1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159116011611162116311641165116611671168116911701171117211731174117511761177117811791180118111821183118411851186118711881189119011911192119311941195119611971198119912001201120212031204120512061207120812091210121112121213121412151216121712181219122012211222122312241225122612271228122912301231123212331234123512361237123812391240124112421243124412451246124712481249125012511252125312541255125612571258125912601261126212631264126512661267126812691270127112721273127412751276127712781279128012811282128312841285128612871288128912901291129212931294129512961297129812991300130113021303130413051306130713081309131013111312131313141315131613171318131913201321132213231324132513261327132813291330133113321333133413351336133713381339134013411342134313441345134613471348134913501351135213531354135513561357135813591360136113621363136413651366136713681369137013711372137313741375137613771378137913801381138213831384138513861387138813891390139113921393139413951396139713981399140014011402140314041405140614071408140914101411141214131414141514161417141814191420142114221423142414251426142714281429143014311432143314341435143614371438143914401441144214431444144514461447144814491450145114521453145414551456145714581459146014611462146314641465146614671468146914701471147214731474147514761477147814791480148114821483148414851486148714881489149014911492149314941495149614971498149915001501150215031504150515061507150815091510151115121513151415151516151715181519152015211522152315241525152615271528152915301531153215331534153515361537153815391540154115421543154415451546154715481549155015511552155315541555155615571558155915601561156215631564156515661567156815691570157115721573157415751576157715781579158015811582158315841585158615871588158915901591159215931594159515961597159815991600160116021603160416051606160716081609161016111612161316141615161616171618161916201621162216231624162516261627162816291630163116321633163416351636163716381639164016411642164316441645164616471648164916501651165216531654165516561657165816591660166116621663166416651666166716681669167016711672167316741675167616771678167916801681168216831684168516861687168816891690169116921693169416951696169716981699170017011702170317041705170617071708170917101711171217131714171517161717171817191720172117221723172417251726172717281729173017311732173317341735173617371738173917401741174217431744174517461747174817491750175117521753175417551756175717581759176017611762176317641765176617671768176917701771177217731774177517761777177817791780178117821783178417851786178717881789179017911792179317941795179617971798179918001801180218031804180518061807180818091810181118121813181418151816181718181819182018211822182318241825182618271828182918301831183218331834183518361837183818391840184118421843184418451846184718481849185018511852185318541855185618571858185918601861186218631864186518661867186818691870187118721873187418751876187718781879188018811882188318841885188618871888188918901891189218931894189518961897189818991900190119021903190419051906190719081909191019111912191319141915191619171918191919201921192219231924192519261927192819291930193119321933193419351936193719381939 |
- /*
- * firewall3 - 3rd OpenWrt UCI firewall implementation
- *
- * Copyright (C) 2013 Jo-Philipp Wich <jo@mein.io>
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
- * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
- * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
- * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- */
- #define _GNU_SOURCE /* RTLD_NEXT */
- /* include userspace headers */
- #include <dlfcn.h>
- #include <unistd.h>
- #include <getopt.h>
- #include <net/if.h>
- #include <netinet/in.h>
- #include <sys/utsname.h>
- #include <sys/socket.h>
- /* prevent indirect inclusion of kernel headers */
- #define _LINUX_IF_H
- #define _LINUX_IN_H
- #define _LINUX_IN6_H
- /* prevent libiptc from including kernel headers */
- #define _FWCHAINS_KERNEL_HEADERS_H
- /* finally include libiptc and xtables */
- #include <libiptc/libiptc.h>
- #include <libiptc/libip6tc.h>
- #include <xtables.h>
- #include <setjmp.h>
- #include "options.h"
- /* xtables interface */
- #if (XTABLES_VERSION_CODE >= 10)
- # include "xtables-10.h"
- #elif (XTABLES_VERSION_CODE == 5)
- # include "xtables-5.h"
- #else
- # error "Unsupported xtables version"
- #endif
- #include "iptables.h"
- #define XT_LOCK_NAME "/var/run/xtables.lock"
- static int xt_lock_fd = -1;
- struct fw3_ipt_rule {
- struct fw3_ipt_handle *h;
- union {
- struct ipt_entry e;
- struct ip6t_entry e6;
- };
- struct xtables_rule_match *matches;
- struct xtables_target *target;
- int argc;
- char **argv;
- uint32_t protocol;
- bool protocol_loaded;
- };
- static struct option base_opts[] = {
- { .name = "match", .has_arg = 1, .val = 'm' },
- { .name = "jump", .has_arg = 1, .val = 'j' },
- { .name = "in-interface", .has_arg = 1, .val = 'i' },
- { .name = "out-interface", .has_arg = 1, .val = 'o' },
- { .name = "source", .has_arg = 1, .val = 's' },
- { .name = "destination", .has_arg = 1, .val = 'd' },
- { NULL }
- };
- static jmp_buf fw3_ipt_error_jmp;
- static __attribute__((noreturn))
- void fw3_ipt_error_handler(enum xtables_exittype status,
- const char *fmt, ...)
- {
- va_list args;
- fprintf(stderr, " ! Exception: ");
- va_start(args, fmt);
- vfprintf(stderr, fmt, args);
- va_end(args);
- longjmp(fw3_ipt_error_jmp, status);
- }
- static struct xtables_globals xtg = {
- .option_offset = 0,
- .program_version = "4",
- .orig_opts = base_opts,
- .exit_err = fw3_ipt_error_handler,
- #if XTABLES_VERSION_CODE > 10
- .compat_rev = xtables_compatible_revision,
- #endif
- };
- static struct xtables_globals xtg6 = {
- .option_offset = 0,
- .program_version = "6",
- .orig_opts = base_opts,
- .exit_err = fw3_ipt_error_handler,
- #if XTABLES_VERSION_CODE > 10
- .compat_rev = xtables_compatible_revision,
- #endif
- };
- static struct {
- bool retain;
- int mcount, tcount;
- struct xtables_match **matches;
- struct xtables_target **targets;
- void (*register_match)(struct xtables_match *);
- void (*register_target)(struct xtables_target *);
- } xext;
- /* Required by certain extensions like SNAT and DNAT */
- int kernel_version = 0;
- void
- get_kernel_version(void)
- {
- static struct utsname uts;
- int x = 3, y = 0, z = 0;
- if (uname(&uts) != -1)
- sscanf(uts.release, "%d.%d.%d", &x, &y, &z);
- kernel_version = 0x10000 * x + 0x100 * y + z;
- }
- static void fw3_init_extensions(void)
- {
- init_extensions();
- init_extensions4();
- #ifndef DISABLE_IPV6
- init_extensions6();
- #endif
- }
- struct fw3_ipt_handle *
- fw3_ipt_open(enum fw3_family family, enum fw3_table table)
- {
- int i;
- struct fw3_ipt_handle *h;
- h = fw3_alloc(sizeof(*h));
- xtables_init();
- while (!fw3_lock_path(&xt_lock_fd, XT_LOCK_NAME)) {
- warn("Currently busy xtables.lock - wait 1 second");
- sleep(1);
- }
- if (family == FW3_FAMILY_V6)
- {
- #ifndef DISABLE_IPV6
- h->family = FW3_FAMILY_V6;
- h->table = table;
- h->handle = ip6tc_init(fw3_flag_names[table]);
- xtables_set_params(&xtg6);
- xtables_set_nfproto(NFPROTO_IPV6);
- #endif
- }
- else
- {
- h->family = FW3_FAMILY_V4;
- h->table = table;
- h->handle = iptc_init(fw3_flag_names[table]);
- xtables_set_params(&xtg);
- xtables_set_nfproto(NFPROTO_IPV4);
- }
- if (!h->handle)
- {
- free(h);
- fw3_unlock_path(&xt_lock_fd, XT_LOCK_NAME);
- return NULL;
- }
- fw3_xt_reset();
- fw3_init_extensions();
- if (xext.register_match)
- for (i = 0; i < xext.mcount; i++)
- xext.register_match(xext.matches[i]);
- if (xext.register_target)
- for (i = 0; i < xext.tcount; i++)
- xext.register_target(xext.targets[i]);
- return h;
- }
- static void
- debug(struct fw3_ipt_handle *h, const char *fmt, ...)
