From 8816e91cddef785c78b3598c7c41a1f88be08f5a Mon Sep 17 00:00:00 2001 From: Jan Engelhardt Date: Sun, 18 Sep 2011 15:06:05 +0200 Subject: build: restore build order of modules iptables(exe) requires libext.a, but extensions/ require libxtables.la (in iptables/). This circular dependency does not work out, so separate libxtables into its own directory and put it in front. Signed-off-by: Jan Engelhardt --- Makefile.am | 5 +- configure.ac | 2 +- extensions/GNUmakefile.in | 4 +- iptables/Makefile.am | 18 +- iptables/xtables.c | 1832 --------------------------------------------- iptables/xtoptions.c | 1171 ----------------------------- libxtables/Makefile.am | 20 + libxtables/xtables.c | 1832 +++++++++++++++++++++++++++++++++++++++++++++ libxtables/xtoptions.c | 1171 +++++++++++++++++++++++++++++ 9 files changed, 3031 insertions(+), 3024 deletions(-) delete mode 100644 iptables/xtables.c delete mode 100644 iptables/xtoptions.c create mode 100644 libxtables/Makefile.am create mode 100644 libxtables/xtables.c create mode 100644 libxtables/xtoptions.c diff --git a/Makefile.am b/Makefile.am index 9167e8e3..4eb63ebe 100644 --- a/Makefile.am +++ b/Makefile.am @@ -3,7 +3,7 @@ ACLOCAL_AMFLAGS = -I m4 AUTOMAKE_OPTIONS = foreign subdir-objects -SUBDIRS = libiptc iptables +SUBDIRS = libiptc libxtables if ENABLE_DEVEL SUBDIRS += include endif @@ -13,7 +13,10 @@ endif if HAVE_LIBNFNETLINK SUBDIRS += utils endif +# Depends on libxtables: SUBDIRS += extensions +# Depends on extensions/libext.a: +SUBDIRS += iptables .PHONY: tarball tarball: diff --git a/configure.ac b/configure.ac index 22b7bf15..8afba8c1 100644 --- a/configure.ac +++ b/configure.ac @@ -112,6 +112,6 @@ AC_SUBST([libxtables_vmajor]) AC_CONFIG_FILES([Makefile extensions/GNUmakefile include/Makefile iptables/Makefile iptables/xtables.pc libipq/Makefile libipq/libipq.pc - libiptc/Makefile libiptc/libiptc.pc utils/Makefile + libiptc/Makefile libiptc/libiptc.pc libxtables/Makefile utils/Makefile include/xtables.h include/iptables/internal.h]) AC_OUTPUT diff --git a/extensions/GNUmakefile.in b/extensions/GNUmakefile.in index 60f28c0c..221c2c91 100644 --- a/extensions/GNUmakefile.in +++ b/extensions/GNUmakefile.in @@ -72,10 +72,10 @@ all: ${targets} check check: ${targets} @echo " CHECK unknown symbols in .so files"; \ - . ../iptables/libxtables.la; \ + . ../libxtables/libxtables.la; \ for i in "" lib*.so; do \ [ -z "$$i" ] && continue; \ - LD_PRELOAD="$$dlname" LD_LIBRARY_PATH=../iptables/.libs \ + LD_PRELOAD="$$dlname" LD_LIBRARY_PATH=../libxtables/.libs \ ldd -r $$i 2>&1 >/dev/null; \ done; diff --git a/iptables/Makefile.am b/iptables/Makefile.am index af620f76..bdd4da11 100644 --- a/iptables/Makefile.am +++ b/iptables/Makefile.am @@ -3,22 +3,6 @@ AM_CFLAGS = ${regular_CFLAGS} AM_CPPFLAGS = ${regular_CPPFLAGS} -I${top_builddir}/include -I${top_srcdir}/include ${kinclude_CPPFLAGS} -lib_LTLIBRARIES = libxtables.la -libxtables_la_SOURCES = xtables.c xtoptions.c -libxtables_la_LDFLAGS = -version-info ${libxtables_vcurrent}:0:${libxtables_vage} -libxtables_la_LIBADD = -if ENABLE_STATIC -# With --enable-static, shipped extensions are linked into the main executable, -# so we need all the LIBADDs here too -libxtables_la_LIBADD += -lm -endif -if ENABLE_SHARED -libxtables_la_CFLAGS = ${AM_CFLAGS} -libxtables_la_LIBADD += -ldl -else -libxtables_la_CFLAGS = ${AM_CFLAGS} -DNO_SHARED_LIBS=1 -endif - xtables_multi_SOURCES = xtables-multi.c iptables-xml.c xtables_multi_CFLAGS = ${AM_CFLAGS} xtables_multi_LDADD = ../extensions/libext.a @@ -38,7 +22,7 @@ xtables_multi_CFLAGS += -DENABLE_IPV6 xtables_multi_LDADD += ../libiptc/libip6tc.la ../extensions/libext6.a endif xtables_multi_SOURCES += xshared.c -xtables_multi_LDADD += libxtables.la -lm +xtables_multi_LDADD += ../libxtables/libxtables.la -lm sbin_PROGRAMS = xtables-multi man_MANS = iptables.8 iptables-restore.8 iptables-save.8 \ diff --git a/iptables/xtables.c b/iptables/xtables.c deleted file mode 100644 index 014e115b..00000000 --- a/iptables/xtables.c +++ /dev/null @@ -1,1832 +0,0 @@ -/* - * (C) 2000-2006 by the netfilter coreteam : - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2 of the License, or - * (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * - * You should have received a copy of the GNU General Public License - * along with this program; if not, write to the Free Software - * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. - */ -#include "config.h" -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#if defined(HAVE_LINUX_MAGIC_H) -# include /* for PROC_SUPER_MAGIC */ -#elif defined(HAVE_LINUX_PROC_FS_H) -# include /* Linux 2.4 */ -#else -# define PROC_SUPER_MAGIC 0x9fa0 -#endif - -#include -#include /* INT_MAX in ip_tables.h/ip6_tables.h */ -#include -#include -#include - -#ifndef NO_SHARED_LIBS -#include -#endif -#ifndef IPT_SO_GET_REVISION_MATCH /* Old kernel source. */ -# define IPT_SO_GET_REVISION_MATCH (IPT_BASE_CTL + 2) -# define IPT_SO_GET_REVISION_TARGET (IPT_BASE_CTL + 3) -#endif -#ifndef IP6T_SO_GET_REVISION_MATCH /* Old kernel source. */ -# define IP6T_SO_GET_REVISION_MATCH 68 -# define IP6T_SO_GET_REVISION_TARGET 69 -#endif -#include -#include "iptables/internal.h" -#include "xshared.h" - -#define NPROTO 255 - -#ifndef PROC_SYS_MODPROBE -#define PROC_SYS_MODPROBE "/proc/sys/kernel/modprobe" -#endif - -/* we need this for ip6?tables-restore. ip6?tables-restore.c sets line to the - * current line of the input file, in order to give a more precise error - * message. ip6?tables itself doesn't need this, so it is initialized to the - * magic number of -1 */ -int line = -1; - -void basic_exit_err(enum xtables_exittype status, const char *msg, ...) __attribute__((noreturn, format(printf,2,3))); - -struct xtables_globals *xt_params = NULL; - -void basic_exit_err(enum xtables_exittype status, const char *msg, ...) -{ - va_list args; - - va_start(args, msg); - fprintf(stderr, "%s v%s: ", xt_params->program_name, xt_params->program_version); - vfprintf(stderr, msg, args); - va_end(args); - fprintf(stderr, "\n"); - exit(status); -} - -void xtables_free_opts(int unused) -{ - if (xt_params->opts != xt_params->orig_opts) { - free(xt_params->opts); - xt_params->opts = NULL; - } -} - -struct option *xtables_merge_options(struct option *orig_opts, - struct option *oldopts, - const struct option *newopts, - unsigned int *option_offset) -{ - unsigned int num_oold = 0, num_old = 0, num_new = 0, i; - struct option *merge, *mp; - - if (newopts == NULL) - return oldopts; - - for (num_oold = 0; orig_opts[num_oold].name; num_oold++) ; - if (oldopts != NULL) - for (num_old = 0; oldopts[num_old].name; num_old++) ; - for (num_new = 0; newopts[num_new].name; num_new++) ; - - /* - * Since @oldopts also has @orig_opts already (and does so at the - * start), skip these entries. - */ - oldopts += num_oold; - num_old -= num_oold; - - merge = malloc(sizeof(*mp) * (num_oold + num_old + num_new + 1)); - if (merge == NULL) - return NULL; - - /* Let the base options -[ADI...] have precedence over everything */ - memcpy(merge, orig_opts, sizeof(*mp) * num_oold); - mp = merge + num_oold; - - /* Second, the new options */ - xt_params->option_offset += XT_OPTION_OFFSET_SCALE; - *option_offset = xt_params->option_offset; - memcpy(mp, newopts, sizeof(*mp) * num_new); - - for (i = 0; i < num_new; ++i, ++mp) - mp->val += *option_offset; - - /* Third, the old options */ - memcpy(mp, oldopts, sizeof(*mp) * num_old); - mp += num_old; - xtables_free_opts(0); - - /* Clear trailing entry */ - memset(mp, 0, sizeof(*mp)); - return merge; -} - -static const struct xtables_afinfo afinfo_ipv4 = { - .kmod = "ip_tables", - .proc_exists = "/proc/net/ip_tables_names", - .libprefix = "libipt_", - .family = NFPROTO_IPV4, - .ipproto = IPPROTO_IP, - .so_rev_match = IPT_SO_GET_REVISION_MATCH, - .so_rev_target = IPT_SO_GET_REVISION_TARGET, -}; - -static const struct xtables_afinfo afinfo_ipv6 = { - .kmod = "ip6_tables", - .proc_exists = "/proc/net/ip6_tables_names", - .libprefix = "libip6t_", - .family = NFPROTO_IPV6, - .ipproto = IPPROTO_IPV6, - .so_rev_match = IP6T_SO_GET_REVISION_MATCH, - .so_rev_target = IP6T_SO_GET_REVISION_TARGET, -}; - -const struct xtables_afinfo *afinfo; - -/* Search path for Xtables .so files */ -static const char *xtables_libdir; - -/* the path to command to load kernel module */ -const char *xtables_modprobe_program; - -/* Keep track of matches/targets pending full registration: linked lists. */ -struct xtables_match *xtables_pending_matches; -struct xtables_target *xtables_pending_targets; - -/* Keep track of fully registered external matches/targets: linked lists. */ -struct xtables_match *xtables_matches; -struct xtables_target *xtables_targets; - -/* Fully register a match/target which was previously partially registered. */ -static void xtables_fully_register_pending_match(struct xtables_match *me); -static void xtables_fully_register_pending_target(struct xtables_target *me); - -void xtables_init(void) -{ - xtables_libdir = getenv("XTABLES_LIBDIR"); - if (xtables_libdir != NULL) - return; - xtables_libdir = getenv("IPTABLES_LIB_DIR"); - if (xtables_libdir != NULL) { - fprintf(stderr, "IPTABLES_LIB_DIR is deprecated, " - "use XTABLES_LIBDIR.\n"); - return; - } - /* - * Well yes, IP6TABLES_LIB_DIR is of lower priority over - * IPTABLES_LIB_DIR since this moved to libxtables; I think that is ok - * for these env vars are deprecated anyhow, and in light of the - * (shared) libxt_*.so files, makes less sense to have - * IPTABLES_LIB_DIR != IP6TABLES_LIB_DIR. - */ - xtables_libdir = getenv("IP6TABLES_LIB_DIR"); - if (xtables_libdir != NULL) { - fprintf(stderr, "IP6TABLES_LIB_DIR is deprecated, " - "use XTABLES_LIBDIR.\n"); - return; - } - xtables_libdir = XTABLES_LIBDIR; -} - -void xtables_set_nfproto(uint8_t nfproto) -{ - switch (nfproto) { - case NFPROTO_IPV4: - afinfo = &afinfo_ipv4; - break; - case NFPROTO_IPV6: - afinfo = &afinfo_ipv6; - break; - default: - fprintf(stderr, "libxtables: unhandled NFPROTO in %s\n", - __func__); - } -} - -/** - * xtables_set_params - set the global parameters used by xtables - * @xtp: input xtables_globals structure - * - * The app is expected to pass a valid xtables_globals data-filled - * with proper values - * @xtp cannot be NULL - * - * Returns -1 on failure to set and 0 on success - */ -int xtables_set_params(struct xtables_globals *xtp) -{ - if (!xtp) { - fprintf(stderr, "%s: Illegal global params\n",__func__); - return -1; - } - - xt_params = xtp; - - if (!xt_params->exit_err) - xt_params->exit_err = basic_exit_err; - - return 0; -} - -int xtables_init_all(struct xtables_globals *xtp, uint8_t nfproto) -{ - xtables_init(); - xtables_set_nfproto(nfproto); - return xtables_set_params(xtp); -} - -/** - * xtables_*alloc - wrappers that exit on failure - */ -void *xtables_calloc(size_t count, size_t size) -{ - void *p; - - if ((p = calloc(count, size)) == NULL) { - perror("ip[6]tables: calloc failed"); - exit(1); - } - - return p; -} - -void *xtables_malloc(size_t size) -{ - void *p; - - if ((p = malloc(size)) == NULL) { - perror("ip[6]tables: malloc failed"); - exit(1); - } - - return p; -} - -void *xtables_realloc(void *ptr, size_t size) -{ - void *p; - - if ((p = realloc(ptr, size)) == NULL) { - perror("ip[6]tables: realloc failed"); - exit(1); - } - - return p; -} - -static char *get_modprobe(void) -{ - int procfile; - char *ret; - -#define PROCFILE_BUFSIZ 1024 - procfile = open(PROC_SYS_MODPROBE, O_RDONLY); - if (procfile < 0) - return NULL; - if (fcntl(procfile, F_SETFD, FD_CLOEXEC) == -1) { - fprintf(stderr, "Could not set close on exec: %s\n", - strerror(errno)); - exit(1); - } - - ret = malloc(PROCFILE_BUFSIZ); - if (ret) { - memset(ret, 0, PROCFILE_BUFSIZ); - switch (read(procfile, ret, PROCFILE_BUFSIZ)) { - case -1: goto fail; - case PROCFILE_BUFSIZ: goto fail; /* Partial read. Wierd */ - } - if (ret[strlen(ret)-1]=='\n') - ret[strlen(ret)-1]=0; - close(procfile); - return ret; - } - fail: - free(ret); - close(procfile); - return NULL; -} - -int xtables_insmod(const char *modname, const char *modprobe, bool quiet) -{ - char *buf = NULL; - char *argv[4]; - int status; - - /* If they don't explicitly set it, read out of kernel */ - if (!modprobe) { - buf = get_modprobe(); - if (!buf) - return -1; - modprobe = buf; - } - - /* - * Need to flush the buffer, or the child may output it again - * when switching the program thru execv. - */ - fflush(stdout); - - switch (vfork()) { - case 0: - argv[0] = (char *)modprobe; - argv[1] = (char *)modname; - if (quiet) { - argv[2] = "-q"; - argv[3] = NULL; - } else { - argv[2] = NULL; - argv[3] = NULL; - } - execv(argv[0], argv); - - /* not usually reached */ - exit(1); - case -1: - free(buf); - return -1; - - default: /* parent */ - wait(&status); - } - - free(buf); - if (WIFEXITED(status) && WEXITSTATUS(status) == 0) - return 0; - return -1; -} - -/* return true if a given file exists within procfs */ -static bool proc_file_exists(const char *filename) -{ - struct stat s; - struct statfs f; - - if (lstat(filename, &s)) - return false; - if (!S_ISREG(s.st_mode)) - return false; - if (statfs(filename, &f)) - return false; - if (f.f_type != PROC_SUPER_MAGIC) - return false; - return true; -} - -int xtables_load_ko(const char *modprobe, bool quiet) -{ - static bool loaded = false; - int ret; - - if (loaded) - return 0; - - if (proc_file_exists(afinfo->proc_exists)) { - loaded = true; - return 0; - }; - - ret = xtables_insmod(afinfo->kmod, modprobe, quiet); - if (ret == 0) - loaded = true; - - return ret; -} - -/** - * xtables_strtou{i,l} - string to number conversion - * @s: input string - * @end: like strtoul's "end" pointer - * @value: pointer for result - * @min: minimum accepted value - * @max: maximum accepted value - * - * If @end is NULL, we assume the caller wants a "strict strtoul", and hence - * "15a" is rejected. - * In either case, the value obtained is compared for min-max compliance. - * Base is always 0, i.e. autodetect depending on @s. - * - * Returns true/false whether number was accepted. On failure, *value has - * undefined contents. - */ -bool xtables_strtoul(const char *s, char **end, uintmax_t *value, - uintmax_t min, uintmax_t max) -{ - uintmax_t v; - const char *p; - char *my_end; - - errno = 0; - /* Since strtoul allows leading minus, we have to check for ourself. */ - for (p = s; isspace(*p); ++p) - ; - if (*p == '-') - return false; - v = strtoumax(s, &my_end, 0); - if (my_end == s) - return false; - if (end != NULL) - *end = my_end; - - if (errno != ERANGE && min <= v && (max == 0 || v <= max)) { - if (value != NULL) - *value = v; - if (end == NULL) - return *my_end == '\0'; - return true; - } - - return false; -} - -bool xtables_strtoui(const char *s, char **end, unsigned int *value, - unsigned int min, unsigned int max) -{ - uintmax_t v; - bool ret; - - ret = xtables_strtoul(s, end, &v, min, max); - if (value != NULL) - *value = v; - return ret; -} - -int xtables_service_to_port(const char *name, const char *proto) -{ - struct servent *service; - - if ((service = getservbyname(name, proto)) != NULL) - return ntohs((unsigned short) service->s_port); - - return -1; -} - -uint16_t xtables_parse_port(const char *port, const char *proto) -{ - unsigned int portnum; - - if (xtables_strtoui(port, NULL, &portnum, 0, UINT16_MAX) || - (portnum = xtables_service_to_port(port, proto)) != (unsigned)-1) - return portnum; - - xt_params->exit_err(PARAMETER_PROBLEM, - "invalid port/service `%s' specified", port); -} - -void xtables_parse_interface(const char *arg, char *vianame, - unsigned char *mask) -{ - unsigned int vialen = strlen(arg); - unsigned int i; - - memset(mask, 0, IFNAMSIZ); - memset(vianame, 0, IFNAMSIZ); - - if (vialen + 1 > IFNAMSIZ) - xt_params->exit_err(PARAMETER_PROBLEM, - "interface name `%s' must be shorter than IFNAMSIZ" - " (%i)", arg, IFNAMSIZ-1); - - strcpy(vianame, arg); - if (vialen == 0) - return; - else if (vianame[vialen - 1] == '+') { - memset(mask, 0xFF, vialen - 1); - /* Don't remove `+' here! -HW */ - } else { - /* Include nul-terminator in match */ - memset(mask, 0xFF, vialen + 1); - for (i = 0; vianame[i]; i++) { - if (vianame[i] == '/' || - vianame[i] == ' ') { - fprintf(stderr, - "Warning: weird character in interface" - " `%s' ('/' and ' ' are not allowed by the kernel).\n", - vianame); - break; - } - } - } -} - -#ifndef NO_SHARED_LIBS -static void *load_extension(const char *search_path, const char *af_prefix, - const char *name, bool is_target) -{ - const char *all_prefixes[] = {"libxt_", af_prefix, NULL}; - const char **prefix; - const char *dir = search_path, *next; - void *ptr = NULL; - struct stat sb; - char path[256]; - - do { - next = strchr(dir, ':'); - if (next == NULL) - next = dir + strlen(dir); - - for (prefix = all_prefixes; *prefix != NULL; ++prefix) { - snprintf(path, sizeof(path), "%.*s/%s%s.so", - (unsigned int)(next - dir), dir, - *prefix, name); - - if (stat(path, &sb) != 0) { - if (errno == ENOENT) - continue; - fprintf(stderr, "%s: %s\n", path, - strerror(errno)); - return NULL; - } - if (dlopen(path, RTLD_NOW) == NULL) { - fprintf(stderr, "%s: %s\n", path, dlerror()); - break; - } - - if (is_target) - ptr = xtables_find_target(name, XTF_DONT_LOAD); - else - ptr = xtables_find_match(name, - XTF_DONT_LOAD, NULL); - - if (ptr != NULL) - return ptr; - - fprintf(stderr, "%s: no \"%s\" extension found for " - "this protocol\n", path, name); - errno = ENOENT; - return NULL; - } - dir = next + 1; - } while (*next != '\0'); - - return NULL; -} -#endif - -struct xtables_match * -xtables_find_match(const char *name, enum xtables_tryload tryload, - struct xtables_rule_match **matches) -{ - struct xtables_match **dptr; - struct xtables_match *ptr; - const char *icmp6 = "icmp6"; - - if (strlen(name) >= XT_EXTENSION_MAXNAMELEN) - xtables_error(PARAMETER_PROBLEM, - "Invalid match name \"%s\" (%u chars max)", - name, XT_EXTENSION_MAXNAMELEN - 1); - - /* This is ugly as hell. Nonetheless, there is no way of changing - * this without hurting backwards compatibility */ - if ( (strcmp(name,"icmpv6") == 0) || - (strcmp(name,"ipv6-icmp") == 0) || - (strcmp(name,"icmp6") == 0) ) - name = icmp6; - - /* Trigger delayed initialization */ - for (dptr = &xtables_pending_matches; *dptr; ) { - if (strcmp(name, (*dptr)->name) == 0) { - ptr = *dptr; - *dptr = (*dptr)->next; - ptr->next = NULL; - xtables_fully_register_pending_match(ptr); - } else { - dptr = &((*dptr)->next); - } - } - - for (ptr = xtables_matches; ptr; ptr = ptr->next) { - if (strcmp(name, ptr->name) == 0) { - struct xtables_match *clone; - - /* First match of this type: */ - if (ptr->m == NULL) - break; - - /* Second and subsequent clones */ - clone = xtables_malloc(sizeof(struct xtables_match)); - memcpy(clone, ptr, sizeof(struct xtables_match)); - clone->udata = NULL; - clone->mflags = 0; - /* This is a clone: */ - clone->next = clone; - - ptr = clone; - break; - } - } - -#ifndef NO_SHARED_LIBS - if (!ptr && tryload != XTF_DONT_LOAD && tryload != XTF_DURING_LOAD) { - ptr = load_extension(xtables_libdir, afinfo->libprefix, - name, false); - - if (ptr == NULL && tryload == XTF_LOAD_MUST_SUCCEED) - xt_params->exit_err(PARAMETER_PROBLEM, - "Couldn't load match `%s':%s\n", - name, strerror(errno)); - } -#else - if (ptr && !ptr->loaded) { - if (tryload != XTF_DONT_LOAD) - ptr->loaded = 1; - else - ptr = NULL; - } - if(!ptr && (tryload == XTF_LOAD_MUST_SUCCEED)) { - xt_params->exit_err(PARAMETER_PROBLEM, - "Couldn't find match `%s'\n", name); - } -#endif - - if (ptr && matches) { - struct xtables_rule_match **i; - struct xtables_rule_match *newentry; - - newentry = xtables_malloc(sizeof(struct xtables_rule_match)); - - for (i = matches; *i; i = &(*i)->next) { - if (strcmp(name, (*i)->match->name) == 0) - (*i)->completed = true; - } - newentry->match = ptr; - newentry->completed = false; - newentry->next = NULL; - *i = newentry; - } - - return ptr; -} - -struct xtables_target * -xtables_find_target(const char *name, enum xtables_tryload tryload) -{ - struct xtables_target **dptr; - struct xtables_target *ptr; - - /* Standard target? */ - if (strcmp(name, "") == 0 - || strcmp(name, XTC_LABEL_ACCEPT) == 0 - || strcmp(name, XTC_LABEL_DROP) == 0 - || strcmp(name, XTC_LABEL_QUEUE) == 0 - || strcmp(name, XTC_LABEL_RETURN) == 0) - name = "standard"; - - /* Trigger delayed initialization */ - for (dptr = &xtables_pending_targets; *dptr; ) { - if (strcmp(name, (*dptr)->name) == 0) { - ptr = *dptr; - *dptr = (*dptr)->next; - ptr->next = NULL; - xtables_fully_register_pending_target(ptr); - } else { - dptr = &((*dptr)->next); - } - } - - for (ptr = xtables_targets; ptr; ptr = ptr->next) { - if (strcmp(name, ptr->name) == 0) - break; - } - -#ifndef NO_SHARED_LIBS - if (!ptr && tryload != XTF_DONT_LOAD && tryload != XTF_DURING_LOAD) { - ptr = load_extension(xtables_libdir, afinfo->libprefix, - name, true); - - if (ptr == NULL && tryload == XTF_LOAD_MUST_SUCCEED) - xt_params->exit_err(PARAMETER_PROBLEM, - "Couldn't load target `%s':%s\n", - name, strerror(errno)); - } -#else - if (ptr && !ptr->loaded) { - if (tryload != XTF_DONT_LOAD) - ptr->loaded = 1; - else - ptr = NULL; - } - if (ptr == NULL && tryload == XTF_LOAD_MUST_SUCCEED) { - xt_params->exit_err(PARAMETER_PROBLEM, - "Couldn't find target `%s'\n", name); - } -#endif - - if (ptr) - ptr->used = 1; - - return ptr; -} - -static int compatible_revision(const char *name, uint8_t revision, int opt) -{ - struct xt_get_revision rev; - socklen_t s = sizeof(rev); - int max_rev, sockfd; - - sockfd = socket(afinfo->family, SOCK_RAW, IPPROTO_RAW); - if (sockfd < 0) { - if (errno == EPERM) { - /* revision 0 is always supported. */ - if (revision != 0) - fprintf(stderr, "%s: Could not determine whether " - "revision %u is supported, " - "assuming it is.