adf64c05c4311ed75135cdb9c927da75ae4553c4
[project/firewall3.git] / iptables.c
1 /*
2 * firewall3 - 3rd OpenWrt UCI firewall implementation
3 *
4 * Copyright (C) 2013 Jo-Philipp Wich <jo@mein.io>
5 *
6 * Permission to use, copy, modify, and/or distribute this software for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
9 *
10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17 */
18
19 #define _GNU_SOURCE /* RTLD_NEXT */
20
21 /* include userspace headers */
22 #include <dlfcn.h>
23 #include <unistd.h>
24 #include <getopt.h>
25 #include <net/if.h>
26 #include <netinet/in.h>
27 #include <sys/utsname.h>
28 #include <sys/socket.h>
29
30 /* prevent indirect inclusion of kernel headers */
31 #define _LINUX_IF_H
32 #define _LINUX_IN_H
33 #define _LINUX_IN6_H
34
35 /* prevent libiptc from including kernel headers */
36 #define _FWCHAINS_KERNEL_HEADERS_H
37
38 /* finally include libiptc and xtables */
39 #include <libiptc/libiptc.h>
40 #include <libiptc/libip6tc.h>
41 #include <xtables.h>
42
43 #include <setjmp.h>
44
45 #include "options.h"
46
47 /* xtables interface */
48 #if (XTABLES_VERSION_CODE >= 10)
49 # include "xtables-10.h"
50 #elif (XTABLES_VERSION_CODE == 5)
51 # include "xtables-5.h"
52 #else
53 # error "Unsupported xtables version"
54 #endif
55
56 #include "iptables.h"
57
58
59 struct fw3_ipt_rule {
60 struct fw3_ipt_handle *h;
61
62 union {
63 struct ipt_entry e;
64 struct ip6t_entry e6;
65 };
66
67 struct xtables_rule_match *matches;
68 struct xtables_target *target;
69
70 int argc;
71 char **argv;
72
73 uint32_t protocol;
74 bool protocol_loaded;
75 };
76
77 static struct option base_opts[] = {
78 { .name = "match", .has_arg = 1, .val = 'm' },
79 { .name = "jump", .has_arg = 1, .val = 'j' },
80 { .name = "in-interface", .has_arg = 1, .val = 'i' },
81 { .name = "out-interface", .has_arg = 1, .val = 'o' },
82 { .name = "source", .has_arg = 1, .val = 's' },
83 { .name = "destination", .has_arg = 1, .val = 'd' },
84 { NULL }
85 };
86
87
88 static jmp_buf fw3_ipt_error_jmp;
89
90 static __attribute__((noreturn))
91 void fw3_ipt_error_handler(enum xtables_exittype status,
92 const char *fmt, ...)
93 {
94 va_list args;
95
96 fprintf(stderr, " ! Exception: ");
97
98 va_start(args, fmt);
99 vfprintf(stderr, fmt, args);
100 va_end(args);
101
102 longjmp(fw3_ipt_error_jmp, status);
103 }
104
105 static struct xtables_globals xtg = {
106 .option_offset = 0,
107 .program_version = "4",
108 .orig_opts = base_opts,
109 .exit_err = fw3_ipt_error_handler,
110 #if XTABLES_VERSION_CODE > 10
111 .compat_rev = xtables_compatible_revision,
112 #endif
113 };
114
115 static struct xtables_globals xtg6 = {
116 .option_offset = 0,
117 .program_version = "6",
118 .orig_opts = base_opts,
119 .exit_err = fw3_ipt_error_handler,
120 #if XTABLES_VERSION_CODE > 10
121 .compat_rev = xtables_compatible_revision,
122 #endif
123 };
124
125 static struct {
126 bool retain;
127 int mcount, tcount;
128 struct xtables_match **matches;
129 struct xtables_target **targets;
130 void (*register_match)(struct xtables_match *);
131 void (*register_target)(struct xtables_target *);
132 } xext;
133
134
135 /* Required by certain extensions like SNAT and DNAT */
136 int kernel_version = 0;
137
138 void
139 get_kernel_version(void)
140 {
141 static struct utsname uts;
142 int x = 0, y = 0, z = 0;
143
144 if (uname(&uts) == -1)
145 sprintf(uts.release, "3.0.0");
146
147 sscanf(uts.release, "%d.%d.%d", &x, &y, &z);
148 kernel_version = 0x10000 * x + 0x100 * y + z;
149 }
150
151 static void fw3_init_extensions(void)
152 {
153 init_extensions();
154 init_extensions4();
155
156 #ifndef DISABLE_IPV6
157 init_extensions6();
158 #endif
159 }
160
161 struct fw3_ipt_handle *
162 fw3_ipt_open(enum fw3_family family, enum fw3_table table)
163 {
164 int i;
165 struct fw3_ipt_handle *h;
166
167 h = fw3_alloc(sizeof(*h));
168
169 xtables_init();
170
171 if (family == FW3_FAMILY_V6)
172 {
173 #ifndef DISABLE_IPV6
174 h->family = FW3_FAMILY_V6;
175 h->table = table;
176 h->handle = ip6tc_init(fw3_flag_names[table]);
177
178 xtables_set_params(&xtg6);
179 xtables_set_nfproto(NFPROTO_IPV6);
180 #endif
181 }
182 else
183 {
184 h->family = FW3_FAMILY_V4;
185 h->table = table;
186 h->handle = iptc_init(fw3_flag_names[table]);
187
188 xtables_set_params(&xtg);
189 xtables_set_nfproto(NFPROTO_IPV4);
190 }
191
192 if (!h->handle)
193 {
194 free(h);
195 return NULL;
196 }
197
198 fw3_xt_reset();
199 fw3_init_extensions();
200
201 if (xext.register_match)
202 for (i = 0; i < xext.mcount; i++)
203 xext.register_match(xext.matches[i]);
204
205 if (xext.register_target)
206 for (i = 0; i < xext.tcount; i++)
207 xext.register_target(xext.targets[i]);
208
209 return h;
210 }
211
212 static void
213 debug(struct fw3_ipt_handle *h, const char *fmt, ...)
