aboutsummaryrefslogtreecommitdiffstats
path: root/extensions/libxt_conntrack.c
diff options
context:
space:
mode:
Diffstat (limited to 'extensions/libxt_conntrack.c')
-rw-r--r--extensions/libxt_conntrack.c243
1 files changed, 243 insertions, 0 deletions
diff --git a/extensions/libxt_conntrack.c b/extensions/libxt_conntrack.c
index 128bbd20..72c52200 100644
--- a/extensions/libxt_conntrack.c
+++ b/extensions/libxt_conntrack.c
@@ -1156,6 +1156,246 @@ static void state_save(const void *ip, const struct xt_entry_match *match)
state_print_state(sinfo->statemask);
}
+static void state_xlate_print(struct xt_xlate *xl, unsigned int statemask)
+{
+ const char *sep = "";
+
+ if (statemask & XT_CONNTRACK_STATE_INVALID) {
+ xt_xlate_add(xl, "%s%s", sep, "invalid");
+ sep = ",";
+ }
+ if (statemask & XT_CONNTRACK_STATE_BIT(IP_CT_NEW)) {
+ xt_xlate_add(xl, "%s%s", sep, "new");
+ sep = ",";
+ }
+ if (statemask & XT_CONNTRACK_STATE_BIT(IP_CT_RELATED)) {
+ xt_xlate_add(xl, "%s%s", sep, "related");
+ sep = ",";
+ }
+ if (statemask & XT_CONNTRACK_STATE_BIT(IP_CT_ESTABLISHED)) {
+ xt_xlate_add(xl, "%s%s", sep, "established");
+ sep = ",";
+ }
+ if (statemask & XT_CONNTRACK_STATE_UNTRACKED) {
+ xt_xlate_add(xl, "%s%s", sep, "untracked");
+ sep = ",";
+ }
+}
+
+static int state_xlate(struct xt_xlate *xl,
+ const struct xt_xlate_mt_params *params)
+{
+ const struct xt_conntrack_mtinfo3 *sinfo =
+ (const void *)params->match->data;
+
+ xt_xlate_add(xl, "ct state %s", sinfo->invert_flags & XT_CONNTRACK_STATE ?
+ "!= " : "");
+ state_xlate_print(xl, sinfo->state_mask);
+ xt_xlate_add(xl, " ");
+ return 1;
+}
+
+static void status_xlate_print(struct xt_xlate *xl, unsigned int statusmask)
+{
+ const char *sep = "";
+
+ if (statusmask & IPS_EXPECTED) {
+ xt_xlate_add(xl, "%s%s", sep, "expected");
+ sep = ",";
+ }
+ if (statusmask & IPS_SEEN_REPLY) {
+ xt_xlate_add(xl, "%s%s", sep, "seen-reply");
+ sep = ",";
+ }
+ if (statusmask & IPS_ASSURED) {
+ xt_xlate_add(xl, "%s%s", sep, "assured");
+ sep = ",";
+ }
+ if (statusmask & IPS_CONFIRMED) {
+ xt_xlate_add(xl, "%s%s", sep, "confirmed");
+ sep = ",";
+ }
+}
+
+static void addr_xlate_print(struct xt_xlate *xl,
+ const union nf_inet_addr *addr,
+ const union nf_inet_addr *mask,
+ unsigned int family)
+{
+ if (family == NFPROTO_IPV4) {
+ xt_xlate_add(xl, "%s%s", xtables_ipaddr_to_numeric(&addr->in),
+ xtables_ipmask_to_numeric(&mask->in));
+ } else if (family == NFPROTO_IPV6) {
+ xt_xlate_add(xl, "%s%s", xtables_ip6addr_to_numeric(&addr->in6),
+ xtables_ip6mask_to_numeric(&mask->in6));
+ }
+}
+
+static int _conntrack3_mt_xlate(struct xt_xlate *xl,
+ const struct xt_xlate_mt_params *params,
+ int family)
+{
+ const struct xt_conntrack_mtinfo3 *sinfo =
+ (const void *)params->match->data;
+ char *space = "";
+
+ if (sinfo->match_flags & XT_CONNTRACK_DIRECTION) {
+ xt_xlate_add(xl, "ct direction %s",
+ sinfo->invert_flags & XT_CONNTRACK_DIRECTION ?