\n", - name, revision); - return 1; - } - fprintf(stderr, "Could not open socket to kernel: %s\n", - strerror(errno)); - exit(1); - } - - if (fcntl(sockfd, F_SETFD, FD_CLOEXEC) == -1) { - fprintf(stderr, "Could not set close on exec: %s\n", - strerror(errno)); - exit(1); - } - - xtables_load_ko(xtables_modprobe_program, true); - - strcpy(rev.name, name); - rev.revision = revision; - - max_rev = getsockopt(sockfd, afinfo->ipproto, opt, &rev, &s); - if (max_rev < 0) { - /* Definitely don't support this? */ - if (errno == ENOENT || errno == EPROTONOSUPPORT) { - close(sockfd); - return 0; - } else if (errno == ENOPROTOOPT) { - close(sockfd); - /* Assume only revision 0 support (old kernel) */ - return (revision == 0); - } else { - fprintf(stderr, "getsockopt failed strangely: %s\n", - strerror(errno)); - exit(1); - } - } - close(sockfd); - return 1; -} - - -static int compatible_match_revision(const char *name, uint8_t revision) -{ - return compatible_revision(name, revision, afinfo->so_rev_match); -} - -static int compatible_target_revision(const char *name, uint8_t revision) -{ - return compatible_revision(name, revision, afinfo->so_rev_target); -} - -static void xtables_check_options(const char *name, const struct option *opt) -{ - for (; opt->name != NULL; ++opt) - if (opt->val < 0 || opt->val >= XT_OPTION_OFFSET_SCALE) { - fprintf(stderr, "%s: Extension %s uses invalid " - "option value %d\n",xt_params->program_name, - name, opt->val); - exit(1); - } -} - -void xtables_register_match(struct xtables_match *me) -{ - if (me->version == NULL) { - fprintf(stderr, "%s: match %s<%u> is missing a version\n", - xt_params->program_name, me->name, me->revision); - exit(1); - } - if (strcmp(me->version, XTABLES_VERSION) != 0) { - fprintf(stderr, "%s: match \"%s\" has version \"%s\", " - "but \"%s\" is required.\n", - xt_params->program_name, me->name, - me->version, XTABLES_VERSION); - exit(1); - } - - if (strlen(me->name) >= XT_EXTENSION_MAXNAMELEN) { - fprintf(stderr, "%s: match `%s' has invalid name\n", - xt_params->program_name, me->name); - exit(1); - } - - if (me->family >= NPROTO) { - fprintf(stderr, - "%s: BUG: match %s has invalid protocol family\n", - xt_params->program_name, me->name); - exit(1); - } - - if (me->x6_options != NULL) - xtables_option_metavalidate(me->name, me->x6_options); - if (me->extra_opts != NULL) - xtables_check_options(me->name, me->extra_opts); - - /* ignore not interested match */ - if (me->family != afinfo->family && me->family != AF_UNSPEC) - return; - - /* place on linked list of matches pending full registration */ - me->next = xtables_pending_matches; - xtables_pending_matches = me; -} - -static void xtables_fully_register_pending_match(struct xtables_match *me) -{ - struct xtables_match **i, *old; - - old = xtables_find_match(me->name, XTF_DURING_LOAD, NULL); - if (old) { - if (old->revision == me->revision && - old->family == me->family) { - fprintf(stderr, - "%s: match `%s' already registered.\n", - xt_params->program_name, me->name); - exit(1); - } - - /* Now we have two (or more) options, check compatibility. */ - if (compatible_match_revision(old->name, old->revision) - && old->revision > me->revision) - return; - - /* See if new match can be used. */ - if (!compatible_match_revision(me->name, me->revision)) - return; - - /* Prefer !AF_UNSPEC over AF_UNSPEC for same revision. */ - if (old->revision == me->revision && me->family == AF_UNSPEC) - return; - - /* Delete old one. */ - for (i = &xtables_matches; *i!=old; i = &(*i)->next); - *i = old->next; - } - - if (me->size != XT_ALIGN(me->size)) { - fprintf(stderr, "%s: match `%s' has invalid size %u.\n", - xt_params->program_name, me->name, - (unsigned int)me->size); - exit(1); - } - - /* Append to list. */ - for (i = &xtables_matches; *i; i = &(*i)->next); - me->next = NULL; - *i = me; - - me->m = NULL; - me->mflags = 0; -} - -void xtables_register_matches(struct xtables_match *match, unsigned int n) -{ - do { - xtables_register_match(&match[--n]); - } while (n > 0); -} - -void xtables_register_target(struct xtables_target *me) -{ - if (me->version == NULL) { - fprintf(stderr, "%s: target %s<%u> is missing a version\n", - xt_params->program_name, me->name, me->revision); - exit(1); - } - if (strcmp(me->version, XTABLES_VERSION) != 0) { - fprintf(stderr, "%s: target \"%s\" has version \"%s\", " - "but \"%s\" is required.\n", - xt_params->program_name, me->name, - me->version, XTABLES_VERSION); - exit(1); - } - - if (strlen(me->name) >= XT_EXTENSION_MAXNAMELEN) { - fprintf(stderr, "%s: target `%s' has invalid name\n", - xt_params->program_name, me->name); - exit(1); - } - - if (me->family >= NPROTO) { - fprintf(stderr, - "%s: BUG: target %s has invalid protocol family\n", - xt_params->program_name, me->name); - exit(1); - } - - if (me->x6_options != NULL) - xtables_option_metavalidate(me->name, me->x6_options); - if (me->extra_opts != NULL) - xtables_check_options(me->name, me->extra_opts); - - /* ignore not interested target */ - if (me->family != afinfo->family && me->family != AF_UNSPEC) - return; - - /* place on linked list of targets pending full registration */ - me->next = xtables_pending_targets; - xtables_pending_targets = me; -} - -static void xtables_fully_register_pending_target(struct xtables_target *me) -{ - struct xtables_target *old; - - old = xtables_find_target(me->name, XTF_DURING_LOAD); - if (old) { - struct xtables_target **i; - - if (old->revision == me->revision && - old->family == me->family) { - fprintf(stderr, - "%s: target `%s' already registered.\n", - xt_params->program_name, me->name); - exit(1); - } - - /* Now we have two (or more) options, check compatibility. */ - if (compatible_target_revision(old->name, old->revision) - && old->revision > me->revision) - return; - - /* See if new target can be used. */ - if (!compatible_target_revision(me->name, me->revision)) - return; - - /* Prefer !AF_UNSPEC over AF_UNSPEC for same revision. */ - if (old->revision == me->revision && me->family == AF_UNSPEC) - return; - - /* Delete old one. */ - for (i = &xtables_targets; *i!=old; i = &(*i)->next); - *i = old->next; - } - - if (me->size != XT_ALIGN(me->size)) { - fprintf(stderr, "%s: target `%s' has invalid size %u.\n", - xt_params->program_name, me->name, - (unsigned int)me->size); - exit(1); - } - - /* Prepend to list. */ - me->next = xtables_targets; - xtables_targets = me; - me->t = NULL; - me->tflags = 0; -} - -void xtables_register_targets(struct xtables_target *target, unsigned int n) -{ - do { - xtables_register_target(&target[--n]); - } while (n > 0); -} - -/** - * xtables_param_act - act on condition - * @status: a constant from enum xtables_exittype - * - * %XTF_ONLY_ONCE: print error message that option may only be used once. - * @p1: module name (e.g. "mark") - * @p2(...): option in conflict (e.g. "--mark") - * @p3(...): condition to match on (see extensions/ for examples) - * - * %XTF_NO_INVERT: option does not support inversion - * @p1: module name - * @p2: option in conflict - * @p3: condition to match on - * - * %XTF_BAD_VALUE: bad value for option - * @p1: module name - * @p2: option with which the problem occured (e.g. "--mark") - * @p3: string the user passed in (e.g. "99999999999999") - * - * %XTF_ONE_ACTION: two mutually exclusive actions have been specified - * @p1: module name - * - * Displays an error message and exits the program. - */ -void xtables_param_act(unsigned int status, const char *p1, ...) -{ - const char *p2, *p3; - va_list args; - bool b; - - va_start(args, p1); - - switch (status) { - case XTF_ONLY_ONCE: - p2 = va_arg(args, const char *); - b = va_arg(args, unsigned int); - if (!b) { - va_end(args); - return; - } - xt_params->exit_err(PARAMETER_PROBLEM, - "%s: \"%s\" option may only be specified once", - p1, p2); - break; - case XTF_NO_INVERT: - p2 = va_arg(args, const char *); - b = va_arg(args, unsigned int); - if (!b) { - va_end(args); - return; - } - xt_params->exit_err(PARAMETER_PROBLEM, - "%s: \"%s\" option cannot be inverted", p1, p2); - break; - case XTF_BAD_VALUE: - p2 = va_arg(args, const char *); - p3 = va_arg(args, const char *); - xt_params->exit_err(PARAMETER_PROBLEM, - "%s: Bad value for \"%s\" option: \"%s\"", - p1, p2, p3); - break; - case XTF_ONE_ACTION: - b = va_arg(args, unsigned int); - if (!b) { - va_end(args); - return; - } - xt_params->exit_err(PARAMETER_PROBLEM, - "%s: At most one action is possible", p1); - break; - default: - xt_params->exit_err(status, p1, args); - break; - } - - va_end(args); -} - -const char *xtables_ipaddr_to_numeric(const struct in_addr *addrp) -{ - static char buf[20]; - const unsigned char *bytep = (const void *)&addrp->s_addr; - - sprintf(buf, "%u.%u.%u.%u", bytep[0], bytep[1], bytep[2], bytep[3]); - return buf; -} - -static const char *ipaddr_to_host(const struct in_addr *addr) -{ - struct hostent *host; - - host = gethostbyaddr(addr, sizeof(struct in_addr), AF_INET); - if (host == NULL) - return NULL; - - return host->h_name; -} - -static const char *ipaddr_to_network(const struct in_addr *addr) -{ - struct netent *net; - - if ((net = getnetbyaddr(ntohl(addr->s_addr), AF_INET)) != NULL) - return net->n_name; - - return NULL; -} - -const char *xtables_ipaddr_to_anyname(const struct in_addr *addr) -{ - const char *name; - - if ((name = ipaddr_to_host(addr)) != NULL || - (name = ipaddr_to_network(addr)) != NULL) - return name; - - return xtables_ipaddr_to_numeric(addr); -} - -const char *xtables_ipmask_to_numeric(const struct in_addr *mask) -{ - static char buf[20]; - uint32_t maskaddr, bits; - int i; - - maskaddr = ntohl(mask->s_addr); - - if (maskaddr == 0xFFFFFFFFL) - /* we don't want to see "/32" */ - return ""; - - i = 32; - bits = 0xFFFFFFFEL; - while (--i >= 0 && maskaddr != bits) - bits <<= 1; - if (i >= 0) - sprintf(buf, "/%d", i); - else - /* mask was not a decent combination of 1's and 0's */ - sprintf(buf, "/%s", xtables_ipaddr_to_numeric(mask)); - - return buf; -} - -static struct in_addr *__numeric_to_ipaddr(const char *dotted, bool is_mask) -{ - static struct in_addr addr; - unsigned char *addrp; - unsigned int onebyte; - char buf[20], *p, *q; - int i; - - /* copy dotted string, because we need to modify it */ - strncpy(buf, dotted, sizeof(buf) - 1); - buf[sizeof(buf) - 1] = '\0'; - addrp = (void *)&addr.s_addr; - - p = buf; - for (i = 0; i < 3; ++i) { - if ((q = strchr(p, '.')) == NULL) { - if (is_mask) - return NULL; - - /* autocomplete, this is a network address */ - if (!xtables_strtoui(p, NULL, &onebyte, 0, UINT8_MAX)) - return NULL; - - addrp[i] = onebyte; - while (i < 3) - addrp[++i] = 0; - - return &addr; - } - - *q = '\0'; - if (!xtables_strtoui(p, NULL, &onebyte, 0, UINT8_MAX)) - return NULL; - - addrp[i] = onebyte; - p = q + 1; - } - - /* we have checked 3 bytes, now we check the last one */ - if (!xtables_strtoui(p, NULL, &onebyte, 0, UINT8_MAX)) - return NULL; - - addrp[3] = onebyte; - return &addr; -} - -struct in_addr *xtables_numeric_to_ipaddr(const char *dotted) -{ - return __numeric_to_ipaddr(dotted, false); -} - -struct in_addr *xtables_numeric_to_ipmask(const char *dotted) -{ - return __numeric_to_ipaddr(dotted, true); -} - -static struct in_addr *network_to_ipaddr(const char *name) -{ - static struct in_addr addr; - struct netent *net; - - if ((net = getnetbyname(name)) != NULL) { - if (net->n_addrtype != AF_INET) - return NULL; - addr.s_addr = htonl(net->n_net); - return &addr; - } - - return NULL; -} - -static struct in_addr *host_to_ipaddr(const char *name, unsigned int *naddr) -{ - struct hostent *host; - struct in_addr *addr; - unsigned int i; - - *naddr = 0; - if ((host = gethostbyname(name)) != NULL) { - if (host->h_addrtype != AF_INET || - host->h_length != sizeof(struct in_addr)) - return NULL; - - while (host->h_addr_list[*naddr] != NULL) - ++*naddr; - addr = xtables_calloc(*naddr, sizeof(struct in_addr)); - for (i = 0; i < *naddr; i++) - memcpy(&addr[i], host->h_addr_list[i], - sizeof(struct in_addr)); - return addr; - } - - return NULL; -} - -static struct in_addr * -ipparse_hostnetwork(const char *name, unsigned int *naddrs) -{ - struct in_addr *addrptmp, *addrp; - - if ((addrptmp = xtables_numeric_to_ipaddr(name)) != NULL || - (addrptmp = network_to_ipaddr(name)) != NULL) { - addrp = xtables_malloc(sizeof(struct in_addr)); - memcpy(addrp, addrptmp, sizeof(*addrp)); - *naddrs = 1; - return addrp; - } - if ((addrptmp = host_to_ipaddr(name, naddrs)) != NULL) - return addrptmp; - - xt_params->exit_err(PARAMETER_PROBLEM, "host/network `%s' not found", name); -} - -static struct in_addr *parse_ipmask(const char *mask) -{ - static struct in_addr maskaddr; - struct in_addr *addrp; - unsigned int bits; - - if (mask == NULL) { - /* no mask at all defaults to 32 bits */ - maskaddr.s_addr = 0xFFFFFFFF; - return &maskaddr; - } - if ((addrp = xtables_numeric_to_ipmask(mask)) != NULL) - /* dotted_to_addr already returns a network byte order addr */ - return addrp; - if (!xtables_strtoui(mask, NULL, &bits, 0, 32)) - xt_params->exit_err(PARAMETER_PROBLEM, - "invalid mask `%s' specified", mask); - if (bits != 0) { - maskaddr.s_addr = htonl(0xFFFFFFFF << (32 - bits)); - return &maskaddr; - } - - maskaddr.s_addr = 0U; - return &maskaddr; -} - -void xtables_ipparse_multiple(const char *name, struct in_addr **addrpp, - struct in_addr **maskpp, unsigned int *naddrs) -{ - struct in_addr *addrp; - char buf[256], *p, *next; - unsigned int len, i, j, n, count = 1; - const char *loop = name; - - while ((loop = strchr(loop, ',')) != NULL) { - ++count; - ++loop; /* skip ',' */ - } - - *addrpp = xtables_malloc(sizeof(struct in_addr) * count); - *maskpp = xtables_malloc(sizeof(struct in_addr) * count); - - loop = name; - - for (i = 0; i < count; ++i) { - while (isspace(*loop)) - ++loop; - next = strchr(loop, ','); - if (next != NULL) - len = next - loop; - else - len = strlen(loop); - if (len > sizeof(buf) - 1) - xt_params->exit_err(PARAMETER_PROBLEM, - "Hostname too long"); - - strncpy(buf, loop, len); - buf[len] = '\0'; - if ((p = strrchr(buf, '/')) != NULL) { - *p = '\0'; - addrp = parse_ipmask(p + 1); - } else { - addrp = parse_ipmask(NULL); - } - memcpy(*maskpp + i, addrp, sizeof(*addrp)); - - /* if a null mask is given, the name is ignored, like in "any/0" */ - if ((*maskpp + i)->s_addr == 0) - /* - * A bit pointless to process multiple addresses - * in this case... - */ - strcpy(buf, "0.0.0.0"); - - addrp = ipparse_hostnetwork(buf, &n); - if (n > 1) { - count += n - 1; - *addrpp = xtables_realloc(*addrpp, - sizeof(struct in_addr) * count); - *maskpp = xtables_realloc(*maskpp, - sizeof(struct in_addr) * count); - for (j = 0; j < n; ++j) - /* for each new addr */ - memcpy(*addrpp + i + j, addrp + j, - sizeof(*addrp)); - for (j = 1; j < n; ++j) - /* for each new mask */ - memcpy(*maskpp + i + j, *maskpp + i, - sizeof(*addrp)); - i += n - 1; - } else { - memcpy(*addrpp + i, addrp, sizeof(*addrp)); - } - /* free what ipparse_hostnetwork had allocated: */ - free(addrp); - if (next == NULL) - break; - loop = next + 1; - } - *naddrs = count; - for (i = 0; i < count; ++i) - (*addrpp+i)->s_addr &= (*maskpp+i)->s_addr; -} - - -/** - * xtables_ipparse_any - transform arbitrary name to in_addr - * - * Possible inputs (pseudo regex): - * m{^($hostname|$networkname|$ipaddr)(/$mask)?