- {
- va_list ap;
- printf("%s -t %s ", (h->family == FW3_FAMILY_V6) ? "ip6tables" : "iptables",
- fw3_flag_names[h->table]);
- va_start(ap, fmt);
- vprintf(fmt, ap);
- va_end(ap);
- }
- void
- fw3_ipt_set_policy(struct fw3_ipt_handle *h, const char *chain,
- enum fw3_flag policy)
- {
- if (fw3_pr_debug)
- debug(h, "-P %s %s\n", chain, fw3_flag_names[policy]);
- #ifndef DISABLE_IPV6
- if (h->family == FW3_FAMILY_V6)
- ip6tc_set_policy(chain, fw3_flag_names[policy], NULL, h->handle);
- else
- #endif
- iptc_set_policy(chain, fw3_flag_names[policy], NULL, h->handle);
- }
- void
- fw3_ipt_flush_chain(struct fw3_ipt_handle *h, const char *chain)
- {
- if (fw3_pr_debug)
- debug(h, "-F %s\n", chain);
- #ifndef DISABLE_IPV6
- if (h->family == FW3_FAMILY_V6)
- ip6tc_flush_entries(chain, h->handle);
- else
- #endif
- iptc_flush_entries(chain, h->handle);
- }
- static void
- delete_rules(struct fw3_ipt_handle *h, const char *target)
- {
- unsigned int num;
- const struct ipt_entry *e;
- const char *chain;
- const char *t;
- bool found;
- #ifndef DISABLE_IPV6
- if (h->family == FW3_FAMILY_V6)
- {
- for (chain = ip6tc_first_chain(h->handle);
- chain != NULL;
- chain = ip6tc_next_chain(h->handle))
- {
- do {
- found = false;
- const struct ip6t_entry *e6;
- for (num = 0, e6 = ip6tc_first_rule(chain, h->handle);
- e6 != NULL;
- num++, e6 = ip6tc_next_rule(e6, h->handle))
- {
- t = ip6tc_get_target(e6, h->handle);
- if (*t && !strcmp(t, target))
- {
- if (fw3_pr_debug)
- debug(h, "-D %s %u\n", chain, num + 1);
- ip6tc_delete_num_entry(chain, num, h->handle);
- found = true;
- break;
- }
- }
- } while (found);
- }
- }
- else
- #endif
- {
- for (chain = iptc_first_chain(h->handle);
- chain != NULL;
- chain = iptc_next_chain(h->handle))
- {
- do {
- found = false;
- for (num = 0, e = iptc_first_rule(chain, h->handle);
- e != NULL;
- num++, e = iptc_next_rule(e, h->handle))
- {
- t = iptc_get_target(e, h->handle);
- if (*t && !strcmp(t, target))
- {
- if (fw3_pr_debug)
- debug(h, "-D %s %u\n", chain, num + 1);
- iptc_delete_num_entry(chain, num, h->handle);
- found = true;
- break;
- }
- }
- } while (found);
- }
- }
- }
- static bool
- is_referenced(struct fw3_ipt_handle *h, const char *target)
- {
- const struct ipt_entry *e;
- const char *chain;
- const char *t;
- #ifndef DISABLE_IPV6
- if (h->family == FW3_FAMILY_V6)
- {
- for (chain = ip6tc_first_chain(h->handle);
- chain != NULL;
- chain = ip6tc_next_chain(h->handle))
- {
- const struct ip6t_entry *e6;
- for (e6 = ip6tc_first_rule(chain, h->handle);
- e6 != NULL;
- e6 = ip6tc_next_rule(e6, h->handle))
- {
- t = ip6tc_get_target(e6, h->handle);
- if (*t && !strcmp(t, target))
- return true;
- }
- }
- }
- else
- #endif
- {
- for (chain = iptc_first_chain(h->handle);
- chain != NULL;
- chain = iptc_next_chain(h->handle))
- {
- for (e = iptc_first_rule(chain, h->handle);
- e != NULL;
- e = iptc_next_rule(e, h->handle))
- {
- t = iptc_get_target(e, h->handle);
- if (*t && !strcmp(t, target))
- return true;
- }
- }
- }
- return false;
- }
- void
- fw3_ipt_delete_chain(struct fw3_ipt_handle *h, bool if_unused,
- const char *chain)
- {
- if (if_unused && is_referenced(h, chain))
- return;
- delete_rules(h, chain);
- if (fw3_pr_debug)
- debug(h, "-X %s\n", chain);
- #ifndef DISABLE_IPV6
- if (h->family == FW3_FAMILY_V6)
- ip6tc_delete_chain(chain, h->handle);
- else
- #endif
- iptc_delete_chain(chain, h->handle);
- }
- static bool
- has_rule_tag(const void *base, unsigned int start, unsigned int end)
- {
- unsigned int i;
- const struct xt_entry_match *em;
- for (i = start; i < end; i += em->u.match_size)
- {
- em = base + i;
- if (strcmp(em->u.user.name, "comment"))
- continue;
- if (!memcmp(em->data, "!fw3", 4))
- return true;
- }
- return false;
- }
- void
- fw3_ipt_delete_id_rules(struct fw3_ipt_handle *h, const char *chain)
- {
- unsigned int num;
- const struct ipt_entry *e;
- bool found;
- #ifndef DISABLE_IPV6
- if (h->family == FW3_FAMILY_V6)
- {
- if (!ip6tc_is_chain(chain, h->handle))
- return;
- do {
- found = false;
- const struct ip6t_entry *e6;
- for (num = 0, e6 = ip6tc_first_rule(chain, h->handle);
- e6 != NULL;
- num++, e6 = ip6tc_next_rule(e6, h->handle))
- {
- if (has_rule_tag(e6, sizeof(*e6), e6->target_offset))
- {
- if (fw3_pr_debug)
- debug(h, "-D %s %u\n", chain, num + 1);
- ip6tc_delete_num_entry(chain, num, h->handle);
- found = true;
- break;
- }
- }
- } while (found);
- }
- else
- #endif
- {
- if (!iptc_is_chain(chain, h->handle))
- return;
- do {
- found = false;
- for (num = 0, e = iptc_first_rule(chain, h->handle);
- e != NULL;
- num++, e = iptc_next_rule(e, h->handle))
- {
- if (has_rule_tag(e, sizeof(*e), e->target_offset))
- {
- if (fw3_pr_debug)
- debug(h, "-D %s %u\n", chain, num + 1);
- iptc_delete_num_entry(chain, num, h->handle);
- found = true;
- break;
- }
- }
- } while (found);
- }
- }
- static bool
