anonfunc/xtables-addons
1
0
Fork 0
mirror of git://git.code.sf.net/p/xtables-addons/xtables-addons synced 2025-09-07 13:15:12 +02:00
Code Issues Releases Wiki Activity

Import ACCOUNT kernel and iptables modules

Browse Source 
Reference: git://developer.intra2net.com/ipt_ACCOUNT # v1.15-1-gfb4dd1a
This commit is contained in:
Jan Engelhardt
2009-09-03 13:20:43 +02:00
parent 1fb6f187d3
commit a44c4e4b1d
6 changed files with 1536 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
extensions/Kbuild
View File

@@ -5,6 +5,7 @@ include ${XA_TOPSRCDIR}/mconfig
obj-m += compat_xtables.o
obj-${build_ACCOUNT} += xt_ACCOUNT.o
obj-${build_CHAOS} += xt_CHAOS.o
obj-${build_DELUDE} += xt_DELUDE.o
obj-${build_DHCPMAC} += xt_DHCPMAC.o

1
extensions/Mbuild
View File

@@ -1,3 +1,4 @@
obj-${build_ACCOUNT} += libxt_ACCOUNT.so
obj-${build_CHAOS} += libxt_CHAOS.so
obj-${build_DELUDE} += libxt_DELUDE.so
obj-${build_DHCPMAC} += libxt_DHCPMAC.so libxt_dhcpmac.so