214 {
215 va_list ap;
216
217 printf("%s -t %s ", (h->family == FW3_FAMILY_V6) ? "ip6tables" : "iptables",
218 fw3_flag_names[h->table]);
219
220 va_start(ap, fmt);
221 vprintf(fmt, ap);
222 va_end(ap);
223 }
224
225 void
226 fw3_ipt_set_policy(struct fw3_ipt_handle *h, const char *chain,
227 enum fw3_flag policy)
228 {
229 if (fw3_pr_debug)
230 debug(h, "-P %s %s\n", chain, fw3_flag_names[policy]);
231
232 #ifndef DISABLE_IPV6
233 if (h->family == FW3_FAMILY_V6)
234 ip6tc_set_policy(chain, fw3_flag_names[policy], NULL, h->handle);
235 else
236 #endif
237 iptc_set_policy(chain, fw3_flag_names[policy], NULL, h->handle);
238 }
239
240 void
241 fw3_ipt_flush_chain(struct fw3_ipt_handle *h, const char *chain)
242 {
243 if (fw3_pr_debug)
244 debug(h, "-F %s\n", chain);
245
246 #ifndef DISABLE_IPV6
247 if (h->family == FW3_FAMILY_V6)
248 ip6tc_flush_entries(chain, h->handle);
249 else
250 #endif
251 iptc_flush_entries(chain, h->handle);
252 }
253
254 static void
255 delete_rules(struct fw3_ipt_handle *h, const char *target)
256 {
257 unsigned int num;
258 const struct ipt_entry *e;
259 const char *chain;
260 const char *t;
261 bool found;
262
263 #ifndef DISABLE_IPV6
264 if (h->family == FW3_FAMILY_V6)
265 {
266 for (chain = ip6tc_first_chain(h->handle);
267 chain != NULL;
268 chain = ip6tc_next_chain(h->handle))
269 {
270 do {
271 found = false;
272
273 const struct ip6t_entry *e6;
274 for (num = 0, e6 = ip6tc_first_rule(chain, h->handle);
275 e6 != NULL;
276 num++, e6 = ip6tc_next_rule(e6, h->handle))
277 {
278 t = ip6tc_get_target(e6, h->handle);
279
280 if (*t && !strcmp(t, target))
281 {
282 if (fw3_pr_debug)
283 debug(h, "-D %s %u\n", chain, num + 1);
284
285 ip6tc_delete_num_entry(chain, num, h->handle);
286 found = true;
287 break;
288 }
289 }
290 } while (found);
291 }
292 }
293 else
294 #endif
295 {
296 for (chain = iptc_first_chain(h->handle);
297 chain != NULL;
298 chain = iptc_next_chain(h->handle))
299 {
300 do {
301 found = false;
302
303 for (num = 0, e = iptc_first_rule(chain, h->handle);
304 e != NULL;
305 num++, e = iptc_next_rule(e, h->handle))
306 {
307 t = iptc_get_target(e, h->handle);
308
309 if (*t && !strcmp(t, target))
310 {
311 if (fw3_pr_debug)
312 debug(h, "-D %s %u\n", chain, num + 1);
313
314 iptc_delete_num_entry(chain, num, h->handle);
315 found = true;
316 break;
317 }
318 }
319 } while (found);
320 }
321 }
322 }
323
324 void
325 fw3_ipt_delete_chain(struct fw3_ipt_handle *h, const char *chain)
326 {
327 delete_rules(h, chain);
328
329 if (fw3_pr_debug)
330 debug(h, "-X %s\n", chain);
331
332 #ifndef DISABLE_IPV6
333 if (h->family == FW3_FAMILY_V6)
334 ip6tc_delete_chain(chain, h->handle);
335 else
336 #endif
337 iptc_delete_chain(chain, h->handle);
338 }
339
340 static bool
341 has_rule_tag(const void *base, unsigned int start, unsigned int end)
342 {
343 unsigned int i;
344 const struct xt_entry_match *em;
345
346 for (i = start; i < end; i += em->u.match_size)
347 {
348 em = base + i;
349
350 if (strcmp(em->u.user.name, "comment"))
351 continue;
352
353 if (!memcmp(em->data, "!fw3", 4))
354 return true;
355 }
356
357 return false;
358 }
359
360 void
361 fw3_ipt_delete_id_rules(struct fw3_ipt_handle *h, const char *chain)
362 {
363 unsigned int num;
364 const struct ipt_entry *e;
365 bool found;
366
367 #ifndef DISABLE_IPV6
368 if (h->family == FW3_FAMILY_V6)
369 {
370 if (!ip6tc_is_chain(chain, h->handle))
371 return;
372
373 do {
374 found = false;
375
376 const struct ip6t_entry *e6;
377 for (num = 0, e6 = ip6tc_first_rule(chain, h->handle);
378 e6 != NULL;
379 num++, e6 = ip6tc_next_rule(e6, h->handle))
380 {
381 if (has_rule_tag(e6, sizeof(*e6), e6->target_offset))
382 {
383 if (fw3_pr_debug)
384 debug(h, "-D %s %u\n", chain, num + 1);
385
386 ip6tc_delete_num_entry(chain, num, h->handle);
387 found = true;
388 break;
389 }
390 }
391 } while (found);
392 }
393 else
394 #endif
395 {
396 if (!iptc_is_chain(chain, h->handle))
397 return;
398
399 do {
400 found = false;
401
402 for (num = 0, e = iptc_first_rule(chain, h->handle);
403 e != NULL;
404 num++, e = iptc_next_rule(e, h->handle))
405 {
406 if (has_rule_tag(e, sizeof(*e), e->target_offset))
407 {
408 if (fw3_pr_debug)
409 debug(h, "-D %s %u\n", chain, num + 1);
410
411 iptc_delete_num_entry(chain, num, h->handle);
412 found = true;
413 break;
414 }
415 }
416 } while (found);
417 }
418 }
419
420 void
421 fw3_ipt_create_chain(struct fw3_ipt_handle *h, const char *fmt, ...)