- is_chain(struct fw3_ipt_handle *h, const char *name)
- {
- #ifndef DISABLE_IPV6
- if (h->family == FW3_FAMILY_V6)
- return ip6tc_is_chain(name, h->handle);
- else
- #endif
- return iptc_is_chain(name, h->handle);
- }
- void
- fw3_ipt_create_chain(struct fw3_ipt_handle *h, bool ignore_existing,
- const char *chain)
- {
- if (ignore_existing && is_chain(h, chain))
- return;
- if (fw3_pr_debug)
- debug(h, "-N %s\n", chain);
- iptc_create_chain(chain, h->handle);
- }
- void
- fw3_ipt_flush(struct fw3_ipt_handle *h)
- {
- const char *chain;
- #ifndef DISABLE_IPV6
- if (h->family == FW3_FAMILY_V6)
- {
- for (chain = ip6tc_first_chain(h->handle);
- chain != NULL;
- chain = ip6tc_next_chain(h->handle))
- {
- ip6tc_flush_entries(chain, h->handle);
- }
- for (chain = ip6tc_first_chain(h->handle);
- chain != NULL;
- chain = ip6tc_next_chain(h->handle))
- {
- ip6tc_delete_chain(chain, h->handle);
- }
- }
- else
- #endif
- {
- for (chain = iptc_first_chain(h->handle);
- chain != NULL;
- chain = iptc_next_chain(h->handle))
- {
- iptc_flush_entries(chain, h->handle);
- }
- for (chain = iptc_first_chain(h->handle);
- chain != NULL;
- chain = iptc_next_chain(h->handle))
- {
- iptc_delete_chain(chain, h->handle);
- }
- }
- }
- static bool
- chain_is_empty(struct fw3_ipt_handle *h, const char *chain)
- {
- #ifndef DISABLE_IPV6
- if (h->family == FW3_FAMILY_V6)
- return (!ip6tc_builtin(chain, h->handle) &&
- !ip6tc_first_rule(chain, h->handle));
- #endif
- return (!iptc_builtin(chain, h->handle) &&
- !iptc_first_rule(chain, h->handle));
- }
- void
- fw3_ipt_gc(struct fw3_ipt_handle *h)
- {
- const char *chain;
- bool found;
- #ifndef DISABLE_IPV6
- if (h->family == FW3_FAMILY_V6)
- {
- do {
- found = false;
- for (chain = ip6tc_first_chain(h->handle);
- chain != NULL;
- chain = ip6tc_next_chain(h->handle))
- {
- if (!chain_is_empty(h, chain))
- continue;
- fw3_ipt_delete_chain(h, false, chain);
- found = true;
- break;
- }
- } while(found);
- }
- else
- #endif
- {
- do {
- found = false;
- for (chain = iptc_first_chain(h->handle);
- chain != NULL;
- chain = iptc_next_chain(h->handle))
- {
- warn("C=%s\n", chain);
- if (!chain_is_empty(h, chain))
- continue;
- warn("D=%s\n", chain);
- fw3_ipt_delete_chain(h, false, chain);
- found = true;
- break;
- }
- } while (found);
- }
- }
- void
- fw3_ipt_commit(struct fw3_ipt_handle *h)
- {
- int rv;
- #ifndef DISABLE_IPV6
- if (h->family == FW3_FAMILY_V6)
- {
- rv = ip6tc_commit(h->handle);
- if (!rv)
- warn("ip6tc_commit(): %s", ip6tc_strerror(errno));
- }
- else
- #endif
- {
- rv = iptc_commit(h->handle);
- if (!rv)
- warn("iptc_commit(): %s", iptc_strerror(errno));
- }
- }
- void
- fw3_ipt_close(struct fw3_ipt_handle *h)
- {
- fw3_unlock_path(&xt_lock_fd, XT_LOCK_NAME);
- free(h);
- }
- struct fw3_ipt_rule *
- fw3_ipt_rule_new(struct fw3_ipt_handle *h)
- {
- struct fw3_ipt_rule *r;
- r = fw3_alloc(sizeof(*r));
- r->h = h;
- r->argv = fw3_alloc(sizeof(char *));
- r->argv[r->argc++] = "fw3";
- return r;
- }
- static char *
- get_protoname(struct fw3_ipt_rule *r)
- {
- const struct xtables_pprot *pp;
- if (r->protocol)
- for (pp = xtables_chain_protos; pp->name; pp++)
- if (pp->num == r->protocol)
- return (char *)pp->name;
- return NULL;
- }
- static struct xtables_match *
- find_match(struct fw3_ipt_rule *r, const char *name)
- {
- struct xtables_match *m;
- xext.retain = true;
- m = xtables_find_match(name, XTF_TRY_LOAD, &r->matches);
- xext.retain = false;
- return m;
- }
- static void
- init_match(struct fw3_ipt_rule *r, struct xtables_match *m, bool no_clone)
- {
- size_t s;
- struct xtables_globals *g;
- if (!m)
- return;
- s = XT_ALIGN(sizeof(struct xt_entry_match)) + m->size;
- m->m = fw3_alloc(s);
- fw3_xt_set_match_name(m);
- m->m->u.user.revision = m->revision;
- m->m->u.match_size = s;
- /* free previous userspace data */
- fw3_xt_free_match_udata(m);
- if (m->init)
- m->init(m->m);
- /* don't merge options if no_clone is set and this match is a clone */
- if (no_clone && (m == m->next))
- return;
- /* merge option table */
- g = (r->h->family == FW3_FAMILY_V6) ? &xtg6 : &xtg;
- fw3_xt_merge_match_options(g, m);
- }
- static bool
- need_protomatch(struct fw3_ipt_rule *r, const char *pname)
- {
- struct xtables_match *match;
- if (!pname)
- return false;
- match = xtables_find_match(pname, XTF_DONT_LOAD, NULL);
- if (!match)
- return true;
- /* Free any kind of clone from xtables_find_match */
- if (match == match->next)
- free(match);
- return !r->protocol_loaded;
- }
- static struct xtables_match *
- load_protomatch(struct fw3_ipt_rule *r)
- {
- const char *pname = get_protoname(r);
- if (!need_protomatch(r, pname))
- return NULL;
- return find_match(r, pname);
- }
- static struct xtables_target *
- find_target(struct fw3_ipt_rule *r, const char *name)
- {
- struct xtables_target *t;
- xext.retain = true;
- if (is_chain(r->h, name))
- t = xtables_find_target(XT_STANDARD_TARGET, XTF_TRY_LOAD);