} - * "1.2.3.4/5", "1.2.3.4", "hostname", "networkname" - */ -void xtables_ipparse_any(const char *name, struct in_addr **addrpp, - struct in_addr *maskp, unsigned int *naddrs) -{ - unsigned int i, j, k, n; - struct in_addr *addrp; - char buf[256], *p; - - strncpy(buf, name, sizeof(buf) - 1); - buf[sizeof(buf) - 1] = '\0'; - if ((p = strrchr(buf, '/')) != NULL) { - *p = '\0'; - addrp = parse_ipmask(p + 1); - } else { - addrp = parse_ipmask(NULL); - } - memcpy(maskp, addrp, sizeof(*maskp)); - - /* if a null mask is given, the name is ignored, like in "any/0" */ - if (maskp->s_addr == 0U) - strcpy(buf, "0.0.0.0"); - - addrp = *addrpp = ipparse_hostnetwork(buf, naddrs); - n = *naddrs; - for (i = 0, j = 0; i < n; ++i) { - addrp[j++].s_addr &= maskp->s_addr; - for (k = 0; k < j - 1; ++k) - if (addrp[k].s_addr == addrp[j-1].s_addr) { - /* - * Nuke the dup by copying an address from the - * tail here, and check the current position - * again (--j). - */ - memcpy(&addrp[--j], &addrp[--*naddrs], - sizeof(struct in_addr)); - break; - } - } -} - -const char *xtables_ip6addr_to_numeric(const struct in6_addr *addrp) -{ - /* 0000:0000:0000:0000:0000:0000:000.000.000.000 - * 0000:0000:0000:0000:0000:0000:0000:0000 */ - static char buf[50+1]; - return inet_ntop(AF_INET6, addrp, buf, sizeof(buf)); -} - -static const char *ip6addr_to_host(const struct in6_addr *addr) -{ - static char hostname[NI_MAXHOST]; - struct sockaddr_in6 saddr; - int err; - - memset(&saddr, 0, sizeof(struct sockaddr_in6)); - memcpy(&saddr.sin6_addr, addr, sizeof(*addr)); - saddr.sin6_family = AF_INET6; - - err = getnameinfo((const void *)&saddr, sizeof(struct sockaddr_in6), - hostname, sizeof(hostname) - 1, NULL, 0, 0); - if (err != 0) { -#ifdef DEBUG - fprintf(stderr,"IP2Name: %s\n",gai_strerror(err)); -#endif - return NULL; - } - -#ifdef DEBUG - fprintf (stderr, "\naddr2host: %s\n", hostname); -#endif - return hostname; -} - -const char *xtables_ip6addr_to_anyname(const struct in6_addr *addr) -{ - const char *name; - - if ((name = ip6addr_to_host(addr)) != NULL) - return name; - - return xtables_ip6addr_to_numeric(addr); -} - -static int ip6addr_prefix_length(const struct in6_addr *k) -{ - unsigned int bits = 0; - uint32_t a, b, c, d; - - a = ntohl(k->s6_addr32[0]); - b = ntohl(k->s6_addr32[1]); - c = ntohl(k->s6_addr32[2]); - d = ntohl(k->s6_addr32[3]); - while (a & 0x80000000U) { - ++bits; - a <<= 1; - a |= (b >> 31) & 1; - b <<= 1; - b |= (c >> 31) & 1; - c <<= 1; - c |= (d >> 31) & 1; - d <<= 1; - } - if (a != 0 || b != 0 || c != 0 || d != 0) - return -1; - return bits; -} - -const char *xtables_ip6mask_to_numeric(const struct in6_addr *addrp) -{ - static char buf[50+2]; - int l = ip6addr_prefix_length(addrp); - - if (l == -1) { - strcpy(buf, "/"); - strcat(buf, xtables_ip6addr_to_numeric(addrp)); - return buf; - } - sprintf(buf, "/%d", l); - return buf; -} - -struct in6_addr *xtables_numeric_to_ip6addr(const char *num) -{ - static struct in6_addr ap; - int err; - - if ((err = inet_pton(AF_INET6, num, &ap)) == 1) - return ≈ -#ifdef DEBUG - fprintf(stderr, "\nnumeric2addr: %d\n", err); -#endif - return NULL; -} - -static struct in6_addr * -host_to_ip6addr(const char *name, unsigned int *naddr) -{ - struct in6_addr *addr; - struct addrinfo hints; - struct addrinfo *res, *p; - int err; - unsigned int i; - - memset(&hints, 0, sizeof(hints)); - hints.ai_flags = AI_CANONNAME; - hints.ai_family = AF_INET6; - hints.ai_socktype = SOCK_RAW; - - *naddr = 0; - if ((err = getaddrinfo(name, NULL, &hints, &res)) != 0) { -#ifdef DEBUG - fprintf(stderr,"Name2IP: %s\n",gai_strerror(err)); -#endif - return NULL; - } else { - /* Find length of address chain */ - for (p = res; p != NULL; p = p->ai_next) - ++*naddr; -#ifdef DEBUG - fprintf(stderr, "resolved: len=%d %s ", res->ai_addrlen, - xtables_ip6addr_to_numeric(&((struct sockaddr_in6 *)res->ai_addr)->sin6_addr)); -#endif - /* Copy each element of the address chain */ - addr = xtables_calloc(*naddr, sizeof(struct in6_addr)); - for (i = 0, p = res; p != NULL; p = p->ai_next) - memcpy(&addr[i++], - &((const struct sockaddr_in6 *)p->ai_addr)->sin6_addr, - sizeof(struct in6_addr)); - freeaddrinfo(res); - return addr; - } - - return NULL; -} - -static struct in6_addr *network_to_ip6addr(const char *name) -{ - /* abort();*/ - /* TODO: not implemented yet, but the exception breaks the - * name resolvation */ - return NULL; -} - -static struct in6_addr * -ip6parse_hostnetwork(const char *name, unsigned int *naddrs) -{ - struct in6_addr *addrp, *addrptmp; - - if ((addrptmp = xtables_numeric_to_ip6addr(name)) != NULL || - (addrptmp = network_to_ip6addr(name)) != NULL) { - addrp = xtables_malloc(sizeof(struct in6_addr)); - memcpy(addrp, addrptmp, sizeof(*addrp)); - *naddrs = 1; - return addrp; - } - if ((addrp = host_to_ip6addr(name, naddrs)) != NULL) - return addrp; - - xt_params->exit_err(PARAMETER_PROBLEM, "host/network `%s' not found", name); -} - -static struct in6_addr *parse_ip6mask(char *mask) -{ - static struct in6_addr maskaddr; - struct in6_addr *addrp; - unsigned int bits; - - if (mask == NULL) { - /* no mask at all defaults to 128 bits */ - memset(&maskaddr, 0xff, sizeof maskaddr); - return &maskaddr; - } - if ((addrp = xtables_numeric_to_ip6addr(mask)) != NULL) - return addrp; - if (!xtables_strtoui(mask, NULL, &bits, 0, 128)) - xt_params->exit_err(PARAMETER_PROBLEM, - "invalid mask `%s' specified", mask); - if (bits != 0) { - char *p = (void *)&maskaddr; - memset(p, 0xff, bits / 8); - memset(p + (bits / 8) + 1, 0, (128 - bits) / 8); - p[bits/8] = 0xff << (8 - (bits & 7)); - return &maskaddr; - } - - memset(&maskaddr, 0, sizeof(maskaddr)); - return &maskaddr; -} - -void -xtables_ip6parse_multiple(const char *name, struct in6_addr **addrpp, - struct in6_addr **maskpp, unsigned int *naddrs) -{ - static const struct in6_addr zero_addr; - struct in6_addr *addrp; - char buf[256], *p, *next; - unsigned int len, i, j, n, count = 1; - const char *loop = name; - - while ((loop = strchr(loop, ',')) != NULL) { - ++count; - ++loop; /* skip ',' */ - } - - *addrpp = xtables_malloc(sizeof(struct in6_addr) * count); - *maskpp = xtables_malloc(sizeof(struct in6_addr) * count); - - loop = name; - - for (i = 0; i < count /*NB: count can grow*/; ++i) { - while (isspace(*loop)) - ++loop; - next = strchr(loop, ','); - if (next != NULL) - len = next - loop; - else - len = strlen(loop); - if (len > sizeof(buf) - 1) - xt_params->exit_err(PARAMETER_PROBLEM, - "Hostname too long"); - - strncpy(buf, loop, len); - buf[len] = '\0'; - if ((p = strrchr(buf, '/')) != NULL) { - *p = '\0'; - addrp = parse_ip6mask(p + 1); - } else { - addrp = parse_ip6mask(NULL); - } - memcpy(*maskpp + i, addrp, sizeof(*addrp)); - - /* if a null mask is given, the name is ignored, like in "any/0" */ - if (memcmp(*maskpp + i, &zero_addr, sizeof(zero_addr)) == 0) - strcpy(buf, "::"); - - addrp = ip6parse_hostnetwork(buf, &n); - if (n > 1) { - count += n - 1; - *addrpp = xtables_realloc(*addrpp, - sizeof(struct in6_addr) * count); - *maskpp = xtables_realloc(*maskpp, - sizeof(struct in6_addr) * count); - for (j = 0; j < n; ++j) - /* for each new addr */ - memcpy(*addrpp + i + j, addrp + j, - sizeof(*addrp)); - for (j = 1; j < n; ++j) - /* for each new mask */ - memcpy(*maskpp + i + j, *maskpp + i, - sizeof(*addrp)); - i += n - 1; - } else { - memcpy(*addrpp + i, addrp, sizeof(*addrp)); - } - /* free what ip6parse_hostnetwork had allocated: */ - free(addrp); - if (next == NULL) - break; - loop = next + 1; - } - *naddrs = count; - for (i = 0; i < count; ++i) - for (j = 0; j < 4; ++j) - (*addrpp+i)->s6_addr32[j] &= (*maskpp+i)->s6_addr32[j]; -} - -void xtables_ip6parse_any(const char *name, struct in6_addr **addrpp, - struct in6_addr *maskp, unsigned int *naddrs) -{ - static const struct in6_addr zero_addr; - struct in6_addr *addrp; - unsigned int i, j, k, n; - char buf[256], *p; - - strncpy(buf, name, sizeof(buf) - 1); - buf[sizeof(buf)-1] = '\0'; - if ((p = strrchr(buf, '/')) != NULL) { - *p = '\0'; - addrp = parse_ip6mask(p + 1); - } else { - addrp = parse_ip6mask(NULL); - } - memcpy(maskp, addrp, sizeof(*maskp)); - - /* if a null mask is given, the name is ignored, like in "any/0" */ - if (memcmp(maskp, &zero_addr, sizeof(zero_addr)) == 0) - strcpy(buf, "::"); - - addrp = *addrpp = ip6parse_hostnetwork(buf, naddrs); - n = *naddrs; - for (i = 0, j = 0; i < n; ++i) { - for (k = 0; k < 4; ++k) - addrp[j].s6_addr32[k] &= maskp->s6_addr32[k]; - ++j; - for (k = 0; k < j - 1; ++k) - if (IN6_ARE_ADDR_EQUAL(&addrp[k], &addrp[j - 1])) { - /* - * Nuke the dup by copying an address from the - * tail here, and check the current position - * again (--j). - */ - memcpy(&addrp[--j], &addrp[--*naddrs], - sizeof(struct in_addr)); - break; - } - } -} - -void xtables_save_string(const char *value) -{ - static const char no_quote_chars[] = "_-0123456789" - "abcdefghijklmnopqrstuvwxyz" - "ABCDEFGHIJKLMNOPQRSTUVWXYZ"; - static const char escape_chars[] = "\"\\'"; - size_t length; - const char *p; - - length = strspn(value, no_quote_chars); - if (length > 0 && value[length] == 0) { - /* no quoting required */ - putchar(' '); - fputs(value, stdout); - } else { - /* there is at least one dangerous character in the - value, which we have to quote. Write double quotes - around the value and escape special characters with - a backslash */ - printf(" \""); - - for (p = strpbrk(value, escape_chars); p != NULL; - p = strpbrk(value, escape_chars)) { - if (p > value) - fwrite(value, 1, p - value, stdout); - putchar('\\'); - putchar(*p); - value = p + 1; - } - - /* print the rest and finish the double quoted - string */ - fputs(value, stdout); - putchar('\"'); - } -} - -const struct xtables_pprot xtables_chain_protos[] = { - {"tcp", IPPROTO_TCP}, - {"sctp", IPPROTO_SCTP}, - {"udp", IPPROTO_UDP}, - {"udplite", IPPROTO_UDPLITE}, - {"icmp", IPPROTO_ICMP}, - {"icmpv6", IPPROTO_ICMPV6}, - {"ipv6-icmp", IPPROTO_ICMPV6}, - {"esp", IPPROTO_ESP}, - {"ah", IPPROTO_AH}, - {"ipv6-mh", IPPROTO_MH}, - {"mh", IPPROTO_MH}, - {"all", 0}, - {NULL}, -}; - -uint16_t -xtables_parse_protocol(const char *s) -{ - const struct protoent *pent; - unsigned int proto, i; - - if (xtables_strtoui(s, NULL, &proto, 0, UINT8_MAX)) - return proto; - - /* first deal with the special case of 'all' to prevent - * people from being able to redefine 'all' in nsswitch - * and/or provoke expensive [not working] ldap/nis/... - * lookups */ - if (strcmp(s, "all") == 0) - return 0; - - pent = getprotobyname(s); - if (pent != NULL) - return pent->p_proto; - - for (i = 0; i < ARRAY_SIZE(xtables_chain_protos); ++i) { - if (xtables_chain_protos[i].name == NULL) - continue; - if (strcmp(s, xtables_chain_protos[i].name) == 0) - return xtables_chain_protos[i].num; - } - xt_params->exit_err(PARAMETER_PROBLEM, - "unknown protocol \"%s\" specified", s); - return -1; -} - -int kernel_version; - -void get_kernel_version(void) -{ - static struct utsname uts; - int x = 0, y = 0, z = 0; - - if (uname(&uts) == -1) { - fprintf(stderr, "Unable to retrieve kernel version.\n"); - xtables_free_opts(1); - exit(1); - } - - sscanf(uts.release, "%d.%d.%d", &x, &y, &z); - kernel_version = LINUX_VERSION(x, y, z); -} diff --git a/iptables/xtoptions.c b/iptables/xtoptions.c deleted file mode 100644 index 5f617a42..00000000 --- a/iptables/xtoptions.c +++ /dev/null @@ -1,1171 +0,0 @@ -/* - * Argument parser - * Copyright © Jan Engelhardt, 2011 - * - * This program is free software; you can redistribute it and/or - * modify it under the terms of the GNU General Public License as - * published by the Free Software Foundation; either version 2 of - * the License, or (at your option) any later version. - */ -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include -#include "xtables.h" -#include "xshared.h" -#ifndef IPTOS_NORMALSVC -# define IPTOS_NORMALSVC 0 -#endif - -#define XTOPT_MKPTR(cb) \ - ((void *)((char *)(cb)->data + (cb)->entry->ptroff)) - -/** - * Simple key-value pairs for syslog levels - */ -struct syslog_level { - char name[8]; - uint8_t level; -}; - -struct tos_value_mask { - uint8_t value, mask; -}; - -static const size_t xtopt_psize[] = { - /* - * All types not listed here, and thus essentially being initialized to - * zero have zero on purpose. - */ - [XTTYPE_UINT8] = sizeof(uint8_t), - [XTTYPE_UINT16] = sizeof(uint16_t), - [XTTYPE_UINT32] = sizeof(uint32_t), - [XTTYPE_UINT64] = sizeof(uint64_t), - [XTTYPE_UINT8RC] = sizeof(uint8_t[2]), - [XTTYPE_UINT16RC] = sizeof(uint16_t[2]), - [XTTYPE_UINT32RC] = sizeof(uint32_t[2]), - [XTTYPE_UINT64RC] = sizeof(uint64_t[2]), - [XTTYPE_DOUBLE] = sizeof(double), - [XTTYPE_STRING] = -1, - [XTTYPE_SYSLOGLEVEL] = sizeof(uint8_t), - [XTTYPE_HOST] = sizeof(union nf_inet_addr), - [XTTYPE_HOSTMASK] = sizeof(union nf_inet_addr), - [XTTYPE_PROTOCOL] = sizeof(uint8_t), - [XTTYPE_PORT] = sizeof(uint16_t), - [XTTYPE_PORTRC] = sizeof(uint16_t[2]), - [XTTYPE_PLENMASK] = sizeof(union nf_inet_addr), - [XTTYPE_ETHERMAC] = sizeof(uint8_t[6]), -}; - -/** - * Creates getopt options from the x6-style option map, and assigns each a - * getopt id. - */ -struct option * -xtables_options_xfrm(struct option *orig_opts, struct option *oldopts, - const struct xt_option_entry *entry, unsigned int *offset) -{ - unsigned int num_orig, num_old = 0, num_new, i; - struct option *merge, *mp; - - if (entry == NULL) - return oldopts; - for (num_orig = 0; orig_opts[num_orig].name != NULL; ++num_orig) - ; - if (oldopts != NULL) - for (num_old = 0; oldopts[num_old].name != NULL; ++num_old) - ; - for (num_new = 0; entry[num_new].name != NULL; ++num_new) - ; - - /* - * Since @oldopts also has @orig_opts already (and does so at the - * start), skip these entries. - */ - oldopts += num_orig; - num_old -= num_orig; - - merge = malloc(sizeof(*mp) * (num_orig + num_old + num_new + 1)); - if (merge == NULL) - return NULL; - - /* Let the base options -[ADI...] have precedence over everything */ - memcpy(merge, orig_opts, sizeof(*mp) * num_orig); - mp = merge + num_orig; - - /* Second, the new options */ - xt_params->option_offset += XT_OPTION_OFFSET_SCALE; - *offset = xt_params->option_offset; - - for (i = 0; i < num_new; ++i, ++mp, ++entry) { - mp->name = entry->name; - mp->has_arg = entry->type != XTTYPE_NONE; - mp->flag = NULL; - mp->val = entry->id + *offset; - } - - /* Third, the old options */ - memcpy(mp, oldopts, sizeof(*mp) * num_old); - mp += num_old; - xtables_free_opts(0); - - /* Clear trailing entry */ - memset(mp, 0, sizeof(*mp)); - return merge; -} - -/** - * Give the upper limit for a certain type. - */ -static uintmax_t xtopt_max_by_type(enum xt_option_type type) -{ - switch (type) { - case XTTYPE_UINT8: - case XTTYPE_UINT8RC: - return UINT8_MAX; - case XTTYPE_UINT16: - case XTTYPE_UINT16RC: - return UINT16_MAX; - case XTTYPE_UINT32: - case XTTYPE_UINT32RC: - return UINT32_MAX; - case XTTYPE_UINT64: - case XTTYPE_UINT64RC: - return UINT64_MAX; - default: - return 0; - } -} - -/** - * Return the size of a single entity based upon a type - predominantly an - * XTTYPE_UINT*RC type. - */ -static size_t xtopt_esize_by_type(enum xt_option_type type) -{ - switch (type) { - case XTTYPE_UINT8RC: - return xtopt_psize[XTTYPE_UINT8]; - case XTTYPE_UINT16RC: - return xtopt_psize[XTTYPE_UINT16]; - case XTTYPE_UINT32RC: - return xtopt_psize[XTTYPE_UINT32]; - case XTTYPE_UINT64RC: - return xtopt_psize[XTTYPE_UINT64]; - default: - return xtopt_psize[type]; - } -} - -/** - * Require a simple integer. - */ -static void xtopt_parse_int(struct xt_option_call *cb) -{ - const struct xt_option_entry *entry = cb->entry; - uintmax_t lmin = 0, lmax = xtopt_max_by_type(entry->type); - uintmax_t value; - - if (cb->entry->min != 0) - lmin = cb->entry->min; - if (cb->entry->max != 0) - lmax = cb->entry->max; - - if (!xtables_strtoul(cb->arg, NULL, &value, lmin, lmax)) - xt_params->exit_err(PARAMETER_PROBLEM, - "%s: bad value for option \"--%s\", " - "or out of range (%ju-%ju).\n", - cb->ext_name, entry->name, lmin, lmax); - - if (entry->type == XTTYPE_UINT8) { - cb->val.u8 = value; - if (entry->flags & XTOPT_PUT) - *(uint8_t *)XTOPT_MKPTR(cb) = cb->val.u8; - } else if (entry->type == XTTYPE_UINT16) { - cb->val.u16 = value; - if (entry->flags & XTOPT_PUT) - *(uint16_t *)XTOPT_MKPTR(cb) = cb->val.u16; - } else if (entry->type == XTTYPE_UINT32) { - cb->val.u32 = value; - if (entry->flags & XTOPT_PUT) - *(uint32_t *)XTOPT_MKPTR(cb) = cb->val.u32; - } else if (entry->type == XTTYPE_UINT64) { - cb->val.u64 = value; - if (entry->flags & XTOPT_PUT) - *(uint64_t *)XTOPT_MKPTR(cb) = cb->val.u64; - } -} - -/** - * Require a simple floating point number. - */ -static void xtopt_parse_float(struct xt_option_call *cb) -{ - const struct xt_option_entry *entry = cb->entry; - double value; - char *end; - - value = strtod(cb->arg, &end); - if (end == cb->arg || *end != '\0' || - (entry->min != entry->max && - (value < entry->min || value > entry->max))) - xt_params->exit_err(PARAMETER_PROBLEM, - "%s: bad value for option \"--%s\", " - "or out of range (%u-%u).\n", - cb->ext_name, entry->name, entry->min, entry->max); - - cb->val.dbl = value; - if (entry->flags & XTOPT_PUT) - *(double *)XTOPT_MKPTR(cb) = cb->val.dbl; -} - -/** - * Copy the parsed value to the appropriate entry in cb->val. - */ -static void xtopt_mint_value_to_cb(struct xt_option_call *cb, uintmax_t value) -{ - const struct xt_option_entry *entry = cb->entry; - - if (cb->nvals >= ARRAY_SIZE(cb->val.u32_range)) - return; - if (entry->type == XTTYPE_UINT8RC) - cb->val.u8_range[cb->nvals] = value; - else if (entry->type == XTTYPE_UINT16RC) - cb->val.u16_range[cb->nvals] = value; - else if (entry->type == XTTYPE_UINT32RC) - cb->val.u32_range[cb->nvals] = value; - else if (entry->type == XTTYPE_UINT64RC) - cb->val.u64_range[cb->nvals] = value; -} - -/** - * Copy the parsed value to the data area, using appropriate type access. - */ -static void xtopt_mint_value_to_ptr(struct xt_option_call *cb, void **datap, - uintmax_t value) -{ - const struct xt_option_entry *entry = cb->entry; - void *data = *datap; - - if (!(entry->flags & XTOPT_PUT)) - return; - if (entry->type == XTTYPE_UINT8RC) - *(uint8_t *)data = value; - else if (entry->type == XTTYPE_UINT16RC) - *(uint16_t *)data = value; - else if (entry->type == XTTYPE_UINT32RC) - *(uint32_t *)data = value; - else if (entry->type == XTTYPE_UINT64RC) - *(uint64_t *)data = value; - data += xtopt_esize_by_type(entry->type); - *datap = data; -} - -/** - * Multiple integer parse routine. - * - * This function is capable of parsing any number of fields. Only the first - * two values from the string will be put into @cb however (and as such, - * @cb->val.uXX_range is just that large) to cater for the few extensions that - * do not have a range[2] field, but {min, max}, and which cannot use - * XTOPT_POINTER. - */ -static void xtopt_parse_mint(struct xt_option_call *cb) -{ - const struct xt_option_entry *entry = cb->entry; - const char *arg = cb->arg; - size_t esize = xtopt_esize_by_type(entry->type); - const uintmax_t lmax = xtopt_max_by_type(entry->type); - void *put = XTOPT_MKPTR(cb); - unsigned int maxiter; - uintmax_t value; - char *end = ""; - char sep = ':'; - - maxiter = entry->size / esize; - if (maxiter == 0) - maxiter = ARRAY_SIZE(cb->val.u32_range); - if (entry->size % esize != 0) - xt_params->exit_err(OTHER_PROBLEM, "%s: memory block does " - "not have proper size\n", __func__); - - cb->nvals = 0; - for (arg = cb->arg, end = (char *)arg; ; arg = end + 1) { - if (cb->nvals == maxiter) - xt_params->exit_err(PARAMETER_PROBLEM, "%s: Too many " - "components for option \"--%s\" (max: %u)\n", - cb->ext_name, entry->name, maxiter); - if (*arg == '\0' || *arg == sep) { - /* Default range components when field not spec'd. */ - end = (char *)arg; - value = (cb->nvals == 1) ? lmax : 0; - } else { - if (!xtables_strtoul(arg, &end, &value, 0, lmax)) - xt_params->exit_err(PARAMETER_PROBLEM, - "%s: bad value for option \"--%s\" near " - "\"%s\", or out of range (0-%ju).\n", - cb->ext_name, entry->name, arg, lmax); - if (*end != '\0' && *end != sep) - xt_params->exit_err(PARAMETER_PROBLEM, - "%s: Argument to \"--%s\" has " - "unexpected characters near \"%s\".\n", - cb->ext_name, entry->name, end); - } - xtopt_mint_value_to_cb(cb, value); - ++cb->nvals; - xtopt_mint_value_to_ptr(cb, &put, value); - if (*end == '\0') - break; - } -} - -static void xtopt_parse_string(struct xt_option_call *cb) -{ - const struct xt_option_entry *entry = cb->entry; - size_t z = strlen(cb->arg); - char *p; - - if (entry->min != 0 && z < entry->min) - xt_params->exit_err(PARAMETER_PROBLEM, - "Argument must have a minimum length of " - "%u characters\n", entry->min); - if (entry->max != 0 && z > entry->max) - xt_params->exit_err(PARAMETER_PROBLEM, - "Argument must have a maximum length of " - "%u characters\n", entry->max); - if (!