summaryrefslogtreecommitdiffstats
path: root/iptables/xtoptions.c
diff options
context:
space:
mode:
Diffstat (limited to 'iptables/xtoptions.c')
-rw-r--r--iptables/xtoptions.c1171
1 files changed, 0 insertions, 1171 deletions
diff --git a/iptables/xtoptions.c b/iptables/xtoptions.c
deleted file mode 100644
index 5f617a42..00000000
--- a/iptables/xtoptions.c
+++ /dev/null
@@ -1,1171 +0,0 @@
-/*
- * Argument parser
- * Copyright © Jan Engelhardt, 2011
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation; either version 2 of
- * the License, or (at your option) any later version.
- */
-#include <ctype.h>
-#include <errno.h>
-#include <getopt.h>
-#include <limits.h>
-#include <netdb.h>
-#include <stdbool.h>
-#include <stdint.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <syslog.h>
-#include <arpa/inet.h>
-#include <netinet/ip.h>
-#include "xtables.h"
-#include "xshared.h"
-#ifndef IPTOS_NORMALSVC
-# define IPTOS_NORMALSVC 0
-#endif
-
-#define XTOPT_MKPTR(cb) \
- ((void *)((char *)(cb)->data + (cb)->entry->ptroff))
-
-/**
- * Simple key-value pairs for syslog levels
- */
-struct syslog_level {
- char name[8];
- uint8_t level;
-};
-
-struct tos_value_mask {
- uint8_t value, mask;
-};
-
-static const size_t xtopt_psize[] = {
- /*
- * All types not listed here, and thus essentially being initialized to
- * zero have zero on purpose.
- */
- [XTTYPE_UINT8] = sizeof(uint8_t),
- [XTTYPE_UINT16] = sizeof(uint16_t),
- [XTTYPE_UINT32] = sizeof(uint32_t),
- [XTTYPE_UINT64] = sizeof(uint64_t),
- [XTTYPE_UINT8RC] = sizeof(uint8_t[2]),
- [XTTYPE_UINT16RC] = sizeof(uint16_t[2]),
- [XTTYPE_UINT32RC] = sizeof(uint32_t[2]),
- [XTTYPE_UINT64RC] = sizeof(uint64_t[2]),
- [XTTYPE_DOUBLE] = sizeof(double),
- [XTTYPE_STRING] = -1,
- [XTTYPE_SYSLOGLEVEL] = sizeof(uint8_t),
- [XTTYPE_HOST] = sizeof(union nf_inet_addr),
- [XTTYPE_HOSTMASK] = sizeof(union nf_inet_addr),
- [XTTYPE_PROTOCOL] = sizeof(uint8_t),
- [XTTYPE_PORT] = sizeof(uint16_t),
- [XTTYPE_PORTRC] = sizeof(uint16_t[2]),
- [XTTYPE_PLENMASK] = sizeof(union nf_inet_addr),
- [XTTYPE_ETHERMAC] = sizeof(uint8_t[6]),
-};
-
-/**
- * Creates getopt options from the x6-style option map, and assigns each a
- * getopt id.
- */
-struct option *
-xtables_options_xfrm(struct option *orig_opts, struct option *oldopts,
- const struct xt_option_entry *entry, unsigned int *offset)
-{
- unsigned int num_orig, num_old = 0, num_new, i;
- struct option *merge, *mp;
-
- if (entry == NULL)
- return oldopts;
- for (num_orig = 0; orig_opts[num_orig].name != NULL; ++num_orig)
- ;
- if (oldopts != NULL)
- for (num_old = 0; oldopts[num_old].name != NULL; ++num_old)
- ;
- for (num_new = 0; entry[num_new].name != NULL; ++num_new)
- ;
-
- /*
- * Since @oldopts also has @orig_opts already (and does so at the
- * start), skip these entries.
- */
- oldopts += num_orig;
- num_old -= num_orig;
-
- merge = malloc(sizeof(*mp) * (num_orig + num_old + num_new + 1));
- if (merge == NULL)
- return NULL;
-
- /* Let the base options -[ADI...] have precedence over everything */
- memcpy(merge, orig_opts, sizeof(*mp) * num_orig);
- mp = merge + num_orig;
-
- /* Second, the new options */
- xt_params->option_offset += XT_OPTION_OFFSET_SCALE;
- *offset = xt_params->option_offset;
-
- for (i = 0; i < num_new; ++i, ++mp, ++entry) {
- mp->name = entry->name;
- mp->has_arg = entry->type != XTTYPE_NONE;
- mp->flag = NULL;
- mp->val = entry->id + *offset;
- }
-
- /* Third, the old options */
- memcpy(mp, oldopts, sizeof(*mp) * num_old);
- mp += num_old;
- xtables_free_opts(0);
-
- /* Clear trailing entry */
- memset(mp, 0, sizeof(*mp));
- return merge;
-}
-
-/**
- * Give the upper limit for a certain type.
- */
-static uintmax_t xtopt_max_by_type(enum xt_option_type type)
-{
- switch (type) {
- case XTTYPE_UINT8:
- case XTTYPE_UINT8RC:
- return UINT8_MAX;
- case XTTYPE_UINT16:
- case XTTYPE_UINT16RC:
- return UINT16_MAX;
- case XTTYPE_UINT32:
- case XTTYPE_UINT32RC:
- return UINT32_MAX;
- case XTTYPE_UINT64:
- case XTTYPE_UINT64RC:
- return UINT64_MAX;
- default:
- return 0;
- }
-}
-
-/**
- * Return the size of a single entity based upon a type - predominantly an
- * XTTYPE_UINT*RC type.