198
extensions/libxt_ACCOUNT.c Normal file
View File

@@ -0,0 +1,198 @@
/* Shared library add-on to iptables to add ACCOUNT(ing) support.
Author: Intra2net AG <opensource@intra2net.com>
*/
#include <stdio.h>
#include <netdb.h>
#include <string.h>
#include <stdlib.h>
#include <syslog.h>
#include <getopt.h>
#include <stddef.h>
#include <xtables.h>
#include <linux/netfilter_ipv4/ip_tables.h>
#include "xt_ACCOUNT.h"
static struct option opts[] = {
{ .name = "addr", .has_arg = 1, .flag = 0, .val = 'a' },
{ .name = "tname", .has_arg = 1, .flag = 0, .val = 't' },
{ .name = 0 }
};
/* Compat glue for iptables 1.4.0 */
#ifndef XTABLES_VERSION
#define XTABLES_VERSION IPTABLES_VERSION
#endif
/* Function which prints out usage message. */
static void help(void)
{
printf(
"ACCOUNT v%s options:\n"
" --%s ip/netmask\t\tBase network IP and netmask used for this table\n"
" --%s name\t\t\tTable name for the userspace library\n",
XTABLES_VERSION, opts[0].name, opts[1].name);
}
/* Initialize the target. */
static void
init(struct xt_entry_target *t)
{
struct ipt_acc_info *accountinfo = (struct ipt_acc_info *)t->data;
accountinfo->table_nr = -1;
}
#define IPT_ACCOUNT_OPT_ADDR 0x01
#define IPT_ACCOUNT_OPT_TABLE 0x02
/* Function which parses command options; returns true if it
ate an option */
static int parse(int c, char **argv, int invert, unsigned int *flags,
const void *entry, struct xt_entry_target **target)
{
struct ipt_acc_info *accountinfo = (struct ipt_acc_info *)(*target)->data;
struct in_addr *addrs = NULL, mask;
unsigned int naddrs = 0;
switch (c) {
case 'a':
if (*flags & IPT_ACCOUNT_OPT_ADDR)
xtables_error(PARAMETER_PROBLEM, "Can't specify --%s twice",
opts[0].name);
if (xtables_check_inverse(optarg, &invert, NULL, 0))
xtables_error(PARAMETER_PROBLEM, "Unexpected `!' after --%s",
opts[0].name);
#ifdef XTABLES_VERSION_CODE
xtables_ipparse_any(optarg, &addrs, &mask, &naddrs);
#else
parse_hostnetworkmask(optarg, &addrs, &mask, &naddrs);
#endif
if (naddrs > 1)
xtables_error(PARAMETER_PROBLEM, "multiple IP addresses not allowed");
accountinfo->net_ip = addrs[0].s_addr;
accountinfo->net_mask = mask.s_addr;
*flags |= IPT_ACCOUNT_OPT_ADDR;
break;
case 't':
if (*flags & IPT_ACCOUNT_OPT_TABLE)
xtables_error(PARAMETER_PROBLEM,
"Can't specify --%s twice", opts[1].name);
if (xtables_check_inverse(optarg, &invert, NULL, 0))
xtables_error(PARAMETER_PROBLEM,
"Unexpected `!' after --%s", opts[1].name);
if (strlen(optarg) > ACCOUNT_TABLE_NAME_LEN - 1)
xtables_error(PARAMETER_PROBLEM,
"Maximum table name length %u for --%s",
ACCOUNT_TABLE_NAME_LEN - 1, opts[1].name);
strcpy(accountinfo->table_name, optarg);
*flags |= IPT_ACCOUNT_OPT_TABLE;
break;
default:
return 0;
}
return 1;
}
/* Final check; nothing. */
static void final_check(unsigned int flags)
{
if (!(flags&IPT_ACCOUNT_OPT_ADDR) || !(flags&IPT_ACCOUNT_OPT_TABLE))
xtables_error(PARAMETER_PROBLEM, "ACCOUNT: needs --%s and --%s",
opts[0].name, opts[1].name);
}
static const char *print_helper_ip(struct in_addr a)
{
#ifdef XTABLES_VERSION_CODE
return xtables_ipaddr_to_numeric(&a);
#else
return addr_to_dotted(&a);
#endif
}
static const char *print_helper_mask(struct in_addr a)
{
#ifdef XTABLES_VERSION_CODE
return xtables_ipmask_to_numeric(&a);
#else
return mask_to_dotted(&a);
#endif
}
static void print_it(const void *ip,
const struct xt_entry_target *target, char do_prefix)
{
const struct ipt_acc_info *accountinfo
= (const struct ipt_acc_info *)target->data;
struct in_addr a;
if (!do_prefix)
printf("ACCOUNT ");
// Network information
if (do_prefix)
printf("--");
printf("%s ", opts[0].name);
a.s_addr = accountinfo->net_ip;
printf("%s", print_helper_ip(a));
a.s_addr = accountinfo->net_mask;
printf("%s", print_helper_mask(a));
printf(" ");
if (do_prefix)
printf("--");
printf("%s %s", opts[1].name, accountinfo->table_name);
}
static void
print(const void *ip,
const struct xt_entry_target *target,
int numeric)
{
print_it (ip, target, 0);
}
/* Saves the union ipt_targinfo in parsable form to stdout. */
static void
save(const void *ip, const struct xt_entry_target *target)
{
print_it(ip, target, 1);
}
static
struct xtables_target account
= {
.next = NULL,
.name = "ACCOUNT",
.family = AF_INET,
.version = XTABLES_VERSION,
.size = XT_ALIGN(sizeof(struct ipt_acc_info)),
.userspacesize = offsetof(struct ipt_acc_info, table_nr),
.help = &help,
.init = &init,
.parse = &parse,
.final_check = &final_check,
.print = &print,
.save = &save,
.extra_opts = opts
};
void _init(void)
{
xtables_register_target(&account);
}