422 {
423 char buf[32];
424 va_list ap;
425
426 va_start(ap, fmt);
427 vsnprintf(buf, sizeof(buf) - 1, fmt, ap);
428 va_end(ap);
429
430 if (fw3_pr_debug)
431 debug(h, "-N %s\n", buf);
432
433 iptc_create_chain(buf, h->handle);
434 }
435
436 void
437 fw3_ipt_flush(struct fw3_ipt_handle *h)
438 {
439 const char *chain;
440
441 #ifndef DISABLE_IPV6
442 if (h->family == FW3_FAMILY_V6)
443 {
444 for (chain = ip6tc_first_chain(h->handle);
445 chain != NULL;
446 chain = ip6tc_next_chain(h->handle))
447 {
448 ip6tc_flush_entries(chain, h->handle);
449 }
450
451 for (chain = ip6tc_first_chain(h->handle);
452 chain != NULL;
453 chain = ip6tc_next_chain(h->handle))
454 {
455 ip6tc_delete_chain(chain, h->handle);
456 }
457 }
458 else
459 #endif
460 {
461 for (chain = iptc_first_chain(h->handle);
462 chain != NULL;
463 chain = iptc_next_chain(h->handle))
464 {
465 iptc_flush_entries(chain, h->handle);
466 }
467
468 for (chain = iptc_first_chain(h->handle);
469 chain != NULL;
470 chain = iptc_next_chain(h->handle))
471 {
472 iptc_delete_chain(chain, h->handle);
473 }
474 }
475 }
476
477 static bool
478 chain_is_empty(struct fw3_ipt_handle *h, const char *chain)
479 {
480 #ifndef DISABLE_IPV6
481 if (h->family == FW3_FAMILY_V6)
482 return (!ip6tc_builtin(chain, h->handle) &&
483 !ip6tc_first_rule(chain, h->handle));
484 #endif
485
486 return (!iptc_builtin(chain, h->handle) &&
487 !iptc_first_rule(chain, h->handle));
488 }
489
490 void
491 fw3_ipt_gc(struct fw3_ipt_handle *h)
492 {
493 const char *chain;
494 bool found;
495
496 #ifndef DISABLE_IPV6
497 if (h->family == FW3_FAMILY_V6)
498 {
499 do {
500 found = false;
501
502 for (chain = ip6tc_first_chain(h->handle);
503 chain != NULL;
504 chain = ip6tc_next_chain(h->handle))
505 {
506 if (!chain_is_empty(h, chain))
507 continue;
508
509 fw3_ipt_delete_chain(h, chain);
510 found = true;
511 break;
512 }
513 } while(found);
514 }
515 else
516 #endif
517 {
518 do {
519 found = false;
520
521 for (chain = iptc_first_chain(h->handle);
522 chain != NULL;
523 chain = iptc_next_chain(h->handle))
524 {
525 warn("C=%s\n", chain);
526
527 if (!chain_is_empty(h, chain))
528 continue;
529
530 warn("D=%s\n", chain);
531
532 fw3_ipt_delete_chain(h, chain);
533 found = true;
534 break;
535 }
536 } while (found);
537 }
538 }
539
540 void
541 fw3_ipt_commit(struct fw3_ipt_handle *h)
542 {
543 int rv;
544
545 #ifndef DISABLE_IPV6
546 if (h->family == FW3_FAMILY_V6)
547 {
548 rv = ip6tc_commit(h->handle);
549 if (!rv)
550 warn("ip6tc_commit(): %s", ip6tc_strerror(errno));
551 }
552 else
553 #endif
554 {
555 rv = iptc_commit(h->handle);
556 if (!rv)
557 warn("iptc_commit(): %s", iptc_strerror(errno));
558 }
559 }
560
561 void
562 fw3_ipt_close(struct fw3_ipt_handle *h)
563 {
564 free(h);
565 }
566
567 struct fw3_ipt_rule *
568 fw3_ipt_rule_new(struct fw3_ipt_handle *h)
569 {
570 struct fw3_ipt_rule *r;
571
572 r = fw3_alloc(sizeof(*r));
573
574 r->h = h;
575 r->argv = fw3_alloc(sizeof(char *));
576 r->argv[r->argc++] = "fw3";
577
578 return r;
579 }
580
581
582 static bool
583 is_chain(struct fw3_ipt_handle *h, const char *name)
584 {
585 #ifndef DISABLE_IPV6
586 if (h->family == FW3_FAMILY_V6)
587 return ip6tc_is_chain(name, h->handle);
588 else
589 #endif
590 return iptc_is_chain(name, h->handle);
591 }
592
593 static char *
594 get_protoname(struct fw3_ipt_rule *r)
595 {
596 const struct xtables_pprot *pp;
597
598 if (r->protocol)
599 for (pp = xtables_chain_protos; pp->name; pp++)
600 if (pp->num == r->protocol)
601 return (char *)pp->name;
602
603 return NULL;
604 }
605
606 static struct xtables_match *
607 find_match(struct fw3_ipt_rule *r, const char *name)
608 {
609 struct xtables_match *m;
610
611 xext.retain = true;
612 m = xtables_find_match(name, XTF_TRY_LOAD, &r->matches);
613 xext.retain = false;
614
615 return m;
616 }
617
618 static void
619 init_match(struct fw3_ipt_rule *r, struct xtables_match *m, bool no_clone)
620 {
621 size_t s;
622 struct xtables_globals *g;
623
624 if (!m)
625 return;
626
627 s = XT_ALIGN(sizeof(struct xt_entry_match)) + m->size;
628
629 m->m = fw3_alloc(s);
630
631 fw3_xt_set_match_name(m);
632
633 m->m->u.user.revision = m->revision;
634 m->m->u.match_size = s;
635
636 /* free previous userspace data */
637 fw3_xt_free_match_udata(m);
638
639 if (m->init)
640 m->init(m->m);
641
642 /* don't merge options if no_clone is set and this match is a clone */
643 if (no_clone && (m == m->next))
644 return;
645
646 /* merge option table */
647 g = (r->h->family == FW3_FAMILY_V6) ? &xtg6 : &xtg;
648 fw3_xt_merge_match_options(g, m);
649 }
650
651 static bool
652 need_protomatch(struct fw3_ipt_rule *r, const char *pname)
653 {
654 if (!pname)
655 return false;
656
657 if (!xtables_find_match(pname, XTF_DONT_LOAD, NULL))
658 return true;
659
660 return !r->protocol_loaded;
661 }
662
663 static struct xtables_match *
664 load_protomatch(struct fw3_ipt_rule *r)
665 {
666 const char *pname = get_protoname(r);
667
668 if (!need_protomatch(r, pname))
669 return NULL;
670
671 return find_match(r, pname);
672 }
673
674 static struct xtables_target *
675 find_target(struct fw3_ipt_rule *r, const char *name)
676 {
677 struct xtables_target *t;
678
679 xext.retain = true;
680
681 if (is_chain(r->h, name))
682 t = xtables_find_target(XT_STANDARD_TARGET, XTF_TRY_LOAD);
683 else