- */
-static size_t xtopt_esize_by_type(enum xt_option_type type)
-{
- switch (type) {
- case XTTYPE_UINT8RC:
- return xtopt_psize[XTTYPE_UINT8];
- case XTTYPE_UINT16RC:
- return xtopt_psize[XTTYPE_UINT16];
- case XTTYPE_UINT32RC:
- return xtopt_psize[XTTYPE_UINT32];
- case XTTYPE_UINT64RC:
- return xtopt_psize[XTTYPE_UINT64];
- default:
- return xtopt_psize[type];
- }
-}
-
-/**
- * Require a simple integer.
- */
-static void xtopt_parse_int(struct xt_option_call *cb)
-{
- const struct xt_option_entry *entry = cb->entry;
- uintmax_t lmin = 0, lmax = xtopt_max_by_type(entry->type);
- uintmax_t value;
-
- if (cb->entry->min != 0)
- lmin = cb->entry->min;
- if (cb->entry->max != 0)
- lmax = cb->entry->max;
-
- if (!xtables_strtoul(cb->arg, NULL, &value, lmin, lmax))
- xt_params->exit_err(PARAMETER_PROBLEM,
- "%s: bad value for option \"--%s\", "
- "or out of range (%ju-%ju).\n",
- cb->ext_name, entry->name, lmin, lmax);
-
- if (entry->type == XTTYPE_UINT8) {
- cb->val.u8 = value;
- if (entry->flags & XTOPT_PUT)
- *(uint8_t *)XTOPT_MKPTR(cb) = cb->val.u8;
- } else if (entry->type == XTTYPE_UINT16) {
- cb->val.u16 = value;
- if (entry->flags & XTOPT_PUT)
- *(uint16_t *)XTOPT_MKPTR(cb) = cb->val.u16;
- } else if (entry->type == XTTYPE_UINT32) {
- cb->val.u32 = value;
- if (entry->flags & XTOPT_PUT)
- *(uint32_t *)XTOPT_MKPTR(cb) = cb->val.u32;
- } else if (entry->type == XTTYPE_UINT64) {
- cb->val.u64 = value;
- if (entry->flags & XTOPT_PUT)
- *(uint64_t *)XTOPT_MKPTR(cb) = cb->val.u64;
- }
-}
-
-/**
- * Require a simple floating point number.
- */
-static void xtopt_parse_float(struct xt_option_call *cb)
-{
- const struct xt_option_entry *entry = cb->entry;
- double value;
- char *end;
-
- value = strtod(cb->arg, &end);
- if (end == cb->arg || *end != '\0' ||
- (entry->min != entry->max &&
- (value < entry->min || value > entry->max)))
- xt_params->exit_err(PARAMETER_PROBLEM,
- "%s: bad value for option \"--%s\", "
- "or out of range (%u-%u).\n",
- cb->ext_name, entry->name, entry->min, entry->max);
-
- cb->val.dbl = value;
- if (entry->flags & XTOPT_PUT)
- *(double *)XTOPT_MKPTR(cb) = cb->val.dbl;
-}
-
-/**
- * Copy the parsed value to the appropriate entry in cb->val.
- */
-static void xtopt_mint_value_to_cb(struct xt_option_call *cb, uintmax_t value)
-{
- const struct xt_option_entry *entry = cb->entry;
-
- if (cb->nvals >= ARRAY_SIZE(cb->val.u32_range))
- return;
- if (entry->type == XTTYPE_UINT8RC)
- cb->val.u8_range[cb->nvals] = value;
- else if (entry->type == XTTYPE_UINT16RC)
- cb->val.u16_range[cb->nvals] = value;
- else if (entry->type == XTTYPE_UINT32RC)
- cb->val.u32_range[cb->nvals] = value;
- else if (entry->type == XTTYPE_UINT64RC)
- cb->val.u64_range[cb->nvals] = value;
-}
-
-/**
- * Copy the parsed value to the data area, using appropriate type access.
- */
-static void xtopt_mint_value_to_ptr(struct xt_option_call *cb, void **datap,
- uintmax_t value)
-{
- const struct xt_option_entry *entry = cb->entry;
- void *data = *datap;
-
- if (!(entry->flags & XTOPT_PUT))
- return;
- if (entry->type == XTTYPE_UINT8RC)
- *(uint8_t *)data = value;
- else if (entry->type == XTTYPE_UINT16RC)
- *(uint16_t *)data = value;
- else if (entry->type == XTTYPE_UINT32RC)
- *(uint32_t *)data = value;
- else if (entry->type == XTTYPE_UINT64RC)
- *(uint64_t *)data = value;
- data += xtopt_esize_by_type(entry->type);
- *datap = data;
-}
-
-/**
- * Multiple integer parse routine.
- *
- * This function is capable of parsing any number of fields. Only the first
- * two values from the string will be put into @cb however (and as such,
- * @cb->val.uXX_range is just that large) to cater for the few extensions that
- * do not have a range[2] field, but {min, max}, and which cannot use
- * XTOPT_POINTER.
