1 /* 2 * firewall3 - 3rd OpenWrt UCI firewall implementation 3 * 4 * Copyright (C) 2013 Jo-Philipp Wich <jo@mein.io> 5 * 6 * Permission to use, copy, modify, and/or distribute this software for any 7 * purpose with or without fee is hereby granted, provided that the above 8 * copyright notice and this permission notice appear in all copies. 9 * 10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 17 */ 18 19 #define _GNU_SOURCE /* RTLD_NEXT */ 20 21 /* include userspace headers */ 22 #include <dlfcn.h> 23 #include <unistd.h> 24 #include <getopt.h> 25 #include <net/if.h> 26 #include <netinet/in.h> 27 #include <sys/utsname.h> 28 #include <sys/socket.h> 29 30 /* prevent indirect inclusion of kernel headers */ 31 #define _LINUX_IF_H 32 #define _LINUX_IN_H 33 #define _LINUX_IN6_H 34 35 /* prevent libiptc from including kernel headers */ 36 #define _FWCHAINS_KERNEL_HEADERS_H 37 38 /* finally include libiptc and xtables */ 39 #include <libiptc/libiptc.h> 40 #include <libiptc/libip6tc.h> 41 #include <xtables.h> 42 43 #include <setjmp.h> 44 45 #include "options.h" 46 47 /* xtables interface */ 48 #if (XTABLES_VERSION_CODE >= 10) 49 # include "xtables-10.h" 50 #elif (XTABLES_VERSION_CODE == 5) 51 # include "xtables-5.h" 52 #else 53 # error "Unsupported xtables version" 54 #endif 55 56 #include "iptables.h" 57 58 #define XT_LOCK_NAME "/var/run/xtables.lock" 59 static int xt_lock_fd = -1; 60 61 struct fw3_ipt_rule { 62 struct fw3_ipt_handle *h; 63 64 union { 65 struct ipt_entry e; 66 struct ip6t_entry e6; 67 }; 68 69 struct xtables_rule_match *matches; 70 struct xtables_target *target; 71 72 int argc; 73 char **argv; 74 75 uint32_t protocol; 76 bool protocol_loaded; 77 }; 78 79 static struct option base_opts[] = { 80 { .name = "match", .has_arg = 1, .val = 'm' }, 81 { .name = "jump", .has_arg = 1, .val = 'j' }, 82 { .name = "in-interface", .has_arg = 1, .val = 'i' }, 83 { .name = "out-interface", .has_arg = 1, .val = 'o' }, 84 { .name = "source", .has_arg = 1, .val = 's' }, 85 { .name = "destination", .has_arg = 1, .val = 'd' }, 86 { NULL } 87 }; 88 89 90 static jmp_buf fw3_ipt_error_jmp; 91 92 static __attribute__((noreturn)) 93 void fw3_ipt_error_handler(enum xtables_exittype status, 94 const char *fmt, ...) 95 { 96 va_list args; 97 98 fprintf(stderr, " ! Exception: "); 99 100 va_start(args, fmt); 101 vfprintf(stderr, fmt, args); 102 va_end(args); 103 104 longjmp(fw3_ipt_error_jmp, status); 105 } 106 107 static struct xtables_globals xtg = { 108 .option_offset = 0, 109 .program_version = "4", 110 .orig_opts = base_opts, 111 .exit_err = fw3_ipt_error_handler, 112 #if XTABLES_VERSION_CODE > 10 113 .compat_rev = xtables_compatible_revision, 114 #endif 115 }; 116 117 static struct xtables_globals xtg6 = { 118 .option_offset = 0, 119 .program_version = "6", 120 .orig_opts = base_opts, 121 .exit_err = fw3_ipt_error_handler, 122 #if XTABLES_VERSION_CODE > 10 123 .compat_rev = xtables_compatible_revision, 124 #endif 125 }; 126 127 static struct { 128 bool retain; 129 int mcount, tcount; 130 struct xtables_match **matches; 131 struct xtables_target **targets; 132 void (*register_match)(struct xtables_match *); 133 void (*register_target)(struct xtables_target *); 134 } xext; 135 136 137 /* Required by certain extensions like SNAT and DNAT */ 138 int kernel_version = 0; 139 140 void 141 get_kernel_version(void) 142 { 143 static struct utsname uts; 144 int x = 3, y = 0, z = 0; 145 146 if (uname(&uts) != -1) 147 sscanf(uts.release, "%d.%d.%d", &x, &y, &z); 148 149 kernel_version = 0x10000 * x + 0x100 * y + z; 150 } 151 152 static void fw3_init_extensions(void) 153 { 154 init_extensions(); 155 init_extensions4(); 156 157 #ifndef DISABLE_IPV6 158 init_extensions6(); 159 #endif 160 } 161 162 struct fw3_ipt_handle * 163 fw3_ipt_open(enum fw3_family family, enum fw3_table table) 164 { 165 int i; 166 struct fw3_ipt_handle *h; 167 168 h = fw3_alloc(sizeof(*h)); 169 170 xtables_init(); 171 172 while (!fw3_lock_path(&xt_lock_fd, XT_LOCK_NAME)) { 173 warn("Currently busy xtables.lock - wait 1 second"); 174 sleep(1); 175 } 176 177 if (family == FW3_FAMILY_V6) 178 { 179 #ifndef DISABLE_IPV6 180 h->family = FW3_FAMILY_V6; 181 h->table = table; 182 h->handle = ip6tc_init(fw3_flag_names[table]); 183 184 xtables_set_params(&xtg6); 185 xtables_set_nfproto(NFPROTO_IPV6); 186 #endif 187 } 188 else 189 { 190 h->family = FW3_FAMILY_V4; 191 h->table = table; 192 h->handle = iptc_init(fw3_flag_names[table]); 193 194 xtables_set_params(&xtg); 195 xtables_set_nfproto(NFPROTO_IPV4); 196 } 197 198 if (!h->handle) 199 { 200 free(h); 201 fw3_unlock_path(&xt_lock_fd, XT_LOCK_NAME); 202 return NULL; 203 } 204 205 fw3_xt_reset(); 206 fw3_init_extensions(); 207 208 if (xext.register_match) 209 for (i = 0; i < xext.mcount; i++) 210 xext.register_match(xext.matches[i]); 211 212 if (xext.register_target) 213 for (i = 0; i < xext.tcount; i++) 214 xext.register_target(xext.targets[i]); 215 216 return h; 217 } 218 219 static void 220 debug(struct fw3_ipt_handle *h, const char *fmt, ...) 