684 t = xtables_find_target(name, XTF_TRY_LOAD);
685
686 xext.retain = false;
687
688 return t;
689 }
690
691 static struct xtables_target *
692 get_target(struct fw3_ipt_rule *r, const char *name)
693 {
694 size_t s;
695 struct xtables_target *t;
696 struct xtables_globals *g;
697
698 t = find_target(r, name);
699
700 if (!t)
701 return NULL;
702
703 s = XT_ALIGN(sizeof(struct xt_entry_target)) + t->size;
704 t->t = fw3_alloc(s);
705
706 fw3_xt_set_target_name(t, name);
707
708 t->t->u.user.revision = t->revision;
709 t->t->u.target_size = s;
710
711 /* free previous userspace data */
712 fw3_xt_free_target_udata(t);
713
714 if (t->init)
715 t->init(t->t);
716
717 /* merge option table */
718 g = (r->h->family == FW3_FAMILY_V6) ? &xtg6 : &xtg;
719 fw3_xt_merge_target_options(g, t);
720
721 r->target = t;
722
723 return t;
724 }
725
726 void
727 fw3_ipt_rule_proto(struct fw3_ipt_rule *r, struct fw3_protocol *proto)
728 {
729 uint32_t pr;
730
731 if (!proto || proto->any)
732 return;
733
734 pr = proto->protocol;
735
736 #ifndef DISABLE_IPV6
737 if (r->h->family == FW3_FAMILY_V6)
738 {
739 if (pr == 1)
740 pr = 58;
741
742 r->e6.ipv6.proto = pr;
743 r->e6.ipv6.flags |= IP6T_F_PROTO;
744
745 if (proto->invert)
746 r->e6.ipv6.invflags |= XT_INV_PROTO;
747 }
748 else
749 #endif
750 {
751 r->e.ip.proto = pr;
752
753 if (proto->invert)
754 r->e.ip.invflags |= XT_INV_PROTO;
755 }
756
757 r->protocol = pr;
758 }
759
760 void
761 fw3_ipt_rule_in_out(struct fw3_ipt_rule *r,
762 struct fw3_device *in, struct fw3_device *out)
763 {
764 #ifndef DISABLE_IPV6
765 if (r->h->family == FW3_FAMILY_V6)
766 {
767 if (in && !in->any)
768 {
769 xtables_parse_interface(in->name, r->e6.ipv6.iniface,
770 r->e6.ipv6.iniface_mask);
771
772 if (in->invert)
773 r->e6.ipv6.invflags |= IP6T_INV_VIA_IN;
774 }
775
776 if (out && !out->any)
777 {
778 xtables_parse_interface(out->name, r->e6.ipv6.outiface,
779 r->e6.ipv6.outiface_mask);
780
781 if (out->invert)
782 r->e6.ipv6.invflags |= IP6T_INV_VIA_OUT;
783 }
784 }
785 else
786 #endif
787 {
788 if (in && !in->any)
789 {
790 xtables_parse_interface(in->name, r->e.ip.iniface,
791 r->e.ip.iniface_mask);
792
793 if (in->invert)
794 r->e.ip.invflags |= IPT_INV_VIA_IN;
795 }
796
797 if (out && !out->any)
798 {
799 xtables_parse_interface(out->name, r->e.ip.outiface,
800 r->e.ip.outiface_mask);
801
802 if (out->invert)
803 r->e.ip.invflags |= IPT_INV_VIA_OUT;
804 }
805 }
806 }
807
808
809 void
810 fw3_ipt_rule_src_dest(struct fw3_ipt_rule *r,
811 struct fw3_address *src, struct fw3_address *dest)
812 {
813 if ((src && src->range) || (dest && dest->range))
814 {
815 fw3_ipt_rule_addarg(r, false, "-m", "iprange");
816 }
817
818 if (src && src->set)
819 {
820 if (src->range)
821 {
822 fw3_ipt_rule_addarg(r, src->invert, "--src-range",
823 fw3_address_to_string(src, false, false));
824 }
825 #ifndef DISABLE_IPV6
826 else if (r->h->family == FW3_FAMILY_V6)
827 {
828 r->e6.ipv6.src = src->address.v6;
829 r->e6.ipv6.smsk = src->mask.v6;
830
831 int i;
832 for (i = 0; i < 4; i++)
833 r->e6.ipv6.src.s6_addr32[i] &= r->e6.ipv6.smsk.s6_addr32[i];
834
835 if (src->invert)
836 r->e6.ipv6.invflags |= IP6T_INV_SRCIP;
837 }
838 #endif
839 else
840 {
841 r->e.ip.src = src->address.v4;
842 r->e.ip.smsk = src->mask.v4;
843
844 r->e.ip.src.s_addr &= r->e.ip.smsk.s_addr;
845
846 if (src->invert)
847 r->e.ip.invflags |= IPT_INV_SRCIP;
848 }
849 }
850
851 if (dest && dest->set)
852 {
853 if (dest->range)
854 {
855 fw3_ipt_rule_addarg(r, dest->invert, "--dst-range",
856 fw3_address_to_string(dest, false, false));
857 }
858 #ifndef DISABLE_IPV6
859 else if (r->h->family == FW3_FAMILY_V6)
860 {
861 r->e6.ipv6.dst = dest->address.v6;
862 r->e6.ipv6.dmsk = dest->mask.v6;
863
864 int i;
865 for (i = 0; i < 4; i++)
866 r->e6.ipv6.dst.s6_addr32[i] &= r->e6.ipv6.dmsk.s6_addr32[i];
867
868 if (dest->invert)
869 r->e6.ipv6.invflags |= IP6T_INV_DSTIP;
870 }
871 #endif
872 else
873 {
874 r->e.ip.dst = dest->address.v4;
875 r->e.ip.dmsk = dest->mask.v4;
876
877 r->e.ip.dst.s_addr &= r->e.ip.dmsk.s_addr;
878
879 if (dest->invert)
880 r->e.ip.invflags |= IPT_INV_DSTIP;
881 }
882 }
883 }
884
885 void
886 fw3_ipt_rule_sport_dport(struct fw3_ipt_rule *r,
887 struct fw3_port *sp, struct fw3_port *dp)
888 {
889 char buf[sizeof("65535:65535\0")];
890
891 if ((!sp || !sp->set) && (!dp || !dp->set))
892 return;
893
894 if (!get_protoname(r))
895 return;
896
897 if (sp && sp->set)
898 {
899 if (sp->port_min == sp->port_max)
900 sprintf(buf, "%u", sp->port_min);
901 else
902 snprintf(buf, sizeof(buf), "%u:%u", sp->port_min, sp->port_max);
903
904 fw3_ipt_rule_addarg(r, sp->invert, "--sport", buf);
905 }
906
907 if (dp && dp->set)
908 {
909 if (dp->port_min == dp->port_max)
910 sprintf(buf, "%u", dp->port_min);
911 else
912 snprintf(buf, sizeof(buf), "%u:%u", dp->port_min, dp->port_max);
913
914 fw3_ipt_rule_addarg(r, dp->invert, "--dport", buf);
915 }
916 }
917
918 void
919 fw3_ipt_rule_device(struct fw3_ipt_rule *r, const char *device, bool out)
920 {
921 if (device) {
922 struct fw3_device dev = { .any = false };
923 strncpy(dev.name, device, sizeof(dev.name) - 1);
924 fw3_ipt_rule_in_out(r, (out) ? NULL : &dev, (out) ? &dev : NULL);
925 }
926 }
927
928 void
929 fw3_ipt_rule_mac(struct fw3_ipt_rule *r, struct fw3_mac *mac)
930 {