- */
-static void xtopt_parse_mint(struct xt_option_call *cb)
-{
- const struct xt_option_entry *entry = cb->entry;
- const char *arg = cb->arg;
- size_t esize = xtopt_esize_by_type(entry->type);
- const uintmax_t lmax = xtopt_max_by_type(entry->type);
- void *put = XTOPT_MKPTR(cb);
- unsigned int maxiter;
- uintmax_t value;
- char *end = "";
- char sep = ':';
-
- maxiter = entry->size / esize;
- if (maxiter == 0)
- maxiter = ARRAY_SIZE(cb->val.u32_range);
- if (entry->size % esize != 0)
- xt_params->exit_err(OTHER_PROBLEM, "%s: memory block does "
- "not have proper size\n", __func__);
-
- cb->nvals = 0;
- for (arg = cb->arg, end = (char *)arg; ; arg = end + 1) {
- if (cb->nvals == maxiter)
- xt_params->exit_err(PARAMETER_PROBLEM, "%s: Too many "
- "components for option \"--%s\" (max: %u)\n",
- cb->ext_name, entry->name, maxiter);
- if (*arg == '\0' || *arg == sep) {
- /* Default range components when field not spec'd. */
- end = (char *)arg;
- value = (cb->nvals == 1) ? lmax : 0;
- } else {
- if (!xtables_strtoul(arg, &end, &value, 0, lmax))
- xt_params->exit_err(PARAMETER_PROBLEM,
- "%s: bad value for option \"--%s\" near "
- "\"%s\", or out of range (0-%ju).\n",
- cb->ext_name, entry->name, arg, lmax);
- if (*end != '\0' && *end != sep)
- xt_params->exit_err(PARAMETER_PROBLEM,
- "%s: Argument to \"--%s\" has "
- "unexpected characters near \"%s\".\n",
- cb->ext_name, entry->name, end);
- }
- xtopt_mint_value_to_cb(cb, value);
- ++cb->nvals;
- xtopt_mint_value_to_ptr(cb, &put, value);
- if (*end == '\0')
- break;
- }
-}
-
-static void xtopt_parse_string(struct xt_option_call *cb)
-{
- const struct xt_option_entry *entry = cb->entry;
- size_t z = strlen(cb->arg);
- char *p;
-
- if (entry->min != 0 && z < entry->min)
- xt_params->exit_err(PARAMETER_PROBLEM,
- "Argument must have a minimum length of "
- "%u characters\n", entry->min);
- if (entry->max != 0 && z > entry->max)
- xt_params->exit_err(PARAMETER_PROBLEM,
- "Argument must have a maximum length of "
- "%u characters\n", entry->max);
- if (!(entry->flags & XTOPT_PUT))
- return;
- if (z >= entry->size)
- z = entry->size - 1;
- p = XTOPT_MKPTR(cb);
- strncpy(p, cb->arg, z);
- p[z] = '\0';
-}
-
-static const struct tos_symbol_info {
- unsigned char value;
- const char *name;
-} tos_symbol_names[] = {
- {IPTOS_LOWDELAY, "Minimize-Delay"},
- {IPTOS_THROUGHPUT, "Maximize-Throughput"},
- {IPTOS_RELIABILITY, "Maximize-Reliability"},
- {IPTOS_MINCOST, "Minimize-Cost"},
- {IPTOS_NORMALSVC, "Normal-Service"},
- {},
-};
-
-/*
- * tos_parse_numeric - parse a string like "15/255"
- *
- * @str: input string
- * @tvm: (value/mask) tuple
- * @max: maximum allowed value (must be pow(2,some_int)-1)
- */
-static bool tos_parse_numeric(const char *str, struct xt_option_call *cb,
- unsigned int max)
-{
- unsigned int value;
- char *end;
-
- xtables_strtoui(str, &end, &value, 0, max);
- cb->val.tos_value = value;
- cb->val.tos_mask = max;
-
- if (*end == '/') {
- const char *p = end + 1;
-
- if (!xtables_strtoui(p, &end, &value, 0, max))
- xtables_error(PARAMETER_PROBLEM, "Illegal value: \"%s\"",
- str);
- cb->val.tos_mask = value;
- }
-
- if (*end != '\0')
- xtables_error(PARAMETER_PROBLEM, "Illegal value: \"%s\"", str);
- return true;
-}
-
-/**
- * @str: input string
- * @tvm: (value/mask) tuple
- * @def_mask: mask to force when a symbolic name is used
- */
-static void xtopt_parse_tosmask(struct xt_option_call *cb)
-{
- const struct tos_symbol_info *symbol;
- char *tmp;
-
- if (xtables_strtoui(cb->arg, &tmp, NULL, 0, UINT8_MAX)) {
- tos_parse_numeric(cb->arg, cb, UINT8_MAX);
- return;
- }
- /*
- * This is our way we deal with different defaults
- * for different revisions.
- */
- cb->val.tos_mask = cb->entry->max;
- for (symbol = tos_symbol_names; symbol->name != NULL; ++symbol)
- if (strcasecmp(cb->arg, symbol->name) == 0) {
- cb->val.tos_value = symbol->value;
- return;
- }
-
- xtables_error(PARAMETER_PROBLEM, "Symbolic name \"%s\" is unknown",
- cb->arg);
-}
-
-/**
- * Validate the input for being conformant to "mark[/mask]".