221 { 222 va_list ap; 223 224 printf("%s -t %s ", (h->family == FW3_FAMILY_V6) ? "ip6tables" : "iptables", 225 fw3_flag_names[h->table]); 226 227 va_start(ap, fmt); 228 vprintf(fmt, ap); 229 va_end(ap); 230 } 231 232 void 233 fw3_ipt_set_policy(struct fw3_ipt_handle *h, const char *chain, 234 enum fw3_flag policy) 235 { 236 if (fw3_pr_debug) 237 debug(h, "-P %s %s\n", chain, fw3_flag_names[policy]); 238 239 #ifndef DISABLE_IPV6 240 if (h->family == FW3_FAMILY_V6) 241 ip6tc_set_policy(chain, fw3_flag_names[policy], NULL, h->handle); 242 else 243 #endif 244 iptc_set_policy(chain, fw3_flag_names[policy], NULL, h->handle); 245 } 246 247 void 248 fw3_ipt_flush_chain(struct fw3_ipt_handle *h, const char *chain) 249 { 250 if (fw3_pr_debug) 251 debug(h, "-F %s\n", chain); 252 253 #ifndef DISABLE_IPV6 254 if (h->family == FW3_FAMILY_V6) 255 ip6tc_flush_entries(chain, h->handle); 256 else 257 #endif 258 iptc_flush_entries(chain, h->handle); 259 } 260 261 static void 262 delete_rules(struct fw3_ipt_handle *h, const char *target) 263 { 264 unsigned int num; 265 const struct ipt_entry *e; 266 const char *chain; 267 const char *t; 268 bool found; 269 270 #ifndef DISABLE_IPV6 271 if (h->family == FW3_FAMILY_V6) 272 { 273 for (chain = ip6tc_first_chain(h->handle); 274 chain != NULL; 275 chain = ip6tc_next_chain(h->handle)) 276 { 277 do { 278 found = false; 279 280 const struct ip6t_entry *e6; 281 for (num = 0, e6 = ip6tc_first_rule(chain, h->handle); 282 e6 != NULL; 283 num++, e6 = ip6tc_next_rule(e6, h->handle)) 284 { 285 t = ip6tc_get_target(e6, h->handle); 286 287 if (*t && !strcmp(t, target)) 288 { 289 if (fw3_pr_debug) 290 debug(h, "-D %s %u\n", chain, num + 1); 291 292 ip6tc_delete_num_entry(chain, num, h->handle); 293 found = true; 294 break; 295 } 296 } 297 } while (found); 298 } 299 } 300 else 301 #endif 302 { 303 for (chain = iptc_first_chain(h->handle); 304 chain != NULL; 305 chain = iptc_next_chain(h->handle)) 306 { 307 do { 308 found = false; 309 310 for (num = 0, e = iptc_first_rule(chain, h->handle); 311 e != NULL; 312 num++, e = iptc_next_rule(e, h->handle)) 313 { 314 t = iptc_get_target(e, h->handle); 315 316 if (*t && !strcmp(t, target)) 317 { 318 if (fw3_pr_debug) 319 debug(h, "-D %s %u\n", chain, num + 1); 320 321 iptc_delete_num_entry(chain, num, h->handle); 322 found = true; 323 break; 324 } 325 } 326 } while (found); 327 } 328 } 329 } 330 331 static bool 332 is_referenced(struct fw3_ipt_handle *h, const char *target) 333 { 334 const struct ipt_entry *e; 335 const char *chain; 336 const char *t; 337 338 #ifndef DISABLE_IPV6 339 if (h->family == FW3_FAMILY_V6) 340 { 341 for (chain = ip6tc_first_chain(h->handle); 342 chain != NULL; 343 chain = ip6tc_next_chain(h->handle)) 344 { 345 const struct ip6t_entry *e6; 346 for (e6 = ip6tc_first_rule(chain, h->handle); 347 e6 != NULL; 348 e6 = ip6tc_next_rule(e6, h->handle)) 349 { 350 t = ip6tc_get_target(e6, h->handle); 351 352 if (*t && !strcmp(t, target)) 353 return true; 354 } 355 } 356 } 357 else 358 #endif 359 { 360 for (chain = iptc_first_chain(h->handle); 361 chain != NULL; 362 chain = iptc_next_chain(h->handle)) 363 { 364 for (e = iptc_first_rule(chain, h->handle); 365 e != NULL; 366 e = iptc_next_rule(e, h->handle)) 367 { 368 t = iptc_get_target(e, h->handle); 369 370 if (*t && !strcmp(t, target)) 371 return true; 372 } 373 } 374 } 375 376 return false; 377 } 378 379 void 380 fw3_ipt_delete_chain(struct fw3_ipt_handle *h, bool if_unused, 381 const char *chain) 382 { 383 if (if_unused && is_referenced(h, chain)) 384 return; 385 386 delete_rules(h, chain); 387 388 if (fw3_pr_debug) 389 debug(h, "-X %s\n", chain); 390 391 #ifndef DISABLE_IPV6 392 if (h->family == FW3_FAMILY_V6) 393 ip6tc_delete_chain(chain, h->handle); 394 else 395 #endif 396 iptc_delete_chain(chain, h->handle); 397 } 398 399 static bool 400 has_rule_tag(const void *base, unsigned int start, unsigned int end) 401 { 402 unsigned int i; 403 const struct xt_entry_match *em; 404 405 for (i = start; i < end; i += em->u.match_size) 406 { 407 em = base + i; 408 409 if (strcmp(em->u.user.name, "comment")) 410 continue; 411 412 if (!memcmp(em->data, "!fw3", 4)) 413 return true; 414 } 415 416 return false; 417 } 418 419 void 420 fw3_ipt_delete_id_rules(struct fw3_ipt_handle *h, const char *chain) 421 { 422 unsigned int num; 423 const struct ipt_entry *e; 424 bool found; 425 426 #ifndef DISABLE_IPV6 427 if (h->family == FW3_FAMILY_V6) 428 { 429 if (!ip6tc_is_chain(chain, h->handle)) 430 return; 431 432 do { 433 found = false; 434 435 const struct ip6t_entry *e6; 436 for (num = 0, e6 = ip6tc_first_rule(chain, h->handle); 437 e6 != NULL; 438 num++, e6 = ip6tc_next_rule(e6, h->handle)) 439 { 440 if (has_rule_tag(e6, sizeof(*e6), e6->target_offset)) 441 { 442 if (fw3_pr_debug) 443 debug(h, "-D %s %u\n", chain, num + 1); 444 445 ip6tc_delete_num_entry(chain, num, h->handle); 446 found = true; 447 break; 448 } 449 } 450 } while (found); 451 } 452 else 453 #endif 454 { 455 if (!iptc_is_chain(chain, h->handle)) 456 return; 457 458 do { 459 found = false; 460 461 for (num = 0, e = iptc_first_rule(chain, h->handle); 462 e != NULL; 463 num++, e = iptc_next_rule(e, h->handle)) 464 { 465 if (has_rule_tag(e, sizeof(*e), e->target_offset)) 466 { 467 if (fw3_pr_debug) 468 debug(h, "-D %s %u\n", chain, num + 1); 469 470 iptc_delete_num_entry(chain, num, h->handle); 471 found = true; 472 break; 473 } 474 } 475 } while (found); 476 } 477 } 478 479 480 static bool 481 is_chain(struct fw3_ipt_handle *h, const char *name) 482 { 483 #ifndef DISABLE_IPV6 484 if (h->family == FW3_FAMILY_V6) 485 return ip6tc_is_chain(name, h->handle); 486 else 487 #endif 488 return iptc_is_chain(name, h->handle); 489 } 490 491 void 492 fw3_ipt_create_chain(struct fw3_ipt_handle *h, bool ignore_existing, 493 const char *chain) 494 { 495 if (ignore_existing && is_chain(h, chain)) 496 return; 497 498 if (fw3_pr_debug) 499 debug(h, "-N %s\n", chain); 500 501 iptc_create_chain(chain, h->handle); 502 } 503 504 void 505 fw3_ipt_flush(struct fw3_ipt_handle *h) 506 { 507 const char *chain; 508 509 #ifndef DISABLE_IPV6 510 if (h->family == FW3_FAMILY_V6) 511 { 512 for (chain = ip6tc_first_chain(h->handle); 513 chain != NULL; 514 chain = ip6tc_next_chain(h->handle)) 515 { 516 ip6tc_flush_entries(chain, h->handle); 517 } 518 519 for (chain = ip6tc_first_chain(h->handle); 520 chain != NULL; 521 chain = ip6tc_next_chain(h->handle)) 522 { 523 ip6tc_delete_chain(chain, h->handle); 524 } 525 } 526 else 527 #endif 528 { 529 for (chain = iptc_first_chain(h->handle); 530 chain != NULL; 531 chain = iptc_next_chain(h->handle)) 532 { 533 iptc_flush_entries(chain, h->handle); 534 } 535 536 for (chain = iptc_first_chain(h->handle); 537 chain != NULL; 538 chain = iptc_next_chain(h->handle)) 539 { 540 iptc_delete_chain(chain, h->handle); 541 } 542 } 543 } 544 545 static bool 546 chain_is_empty(struct fw3_ipt_handle *h, const char *chain) 547 { 548 #ifndef DISABLE_IPV6 549 if (h->family == FW3_FAMILY_V6) 550 return (!ip6tc_builtin(chain, h->handle) && 551 !ip6tc_first_rule(chain, h->handle)); 552 #endif 553 554 return (!iptc_builtin(chain, h->handle) && 555 !iptc_first_rule(chain, h->handle)); 556 } 557 558 void 559 fw3_ipt_gc(struct fw3_ipt_handle *h) 560 { 561 const char *chain; 562 bool found; 563 564 #ifndef DISABLE_IPV6 565 if (h->family == FW3_FAMILY_V6) 566 { 567 do { 568 found = false; 569 570 for (chain = ip6tc_first_chain(h->handle); 571 chain != NULL; 572 chain = ip6tc_next_chain(h->handle)) 573 { 574 if (!chain_is_empty(h, chain)) 575 continue; 576 577 fw3_ipt_delete_chain(h, false, chain); 578 found = true; 579 break; 580 } 581 } while(found); 582 } 583 else 584 #endif 585 { 586 do { 587 found = false; 588 589 for (chain = iptc_first_chain(h->handle); 590 chain != NULL; 591 chain = iptc_next_chain(h->handle)) 592 { 593 warn("C=%s\n", chain); 594 595 if (!chain_is_empty(h, chain)) 596 continue; 597 598 warn("D=%s\n", chain); 599 600 fw3_ipt_delete_chain(h, false, chain); 601 found = true; 602 break; 603 } 604 } while (found); 605 } 606 } 607 608 void 609 fw3_ipt_commit(struct fw3_ipt_handle *h) 610 { 611 int rv; 612 613 #ifndef DISABLE_IPV6 614 if (h->family == FW3_FAMILY_V6) 615 { 616 rv = ip6tc_commit(h->handle); 617 if (!rv) 618 warn("ip6tc_commit(): %s", ip6tc_strerror(errno)); 619 } 620 else 621 #endif 622 { 623 rv = iptc_commit(h->handle); 624 if (!rv) 625 warn("iptc_commit(): %s", iptc_strerror(errno)); 626 } 627 } 628 629 void 630 fw3_ipt_close(struct fw3_ipt_handle *h) 631 { 632 fw3_unlock_path(&xt_lock_fd, XT_LOCK_NAME); 633 free(h); 634 } 635 636 struct fw3_ipt_rule * 637 fw3_ipt_rule_new(struct fw3_ipt_handle *h) 638 { 639 struct fw3_ipt_rule *r; 640 641 r = fw3_alloc(sizeof(*r)); 642 643 r->h = h; 644 r->argv = fw3_alloc(sizeof(char *)); 645 r->argv[r->argc++] = "fw3"; 646 647 return r; 648 } 649 650 651 static char * 652 get_protoname(struct fw3_ipt_rule *r) 653 { 654 const struct xtables_pprot *pp; 655 656 if (r->protocol) 657 for (pp = xtables_chain_protos; pp->name; pp++) 658 if (pp->num == r->protocol) 659 return (char *)pp->name; 660 661 return NULL; 662 } 663 664 static struct xtables_match * 665 find_match(struct fw3_ipt_rule *r, const char *name) 666 { 667 struct xtables_match *m; 668 669 xext.retain = true; 670 m = xtables_find_match(name, XTF_TRY_LOAD, &r->matches); 671 xext.retain = false; 672 673 return m; 674 } 675 676 static void 677 init_match(struct fw3_ipt_rule *r, struct xtables_match *m, bool no_clone) 678 { 679 size_t s; 680 struct xtables_globals *g; 681 682 if (!m) 683 return; 684 685 s = XT_ALIGN(sizeof(struct xt_entry_match)) + m->size; 686 687 m->m = fw3_alloc(s); 688 689 fw3_xt_set_match_name(m); 690 691 m->m->u.user.revision = m->revision; 692 m->m->u.match_size = s; 693 694 /* free previous userspace data */ 695 fw3_xt_free_match_udata(m); 696 697 if (m->init) 698 m->init(m->m); 699 700 /* don't merge options if no_clone is set and this match is a clone */ 701 if (no_clone && (m == m->next)) 702 return; 703 704 /* merge option table */ 705 g = (r->h->family == FW3_FAMILY_V6) ? &xtg6 : &xtg; 706 fw3_xt_merge_match_options(g, m); 707 } 708 709 static bool 710 need_protomatch(struct fw3_ipt_rule *r, const char *pname) 711 { 712 struct xtables_match *match; 713 714 if (!pname) 715 return false; 716 717 match = xtables_find_match(pname, XTF_DONT_LOAD, NULL); 718 if (!match) 719 return true; 720 721 /* Free any kind of clone from xtables_find_match */ 722 if (match == match->next) 723 free(match); 724 return !r->protocol_loaded; 725 } 726 727 static struct xtables_match * 728 load_protomatch(struct fw3_ipt_rule *r) 729 { 730 const char *pname = get_protoname(r); 731 732 if (!need_protomatch(r, pname)) 733 return NULL; 734 735 return find_match(r, pname); 736 } 737 738 static struct xtables_target * 739 find_target(struct fw3_ipt_rule *r, const char *name) 740 { 741 struct xtables_target *t; 742 743 xext.retain = true; 744 745 if (is_chain(r->h, name)) 746 t = xtables_find_target(XT_STANDARD_TARGET, XTF_TRY_LOAD); 747 else 748 t = xtables_find_target(name, XTF_TRY_LOAD); 749 750 xext.retain = false; 751 752 return t; 753 } 754 755 static struct