931 char buf[sizeof("ff:ff:ff:ff:ff:ff\0")];
932 uint8_t *addr = mac->mac.ether_addr_octet;
933
934 if (!mac)
935 return;
936
937 sprintf(buf, "%02x:%02x:%02x:%02x:%02x:%02x",
938 addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]);
939
940 fw3_ipt_rule_addarg(r, false, "-m", "mac");
941 fw3_ipt_rule_addarg(r, mac->invert, "--mac-source", buf);
942 }
943
944 void
945 fw3_ipt_rule_icmptype(struct fw3_ipt_rule *r, struct fw3_icmptype *icmp)
946 {
947 char buf[sizeof("255/255\0")];
948
949 if (!icmp)
950 return;
951
952 #ifndef DISABLE_IPV6
953 if (r->h->family == FW3_FAMILY_V6)
954 {
955 if (icmp->code6_min == 0 && icmp->code6_max == 0xFF)
956 sprintf(buf, "%u", icmp->type6);
957 else
958 snprintf(buf, sizeof(buf), "%u/%u", icmp->type6, icmp->code6_min);
959
960 fw3_ipt_rule_addarg(r, icmp->invert, "--icmpv6-type", buf);
961 }
962 else
963 #endif
964 {
965 if (icmp->code_min == 0 && icmp->code_max == 0xFF)
966 sprintf(buf, "%u", icmp->type);
967 else
968 snprintf(buf, sizeof(buf), "%u/%u", icmp->type, icmp->code_min);
969
970 fw3_ipt_rule_addarg(r, icmp->invert, "--icmp-type", buf);
971 }
972 }
973
974 void
975 fw3_ipt_rule_limit(struct fw3_ipt_rule *r, struct fw3_limit *limit)
976 {
977 char buf[sizeof("-4294967296/second\0")];
978
979 if (!limit || limit->rate <= 0)
980 return;
981
982 fw3_ipt_rule_addarg(r, false, "-m", "limit");
983
984 sprintf(buf, "%u/%s", limit->rate, fw3_limit_units[limit->unit]);
985 fw3_ipt_rule_addarg(r, limit->invert, "--limit", buf);
986
987 if (limit->burst > 0)
988 {
989 sprintf(buf, "%u", limit->burst);
990 fw3_ipt_rule_addarg(r, limit->invert, "--limit-burst", buf);
991 }
992 }
993
994 void
995 fw3_ipt_rule_ipset(struct fw3_ipt_rule *r, struct fw3_setmatch *match)
996 {
997 char buf[sizeof("dst,dst,dst\0")];
998 char *p = buf;
999 int i = 0;
1000
1001 struct fw3_ipset *set;
1002 struct fw3_ipset_datatype *type;
1003
1004 if (!match || !match->set || !match->ptr)
1005 return;
1006
1007 set = match->ptr;
1008 list_for_each_entry(type, &set->datatypes, list)
1009 {
1010 if (i >= 3)
1011 break;
1012
1013 if (p > buf)
1014 *p++ = ',';
1015
1016 p += sprintf(p, "%s", match->dir[i] ? match->dir[i] : type->dir);
1017 i++;
1018 }
1019
1020 fw3_ipt_rule_addarg(r, false, "-m", "set");
1021
1022 fw3_ipt_rule_addarg(r, match->invert, "--match-set",
1023 set->external ? set->external : set->name);
1024
1025 fw3_ipt_rule_addarg(r, false, buf, NULL);
1026 }
1027
1028 void
1029 fw3_ipt_rule_helper(struct fw3_ipt_rule *r, struct fw3_cthelpermatch *match)
1030 {
1031 if (!match || !match->set || !match->ptr)
1032 return;
1033
1034 fw3_ipt_rule_addarg(r, false, "-m", "helper");
1035 fw3_ipt_rule_addarg(r, match->invert, "--helper", match->ptr->name);
1036 }
1037
1038 void
1039 fw3_ipt_rule_time(struct fw3_ipt_rule *r, struct fw3_time *time)
1040 {
1041 int i;
1042 struct tm empty = { 0 };
1043
1044 char buf[84]; /* sizeof("1,2,3,...,30,31\0") */
1045 char *p;
1046
1047 bool d1 = memcmp(&time->datestart, &empty, sizeof(empty));
1048 bool d2 = memcmp(&time->datestop, &empty, sizeof(empty));
1049
1050 if (!d1 && !d2 && !time->timestart && !time->timestop &&
1051 !(time->monthdays & 0xFFFFFFFE) && !(time->weekdays & 0xFE))
1052 {
1053 return;
1054 }
1055
1056 fw3_ipt_rule_addarg(r, false, "-m", "time");
1057
1058 if (!time->utc)
1059 fw3_ipt_rule_addarg(r, false, "--kerneltz", NULL);
1060
1061 if (d1)
1062 {
1063 strftime(buf, sizeof(buf), "%Y-%m-%dT%H:%M:%S", &time->datestart);
1064 fw3_ipt_rule_addarg(r, false, "--datestart", buf);
1065 }
1066
1067 if (d2)
1068 {
1069 strftime(buf, sizeof(buf), "%Y-%m-%dT%H:%M:%S", &time->datestop);
1070 fw3_ipt_rule_addarg(r, false, "--datestop", buf);
1071 }
1072
1073 if (time->timestart)
1074 {
1075 sprintf(buf, "%02d:%02d:%02d",
1076 time->timestart / 3600,
1077 time->timestart % 3600 / 60,
1078 time->timestart % 60);
1079
1080 fw3_ipt_rule_addarg(r, false, "--timestart", buf);
1081 }
1082
1083 if (time->timestop)
1084 {
1085 sprintf(buf, "%02d:%02d:%02d",
1086 time->timestop / 3600,
1087 time->timestop % 3600 / 60,
1088 time->timestop % 60);
1089
1090 fw3_ipt_rule_addarg(r, false, "--timestop", buf);
1091 }
1092
1093 if (time->monthdays & 0xFFFFFFFE)
1094 {
1095 for (i = 1, p = buf; i < 32; i++)
1096 {
1097 if (fw3_hasbit(time->monthdays, i))
1098 {
1099 if (p > buf)
1100 *p++ = ',';
1101
1102 p += sprintf(p, "%u", i);
1103 }
1104 }
1105
1106 fw3_ipt_rule_addarg(r, fw3_hasbit(time->monthdays, 0), "--monthdays", buf);
1107 }
1108
1109 if (time->weekdays & 0xFE)
1110 {
1111 for (i = 1, p = buf; i < 8; i++)
1112 {
1113 if (fw3_hasbit(time->weekdays, i))
1114 {
1115 if (p > buf)
1116 *p++ = ',';
1117
1118 p += sprintf(p, "%u", i);
1119 }
1120 }
1121
1122 fw3_ipt_rule_addarg(r, fw3_hasbit(time->weekdays, 0), "--weekdays", buf);
1123 }
1124 }
1125
1126 void
1127 fw3_ipt_rule_mark(struct fw3_ipt_rule *r, struct fw3_mark *mark)
1128 {
1129 char buf[sizeof("0xFFFFFFFF/0xFFFFFFFF\0")];
1130
1131 if (!mark || !mark->set)
1132 return;
1133
1134 if (mark->mask < 0xFFFFFFFF)
1135 sprintf(buf, "0x%x/0x%x", mark->mark, mark->mask);
1136 else
1137 sprintf(buf, "0x%x", mark->mark);
1138
1139 fw3_ipt_rule_addarg(r, false, "-m", "mark");
1140 fw3_ipt_rule_addarg(r, mark->invert, "--mark", buf);
1141 }
1142
1143 void
1144 fw3_ipt_rule_comment(struct fw3_ipt_rule *r, const char *fmt, ...)