- */
-static void xtopt_parse_markmask(struct xt_option_call *cb)
-{
- unsigned int mark = 0, mask = ~0U;
- char *end;
-
- if (!xtables_strtoui(cb->arg, &end, &mark, 0, UINT32_MAX))
- xt_params->exit_err(PARAMETER_PROBLEM,
- "%s: bad mark value for option \"--%s\", "
- "or out of range.\n",
- cb->ext_name, cb->entry->name);
- if (*end == '/' &&
- !xtables_strtoui(end + 1, &end, &mask, 0, UINT32_MAX))
- xt_params->exit_err(PARAMETER_PROBLEM,
- "%s: bad mask value for option \"--%s\", "
- "or out of range.\n",
- cb->ext_name, cb->entry->name);
- if (*end != '\0')
- xt_params->exit_err(PARAMETER_PROBLEM,
- "%s: trailing garbage after value "
- "for option \"--%s\".\n",
- cb->ext_name, cb->entry->name);
- cb->val.mark = mark;
- cb->val.mask = mask;
-}
-
-static int xtopt_sysloglvl_compare(const void *a, const void *b)
-{
- const char *name = a;
- const struct syslog_level *entry = b;
-
- return strcmp(name, entry->name);
-}
-
-static void xtopt_parse_sysloglevel(struct xt_option_call *cb)
-{
- static const struct syslog_level log_names[] = { /* must be sorted */
- {"alert", LOG_ALERT},
- {"crit", LOG_CRIT},
- {"debug", LOG_DEBUG},
- {"emerg", LOG_EMERG},
- {"error", LOG_ERR}, /* deprecated */
- {"info", LOG_INFO},
- {"notice", LOG_NOTICE},
- {"panic", LOG_EMERG}, /* deprecated */
- {"warning", LOG_WARNING},
- };
- const struct syslog_level *e;
- unsigned int num = 0;
-
- if (!xtables_strtoui(cb->arg, NULL, &num, 0, 7)) {
- e = bsearch(cb->arg, log_names, ARRAY_SIZE(log_names),
- sizeof(*log_names), xtopt_sysloglvl_compare);
- if (e == NULL)
- xt_params->exit_err(PARAMETER_PROBLEM,
- "log level \"%s\" unknown\n", cb->arg);
- num = e->level;
- }
- cb->val.syslog_level = num;
- if (cb->entry->flags & XTOPT_PUT)
- *(uint8_t *)XTOPT_MKPTR(cb) = num;
-}
-
-static void *xtables_sa_host(const void *sa, unsigned int afproto)
-{
- if (afproto == AF_INET6)
- return &((struct sockaddr_in6 *)sa)->sin6_addr;
- else if (afproto == AF_INET)
- return &((struct sockaddr_in *)sa)->sin_addr;
- return (void *)sa;
-}
-
-static socklen_t xtables_sa_hostlen(unsigned int afproto)
-{
- if (afproto == AF_INET6)
- return sizeof(struct in6_addr);
- else if (afproto == AF_INET)
- return sizeof(struct in_addr);
- return 0;
-}
-
-/**
- * Accepts: a hostname (DNS), or a single inetaddr - without any mask. The
- * result is stored in @cb->val.haddr. Additionally, @cb->val.hmask and
- * @cb->val.hlen are set for completeness to the appropriate values.
- */
-static void xtopt_parse_host(struct xt_option_call *cb)
-{
- struct addrinfo hints = {.ai_family = afinfo->family};
- unsigned int adcount = 0;
- struct addrinfo *res, *p;
- int ret;
-
- ret = getaddrinfo(cb->arg, NULL, &hints, &res);
- if (ret < 0)
- xt_params->exit_err(PARAMETER_PROBLEM,
- "getaddrinfo: %s\n", gai_strerror(ret));
-
- memset(&cb->val.hmask, 0xFF, sizeof(cb->val.hmask));
- cb->val.hlen = (afinfo->family == NFPROTO_IPV4) ? 32 : 128;
-
- for (p = res; p != NULL; p = p->ai_next) {
- if (adcount == 0) {
- memset(&cb->val.haddr, 0, sizeof(cb->val.haddr));
- memcpy(&cb->val.haddr,
- xtables_sa_host(p->ai_addr, p->ai_family),
- xtables_sa_hostlen(p->ai_family));
- ++adcount;
- continue;
- }
- if (memcmp(&cb->val.haddr,
- xtables_sa_host(p->ai_addr, p->ai_family),
- xtables_sa_hostlen(p->ai_family)) != 0)
- xt_params->exit_err(PARAMETER_PROBLEM,
- "%s resolves to more than one address\n",
- cb->arg);
- }
-
- freeaddrinfo(res);
- if (cb->entry->flags & XTOPT_PUT)
- /* Validation in xtables_option_metavalidate */
- memcpy(XTOPT_MKPTR(cb), &cb->val.haddr,
- sizeof(cb->val.haddr));
-}
-
-/**
- * @name: port name, or number as a string (e.g. "http" or "80")
- *
- * Resolve a port name to a number. Returns the port number in integral
- * form on success, or <0 on error. (errno will not be set.)
- */
-static int xtables_getportbyname(const char *name)
-{
- struct addrinfo *res = NULL, *p;
- int ret;
-
- ret = getaddrinfo(NULL, name, NULL, &res);
- if (ret < 0)
- return -1;
- ret = -1;
- for (p = res; p != NULL; p = p->ai_next) {
- if (p->ai_family == AF_INET6) {
- ret = ((struct sockaddr_in6 *)p->ai_addr)->sin6_port;
- break;
- } else if (p->ai_family == AF_INET) {
- ret = ((struct sockaddr_in *)p->ai_addr)->sin_port;
- break;
- }
- }
- freeaddrinfo(res);
- if (ret < 0)
- return ret;
- return ntohs(ret);
-}
-
-/**
- * Validate and parse a protocol specification (number or name) by use of
- * /etc/protocols and put the result into @cb->val.protocol.