xtables_target * 756 get_target(struct fw3_ipt_rule *r, const char *name) 757 { 758 size_t s; 759 struct xtables_target *t; 760 struct xtables_globals *g; 761 762 t = find_target(r, name); 763 764 if (!t) 765 return NULL; 766 767 s = XT_ALIGN(sizeof(struct xt_entry_target)) + t->size; 768 t->t = fw3_alloc(s); 769 770 fw3_xt_set_target_name(t, name); 771 772 t->t->u.user.revision = t->revision; 773 t->t->u.target_size = s; 774 775 /* free previous userspace data */ 776 fw3_xt_free_target_udata(t); 777 778 if (t->init) 779 t->init(t->t); 780 781 /* merge option table */ 782 g = (r->h->family == FW3_FAMILY_V6) ? &xtg6 : &xtg; 783 fw3_xt_merge_target_options(g, t); 784 785 r->target = t; 786 787 return t; 788 } 789 790 void 791 fw3_ipt_rule_proto(struct fw3_ipt_rule *r, struct fw3_protocol *proto) 792 { 793 uint32_t pr; 794 795 if (!proto || proto->any) 796 return; 797 798 pr = proto->protocol; 799 800 #ifndef DISABLE_IPV6 801 if (r->h->family == FW3_FAMILY_V6) 802 { 803 if (pr == 1) 804 pr = 58; 805 806 r->e6.ipv6.proto = pr; 807 r->e6.ipv6.flags |= IP6T_F_PROTO; 808 809 if (proto->invert) 810 r->e6.ipv6.invflags |= XT_INV_PROTO; 811 } 812 else 813 #endif 814 { 815 r->e.ip.proto = pr; 816 817 if (proto->invert) 818 r->e.ip.invflags |= XT_INV_PROTO; 819 } 820 821 r->protocol = pr; 822 } 823 824 void 825 fw3_ipt_rule_in_out(struct fw3_ipt_rule *r, 826 struct fw3_device *in, struct fw3_device *out) 827 { 828 #ifndef DISABLE_IPV6 829 if (r->h->family == FW3_FAMILY_V6) 830 { 831 if (in && !in->any) 832 { 833 xtables_parse_interface(in->name, r->e6.ipv6.iniface, 834 r->e6.ipv6.iniface_mask); 835 836 if (in->invert) 837 r->e6.ipv6.invflags |= IP6T_INV_VIA_IN; 838 } 839 840 if (out && !out->any) 841 { 842 xtables_parse_interface(out->name, r->e6.ipv6.outiface, 843 r->e6.ipv6.outiface_mask); 844 845 if (out->invert) 846 r->e6.ipv6.invflags |= IP6T_INV_VIA_OUT; 847 } 848 } 849 else 850 #endif 851 { 852 if (in && !in->any) 853 { 854 xtables_parse_interface(in->name, r->e.ip.iniface, 855 r->e.ip.iniface_mask); 856 857 if (in->invert) 858 r->e.ip.invflags |= IPT_INV_VIA_IN; 859 } 860 861 if (out && !out->any) 862 { 863 xtables_parse_interface(out->name, r->e.ip.outiface, 864 r->e.ip.outiface_mask); 865 866 if (out->invert) 867 r->e.ip.invflags |= IPT_INV_VIA_OUT; 868 } 869 } 870 } 871 872 873 void 874 fw3_ipt_rule_src_dest(struct fw3_ipt_rule *r, 875 struct fw3_address *src, struct fw3_address *dest) 876 { 877 if ((src && src->range) || (dest && dest->range)) 878 { 879 fw3_ipt_rule_addarg(r, false, "-m", "iprange"); 880 } 881 882 if (src && src->set) 883 { 884 if (src->range) 885 { 886 fw3_ipt_rule_addarg(r, src->invert, "--src-range", 887 fw3_address_to_string(src, false, false)); 888 } 889 #ifndef DISABLE_IPV6 890 else if (r->h->family == FW3_FAMILY_V6) 891 { 892 r->e6.ipv6.src = src->address.v6; 893 r->e6.ipv6.smsk = src->mask.v6; 894 895 int i; 896 for (i = 0; i < 4; i++) 897 r->e6.ipv6.src.s6_addr32[i] &= r->e6.ipv6.smsk.s6_addr32[i]; 898 899 if (src->invert) 900 r->e6.ipv6.invflags |= IP6T_INV_SRCIP; 901 } 902 #endif 903 else 904 { 905 r->e.ip.src = src->address.v4; 906 r->e.ip.smsk = src->mask.v4; 907 908 r->e.ip.src.s_addr &= r->e.ip.smsk.s_addr; 909 910 if (src->invert) 911 r->e.ip.invflags |= IPT_INV_SRCIP; 912 } 913 } 914 915 if (dest && dest->set) 916 { 917 if (dest->range) 918 { 919 fw3_ipt_rule_addarg(r, dest->invert, "--dst-range", 920 fw3_address_to_string(dest, false, false)); 921 } 922 #ifndef DISABLE_IPV6 923 else if (r->h->family == FW3_FAMILY_V6) 924 { 925 r->e6.ipv6.dst = dest->address.v6; 926 r->e6.ipv6.dmsk = dest->mask.v6; 927 928 int i; 929 for (i = 0; i < 4; i++) 930 r->e6.ipv6.dst.s6_addr32[i] &= r->e6.ipv6.dmsk.s6_addr32[i]; 931 932 if (dest->invert) 933 r->e6.ipv6.invflags |= IP6T_INV_DSTIP; 934 } 935 #endif 936 else 937 { 938 r->e.ip.dst = dest->address.v4; 939 r->e.ip.dmsk = dest->mask.v4; 940 941 r->e.ip.dst.s_addr &= r->e.ip.dmsk.s_addr; 942 943 if (dest->invert) 944 r->e.ip.invflags |= IPT_INV_DSTIP; 945 } 946 } 947 } 948 949 void 950 fw3_ipt_rule_sport_dport(struct fw3_ipt_rule *r, 951 struct fw3_port *sp, struct fw3_port *dp) 952 { 953 char buf[sizeof("65535:65535")]; 954 955 if ((!sp || !sp->set) && (!dp || !dp->set)) 956 return; 957 958 if (!get_protoname(r)) 959 return; 960 961 if (sp && sp->set) 962 { 963 if (sp->port_min == sp->port_max) 964 snprintf(buf, sizeof(buf), "%u", sp->port_min); 965 else 966 snprintf(buf, sizeof(buf), "%u:%u", sp->port_min, sp->port_max); 967 968 fw3_ipt_rule_addarg(r, sp->invert, "--sport", buf); 969 } 970 971 if (dp && dp->set) 972 { 973 if (dp->port_min == dp->port_max) 974 snprintf(buf, sizeof(buf), "%u", dp->port_min); 975 else 976 snprintf(buf, sizeof(buf), "%u:%u", dp->port_min, dp->port_max); 977 978 fw3_ipt_rule_addarg(r, dp->invert, "--dport", buf); 979 } 980 } 981 982 void 983 fw3_ipt_rule_device(struct fw3_ipt_rule *r, const char *device, bool out) 984 { 985 struct fw3_device dev = { .any = false }; 986 987 if (device) { 988 snprintf(dev.name, sizeof(dev.name), "%s", device); 989 fw3_ipt_rule_in_out(r, (out) ? NULL : &dev, (out) ? &dev : NULL); 990 } 991 } 992 993 void 994 fw3_ipt_rule_mac(struct fw3_ipt_rule *r, struct fw3_mac *mac) 995 { 996 char buf[sizeof("ff:ff:ff:ff:ff:ff")]; 997 uint8_t *addr = mac->mac.ether_addr_octet; 998 999 if (!mac) 1000 return; 1001 1002 snprintf(buf, sizeof(buf), "%02x:%02x:%02x:%02x:%02x:%02x", 