1145 {
1146 va_list ap;
1147 char buf[256];
1148
1149 if (!fmt || !*fmt)
1150 return;
1151
1152 va_start(ap, fmt);
1153 vsnprintf(buf, sizeof(buf) - 1, fmt, ap);
1154 va_end(ap);
1155
1156 fw3_ipt_rule_addarg(r, false, "-m", "comment");
1157 fw3_ipt_rule_addarg(r, false, "--comment", buf);
1158 }
1159
1160 void
1161 fw3_ipt_rule_extra(struct fw3_ipt_rule *r, const char *extra)
1162 {
1163 char *p, **tmp, *s;
1164
1165 if (!extra || !*extra)
1166 return;
1167
1168 s = fw3_strdup(extra);
1169
1170 for (p = strtok(s, " \t"); p; p = strtok(NULL, " \t"))
1171 {
1172 tmp = realloc(r->argv, (r->argc + 1) * sizeof(*r->argv));
1173
1174 if (!tmp)
1175 break;
1176
1177 r->argv = tmp;
1178 r->argv[r->argc++] = fw3_strdup(p);
1179 }
1180
1181 free(s);
1182 }
1183
1184 #ifndef DISABLE_IPV6
1185 static void
1186 rule_print6(struct ip6t_entry *e)
1187 {
1188 char buf1[INET6_ADDRSTRLEN], buf2[INET6_ADDRSTRLEN];
1189 char *pname;
1190
1191 if (e->ipv6.flags & IP6T_F_PROTO)
1192 {
1193 if (e->ipv6.invflags & XT_INV_PROTO)
1194 printf(" !");
1195
1196 pname = get_protoname(container_of(e, struct fw3_ipt_rule, e6));
1197
1198 if (pname)
1199 printf(" -p %s", pname);
1200 else
1201 printf(" -p %u", e->ipv6.proto);
1202 }
1203
1204 if (e->ipv6.iniface[0])
1205 {
1206 if (e->ipv6.invflags & IP6T_INV_VIA_IN)
1207 printf(" !");
1208
1209 printf(" -i %s", e->ipv6.iniface);
1210 }
1211
1212 if (e->ipv6.outiface[0])
1213 {
1214 if (e->ipv6.invflags & IP6T_INV_VIA_OUT)
1215 printf(" !");
1216
1217 printf(" -o %s", e->ipv6.outiface);
1218 }
1219
1220 if (memcmp(&e->ipv6.src, &in6addr_any, sizeof(struct in6_addr)))
1221 {
1222 if (e->ipv6.invflags & IP6T_INV_SRCIP)
1223 printf(" !");
1224
1225 printf(" -s %s/%s",
1226 inet_ntop(AF_INET6, &e->ipv6.src, buf1, sizeof(buf1)),
1227 inet_ntop(AF_INET6, &e->ipv6.smsk, buf2, sizeof(buf2)));
1228 }
1229
1230 if (memcmp(&e->ipv6.dst, &in6addr_any, sizeof(struct in6_addr)))
1231 {
1232 if (e->ipv6.invflags & IP6T_INV_DSTIP)
1233 printf(" !");
1234
1235 printf(" -d %s/%s",
1236 inet_ntop(AF_INET6, &e->ipv6.dst, buf1, sizeof(buf1)),
1237 inet_ntop(AF_INET6, &e->ipv6.dmsk, buf2, sizeof(buf2)));
1238 }
1239 }
1240 #endif
1241
1242 static void
1243 rule_print4(struct ipt_entry *e)
1244 {
1245 struct in_addr in_zero = { 0 };
1246 char buf1[sizeof("255.255.255.255\0")], buf2[sizeof("255.255.255.255\0")];
1247 char *pname;
1248
1249 if (e->ip.proto)
1250 {
1251 if (e->ip.invflags & XT_INV_PROTO)
1252 printf(" !");
1253
1254 pname = get_protoname(container_of(e, struct fw3_ipt_rule, e));
1255
1256 if (pname)
1257 printf(" -p %s", pname);
1258 else
1259 printf(" -p %u", e->ip.proto);
1260 }
1261
1262 if (e->ip.iniface[0])
1263 {
1264 if (e->ip.invflags & IPT_INV_VIA_IN)
1265 printf(" !");
1266
1267 printf(" -i %s", e->ip.iniface);
1268 }
1269
1270 if (e->ip.outiface[0])
1271 {
1272 if (e->ip.invflags & IPT_INV_VIA_OUT)
1273 printf(" !");
1274
1275 printf(" -o %s", e->ip.outiface);
1276 }
1277
1278 if (memcmp(&e->ip.src, &in_zero, sizeof(struct in_addr)))
1279 {
1280 if (e->ip.invflags & IPT_INV_SRCIP)
1281 printf(" !");
1282
1283 printf(" -s %s/%s",
1284 inet_ntop(AF_INET, &e->ip.src, buf1, sizeof(buf1)),
1285 inet_ntop(AF_INET, &e->ip.smsk, buf2, sizeof(buf2)));
1286 }
1287
1288 if (memcmp(&e->ip.dst, &in_zero, sizeof(struct in_addr)))
1289 {
1290 if (e->ip.invflags & IPT_INV_DSTIP)
1291 printf(" !");
1292
1293 printf(" -d %s/%s",
1294 inet_ntop(AF_INET, &e->ip.dst, buf1, sizeof(buf1)),
1295 inet_ntop(AF_INET, &e->ip.dmsk, buf2, sizeof(buf2)));
1296 }
1297 }
1298
1299 static void
1300 rule_print(struct fw3_ipt_rule *r, const char *prefix, const char *chain)
1301 {
1302 debug(r->h, "%s %s", prefix, chain);
1303
1304 #ifndef DISABLE_IPV6
1305 if (r->h->family == FW3_FAMILY_V6)
1306 rule_print6(&r->e6);
1307 else
1308 #endif
1309 rule_print4(&r->e);
1310
1311 fw3_xt_print_matches(&r->e.ip, r->matches);
1312 fw3_xt_print_target(&r->e.ip, r->target);
1313
1314 printf("\n");
1315 }
1316
1317 static bool
1318 parse_option(struct fw3_ipt_rule *r, int optc, bool inv)
1319 {
1320 struct xtables_rule_match *m;
1321 struct xtables_match *em;
1322
1323 /* is a target option */
1324 if (r->target && fw3_xt_has_target_parse(r->target) &&
1325 optc >= r->target->option_offset &&
1326 optc < (r->target->option_offset + 256))
1327 {
1328 xtables_option_tpcall(optc, r->argv, inv, r->target, &r->e);
1329 return false;
1330 }
1331
1332 /* try to dispatch argument to one of the match parsers */
1333 for (m = r->matches; m; m = m->next)
1334 {
1335 em = m->match;
1336
1337 if (m->completed || !fw3_xt_has_match_parse(em))
1338 continue;
1339
1340 if (optc < em->option_offset ||
1341 optc >= (em->option_offset + 256))
1342 continue;
1343
1344 xtables_option_mpcall(optc, r->argv, inv, em, &r->e);
1345 return false;
1346 }
1347
1348 /* unhandled option, might belong to a protocol match */
1349 if ((em = load_protomatch(r)) != NULL)
1350 {
1351 init_match(r, em, false);
1352
1353 r->protocol_loaded = true;
1354 optind--;
1355
1356 return true;
1357 }
1358
1359 if (optc == ':')
1360 warn("parse_option(): option '%s' needs argument", r->argv[optind-1]);
1361
1362 if (optc == '?')