(entry->flags & XTOPT_PUT)) - return; - if (z >= entry->size) - z = entry->size - 1; - p = XTOPT_MKPTR(cb); - strncpy(p, cb->arg, z); - p[z] = '\0'; -} - -static const struct tos_symbol_info { - unsigned char value; - const char *name; -} tos_symbol_names[] = { - {IPTOS_LOWDELAY, "Minimize-Delay"}, - {IPTOS_THROUGHPUT, "Maximize-Throughput"}, - {IPTOS_RELIABILITY, "Maximize-Reliability"}, - {IPTOS_MINCOST, "Minimize-Cost"}, - {IPTOS_NORMALSVC, "Normal-Service"}, - {}, -}; - -/* - * tos_parse_numeric - parse a string like "15/255" - * - * @str: input string - * @tvm: (value/mask) tuple - * @max: maximum allowed value (must be pow(2,some_int)-1) - */ -static bool tos_parse_numeric(const char *str, struct xt_option_call *cb, - unsigned int max) -{ - unsigned int value; - char *end; - - xtables_strtoui(str, &end, &value, 0, max); - cb->val.tos_value = value; - cb->val.tos_mask = max; - - if (*end == '/') { - const char *p = end + 1; - - if (!xtables_strtoui(p, &end, &value, 0, max)) - xtables_error(PARAMETER_PROBLEM, "Illegal value: \"%s\"", - str); - cb->val.tos_mask = value; - } - - if (*end != '\0') - xtables_error(PARAMETER_PROBLEM, "Illegal value: \"%s\"", str); - return true; -} - -/** - * @str: input string - * @tvm: (value/mask) tuple - * @def_mask: mask to force when a symbolic name is used - */ -static void xtopt_parse_tosmask(struct xt_option_call *cb) -{ - const struct tos_symbol_info *symbol; - char *tmp; - - if (xtables_strtoui(cb->arg, &tmp, NULL, 0, UINT8_MAX)) { - tos_parse_numeric(cb->arg, cb, UINT8_MAX); - return; - } - /* - * This is our way we deal with different defaults - * for different revisions. - */ - cb->val.tos_mask = cb->entry->max; - for (symbol = tos_symbol_names; symbol->name != NULL; ++symbol) - if (strcasecmp(cb->arg, symbol->name) == 0) { - cb->val.tos_value = symbol->value; - return; - } - - xtables_error(PARAMETER_PROBLEM, "Symbolic name \"%s\" is unknown", - cb->arg); -} - -/** - * Validate the input for being conformant to "mark[/mask]". - */ -static void xtopt_parse_markmask(struct xt_option_call *cb) -{ - unsigned int mark = 0, mask = ~0U; - char *end; - - if (!xtables_strtoui(cb->arg, &end, &mark, 0, UINT32_MAX)) - xt_params->exit_err(PARAMETER_PROBLEM, - "%s: bad mark value for option \"--%s\", " - "or out of range.\n", - cb->ext_name, cb->entry->name); - if (*end == '/' && - !xtables_strtoui(end + 1, &end, &mask, 0, UINT32_MAX)) - xt_params->exit_err(PARAMETER_PROBLEM, - "%s: bad mask value for option \"--%s\", " - "or out of range.\n", - cb->ext_name, cb->entry->name); - if (*end != '\0') - xt_params->exit_err(PARAMETER_PROBLEM, - "%s: trailing garbage after value " - "for option \"--%s\".\n", - cb->ext_name, cb->entry->name); - cb->val.mark = mark; - cb->val.mask = mask; -} - -static int xtopt_sysloglvl_compare(const void *a, const void *b) -{ - const char *name = a; - const struct syslog_level *entry = b; - - return strcmp(name, entry->name); -} - -static void xtopt_parse_sysloglevel(struct xt_option_call *cb) -{ - static const struct syslog_level log_names[] = { /* must be sorted */ - {"alert", LOG_ALERT}, - {"crit", LOG_CRIT}, - {"debug", LOG_DEBUG}, - {"emerg", LOG_EMERG}, - {"error", LOG_ERR}, /* deprecated */ - {"info", LOG_INFO}, - {"notice", LOG_NOTICE}, - {"panic", LOG_EMERG}, /* deprecated */ - {"warning", LOG_WARNING}, - }; - const struct syslog_level *e; - unsigned int num = 0; - - if (!xtables_strtoui(cb->arg, NULL, &num, 0, 7)) { - e = bsearch(cb->arg, log_names, ARRAY_SIZE(log_names), - sizeof(*log_names), xtopt_sysloglvl_compare); - if (e == NULL) - xt_params->exit_err(PARAMETER_PROBLEM, - "log level \"%s\" unknown\n", cb->arg); - num = e->level; - } - cb->val.syslog_level = num; - if (cb->entry->flags & XTOPT_PUT) - *(uint8_t *)XTOPT_MKPTR(cb) = num; -} - -static void *xtables_sa_host(const void *sa, unsigned int afproto) -{ - if (afproto == AF_INET6) - return &((struct sockaddr_in6 *)sa)->sin6_addr; - else if (afproto == AF_INET) - return &((struct sockaddr_in *)sa)->sin_addr; - return (void *)sa; -} - -static socklen_t xtables_sa_hostlen(unsigned int afproto) -{ - if (afproto == AF_INET6) - return sizeof(struct in6_addr); - else if (afproto == AF_INET) - return sizeof(struct in_addr); - return 0; -} - -/** - * Accepts: a hostname (DNS), or a single inetaddr - without any mask. The - * result is stored in @cb->val.haddr. Additionally, @cb->val.hmask and - * @cb->val.hlen are set for completeness to the appropriate values. - */ -static void xtopt_parse_host(struct xt_option_call *cb) -{ - struct addrinfo hints = {.ai_family = afinfo->family}; - unsigned int adcount = 0; - struct addrinfo *res, *p; - int ret; - - ret = getaddrinfo(cb->arg, NULL, &hints, &res); - if (ret < 0) - xt_params->exit_err(PARAMETER_PROBLEM, - "getaddrinfo: %s\n", gai_strerror(ret)); - - memset(&cb->val.hmask, 0xFF, sizeof(cb->val.hmask)); - cb->val.hlen = (afinfo->family == NFPROTO_IPV4) ? 32 : 128; - - for (p = res; p != NULL; p = p->ai_next) { - if (adcount == 0) { - memset(&cb->val.haddr, 0, sizeof(cb->val.haddr)); - memcpy(&cb->val.haddr, - xtables_sa_host(p->ai_addr, p->ai_family), - xtables_sa_hostlen(p->ai_family)); - ++adcount; - continue; - } - if (memcmp(&cb->val.haddr, - xtables_sa_host(p->ai_addr, p->ai_family), - xtables_sa_hostlen(p->ai_family)) != 0) - xt_params->exit_err(PARAMETER_PROBLEM, - "%s resolves to more than one address\n", - cb->arg); - } - - freeaddrinfo(res); - if (cb->entry->flags & XTOPT_PUT) - /* Validation in xtables_option_metavalidate */ - memcpy(XTOPT_MKPTR(cb), &cb->val.haddr, - sizeof(cb->val.haddr)); -} - -/** - * @name: port name, or number as a string (e.g. "http" or "80") - * - * Resolve a port name to a number. Returns the port number in integral - * form on success, or <0 on error. (errno will not be set.) - */ -static int xtables_getportbyname(const char *name) -{ - struct addrinfo *res = NULL, *p; - int ret; - - ret = getaddrinfo(NULL, name, NULL, &res); - if (ret < 0) - return -1; - ret = -1; - for (p = res; p != NULL; p = p->ai_next) { - if (p->ai_family == AF_INET6) { - ret = ((struct sockaddr_in6 *)p->ai_addr)->sin6_port; - break; - } else if (p->ai_family == AF_INET) { - ret = ((struct sockaddr_in *)p->ai_addr)->sin_port; - break; - } - } - freeaddrinfo(res); - if (ret < 0) - return ret; - return ntohs(ret); -} - -/** - * Validate and parse a protocol specification (number or name) by use of - * /etc/protocols and put the result into @cb->val.protocol. - */ -static void xtopt_parse_protocol(struct xt_option_call *cb) -{ - cb->val.protocol = xtables_parse_protocol(cb->arg); - if (cb->entry->flags & XTOPT_PUT) - *(uint8_t *)XTOPT_MKPTR(cb) = cb->val.protocol; -} - -/** - * Validate and parse a port specification and put the result into - * @cb->val.port. - */ -static void xtopt_parse_port(struct xt_option_call *cb) -{ - const struct xt_option_entry *entry = cb->entry; - int ret; - - ret = xtables_getportbyname(cb->arg); - if (ret < 0) - xt_params->exit_err(PARAMETER_PROBLEM, - "Port \"%s\" does not resolve to anything.\n", - cb->arg); - if (entry->flags & XTOPT_NBO) - ret = htons(ret); - cb->val.port = ret; - if (entry->flags & XTOPT_PUT) - *(uint16_t *)XTOPT_MKPTR(cb) = cb->val.port; -} - -static void xtopt_parse_mport(struct xt_option_call *cb) -{ - static const size_t esize = sizeof(uint16_t); - const struct xt_option_entry *entry = cb->entry; - char *lo_arg, *wp_arg, *arg; - unsigned int maxiter; - int value; - - wp_arg = lo_arg = strdup(cb->arg); - if (lo_arg == NULL) - xt_params->exit_err(RESOURCE_PROBLEM, "strdup"); - - maxiter = entry->size / esize; - if (maxiter == 0) - maxiter = 2; /* ARRAY_SIZE(cb->val.port_range) */ - if (entry->size % esize != 0) - xt_params->exit_err(OTHER_PROBLEM, "%s: memory block does " - "not have proper size\n", __func__); - - cb->val.port_range[0] = 0; - cb->val.port_range[1] = UINT16_MAX; - cb->nvals = 0; - - while ((arg = strsep(&wp_arg, ":")) != NULL) { - if (cb->nvals == maxiter) - xt_params->exit_err(PARAMETER_PROBLEM, "%s: Too many " - "components for option \"--%s\" (max: %u)\n", - cb->ext_name, entry->name, maxiter); - if (*arg == '\0') { - ++cb->nvals; - continue; - } - - value = xtables_getportbyname(arg); - if (value < 0) - xt_params->exit_err(PARAMETER_PROBLEM, - "Port \"%s\" does not resolve to " - "anything.\n", arg); - if (entry->flags & XTOPT_NBO) - value = htons(value); - if (cb->nvals < ARRAY_SIZE(cb->val.port_range)) - cb->val.port_range[cb->nvals] = value; - ++cb->nvals; - } - - if (cb->nvals == 1) { - cb->val.port_range[1] = cb->val.port_range[0]; - ++cb->nvals; - } - if (entry->flags & XTOPT_PUT) - memcpy(XTOPT_MKPTR(cb), cb->val.port_range, sizeof(uint16_t) * - (cb->nvals <= maxiter ? cb->nvals : maxiter)); - free(lo_arg); -} - -/** - * Parse an integer and ensure it is within the address family's prefix length - * limits. The result is stored in @cb->val.hlen. - */ -static void xtopt_parse_plen(struct xt_option_call *cb) -{ - const struct xt_option_entry *entry = cb->entry; - unsigned int prefix_len = 128; /* happiness is a warm gcc */ - - cb->val.hlen = (afinfo->family == NFPROTO_IPV4) ? 32 : 128; - if (!xtables_strtoui(cb->arg, NULL, &prefix_len, 0, cb->val.hlen)) - xt_params->exit_err(PARAMETER_PROBLEM, - "%s: bad value for option \"--%s\", " - "or out of range (%u-%u).\n", - cb->ext_name, entry->name, 0, cb->val.hlen); - - cb->val.hlen = prefix_len; -} - -/** - * Reuse xtopt_parse_plen for testing the integer. Afterwards convert this to - * a bitmask, and make it available through @cb->val.hmask (hlen remains - * valid). If %XTOPT_PUT is used, hmask will be copied to the target area. - */ -static void xtopt_parse_plenmask(struct xt_option_call *cb) -{ - const struct xt_option_entry *entry = cb->entry; - uint32_t *mask = cb->val.hmask.all; - - xtopt_parse_plen(cb); - - memset(mask, 0xFF, sizeof(union nf_inet_addr)); - /* This shifting is AF-independent. */ - if (cb->val.hlen == 0) { - mask[0] = mask[1] = mask[2] = mask[3] = 0; - } else if (cb->val.hlen <= 32) { - mask[0] <<= 32 - cb->val.hlen; - mask[1] = mask[2] = mask[3] = 0; - } else if (cb->val.hlen <= 64) { - mask[1] <<= 32 - (cb->val.hlen - 32); - mask[2] = mask[3] = 0; - } else if (cb->val.hlen <= 96) { - mask[2] <<= 32 - (cb->val.hlen - 64); - mask[3] = 0; - } else if (cb->val.hlen <= 128) { - mask[3] <<= 32 - (cb->val.hlen - 96); - } - mask[0] = htonl(mask[0]); - mask[1] = htonl(mask[1]); - mask[2] = htonl(mask[2]); - mask[3] = htonl(mask[3]); - if (entry->flags & XTOPT_PUT) - memcpy(XTOPT_MKPTR(cb), mask, sizeof(union nf_inet_addr)); -} - -static void xtopt_parse_hostmask(struct xt_option_call *cb) -{ - const char *orig_arg = cb->arg; - char *work, *p; - - if (strchr(cb->arg, '/') == NULL) { - xtopt_parse_host(cb); - return; - } - work = strdup(orig_arg); - if (work == NULL) - xt_params->exit_err(PARAMETER_PROBLEM, "strdup"); - p = strchr(work, '/'); /* by def this can't be NULL now */ - *p++ = '\0'; - /* - * Because xtopt_parse_host and xtopt_parse_plenmask would store - * different things in the same target area, XTTYPE_HOSTMASK must - * disallow XTOPT_PUT, which it does by forcing its absence, - * cf. not being listed in xtopt_psize. - */ - cb->arg = work; - xtopt_parse_host(cb); - cb->arg = p; - xtopt_parse_plenmask(cb); - cb->arg = orig_arg; -} - -static void xtopt_parse_ethermac(struct xt_option_call *cb) -{ - const char *arg = cb->arg; - unsigned int i; - char *end; - - for (i = 0; i < ARRAY_SIZE(cb->val.ethermac) - 1; ++i) { - cb->val.ethermac[i] = strtoul(arg, &end, 16); - if (*end != ':' || end - arg > 2) - goto out; - arg = end + 1; - } - i = ARRAY_SIZE(cb->val.ethermac) - 1; - cb->val.ethermac[i] = strtoul(arg, &end, 16); - if (*end != '\0' || end - arg > 2) - goto out; - if (cb->entry->flags & XTOPT_PUT) - memcpy(XTOPT_MKPTR(cb), cb->val.ethermac, - sizeof(cb->val.ethermac)); - return; - out: - xt_params->exit_err(PARAMETER_PROBLEM, "ether"); -} - -static void (*const xtopt_subparse[])(struct xt_option_call *) = { - [XTTYPE_UINT8] = xtopt_parse_int, - [XTTYPE_UINT16] = xtopt_parse_int, - [XTTYPE_UINT32] = xtopt_parse_int, - [XTTYPE_UINT64] = xtopt_parse_int, - [XTTYPE_UINT8RC] = xtopt_parse_mint, - [XTTYPE_UINT16RC] = xtopt_parse_mint, - [XTTYPE_UINT32RC] = xtopt_parse_mint, - [XTTYPE_UINT64RC] = xtopt_parse_mint, - [XTTYPE_DOUBLE] = xtopt_parse_float, - [XTTYPE_STRING] = xtopt_parse_string, - [XTTYPE_TOSMASK] = xtopt_parse_tosmask, - [XTTYPE_MARKMASK32] = xtopt_parse_markmask, - [XTTYPE_SYSLOGLEVEL] = xtopt_parse_sysloglevel, - [XTTYPE_HOST] = xtopt_parse_host, - [XTTYPE_HOSTMASK] = xtopt_parse_hostmask, - [XTTYPE_PROTOCOL] = xtopt_parse_protocol, - [XTTYPE_PORT] = xtopt_parse_port, - [XTTYPE_PORTRC] = xtopt_parse_mport, - [XTTYPE_PLEN] = xtopt_parse_plen, - [XTTYPE_PLENMASK] = xtopt_parse_plenmask, - [XTTYPE_ETHERMAC] = xtopt_parse_ethermac, -}; - -/** - * The master option parsing routine. May be used for the ".x6_parse" - * function pointer in extensions if fully automatic parsing is desired. - * It may be also called manually from a custom x6_parse function. - */ -void xtables_option_parse(struct xt_option_call *cb) -{ - const struct xt_option_entry *entry = cb->entry; - unsigned int eflag = 1 << cb->entry->id; - - /* - * With {.id = P_FOO, .excl = P_FOO} we can have simple double-use - * prevention. Though it turned out that this is too much typing (most - * of the options are one-time use only), so now we also have - * %XTOPT_MULTI. - */ - if ((!(entry->flags & XTOPT_MULTI) || (entry->excl & eflag)) && - cb->xflags & eflag) - xt_params->exit_err(PARAMETER_PROBLEM, - "%s: option \"--%s\" can only be used once.\n", - cb->ext_name, cb->entry->name); - if (cb->invert && !(entry->flags & XTOPT_INVERT)) - xt_params->exit_err(PARAMETER_PROBLEM, - "%s: option \"--%s\" cannot be inverted.\n", - cb->ext_name, entry->name); - if (entry->type != XTTYPE_NONE && optarg == NULL) - xt_params->exit_err(PARAMETER_PROBLEM, - "%s: option \"--%s\" requires an argument.\n", - cb->ext_name, entry->name); - /* - * Fill in fallback value for "nvals", in case an extension (as it - * happened with libxt_conntrack.2) tries to read it, despite not using - * a *RC option type. - */ - cb->nvals = 1; - if (entry->type <= ARRAY_SIZE(xtopt_subparse) && - xtopt_subparse[entry->type] != NULL) - xtopt_subparse[entry->type](cb); - /* Exclusion with other flags tested later in finalize. */ - cb->xflags |= 1 << entry->id; -} - -/** - * Verifies that an extension's option map descriptor is valid, and ought to - * be called right after the extension has been loaded, and before option - * merging/xfrm. - */ -void xtables_option_metavalidate(const char *name, - const struct xt_option_entry *entry) -{ - for (; entry->name != NULL; ++entry) { - if (entry->id >= CHAR_BIT * sizeof(unsigned int) || - entry->id >= XT_OPTION_OFFSET_SCALE) - xt_params->exit_err(OTHER_PROBLEM, - "Extension %s uses invalid ID %u\n", - name, entry->id); - if (!(entry->flags & XTOPT_PUT)) { - if (entry->ptroff != 0) - xt_params->exit_err(OTHER_PROBLEM, - "%s: ptroff for \"--%s\" is non-" - "zero but no XTOPT_PUT is specified. " - "Oversight?", name, entry->name); - continue; - } - if (entry->type >= ARRAY_SIZE(xtopt_psize) || - xtopt_psize[entry->type] == 0) - xt_params->exit_err(OTHER_PROBLEM, - "%s: entry type of option \"--%s\" cannot be " - "combined with XTOPT_PUT\n", - name, entry->name); - if (xtopt_psize[entry->type] != -1 && - xtopt_psize[entry->type] != entry->size) - xt_params->exit_err(OTHER_PROBLEM, - "%s: option \"--%s\" points to a memory block " - "of wrong size (expected %zu, got %zu)\n", - name, entry->name, - xtopt_psize[entry->type], entry->size); - } -} - -/** - * Find an option entry by its id. - */ -static const struct xt_option_entry * -xtables_option_lookup(const struct xt_option_entry *entry, unsigned int id) -{ - for (; entry->name != NULL; ++entry) - if (entry->id == id) - return entry; - return NULL; -} - -/** - * @c: getopt id (i.e. with offset) - * @fw: struct ipt_entry or ip6t_entry - * - * Dispatch arguments to the appropriate parse function, based upon the - * extension's choice of API. - */ -void xtables_option_tpcall(unsigned int c, char **argv, bool invert, - struct xtables_target *t, void *fw) -{ - struct xt_option_call cb; - - if (t->x6_parse == NULL) { - if (t->parse != NULL) - t->parse(c - t->option_offset, argv, invert, - &t->tflags, fw, &t->t); - return; - } - - c -= t->option_offset; - cb.entry = xtables_option_lookup(t->x6_options, c); - if (cb.entry == NULL) - xtables_error(OTHER_PROBLEM, - "Extension does not know id %u\n", c); - cb.arg = optarg; - cb.invert = invert; - cb.ext_name = t->name; - cb.data = t->t->data; - cb.xflags = t->tflags; - cb.target = &t->t; - cb.xt_entry = fw; - cb.udata = t->udata; - t->x6_parse(&cb); - t->tflags = cb.xflags; -} - -/** - * @c: getopt id (i.e. with offset) - * @fw: struct ipt_entry or ip6t_entry - * - * Dispatch arguments to the appropriate parse function, based upon the - * extension's choice of API. - */ -void xtables_option_mpcall(unsigned int c, char **argv, bool invert, - struct xtables_match *m, void *fw) -{ - struct xt_option_call cb; - - if (m->x6_parse == NULL) { - if (m->parse != NULL) - m->parse(c - m->option_offset, argv, invert, - &m->mflags, fw, &m->m); - return; - } - - c -= m->option_offset; - cb.entry = xtables_option_lookup(m->x6_options, c); - if (cb.entry == NULL) - xtables_error(OTHER_PROBLEM, - "Extension does not know id %u\n", c); - cb.arg = optarg; - cb.invert = invert; - cb.ext_name = m->name; - cb.data = m->m->data; - cb.xflags = m->mflags; - cb.match = &m->m; - cb.xt_entry = fw; - cb.udata = m->udata; - m->x6_parse(&cb); - m->mflags = cb.xflags; -} - -/** - * @name: name of extension - * @entry: current option (from all ext's entries) being validated - * @xflags: flags the extension has collected - * @i: conflicting option (id) to test for - */ -static void -xtables_option_fcheck2(const char *name, const struct xt_option_entry *entry, - const struct xt_option_entry *other, - unsigned int xflags) -{ - unsigned int ef = 1 << entry->id, of = 1 << other->id; - - if (entry->also & of && !(xflags & of)) - xt_params->exit_err(PARAMETER_PROBLEM, - "%s: option \"--%s\" also requires \"--%s\".\n", - name, entry->name, other->name); - - if (!(entry->excl & of)) - /* Use of entry does not collide with other option, good. */ - return; - if ((xflags & (ef | of)) != (ef | of)) - /* Conflicting options were not used. */ - return; - - xt_params->exit_err(PARAMETER_PROBLEM, - "%s: option \"--%s\" cannot be used together with \"--%s\".\n", - name, entry->name, other->name); -} - -/** - * @name: name of extension - * @xflags: accumulated flags - * @entry: extension's option table - * - * Check that all option constraints have been met. This effectively replaces - * ->final_check of the older API. - */ -void xtables_options_fcheck(const char *name, unsigned int xflags, - const struct xt_option_entry *table) -{ - const struct xt_option_entry *entry, *other; - unsigned int i; - - for (entry = table; entry->name != NULL; ++entry) { - if (entry->flags & XTOPT_MAND && - !(xflags & (1 << entry->id))) - xt_params->exit_err(PARAMETER_PROBLEM, - "%s: option \"--%s\" must be specified\n", - name, entry->name); - if (!