+ "reply" : "original");
+ space = " ";
+ }
+
+ if (sinfo->match_flags & XT_CONNTRACK_PROTO) {
+ xt_xlate_add(xl, "%sct %s protocol %s%u", space,
+ sinfo->invert_flags & XT_CONNTRACK_DIRECTION ?
+ "reply" : "original",
+ sinfo->invert_flags & XT_CONNTRACK_PROTO ?
+ "!= " : "",
+ sinfo->l4proto);
+ space = " ";
+ }
+
+ if (sinfo->match_flags & XT_CONNTRACK_STATE) {
+ xt_xlate_add(xl, "%sct state %s", space,
+ sinfo->invert_flags & XT_CONNTRACK_STATE ?
+ "!= " : "");
+ state_xlate_print(xl, sinfo->state_mask);
+ space = " ";
+ }
+
+ if (sinfo->match_flags & XT_CONNTRACK_STATUS) {
+ if (sinfo->status_mask == 1)
+ return 0;
+ xt_xlate_add(xl, "%sct status %s", space,
+ sinfo->invert_flags & XT_CONNTRACK_STATUS ?
+ "!= " : "");
+ status_xlate_print(xl, sinfo->status_mask);
+ space = " ";
+ }
+
+ if (sinfo->match_flags & XT_CONNTRACK_EXPIRES) {
+ xt_xlate_add(xl, "%sct expiration %s", space,
+ sinfo->invert_flags & XT_CONNTRACK_EXPIRES ?
+ "!= " : "");
+ if (sinfo->expires_max == sinfo->expires_min)
+ xt_xlate_add(xl, "%lu", sinfo->expires_min);
+ else
+ xt_xlate_add(xl, "%lu-%lu", sinfo->expires_min,
+ sinfo->expires_max);
+ space = " ";
+ }
+
+ if (sinfo->match_flags & XT_CONNTRACK_ORIGSRC) {
+ if (&sinfo->origsrc_addr == 0L)
+ return 0;
+
+ xt_xlate_add(xl, "%sct original saddr %s", space,
+ sinfo->invert_flags & XT_CONNTRACK_ORIGSRC ?
+ "!= " : "");
+ addr_xlate_print(xl, &sinfo->origsrc_addr,
+ &sinfo->origsrc_mask, family);
+ space = " ";
+ }
+
+ if (sinfo->match_flags & XT_CONNTRACK_ORIGDST) {
+ if (&sinfo->origdst_addr == 0L)
+ return 0;
+
+ xt_xlate_add(xl, "%sct original daddr %s", space,
+ sinfo->invert_flags & XT_CONNTRACK_ORIGDST ?
+ "!= " : "");
+ addr_xlate_print(xl, &sinfo->origdst_addr,
+ &sinfo->origdst_mask, family);
+ space = " ";
+ }
+
+ if (sinfo->match_flags & XT_CONNTRACK_REPLSRC) {
+ if (&sinfo->replsrc_addr == 0L)
+ return 0;
+
+ xt_xlate_add(xl, "%sct reply saddr %s", space,
+ sinfo->invert_flags & XT_CONNTRACK_REPLSRC ?
+ "!= " : "");
+ addr_xlate_print(xl, &sinfo->replsrc_addr,
+ &sinfo->replsrc_mask, family);
+ space = " ";
+ }
+
+ if (sinfo->match_flags & XT_CONNTRACK_REPLDST) {
+ if (&sinfo->repldst_addr == 0L)
+ return 0;
+
+ xt_xlate_add(xl, "%sct reply daddr %s", space,
+ sinfo->invert_flags & XT_CONNTRACK_REPLDST ?