- else
- t = xtables_find_target(name, XTF_TRY_LOAD);
- xext.retain = false;
- return t;
- }
- static struct xtables_target *
- get_target(struct fw3_ipt_rule *r, const char *name)
- {
- size_t s;
- struct xtables_target *t;
- struct xtables_globals *g;
- t = find_target(r, name);
- if (!t)
- return NULL;
- s = XT_ALIGN(sizeof(struct xt_entry_target)) + t->size;
- t->t = fw3_alloc(s);
- fw3_xt_set_target_name(t, name);
- t->t->u.user.revision = t->revision;
- t->t->u.target_size = s;
- /* free previous userspace data */
- fw3_xt_free_target_udata(t);
- if (t->init)
- t->init(t->t);
- /* merge option table */
- g = (r->h->family == FW3_FAMILY_V6) ? &xtg6 : &xtg;
- fw3_xt_merge_target_options(g, t);
- r->target = t;
- return t;
- }
- void
- fw3_ipt_rule_proto(struct fw3_ipt_rule *r, struct fw3_protocol *proto)
- {
- uint32_t pr;
- if (!proto || proto->any)
- return;
- pr = proto->protocol;
- #ifndef DISABLE_IPV6
- if (r->h->family == FW3_FAMILY_V6)
- {
- if (pr == 1)
- pr = 58;
- r->e6.ipv6.proto = pr;
- r->e6.ipv6.flags |= IP6T_F_PROTO;
- if (proto->invert)
- r->e6.ipv6.invflags |= XT_INV_PROTO;
- }
- else
- #endif
- {
- r->e.ip.proto = pr;
- if (proto->invert)
- r->e.ip.invflags |= XT_INV_PROTO;
- }
- r->protocol = pr;
- }
- void
- fw3_ipt_rule_in_out(struct fw3_ipt_rule *r,
- struct fw3_device *in, struct fw3_device *out)
- {
- #ifndef DISABLE_IPV6
- if (r->h->family == FW3_FAMILY_V6)
- {
- if (in && !in->any)
- {
- xtables_parse_interface(in->name, r->e6.ipv6.iniface,
- r->e6.ipv6.iniface_mask);
- if (in->invert)
- r->e6.ipv6.invflags |= IP6T_INV_VIA_IN;
- }
- if (out && !out->any)
- {
- xtables_parse_interface(out->name, r->e6.ipv6.outiface,
- r->e6.ipv6.outiface_mask);
- if (out->invert)
- r->e6.ipv6.invflags |= IP6T_INV_VIA_OUT;
- }
- }
- else
- #endif
- {
- if (in && !in->any)
- {
- xtables_parse_interface(in->name, r->e.ip.iniface,
- r->e.ip.iniface_mask);
- if (in->invert)
- r->e.ip.invflags |= IPT_INV_VIA_IN;
- }
- if (out && !out->any)
- {
- xtables_parse_interface(out->name, r->e.ip.outiface,
- r->e.ip.outiface_mask);
- if (out->invert)
- r->e.ip.invflags |= IPT_INV_VIA_OUT;
- }
- }
- }
- void
- fw3_ipt_rule_src_dest(struct fw3_ipt_rule *r,
- struct fw3_address *src, struct fw3_address *dest)
- {
- if ((src && src->range) || (dest && dest->range))
- {
- fw3_ipt_rule_addarg(r, false, "-m", "iprange");
- }
- if (src && src->set)
- {
- if (src->range)
- {
- fw3_ipt_rule_addarg(r, src->invert, "--src-range",
- fw3_address_to_string(src, false, false));
- }
- #ifndef DISABLE_IPV6
- else if (r->h->family == FW3_FAMILY_V6)
- {
- r->e6.ipv6.src = src->address.v6;
- r->e6.ipv6.smsk = src->mask.v6;
- int i;
- for (i = 0; i < 4; i++)
- r->e6.ipv6.src.s6_addr32[i] &= r->e6.ipv6.smsk.s6_addr32[i];
- if (src->invert)
- r->e6.ipv6.invflags |= IP6T_INV_SRCIP;
- }
- #endif
- else
- {
- r->e.ip.src = src->address.v4;
- r->e.ip.smsk = src->mask.v4;
- r->e.ip.src.s_addr &= r->e.ip.smsk.s_addr;
- if (src->invert)
- r->e.ip.invflags |= IPT_INV_SRCIP;
- }
- }
- if (dest && dest->set)
- {
- if (dest->range)
- {
- fw3_ipt_rule_addarg(r, dest->invert, "--dst-range",
- fw3_address_to_string(dest, false, false));
- }
- #ifndef DISABLE_IPV6
- else if (r->h->family == FW3_FAMILY_V6)
- {
- r->e6.ipv6.dst = dest->address.v6;
- r->e6.ipv6.dmsk = dest->mask.v6;
- int i;
- for (i = 0; i < 4; i++)
- r->e6.ipv6.dst.s6_addr32[i] &= r->e6.ipv6.dmsk.s6_addr32[i];
- if (dest->invert)
- r->e6.ipv6.invflags |= IP6T_INV_DSTIP;
- }
- #endif
- else
- {
- r->e.ip.dst = dest->address.v4;
- r->e.ip.dmsk = dest->mask.v4;
- r->e.ip.dst.s_addr &= r->e.ip.dmsk.s_addr;
- if (dest->invert)
- r->e.ip.invflags |= IPT_INV_DSTIP;
- }
- }
- }
- void
- fw3_ipt_rule_sport_dport(struct fw3_ipt_rule *r,
- struct fw3_port *sp, struct fw3_port *dp)
- {
- char buf[sizeof("65535:65535")];
- if ((!sp || !sp->set) && (!dp || !dp->set))
- return;
- if (!get_protoname(r))
- return;
- if (sp && sp->set)
- {
- if (sp->port_min == sp->port_max)
- snprintf(buf, sizeof(buf), "%u", sp->port_min);
- else
- snprintf(buf, sizeof(buf), "%u:%u", sp->port_min, sp->port_max);
- fw3_ipt_rule_addarg(r, sp->invert, "--sport", buf);
- }
- if (dp && dp->set)
- {
- if (dp->port_min == dp->port_max)
- snprintf(buf, sizeof(buf), "%u", dp->port_min);
- else
- snprintf(buf, sizeof(buf), "%u:%u", dp->port_min, dp->port_max);
- fw3_ipt_rule_addarg(r, dp->invert, "--dport", buf);
- }
- }
- void
- fw3_ipt_rule_device(struct fw3_ipt_rule *r, const char *device, bool out)
- {
- struct fw3_device dev = { .any = false };
- if (device) {
- snprintf(dev.name, sizeof(dev.name), "%s", device);
- fw3_ipt_rule_in_out(r, (out) ? NULL : &dev, (out) ? &dev : NULL);
- }
- }
- void
- fw3_ipt_rule_mac(struct fw3_ipt_rule *r, struct fw3_mac *mac)
- {
- char buf[sizeof("ff:ff:ff:ff:ff:ff")];
- uint8_t *addr = mac->mac.ether_addr_octet;
- if (!mac)
- return;