(xflags & (1 << entry->id))) - /* Not required, not specified, thus skip. */ - continue; - - for (i = 0; i < CHAR_BIT * sizeof(entry->id); ++i) { - if (entry->id == i) - /* - * Avoid conflict with self. Multi-use check - * was done earlier in xtables_option_parse. - */ - continue; - other = xtables_option_lookup(table, i); - if (other == NULL) - continue; - xtables_option_fcheck2(name, entry, other, xflags); - } - } -} - -/** - * Dispatch arguments to the appropriate final_check function, based upon the - * extension's choice of API. - */ -void xtables_option_tfcall(struct xtables_target *t) -{ - if (t->x6_fcheck != NULL) { - struct xt_fcheck_call cb; - - cb.ext_name = t->name; - cb.data = t->t->data; - cb.xflags = t->tflags; - cb.udata = t->udata; - t->x6_fcheck(&cb); - } else if (t->final_check != NULL) { - t->final_check(t->tflags); - } - if (t->x6_options != NULL) - xtables_options_fcheck(t->name, t->tflags, t->x6_options); -} - -/** - * Dispatch arguments to the appropriate final_check function, based upon the - * extension's choice of API. - */ -void xtables_option_mfcall(struct xtables_match *m) -{ - if (m->x6_fcheck != NULL) { - struct xt_fcheck_call cb; - - cb.ext_name = m->name; - cb.data = m->m->data; - cb.xflags = m->mflags; - cb.udata = m->udata; - m->x6_fcheck(&cb); - } else if (m->final_check != NULL) { - m->final_check(m->mflags); - } - if (m->x6_options != NULL) - xtables_options_fcheck(m->name, m->mflags, m->x6_options); -} - -struct xtables_lmap *xtables_lmap_init(const char *file) -{ - struct xtables_lmap *lmap_head = NULL, *lmap_prev = NULL, *lmap_this; - char buf[512]; - FILE *fp; - char *cur, *nxt; - int id; - - fp = fopen(file, "re"); - if (fp == NULL) - return NULL; - - while (fgets(buf, sizeof(buf), fp) != NULL) { - cur = buf; - while (isspace(*cur)) - ++cur; - if (*cur == '#' || *cur == '\n' || *cur == '\0') - continue; - - /* iproute2 allows hex and dec format */ - errno = 0; - id = strtoul(cur, &nxt, strncmp(cur, "0x", 2) == 0 ? 16 : 10); - if (nxt == cur || errno != 0) - continue; - - /* same boundaries as in iproute2 */ - if (id < 0 || id > 255) - continue; - cur = nxt; - - if (!isspace(*cur)) - continue; - while (isspace(*cur)) - ++cur; - if (*cur == '#' || *cur == '\n' || *cur == '\0') - continue; - nxt = cur; - while (*nxt != '\0' && !isspace(*nxt)) - ++nxt; - if (nxt == cur) - continue; - *nxt = '\0'; - - /* found valid data */ - lmap_this = malloc(sizeof(*lmap_this)); - if (lmap_this == NULL) { - perror("malloc"); - goto out; - } - lmap_this->id = id; - lmap_this->name = strdup(cur); - if (lmap_this->name == NULL) { - free(lmap_this); - goto out; - } - lmap_this->next = NULL; - - if (lmap_prev != NULL) - lmap_prev->next = lmap_this; - else - lmap_head = lmap_this; - lmap_prev = lmap_this; - } - - fclose(fp); - return lmap_head; - out: - xtables_lmap_free(lmap_head); - return NULL; -} - -void xtables_lmap_free(struct xtables_lmap *head) -{ - struct xtables_lmap *next; - - for (; head != NULL; head = next) { - next = head->next; - free(head->name); - free(head); - } -} - -int xtables_lmap_name2id(const struct xtables_lmap *head, const char *name) -{ - for (; head != NULL; head = head->next) - if (strcmp(head->name, name) == 0) - return head->id; - return -1; -} - -const char *xtables_lmap_id2name(const struct xtables_lmap *head, int id) -{ - for (; head != NULL; head = head->next) - if (head->id == id) - return head->name; - return NULL; -} diff --git a/libxtables/Makefile.am b/libxtables/Makefile.am new file mode 100644 index 00000000..c5795fef --- /dev/null +++ b/libxtables/Makefile.am @@ -0,0 +1,20 @@ +# -*- Makefile -*- + +AM_CFLAGS = ${regular_CFLAGS} +AM_CPPFLAGS = ${regular_CPPFLAGS} -I${top_builddir}/include -I${top_srcdir}/include -I${top_srcdir}/iptables ${kinclude_CPPFLAGS} + +lib_LTLIBRARIES = libxtables.la +libxtables_la_SOURCES = xtables.c xtoptions.c +libxtables_la_LDFLAGS = -version-info ${libxtables_vcurrent}:0:${libxtables_vage} +libxtables_la_LIBADD = +if ENABLE_STATIC +# With --enable-static, shipped extensions are linked into the main executable, +# so we need all the LIBADDs here too +libxtables_la_LIBADD += -lm +endif +if ENABLE_SHARED +libxtables_la_CFLAGS = ${AM_CFLAGS} +libxtables_la_LIBADD += -ldl +else +libxtables_la_CFLAGS = ${AM_CFLAGS} -DNO_SHARED_LIBS=1 +endif diff --git a/libxtables/xtables.c b/libxtables/xtables.c new file mode 100644 index 00000000..014e115b --- /dev/null +++ b/libxtables/xtables.c @@ -0,0 +1,1832 @@ +/* + * (C) 2000-2006 by the netfilter coreteam : + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + */ +#include "config.h" +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#if defined(HAVE_LINUX_MAGIC_H) +# include /* for PROC_SUPER_MAGIC */ +#elif defined(HAVE_LINUX_PROC_FS_H) +# include /* Linux 2.4 */ +#else +# define PROC_SUPER_MAGIC 0x9fa0 +#endif + +#include +#include /* INT_MAX in ip_tables.h/ip6_tables.h */ +#include +#include +#include + +#ifndef NO_SHARED_LIBS +#include +#endif +#ifndef IPT_SO_GET_REVISION_MATCH /* Old kernel source. */ +# define IPT_SO_GET_REVISION_MATCH (IPT_BASE_CTL + 2) +# define IPT_SO_GET_REVISION_TARGET (IPT_BASE_CTL + 3) +#endif +#ifndef IP6T_SO_GET_REVISION_MATCH /* Old kernel source. */ +# define IP6T_SO_GET_REVISION_MATCH 68 +# define IP6T_SO_GET_REVISION_TARGET 69 +#endif +#include +#include "iptables/internal.h" +#include "xshared.h" + +#define NPROTO 255 + +#ifndef PROC_SYS_MODPROBE +#define PROC_SYS_MODPROBE "/proc/sys/kernel/modprobe" +#endif + +/* we need this for ip6?tables-restore. ip6?tables-restore.c sets line to the + * current line of the input file, in order to give a more precise error + * message. ip6?tables itself doesn't need this, so it is initialized to the + * magic number of -1 */ +int line = -1; + +void basic_exit_err(enum xtables_exittype status, const char *msg, ...) __attribute__((noreturn, format(printf,2,3))); + +struct xtables_globals *xt_params = NULL; + +void basic_exit_err(enum xtables_exittype status, const char *msg, ...) +{ + va_list args; + + va_start(args, msg); + fprintf(stderr, "%s v%s: ", xt_params->program_name, xt_params->program_version); + vfprintf(stderr, msg, args); + va_end(args); + fprintf(stderr, "\n"); + exit(status); +} + +void xtables_free_opts(int unused) +{ + if (xt_params->opts != xt_params->orig_opts) { + free(xt_params->opts); + xt_params->opts = NULL; + } +} + +struct option *xtables_merge_options(struct option *orig_opts, + struct option *oldopts, + const struct option *newopts, + unsigned int *option_offset) +{ + unsigned int num_oold = 0, num_old = 0, num_new = 0, i; + struct option *merge, *mp; + + if (newopts == NULL) + return oldopts; + + for (num_oold = 0; orig_opts[num_oold].name; num_oold++) ; + if (oldopts != NULL) + for (num_old = 0; oldopts[num_old].name; num_old++) ; + for (num_new = 0; newopts[num_new].name; num_new++) ; + + /* + * Since @oldopts also has @orig_opts already (and does so at the + * start), skip these entries. + */ + oldopts += num_oold; + num_old -= num_oold; + + merge = malloc(sizeof(*mp) * (num_oold + num_old + num_new + 1)); + if (merge == NULL) + return NULL; + + /* Let the base options -[ADI...] have precedence over everything */ + memcpy(merge, orig_opts, sizeof(*mp) * num_oold); + mp = merge + num_oold; + + /* Second, the new options */ + xt_params->option_offset += XT_OPTION_OFFSET_SCALE; + *option_offset = xt_params->option_offset; + memcpy(mp, newopts, sizeof(*mp) * num_new); + + for (i = 0; i < num_new; ++i, ++mp) + mp->val += *option_offset; + + /* Third, the old options */ + memcpy(mp, oldopts, sizeof(*mp) * num_old); + mp += num_old; + xtables_free_opts(0); + + /* Clear trailing entry */ + memset(mp, 0, sizeof(*mp)); + return merge; +} + +static const struct xtables_afinfo afinfo_ipv4 = { + .kmod = "ip_tables", + .proc_exists = "/proc/net/ip_tables_names", + .libprefix = "libipt_", + .family = NFPROTO_IPV4, + .ipproto = IPPROTO_IP, + .so_rev_match = IPT_SO_GET_REVISION_MATCH, + .so_rev_target = IPT_SO_GET_REVISION_TARGET, +}; + +static const struct xtables_afinfo afinfo_ipv6 = { + .kmod = "ip6_tables", + .proc_exists = "/proc/net/ip6_tables_names", + .libprefix = "libip6t_", + .family = NFPROTO_IPV6, + .ipproto = IPPROTO_IPV6, + .so_rev_match = IP6T_SO_GET_REVISION_MATCH, + .so_rev_target = IP6T_SO_GET_REVISION_TARGET, +}; + +const struct xtables_afinfo *afinfo; + +/* Search path for Xtables .so files */ +static const char *xtables_libdir; + +/* the path to command to load kernel module */ +const char *xtables_modprobe_program; + +/* Keep track of matches/targets pending full registration: linked lists. */ +struct xtables_match *xtables_pending_matches; +struct xtables_target *xtables_pending_targets; + +/* Keep track of fully registered external matches/targets: linked lists. */ +struct xtables_match *xtables_matches; +struct xtables_target *xtables_targets; + +/* Fully register a match/target which was previously partially registered. */ +static void xtables_fully_register_pending_match(struct xtables_match *me); +static void xtables_fully_register_pending_target(struct xtables_target *me); + +void xtables_init(void) +{ + xtables_libdir = getenv("XTABLES_LIBDIR"); + if (xtables_libdir != NULL) + return; + xtables_libdir = getenv("IPTABLES_LIB_DIR"); + if (xtables_libdir != NULL) { + fprintf(stderr, "IPTABLES_LIB_DIR is deprecated, " + "use XTABLES_LIBDIR.\n"); + return; + } + /* + * Well yes, IP6TABLES_LIB_DIR is of lower priority over + * IPTABLES_LIB_DIR since this moved to libxtables; I think that is ok + * for these env vars are deprecated anyhow, and in light of the + * (shared) libxt_*.so files, makes less sense to have + * IPTABLES_LIB_DIR != IP6TABLES_LIB_DIR. + */ + xtables_libdir = getenv("IP6TABLES_LIB_DIR"); + if (xtables_libdir != NULL) { + fprintf(stderr, "IP6TABLES_LIB_DIR is deprecated, " + "use XTABLES_LIBDIR.\n"); + return; + } + xtables_libdir = XTABLES_LIBDIR; +} + +void xtables_set_nfproto(uint8_t nfproto) +{ + switch (nfproto) { + case NFPROTO_IPV4: + afinfo = &afinfo_ipv4; + break; + case NFPROTO_IPV6: + afinfo = &afinfo_ipv6; + break; + default: + fprintf(stderr, "libxtables: unhandled NFPROTO in %s\n", + __func__); + } +} + +/** + * xtables_set_params - set the global parameters used by xtables + * @xtp: input xtables_globals structure + * + * The app is expected to pass a valid xtables_globals data-filled + * with proper values + * @xtp cannot be NULL + * + * Returns -1 on failure to set and 0 on success + */ +int xtables_set_params(struct xtables_globals *xtp) +{ + if (!xtp) { + fprintf(stderr, "%s: Illegal global params\n",__func__); + return -1; + } + + xt_params = xtp; + + if (!xt_params->exit_err) + xt_params->exit_err = basic_exit_err; + + return 0; +} + +int xtables_init_all(struct xtables_globals *xtp, uint8_t nfproto) +{ + xtables_init(); + xtables_set_nfproto(nfproto); + return xtables_set_params(xtp); +} + +/** + * xtables_*alloc - wrappers that exit on failure + */ +void *xtables_calloc(size_t count, size_t size) +{ + void *p; + + if ((p = calloc(count, size)) == NULL) { + perror("ip[6]tables: calloc failed"); + exit(1); + } + + return p; +} + +void *xtables_malloc(size_t size) +{ + void *p; + + if ((p = malloc(size)) == NULL) { + perror("ip[6]tables: malloc failed"); + exit(1); + } + + return p; +} + +void *xtables_realloc(void *ptr, size_t size) +{ + void *p; + + if ((p = realloc(ptr, size)) == NULL) { + perror("ip[6]tables: realloc failed"); + exit(1); + } + + return p; +} + +static char *get_modprobe(void) +{ + int procfile; + char *ret; + +#define PROCFILE_BUFSIZ 1024 + procfile = open(PROC_SYS_MODPROBE, O_RDONLY); + if (procfile < 0) + return NULL; + if (fcntl(procfile, F_SETFD, FD_CLOEXEC) == -1) { + fprintf(stderr, "Could not set close on exec: %s\n", + strerror(errno)); + exit(1); + } + + ret = malloc(PROCFILE_BUFSIZ); + if (ret) { + memset(ret, 0, PROCFILE_BUFSIZ); + switch (read(procfile, ret, PROCFILE_BUFSIZ)) { + case -1: goto fail; + case PROCFILE_BUFSIZ: goto fail; /* Partial read. Wierd */ + } + if (ret[strlen(ret)-1]=='\n') + ret[strlen(ret)-1]=0; + close(procfile); + return ret; + } + fail: + free(ret); + close(procfile); + return NULL; +} + +int xtables_insmod(const char *modname, const char *modprobe, bool quiet) +{ + char *buf = NULL; + char *argv[4]; + int status; + + /* If they don't explicitly set it, read out of kernel */ + if (!modprobe) { + buf = get_modprobe(); + if (!buf) + return -1; + modprobe = buf; + } + + /* + * Need to flush the buffer, or the child may output it again + * when switching the program thru execv. + */ + fflush(stdout); + + switch (vfork()) { + case 0: + argv[0] = (char *)modprobe; + argv[1] = (char *)modname; + if (quiet) { + argv[2] = "-q"; + argv[3] = NULL; + } else { + argv[2] = NULL; + argv[3] = NULL; + } + execv(argv[0], argv); + + /* not usually reached */ + exit(1); + case -1: + free(buf); + return -1; + + default: /* parent */ + wait(&status); + } + + free(buf); + if (WIFEXITED(status) && WEXITSTATUS(status) == 0) + return 0; + return -1; +} + +/* return true if a given file exists within procfs */ +static bool proc_file_exists(const char *filename) +{ + struct stat s; + struct statfs f; + + if (lstat(filename, &s)) + return false; + if (!S_ISREG(s.st_mode)) + return false; + if (statfs(filename, &f)) + return false; + if (f.f_type != PROC_SUPER_MAGIC) + return false; + return true; +} + +int xtables_load_ko(const char *modprobe, bool quiet) +{ + static bool loaded = false; + int ret; + + if (loaded) + return 0; + + if (proc_file_exists(afinfo->proc_exists)) { + loaded = true; + return 0; + }; + + ret = xtables_insmod(afinfo->kmod, modprobe, quiet); + if (ret == 0) + loaded = true; + + return ret; +} + +/** + * xtables_strtou{i,l} - string to number conversion + * @s: input string + * @end: like strtoul's "end" pointer + * @value: pointer for result + * @min: minimum accepted value + * @max: maximum accepted value + * + * If @end is NULL, we assume the caller wants a "strict strtoul", and hence + * "15a" is rejected. + * In either case, the value obtained is compared for min-max compliance. + * Base is always 0, i.e. autodetect depending on @s. + * + * Returns true/false whether number was accepted. On failure, *value has + * undefined contents. + */ +bool xtables_strtoul(const char *s, char **end, uintmax_t *value, + uintmax_t min, uintmax_t max) +{ + uintmax_t v; + const char *p; + char *my_end; + + errno = 0; + /* Since strtoul allows leading minus, we have to check for ourself. */ + for (p = s; isspace(*p); ++p) + ; + if (*p == '-') + return false; + v = strtoumax(s, &my_end, 0); + if (my_end == s) + return false; + if (end != NULL) + *end = my_end; + + if (errno != ERANGE && min <= v && (max == 0 || v <= max)) { + if (value != NULL) + *value = v; + if (end == NULL) + return *my_end == '\0'; + return true; + } + + return false; +} + +bool xtables_strtoui(const char *s, char **end, unsigned int *value, + unsigned int min, unsigned int max) +{ + uintmax_t v; + bool ret; + + ret = xtables_strtoul(s, end, &v, min, max); + if (value != NULL) + *value = v; + return ret; +} + +int xtables_service_to_port(const char *name, const char *proto) +{ + struct servent *service; + + if ((service = getservbyname(name, proto)) != NULL) + return ntohs((unsigned short) service->s_port); + + return -1; +} + +uint16_t xtables_parse_port(const char *port, const char *proto) +{ + unsigned int portnum; + + if (xtables_strtoui(port, NULL, &portnum, 0, UINT16_MAX) || + (portnum = xtables_service_to_port(port, proto)) != (unsigned)-1) + return portnum; + + xt_params->exit_err(PARAMETER_PROBLEM, + "invalid port/service `%s' specified", port); +} + +void xtables_parse_interface(const char *arg, char *vianame, + unsigned char *mask) +{ + unsigned int vialen = strlen(arg); + unsigned int i; + + memset(mask, 0, IFNAMSIZ); + memset(vianame, 0, IFNAMSIZ); + + if (vialen + 1 > IFNAMSIZ) + xt_params->exit_err(PARAMETER_PROBLEM, + "interface name `%s' must be shorter than IFNAMSIZ" + " (%i)", arg, IFNAMSIZ-1); + + strcpy(vianame, arg); + if (vialen == 0) + return; + else if (vianame[vialen - 1] == '+') { + memset(mask, 0xFF, vialen - 1); + /* Don't remove `+' here! -HW */ + } else { + /* Include nul-terminator in match */ + memset(mask, 0xFF, vialen + 1); + for (i = 0; vianame[i]; i++) { + if (vianame[i] == '/' || + vianame[i] == ' ') { + fprintf(stderr, + "Warning: weird character in interface" + " `%s' ('/' and ' ' are not allowed by the kernel).\n", + vianame); + break; + } + } + } +} + +#ifndef NO_SHARED_LIBS +static void *load_extension(const char *search_path, const char *af_prefix, + const char *name, bool is_target) +{ + const char *all_prefixes[] = {"libxt_", af_prefix, NULL}; + const char **prefix; + const char *dir = search_path, *next; + void *ptr = NULL; + struct stat sb; + char path[256]; + + do { + next = strchr(dir, ':'); + if (next == NULL) + next = dir + strlen(dir); + + for (prefix = all_prefixes; *prefix != NULL; ++prefix) { + snprintf(path, sizeof(path), "%.*s/%s%s.so", + (unsigned int)(next - dir), dir, + *prefix, name); + + if (stat(path, &sb) != 0) { + if (errno == ENOENT) + continue; + fprintf(stderr, "%s: %s\n", path, + strerror(errno)); + return NULL; + } + if (dlopen(path, RTLD_NOW) == NULL) { + fprintf(stderr, "%s: %s\n", path, dlerror()); + break; + } + + if (is_target) + ptr = xtables_find_target(name, XTF_DONT_LOAD); + else + ptr = xtables_find_match(name, + XTF_DONT_LOAD, NULL); + + if (ptr != NULL) + return ptr; + + fprintf(stderr, "%s: no \"%s\" extension found for " + "this protocol\n", path, name); + errno = ENOENT; + return NULL; + } + dir = next + 1; + } while (*next != '\0'); + + return NULL; +} +#endif + +struct xtables_match * +xtables_find_match(const char *name, enum xtables_tryload tryload, + struct xtables_rule_match **matches) +{ + struct xtables_match **dptr; + struct xtables_match *ptr; + const char *icmp6 = "icmp6"; + + if (strlen(name) >= XT_EXTENSION_MAXNAMELEN) + xtables_error(PARAMETER_PROBLEM, + "Invalid match name \"%s\" (%u chars max)", + name, XT_EXTENSION_MAXNAMELEN - 1); + + /* This is ugly as hell. Nonetheless, there is no way of changing + * this without hurting backwards compatibility */ + if ( (strcmp(name,"icmpv6") == 0) || + (strcmp(name,"ipv6-icmp") == 0) || + (strcmp(name,"icmp6") == 0) ) + name = icmp6; + + /* Trigger delayed initialization */ + for (dptr = &xtables_pending_matches; *dptr; ) { + if (strcmp(name, (*dptr)->name) == 0) { + ptr = *dptr; + *dptr = (*dptr)->next; + ptr->next = NULL; + xtables_fully_register_pending_match(ptr); + } else { + dptr = &((*dptr)->next); + } + } + + for (ptr = xtables_matches; ptr; ptr = ptr->next) { + if (strcmp(name, ptr->name) == 0) { + struct xtables_match *clone; + + /* First match of this type: */ + if (ptr->m == NULL) + break; + + /* Second and subsequent clones */ + clone = xtables_malloc(sizeof(struct xtables_match)); + memcpy(clone, ptr, sizeof(struct xtables_match)); + clone->udata = NULL; + clone->mflags = 0; + /* This is a clone: */ + clone->next = clone; + + ptr = clone; + break; + } + } + +#ifndef NO_SHARED_LIBS + if (!ptr && tryload != XTF_DONT_LOAD && tryload != XTF_DURING_LOAD) { + ptr = load_extension(xtables_libdir, afinfo->libprefix, + name, false); + + if (ptr == NULL && tryload == XTF_LOAD_MUST_SUCCEED) + xt_params->exit_err(PARAMETER_PROBLEM, + "Couldn't load match `%s':%s\n", + name, strerror(errno)); + } +#else + if (ptr && !ptr->loaded) { + if (tryload != XTF_DONT_LOAD) + ptr->loaded = 1; + else + ptr = NULL; + } + if(!ptr && (tryload == XTF_LOAD_MUST_SUCCEED)) { + xt_params->exit_err(PARAMETER_PROBLEM, + "Couldn't find match `%s'\n", name); + } +#endif + + if (ptr && matches) { + struct xtables_rule_match **i; + struct xtables_rule_match *newentry; + + newentry = xtables_malloc(sizeof(struct xtables_rule_match)); + + for (i = matches; *i; i = &(*i)->next) { + if (strcmp(name, (*i)->match->name) == 0) + (*i)->completed = true; + } + newentry->match = ptr; + newentry->completed = false; + newentry->next = NULL; + *i = newentry; + } + + return ptr; +} + +struct xtables_target * +xtables_find_target(const char *name, enum xtables_tryload tryload) +{ + struct xtables_target **dptr; + struct xtables_target *ptr; + + /* Standard target? */ + if (strcmp(name, "") == 0 + || strcmp(name, XTC_LABEL_ACCEPT) == 0 + || strcmp(name, XTC_LABEL_DROP) == 0 + || strcmp(name, XTC_LABEL_QUEUE) == 0 + || strcmp(name, XTC_LABEL_RETURN) == 0) + name = "standard"; + + /* Trigger delayed initialization */ + for (dptr = &xtables_pending_targets; *dptr; ) { + if (strcmp(name, (*dptr)->name) == 0) { + ptr = *dptr; + *dptr = (*dptr)->next; + ptr->next = NULL; + xtables_fully_register_pending_target(ptr); + } else { + dptr = &((*dptr)->next); + } + } + + for (ptr = xtables_targets; ptr; ptr = ptr->next) { + if (strcmp(name, ptr->name) == 0) + break; + } + +#ifndef NO_SHARED_LIBS + if (!ptr && tryload != XTF_DONT_LOAD && tryload != XTF_DURING_LOAD) { + ptr = load_extension(xtables_libdir, afinfo->libprefix, + name, true); + + if (ptr == NULL && tryload == XTF_LOAD_MUST_SUCCEED) + xt_params->exit_err(PARAMETER_PROBLEM, + "Couldn't load target `%s':%s\n", + name, strerror(errno)); + } +#else + if (ptr && !ptr->loaded) { + if (tryload != XTF_DONT_LOAD) + ptr->loaded = 1; + else + ptr = NULL; + } + if (ptr == NULL && tryload == XTF_LOAD_MUST_SUCCEED) { + xt_params->exit_err(PARAMETER_PROBLEM, + "Couldn't find target `%s'\n", name); + } +#endif + + if (ptr) + ptr->used = 1; + + return ptr; +} + +static int compatible_revision(const char *name, uint8_t revision, int opt) +{ + struct xt_get_revision rev; + socklen_t s = sizeof(rev); + int max_rev, sockfd; + + sockfd = socket(afinfo->family, SOCK_RAW, IPPROTO_RAW); + if (sockfd < 0) { + if (errno == EPERM) { + /* revision 0 is always supported. */ + if (revision != 0) + fprintf(stderr, "%s: Could not determine whether " + "revision %u is supported, " + "assuming it is.