- */
-static void xtopt_parse_protocol(struct xt_option_call *cb)
-{
- cb->val.protocol = xtables_parse_protocol(cb->arg);
- if (cb->entry->flags & XTOPT_PUT)
- *(uint8_t *)XTOPT_MKPTR(cb) = cb->val.protocol;
-}
-
-/**
- * Validate and parse a port specification and put the result into
- * @cb->val.port.
- */
-static void xtopt_parse_port(struct xt_option_call *cb)
-{
- const struct xt_option_entry *entry = cb->entry;
- int ret;
-
- ret = xtables_getportbyname(cb->arg);
- if (ret < 0)
- xt_params->exit_err(PARAMETER_PROBLEM,
- "Port \"%s\" does not resolve to anything.\n",
- cb->arg);
- if (entry->flags & XTOPT_NBO)
- ret = htons(ret);
- cb->val.port = ret;
- if (entry->flags & XTOPT_PUT)
- *(uint16_t *)XTOPT_MKPTR(cb) = cb->val.port;
-}
-
-static void xtopt_parse_mport(struct xt_option_call *cb)
-{
- static const size_t esize = sizeof(uint16_t);
- const struct xt_option_entry *entry = cb->entry;
- char *lo_arg, *wp_arg, *arg;
- unsigned int maxiter;
- int value;
-
- wp_arg = lo_arg = strdup(cb->arg);
- if (lo_arg == NULL)
- xt_params->exit_err(RESOURCE_PROBLEM, "strdup");
-
- maxiter = entry->size / esize;
- if (maxiter == 0)
- maxiter = 2; /* ARRAY_SIZE(cb->val.port_range) */
- if (entry->size % esize != 0)
- xt_params->exit_err(OTHER_PROBLEM, "%s: memory block does "
- "not have proper size\n", __func__);
-
- cb->val.port_range[0] = 0;
- cb->val.port_range[1] = UINT16_MAX;
- cb->nvals = 0;
-
- while ((arg = strsep(&wp_arg, ":")) != NULL) {
- if (cb->nvals == maxiter)
- xt_params->exit_err(PARAMETER_PROBLEM, "%s: Too many "
- "components for option \"--%s\" (max: %u)\n",
- cb->ext_name, entry->name, maxiter);
- if (*arg == '\0') {
- ++cb->nvals;
- continue;
- }
-
- value = xtables_getportbyname(arg);
- if (value < 0)
- xt_params->exit_err(PARAMETER_PROBLEM,
- "Port \"%s\" does not resolve to "
- "anything.\n", arg);
- if (entry->flags & XTOPT_NBO)
- value = htons(value);
- if (cb->nvals < ARRAY_SIZE(cb->val.port_range))
- cb->val.port_range[cb->nvals] = value;
- ++cb->nvals;
- }
-
- if (cb->nvals == 1) {
- cb->val.port_range[1] = cb->val.port_range[0];
- ++cb->nvals;
- }
- if (entry->flags & XTOPT_PUT)
- memcpy(XTOPT_MKPTR(cb), cb->val.port_range, sizeof(uint16_t) *
- (cb->nvals <= maxiter ? cb->nvals : maxiter));
- free(lo_arg);
-}
-
-/**
- * Parse an integer and ensure it is within the address family's prefix length
- * limits. The result is stored in @cb->val.hlen.
- */
-static void xtopt_parse_plen(struct xt_option_call *cb)
-{
- const struct xt_option_entry *entry = cb->entry;
- unsigned int prefix_len = 128; /* happiness is a warm gcc */
-
- cb->val.hlen = (afinfo->family == NFPROTO_IPV4) ? 32 : 128;
- if (!xtables_strtoui(cb->arg, NULL, &prefix_len, 0, cb->val.hlen))
- xt_params->exit_err(PARAMETER_PROBLEM,
- "%s: bad value for option \"--%s\", "
- "or out of range (%u-%u).\n",
- cb->ext_name, entry->name, 0, cb->val.hlen);
-
- cb->val.hlen = prefix_len;
-}
-
-/**
- * Reuse xtopt_parse_plen for testing the integer. Afterwards convert this to
- * a bitmask, and make it available through @cb->val.hmask (hlen remains
- * valid). If %XTOPT_PUT is used, hmask will be copied to the target area.