1003 addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]); 1004 1005 fw3_ipt_rule_addarg(r, false, "-m", "mac"); 1006 fw3_ipt_rule_addarg(r, mac->invert, "--mac-source", buf); 1007 } 1008 1009 void 1010 fw3_ipt_rule_icmptype(struct fw3_ipt_rule *r, struct fw3_icmptype *icmp) 1011 { 1012 char buf[sizeof("255/255")]; 1013 1014 if (!icmp) 1015 return; 1016 1017 #ifndef DISABLE_IPV6 1018 if (r->h->family == FW3_FAMILY_V6) 1019 { 1020 if (icmp->code6_min == 0 && icmp->code6_max == 0xFF) 1021 snprintf(buf, sizeof(buf), "%u", icmp->type6); 1022 else 1023 snprintf(buf, sizeof(buf), "%u/%u", icmp->type6, icmp->code6_min); 1024 1025 fw3_ipt_rule_addarg(r, icmp->invert, "--icmpv6-type", buf); 1026 } 1027 else 1028 #endif 1029 { 1030 if (icmp->code_min == 0 && icmp->code_max == 0xFF) 1031 snprintf(buf, sizeof(buf), "%u", icmp->type); 1032 else 1033 snprintf(buf, sizeof(buf), "%u/%u", icmp->type, icmp->code_min); 1034 1035 fw3_ipt_rule_addarg(r, icmp->invert, "--icmp-type", buf); 1036 } 1037 } 1038 1039 void 1040 fw3_ipt_rule_limit(struct fw3_ipt_rule *r, struct fw3_limit *limit) 1041 { 1042 char buf[sizeof("-4294967296/second")]; 1043 1044 if (!limit || limit->rate <= 0) 1045 return; 1046 1047 fw3_ipt_rule_addarg(r, false, "-m", "limit"); 1048 1049 snprintf(buf, sizeof(buf), "%u/%s", limit->rate, fw3_limit_units[limit->unit]); 1050 fw3_ipt_rule_addarg(r, limit->invert, "--limit", buf); 1051 1052 if (limit->burst > 0) 1053 { 1054 snprintf(buf, sizeof(buf), "%u", limit->burst); 1055 fw3_ipt_rule_addarg(r, limit->invert, "--limit-burst", buf); 1056 } 1057 } 1058 1059 void 1060 fw3_ipt_rule_ipset(struct fw3_ipt_rule *r, struct fw3_setmatch *match) 1061 { 1062 char buf[sizeof("dst,dst,dst")]; 1063 char *p = buf; 1064 int i = 0, len; 1065 size_t rem = sizeof(buf); 1066 1067 struct fw3_ipset *set; 1068 struct fw3_ipset_datatype *type; 1069 1070 if (!match || !match->set || !match->ptr) 1071 return; 1072 1073 set = match->ptr; 1074 list_for_each_entry(type, &set->datatypes, list) 1075 { 1076 if (i >= 3) 1077 break; 1078 1079 if (p > buf) { 1080 if (rem <= 1) 1081 break; 1082 1083 *p++ = ','; 1084 *p = 0; 1085 rem--; 1086 } 1087 1088 len = snprintf(p, rem, "%s", match->dir[i] ? match->dir[i] : type->dir); 1089 1090 if (len < 0 || len >= rem) 1091 break; 1092 1093 rem -= len; 1094 p += len; 1095 1096 i++; 1097 } 1098 1099 fw3_ipt_rule_addarg(r, false, "-m", "set"); 1100 1101 fw3_ipt_rule_addarg(r, match->invert, "--match-set", 1102 set->external ? set->external : set->name); 1103 1104 fw3_ipt_rule_addarg(r, false, buf, NULL); 1105 } 1106 1107 void 1108 fw3_ipt_rule_helper(struct fw3_ipt_rule *r, struct fw3_cthelpermatch *match) 1109 { 1110 if (!match || !match->set || !match->ptr) 1111 return; 1112 1113 fw3_ipt_rule_addarg(r, false, "-m", "helper"); 1114 fw3_ipt_rule_addarg(r, match->invert, "--helper", match->ptr->name); 1115 } 1116 1117 void 1118 fw3_ipt_rule_time(struct fw3_ipt_rule *r, struct fw3_time *time) 1119 { 1120 int i, len; 1121 struct tm empty = { 0 }; 1122 1123 char buf[84]; /* sizeof("1,2,3,...,30,31") */ 1124 char *p; 1125 1126 bool d1 = memcmp(&time->datestart, &empty, sizeof(empty)); 1127 bool d2 = memcmp(&time->datestop, &empty, sizeof(empty)); 1128 1129 size_t rem; 1130 1131 if (!d1 && !d2 && !time->timestart && !time->timestop && 1132 !(time->monthdays & 0xFFFFFFFE) && !(time->weekdays & 0xFE)) 1133 { 1134 return; 1135 } 1136 1137 fw3_ipt_rule_addarg(r, false, "-m", "time"); 1138 1139 if (!time->utc) 1140 fw3_ipt_rule_addarg(r, false, "--kerneltz", NULL); 1141 1142 if (d1) 1143 { 1144 strftime(buf, sizeof(buf), "%Y-%m-%dT%H:%M:%S", &time->datestart); 1145 fw3_ipt_rule_addarg(r, false, "--datestart", buf); 1146 } 1147 1148 if (d2) 1149 { 1150 strftime(buf, sizeof(buf), "%Y-%m-%dT%H:%M:%S", &time->datestop); 1151 fw3_ipt_rule_addarg(r, false, "--datestop", buf); 1152 } 1153 1154 if (time->timestart) 1155 { 1156 snprintf(buf, sizeof(buf), "%02d:%02d:%02d", 1157 time->timestart / 3600, 1158 time->timestart % 3600 / 60, 1159 time->timestart % 60); 1160 1161 fw3_ipt_rule_addarg(r, false, "--timestart", buf); 1162 } 1163 1164 if (time->timestop) 1165 { 1166 snprintf(buf, sizeof(buf), "%02d:%02d:%02d", 1167 time->timestop / 3600, 1168 time->timestop % 3600 / 60, 1169 time->timestop % 60); 1170 1171 fw3_ipt_rule_addarg(r, false, "--timestop", buf); 1172 } 1173 1174 if (time->monthdays & 0xFFFFFFFE) 1175 { 1176 for (i = 1, p = buf, rem = sizeof(buf); i < 32; i++) 1177 { 1178 if (fw3_hasbit(time->monthdays, i)) 1179 { 1180 if (p > buf) { 1181 if (rem <= 1) 1182 break; 1183 1184 *p++ = ','; 1185 *p = 0; 1186 rem--; 1187 } 1188 1189 len = snprintf(p, rem, "%u", i); 1190 1191 if (len < 0 || len >= rem) 1192 break; 1193 1194 rem -= len; 1195 p += len; 1196 } 1197 } 1198 1199 fw3_ipt_rule_addarg(r, fw3_hasbit(time->monthdays, 0), "--monthdays", buf); 1200 } 1201 1202 if (time->weekdays & 0xFE) 1203 { 1204 for (i = 1, p = buf, rem = sizeof(buf); i < 8; i++) 1205 { 1206 if (fw3_hasbit(time->weekdays, i)) 1207 { 1208 if (p > buf) { 1209 if (rem <= 1) 1210 break; 1211 1212 *p++ = ','; 1213 *p = 0; 1214 rem--; 1215 } 1216 1217 len = snprintf(p, rem, "%u", i); 1218 1219 if (len < 0 || len >= rem) 1220 break; 1221 1222 rem -= len; 1223 p += len; 1224 } 1225 } 1226 1227 fw3_ipt_rule_addarg(r, fw3_hasbit(time->weekdays, 0), "--weekdays", buf); 1228 } 1229 } 1230 1231 void 1232 fw3_ipt_rule_mark(struct fw3_ipt_rule *r, struct fw3_mark *mark) 1233 { 1234 char buf[sizeof("0xFFFFFFFF/0xFFFFFFFF")]; 1235 1236 if (!mark || !mark->set) 1237 return; 1238 1239 if (mark->mask < 0xFFFFFFFF) 1240 snprintf(buf, sizeof(buf), "0x%x/0x%x", mark->mark, mark->mask); 1241 else 1242 snprintf(buf, sizeof(buf), "0x%x", mark->mark); 1243 1244 fw3_ipt_rule_addarg(r, false, "-m", "mark"); 1245 fw3_ipt_rule_addarg(r, mark->invert, "--mark", buf); 1246 } 1247 1248 void 1249 fw3_ipt_rule_dscp(struct fw3_ipt_rule *r, struct fw3_dscp *dscp) 1250 { 1251 char buf[sizeof("0xFF")]; 1252 1253 if (!dscp || !dscp->set) 1254 return; 1255 1256 snprintf(buf, sizeof(buf), "0x%x", dscp->dscp); 1257 1258 fw3_ipt_rule_addarg(r, false, "-m", "dscp"); 1259 fw3_ipt_rule_addarg(r, dscp->invert, "--dscp", buf); 1260 } 1261 1262 void 1263 fw3_ipt_rule_comment(struct fw3_ipt_rule *r, const char *fmt, ...) 1264 { 1265 va_list ap; 1266 char buf[256]; 1267 1268 if (!fmt || !*fmt) 1269 return; 1270 1271 va_start(ap, fmt); 1272 vsnprintf(buf, sizeof(buf), fmt, ap); 1273 va_end(ap); 1274 1275 fw3_ipt_rule_addarg(r, false, "-m", "comment"); 1276 fw3_ipt_rule_addarg(r, false, "--comment", buf); 1277 } 1278 1279 void 1280 fw3_ipt_rule_extra(struct fw3_ipt_rule *r, const char *extra) 1281 { 1282 char *p, **tmp, *s; 1283 1284 if (!extra || !*extra) 1285 return; 1286 1287 s = fw3_strdup(extra); 1288 1289 for (p = strtok(s, " \t"); p; p = strtok(NULL, " \t")) 1290 { 1291 tmp = realloc(r->argv, (r->argc + 1) * sizeof(*r->argv)); 1292 1293 if (!tmp) 1294 break; 1295 1296 r->argv = tmp; 1297 r->argv[r->argc++] = fw3_strdup(p); 1298 } 1299 1300 free(s); 1301 } 1302 1303 #ifndef DISABLE_IPV6 1304 static void 1305 rule_print6(struct ip6t_entry *e) 1306 { 1307 char buf1[INET6_ADDRSTRLEN], buf2[INET6_ADDRSTRLEN]; 1308 char *pname; 1309 1310 if (e->ipv6.flags & IP6T_F_PROTO) 1311 { 1312 if (e->ipv6.invflags & XT_INV_PROTO) 1313 printf(" !"); 1314 1315 pname = get_protoname(container_of(e, struct fw3_ipt_rule, e6)); 1316 1317 if (pname) 1318 printf(" -p %s", pname); 1319 else 1320 printf(" -p %u", e->ipv6.proto); 1321 } 1322 1323 if (e->ipv6.iniface[0]) 1324 { 1325 if (e->ipv6.invflags & IP6T_INV_VIA_IN) 1326 printf(" !"); 1327 1328 printf(" -i %s", e->ipv6.iniface); 1329 } 1330 1331 if (e->ipv6.outiface[0]) 1332 { 1333 if (e->ipv6.invflags & IP6T_INV_VIA_OUT) 1334 printf(" !"); 1335 1336 printf(" -o %s", e->ipv6.outiface); 1337 } 1338 1339 if (memcmp(&e->ipv6.src, &in6addr_any, sizeof(struct in6_addr))) 1340 { 1341 if (e->ipv6.invflags & IP6T_INV_SRCIP) 1342 printf(" !"); 1343 1344 printf(" -s %s/%s", 1345 inet_ntop(AF_INET6, &e->ipv6.src, buf1, sizeof(buf1)), 1346 inet_ntop(AF_INET6, &e->ipv6.smsk, buf2, sizeof(buf2))); 1347 } 1348 1349 if (memcmp(&e->ipv6.dst, &in6addr_any, sizeof(struct in6_addr))) 1350 { 1351 if (e->ipv6.invflags & IP6T_INV_DSTIP) 1352 printf(" !"); 1353 1354 printf(" -d %s/%s", 1355 inet_ntop(AF_INET6, &e->ipv6.dst, buf1, sizeof(buf1)), 1356 inet_ntop(AF_INET6, &e->ipv6.dmsk, buf2, sizeof(buf2))); 1357 } 1358 } 1359 #endif 1360 1361 static void 1362 rule_print4(struct ipt_entry *e) 1363 { 1364 struct in_addr in_zero = { 0 }; 1365 char buf1[sizeof("255.255.255.255")], buf2[sizeof("255.255.255.255")]; 1366 char *pname; 1367 1368 if (e->ip.proto) 1369 { 1370 if (e->ip.invflags & XT_INV_PROTO) 1371 printf(" !"); 1372 1373 pname = get_protoname(container_of(e, struct fw3_ipt_rule, e)); 1374 1375 if (pname) 1376 printf(" -p %s", pname); 1377 else 1378 printf(" -p %u", e->ip.proto); 1379 } 1380 1381 if (e->ip.iniface[0]) 1382 { 1383 if (e->ip.invflags & IPT_INV_VIA_IN) 1384 printf(" !"); 1385 1386 printf(" -i %s", e->ip.iniface); 1387 } 1388 1389 if (e->ip.outiface[0]) 1390 { 1391 if (e->ip.invflags & IPT_INV_VIA_OUT) 1392 printf(" !"); 1393 1394 printf(" -o %s", e->ip.outiface); 1395 } 1396 1397 if (memcmp(&e->ip.src, &in_zero, sizeof(struct in_addr))) 1398 { 1399 if (e->ip.invflags & IPT_INV_SRCIP) 1400 printf(" !"); 1401 1402 printf(" -s %s/%s", 1403 inet_ntop(AF_INET, &e->ip.src, buf1, sizeof(buf1)), 1404 inet_ntop(AF_INET, &e->ip.smsk, buf2, sizeof(buf2))); 1405 } 1406 1407 if (memcmp(&e->ip.dst, &in_zero, sizeof(struct in_addr))) 1408 { 1409 if (e->ip.invflags & IPT_INV_DSTIP) 1410 printf(" !"); 1411 1412 printf(" -d %s/%s", 1413 inet_ntop(AF_INET, &e->ip.dst, buf1, sizeof(buf1)), 1414 inet_ntop(AF_INET, &e->ip.dmsk, buf2, sizeof(buf2))); 1415 } 1416 } 1417 1418 static void 1419 rule_print(struct fw3_ipt_rule *r, const char *prefix, const char *chain) 1420 { 1421 debug(r->h, "%s %s", prefix, chain); 1422 1423 #ifndef DISABLE_IPV6 1424 if (r->h->family == FW3_FAMILY_V6) 1425 rule_print6(&r->e6); 1426 else 1427 #endif 1428 rule_print4(&r->e); 1429 1430 fw3_xt_print_matches(&r->e.ip, r->matches); 1431 fw3_xt_print_target(&r->e.ip, r->target); 1432 1433 printf("\n"); 1434 } 1435 1436 static bool 1437 parse_option(struct fw3_ipt_rule *r, int optc, bool inv) 1438 { 1439 struct xtables_rule_match *m; 1440 struct xtables_match *em; 1441 1442 /* is a target option */ 1443 if (r->target && fw3_xt_has_target_parse(r->target) && 1444 optc >= r->target->option_offset && 1445 optc < (r->target->option_offset + 256)) 1446 { 1447 xtables_option_tpcall(optc, r->argv, inv, r->target, &r->e); 1448 return false; 1449 } 1450 1451 /* try to dispatch argument to one of the match parsers */ 1452 for (m = r->matches; m; m = m->next) 1453 { 1454 em = m->match; 1455 1456 if (m->completed || !fw3_xt_has_match_parse(em)) 1457 continue; 1458 1459 if (optc < em->option_offset || 1460 optc >= (em->option_offset + 256)) 1461 continue; 1462 1463 xtables_option_mpcall(optc, r->argv, inv, em, &r->e); 1464 return false; 1465 } 1466 1467 /* unhandled option, might belong to a protocol match */ 1468 if ((em = load_protomatch(r)) != NULL) 1469 { 1470 init_match(r, em, false); 1471 1472 r->protocol_loaded = true; 1473 optind--; 1474 1475 return true; 1476 } 1477 1478 if (optc == ':') 1479 warn("parse_option(): option '%s' needs argument", r->argv[optind-1]); 1480 1481 if (optc == '?') 