\n", + name, revision); + return 1; + } + fprintf(stderr, "Could not open socket to kernel: %s\n", + strerror(errno)); + exit(1); + } + + if (fcntl(sockfd, F_SETFD, FD_CLOEXEC) == -1) { + fprintf(stderr, "Could not set close on exec: %s\n", + strerror(errno)); + exit(1); + } + + xtables_load_ko(xtables_modprobe_program, true); + + strcpy(rev.name, name); + rev.revision = revision; + + max_rev = getsockopt(sockfd, afinfo->ipproto, opt, &rev, &s); + if (max_rev < 0) { + /* Definitely don't support this? */ + if (errno == ENOENT || errno == EPROTONOSUPPORT) { + close(sockfd); + return 0; + } else if (errno == ENOPROTOOPT) { + close(sockfd); + /* Assume only revision 0 support (old kernel) */ + return (revision == 0); + } else { + fprintf(stderr, "getsockopt failed strangely: %s\n", + strerror(errno)); + exit(1); + } + } + close(sockfd); + return 1; +} + + +static int compatible_match_revision(const char *name, uint8_t revision) +{ + return compatible_revision(name, revision, afinfo->so_rev_match); +} + +static int compatible_target_revision(const char *name, uint8_t revision) +{ + return compatible_revision(name, revision, afinfo->so_rev_target); +} + +static void xtables_check_options(const char *name, const struct option *opt) +{ + for (; opt->name != NULL; ++opt) + if (opt->val < 0 || opt->val >= XT_OPTION_OFFSET_SCALE) { + fprintf(stderr, "%s: Extension %s uses invalid " + "option value %d\n",xt_params->program_name, + name, opt->val); + exit(1); + } +} + +void xtables_register_match(struct xtables_match *me) +{ + if (me->version == NULL) { + fprintf(stderr, "%s: match %s<%u> is missing a version\n", + xt_params->program_name, me->name, me->revision); + exit(1); + } + if (strcmp(me->version, XTABLES_VERSION) != 0) { + fprintf(stderr, "%s: match \"%s\" has version \"%s\", " + "but \"%s\" is required.\n", + xt_params->program_name, me->name, + me->version, XTABLES_VERSION); + exit(1); + } + + if (strlen(me->name) >= XT_EXTENSION_MAXNAMELEN) { + fprintf(stderr, "%s: match `%s' has invalid name\n", + xt_params->program_name, me->name); + exit(1); + } + + if (me->family >= NPROTO) { + fprintf(stderr, + "%s: BUG: match %s has invalid protocol family\n", + xt_params->program_name, me->name); + exit(1); + } + + if (me->x6_options != NULL) + xtables_option_metavalidate(me->name, me->x6_options); + if (me->extra_opts != NULL) + xtables_check_options(me->name, me->extra_opts); + + /* ignore not interested match */ + if (me->family != afinfo->family && me->family != AF_UNSPEC) + return; + + /* place on linked list of matches pending full registration */ + me->next = xtables_pending_matches; + xtables_pending_matches = me; +} + +static void xtables_fully_register_pending_match(struct xtables_match *me) +{ + struct xtables_match **i, *old; + + old = xtables_find_match(me->name, XTF_DURING_LOAD, NULL); + if (old) { + if (old->revision == me->revision && + old->family == me->family) { + fprintf(stderr, + "%s: match `%s' already registered.\n", + xt_params->program_name, me->name); + exit(1); + } + + /* Now we have two (or more) options, check compatibility. */ + if (compatible_match_revision(old->name, old->revision) + && old->revision > me->revision) + return; + + /* See if new match can be used. */ + if (!compatible_match_revision(me->name, me->revision)) + return; + + /* Prefer !AF_UNSPEC over AF_UNSPEC for same revision. */ + if (old->revision == me->revision && me->family == AF_UNSPEC) + return; + + /* Delete old one. */ + for (i = &xtables_matches; *i!=old; i = &(*i)->next); + *i = old->next; + } + + if (me->size != XT_ALIGN(me->size)) { + fprintf(stderr, "%s: match `%s' has invalid size %u.\n", + xt_params->program_name, me->name, + (unsigned int)me->size); + exit(1); + } + + /* Append to list. */ + for (i = &xtables_matches; *i; i = &(*i)->next); + me->next = NULL; + *i = me; + + me->m = NULL; + me->mflags = 0; +} + +void xtables_register_matches(struct xtables_match *match, unsigned int n) +{ + do { + xtables_register_match(&match[--n]); + } while (n > 0); +} + +void xtables_register_target(struct xtables_target *me) +{ + if (me->version == NULL) { + fprintf(stderr, "%s: target %s<%u> is missing a version\n", + xt_params->program_name, me->name, me->revision); + exit(1); + } + if (strcmp(me->version, XTABLES_VERSION) != 0) { + fprintf(stderr, "%s: target \"%s\" has version \"%s\", " + "but \"%s\" is required.\n", + xt_params->program_name, me->name, + me->version, XTABLES_VERSION); + exit(1); + } + + if (strlen(me->name) >= XT_EXTENSION_MAXNAMELEN) { + fprintf(stderr, "%s: target `%s' has invalid name\n", + xt_params->program_name, me->name); + exit(1); + } + + if (me->family >= NPROTO) { + fprintf(stderr, + "%s: BUG: target %s has invalid protocol family\n", + xt_params->program_name, me->name); + exit(1); + } + + if (me->x6_options != NULL) + xtables_option_metavalidate(me->name, me->x6_options); + if (me->extra_opts != NULL) + xtables_check_options(me->name, me->extra_opts); + + /* ignore not interested target */ + if (me->family != afinfo->family && me->family != AF_UNSPEC) + return; + + /* place on linked list of targets pending full registration */ + me->next = xtables_pending_targets; + xtables_pending_targets = me; +} + +static void xtables_fully_register_pending_target(struct xtables_target *me) +{ + struct xtables_target *old; + + old = xtables_find_target(me->name, XTF_DURING_LOAD); + if (old) { + struct xtables_target **i; + + if (old->revision == me->revision && + old->family == me->family) { + fprintf(stderr, + "%s: target `%s' already registered.\n", + xt_params->program_name, me->name); + exit(1); + } + + /* Now we have two (or more) options, check compatibility. */ + if (compatible_target_revision(old->name, old->revision) + && old->revision > me->revision) + return; + + /* See if new target can be used. */ + if (!compatible_target_revision(me->name, me->revision)) + return; + + /* Prefer !AF_UNSPEC over AF_UNSPEC for same revision. */ + if (old->revision == me->revision && me->family == AF_UNSPEC) + return; + + /* Delete old one. */ + for (i = &xtables_targets; *i!=old; i = &(*i)->next); + *i = old->next; + } + + if (me->size != XT_ALIGN(me->size)) { + fprintf(stderr, "%s: target `%s' has invalid size %u.\n", + xt_params->program_name, me->name, + (unsigned int)me->size); + exit(1); + } + + /* Prepend to list. */ + me->next = xtables_targets; + xtables_targets = me; + me->t = NULL; + me->tflags = 0; +} + +void xtables_register_targets(struct xtables_target *target, unsigned int n) +{ + do { + xtables_register_target(&target[--n]); + } while (n > 0); +} + +/** + * xtables_param_act - act on condition + * @status: a constant from enum xtables_exittype + * + * %XTF_ONLY_ONCE: print error message that option may only be used once. + * @p1: module name (e.g. "mark") + * @p2(...): option in conflict (e.g. "--mark") + * @p3(...): condition to match on (see extensions/ for examples) + * + * %XTF_NO_INVERT: option does not support inversion + * @p1: module name + * @p2: option in conflict + * @p3: condition to match on + * + * %XTF_BAD_VALUE: bad value for option + * @p1: module name + * @p2: option with which the problem occured (e.g. "--mark") + * @p3: string the user passed in (e.g. "99999999999999") + * + * %XTF_ONE_ACTION: two mutually exclusive actions have been specified + * @p1: module name + * + * Displays an error message and exits the program. + */ +void xtables_param_act(unsigned int status, const char *p1, ...) +{ + const char *p2, *p3; + va_list args; + bool b; + + va_start(args, p1); + + switch (status) { + case XTF_ONLY_ONCE: + p2 = va_arg(args, const char *); + b = va_arg(args, unsigned int); + if (!b) { + va_end(args); + return; + } + xt_params->exit_err(PARAMETER_PROBLEM, + "%s: \"%s\" option may only be specified once", + p1, p2); + break; + case XTF_NO_INVERT: + p2 = va_arg(args, const char *); + b = va_arg(args, unsigned int); + if (!b) { + va_end(args); + return; + } + xt_params->exit_err(PARAMETER_PROBLEM, + "%s: \"%s\" option cannot be inverted", p1, p2); + break; + case XTF_BAD_VALUE: + p2 = va_arg(args, const char *); + p3 = va_arg(args, const char *); + xt_params->exit_err(PARAMETER_PROBLEM, + "%s: Bad value for \"%s\" option: \"%s\"", + p1, p2, p3); + break; + case XTF_ONE_ACTION: + b = va_arg(args, unsigned int); + if (!b) { + va_end(args); + return; + } + xt_params->exit_err(PARAMETER_PROBLEM, + "%s: At most one action is possible", p1); + break; + default: + xt_params->exit_err(status, p1, args); + break; + } + + va_end(args); +} + +const char *xtables_ipaddr_to_numeric(const struct in_addr *addrp) +{ + static char buf[20]; + const unsigned char *bytep = (const void *)&addrp->s_addr; + + sprintf(buf, "%u.%u.%u.%u", bytep[0], bytep[1], bytep[2], bytep[3]); + return buf; +} + +static const char *ipaddr_to_host(const struct in_addr *addr) +{ + struct hostent *host; + + host = gethostbyaddr(addr, sizeof(struct in_addr), AF_INET); + if (host == NULL) + return NULL; + + return host->h_name; +} + +static const char *ipaddr_to_network(const struct in_addr *addr) +{ + struct netent *net; + + if ((net = getnetbyaddr(ntohl(addr->s_addr), AF_INET)) != NULL) + return net->n_name; + + return NULL; +} + +const char *xtables_ipaddr_to_anyname(const struct in_addr *addr) +{ + const char *name; + + if ((name = ipaddr_to_host(addr)) != NULL || + (name = ipaddr_to_network(addr)) != NULL) + return name; + + return xtables_ipaddr_to_numeric(addr); +} + +const char *xtables_ipmask_to_numeric(const struct in_addr *mask) +{ + static char buf[20]; + uint32_t maskaddr, bits; + int i; + + maskaddr = ntohl(mask->s_addr); + + if (maskaddr == 0xFFFFFFFFL) + /* we don't want to see "/32" */ + return ""; + + i = 32; + bits = 0xFFFFFFFEL; + while (--i >= 0 && maskaddr != bits) + bits <<= 1; + if (i >= 0) + sprintf(buf, "/%d", i); + else + /* mask was not a decent combination of 1's and 0's */ + sprintf(buf, "/%s", xtables_ipaddr_to_numeric(mask)); + + return buf; +} + +static struct in_addr *__numeric_to_ipaddr(const char *dotted, bool is_mask) +{ + static struct in_addr addr; + unsigned char *addrp; + unsigned int onebyte; + char buf[20], *p, *q; + int i; + + /* copy dotted string, because we need to modify it */ + strncpy(buf, dotted, sizeof(buf) - 1); + buf[sizeof(buf) - 1] = '\0'; + addrp = (void *)&addr.s_addr; + + p = buf; + for (i = 0; i < 3; ++i) { + if ((q = strchr(p, '.')) == NULL) { + if (is_mask) + return NULL; + + /* autocomplete, this is a network address */ + if (!xtables_strtoui(p, NULL, &onebyte, 0, UINT8_MAX)) + return NULL; + + addrp[i] = onebyte; + while (i < 3) + addrp[++i] = 0; + + return &addr; + } + + *q = '\0'; + if (!xtables_strtoui(p, NULL, &onebyte, 0, UINT8_MAX)) + return NULL; + + addrp[i] = onebyte; + p = q + 1; + } + + /* we have checked 3 bytes, now we check the last one */ + if (!xtables_strtoui(p, NULL, &onebyte, 0, UINT8_MAX)) + return NULL; + + addrp[3] = onebyte; + return &addr; +} + +struct in_addr *xtables_numeric_to_ipaddr(const char *dotted) +{ + return __numeric_to_ipaddr(dotted, false); +} + +struct in_addr *xtables_numeric_to_ipmask(const char *dotted) +{ + return __numeric_to_ipaddr(dotted, true); +} + +static struct in_addr *network_to_ipaddr(const char *name) +{ + static struct in_addr addr; + struct netent *net; + + if ((net = getnetbyname(name)) != NULL) { + if (net->n_addrtype != AF_INET) + return NULL; + addr.s_addr = htonl(net->n_net); + return &addr; + } + + return NULL; +} + +static struct in_addr *host_to_ipaddr(const char *name, unsigned int *naddr) +{ + struct hostent *host; + struct in_addr *addr; + unsigned int i; + + *naddr = 0; + if ((host = gethostbyname(name)) != NULL) { + if (host->h_addrtype != AF_INET || + host->h_length != sizeof(struct in_addr)) + return NULL; + + while (host->h_addr_list[*naddr] != NULL) + ++*naddr; + addr = xtables_calloc(*naddr, sizeof(struct in_addr)); + for (i = 0; i < *naddr; i++) + memcpy(&addr[i], host->h_addr_list[i], + sizeof(struct in_addr)); + return addr; + } + + return NULL; +} + +static struct in_addr * +ipparse_hostnetwork(const char *name, unsigned int *naddrs) +{ + struct in_addr *addrptmp, *addrp; + + if ((addrptmp = xtables_numeric_to_ipaddr(name)) != NULL || + (addrptmp = network_to_ipaddr(name)) != NULL) { + addrp = xtables_malloc(sizeof(struct in_addr)); + memcpy(addrp, addrptmp, sizeof(*addrp)); + *naddrs = 1; + return addrp; + } + if ((addrptmp = host_to_ipaddr(name, naddrs)) != NULL) + return addrptmp; + + xt_params->exit_err(PARAMETER_PROBLEM, "host/network `%s' not found", name); +} + +static struct in_addr *parse_ipmask(const char *mask) +{ + static struct in_addr maskaddr; + struct in_addr *addrp; + unsigned int bits; + + if (mask == NULL) { + /* no mask at all defaults to 32 bits */ + maskaddr.s_addr = 0xFFFFFFFF; + return &maskaddr; + } + if ((addrp = xtables_numeric_to_ipmask(mask)) != NULL) + /* dotted_to_addr already returns a network byte order addr */ + return addrp; + if (!xtables_strtoui(mask, NULL, &bits, 0, 32)) + xt_params->exit_err(PARAMETER_PROBLEM, + "invalid mask `%s' specified", mask); + if (bits != 0) { + maskaddr.s_addr = htonl(0xFFFFFFFF << (32 - bits)); + return &maskaddr; + } + + maskaddr.s_addr = 0U; + return &maskaddr; +} + +void xtables_ipparse_multiple(const char *name, struct in_addr **addrpp, + struct in_addr **maskpp, unsigned int *naddrs) +{ + struct in_addr *addrp; + char buf[256], *p, *next; + unsigned int len, i, j, n, count = 1; + const char *loop = name; + + while ((loop = strchr(loop, ',')) != NULL) { + ++count; + ++loop; /* skip ',' */ + } + + *addrpp = xtables_malloc(sizeof(struct in_addr) * count); + *maskpp = xtables_malloc(sizeof(struct in_addr) * count); + + loop = name; + + for (i = 0; i < count; ++i) { + while (isspace(*loop)) + ++loop; + next = strchr(loop, ','); + if (next != NULL) + len = next - loop; + else + len = strlen(loop); + if (len > sizeof(buf) - 1) + xt_params->exit_err(PARAMETER_PROBLEM, + "Hostname too long"); + + strncpy(buf, loop, len); + buf[len] = '\0'; + if ((p = strrchr(buf, '/')) != NULL) { + *p = '\0'; + addrp = parse_ipmask(p + 1); + } else { + addrp = parse_ipmask(NULL); + } + memcpy(*maskpp + i, addrp, sizeof(*addrp)); + + /* if a null mask is given, the name is ignored, like in "any/0" */ + if ((*maskpp + i)->s_addr == 0) + /* + * A bit pointless to process multiple addresses + * in this case... + */ + strcpy(buf, "0.0.0.0"); + + addrp = ipparse_hostnetwork(buf, &n); + if (n > 1) { + count += n - 1; + *addrpp = xtables_realloc(*addrpp, + sizeof(struct in_addr) * count); + *maskpp = xtables_realloc(*maskpp, + sizeof(struct in_addr) * count); + for (j = 0; j < n; ++j) + /* for each new addr */ + memcpy(*addrpp + i + j, addrp + j, + sizeof(*addrp)); + for (j = 1; j < n; ++j) + /* for each new mask */ + memcpy(*maskpp + i + j, *maskpp + i, + sizeof(*addrp)); + i += n - 1; + } else { + memcpy(*addrpp + i, addrp, sizeof(*addrp)); + } + /* free what ipparse_hostnetwork had allocated: */ + free(addrp); + if (next == NULL) + break; + loop = next + 1; + } + *naddrs = count; + for (i = 0; i < count; ++i) + (*addrpp+i)->s_addr &= (*maskpp+i)->s_addr; +} + + +/** + * xtables_ipparse_any - transform arbitrary name to in_addr + * + * Possible inputs (pseudo regex): + * m{^($hostname|$networkname|$ipaddr)(/$mask)?