- snprintf(buf, sizeof(buf), "%02x:%02x:%02x:%02x:%02x:%02x",
- addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]);
- fw3_ipt_rule_addarg(r, false, "-m", "mac");
- fw3_ipt_rule_addarg(r, mac->invert, "--mac-source", buf);
- }
- void
- fw3_ipt_rule_icmptype(struct fw3_ipt_rule *r, struct fw3_icmptype *icmp)
- {
- char buf[sizeof("255/255")];
- if (!icmp)
- return;
- #ifndef DISABLE_IPV6
- if (r->h->family == FW3_FAMILY_V6)
- {
- if (icmp->code6_min == 0 && icmp->code6_max == 0xFF)
- snprintf(buf, sizeof(buf), "%u", icmp->type6);
- else
- snprintf(buf, sizeof(buf), "%u/%u", icmp->type6, icmp->code6_min);
- fw3_ipt_rule_addarg(r, icmp->invert, "--icmpv6-type", buf);
- }
- else
- #endif
- {
- if (icmp->code_min == 0 && icmp->code_max == 0xFF)
- snprintf(buf, sizeof(buf), "%u", icmp->type);
- else
- snprintf(buf, sizeof(buf), "%u/%u", icmp->type, icmp->code_min);
- fw3_ipt_rule_addarg(r, icmp->invert, "--icmp-type", buf);
- }
- }
- void
- fw3_ipt_rule_limit(struct fw3_ipt_rule *r, struct fw3_limit *limit)
- {
- char buf[sizeof("-4294967296/second")];
- if (!limit || limit->rate <= 0)
- return;
- fw3_ipt_rule_addarg(r, false, "-m", "limit");
- snprintf(buf, sizeof(buf), "%u/%s", limit->rate, fw3_limit_units[limit->unit]);
- fw3_ipt_rule_addarg(r, limit->invert, "--limit", buf);
- if (limit->burst > 0)
- {
- snprintf(buf, sizeof(buf), "%u", limit->burst);
- fw3_ipt_rule_addarg(r, limit->invert, "--limit-burst", buf);
- }
- }
- void
- fw3_ipt_rule_ipset(struct fw3_ipt_rule *r, struct fw3_setmatch *match)
- {
- char buf[sizeof("dst,dst,dst")];
- char *p = buf;
- int i = 0, len;
- size_t rem = sizeof(buf);
- struct fw3_ipset *set;
- struct fw3_ipset_datatype *type;
- if (!match || !match->set || !match->ptr)
- return;
- set = match->ptr;
- list_for_each_entry(type, &set->datatypes, list)
- {
- if (i >= 3)
- break;
- if (p > buf) {
- if (rem <= 1)
- break;
- *p++ = ',';
- *p = 0;
- rem--;
- }
- len = snprintf(p, rem, "%s", match->dir[i] ? match->dir[i] : type->dir);
- if (len < 0 || len >= rem)
- break;
- rem -= len;
- p += len;
- i++;
- }
- fw3_ipt_rule_addarg(r, false, "-m", "set");
- fw3_ipt_rule_addarg(r, match->invert, "--match-set",
- set->external ? set->external : set->name);
- fw3_ipt_rule_addarg(r, false, buf, NULL);
- }
- void
- fw3_ipt_rule_helper(struct fw3_ipt_rule *r, struct fw3_cthelpermatch *match)
- {
- if (!match || !match->set || !match->ptr)
- return;
- fw3_ipt_rule_addarg(r, false, "-m", "helper");
- fw3_ipt_rule_addarg(r, match->invert, "--helper", match->ptr->name);
- }
- void
- fw3_ipt_rule_time(struct fw3_ipt_rule *r, struct fw3_time *time)
- {
- int i, len;
- struct tm empty = { 0 };
- char buf[84]; /* sizeof("1,2,3,...,30,31") */
- char *p;
- bool d1 = memcmp(&time->datestart, &empty, sizeof(empty));
- bool d2 = memcmp(&time->datestop, &empty, sizeof(empty));
- size_t rem;
- if (!d1 && !d2 && !time->timestart && !time->timestop &&
- !(time->monthdays & 0xFFFFFFFE) && !(time->weekdays & 0xFE))
- {
- return;
- }
- fw3_ipt_rule_addarg(r, false, "-m", "time");
- if (!time->utc)
- fw3_ipt_rule_addarg(r, false, "--kerneltz", NULL);
- if (d1)
- {
- strftime(buf, sizeof(buf), "%Y-%m-%dT%H:%M:%S", &time->datestart);
- fw3_ipt_rule_addarg(r, false, "--datestart", buf);
- }
- if (d2)
- {
- strftime(buf, sizeof(buf), "%Y-%m-%dT%H:%M:%S", &time->datestop);
- fw3_ipt_rule_addarg(r, false, "--datestop", buf);
- }
- if (time->timestart)
- {
- snprintf(buf, sizeof(buf), "%02d:%02d:%02d",
- time->timestart / 3600,
- time->timestart % 3600 / 60,
- time->timestart % 60);
- fw3_ipt_rule_addarg(r, false, "--timestart", buf);
- }
- if (time->timestop)
- {
- snprintf(buf, sizeof(buf), "%02d:%02d:%02d",
- time->timestop / 3600,
- time->timestop % 3600 / 60,
- time->timestop % 60);
- fw3_ipt_rule_addarg(r, false, "--timestop", buf);
- }
- if (time->monthdays & 0xFFFFFFFE)
- {
- for (i = 1, p = buf, rem = sizeof(buf); i < 32; i++)
- {
- if (fw3_hasbit(time->monthdays, i))
- {
- if (p > buf) {
- if (rem <= 1)
- break;
- *p++ = ',';
- *p = 0;
- rem--;
- }
- len = snprintf(p, rem, "%u", i);
- if (len < 0 || len >= rem)
- break;
- rem -= len;
- p += len;
- }
- }
- fw3_ipt_rule_addarg(r, fw3_hasbit(time->monthdays, 0), "--monthdays", buf);
- }
- if (time->weekdays & 0xFE)
- {
- for (i = 1, p = buf, rem = sizeof(buf); i < 8; i++)
- {
- if (fw3_hasbit(time->weekdays, i))
- {
- if (p > buf) {
- if (rem <= 1)
- break;
- *p++ = ',';
- *p = 0;
- rem--;
- }
- len = snprintf(p, rem, "%u", i);
- if (len < 0 || len >= rem)
- break;
- rem -= len;
- p += len;
- }
- }
- fw3_ipt_rule_addarg(r, fw3_hasbit(time->weekdays, 0), "--weekdays", buf);
- }
- }
- void
- fw3_ipt_rule_mark(struct fw3_ipt_rule *r, struct fw3_mark *mark)
- {
- char buf[sizeof("0xFFFFFFFF/0xFFFFFFFF")];
- if (!mark || !mark->set)
- return;
- if (mark->mask < 0xFFFFFFFF)
- snprintf(buf, sizeof(buf), "0x%x/0x%x", mark->mark, mark->mask);
- else
- snprintf(buf, sizeof(buf), "0x%x", mark->mark);