- */
-static void xtopt_parse_plenmask(struct xt_option_call *cb)
-{
- const struct xt_option_entry *entry = cb->entry;
- uint32_t *mask = cb->val.hmask.all;
-
- xtopt_parse_plen(cb);
-
- memset(mask, 0xFF, sizeof(union nf_inet_addr));
- /* This shifting is AF-independent. */
- if (cb->val.hlen == 0) {
- mask[0] = mask[1] = mask[2] = mask[3] = 0;
- } else if (cb->val.hlen <= 32) {
- mask[0] <<= 32 - cb->val.hlen;
- mask[1] = mask[2] = mask[3] = 0;
- } else if (cb->val.hlen <= 64) {
- mask[1] <<= 32 - (cb->val.hlen - 32);
- mask[2] = mask[3] = 0;
- } else if (cb->val.hlen <= 96) {
- mask[2] <<= 32 - (cb->val.hlen - 64);
- mask[3] = 0;
- } else if (cb->val.hlen <= 128) {
- mask[3] <<= 32 - (cb->val.hlen - 96);
- }
- mask[0] = htonl(mask[0]);
- mask[1] = htonl(mask[1]);
- mask[2] = htonl(mask[2]);
- mask[3] = htonl(mask[3]);
- if (entry->flags & XTOPT_PUT)
- memcpy(XTOPT_MKPTR(cb), mask, sizeof(union nf_inet_addr));
-}
-
-static void xtopt_parse_hostmask(struct xt_option_call *cb)
-{
- const char *orig_arg = cb->arg;
- char *work, *p;
-
- if (strchr(cb->arg, '/') == NULL) {
- xtopt_parse_host(cb);
- return;
- }
- work = strdup(orig_arg);
- if (work == NULL)
- xt_params->exit_err(PARAMETER_PROBLEM, "strdup");
- p = strchr(work, '/'); /* by def this can't be NULL now */
- *p++ = '\0';
- /*
- * Because xtopt_parse_host and xtopt_parse_plenmask would store
- * different things in the same target area, XTTYPE_HOSTMASK must
- * disallow XTOPT_PUT, which it does by forcing its absence,
- * cf. not being listed in xtopt_psize.
- */
- cb->arg = work;
- xtopt_parse_host(cb);
- cb->arg = p;
- xtopt_parse_plenmask(cb);
- cb->arg = orig_arg;
-}
-
-static void xtopt_parse_ethermac(struct xt_option_call *cb)
-{
- const char *arg = cb->arg;
- unsigned int i;
- char *end;
-
- for (i = 0; i < ARRAY_SIZE(cb->val.ethermac) - 1; ++i) {
- cb->val.ethermac[i] = strtoul(arg, &end, 16);
- if (*end != ':' || end - arg > 2)
- goto out;
- arg = end + 1;
- }
- i = ARRAY_SIZE(cb->val.ethermac) - 1;
- cb->val.ethermac[i] = strtoul(arg, &end, 16);
- if (*end != '\0' || end - arg > 2)
- goto out;
- if (cb->entry->flags & XTOPT_PUT)
- memcpy(XTOPT_MKPTR(cb), cb->val.ethermac,
- sizeof(cb->val.ethermac));
- return;
- out:
- xt_params->exit_err(PARAMETER_PROBLEM, "ether");
-}
-
-static void (*const xtopt_subparse[])(struct xt_option_call *) = {
- [XTTYPE_UINT8] = xtopt_parse_int,
- [XTTYPE_UINT16] = xtopt_parse_int,
- [XTTYPE_UINT32] = xtopt_parse_int,
- [XTTYPE_UINT64] = xtopt_parse_int,
- [XTTYPE_UINT8RC] = xtopt_parse_mint,
- [XTTYPE_UINT16RC] = xtopt_parse_mint,
- [XTTYPE_UINT32RC] = xtopt_parse_mint,
- [XTTYPE_UINT64RC] = xtopt_parse_mint,
- [XTTYPE_DOUBLE] = xtopt_parse_float,
- [XTTYPE_STRING] = xtopt_parse_string,
- [XTTYPE_TOSMASK] = xtopt_parse_tosmask,
- [XTTYPE_MARKMASK32] = xtopt_parse_markmask,
- [XTTYPE_SYSLOGLEVEL] = xtopt_parse_sysloglevel,
- [XTTYPE_HOST] = xtopt_parse_host,
- [XTTYPE_HOSTMASK] = xtopt_parse_hostmask,
- [XTTYPE_PROTOCOL] = xtopt_parse_protocol,
- [XTTYPE_PORT] = xtopt_parse_port,
- [XTTYPE_PORTRC] = xtopt_parse_mport,
- [XTTYPE_PLEN] = xtopt_parse_plen,
- [XTTYPE_PLENMASK] = xtopt_parse_plenmask,
- [XTTYPE_ETHERMAC] = xtopt_parse_ethermac,
-};
-
-/**
- * The master option parsing routine. May be used for the ".x6_parse"
- * function pointer in extensions if fully automatic parsing is desired.
- * It may be also called manually from a custom x6_parse function.
- */
-void xtables_option_parse(struct xt_option_call *cb)
-{
- const struct xt_option_entry *entry = cb->entry;
- unsigned int eflag = 1 << cb->entry->id;
-
- /*
- * With {.id = P_FOO, .excl = P_FOO} we can have simple double-use
- * prevention. Though it turned out that this is too much typing (most
- * of the options are one-time use only), so now we also have
- * %XTOPT_MULTI.
- */
- if ((!(entry->flags & XTOPT_MULTI) || (entry->excl & eflag)) &&
- cb->xflags & eflag)
- xt_params->exit_err(PARAMETER_PROBLEM,
- "%s: option \"--%s\" can only be used once.\n",
- cb->ext_name, cb->entry->name);
- if (cb->invert && !(entry->flags & XTOPT_INVERT))
- xt_params->exit_err(PARAMETER_PROBLEM,
- "%s: option \"--%s\" cannot be inverted.\n",
- cb->ext_name, entry->name);
- if (entry->type != XTTYPE_NONE && optarg == NULL)
- xt_params->exit_err(PARAMETER_PROBLEM,
- "%s: option \"--%s\" requires an argument.\n",
- cb->ext_name, entry->name);
- /*
- * Fill in fallback value for "nvals", in case an extension (as it
- * happened with libxt_conntrack.2) tries to read it, despite not using
- * a *RC option type.
