1 files changed, 62 insertions, 149 deletions

diff --git a/extensions/libip6t_ah.c b/extensions/libip6t_ah.c
index 794e02eb..26f81408 100644
--- a/extensions/libip6t_ah.c
+++ b/extensions/libip6t_ah.c
@@ -1,227 +1,140 @@
-/* Shared library add-on to ip6tables to add AH support. */
 #include <stdio.h>
-#include <netdb.h>
-#include <string.h>
-#include <stdlib.h>
-#include <getopt.h>
-#include <errno.h>
-#include <ip6tables.h>
+#include <xtables.h>
 #include <linux/netfilter_ipv6/ip6t_ah.h>
-                                        
-/* Function which prints out usage message. */
-static void
-help(void)
-{
-	printf(
-"AH v%s options:\n"
-" --ahspi [!] spi[:spi]         match spi (range)\n"
-" --ahlen [!] length            total length of this header\n"
-" --ahres                       check the reserved filed, too\n",
-IPTABLES_VERSION);
-}
 
-static struct option opts[] = {
-	{ .name = "ahspi", .has_arg = 1, .flag = 0, .val = '1' },
-	{ .name = "ahlen", .has_arg = 1, .flag = 0, .val = '2' },
-	{ .name = "ahres", .has_arg = 0, .flag = 0, .val = '3' },
-	{ .name = 0 }
+enum {
+	O_AHSPI = 0,
+	O_AHLEN,
+	O_AHRES,
 };
 
-static u_int32_t
-parse_ah_spi(const char *spistr, const char *typestr)
-{
-	unsigned long int spi;
-	char* ep;
-
-	spi = strtoul(spistr, &ep, 0);
-
-	if ( spistr == ep )
-		exit_error(PARAMETER_PROBLEM,
-			   "AH no valid digits in %s `%s'", typestr, spistr);
-
-	if ( spi == ULONG_MAX  && errno == ERANGE )
-		exit_error(PARAMETER_PROBLEM,
-			   "%s `%s' specified too big: would overflow",
-			   typestr, spistr);
-
-	if ( *spistr != '\0'  && *ep != '\0' )
-		exit_error(PARAMETER_PROBLEM,
-			   "AH error parsing %s `%s'", typestr, spistr);
-
-	return (u_int32_t) spi;
-}
-
-static void
-parse_ah_spis(const char *spistring, u_int32_t *spis)
+static void ah_help(void)
 {
-	char *buffer;
-	char *cp;
-
-	buffer = strdup(spistring);
-	if ((cp = strchr(buffer, ':')) == NULL)
-		spis[0] = spis[1] = parse_ah_spi(buffer, "spi");
-	else {
-		*cp = '\0';
-		cp++;
-
-		spis[0] = buffer[0] ? parse_ah_spi(buffer, "spi") : 0;
-		spis[1] = cp[0] ? parse_ah_spi(cp, "spi") : 0xFFFFFFFF;
-	}
-	free(buffer);
+	printf(
+"ah match options:\n"
+"[!] --ahspi spi[:spi]          match spi (range)\n"
+"[!] --ahlen length             total length of this header\n"
+" --ahres                       check the reserved field too\n");
 }
 
-/* Initialize the match. */
-static void
-init(struct ip6t_entry_match *m, unsigned int *nfcache)
-{
-	struct ip6t_ah *ahinfo = (struct ip6t_ah *)m->data;
-
-	ahinfo->spis[1] = 0xFFFFFFFF;
-	ahinfo->hdrlen = 0;
-	ahinfo->hdrres = 0;
-}
+#define s struct ip6t_ah
+static const struct xt_option_entry ah_opts[] = {
+	{.name = "ahspi", .id = O_AHSPI, .type = XTTYPE_UINT32RC,
+	 .flags = XTOPT_INVERT | XTOPT_PUT, XTOPT_POINTER(s, spis)},
+	{.name = "ahlen", .id = O_AHLEN, .type = XTTYPE_UINT32,
+	 .flags = XTOPT_INVERT | XTOPT_PUT, XTOPT_POINTER(s, hdrlen)},
+	{.name = "ahres", .id = O_AHRES, .type = XTTYPE_NONE},
+	XTOPT_TABLEEND,
+};
+#undef s
 
-/* Function which parses command options; returns true if it
-   ate an option */
-static int
-parse(int c, char **argv, int invert, unsigned int *flags,
-      const struct ip6t_entry *entry,
-      unsigned int *nfcache,
-      struct ip6t_entry_match **match)
+static void ah_parse(struct xt_option_call *cb)
 {
-	struct ip6t_ah *ahinfo = (struct ip6t_ah *)(*match)->data;
-
-	switch (c) {
-	case '1':
-		if (*flags & IP6T_AH_SPI)
-			exit_error(PARAMETER_PROBLEM,
-				   "Only one `--ahspi' allowed");
-		check_inverse(optarg, &invert, &optind, 0);
-		parse_ah_spis(argv[optind-1], ahinfo->spis);
-		if (invert)
+	struct ip6t_ah *ahinfo = cb->data;
+
+	xtables_option_parse(cb);
+	switch (cb->entry->id) {
+	case O_AHSPI:
+		if (cb->nvals == 1)
+			ahinfo->spis[1] = ahinfo->spis[0];
+		if (cb->invert)
 			ahinfo->invflags |= IP6T_AH_INV_SPI;
-		*flags |= IP6T_AH_SPI;
 		break;
-	case '2':
-		if (*flags & IP6T_AH_LEN)
-			exit_error(PARAMETER_PROBLEM,
-				   "Only one `--ahlen' allowed");
-		check_inverse(optarg, &invert, &optind, 0);
-		ahinfo->hdrlen = parse_ah_spi(argv[optind-1], "length");
-		if (invert)
+	case O_AHLEN:
+		if (cb->invert)
 			ahinfo->invflags |= IP6T_AH_INV_LEN;
-		*flags |= IP6T_AH_LEN;
 		break;
-	case '3':
-		if (*flags & IP6T_AH_RES)
-			exit_error(PARAMETER_PROBLEM,
-				   "Only one `--ahres' allowed");
+	case O_AHRES:
 		ahinfo->hdrres = 1;
-		*flags |= IP6T_AH_RES;
 		break;
-	default:
-		return 0;
 	}
-
-	return 1;
-}
-
-/* Final check; we don't care. */
-static void
-final_check(unsigned int flags)
-{
 }
 