- fw3_ipt_rule_addarg(r, false, "-m", "mark");
- fw3_ipt_rule_addarg(r, mark->invert, "--mark", buf);
- }
- void
- fw3_ipt_rule_dscp(struct fw3_ipt_rule *r, struct fw3_dscp *dscp)
- {
- char buf[sizeof("0xFF")];
- if (!dscp || !dscp->set)
- return;
- snprintf(buf, sizeof(buf), "0x%x", dscp->dscp);
- fw3_ipt_rule_addarg(r, false, "-m", "dscp");
- fw3_ipt_rule_addarg(r, dscp->invert, "--dscp", buf);
- }
- void
- fw3_ipt_rule_comment(struct fw3_ipt_rule *r, const char *fmt, ...)
- {
- va_list ap;
- char buf[256];
- if (!fmt || !*fmt)
- return;
- va_start(ap, fmt);
- vsnprintf(buf, sizeof(buf), fmt, ap);
- va_end(ap);
- fw3_ipt_rule_addarg(r, false, "-m", "comment");
- fw3_ipt_rule_addarg(r, false, "--comment", buf);
- }
- void
- fw3_ipt_rule_extra(struct fw3_ipt_rule *r, const char *extra)
- {
- char *p, **tmp, *s;
- if (!extra || !*extra)
- return;
- s = fw3_strdup(extra);
- for (p = strtok(s, " \t"); p; p = strtok(NULL, " \t"))
- {
- tmp = realloc(r->argv, (r->argc + 1) * sizeof(*r->argv));
- if (!tmp)
- break;
- r->argv = tmp;
- r->argv[r->argc++] = fw3_strdup(p);
- }
- free(s);
- }
- #ifndef DISABLE_IPV6
- static void
- rule_print6(struct ip6t_entry *e)
- {
- char buf1[INET6_ADDRSTRLEN], buf2[INET6_ADDRSTRLEN];
- char *pname;
- if (e->ipv6.flags & IP6T_F_PROTO)
- {
- if (e->ipv6.invflags & XT_INV_PROTO)
- printf(" !");
- pname = get_protoname(container_of(e, struct fw3_ipt_rule, e6));
- if (pname)
- printf(" -p %s", pname);
- else
- printf(" -p %u", e->ipv6.proto);
- }
- if (e->ipv6.iniface[0])
- {
- if (e->ipv6.invflags & IP6T_INV_VIA_IN)
- printf(" !");
- printf(" -i %s", e->ipv6.iniface);
- }
- if (e->ipv6.outiface[0])
- {
- if (e->ipv6.invflags & IP6T_INV_VIA_OUT)
- printf(" !");
- printf(" -o %s", e->ipv6.outiface);
- }
- if (memcmp(&e->ipv6.src, &in6addr_any, sizeof(struct in6_addr)))
- {
- if (e->ipv6.invflags & IP6T_INV_SRCIP)
- printf(" !");
- printf(" -s %s/%s",
- inet_ntop(AF_INET6, &e->ipv6.src, buf1, sizeof(buf1)),
- inet_ntop(AF_INET6, &e->ipv6.smsk, buf2, sizeof(buf2)));
- }
- if (memcmp(&e->ipv6.dst, &in6addr_any, sizeof(struct in6_addr)))
- {
- if (e->ipv6.invflags & IP6T_INV_DSTIP)
- printf(" !");
- printf(" -d %s/%s",
- inet_ntop(AF_INET6, &e->ipv6.dst, buf1, sizeof(buf1)),
- inet_ntop(AF_INET6, &e->ipv6.dmsk, buf2, sizeof(buf2)));
- }
- }
- #endif
- static void
- rule_print4(struct ipt_entry *e)
- {
- struct in_addr in_zero = { 0 };
- char buf1[sizeof("255.255.255.255")], buf2[sizeof("255.255.255.255")];
- char *pname;
- if (e->ip.proto)
- {
- if (e->ip.invflags & XT_INV_PROTO)
- printf(" !");
- pname = get_protoname(container_of(e, struct fw3_ipt_rule, e));
- if (pname)
- printf(" -p %s", pname);
- else
- printf(" -p %u", e->ip.proto);
- }
- if (e->ip.iniface[0])
- {
- if (e->ip.invflags & IPT_INV_VIA_IN)
- printf(" !");
- printf(" -i %s", e->ip.iniface);
- }
- if (e->ip.outiface[0])
- {
- if (e->ip.invflags & IPT_INV_VIA_OUT)
- printf(" !");
- printf(" -o %s", e->ip.outiface);
- }
- if (memcmp(&e->ip.src, &in_zero, sizeof(struct in_addr)))
- {
- if (e->ip.invflags & IPT_INV_SRCIP)
- printf(" !");
- printf(" -s %s/%s",
- inet_ntop(AF_INET, &e->ip.src, buf1, sizeof(buf1)),
- inet_ntop(AF_INET, &e->ip.smsk, buf2, sizeof(buf2)));
- }
- if (memcmp(&e->ip.dst, &in_zero, sizeof(struct in_addr)))
- {
- if (e->ip.invflags & IPT_INV_DSTIP)
- printf(" !");
- printf(" -d %s/%s",
- inet_ntop(AF_INET, &e->ip.dst, buf1, sizeof(buf1)),
- inet_ntop(AF_INET, &e->ip.dmsk, buf2, sizeof(buf2)));
- }
- }
- static void
- rule_print(struct fw3_ipt_rule *r, const char *prefix, const char *chain)
- {
- debug(r->h, "%s %s", prefix, chain);
- #ifndef DISABLE_IPV6
- if (r->h->family == FW3_FAMILY_V6)
- rule_print6(&r->e6);
- else
- #endif
- rule_print4(&r->e);
- fw3_xt_print_matches(&r->e.ip, r->matches);
- fw3_xt_print_target(&r->e.ip, r->target);
- printf("\n");
- }
- static bool
- parse_option(struct fw3_ipt_rule *r, int optc, bool inv)
- {
- struct xtables_rule_match *m;
- struct xtables_match *em;
- /* is a target option */
- if (r->target && fw3_xt_has_target_parse(r->target) &&
- optc >= r->target->option_offset &&
- optc < (r->target->option_offset + 256))
- {
- xtables_option_tpcall(optc, r->argv, inv, r->target, &r->e);
- return false;
- }
- /* try to dispatch argument to one of the match parsers */
- for (m = r->matches; m; m = m->next)
- {
- em = m->match;
- if (m->completed || !fw3_xt_has_match_parse(em))
- continue;
- if (optc < em->option_offset ||
- optc >= (em->option_offset + 256))
- continue;
- xtables_option_mpcall(optc, r->argv, inv, em, &r->e);
- return false;
- }
- /* unhandled option, might belong to a protocol match */
- if ((em = load_protomatch(r)) != NULL)
- {
- init_match(r, em, false);
- r->protocol_loaded = true;
- optind--;
- return true;
- }
- if (optc == ':')
- warn("parse_option(): option '%s' needs argument", r->argv[optind-1]);
- if (optc == '?')