+ "!= " : "");
+ addr_xlate_print(xl, &sinfo->repldst_addr,
+ &sinfo->repldst_mask, family);
+ space = " ";
+ }
+
+ if (sinfo->match_flags & XT_CONNTRACK_ORIGSRC_PORT) {
+ xt_xlate_add(xl, "%sct original proto-src %s", space,
+ sinfo->invert_flags & XT_CONNTRACK_ORIGSRC_PORT ?
+ "!= " : "");
+ if (sinfo->origsrc_port == sinfo->origsrc_port_high)
+ xt_xlate_add(xl, "%u", sinfo->origsrc_port);
+ else
+ xt_xlate_add(xl, "%u-%u", sinfo->origsrc_port,
+ sinfo->origsrc_port_high);
+ space = " ";
+ }
+
+ if (sinfo->match_flags & XT_CONNTRACK_ORIGDST_PORT) {
+ xt_xlate_add(xl, "%sct original proto-dst %s", space,
+ sinfo->invert_flags & XT_CONNTRACK_ORIGDST_PORT ?
+ "!= " : "");
+ if (sinfo->origdst_port == sinfo->origdst_port_high)
+ xt_xlate_add(xl, "%u", sinfo->origdst_port);
+ else
+ xt_xlate_add(xl, "%u-%u", sinfo->origdst_port,
+ sinfo->origdst_port_high);
+ space = " ";
+ }
+
+ if (sinfo->match_flags & XT_CONNTRACK_REPLSRC_PORT) {
+ xt_xlate_add(xl, "%sct reply proto-src %s", space,
+ sinfo->invert_flags & XT_CONNTRACK_REPLSRC_PORT ?
+ "!= " : "");
+ if (sinfo->replsrc_port == sinfo->replsrc_port_high)
+ xt_xlate_add(xl, "%u", sinfo->replsrc_port);
+ else
+ xt_xlate_add(xl, "%u-%u", sinfo->replsrc_port,
+ sinfo->replsrc_port_high);
+ space = " ";
+ }
+
+ if (sinfo->match_flags & XT_CONNTRACK_REPLDST_PORT) {
+ xt_xlate_add(xl, "%sct reply proto-dst %s", space,
+ sinfo->invert_flags & XT_CONNTRACK_REPLDST_PORT ?
+ "!= " : "", sinfo->repldst_port);
+ if (sinfo->repldst_port == sinfo->repldst_port_high)
+ xt_xlate_add(xl, "%u", sinfo->repldst_port);
+ else
+ xt_xlate_add(xl, "%u-%u", sinfo->repldst_port,
+ sinfo->repldst_port_high);
+ }
+
+ return 1;
+}
+
+static int conntrack3_mt4_xlate(struct xt_xlate *xl,
+ const struct xt_xlate_mt_params *params)
+{
+ return _conntrack3_mt_xlate(xl, params, NFPROTO_IPV4);
+}
+
+static int conntrack3_mt6_xlate(struct xt_xlate *xl,
+ const struct xt_xlate_mt_params *params)
+{
+ return _conntrack3_mt_xlate(xl, params, NFPROTO_IPV6);
+}
+
static struct xtables_match conntrack_mt_reg[] = {
{
.version = XTABLES_VERSION,
@@ -1246,6 +1486,7 @@ static struct xtables_match conntrack_mt_reg[] = {
.save = conntrack3_mt_save,
.alias = conntrack_print_name_alias,
.x6_options = conntrack3_mt_opts,
+ .xlate = conntrack3_mt4_xlate,
},
{
.version = XTABLES_VERSION,
@@ -1261,6 +1502,7 @@ static struct xtables_match conntrack_mt_reg[] = {
.save = conntrack3_mt6_save,
.alias = conntrack_print_name_alias,
.x6_options = conntrack3_mt_opts,
+ .xlate = conntrack3_mt6_xlate,
},
{
.family = NFPROTO_UNSPEC,
@@ -1306,6 +1548,7 @@ static struct xtables_match conntrack_mt_reg[] = {
.save = state_save,
.x6_parse = state_ct23_parse,
.x6_options = state_opts,
+ .xlate = state_xlate,
},
{
.family = NFPROTO_UNSPEC,
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-02 18:48:26 +0000