 static void
-print_spis(const char *name, u_int32_t min, u_int32_t max,
+print_spis(const char *name, uint32_t min, uint32_t max,
 	    int invert)
 {
 	const char *inv = invert ? "!" : "";
 
 	if (min != 0 || max != 0xFFFFFFFF || invert) {
 		if (min == max)
-			printf("%s:%s%u ", name, inv, min);
+			printf("%s:%s%u", name, inv, min);
 		else
-			printf("%ss:%s%u:%u ", name, inv, min, max);
+			printf("%ss:%s%u:%u", name, inv, min, max);
 	}
 }
 
 static void
-print_len(const char *name, u_int32_t len, int invert)
+print_len(const char *name, uint32_t len, int invert)
 {
 	const char *inv = invert ? "!" : "";
 
 	if (len != 0 || invert)
-		printf("%s:%s%u ", name, inv, len);
+		printf("%s:%s%u", name, inv, len);
 }
 
-/* Prints out the union ip6t_matchinfo. */
-static void
-print(const struct ip6t_ip6 *ip,
-      const struct ip6t_entry_match *match, int numeric)
+static void ah_print(const void *ip, const struct xt_entry_match *match,
+                     int numeric)
 {
 	const struct ip6t_ah *ah = (struct ip6t_ah *)match->data;
 
-	printf("ah ");
+	printf(" ah ");
 	print_spis("spi", ah->spis[0], ah->spis[1],
 		    ah->invflags & IP6T_AH_INV_SPI);
 	print_len("length", ah->hdrlen, 
 		    ah->invflags & IP6T_AH_INV_LEN);
 
 	if (ah->hdrres)
-		printf("reserved ");
+		printf(" reserved");
 
 	if (ah->invflags & ~IP6T_AH_INV_MASK)
-		printf("Unknown invflags: 0x%X ",
+		printf(" Unknown invflags: 0x%X",
 		       ah->invflags & ~IP6T_AH_INV_MASK);
 }
 
-/* Saves the union ip6t_matchinfo in parsable form to stdout. */
-static void save(const struct ip6t_ip6 *ip, const struct ip6t_entry_match *match)
+static void ah_save(const void *ip, const struct xt_entry_match *match)
 {
 	const struct ip6t_ah *ahinfo = (struct ip6t_ah *)match->data;
 
 	if (!(ahinfo->spis[0] == 0
 	    && ahinfo->spis[1] == 0xFFFFFFFF)) {
-		printf("--ahspi %s", 
-			(ahinfo->invflags & IP6T_AH_INV_SPI) ? "! " : "");
+		printf("%s --ahspi ",
+			(ahinfo->invflags & IP6T_AH_INV_SPI) ? " !" : "");
 		if (ahinfo->spis[0]
 		    != ahinfo->spis[1])
-			printf("%u:%u ",
+			printf("%u:%u",
 			       ahinfo->spis[0],
 			       ahinfo->spis[1]);
 		else
-			printf("%u ",
+			printf("%u",
 			       ahinfo->spis[0]);
 	}
 
 	if (ahinfo->hdrlen != 0 || (ahinfo->invflags & IP6T_AH_INV_LEN) ) {
-		printf("--ahlen %s%u ", 
-			(ahinfo->invflags & IP6T_AH_INV_LEN) ? "! " : "", 
+		printf("%s --ahlen %u",
+			(ahinfo->invflags & IP6T_AH_INV_LEN) ? " !" : "",
 			ahinfo->hdrlen);
 	}
 
 	if (ahinfo->hdrres != 0 )
-		printf("--ahres ");
+		printf(" --ahres");
 }
 
-static
-struct ip6tables_match ah = {
+static struct xtables_match ah_mt6_reg = {
 	.name          = "ah",
-	.version       = IPTABLES_VERSION,
-	.size          = IP6T_ALIGN(sizeof(struct ip6t_ah)),
-	.userspacesize = IP6T_ALIGN(sizeof(struct ip6t_ah)),
-	.help          = &help,
-	.init          = &init,
-	.parse         = &parse,
-	.final_check   = &final_check,
-	.print         = &print,
-	.save          = &save,
-	.extra_opts    = opts
+	.version       = XTABLES_VERSION,
+	.family        = NFPROTO_IPV6,
+	.size          = XT_ALIGN(sizeof(struct ip6t_ah)),
+	.userspacesize = XT_ALIGN(sizeof(struct ip6t_ah)),
+	.help          = ah_help,
+	.print         = ah_print,
+	.save          = ah_save,
+	.x6_parse      = ah_parse,
+	.x6_options    = ah_opts,
 };
 
 void
 _init(void)
 {
-	register_match6(&ah);
+	xtables_register_match(&ah_mt6_reg);
 }