- warn("parse_option(): unknown option '%s'", r->argv[optind-1]);
- return false;
- }
- void
- fw3_ipt_rule_addarg(struct fw3_ipt_rule *r, bool inv,
- const char *k, const char *v)
- {
- int n;
- char **tmp;
- if (!k)
- return;
- n = inv + !!k + !!v;
- tmp = realloc(r->argv, (r->argc + n) * sizeof(*tmp));
- if (!tmp)
- return;
- r->argv = tmp;
- if (inv)
- r->argv[r->argc++] = fw3_strdup("!");
- r->argv[r->argc++] = fw3_strdup(k);
- if (v)
- r->argv[r->argc++] = fw3_strdup(v);
- }
- static unsigned char *
- rule_mask(struct fw3_ipt_rule *r)
- {
- size_t s;
- unsigned char *p, *mask = NULL;
- struct xtables_rule_match *m;
- #define SZ(x) XT_ALIGN(sizeof(struct x))
- #ifndef DISABLE_IPV6
- if (r->h->family == FW3_FAMILY_V6)
- {
- s = SZ(ip6t_entry);
- for (m = r->matches; m; m = m->next)
- s += SZ(ip6t_entry_match) + m->match->size;
- s += SZ(ip6t_entry_target);
- if (r->target)
- s += r->target->size;
- mask = fw3_alloc(s);
- memset(mask, 0xFF, SZ(ip6t_entry));
- p = mask + SZ(ip6t_entry);
- for (m = r->matches; m; m = m->next)
- {
- memset(p, 0xFF, SZ(ip6t_entry_match) + m->match->userspacesize);
- p += SZ(ip6t_entry_match) + m->match->size;
- }
- memset(p, 0xFF, SZ(ip6t_entry_target) + (r->target ? r->target->userspacesize : 0));
- }
- else
- #endif
- {
- s = SZ(ipt_entry);
- for (m = r->matches; m; m = m->next)
- s += SZ(ipt_entry_match) + m->match->size;
- s += SZ(ipt_entry_target);
- if (r->target)
- s += r->target->size;
- mask = fw3_alloc(s);
- memset(mask, 0xFF, SZ(ipt_entry));
- p = mask + SZ(ipt_entry);
- for (m = r->matches; m; m = m->next)
- {
- memset(p, 0xFF, SZ(ipt_entry_match) + m->match->userspacesize);
- p += SZ(ipt_entry_match) + m->match->size;
- }
- memset(p, 0xFF, SZ(ipt_entry_target) + (r->target ? r->target->userspacesize : 0));
- }
- return mask;
- }
- static void *
- rule_build(struct fw3_ipt_rule *r)
- {
- size_t s, target_size = (r->target) ? r->target->t->u.target_size : 0;
- struct xtables_rule_match *m;
- #ifndef DISABLE_IPV6
- if (r->h->family == FW3_FAMILY_V6)
- {
- struct ip6t_entry *e6;
- s = XT_ALIGN(sizeof(struct ip6t_entry));
- for (m = r->matches; m; m = m->next)
- s += m->match->m->u.match_size;
- e6 = fw3_alloc(s + target_size);
- memcpy(e6, &r->e6, sizeof(struct ip6t_entry));
- e6->target_offset = s;
- e6->next_offset = s + target_size;
- s = 0;
- for (m = r->matches; m; m = m->next)
- {
- memcpy(e6->elems + s, m->match->m, m->match->m->u.match_size);
- s += m->match->m->u.match_size;
- }
- if (target_size)
- memcpy(e6->elems + s, r->target->t, target_size);
- return e6;
- }
- else
- #endif
- {
- struct ipt_entry *e;
- s = XT_ALIGN(sizeof(struct ipt_entry));
- for (m = r->matches; m; m = m->next)
- s += m->match->m->u.match_size;
- e = fw3_alloc(s + target_size);
- memcpy(e, &r->e, sizeof(struct ipt_entry));
- e->target_offset = s;
- e->next_offset = s + target_size;
- s = 0;
- for (m = r->matches; m; m = m->next)
- {
- memcpy(e->elems + s, m->match->m, m->match->m->u.match_size);
- s += m->match->m->u.match_size;
- }
- if (target_size)
- memcpy(e->elems + s, r->target->t, target_size);
- return e;
- }
- }
- static void
- set_rule_tag(struct fw3_ipt_rule *r)
- {
- int i;
- char *p, **tmp;
- const char *tag = "!fw3";
- for (i = 0; i < r->argc; i++)
- if (!strcmp(r->argv[i], "--comment") && (i + 1) < r->argc)
- if (asprintf(&p, "%s: %s", tag, r->argv[i + 1]) > 0)
- {
- free(r->argv[i + 1]);
- r->argv[i + 1] = p;
- return;
- }
- tmp = realloc(r->argv, (r->argc + 4) * sizeof(*r->argv));
- if (tmp)
- {
- r->argv = tmp;
- r->argv[r->argc++] = fw3_strdup("-m");
- r->argv[r->argc++] = fw3_strdup("comment");
- r->argv[r->argc++] = fw3_strdup("--comment");
- r->argv[r->argc++] = fw3_strdup(tag);
- }
- }
- void
- __fw3_ipt_rule_append(struct fw3_ipt_rule *r, bool repl, const char *fmt, ...)