} + * "1.2.3.4/5", "1.2.3.4", "hostname", "networkname" + */ +void xtables_ipparse_any(const char *name, struct in_addr **addrpp, + struct in_addr *maskp, unsigned int *naddrs) +{ + unsigned int i, j, k, n; + struct in_addr *addrp; + char buf[256], *p; + + strncpy(buf, name, sizeof(buf) - 1); + buf[sizeof(buf) - 1] = '\0'; + if ((p = strrchr(buf, '/')) != NULL) { + *p = '\0'; + addrp = parse_ipmask(p + 1); + } else { + addrp = parse_ipmask(NULL); + } + memcpy(maskp, addrp, sizeof(*maskp)); + + /* if a null mask is given, the name is ignored, like in "any/0" */ + if (maskp->s_addr == 0U) + strcpy(buf, "0.0.0.0"); + + addrp = *addrpp = ipparse_hostnetwork(buf, naddrs); + n = *naddrs; + for (i = 0, j = 0; i < n; ++i) { + addrp[j++].s_addr &= maskp->s_addr; + for (k = 0; k < j - 1; ++k) + if (addrp[k].s_addr == addrp[j-1].s_addr) { + /* + * Nuke the dup by copying an address from the + * tail here, and check the current position + * again (--j). + */ + memcpy(&addrp[--j], &addrp[--*naddrs], + sizeof(struct in_addr)); + break; + } + } +} + +const char *xtables_ip6addr_to_numeric(const struct in6_addr *addrp) +{ + /* 0000:0000:0000:0000:0000:0000:000.000.000.000 + * 0000:0000:0000:0000:0000:0000:0000:0000 */ + static char buf[50+1]; + return inet_ntop(AF_INET6, addrp, buf, sizeof(buf)); +} + +static const char *ip6addr_to_host(const struct in6_addr *addr) +{ + static char hostname[NI_MAXHOST]; + struct sockaddr_in6 saddr; + int err; + + memset(&saddr, 0, sizeof(struct sockaddr_in6)); + memcpy(&saddr.sin6_addr, addr, sizeof(*addr)); + saddr.sin6_family = AF_INET6; + + err = getnameinfo((const void *)&saddr, sizeof(struct sockaddr_in6), + hostname, sizeof(hostname) - 1, NULL, 0, 0); + if (err != 0) { +#ifdef DEBUG + fprintf(stderr,"IP2Name: %s\n",gai_strerror(err)); +#endif + return NULL; + } + +#ifdef DEBUG + fprintf (stderr, "\naddr2host: %s\n", hostname); +#endif + return hostname; +} + +const char *xtables_ip6addr_to_anyname(const struct in6_addr *addr) +{ + const char *name; + + if ((name = ip6addr_to_host(addr)) != NULL) + return name; + + return xtables_ip6addr_to_numeric(addr); +} + +static int ip6addr_prefix_length(const struct in6_addr *k) +{ + unsigned int bits = 0; + uint32_t a, b, c, d; + + a = ntohl(k->s6_addr32[0]); + b = ntohl(k->s6_addr32[1]); + c = ntohl(k->s6_addr32[2]); + d = ntohl(k->s6_addr32[3]); + while (a & 0x80000000U) { + ++bits; + a <<= 1; + a |= (b >> 31) & 1; + b <<= 1; + b |= (c >> 31) & 1; + c <<= 1; + c |= (d >> 31) & 1; + d <<= 1; + } + if (a != 0 || b != 0 || c != 0 || d != 0) + return -1; + return bits; +} + +const char *xtables_ip6mask_to_numeric(const struct in6_addr *addrp) +{ + static char buf[50+2]; + int l = ip6addr_prefix_length(addrp); + + if (l == -1) { + strcpy(buf, "/"); + strcat(buf, xtables_ip6addr_to_numeric(addrp)); + return buf; + } + sprintf(buf, "/%d", l); + return buf; +} + +struct in6_addr *xtables_numeric_to_ip6addr(const char *num) +{ + static struct in6_addr ap; + int err; + + if ((err = inet_pton(AF_INET6, num, &ap)) == 1) + return ≈ +#ifdef DEBUG + fprintf(stderr, "\nnumeric2addr: %d\n", err); +#endif + return NULL; +} + +static struct in6_addr * +host_to_ip6addr(const char *name, unsigned int *naddr) +{ + struct in6_addr *addr; + struct addrinfo hints; + struct addrinfo *res, *p; + int err; + unsigned int i; + + memset(&hints, 0, sizeof(hints)); + hints.ai_flags = AI_CANONNAME; + hints.ai_family = AF_INET6; + hints.ai_socktype = SOCK_RAW; + + *naddr = 0; + if ((err = getaddrinfo(name, NULL, &hints, &res)) != 0) { +#ifdef DEBUG + fprintf(stderr,"Name2IP: %s\n",gai_strerror(err)); +#endif + return NULL; + } else { + /* Find length of address chain */ + for (p = res; p != NULL; p = p->ai_next) + ++*naddr; +#ifdef DEBUG + fprintf(stderr, "resolved: len=%d %s ", res->ai_addrlen, + xtables_ip6addr_to_numeric(&((struct sockaddr_in6 *)res->ai_addr)->sin6_addr)); +#endif + /* Copy each element of the address chain */ + addr = xtables_calloc(*naddr, sizeof(struct in6_addr)); + for (i = 0, p = res; p != NULL; p = p->ai_next) + memcpy(&addr[i++], + &((const struct sockaddr_in6 *)p->ai_addr)->sin6_addr, + sizeof(struct in6_addr)); + freeaddrinfo(res); + return addr; + } + + return NULL; +} + +static struct in6_addr *network_to_ip6addr(const char *name) +{ + /* abort();*/ + /* TODO: not implemented yet, but the exception breaks the + * name resolvation */ + return NULL; +} + +static struct in6_addr * +ip6parse_hostnetwork(const char *name, unsigned int *naddrs) +{ + struct in6_addr *addrp, *addrptmp; + + if ((addrptmp = xtables_numeric_to_ip6addr(name)) != NULL || + (addrptmp = network_to_ip6addr(name)) != NULL) { + addrp = xtables_malloc(sizeof(struct in6_addr)); + memcpy(addrp, addrptmp, sizeof(*addrp)); + *naddrs = 1; + return addrp; + } + if ((addrp = host_to_ip6addr(name, naddrs)) != NULL) + return addrp; + + xt_params->exit_err(PARAMETER_PROBLEM, "host/network `%s' not found", name); +} + +static struct in6_addr *parse_ip6mask(char *mask) +{ + static struct in6_addr maskaddr; + struct in6_addr *addrp; + unsigned int bits; + + if (mask == NULL) { + /* no mask at all defaults to 128 bits */ + memset(&maskaddr, 0xff, sizeof maskaddr); + return &maskaddr; + } + if ((addrp = xtables_numeric_to_ip6addr(mask)) != NULL) + return addrp; + if (!xtables_strtoui(mask, NULL, &bits, 0, 128)) + xt_params->exit_err(PARAMETER_PROBLEM, + "invalid mask `%s' specified", mask); + if (bits != 0) { + char *p = (void *)&maskaddr; + memset(p, 0xff, bits / 8); + memset(p + (bits / 8) + 1, 0, (128 - bits) / 8); + p[bits/8] = 0xff << (8 - (bits & 7)); + return &maskaddr; + } + + memset(&maskaddr, 0, sizeof(maskaddr)); + return &maskaddr; +} + +void +xtables_ip6parse_multiple(const char *name, struct in6_addr **addrpp, + struct in6_addr **maskpp, unsigned int *naddrs) +{ + static const struct in6_addr zero_addr; + struct in6_addr *addrp; + char buf[256], *p, *next; + unsigned int len, i, j, n, count = 1; + const char *loop = name; + + while ((loop = strchr(loop, ',')) != NULL) { + ++count; + ++loop; /* skip ',' */ + } + + *addrpp = xtables_malloc(sizeof(struct in6_addr) * count); + *maskpp = xtables_malloc(sizeof(struct in6_addr) * count); + + loop = name; + + for (i = 0; i < count /*NB: count can grow*/; ++i) { + while (isspace(*loop)) + ++loop; + next = strchr(loop, ','); + if (next != NULL) + len = next - loop; + else + len = strlen(loop); + if (len > sizeof(buf) - 1) + xt_params->exit_err(PARAMETER_PROBLEM, + "Hostname too long"); + + strncpy(buf, loop, len); + buf[len] = '\0'; + if ((p = strrchr(buf, '/')) != NULL) { + *p = '\0'; + addrp = parse_ip6mask(p + 1); + } else { + addrp = parse_ip6mask(NULL); + } + memcpy(*maskpp + i, addrp, sizeof(*addrp)); + + /* if a null mask is given, the name is ignored, like in "any/0" */ + if (memcmp(*maskpp + i, &zero_addr, sizeof(zero_addr)) == 0) + strcpy(buf, "::"); + + addrp = ip6parse_hostnetwork(buf, &n); + if (n > 1) { + count += n - 1; + *addrpp = xtables_realloc(*addrpp, + sizeof(struct in6_addr) * count); + *maskpp = xtables_realloc(*maskpp, + sizeof(struct in6_addr) * count); + for (j = 0; j < n; ++j) + /* for each new addr */ + memcpy(*addrpp + i + j, addrp + j, + sizeof(*addrp)); + for (j = 1; j < n; ++j) + /* for each new mask */ + memcpy(*maskpp + i + j, *maskpp + i, + sizeof(*addrp)); + i += n - 1; + } else { + memcpy(*addrpp + i, addrp, sizeof(*addrp)); + } + /* free what ip6parse_hostnetwork had allocated: */ + free(addrp); + if (next == NULL) + break; + loop = next + 1; + } + *naddrs = count; + for (i = 0; i < count; ++i) + for (j = 0; j < 4; ++j) + (*addrpp+i)->s6_addr32[j] &= (*maskpp+i)->s6_addr32[j]; +} + +void xtables_ip6parse_any(const char *name, struct in6_addr **addrpp, + struct in6_addr *maskp, unsigned int *naddrs) +{ + static const struct in6_addr zero_addr; + struct in6_addr *addrp; + unsigned int i, j, k, n; + char buf[256], *p; + + strncpy(buf, name, sizeof(buf) - 1); + buf[sizeof(buf)-1] = '\0'; + if ((p = strrchr(buf, '/')) != NULL) { + *p = '\0'; + addrp = parse_ip6mask(p + 1); + } else { + addrp = parse_ip6mask(NULL); + } + memcpy(maskp, addrp, sizeof(*maskp)); + + /* if a null mask is given, the name is ignored, like in "any/0" */ + if (memcmp(maskp, &zero_addr, sizeof(zero_addr)) == 0) + strcpy(buf, "::"); + + addrp = *addrpp = ip6parse_hostnetwork(buf, naddrs); + n = *naddrs; + for (i = 0, j = 0; i < n; ++i) { + for (k = 0; k < 4; ++k) + addrp[j].s6_addr32[k] &= maskp->s6_addr32[k]; + ++j; + for (k = 0; k < j - 1; ++k) + if (IN6_ARE_ADDR_EQUAL(&addrp[k], &addrp[j - 1])) { + /* + * Nuke the dup by copying an address from the + * tail here, and check the current position + * again (--j). + */ + memcpy(&addrp[--j], &addrp[--*naddrs], + sizeof(struct in_addr)); + break; + } + } +} + +void xtables_save_string(const char *value) +{ + static const char no_quote_chars[] = "_-0123456789" + "abcdefghijklmnopqrstuvwxyz" + "ABCDEFGHIJKLMNOPQRSTUVWXYZ"; + static const char escape_chars[] = "\"\\'"; + size_t length; + const char *p; + + length = strspn(value, no_quote_chars); + if (length > 0 && value[length] == 0) { + /* no quoting required */ + putchar(' '); + fputs(value, stdout); + } else { + /* there is at least one dangerous character in the + value, which we have to quote. Write double quotes + around the value and escape special characters with + a backslash */ + printf(" \""); + + for (p = strpbrk(value, escape_chars); p != NULL; + p = strpbrk(value, escape_chars)) { + if (p > value) + fwrite(value, 1, p - value, stdout); + putchar('\\'); + putchar(*p); + value = p + 1; + } + + /* print the rest and finish the double quoted + string */ + fputs(value, stdout); + putchar('\"'); + } +} + +const struct xtables_pprot xtables_chain_protos[] = { + {"tcp", IPPROTO_TCP}, + {"sctp", IPPROTO_SCTP}, + {"udp", IPPROTO_UDP}, + {"udplite", IPPROTO_UDPLITE}, + {"icmp", IPPROTO_ICMP}, + {"icmpv6", IPPROTO_ICMPV6}, + {"ipv6-icmp", IPPROTO_ICMPV6}, + {"esp", IPPROTO_ESP}, + {"ah", IPPROTO_AH}, + {"ipv6-mh", IPPROTO_MH}, + {"mh", IPPROTO_MH}, + {"all", 0}, + {NULL}, +}; + +uint16_t +xtables_parse_protocol(const char *s) +{ + const struct protoent *pent; + unsigned int proto, i; + + if (xtables_strtoui(s, NULL, &proto, 0, UINT8_MAX)) + return proto; + + /* first deal with the special case of 'all' to prevent + * people from being able to redefine 'all' in nsswitch + * and/or provoke expensive [not working] ldap/nis/... + * lookups */ + if (strcmp(s, "all") == 0) + return 0; + + pent = getprotobyname(s); + if (pent != NULL) + return pent->p_proto; + + for (i = 0; i < ARRAY_SIZE(xtables_chain_protos); ++i) { + if (xtables_chain_protos[i].name == NULL) + continue; + if (strcmp(s, xtables_chain_protos[i].name) == 0) + return xtables_chain_protos[i].num; + } + xt_params->exit_err(PARAMETER_PROBLEM, + "unknown protocol \"%s\" specified", s); + return -1; +} + +int kernel_version; + +void get_kernel_version(void) +{ + static struct utsname uts; + int x = 0, y = 0, z = 0; + + if (uname(&uts) == -1) { + fprintf(stderr, "Unable to retrieve kernel version.\n"); + xtables_free_opts(1); + exit(1); + } + + sscanf(uts.release, "%d.%d.%d", &x, &y, &z); + kernel_version = LINUX_VERSION(x, y, z); +} diff --git a/libxtables/xtoptions.c b/libxtables/xtoptions.c new file mode 100644 index 00000000..5f617a42 --- /dev/null +++ b/libxtables/xtoptions.c @@ -0,0 +1,1171 @@ +/* + * Argument parser + * Copyright © Jan Engelhardt, 2011 + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License as + * published by the Free Software Foundation; either version 2 of + * the License, or (at your option) any later version. + */ +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include "xtables.h" +#include "xshared.h" +#ifndef IPTOS_NORMALSVC +# define IPTOS_NORMALSVC 0 +#endif + +#define XTOPT_MKPTR(cb) \ + ((void *)((char *)(cb)->data + (cb)->entry->ptroff)) + +/** + * Simple key-value pairs for syslog levels + */ +struct syslog_level { + char name[8]; + uint8_t level; +}; + +struct tos_value_mask { + uint8_t value, mask; +}; + +static const size_t xtopt_psize[] = { + /* + * All types not listed here, and thus essentially being initialized to + * zero have zero on purpose. + */ + [XTTYPE_UINT8] = sizeof(uint8_t), + [XTTYPE_UINT16] = sizeof(uint16_t), + [XTTYPE_UINT32] = sizeof(uint32_t), + [XTTYPE_UINT64] = sizeof(uint64_t), + [XTTYPE_UINT8RC] = sizeof(uint8_t[2]), + [XTTYPE_UINT16RC] = sizeof(uint16_t[2]), + [XTTYPE_UINT32RC] = sizeof(uint32_t[2]), + [XTTYPE_UINT64RC] = sizeof(uint64_t[2]), + [XTTYPE_DOUBLE] = sizeof(double), + [XTTYPE_STRING] = -1, + [XTTYPE_SYSLOGLEVEL] = sizeof(uint8_t), + [XTTYPE_HOST] = sizeof(union nf_inet_addr), + [XTTYPE_HOSTMASK] = sizeof(union nf_inet_addr), + [XTTYPE_PROTOCOL] = sizeof(uint8_t), + [XTTYPE_PORT] = sizeof(uint16_t), + [XTTYPE_PORTRC] = sizeof(uint16_t[2]), + [XTTYPE_PLENMASK] = sizeof(union nf_inet_addr), + [XTTYPE_ETHERMAC] = sizeof(uint8_t[6]), +}; + +/** + * Creates getopt options from the x6-style option map, and assigns each a + * getopt id. + */ +struct option * +xtables_options_xfrm(struct option *orig_opts, struct option *oldopts, + const struct xt_option_entry *entry, unsigned int *offset) +{ + unsigned int num_orig, num_old = 0, num_new, i; + struct option *merge, *mp; + + if (entry == NULL) + return oldopts; + for (num_orig = 0; orig_opts[num_orig].name != NULL; ++num_orig) + ; + if (oldopts != NULL) + for (num_old = 0; oldopts[num_old].name != NULL; ++num_old) + ; + for (num_new = 0; entry[num_new].name != NULL; ++num_new) + ; + + /* + * Since @oldopts also has @orig_opts already (and does so at the + * start), skip these entries. + */ + oldopts += num_orig; + num_old -= num_orig; + + merge = malloc(sizeof(*mp) * (num_orig + num_old + num_new + 1)); + if (merge == NULL) + return NULL; + + /* Let the base options -[ADI...] have precedence over everything */ + memcpy(merge, orig_opts, sizeof(*mp) * num_orig); + mp = merge + num_orig; + + /* Second, the new options */ + xt_params->option_offset += XT_OPTION_OFFSET_SCALE; + *offset = xt_params->option_offset; + + for (i = 0; i < num_new; ++i, ++mp, ++entry) { + mp->name = entry->name; + mp->has_arg = entry->type != XTTYPE_NONE; + mp->flag = NULL; + mp->val = entry->id + *offset; + } + + /* Third, the old options */ + memcpy(mp, oldopts, sizeof(*mp) * num_old); + mp += num_old; + xtables_free_opts(0); + + /* Clear trailing entry */ + memset(mp, 0, sizeof(*mp)); + return merge; +} + +/** + * Give the upper limit for a certain type. + */ +static uintmax_t xtopt_max_by_type(enum xt_option_type type) +{ + switch (type) { + case XTTYPE_UINT8: + case XTTYPE_UINT8RC: + return UINT8_MAX; + case XTTYPE_UINT16: + case XTTYPE_UINT16RC: + return UINT16_MAX; + case XTTYPE_UINT32: + case XTTYPE_UINT32RC: + return UINT32_MAX; + case XTTYPE_UINT64: + case XTTYPE_UINT64RC: + return UINT64_MAX; + default: + return 0; + } +} + +/** + * Return the size of a single entity based upon a type - predominantly an + * XTTYPE_UINT*RC type. + */ +static size_t xtopt_esize_by_type(enum xt_option_type type) +{ + switch (type) { + case XTTYPE_UINT8RC: + return xtopt_psize[XTTYPE_UINT8]; + case XTTYPE_UINT16RC: + return xtopt_psize[XTTYPE_UINT16]; + case XTTYPE_UINT32RC: + return xtopt_psize[XTTYPE_UINT32]; + case XTTYPE_UINT64RC: + return xtopt_psize[XTTYPE_UINT64]; + default: + return xtopt_psize[type]; + } +} + +/** + * Require a simple integer. + */ +static void xtopt_parse_int(struct xt_option_call *cb) +{ + const struct xt_option_entry *entry = cb->entry; + uintmax_t lmin = 0, lmax = xtopt_max_by_type(entry->type); + uintmax_t value; + + if (cb->entry->min != 0) + lmin = cb->entry->min; + if (cb->entry->max != 0) + lmax = cb->entry->max; + + if (!xtables_strtoul(cb->arg, NULL, &value, lmin, lmax)) + xt_params->exit_err(PARAMETER_PROBLEM, + "%s: bad value for option \"--%s\", " + "or out of range (%ju-%ju).\n", + cb->ext_name, entry->name, lmin, lmax); + + if (entry->type == XTTYPE_UINT8) { + cb->val.u8 = value; + if (entry->flags & XTOPT_PUT) + *(uint8_t *)XTOPT_MKPTR(cb) = cb->val.u8; + } else if (entry->type == XTTYPE_UINT16) { + cb->val.u16 = value; + if (entry->flags & XTOPT_PUT) + *(uint16_t *)XTOPT_MKPTR(cb) = cb->val.u16; + } else if (entry->type == XTTYPE_UINT32) { + cb->val.u32 = value; + if (entry->flags & XTOPT_PUT) + *(uint32_t *)XTOPT_MKPTR(cb) = cb->val.u32; + } else if (entry->type == XTTYPE_UINT64) { + cb->val.u64 = value; + if (entry->flags & XTOPT_PUT) + *(uint64_t *)XTOPT_MKPTR(cb) = cb->val.u64; + } +} + +/** + * Require a simple floating point number. + */ +static void xtopt_parse_float(struct xt_option_call *cb) +{ + const struct xt_option_entry *entry = cb->entry; + double value; + char *end; + + value = strtod(cb->arg, &end); + if (end == cb->arg || *end != '\0' || + (entry->min != entry->max && + (value < entry->min || value > entry->max))) + xt_params->exit_err(PARAMETER_PROBLEM, + "%s: bad value for option \"--%s\", " + "or out of range (%u-%u).\n", + cb->ext_name, entry->name, entry->min, entry->max); + + cb->val.dbl = value; + if (entry->flags & XTOPT_PUT) + *(double *)XTOPT_MKPTR(cb) = cb->val.dbl; +} + +/** + * Copy the parsed value to the appropriate entry in cb->val. + */ +static void xtopt_mint_value_to_cb(struct xt_option_call *cb, uintmax_t value) +{ + const struct xt_option_entry *entry = cb->entry; + + if (cb->nvals >= ARRAY_SIZE(cb->val.u32_range)) + return; + if (entry->type == XTTYPE_UINT8RC) + cb->val.u8_range[cb->nvals] = value; + else if (entry->type == XTTYPE_UINT16RC) + cb->val.u16_range[cb->nvals] = value; + else if (entry->type == XTTYPE_UINT32RC) + cb->val.u32_range[cb->nvals] = value; + else if (entry->type == XTTYPE_UINT64RC) + cb->val.u64_range[cb->nvals] = value; +} + +/** + * Copy the parsed value to the data area, using appropriate type access. + */ +static void xtopt_mint_value_to_ptr(struct xt_option_call *cb, void **datap, + uintmax_t value) +{ + const struct xt_option_entry *entry = cb->entry; + void *data = *datap; + + if (!(entry->flags & XTOPT_PUT)) + return; + if (entry->type == XTTYPE_UINT8RC) + *(uint8_t *)data = value; + else if (entry->type == XTTYPE_UINT16RC) + *(uint16_t *)data = value; + else if (entry->type == XTTYPE_UINT32RC) + *(uint32_t *)data = value; + else if (entry->type == XTTYPE_UINT64RC) + *(uint64_t *)data = value; + data += xtopt_esize_by_type(entry->type); + *datap = data; +} + +/** + * Multiple integer parse routine. + * + * This function is capable of parsing any number of fields. Only the first + * two values from the string will be put into @cb however (and as such, + * @cb->val.uXX_range is just that large) to cater for the few extensions that + * do not have a range[2] field, but {min, max}, and which cannot use + * XTOPT_POINTER. + */ +static void xtopt_parse_mint(struct xt_option_call *cb) +{ + const struct xt_option_entry *entry = cb->entry; + const char *arg = cb->arg; + size_t esize = xtopt_esize_by_type(entry->type); + const uintmax_t lmax = xtopt_max_by_type(entry->type); + void *put = XTOPT_MKPTR(cb); + unsigned int maxiter; + uintmax_t value; + char *end = ""; + char sep = ':'; + + maxiter = entry->size / esize; + if (maxiter == 0) + maxiter = ARRAY_SIZE(cb->val.u32_range); + if (entry->size % esize != 0) + xt_params->exit_err(OTHER_PROBLEM, "%s: memory block does " + "not have proper size\n", __func__); + + cb->nvals = 0; + for (arg = cb->arg, end = (char *)arg; ; arg = end + 1) { + if (cb->nvals == maxiter) + xt_params->exit_err(PARAMETER_PROBLEM, "%s: Too many " + "components for option \"--%s\" (max: %u)\n", + cb->ext_name, entry->name, maxiter); + if (*arg == '\0' || *arg == sep) { + /* Default range components when field not spec'd. */ + end = (char *)arg; + value = (cb->nvals == 1) ? lmax : 0; + } else { + if (!xtables_strtoul(arg, &end, &value, 0, lmax)) + xt_params->exit_err(PARAMETER_PROBLEM, + "%s: bad value for option \"--%s\" near " + "\"%s\", or out of range (0-%ju).\n", + cb->ext_name, entry->name, arg, lmax); + if (*end != '\0' && *end != sep) + xt_params->exit_err(PARAMETER_PROBLEM, + "%s: Argument to \"--%s\" has " + "unexpected characters near \"%s\".\n", + cb->ext_name, entry->name, end); + } + xtopt_mint_value_to_cb(cb, value); + ++cb->nvals; + xtopt_mint_value_to_ptr(cb, &put, value); + if (*end == '\0') + break; + } +} + +static void xtopt_parse_string(struct xt_option_call *cb) +{ + const struct xt_option_entry *entry = cb->entry; + size_t z = strlen(cb->arg); + char *p; + + if (entry->min != 0 && z < entry->min) + xt_params->exit_err(PARAMETER_PROBLEM, + "Argument must have a minimum length of " + "%u characters\n", entry->min); + if (entry->max != 0 && z > entry->max) + xt_params->exit_err(PARAMETER_PROBLEM, + "Argument must have a maximum length of " + "%u characters\n", entry->max); + if (!(entry->flags & XTOPT_PUT)) + return; + if (z >= entry->size) + z = entry->size - 1; + p = XTOPT_MKPTR(cb); + strncpy(p, cb->arg, z); + p[z] = '\0'; +} + +static const struct tos_symbol_info { + unsigned char value; + const char *name; +} tos_symbol_names[] = { + {IPTOS_LOWDELAY, "Minimize-Delay"}, + {IPTOS_THROUGHPUT, "Maximize-Throughput"}, + {IPTOS_RELIABILITY, "Maximize-Reliability"}, + {IPTOS_MINCOST, "Minimize-Cost"}, + {IPTOS_NORMALSVC, "Normal-Service"}, + {}, +}; + +/* + * tos_parse_numeric - parse a string like "15/255" + * + * @str: input string + * @tvm: (value/mask) tuple + * @max: maximum allowed value (must be pow(2,some_int)-1) + */ +static bool tos_parse_numeric(const char *str, struct xt_option_call *cb, + unsigned int max) +{ + unsigned int value; + char *end; + + xtables_strtoui(str, &end, &value, 0, max); + cb->val.tos_value = value; + cb->val.tos_mask = max; + + if (*end == '/') { + const char *p = end + 1; + + if (!xtables_strtoui(p, &end, &value, 0, max)) + xtables_error(PARAMETER_PROBLEM, "Illegal value: \"%s\"", + str); + cb->val.tos_mask = value; + } + + if (*end != '\0') + xtables_error(PARAMETER_PROBLEM, "Illegal value: \"%s\"", str); + return true; +} + +/** + * @str: input string + * @tvm: (value/mask) tuple + * @def_mask: mask to force when a symbolic name is used + */ +static void xtopt_parse_tosmask(struct xt_option_call *cb) +{ + const struct tos_symbol_info *symbol; + char *tmp; + + if (xtables_strtoui(cb->arg, &tmp, NULL, 0, UINT8_MAX)) { + tos_parse_numeric(cb->arg, cb, UINT8_MAX); + return; + } + /* + * This is our way we deal with different defaults + * for different revisions. + */ + cb->val.tos_mask = cb->entry->max; + for (symbol = tos_symbol_names; symbol->name != NULL; ++symbol) + if (strcasecmp(cb->arg, symbol->name) == 0) { + cb->val.tos_value = symbol->value; + return; + } + + xtables_error(PARAMETER_PROBLEM, "Symbolic name \"%s\" is unknown", + cb->arg); +} + +/** + * Validate the input for being conformant to "mark[/mask]". + */ +static void xtopt_parse_markmask(struct xt_option_call *cb) +{ + unsigned int mark = 0, mask = ~0U; + char *end; + + if (!xtables_strtoui(cb->arg, &end, &mark, 0, UINT32_MAX)) + xt_params->exit_err(PARAMETER_PROBLEM, + "%s: bad mark value for option \"--%s\", " + "or out of range.