1363 warn("parse_option(): unknown option '%s'", r->argv[optind-1]);
1364
1365 return false;
1366 }
1367
1368 void
1369 fw3_ipt_rule_addarg(struct fw3_ipt_rule *r, bool inv,
1370 const char *k, const char *v)
1371 {
1372 int n;
1373 char **tmp;
1374
1375 if (!k)
1376 return;
1377
1378 n = inv + !!k + !!v;
1379 tmp = realloc(r->argv, (r->argc + n) * sizeof(*tmp));
1380
1381 if (!tmp)
1382 return;
1383
1384 r->argv = tmp;
1385
1386 if (inv)
1387 r->argv[r->argc++] = fw3_strdup("!");
1388
1389 r->argv[r->argc++] = fw3_strdup(k);
1390
1391 if (v)
1392 r->argv[r->argc++] = fw3_strdup(v);
1393 }
1394
1395 static unsigned char *
1396 rule_mask(struct fw3_ipt_rule *r)
1397 {
1398 size_t s;
1399 unsigned char *p, *mask = NULL;
1400 struct xtables_rule_match *m;
1401
1402 #define SZ(x) XT_ALIGN(sizeof(struct x))
1403
1404 #ifndef DISABLE_IPV6
1405 if (r->h->family == FW3_FAMILY_V6)
1406 {
1407 s = SZ(ip6t_entry);
1408
1409 for (m = r->matches; m; m = m->next)
1410 s += SZ(ip6t_entry_match) + m->match->size;
1411
1412 s += SZ(ip6t_entry_target);
1413 if (r->target)
1414 s += r->target->size;
1415
1416 mask = fw3_alloc(s);
1417 memset(mask, 0xFF, SZ(ip6t_entry));
1418 p = mask + SZ(ip6t_entry);
1419
1420 for (m = r->matches; m; m = m->next)
1421 {
1422 memset(p, 0xFF, SZ(ip6t_entry_match) + m->match->userspacesize);
1423 p += SZ(ip6t_entry_match) + m->match->size;
1424 }
1425
1426 memset(p, 0xFF, SZ(ip6t_entry_target) + (r->target ? r->target->userspacesize : 0));
1427 }
1428 else
1429 #endif
1430 {
1431 s = SZ(ipt_entry);
1432
1433 for (m = r->matches; m; m = m->next)
1434 s += SZ(ipt_entry_match) + m->match->size;
1435
1436 s += SZ(ipt_entry_target);
1437 if (r->target)
1438 s += r->target->size;
1439
1440 mask = fw3_alloc(s);
1441 memset(mask, 0xFF, SZ(ipt_entry));
1442 p = mask + SZ(ipt_entry);
1443
1444 for (m = r->matches; m; m = m->next)
1445 {
1446 memset(p, 0xFF, SZ(ipt_entry_match) + m->match->userspacesize);
1447 p += SZ(ipt_entry_match) + m->match->size;
1448 }
1449
1450 memset(p, 0xFF, SZ(ipt_entry_target) + (r->target ? r->target->userspacesize : 0));
1451 }
1452
1453 return mask;
1454 }
1455
1456 static void *
1457 rule_build(struct fw3_ipt_rule *r)
1458 {
1459 size_t s, target_size = (r->target) ? r->target->t->u.target_size : 0;
1460 struct xtables_rule_match *m;
1461
1462 #ifndef DISABLE_IPV6
1463 if (r->h->family == FW3_FAMILY_V6)
1464 {
1465 struct ip6t_entry *e6;
1466
1467 s = XT_ALIGN(sizeof(struct ip6t_entry));
1468
1469 for (m = r->matches; m; m = m->next)
1470 s += m->match->m->u.match_size;
1471
1472 e6 = fw3_alloc(s + target_size);
1473
1474 memcpy(e6, &r->e6, sizeof(struct ip6t_entry));
1475
1476 e6->target_offset = s;
1477 e6->next_offset = s + target_size;
1478
1479 s = 0;
1480
1481 for (m = r->matches; m; m = m->next)
1482 {
1483 memcpy(e6->elems + s, m->match->m, m->match->m->u.match_size);
1484 s += m->match->m->u.match_size;
1485 }
1486
1487 if (target_size)
1488 memcpy(e6->elems + s, r->target->t, target_size);
1489
1490 return e6;
1491 }
1492 else
1493 #endif
1494 {
1495 struct ipt_entry *e;
1496
1497 s = XT_ALIGN(sizeof(struct ipt_entry));
1498
1499 for (m = r->matches; m; m = m->next)
1500 s += m->match->m->u.match_size;
1501
1502 e = fw3_alloc(s + target_size);
1503
1504 memcpy(e, &r->e, sizeof(struct ipt_entry));
1505
1506 e->target_offset = s;
1507 e->next_offset = s + target_size;
1508
1509 s = 0;
1510
1511 for (m = r->matches; m; m = m->next)
1512 {
1513 memcpy(e->elems + s, m->match->m, m->match->m->u.match_size);
1514 s += m->match->m->u.match_size;
1515 }
1516
1517 if (target_size)
1518 memcpy(e->elems + s, r->target->t, target_size);
1519
1520 return e;
1521 }
1522 }
1523
1524 static void
1525 set_rule_tag(struct fw3_ipt_rule *r)
1526 {
1527 int i;
1528 char *p, **tmp;
1529 const char *tag = "!fw3";
1530
1531 for (i = 0; i < r->argc; i++)
1532 if (!strcmp(r->argv[i], "--comment") && (i + 1) < r->argc)
1533 if (asprintf(&p, "%s: %s", tag, r->argv[i + 1]) > 0)
1534 {
1535 free(r->argv[i + 1]);
1536 r->argv[i + 1] = p;
1537 return;
1538 }
1539
1540 tmp = realloc(r->argv, (r->argc + 4) * sizeof(*r->argv));
1541
1542 if (tmp)
1543 {
1544 r->argv = tmp;
1545 r->argv[r->argc++] = fw3_strdup("-m");
1546 r->argv[r->argc++] = fw3_strdup("comment");
1547 r->argv[r->argc++] = fw3_strdup("--comment");
1548 r->argv[r->argc++] = fw3_strdup(tag);
1549 }
1550 }
1551
1552 void
1553 __fw3_ipt_rule_append(struct fw3_ipt_rule *r, bool repl, const char *fmt, ...)