1482 warn("parse_option(): unknown option '%s'", r->argv[optind-1]); 1483 1484 return false; 1485 } 1486 1487 void 1488 fw3_ipt_rule_addarg(struct fw3_ipt_rule *r, bool inv, 1489 const char *k, const char *v) 1490 { 1491 int n; 1492 char **tmp; 1493 1494 if (!k) 1495 return; 1496 1497 n = inv + !!k + !!v; 1498 tmp = realloc(r->argv, (r->argc + n) * sizeof(*tmp)); 1499 1500 if (!tmp) 1501 return; 1502 1503 r->argv = tmp; 1504 1505 if (inv) 1506 r->argv[r->argc++] = fw3_strdup("!"); 1507 1508 r->argv[r->argc++] = fw3_strdup(k); 1509 1510 if (v) 1511 r->argv[r->argc++] = fw3_strdup(v); 1512 } 1513 1514 static unsigned char * 1515 rule_mask(struct fw3_ipt_rule *r) 1516 { 1517 size_t s; 1518 unsigned char *p, *mask = NULL; 1519 struct xtables_rule_match *m; 1520 1521 #define SZ(x) XT_ALIGN(sizeof(struct x)) 1522 1523 #ifndef DISABLE_IPV6 1524 if (r->h->family == FW3_FAMILY_V6) 1525 { 1526 s = SZ(ip6t_entry); 1527 1528 for (m = r->matches; m; m = m->next) 1529 s += SZ(ip6t_entry_match) + m->match->size; 1530 1531 s += SZ(ip6t_entry_target); 1532 if (r->target) 1533 s += r->target->size; 1534 1535 mask = fw3_alloc(s); 1536 memset(mask, 0xFF, SZ(ip6t_entry)); 1537 p = mask + SZ(ip6t_entry); 1538 1539 for (m = r->matches; m; m = m->next) 1540 { 1541 memset(p, 0xFF, SZ(ip6t_entry_match) + m->match->userspacesize); 1542 p += SZ(ip6t_entry_match) + m->match->size; 1543 } 1544 1545 memset(p, 0xFF, SZ(ip6t_entry_target) + (r->target ? r->target->userspacesize : 0)); 1546 } 1547 else 1548 #endif 1549 { 1550 s = SZ(ipt_entry); 1551 1552 for (m = r->matches; m; m = m->next) 1553 s += SZ(ipt_entry_match) + m->match->size; 1554 1555 s += SZ(ipt_entry_target); 1556 if (r->target) 1557 s += r->target->size; 1558 1559 mask = fw3_alloc(s); 1560 memset(mask, 0xFF, SZ(ipt_entry)); 1561 p = mask + SZ(ipt_entry); 1562 1563 for (m = r->matches; m; m = m->next) 1564 { 1565 memset(p, 0xFF, SZ(ipt_entry_match) + m->match->userspacesize); 1566 p += SZ(ipt_entry_match) + m->match->size; 1567 } 1568 1569 memset(p, 0xFF, SZ(ipt_entry_target) + (r->target ? r->target->userspacesize : 0)); 1570 } 1571 1572 return mask; 1573 } 1574 1575 static void * 1576 rule_build(struct fw3_ipt_rule *r) 1577 { 1578 size_t s, target_size = (r->target) ? r->target->t->u.target_size : 0; 1579 struct xtables_rule_match *m; 1580 1581 #ifndef DISABLE_IPV6 1582 if (r->h->family == FW3_FAMILY_V6) 1583 { 1584 struct ip6t_entry *e6; 1585 1586 s = XT_ALIGN(sizeof(struct ip6t_entry)); 1587 1588 for (m = r->matches; m; m = m->next) 1589 s += m->match->m->u.match_size; 1590 1591 e6 = fw3_alloc(s + target_size); 1592 1593 memcpy(e6, &r->e6, sizeof(struct ip6t_entry)); 1594 1595 e6->target_offset = s; 1596 e6->next_offset = s + target_size; 1597 1598 s = 0; 1599 1600 for (m = r->matches; m; m = m->next) 1601 { 1602 memcpy(e6->elems + s, m->match->m, m->match->m->u.match_size); 1603 s += m->match->m->u.match_size; 1604 } 1605 1606 if (target_size) 1607 memcpy(e6->elems + s, r->target->t, target_size); 1608 1609 return e6; 1610 } 1611 else 1612 #endif 1613 { 1614 struct ipt_entry *e; 1615 1616 s = XT_ALIGN(sizeof(struct ipt_entry)); 1617 1618 for (m = r->matches; m; m = m->next) 1619 s += m->match->m->u.match_size; 1620 1621 e = fw3_alloc(s + target_size); 1622 1623 memcpy(e, &r->e, sizeof(struct ipt_entry)); 1624 1625 e->target_offset = s; 1626 e->next_offset = s + target_size; 1627 1628 s = 0; 1629 1630 for (m = r->matches; m; m = m->next) 1631 { 1632 memcpy(e->elems + s, m->match->m, m->match->m->u.match_size); 1633 s += m->match->m->u.match_size; 1634 } 1635 1636 if (target_size) 1637 memcpy(e->elems + s, r->target->t, target_size); 1638 1639 return e; 1640 } 1641 } 1642 1643 static void 1644 set_rule_tag(struct fw3_ipt_rule *r) 1645 { 1646 int i; 1647 char *p, **tmp; 1648 const char *tag = "!fw3"; 1649 1650 for (i = 0; i < r->argc; i++) 1651 if (!strcmp(r->argv[i], "--comment") && (i + 1) < r->argc) 1652 if (asprintf(&p, "%s: %s", tag, r->argv[i + 1]) > 0) 1653 { 1654 free(r->argv[i + 1]); 1655 r->argv[i + 1] = p; 1656 return; 1657 } 1658 1659 tmp = realloc(r->argv, (r->argc + 4) * sizeof(*r->argv)); 1660 1661 if (tmp) 1662 { 1663 r->argv = tmp; 1664 r->argv[r->argc++] = fw3_strdup("-m"); 1665 r->argv[r->argc++] = fw3_strdup("comment"); 1666 r->argv[r->argc++] = fw3_strdup("--comment"); 1667 r->argv[r->argc++] = fw3_strdup(tag); 1668 } 1669 } 1670 1671 void 1672 __fw3_ipt_rule_append(struct fw3_ipt_rule *r, bool repl, const char *fmt, ...) 