The group ID used by xt_pknock is configurable, but pknlusr hard-codes
it. Modify pknlusr to accept an optional ID from the command-line.
Group ID's range from 1 to 32 and each ID appears in the group bit-mask
at position `group_id - 1`.
Signed-off-by: Jeremy Sowden <jeremy@xxxxxxxxxx>
---
extensions/pknock/pknlusr.c | 41 +++++++++++++++++++++++++++++++++----
1 file changed, 37 insertions(+), 4 deletions(-)
diff --git a/extensions/pknock/pknlusr.c b/extensions/pknock/pknlusr.c
index fba628e1f466..255649aefbb5 100644
--- a/extensions/pknock/pknlusr.c
+++ b/extensions/pknock/pknlusr.c
@@ -7,15 +7,22 @@
#include <arpa/inet.h>
#include <linux/netlink.h>
#include <linux/connector.h>
+#include <errno.h>
+#include <libgen.h>
+#include <limits.h>
#include "xt_pknock.h"
-#define GROUP 1
+#define DEFAULT_GROUP_ID 1
-int main(void)
+#define MIN_GROUP_ID DEFAULT_GROUP_ID
+#define MAX_GROUP_ID \
+ (sizeof ((struct sockaddr_nl) { 0 }.nl_groups) * CHAR_BIT)
+
+int main(int argc, char **argv)
{
int status;
- int group = GROUP;
+ unsigned int group_id = DEFAULT_GROUP_ID;
struct sockaddr_nl local_addr = { .nl_family = AF_NETLINK };
int sock_fd;
@@ -25,6 +32,32 @@ int main(void)
struct cn_msg *cn_msg;
struct xt_pknock_nl_msg *pknock_msg;
+ if (argc > 2) {
+ char *prog;
+ if (!(prog = strdup (argv[0]))) {
+ perror("strdup()");
+ } else {
+ fprintf(stderr, "%s [ group-id ]\n", basename(prog));
+ free(prog);
+ }
+ exit(EXIT_FAILURE);
+ }
+
+ if (argc == 2) {
+ long n;
+ char *end;
+
+ errno = 0;
+ n = strtol(argv[1], &end, 10);
+ if (*end || (errno && (n == LONG_MIN || n == LONG_MAX)) ||
+ n < MIN_GROUP_ID || n > MAX_GROUP_ID) {
+ fputs("Group ID invalid.\n", stderr);
+ exit(EXIT_FAILURE);
+ }
+
+ group_id = n;
+ }
+
sock_fd = socket(PF_NETLINK, SOCK_DGRAM, NETLINK_CONNECTOR);
if (sock_fd == -1) {
@@ -32,7 +65,7 @@ int main(void)
exit (EXIT_FAILURE);
}
- local_addr.nl_groups = group;
+ local_addr.nl_groups = 1U << (group_id - 1);
status = bind(sock_fd, (struct sockaddr*)&local_addr, sizeof(local_addr));
--
2.28.0