1554 {
1555 void *rule;
1556 unsigned char *mask;
1557
1558 struct xtables_rule_match *m;
1559 struct xtables_match *em;
1560 struct xtables_target *et;
1561 struct xtables_globals *g;
1562
1563 struct fw3_device dev;
1564 struct fw3_address addr;
1565
1566 enum xtables_exittype status;
1567
1568 int i, optc;
1569 bool inv = false;
1570 char buf[32];
1571 va_list ap;
1572
1573 va_start(ap, fmt);
1574 vsnprintf(buf, sizeof(buf) - 1, fmt, ap);
1575 va_end(ap);
1576
1577 g = (r->h->family == FW3_FAMILY_V6) ? &xtg6 : &xtg;
1578 g->opts = g->orig_opts;
1579
1580 optind = 0;
1581 opterr = 0;
1582
1583 status = setjmp(fw3_ipt_error_jmp);
1584
1585 if (status > 0)
1586 {
1587 info(" ! Skipping due to previous exception (code %u)", status);
1588 goto free;
1589 }
1590
1591 set_rule_tag(r);
1592
1593 while ((optc = getopt_long(r->argc, r->argv, "-:m:j:i:o:s:d:", g->opts,
1594 NULL)) != -1)
1595 {
1596 switch (optc)
1597 {
1598 case 'm':
1599 em = find_match(r, optarg);
1600
1601 if (!em)
1602 {
1603 warn("fw3_ipt_rule_append(): Can't find match '%s'", optarg);
1604 goto free;
1605 }
1606
1607 init_match(r, em, true);
1608 break;
1609
1610 case 'j':
1611 et = get_target(r, optarg);
1612
1613 if (!et)
1614 {
1615 warn("fw3_ipt_rule_append(): Can't find target '%s'", optarg);
1616 goto free;
1617 }
1618
1619 break;
1620
1621 case 'i':
1622 case 'o':
1623 if (!fw3_parse_device(&dev, optarg, false) ||
1624 dev.any || dev.invert || *dev.network)
1625 {
1626 warn("fw3_ipt_rule_append(): Bad argument '%s'", optarg);
1627 goto free;
1628 }
1629
1630 dev.invert = inv;
1631 fw3_ipt_rule_in_out(r, (optc == 'i') ? &dev : NULL,
1632 (optc == 'o') ? &dev : NULL);
1633 break;
1634
1635 case 's':
1636 case 'd':
1637 if (!fw3_parse_address(&addr, optarg, false) ||
1638 addr.range || addr.invert)
1639 {
1640 warn("fw3_ipt_rule_append(): Bad argument '%s'", optarg);
1641 goto free;
1642 }
1643
1644 addr.invert = inv;
1645 fw3_ipt_rule_src_dest(r, (optc == 's') ? &addr : NULL,
1646 (optc == 'd') ? &addr : NULL);
1647 break;
1648
1649 case 1:
1650 if ((optarg[0] == '!') && (optarg[1] == '\0'))
1651 {
1652 optarg[0] = '\0';
1653 inv = true;
1654 continue;
1655 }
1656
1657 warn("fw3_ipt_rule_append(): Bad argument '%s'", optarg);
1658 goto free;
1659
1660 default:
1661 if (parse_option(r, optc, inv))
1662 continue;
1663 break;
1664 }
1665
1666 inv = false;
1667 }
1668
1669 for (m = r->matches; m; m = m->next)
1670 xtables_option_mfcall(m->match);
1671
1672 if (r->target)
1673 xtables_option_tfcall(r->target);
1674
1675 rule = rule_build(r);
1676
1677 #ifndef DISABLE_IPV6
1678 if (r->h->family == FW3_FAMILY_V6)
1679 {
1680 if (repl)
1681 {
1682 mask = rule_mask(r);
1683
1684 while (ip6tc_delete_entry(buf, rule, mask, r->h->handle))
1685 if (fw3_pr_debug)
1686 rule_print(r, "-D", buf);
1687
1688 free(mask);
1689 }
1690
1691 if (fw3_pr_debug)
1692 rule_print(r, "-A", buf);
1693
1694 if (!ip6tc_append_entry(buf, rule, r->h->handle))
1695 warn("ip6tc_append_entry(): %s", ip6tc_strerror(errno));
1696 }
1697 else
1698 #endif
1699 {
1700 if (repl)
1701 {
1702 mask = rule_mask(r);
1703
1704 while (iptc_delete_entry(buf, rule, mask, r->h->handle))
1705 if (fw3_pr_debug)
1706 rule_print(r, "-D", buf);
1707
1708 free(mask);
1709 }
1710
1711 if (fw3_pr_debug)
1712 rule_print(r, "-A", buf);
1713
1714 if (!iptc_append_entry(buf, rule, r->h->handle))
1715 warn("iptc_append_entry(): %s\n", iptc_strerror(errno));
1716 }
1717
1718 free(rule);
1719
1720 free:
1721 for (i = 1; i < r->argc; i++)
1722 free(r->argv[i]);
1723
1724 free(r->argv);
1725
1726 xtables_rule_matches_free(&r->matches);
1727
1728 if (r->target)
1729 free(r->target->t);
1730
1731 free(r);
1732
1733 /* reset all targets and matches */
1734 for (em = xtables_matches; em; em = em->next)
1735 em->mflags = 0;
1736
1737 for (et = xtables_targets; et; et = et->next)
1738 {
1739 et->tflags = 0;
1740 et->used = 0;
1741 }
1742
1743 xtables_free_opts(1);
1744 }
1745
1746 struct fw3_ipt_rule *
1747 fw3_ipt_rule_create(struct fw3_ipt_handle *handle, struct fw3_protocol *proto,
1748 struct fw3_device *in, struct fw3_device *out,
1749 struct fw3_address *src, struct fw3_address *dest)
1750 {
1751 struct fw3_ipt_rule *r;
1752
1753 r = fw3_ipt_rule_new(handle);
1754
1755 fw3_ipt_rule_proto(r, proto);
1756 fw3_ipt_rule_in_out(r, in, out);
1757 fw3_ipt_rule_src_dest(r, src, dest);
1758
1759 return r;
1760 }
1761
1762 void
1763 xtables_register_match(struct xtables_match *me)
1764 {
1765 int i;
1766 static struct xtables_match **tmp;
1767
1768 if (!xext.register_match)
1769 xext.register_match = dlsym(RTLD_NEXT, "xtables_register_match");
1770
1771 if (!xext.register_match)
1772 return;
1773
1774 xext.register_match(me);
1775
1776 if (xext.retain)
1777 {
1778 for (i = 0; i < xext.mcount; i++)
1779 if (xext.matches[i] == me)
1780 return;
1781
1782 tmp = realloc(xext.matches, sizeof(me) * (xext.mcount + 1));
1783
1784 if (!tmp)
1785 return;
1786
1787 xext.matches = tmp;
1788 xext.matches[xext.mcount++] = me;
1789 }
1790 }
1791
1792 void
1793 xtables_register_target(struct xtables_target *me)
1794 {
1795 int i;
1796 static struct xtables_target **tmp;
1797
1798 if (!xext.register_target)
1799 xext.register_target = dlsym(RTLD_NEXT, "xtables_register_target");
1800
1801 if (!xext.register_target)
1802 return;
1803
1804 xext.register_target(me);
1805
1806 if (xext.retain)
1807 {
1808 for (i = 0; i < xext.tcount; i++)
1809 if (xext.targets[i] == me)
1810 return;
1811
1812 tmp = realloc(xext.targets, sizeof(me) * (xext.tcount + 1));
1813
1814 if (!tmp)
1815 return;
1816
1817 xext.targets = tmp;
1818 xext.targets[xext.tcount++] = me;
1819 }
1820 }