- */
- cb->nvals = 1;
- if (entry->type <= ARRAY_SIZE(xtopt_subparse) &&
- xtopt_subparse[entry->type] != NULL)
- xtopt_subparse[entry->type](cb);
- /* Exclusion with other flags tested later in finalize. */
- cb->xflags |= 1 << entry->id;
-}
-
-/**
- * Verifies that an extension's option map descriptor is valid, and ought to
- * be called right after the extension has been loaded, and before option
- * merging/xfrm.
- */
-void xtables_option_metavalidate(const char *name,
- const struct xt_option_entry *entry)
-{
- for (; entry->name != NULL; ++entry) {
- if (entry->id >= CHAR_BIT * sizeof(unsigned int) ||
- entry->id >= XT_OPTION_OFFSET_SCALE)
- xt_params->exit_err(OTHER_PROBLEM,
- "Extension %s uses invalid ID %u\n",
- name, entry->id);
- if (!(entry->flags & XTOPT_PUT)) {
- if (entry->ptroff != 0)
- xt_params->exit_err(OTHER_PROBLEM,
- "%s: ptroff for \"--%s\" is non-"
- "zero but no XTOPT_PUT is specified. "
- "Oversight?", name, entry->name);
- continue;
- }
- if (entry->type >= ARRAY_SIZE(xtopt_psize) ||
- xtopt_psize[entry->type] == 0)
- xt_params->exit_err(OTHER_PROBLEM,
- "%s: entry type of option \"--%s\" cannot be "
- "combined with XTOPT_PUT\n",
- name, entry->name);
- if (xtopt_psize[entry->type] != -1 &&
- xtopt_psize[entry->type] != entry->size)
- xt_params->exit_err(OTHER_PROBLEM,
- "%s: option \"--%s\" points to a memory block "
- "of wrong size (expected %zu, got %zu)\n",
- name, entry->name,
- xtopt_psize[entry->type], entry->size);
- }
-}
-
-/**
- * Find an option entry by its id.
- */
-static const struct xt_option_entry *
-xtables_option_lookup(const struct xt_option_entry *entry, unsigned int id)
-{
- for (; entry->name != NULL; ++entry)
- if (entry->id == id)
- return entry;
- return NULL;
-}
-
-/**
- * @c: getopt id (i.e. with offset)
- * @fw: struct ipt_entry or ip6t_entry
- *
- * Dispatch arguments to the appropriate parse function, based upon the
- * extension's choice of API.
- */
-void xtables_option_tpcall(unsigned int c, char **argv, bool invert,
- struct xtables_target *t, void *fw)
-{
- struct xt_option_call cb;
-
- if (t->x6_parse == NULL) {
- if (t->parse != NULL)
- t->parse(c - t->option_offset, argv, invert,
- &t->tflags, fw, &t->t);
- return;
- }
-
- c -= t->option_offset;
- cb.entry = xtables_option_lookup(t->x6_options, c);
- if (cb.entry == NULL)
- xtables_error(OTHER_PROBLEM,
- "Extension does not know id %u\n", c);
- cb.arg = optarg;
- cb.invert = invert;
- cb.ext_name = t->name;
- cb.data = t->t->data;
- cb.xflags = t->tflags;
- cb.target = &t->t;
- cb.xt_entry = fw;
- cb.udata = t->udata;
- t->x6_parse(&cb);
- t->tflags = cb.xflags;
-}
-
-/**
- * @c: getopt id (i.e. with offset)
- * @fw: struct ipt_entry or ip6t_entry
- *
- * Dispatch arguments to the appropriate parse function, based upon the
- * extension's choice of API.
- */
-void xtables_option_mpcall(unsigned int c, char **argv, bool invert,
- struct xtables_match *m, void *fw)
-{
- struct xt_option_call cb;
-
- if (m->x6_parse == NULL) {
- if (m->parse != NULL)
- m->parse(c - m->option_offset, argv, invert,
- &m->mflags, fw, &m->m);
- return;
- }
-
- c -= m->option_offset;
- cb.entry = xtables_option_lookup(m->x6_options, c);
- if (cb.entry == NULL)
- xtables_error(OTHER_PROBLEM,
- "Extension does not know id %u\n", c);
- cb.arg = optarg;
- cb.invert = invert;
- cb.ext_name = m->name;
- cb.data = m->m->data;
- cb.xflags = m->mflags;
- cb.match = &m->m;
- cb.xt_entry = fw;
- cb.udata = m->udata;
- m->x6_parse(&cb);
- m->mflags = cb.xflags;
-}
-
-/**
- * @name: name of extension
- * @entry: current option (from all ext's entries) being validated
- * @xflags: flags the extension has collected
- * @i: conflicting option (id) to test for
- */
-static void
-xtables_option_fcheck2(const char *name, const struct xt_option_entry *entry,
- const struct xt_option_entry *other,
- unsigned int xflags)
-{
- unsigned int ef = 1 << entry->id, of = 1 << other->id;
-
- if (entry->also & of && !(xflags & of))
- xt_params->exit_err(PARAMETER_PROBLEM,
- "%s: option \"--%s\" also requires \"--%s\".\n",
- name, entry->name, other->name);
-
- if (!(entry->excl & of))
- /* Use of entry does not collide with other option, good. */
- return;
- if ((xflags & (ef | of)) != (ef | of))
- /* Conflicting options were not used. */
- return;
-
- xt_params->exit_err(PARAMETER_PROBLEM,
- "%s: option \"--%s\" cannot be used together with \"--%s\".\n",
- name, entry->name, other->name);
-}
-
-/**
- * @name: name of extension
- * @xflags: accumulated flags
- * @entry: extension's option table
- *
- * Check that all option constraints have been met. This effectively replaces
- * ->final_check of the older API.