1673 { 1674 void *rule; 1675 unsigned char *mask; 1676 1677 struct xtables_rule_match *m; 1678 struct xtables_match *em; 1679 struct xtables_target *et; 1680 struct xtables_globals *g; 1681 1682 struct fw3_device dev; 1683 struct fw3_address addr; 1684 1685 enum xtables_exittype status; 1686 1687 int i, optc; 1688 bool inv = false; 1689 char buf[32]; 1690 va_list ap; 1691 1692 va_start(ap, fmt); 1693 vsnprintf(buf, sizeof(buf) - 1, fmt, ap); 1694 va_end(ap); 1695 1696 g = (r->h->family == FW3_FAMILY_V6) ? &xtg6 : &xtg; 1697 g->opts = g->orig_opts; 1698 1699 optind = 0; 1700 opterr = 0; 1701 1702 status = setjmp(fw3_ipt_error_jmp); 1703 1704 if (status > 0) 1705 { 1706 info(" ! Skipping due to previous exception (code %u)", status); 1707 goto free; 1708 } 1709 1710 set_rule_tag(r); 1711 1712 while ((optc = getopt_long(r->argc, r->argv, "-:m:j:i:o:s:d:", g->opts, 1713 NULL)) != -1) 1714 { 1715 switch (optc) 1716 { 1717 case 'm': 1718 em = find_match(r, optarg); 1719 1720 if (!em) 1721 { 1722 warn("fw3_ipt_rule_append(): Can't find match '%s'", optarg); 1723 goto free; 1724 } 1725 1726 init_match(r, em, true); 1727 break; 1728 1729 case 'j': 1730 et = get_target(r, optarg); 1731 1732 if (!et) 1733 { 1734 warn("fw3_ipt_rule_append(): Can't find target '%s'", optarg); 1735 goto free; 1736 } 1737 1738 break; 1739 1740 case 'i': 1741 case 'o': 1742 if (!fw3_parse_device(&dev, optarg, false) || 1743 dev.any || dev.invert || *dev.network) 1744 { 1745 warn("fw3_ipt_rule_append(): Bad argument '%s'", optarg); 1746 goto free; 1747 } 1748 1749 dev.invert = inv; 1750 fw3_ipt_rule_in_out(r, (optc == 'i') ? &dev : NULL, 1751 (optc == 'o') ? &dev : NULL); 1752 break; 1753 1754 case 's': 1755 case 'd': 1756 if (!fw3_parse_address(&addr, optarg, false) || 1757 addr.range || addr.invert) 1758 { 1759 warn("fw3_ipt_rule_append(): Bad argument '%s'", optarg); 1760 goto free; 1761 } 1762 1763 addr.invert = inv; 1764 fw3_ipt_rule_src_dest(r, (optc == 's') ? &addr : NULL, 1765 (optc == 'd') ? &addr : NULL); 1766 break; 1767 1768 case 1: 1769 if ((optarg[0] == '!') && (optarg[1] == '\0')) 1770 { 1771 optarg[0] = '\0'; 1772 inv = true; 1773 continue; 1774 } 1775 1776 warn("fw3_ipt_rule_append(): Bad argument '%s'", optarg); 1777 goto free; 1778 1779 default: 1780 if (parse_option(r, optc, inv)) 1781 continue; 1782 break; 1783 } 1784 1785 inv = false; 1786 } 1787 1788 for (m = r->matches; m; m = m->next) 1789 xtables_option_mfcall(m->match); 1790 1791 if (r->target) 1792 xtables_option_tfcall(r->target); 1793 1794 rule = rule_build(r); 1795 1796 #ifndef DISABLE_IPV6 1797 if (r->h->family == FW3_FAMILY_V6) 1798 { 1799 if (repl) 1800 { 1801 mask = rule_mask(r); 1802 1803 while (ip6tc_delete_entry(buf, rule, mask, r->h->handle)) 1804 if (fw3_pr_debug) 1805 rule_print(r, "-D", buf); 1806 1807 free(mask); 1808 } 1809 1810 if (fw3_pr_debug) 1811 rule_print(r, "-A", buf); 1812 1813 if (!ip6tc_append_entry(buf, rule, r->h->handle)) 1814 warn("ip6tc_append_entry(): %s", ip6tc_strerror(errno)); 1815 } 1816 else 1817 #endif 1818 { 1819 if (repl) 1820 { 1821 mask = rule_mask(r); 1822 1823 while (iptc_delete_entry(buf, rule, mask, r->h->handle)) 1824 if (fw3_pr_debug) 1825 rule_print(r, "-D", buf); 1826 1827 free(mask); 1828 } 1829 1830 if (fw3_pr_debug) 1831 rule_print(r, "-A", buf); 1832 1833 if (!iptc_append_entry(buf, rule, r->h->handle)) 1834 warn("iptc_append_entry(): %s\n", iptc_strerror(errno)); 1835 } 1836 1837 free(rule); 1838 1839 free: 1840 for (i = 1; i < r->argc; i++) 1841 free(r->argv[i]); 1842 1843 free(r->argv); 1844 1845 xtables_rule_matches_free(&r->matches); 1846 1847 if (r->target) 1848 free(r->target->t); 1849 1850 free(r); 1851 1852 /* reset all targets and matches */ 1853 for (em = xtables_matches; em; em = em->next) 1854 em->mflags = 0; 1855 1856 for (et = xtables_targets; et; et = et->next) 1857 { 1858 et->tflags = 0; 1859 et->used = 0; 1860 } 1861 1862 xtables_free_opts(1); 1863 } 1864 1865 struct fw3_ipt_rule * 1866 fw3_ipt_rule_create(struct fw3_ipt_handle *handle, struct fw3_protocol *proto, 1867 struct fw3_device *in, struct fw3_device *out, 1868 struct fw3_address *src, struct fw3_address *dest) 1869 { 1870 struct fw3_ipt_rule *r; 1871 1872 r = fw3_ipt_rule_new(handle); 1873 1874 fw3_ipt_rule_proto(r, proto); 1875 fw3_ipt_rule_in_out(r, in, out); 1876 fw3_ipt_rule_src_dest(r, src, dest); 1877 1878 return r; 1879 } 1880 1881 void 1882 xtables_register_match(struct xtables_match *me) 1883 { 1884 int i; 1885 static struct xtables_match **tmp; 1886 1887 if (!xext.register_match) 1888 xext.register_match = dlsym(RTLD_NEXT, "xtables_register_match"); 1889 1890 if (!xext.register_match) 1891 return; 1892 1893 xext.register_match(me); 1894 1895 if (xext.retain) 1896 { 1897 for (i = 0; i < xext.mcount; i++) 1898 if (xext.matches[i] == me) 1899 return; 1900 1901 tmp = realloc(xext.matches, sizeof(me) * (xext.mcount + 1)); 1902 1903 if (!tmp) 1904 return; 1905 1906 xext.matches = tmp; 1907 xext.matches[xext.mcount++] = me; 1908 } 1909 } 1910 1911 void 1912 xtables_register_target(struct xtables_target *me) 1913 { 1914 int i; 1915 static struct xtables_target **tmp; 1916 1917 if (!xext.register_target) 1918 xext.register_target = dlsym(RTLD_NEXT, "xtables_register_target"); 1919 1920 if (!xext.register_target) 1921 return; 1922 1923 xext.register_target(me); 1924 1925 if (xext.retain) 1926 { 1927 for (i = 0; i < xext.tcount; i++) 1928 if (xext.targets[i] == me) 1929 return; 1930 1931 tmp = realloc(xext.targets, sizeof(me) * (xext.tcount + 1)); 1932 1933 if (!tmp) 1934 return; 1935 1936 xext.targets = tmp; 1937 xext.targets[xext.tcount++] = me; 1938 } 1939 } 1940
This page was automatically generated by LXR 0.3.1. • OpenWrt