1 /* Shared library add-on to iptables to add NFMARK matching support. */
10 #include <linux/netfilter/xt_mark.h>
13 unsigned long mark, mask;
21 static void mark_mt_help(void)
24 "mark match options:\n"
25 "[!] --mark value[/mask] Match nfmark value with optional mask\n");
28 static const struct option mark_mt_opts[] = {
29 {.name = "mark", .has_arg = true, .val = '1'},
33 static int mark_mt_parse(int c, char **argv, int invert, unsigned int *flags,
34 const void *entry, struct xt_entry_match **match)
36 struct xt_mark_mtinfo1 *info = (void *)(*match)->data;
37 unsigned int mark, mask = UINT32_MAX;
41 case '1': /* --mark */
42 xtables_param_act(XTF_ONLY_ONCE, "mark", "--mark", *flags & F_MARK);
43 if (!xtables_strtoui(optarg, &end, &mark, 0, UINT32_MAX))
44 xtables_param_act(XTF_BAD_VALUE, "mark", "--mark", optarg);
46 if (!xtables_strtoui(end + 1, &end, &mask, 0, UINT32_MAX))
47 xtables_param_act(XTF_BAD_VALUE, "mark", "--mark", optarg);
49 xtables_param_act(XTF_BAD_VALUE, "mark", "--mark", optarg);
62 mark_parse(int c, char **argv, int invert, unsigned int *flags,
63 const void *entry, struct xt_entry_match **match)
65 struct xt_mark_info *markinfo = (struct xt_mark_info *)(*match)->data;
70 xtables_check_inverse(optarg, &invert, &optind, 0, argv);
71 markinfo->mark = strtoul(optarg, &end, 0);
73 markinfo->mask = strtoul(end+1, &end, 0);
75 markinfo->mask = 0xffffffff;
76 if (*end != '\0' || end == optarg)
77 xtables_error(PARAMETER_PROBLEM, "Bad MARK value \"%s\"", optarg);
89 static void print_mark(unsigned int mark, unsigned int mask)
91 if (mask != 0xffffffffU)
92 printf("0x%x/0x%x ", mark, mask);
94 printf("0x%x ", mark);
97 static void mark_mt_check(unsigned int flags)
100 xtables_error(PARAMETER_PROBLEM,
101 "mark match: The --mark option is required");
105 mark_mt_print(const void *ip, const struct xt_entry_match *match, int numeric)
107 const struct xt_mark_mtinfo1 *info = (const void *)match->data;
109 printf("mark match ");
112 print_mark(info->mark, info->mask);
116 mark_print(const void *ip, const struct xt_entry_match *match, int numeric)
118 const struct xt_mark_info *info = (const void *)match->data;
120 printf("MARK match ");
125 print_mark(info->mark, info->mask);
128 static void mark_mt_save(const void *ip, const struct xt_entry_match *match)
130 const struct xt_mark_mtinfo1 *info = (const void *)match->data;
136 print_mark(info->mark, info->mask);
140 mark_save(const void *ip, const struct xt_entry_match *match)
142 const struct xt_mark_info *info = (const void *)match->data;
148 print_mark(info->mark, info->mask);
151 static struct xtables_match mark_mt_reg[] = {
153 .family = NFPROTO_UNSPEC,
156 .version = XTABLES_VERSION,
157 .size = XT_ALIGN(sizeof(struct xt_mark_info)),
158 .userspacesize = XT_ALIGN(sizeof(struct xt_mark_info)),
159 .help = mark_mt_help,
161 .final_check = mark_mt_check,
164 .extra_opts = mark_mt_opts,
167 .version = XTABLES_VERSION,
170 .family = NFPROTO_UNSPEC,
171 .size = XT_ALIGN(sizeof(struct xt_mark_mtinfo1)),
172 .userspacesize = XT_ALIGN(sizeof(struct xt_mark_mtinfo1)),
173 .help = mark_mt_help,
174 .parse = mark_mt_parse,
175 .final_check = mark_mt_check,
176 .print = mark_mt_print,
177 .save = mark_mt_save,
178 .extra_opts = mark_mt_opts,
184 xtables_register_matches(mark_mt_reg, ARRAY_SIZE(mark_mt_reg));