diff -urN iptables-1.3.3.old/extensions/libipt_TRIGGER.c iptables-1.3.3.dev/extensions/libipt_TRIGGER.c --- iptables-1.3.3.old/extensions/libipt_TRIGGER.c 1969-12-31 16:00:00.000000000 -0800 +++ iptables-1.3.3.dev/extensions/libipt_TRIGGER.c 2007-03-09 21:07:39.000000000 -0800 @@ -0,0 +1,209 @@ +/* Port-triggering target. + * + * Copyright (C) 2003, CyberTAN Corporation + * All Rights Reserved. + */ + +/* Shared library add-on to iptables to add port-trigger support. */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include + +/* Function which prints out usage message. */ +static void +help(void) +{ + printf( +"TRIGGER v%s options:\n" +" --trigger-type (dnat|in|out)\n" +" Trigger type\n" +" --trigger-proto proto\n" +" Trigger protocol\n" +" --trigger-match port[-port]\n" +" Trigger destination port range\n" +" --trigger-relate port[-port]\n" +" Port range to map related destination port range to.\n\n", +IPTABLES_VERSION); +} + +static struct option opts[] = { + { "trigger-type", 1, 0, '1' }, + { "trigger-proto", 1, 0, '2' }, + { "trigger-match", 1, 0, '3' }, + { "trigger-relate", 1, 0, '4' }, + { 0 } +}; + +/* Initialize the target. */ +static void +init(struct ipt_entry_target *t, unsigned int *nfcache) +{ + /* Can't cache this */ + *nfcache |= NFC_UNKNOWN; +} + +/* Parses ports */ +static void +parse_ports(const char *arg, u_int16_t *ports) +{ + const char *dash; + int port; + + port = atoi(arg); + if (port == 0 || port > 65535) + exit_error(PARAMETER_PROBLEM, "Port range `%s' invalid\n", arg); + + dash = strchr(arg, '-'); + if (!dash) + ports[0] = ports[1] = port; + else { + int maxport; + + maxport = atoi(dash + 1); + if (maxport == 0 || maxport > 65535) + exit_error(PARAMETER_PROBLEM, + "Port range `%s' invalid\n", dash+1); + if (maxport < port) + exit_error(PARAMETER_PROBLEM, + "Port range `%s' invalid\n", arg); + ports[0] = port; + ports[1] = maxport; + } +} + + +/* Function which parses command options; returns true if it + ate an option */ +static int +parse(int c, char **argv, int invert, unsigned int *flags, + const struct ipt_entry *entry, + struct ipt_entry_target **target) +{ + struct ipt_trigger_info *info = (struct ipt_trigger_info *)(*target)->data; + + switch (c) { + case '1': + if (!strcasecmp(optarg, "dnat")) + info->type = IPT_TRIGGER_DNAT; + else if (!strcasecmp(optarg, "in")) + info->type = IPT_TRIGGER_IN; + else if (!strcasecmp(optarg, "out")) + info->type = IPT_TRIGGER_OUT; + else + exit_error(PARAMETER_PROBLEM, + "unknown type `%s' specified", optarg); + return 1; + + case '2': + if (!strcasecmp(optarg, "tcp")) + info->proto = IPPROTO_TCP; + else if (!strcasecmp(optarg, "udp")) + info->proto = IPPROTO_UDP; + else if (!strcasecmp(optarg, "all")) + info->proto = 0; + else + exit_error(PARAMETER_PROBLEM, + "unknown protocol `%s' specified", optarg); + return 1; + + case '3': + if (check_inverse(optarg, &invert, &optind, 0)) + exit_error(PARAMETER_PROBLEM, + "Unexpected `!' after --trigger-match"); + + parse_ports(optarg, info->ports.mport); + return 1; + + case '4': + if (check_inverse(optarg, &invert, &optind, 0)) + exit_error(PARAMETER_PROBLEM, + "Unexpected `!' after --trigger-relate"); + + parse_ports(optarg, info->ports.rport); + *flags |= IP_NAT_RANGE_PROTO_SPECIFIED; + return 1; + + default: + return 0; + } +} + +/* Final check; don't care. */ +static void final_check(unsigned int flags) +{ +} + +/* Prints out the targinfo. */ +static void +print(const struct ipt_ip *ip, + const struct ipt_entry_target *target, + int numeric) +{ + struct ipt_trigger_info *info = (struct ipt_trigger_info *)target->data; + + printf("TRIGGER "); + if (info->type == IPT_TRIGGER_DNAT) + printf("type:dnat "); + else if (info->type == IPT_TRIGGER_IN) + printf("type:in "); + else if (info->type == IPT_TRIGGER_OUT) + printf("type:out "); + + if (info->proto == IPPROTO_TCP) + printf("tcp "); + else if (info->proto == IPPROTO_UDP) + printf("udp "); + + printf("match:%hu", info->ports.mport[0]); + if (info->ports.mport[1] > info->ports.mport[0]) + printf("-%hu", info->ports.mport[1]); + printf(" "); + + printf("relate:%hu", info->ports.rport[0]); + if (info->ports.rport[1] > info->ports.rport[0]) + printf("-%hu", info->ports.rport[1]); + printf(" "); +} + +/* Saves the union ipt_targinfo in parsable form to stdout. */ +static void +save(const struct ipt_ip *ip, const struct ipt_entry_target *target) +{ + struct ipt_trigger_info *info = (struct ipt_trigger_info *)target->data; + + printf("--trigger-proto "); + if (info->proto == IPPROTO_TCP) + printf("tcp "); + else if (info->proto == IPPROTO_UDP) + printf("udp "); + printf("--trigger-match %hu-%hu ", info->ports.mport[0], info->ports.mport[1]); + printf("--trigger-relate %hu-%hu ", info->ports.rport[0], info->ports.rport[1]); +} + +struct iptables_target trigger += { NULL, + "TRIGGER", + 0, + IPTABLES_VERSION, + IPT_ALIGN(sizeof(struct ipt_trigger_info)), + IPT_ALIGN(sizeof(struct ipt_trigger_info)), + &help, + &init, + &parse, + &final_check, + &print, + &save, + opts +}; + +void _init(void) +{ + register_target(&trigger); +} diff -urN iptables-1.3.3.old/extensions/Makefile iptables-1.3.3.dev/extensions/Makefile --- iptables-1.3.3.old/extensions/Makefile 2007-03-10 10:43:23.000000000 -0800 +++ iptables-1.3.3.dev/extensions/Makefile 2007-03-09 20:24:28.000000000 -0800 @@ -5,7 +5,7 @@ # header files are present in the include/linux directory of this iptables # package (HW) # -PF_EXT_SLIB:=ah addrtype comment connlimit connmark conntrack dscp ecn esp hashlimit helper icmp iprange length limit mac mark multiport owner physdev pkttype realm rpc sctp standard state tcp tcpmss tos ttl udp unclean CLASSIFY CONNMARK DNAT DSCP ECN LOG MARK MASQUERADE MIRROR NETMAP NFQUEUE NOTRACK REDIRECT REJECT SAME SNAT TARPIT TCPMSS TOS TRACE TTL ULOG +PF_EXT_SLIB:=ah addrtype comment connlimit connmark conntrack dscp ecn esp hashlimit helper icmp iprange length limit mac mark multiport owner physdev pkttype realm rpc sctp standard state tcp tcpmss tos ttl udp unclean CLASSIFY CONNMARK DNAT DSCP ECN LOG MARK MASQUERADE MIRROR NETMAP NFQUEUE NOTRACK REDIRECT REJECT SAME SNAT TARPIT TCPMSS TOS TRACE TRIGGER TTL ULOG PF6_EXT_SLIB:=eui64 hl icmpv6 length limit mac mark multiport owner physdev standard tcp udp HL LOG NFQUEUE MARK TRACE # Optionals diff -urN iptables-1.3.3.old/include/linux/netfilter_ipv4/ipt_TRIGGER.h iptables-1.3.3.dev/include/linux/netfilter_ipv4/ipt_TRIGGER.h --- iptables-1.3.3.old/include/linux/netfilter_ipv4/ipt_TRIGGER.h 1969-12-31 16:00:00.000000000 -0800 +++ iptables-1.3.3.dev/include/linux/netfilter_ipv4/ipt_TRIGGER.h 2004-02-19 03:13:14.000000000 -0800 @@ -0,0 +1,24 @@ +#ifndef _IPT_TRIGGER_H_target +#define _IPT_TRIGGER_H_target + +#define TRIGGER_TIMEOUT 600 /* 600 secs */ + +enum ipt_trigger_type +{ + IPT_TRIGGER_DNAT = 1, + IPT_TRIGGER_IN = 2, + IPT_TRIGGER_OUT = 3 +}; + +struct ipt_trigger_ports { + u_int16_t mport[2]; /* Related destination port range */ + u_int16_t rport[2]; /* Port range to map related destination port range to */ +}; + +struct ipt_trigger_info { + enum ipt_trigger_type type; + u_int16_t proto; /* Related protocol */ + struct ipt_trigger_ports ports; +}; + +#endif /*_IPT_TRIGGER_H_target*/