy", "--spi", optarg);
e->reqid = num;
break;
case '5':
if (e->match.spi)
xtables_error(PARAMETER_PROBLEM,
"policy match: double --spi option");
e->match.spi = 1;
e->invert.spi = invert;
if (!xtables_strtoui(optarg, NULL, &num, 0, UINT32_MAX))
xtables_param_act(XTF_BAD_VALUE, "policy", "--spi", optarg);
e->spi = num;
break;
case '6':
if (e->match.saddr)
xtables_error(PARAMETER_PROBLEM,
"policy match: double --tunnel-src option");
if (family == NFPROTO_IPV6)
xtables_ip6parse_any(optarg, &addr6, &mask6, &naddr);
else
xtables_ipparse_any(optarg, &addr, &mask, &naddr);
if (naddr > 1)
xtables_error(PARAMETER_PROBLEM,
"policy match: name resolves to multiple IPs");
e->match.saddr = 1;
e->invert.saddr = invert;
if (family == NFPROTO_IPV6) {
memcpy(&e->saddr.a6, addr6, sizeof(*addr6));
memcpy(&e->smask.a6, &mask6, sizeof(mask6));
} else {
e->saddr.a4 = addr[0];
e->smask.a4 = mask;
}
break;
case '7':
if (e->match.daddr)
xtables_error(PARAMETER_PROBLEM,
"policy match: double --tunnel-dst option");
if (family == NFPROTO_IPV6)
xtables_ip6parse_any(optarg, &addr6, &mask6, &naddr);
else
xtables_ipparse_any(optarg, &addr, &mask, &naddr);
if (naddr > 1)
xtables_error(PARAMETER_PROBLEM,
"policy match: name resolves to multiple IPs");
e->match.daddr = 1;
e->invert.daddr = invert;
if (family == NFPROTO_IPV6) {
memcpy(&e->daddr.a6, addr6, sizeof(*addr6));
memcpy(&e->dmask.a6, &mask6, sizeof(mask6));
} else {
e->daddr.a4 = addr[0];
e->dmask.a4 = mask;
}
break;
case '8':
if (e->match.proto)
xtables_error(PARAMETER_PROBLEM,
"policy match: double --proto option");
e->proto = xtables_parse_protocol(optarg);
if (e->proto != IPPROTO_AH && e->proto != IPPROTO_ESP &&
e->proto != IPPROTO_COMP)
xtables_error(PARAMETER_PROBLEM,
"policy match: protocol must ah/esp/ipcomp");
e->match.proto = 1;
e->invert.proto = invert;
break;
case '9':
if (e->match.mode)
xtables_error(PARAMETER_PROBLEM,
"policy match: double --mode option");
mode = parse_mode(optarg);
e->match.mode = 1;
e->invert.mode = invert;
e->mode = mode;
break;
case 'a':
if (invert)
xtables_error(PARAMETER_PROBLEM,
"policy match: can't invert --next option");
if (++info->len == XT_POLICY_MAX_ELEM)
xtables_error(PARAMETER_PROBLEM,
"policy match: maximum policy depth reached");
break;
default:
return 0;
}
return 1;
}
int nat64_tg6_parse(int c, char **argv, int invert,
unsigned int *flags, const void *entry,
struct xt_entry_target **target)
{
struct xt_nat64_tginfo *info = (void *)(*target)->data;
struct in6_addr *addrs, mask;
char out_dev[IFNAMSIZ];
unsigned char out_dev_mask[IFNAMSIZ];
unsigned int naddrs;
switch(c) {
case '1': /* --ipsrc */
xtables_error(PARAMETER_PROBLEM, "xt_nat64: "
"You can't check for the source!");
return false;
case '2': /* --ipdst */
if (*flags & XT_NAT64_IPV6_DST)
xtables_error(PARAMETER_PROBLEM, "xt_nat64: "
"Only use \"--ipdst\" once!");
*flags |= XT_NAT64_IPV6_DST;
info->flags |= XT_NAT64_IPV6_DST;
if (invert)
xtables_error(PARAMETER_PROBLEM, "xt_nat64: "
"I'm sorry, the invert flag isn't available yet");
xtables_ip6parse_any(optarg, &addrs, &mask, &naddrs);
if (naddrs != 1)
xtables_error(PARAMETER_PROBLEM,
"%s does not resolves to exactly "
"one address", optarg);
if (addrs == NULL)
xtables_error(PARAMETER_PROBLEM,
"Parse error at %s\n", optarg);
memcpy(&info->ip6dst.in6, addrs, sizeof(*addrs));
memcpy(&info->ip6dst_mask.in6, &mask, sizeof(mask));
return true;
case '3': /* --oudev */
if (*flags & XT_NAT64_OUT_DEV)
xtables_error(PARAMETER_PROBLEM, "xt_nat64: "
"Only use \"--outdev\" once!");
*flags |= XT_NAT64_OUT_DEV;
info->flags |= XT_NAT64_OUT_DEV;
if (invert)
xtables_error(PARAMETER_PROBLEM, "xt_nat64: "
"I'm sorry, the invert flag isn't available yet");
xtables_parse_interface(optarg, out_dev, out_dev_mask);
if (out_dev == NULL)
xtables_error(PARAMETER_PROBLEM,
"Parse error at %s\n", optarg);
memcpy(&info->out_dev, out_dev, sizeof(char) * IFNAMSIZ);
memcpy(&info->out_dev_mask, out_dev_mask, sizeof(unsigned char) * IFNAMSIZ);
return true;
}
return false;
}