- {
- void *rule;
- unsigned char *mask;
- struct xtables_rule_match *m;
- struct xtables_match *em;
- struct xtables_target *et;
- struct xtables_globals *g;
- struct fw3_device dev;
- struct fw3_address addr;
- enum xtables_exittype status;
- int i, optc;
- bool inv = false;
- char buf[32];
- va_list ap;
- va_start(ap, fmt);
- vsnprintf(buf, sizeof(buf) - 1, fmt, ap);
- va_end(ap);
- g = (r->h->family == FW3_FAMILY_V6) ? &xtg6 : &xtg;
- g->opts = g->orig_opts;
- optind = 0;
- opterr = 0;
- status = setjmp(fw3_ipt_error_jmp);
- if (status > 0)
- {
- info(" ! Skipping due to previous exception (code %u)", status);
- goto free;
- }
- set_rule_tag(r);
- while ((optc = getopt_long(r->argc, r->argv, "-:m:j:i:o:s:d:", g->opts,
- NULL)) != -1)
- {
- switch (optc)
- {
- case 'm':
- em = find_match(r, optarg);
- if (!em)
- {
- warn("fw3_ipt_rule_append(): Can't find match '%s'", optarg);
- goto free;
- }
- init_match(r, em, true);
- break;
- case 'j':
- et = get_target(r, optarg);
- if (!et)
- {
- warn("fw3_ipt_rule_append(): Can't find target '%s'", optarg);
- goto free;
- }
- break;
- case 'i':
- case 'o':
- if (!fw3_parse_device(&dev, optarg, false) ||
- dev.any || dev.invert || *dev.network)
- {
- warn("fw3_ipt_rule_append(): Bad argument '%s'", optarg);
- goto free;
- }
- dev.invert = inv;
- fw3_ipt_rule_in_out(r, (optc == 'i') ? &dev : NULL,
- (optc == 'o') ? &dev : NULL);
- break;
- case 's':
- case 'd':
- if (!fw3_parse_address(&addr, optarg, false) ||
- addr.range || addr.invert)
- {
- warn("fw3_ipt_rule_append(): Bad argument '%s'", optarg);
- goto free;
- }
- addr.invert = inv;
- fw3_ipt_rule_src_dest(r, (optc == 's') ? &addr : NULL,
- (optc == 'd') ? &addr : NULL);
- break;
- case 1:
- if ((optarg[0] == '!') && (optarg[1] == '\0'))
- {
- optarg[0] = '\0';
- inv = true;
- continue;
- }
- warn("fw3_ipt_rule_append(): Bad argument '%s'", optarg);
- goto free;
- default:
- if (parse_option(r, optc, inv))
- continue;
- break;
- }
- inv = false;
- }
- for (m = r->matches; m; m = m->next)
- xtables_option_mfcall(m->match);
- if (r->target)
- xtables_option_tfcall(r->target);
- rule = rule_build(r);
- #ifndef DISABLE_IPV6
- if (r->h->family == FW3_FAMILY_V6)
- {
- if (repl)
- {
- mask = rule_mask(r);
- while (ip6tc_delete_entry(buf, rule, mask, r->h->handle))
- if (fw3_pr_debug)
- rule_print(r, "-D", buf);
- free(mask);
- }
- if (fw3_pr_debug)
- rule_print(r, "-A", buf);
- if (!ip6tc_append_entry(buf, rule, r->h->handle))
- warn("ip6tc_append_entry(): %s", ip6tc_strerror(errno));
- }
- else
- #endif
- {
- if (repl)
- {
- mask = rule_mask(r);
- while (iptc_delete_entry(buf, rule, mask, r->h->handle))
- if (fw3_pr_debug)
- rule_print(r, "-D", buf);
- free(mask);
- }
- if (fw3_pr_debug)
- rule_print(r, "-A", buf);
- if (!iptc_append_entry(buf, rule, r->h->handle))
- warn("iptc_append_entry(): %s\n", iptc_strerror(errno));
- }
- free(rule);
- free:
- for (i = 1; i < r->argc; i++)
- free(r->argv[i]);
- free(r->argv);
- xtables_rule_matches_free(&r->matches);
- if (r->target)
- free(r->target->t);
- free(r);
- /* reset all targets and matches */
- for (em = xtables_matches; em; em = em->next)
- em->mflags = 0;
- for (et = xtables_targets; et; et = et->next)
- {
- et->tflags = 0;
- et->used = 0;
- }
- xtables_free_opts(1);
- }
- struct fw3_ipt_rule *
- fw3_ipt_rule_create(struct fw3_ipt_handle *handle, struct fw3_protocol *proto,
- struct fw3_device *in, struct fw3_device *out,
- struct fw3_address *src, struct fw3_address *dest)
- {
- struct fw3_ipt_rule *r;
- r = fw3_ipt_rule_new(handle);
- fw3_ipt_rule_proto(r, proto);
- fw3_ipt_rule_in_out(r, in, out);
- fw3_ipt_rule_src_dest(r, src, dest);
- return r;
- }
- void
- xtables_register_match(struct xtables_match *me)
- {
- int i;
- static struct xtables_match **tmp;
- if (!xext.register_match)
- xext.register_match = dlsym(RTLD_NEXT, "xtables_register_match");
- if (!xext.register_match)
- return;
- xext.register_match(me);
- if (xext.retain)
- {
- for (i = 0; i < xext.mcount; i++)
- if (xext.matches[i] == me)
- return;
- tmp = realloc(xext.matches, sizeof(me) * (xext.mcount + 1));
- if (!tmp)
- return;
- xext.matches = tmp;
- xext.matches[xext.mcount++] = me;
- }
- }
- void
- xtables_register_target(struct xtables_target *me)
- {
- int i;
- static struct xtables_target **tmp;
- if (!xext.register_target)
- xext.register_target = dlsym(RTLD_NEXT, "xtables_register_target");
- if (!xext.register_target)
- return;
- xext.register_target(me);
- if (xext.retain)
- {
- for (i = 0; i < xext.tcount; i++)
- if (xext.targets[i] == me)
- return;
- tmp = realloc(xext.targets, sizeof(me) * (xext.tcount + 1));
- if (!tmp)
- return;
- xext.targets = tmp;
- xext.targets[xext.tcount++] = me;
- }
- }
|