1224
extensions/xt_ACCOUNT.c Normal file
View File

File diff suppressed because it is too large Load Diff

111
extensions/xt_ACCOUNT.h Normal file
View File

@@ -0,0 +1,111 @@
/***************************************************************************
* Copyright (C) 2004-2006 by Intra2net AG *
* opensource@intra2net.com *
* *
* This program is free software; you can redistribute it and/or modify *
* it under the terms of the GNU General Public License *
* version 2 as published by the Free Software Foundation; *
* *
***************************************************************************/
#ifndef _IPT_ACCOUNT_H
#define _IPT_ACCOUNT_H
#define IPT_SO_SET_ACCOUNT_HANDLE_FREE (IPT_BASE_CTL + 3)
#define IPT_SO_SET_ACCOUNT_HANDLE_FREE_ALL (IPT_BASE_CTL + 4)
#define IPT_SO_SET_ACCOUNT_MAX IPT_SO_SET_ACCOUNT_HANDLE_FREE_ALL
#define IPT_SO_GET_ACCOUNT_PREPARE_READ (IPT_BASE_CTL + 4)
#define IPT_SO_GET_ACCOUNT_PREPARE_READ_FLUSH (IPT_BASE_CTL + 5)
#define IPT_SO_GET_ACCOUNT_GET_DATA (IPT_BASE_CTL + 6)
#define IPT_SO_GET_ACCOUNT_GET_HANDLE_USAGE (IPT_BASE_CTL + 7)
#define IPT_SO_GET_ACCOUNT_GET_TABLE_NAMES (IPT_BASE_CTL + 8)
#define IPT_SO_GET_ACCOUNT_MAX IPT_SO_GET_ACCOUNT_GET_TABLE_NAMES
#define ACCOUNT_MAX_TABLES 128
#define ACCOUNT_TABLE_NAME_LEN 32
#define ACCOUNT_MAX_HANDLES 10
/* Structure for the userspace part of ipt_ACCOUNT */
struct ipt_acc_info {
uint32_t net_ip;
uint32_t net_mask;
char table_name[ACCOUNT_TABLE_NAME_LEN];
int32_t table_nr;
};
/* Internal table structure, generated by check_entry() */
struct ipt_acc_table {
char name[ACCOUNT_TABLE_NAME_LEN]; /* name of the table */
uint32_t ip; /* base IP of network */
uint32_t netmask; /* netmask of the network */
unsigned char depth; /* size of network:
0: 8 bit, 1: 16bit, 2: 24 bit */
uint32_t refcount; /* refcount of this table.
if zero, destroy it */
uint32_t itemcount; /* number of IPs in this table */
void *data; /* pointer to the actual data,
depending on netmask */
};
/* Internal handle structure */
struct ipt_acc_handle {
uint32_t ip; /* base IP of network. Used for
caculating the final IP during
get_data() */
unsigned char depth; /* size of network. See above for
details */
uint32_t itemcount; /* number of IPs in this table */
void *data; /* pointer to the actual data,
depending on size */
};
/* Handle structure for communication with the userspace library */
struct ipt_acc_handle_sockopt {
uint32_t handle_nr; /* Used for HANDLE_FREE */
char name[ACCOUNT_TABLE_NAME_LEN]; /* Used for HANDLE_PREPARE_READ/
HANDLE_READ_FLUSH */
uint32_t itemcount; /* Used for HANDLE_PREPARE_READ/
HANDLE_READ_FLUSH */
};
/* Used for every IP entry
Size is 16 bytes so that 256 (class C network) * 16
fits in one kernel (zero) page */
struct ipt_acc_ip {
uint32_t src_packets;
uint32_t src_bytes;
uint32_t dst_packets;
uint32_t dst_bytes;
};
/*
Used for every IP when returning data
*/
struct ipt_acc_handle_ip {
uint32_t ip;
uint32_t src_packets;
uint32_t src_bytes;
uint32_t dst_packets;
uint32_t dst_bytes;
};
/*
The IPs are organized as an array so that direct slot
calculations are possible.
Only 8 bit networks are preallocated, 16/24 bit networks
allocate their slots when needed -> very efficent.
*/
struct ipt_acc_mask_24 {
struct ipt_acc_ip ip[256];
};
struct ipt_acc_mask_16 {
struct ipt_acc_mask_24 *mask_24[256];
};
struct ipt_acc_mask_8 {
struct ipt_acc_mask_16 *mask_16[256];
};
#endif /*_IPT_ACCOUNT_H*/