- */
-void xtables_options_fcheck(const char *name, unsigned int xflags,
- const struct xt_option_entry *table)
-{
- const struct xt_option_entry *entry, *other;
- unsigned int i;
-
- for (entry = table; entry->name != NULL; ++entry) {
- if (entry->flags & XTOPT_MAND &&
- !(xflags & (1 << entry->id)))
- xt_params->exit_err(PARAMETER_PROBLEM,
- "%s: option \"--%s\" must be specified\n",
- name, entry->name);
- if (!(xflags & (1 << entry->id)))
- /* Not required, not specified, thus skip. */
- continue;
-
- for (i = 0; i < CHAR_BIT * sizeof(entry->id); ++i) {
- if (entry->id == i)
- /*
- * Avoid conflict with self. Multi-use check
- * was done earlier in xtables_option_parse.
- */
- continue;
- other = xtables_option_lookup(table, i);
- if (other == NULL)
- continue;
- xtables_option_fcheck2(name, entry, other, xflags);
- }
- }
-}
-
-/**
- * Dispatch arguments to the appropriate final_check function, based upon the
- * extension's choice of API.
- */
-void xtables_option_tfcall(struct xtables_target *t)
-{
- if (t->x6_fcheck != NULL) {
- struct xt_fcheck_call cb;
-
- cb.ext_name = t->name;
- cb.data = t->t->data;
- cb.xflags = t->tflags;
- cb.udata = t->udata;
- t->x6_fcheck(&cb);
- } else if (t->final_check != NULL) {
- t->final_check(t->tflags);
- }
- if (t->x6_options != NULL)
- xtables_options_fcheck(t->name, t->tflags, t->x6_options);
-}
-
-/**
- * Dispatch arguments to the appropriate final_check function, based upon the
- * extension's choice of API.
- */
-void xtables_option_mfcall(struct xtables_match *m)
-{
- if (m->x6_fcheck != NULL) {
- struct xt_fcheck_call cb;
-
- cb.ext_name = m->name;
- cb.data = m->m->data;
- cb.xflags = m->mflags;
- cb.udata = m->udata;
- m->x6_fcheck(&cb);
- } else if (m->final_check != NULL) {
- m->final_check(m->mflags);
- }
- if (m->x6_options != NULL)
- xtables_options_fcheck(m->name, m->mflags, m->x6_options);
-}
-
-struct xtables_lmap *xtables_lmap_init(const char *file)
-{
- struct xtables_lmap *lmap_head = NULL, *lmap_prev = NULL, *lmap_this;
- char buf[512];
- FILE *fp;
- char *cur, *nxt;
- int id;
-
- fp = fopen(file, "re");
- if (fp == NULL)
- return NULL;
-
- while (fgets(buf, sizeof(buf), fp) != NULL) {
- cur = buf;
- while (isspace(*cur))
- ++cur;
- if (*cur == '#' || *cur == '\n' || *cur == '\0')
- continue;
-
- /* iproute2 allows hex and dec format */
- errno = 0;
- id = strtoul(cur, &nxt, strncmp(cur, "0x", 2) == 0 ? 16 : 10);
- if (nxt == cur || errno != 0)
- continue;
-
- /* same boundaries as in iproute2 */
- if (id < 0 || id > 255)
- continue;
- cur = nxt;
-
- if (!isspace(*cur))
- continue;
- while (isspace(*cur))
- ++cur;
- if (*cur == '#' || *cur == '\n' || *cur == '\0')
- continue;
- nxt = cur;
- while (*nxt != '\0' && !isspace(*nxt))
- ++nxt;
- if (nxt == cur)
- continue;
- *nxt = '\0';
-
- /* found valid data */
- lmap_this = malloc(sizeof(*lmap_this));
- if (lmap_this == NULL) {
- perror("malloc");
- goto out;
- }
- lmap_this->id = id;
- lmap_this->name = strdup(cur);
- if (lmap_this->name == NULL) {
- free(lmap_this);
- goto out;
- }
- lmap_this->next = NULL;
-
- if (lmap_prev != NULL)
- lmap_prev->next = lmap_this;
- else
- lmap_head = lmap_this;
- lmap_prev = lmap_this;
- }
-
- fclose(fp);
- return lmap_head;
- out:
- xtables_lmap_free(lmap_head);
- return NULL;
-}
-
-void xtables_lmap_free(struct xtables_lmap *head)
-{
- struct xtables_lmap *next;
-
- for (; head != NULL; head = next) {
- next = head->next;
- free(head->name);
- free(head);
- }
-}
-
-int xtables_lmap_name2id(const struct xtables_lmap *head, const char *name)
-{
- for (; head != NULL; head = head->next)
- if (strcmp(head->name, name) == 0)
- return head->id;
- return -1;
-}
-
-const char *xtables_lmap_id2name(const struct xtables_lmap *head, int id)
-{
- for (; head != NULL; head = head->next)
- if (head->id == id)
- return head->name;
- return NULL;
-}