\n", + cb->ext_name, cb->entry->name); + if (*end == '/' && + !xtables_strtoui(end + 1, &end, &mask, 0, UINT32_MAX)) + xt_params->exit_err(PARAMETER_PROBLEM, + "%s: bad mask value for option \"--%s\", " + "or out of range.\n", + cb->ext_name, cb->entry->name); + if (*end != '\0') + xt_params->exit_err(PARAMETER_PROBLEM, + "%s: trailing garbage after value " + "for option \"--%s\".\n", + cb->ext_name, cb->entry->name); + cb->val.mark = mark; + cb->val.mask = mask; +} + +static int xtopt_sysloglvl_compare(const void *a, const void *b) +{ + const char *name = a; + const struct syslog_level *entry = b; + + return strcmp(name, entry->name); +} + +static void xtopt_parse_sysloglevel(struct xt_option_call *cb) +{ + static const struct syslog_level log_names[] = { /* must be sorted */ + {"alert", LOG_ALERT}, + {"crit", LOG_CRIT}, + {"debug", LOG_DEBUG}, + {"emerg", LOG_EMERG}, + {"error", LOG_ERR}, /* deprecated */ + {"info", LOG_INFO}, + {"notice", LOG_NOTICE}, + {"panic", LOG_EMERG}, /* deprecated */ + {"warning", LOG_WARNING}, + }; + const struct syslog_level *e; + unsigned int num = 0; + + if (!xtables_strtoui(cb->arg, NULL, &num, 0, 7)) { + e = bsearch(cb->arg, log_names, ARRAY_SIZE(log_names), + sizeof(*log_names), xtopt_sysloglvl_compare); + if (e == NULL) + xt_params->exit_err(PARAMETER_PROBLEM, + "log level \"%s\" unknown\n", cb->arg); + num = e->level; + } + cb->val.syslog_level = num; + if (cb->entry->flags & XTOPT_PUT) + *(uint8_t *)XTOPT_MKPTR(cb) = num; +} + +static void *xtables_sa_host(const void *sa, unsigned int afproto) +{ + if (afproto == AF_INET6) + return &((struct sockaddr_in6 *)sa)->sin6_addr; + else if (afproto == AF_INET) + return &((struct sockaddr_in *)sa)->sin_addr; + return (void *)sa; +} + +static socklen_t xtables_sa_hostlen(unsigned int afproto) +{ + if (afproto == AF_INET6) + return sizeof(struct in6_addr); + else if (afproto == AF_INET) + return sizeof(struct in_addr); + return 0; +} + +/** + * Accepts: a hostname (DNS), or a single inetaddr - without any mask. The + * result is stored in @cb->val.haddr. Additionally, @cb->val.hmask and + * @cb->val.hlen are set for completeness to the appropriate values. + */ +static void xtopt_parse_host(struct xt_option_call *cb) +{ + struct addrinfo hints = {.ai_family = afinfo->family}; + unsigned int adcount = 0; + struct addrinfo *res, *p; + int ret; + + ret = getaddrinfo(cb->arg, NULL, &hints, &res); + if (ret < 0) + xt_params->exit_err(PARAMETER_PROBLEM, + "getaddrinfo: %s\n", gai_strerror(ret)); + + memset(&cb->val.hmask, 0xFF, sizeof(cb->val.hmask)); + cb->val.hlen = (afinfo->family == NFPROTO_IPV4) ? 32 : 128; + + for (p = res; p != NULL; p = p->ai_next) { + if (adcount == 0) { + memset(&cb->val.haddr, 0, sizeof(cb->val.haddr)); + memcpy(&cb->val.haddr, + xtables_sa_host(p->ai_addr, p->ai_family), + xtables_sa_hostlen(p->ai_family)); + ++adcount; + continue; + } + if (memcmp(&cb->val.haddr, + xtables_sa_host(p->ai_addr, p->ai_family), + xtables_sa_hostlen(p->ai_family)) != 0) + xt_params->exit_err(PARAMETER_PROBLEM, + "%s resolves to more than one address\n", + cb->arg); + } + + freeaddrinfo(res); + if (cb->entry->flags & XTOPT_PUT) + /* Validation in xtables_option_metavalidate */ + memcpy(XTOPT_MKPTR(cb), &cb->val.haddr, + sizeof(cb->val.haddr)); +} + +/** + * @name: port name, or number as a string (e.g. "http" or "80") + * + * Resolve a port name to a number. Returns the port number in integral + * form on success, or <0 on error. (errno will not be set.) + */ +static int xtables_getportbyname(const char *name) +{ + struct addrinfo *res = NULL, *p; + int ret; + + ret = getaddrinfo(NULL, name, NULL, &res); + if (ret < 0) + return -1; + ret = -1; + for (p = res; p != NULL; p = p->ai_next) { + if (p->ai_family == AF_INET6) { + ret = ((struct sockaddr_in6 *)p->ai_addr)->sin6_port; + break; + } else if (p->ai_family == AF_INET) { + ret = ((struct sockaddr_in *)p->ai_addr)->sin_port; + break; + } + } + freeaddrinfo(res); + if (ret < 0) + return ret; + return ntohs(ret); +} + +/** + * Validate and parse a protocol specification (number or name) by use of + * /etc/protocols and put the result into @cb->val.protocol. + */ +static void xtopt_parse_protocol(struct xt_option_call *cb) +{ + cb->val.protocol = xtables_parse_protocol(cb->arg); + if (cb->entry->flags & XTOPT_PUT) + *(uint8_t *)XTOPT_MKPTR(cb) = cb->val.protocol; +} + +/** + * Validate and parse a port specification and put the result into + * @cb->val.port. + */ +static void xtopt_parse_port(struct xt_option_call *cb) +{ + const struct xt_option_entry *entry = cb->entry; + int ret; + + ret = xtables_getportbyname(cb->arg); + if (ret < 0) + xt_params->exit_err(PARAMETER_PROBLEM, + "Port \"%s\" does not resolve to anything.\n", + cb->arg); + if (entry->flags & XTOPT_NBO) + ret = htons(ret); + cb->val.port = ret; + if (entry->flags & XTOPT_PUT) + *(uint16_t *)XTOPT_MKPTR(cb) = cb->val.port; +} + +static void xtopt_parse_mport(struct xt_option_call *cb) +{ + static const size_t esize = sizeof(uint16_t); + const struct xt_option_entry *entry = cb->entry; + char *lo_arg, *wp_arg, *arg; + unsigned int maxiter; + int value; + + wp_arg = lo_arg = strdup(cb->arg); + if (lo_arg == NULL) + xt_params->exit_err(RESOURCE_PROBLEM, "strdup"); + + maxiter = entry->size / esize; + if (maxiter == 0) + maxiter = 2; /* ARRAY_SIZE(cb->val.port_range) */ + if (entry->size % esize != 0) + xt_params->exit_err(OTHER_PROBLEM, "%s: memory block does " + "not have proper size\n", __func__); + + cb->val.port_range[0] = 0; + cb->val.port_range[1] = UINT16_MAX; + cb->nvals = 0; + + while ((arg = strsep(&wp_arg, ":")) != NULL) { + if (cb->nvals == maxiter) + xt_params->exit_err(PARAMETER_PROBLEM, "%s: Too many " + "components for option \"--%s\" (max: %u)\n", + cb->ext_name, entry->name, maxiter); + if (*arg == '\0') { + ++cb->nvals; + continue; + } + + value = xtables_getportbyname(arg); + if (value < 0) + xt_params->exit_err(PARAMETER_PROBLEM, + "Port \"%s\" does not resolve to " + "anything.\n", arg); + if (entry->flags & XTOPT_NBO) + value = htons(value); + if (cb->nvals < ARRAY_SIZE(cb->val.port_range)) + cb->val.port_range[cb->nvals] = value; + ++cb->nvals; + } + + if (cb->nvals == 1) { + cb->val.port_range[1] = cb->val.port_range[0]; + ++cb->nvals; + } + if (entry->flags & XTOPT_PUT) + memcpy(XTOPT_MKPTR(cb), cb->val.port_range, sizeof(uint16_t) * + (cb->nvals <= maxiter ? cb->nvals : maxiter)); + free(lo_arg); +} + +/** + * Parse an integer and ensure it is within the address family's prefix length + * limits. The result is stored in @cb->val.hlen. + */ +static void xtopt_parse_plen(struct xt_option_call *cb) +{ + const struct xt_option_entry *entry = cb->entry; + unsigned int prefix_len = 128; /* happiness is a warm gcc */ + + cb->val.hlen = (afinfo->family == NFPROTO_IPV4) ? 32 : 128; + if (!xtables_strtoui(cb->arg, NULL, &prefix_len, 0, cb->val.hlen)) + xt_params->exit_err(PARAMETER_PROBLEM, + "%s: bad value for option \"--%s\", " + "or out of range (%u-%u).\n", + cb->ext_name, entry->name, 0, cb->val.hlen); + + cb->val.hlen = prefix_len; +} + +/** + * Reuse xtopt_parse_plen for testing the integer. Afterwards convert this to + * a bitmask, and make it available through @cb->val.hmask (hlen remains + * valid). If %XTOPT_PUT is used, hmask will be copied to the target area. + */ +static void xtopt_parse_plenmask(struct xt_option_call *cb) +{ + const struct xt_option_entry *entry = cb->entry; + uint32_t *mask = cb->val.hmask.all; + + xtopt_parse_plen(cb); + + memset(mask, 0xFF, sizeof(union nf_inet_addr)); + /* This shifting is AF-independent. */ + if (cb->val.hlen == 0) { + mask[0] = mask[1] = mask[2] = mask[3] = 0; + } else if (cb->val.hlen <= 32) { + mask[0] <<= 32 - cb->val.hlen; + mask[1] = mask[2] = mask[3] = 0; + } else if (cb->val.hlen <= 64) { + mask[1] <<= 32 - (cb->val.hlen - 32); + mask[2] = mask[3] = 0; + } else if (cb->val.hlen <= 96) { + mask[2] <<= 32 - (cb->val.hlen - 64); + mask[3] = 0; + } else if (cb->val.hlen <= 128) { + mask[3] <<= 32 - (cb->val.hlen - 96); + } + mask[0] = htonl(mask[0]); + mask[1] = htonl(mask[1]); + mask[2] = htonl(mask[2]); + mask[3] = htonl(mask[3]); + if (entry->flags & XTOPT_PUT) + memcpy(XTOPT_MKPTR(cb), mask, sizeof(union nf_inet_addr)); +} + +static void xtopt_parse_hostmask(struct xt_option_call *cb) +{ + const char *orig_arg = cb->arg; + char *work, *p; + + if (strchr(cb->arg, '/') == NULL) { + xtopt_parse_host(cb); + return; + } + work = strdup(orig_arg); + if (work == NULL) + xt_params->exit_err(PARAMETER_PROBLEM, "strdup"); + p = strchr(work, '/'); /* by def this can't be NULL now */ + *p++ = '\0'; + /* + * Because xtopt_parse_host and xtopt_parse_plenmask would store + * different things in the same target area, XTTYPE_HOSTMASK must + * disallow XTOPT_PUT, which it does by forcing its absence, + * cf. not being listed in xtopt_psize. + */ + cb->arg = work; + xtopt_parse_host(cb); + cb->arg = p; + xtopt_parse_plenmask(cb); + cb->arg = orig_arg; +} + +static void xtopt_parse_ethermac(struct xt_option_call *cb) +{ + const char *arg = cb->arg; + unsigned int i; + char *end; + + for (i = 0; i < ARRAY_SIZE(cb->val.ethermac) - 1; ++i) { + cb->val.ethermac[i] = strtoul(arg, &end, 16); + if (*end != ':' || end - arg > 2) + goto out; + arg = end + 1; + } + i = ARRAY_SIZE(cb->val.ethermac) - 1; + cb->val.ethermac[i] = strtoul(arg, &end, 16); + if (*end != '\0' || end - arg > 2) + goto out; + if (cb->entry->flags & XTOPT_PUT) + memcpy(XTOPT_MKPTR(cb), cb->val.ethermac, + sizeof(cb->val.ethermac)); + return; + out: + xt_params->exit_err(PARAMETER_PROBLEM, "ether"); +} + +static void (*const xtopt_subparse[])(struct xt_option_call *) = { + [XTTYPE_UINT8] = xtopt_parse_int, + [XTTYPE_UINT16] = xtopt_parse_int, + [XTTYPE_UINT32] = xtopt_parse_int, + [XTTYPE_UINT64] = xtopt_parse_int, + [XTTYPE_UINT8RC] = xtopt_parse_mint, + [XTTYPE_UINT16RC] = xtopt_parse_mint, + [XTTYPE_UINT32RC] = xtopt_parse_mint, + [XTTYPE_UINT64RC] = xtopt_parse_mint, + [XTTYPE_DOUBLE] = xtopt_parse_float, + [XTTYPE_STRING] = xtopt_parse_string, + [XTTYPE_TOSMASK] = xtopt_parse_tosmask, + [XTTYPE_MARKMASK32] = xtopt_parse_markmask, + [XTTYPE_SYSLOGLEVEL] = xtopt_parse_sysloglevel, + [XTTYPE_HOST] = xtopt_parse_host, + [XTTYPE_HOSTMASK] = xtopt_parse_hostmask, + [XTTYPE_PROTOCOL] = xtopt_parse_protocol, + [XTTYPE_PORT] = xtopt_parse_port, + [XTTYPE_PORTRC] = xtopt_parse_mport, + [XTTYPE_PLEN] = xtopt_parse_plen, + [XTTYPE_PLENMASK] = xtopt_parse_plenmask, + [XTTYPE_ETHERMAC] = xtopt_parse_ethermac, +}; + +/** + * The master option parsing routine. May be used for the ".x6_parse" + * function pointer in extensions if fully automatic parsing is desired. + * It may be also called manually from a custom x6_parse function. + */ +void xtables_option_parse(struct xt_option_call *cb) +{ + const struct xt_option_entry *entry = cb->entry; + unsigned int eflag = 1 << cb->entry->id; + + /* + * With {.id = P_FOO, .excl = P_FOO} we can have simple double-use + * prevention. Though it turned out that this is too much typing (most + * of the options are one-time use only), so now we also have + * %XTOPT_MULTI. + */ + if ((!(entry->flags & XTOPT_MULTI) || (entry->excl & eflag)) && + cb->xflags & eflag) + xt_params->exit_err(PARAMETER_PROBLEM, + "%s: option \"--%s\" can only be used once.\n", + cb->ext_name, cb->entry->name); + if (cb->invert && !(entry->flags & XTOPT_INVERT)) + xt_params->exit_err(PARAMETER_PROBLEM, + "%s: option \"--%s\" cannot be inverted.\n", + cb->ext_name, entry->name); + if (entry->type != XTTYPE_NONE && optarg == NULL) + xt_params->exit_err(PARAMETER_PROBLEM, + "%s: option \"--%s\" requires an argument.\n", + cb->ext_name, entry->name); + /* + * Fill in fallback value for "nvals", in case an extension (as it + * happened with libxt_conntrack.2) tries to read it, despite not using + * a *RC option type. + */ + cb->nvals = 1; + if (entry->type <= ARRAY_SIZE(xtopt_subparse) && + xtopt_subparse[entry->type] != NULL) + xtopt_subparse[entry->type](cb); + /* Exclusion with other flags tested later in finalize. */ + cb->xflags |= 1 << entry->id; +} + +/** + * Verifies that an extension's option map descriptor is valid, and ought to + * be called right after the extension has been loaded, and before option + * merging/xfrm. + */ +void xtables_option_metavalidate(const char *name, + const struct xt_option_entry *entry) +{ + for (; entry->name != NULL; ++entry) { + if (entry->id >= CHAR_BIT * sizeof(unsigned int) || + entry->id >= XT_OPTION_OFFSET_SCALE) + xt_params->exit_err(OTHER_PROBLEM, + "Extension %s uses invalid ID %u\n", + name, entry->id); + if (!(entry->flags & XTOPT_PUT)) { + if (entry->ptroff != 0) + xt_params->exit_err(OTHER_PROBLEM, + "%s: ptroff for \"--%s\" is non-" + "zero but no XTOPT_PUT is specified. " + "Oversight?", name, entry->name); + continue; + } + if (entry->type >= ARRAY_SIZE(xtopt_psize) || + xtopt_psize[entry->type] == 0) + xt_params->exit_err(OTHER_PROBLEM, + "%s: entry type of option \"--%s\" cannot be " + "combined with XTOPT_PUT\n", + name, entry->name); + if (xtopt_psize[entry->type] != -1 && + xtopt_psize[entry->type] != entry->size) + xt_params->exit_err(OTHER_PROBLEM, + "%s: option \"--%s\" points to a memory block " + "of wrong size (expected %zu, got %zu)\n", + name, entry->name, + xtopt_psize[entry->type], entry->size); + } +} + +/** + * Find an option entry by its id. + */ +static const struct xt_option_entry * +xtables_option_lookup(const struct xt_option_entry *entry, unsigned int id) +{ + for (; entry->name != NULL; ++entry) + if (entry->id == id) + return entry; + return NULL; +} + +/** + * @c: getopt id (i.e. with offset) + * @fw: struct ipt_entry or ip6t_entry + * + * Dispatch arguments to the appropriate parse function, based upon the + * extension's choice of API. + */ +void xtables_option_tpcall(unsigned int c, char **argv, bool invert, + struct xtables_target *t, void *fw) +{ + struct xt_option_call cb; + + if (t->x6_parse == NULL) { + if (t->parse != NULL) + t->parse(c - t->option_offset, argv, invert, + &t->tflags, fw, &t->t); + return; + } + + c -= t->option_offset; + cb.entry = xtables_option_lookup(t->x6_options, c); + if (cb.entry == NULL) + xtables_error(OTHER_PROBLEM, + "Extension does not know id %u\n", c); + cb.arg = optarg; + cb.invert = invert; + cb.ext_name = t->name; + cb.data = t->t->data; + cb.xflags = t->tflags; + cb.target = &t->t; + cb.xt_entry = fw; + cb.udata = t->udata; + t->x6_parse(&cb); + t->tflags = cb.xflags; +} + +/** + * @c: getopt id (i.e. with offset) + * @fw: struct ipt_entry or ip6t_entry + * + * Dispatch arguments to the appropriate parse function, based upon the + * extension's choice of API. + */ +void xtables_option_mpcall(unsigned int c, char **argv, bool invert, + struct xtables_match *m, void *fw) +{ + struct xt_option_call cb; + + if (m->x6_parse == NULL) { + if (m->parse != NULL) + m->parse(c - m->option_offset, argv, invert, + &m->mflags, fw, &m->m); + return; + } + + c -= m->option_offset; + cb.entry = xtables_option_lookup(m->x6_options, c); + if (cb.entry == NULL) + xtables_error(OTHER_PROBLEM, + "Extension does not know id %u\n", c); + cb.arg = optarg; + cb.invert = invert; + cb.ext_name = m->name; + cb.data = m->m->data; + cb.xflags = m->mflags; + cb.match = &m->m; + cb.xt_entry = fw; + cb.udata = m->udata; + m->x6_parse(&cb); + m->mflags = cb.xflags; +} + +/** + * @name: name of extension + * @entry: current option (from all ext's entries) being validated + * @xflags: flags the extension has collected + * @i: conflicting option (id) to test for + */ +static void +xtables_option_fcheck2(const char *name, const struct xt_option_entry *entry, + const struct xt_option_entry *other, + unsigned int xflags) +{ + unsigned int ef = 1 << entry->id, of = 1 << other->id; + + if (entry->also & of && !(xflags & of)) + xt_params->exit_err(PARAMETER_PROBLEM, + "%s: option \"--%s\" also requires \"--%s\".\n", + name, entry->name, other->name); + + if (!(entry->excl & of)) + /* Use of entry does not collide with other option, good. */ + return; + if ((xflags & (ef | of)) != (ef | of)) + /* Conflicting options were not used. */ + return; + + xt_params->exit_err(PARAMETER_PROBLEM, + "%s: option \"--%s\" cannot be used together with \"--%s\".\n", + name, entry->name, other->name); +} + +/** + * @name: name of extension + * @xflags: accumulated flags + * @entry: extension's option table + * + * Check that all option constraints have been met. This effectively replaces + * ->final_check of the older API. + */ +void xtables_options_fcheck(const char *name, unsigned int xflags, + const struct xt_option_entry *table) +{ + const struct xt_option_entry *entry, *other; + unsigned int i; + + for (entry = table; entry->name != NULL; ++entry) { + if (entry->flags & XTOPT_MAND && + !(xflags & (1 << entry->id))) + xt_params->exit_err(PARAMETER_PROBLEM, + "%s: option \"--%s\" must be specified\n", + name, entry->name); + if (!(xflags & (1 << entry->id))) + /* Not required, not specified, thus skip. */ + continue; + + for (i = 0; i < CHAR_BIT * sizeof(entry->id); ++i) { + if (entry->id == i) + /* + * Avoid conflict with self. Multi-use check + * was done earlier in xtables_option_parse. + */ + continue; + other = xtables_option_lookup(table, i); + if (other == NULL) + continue; + xtables_option_fcheck2(name, entry, other, xflags); + } + } +} + +/** + * Dispatch arguments to the appropriate final_check function, based upon the + * extension's choice of API. + */ +void xtables_option_tfcall(struct xtables_target *t) +{ + if (t->x6_fcheck != NULL) { + struct xt_fcheck_call cb; + + cb.ext_name = t->name; + cb.data = t->t->data; + cb.xflags = t->tflags; + cb.udata = t->udata; + t->x6_fcheck(&cb); + } else if (t->final_check != NULL) { + t->final_check(t->tflags); + } + if (t->x6_options != NULL) + xtables_options_fcheck(t->name, t->tflags, t->x6_options); +} + +/** + * Dispatch arguments to the appropriate final_check function, based upon the + * extension's choice of API. + */ +void xtables_option_mfcall(struct xtables_match *m) +{ + if (m->x6_fcheck != NULL) { + struct xt_fcheck_call cb; + + cb.ext_name = m->name; + cb.data = m->m->data; + cb.xflags = m->mflags; + cb.udata = m->udata; + m->x6_fcheck(&cb); + } else if (m->final_check != NULL) { + m->final_check(m->mflags); + } + if (m->x6_options != NULL) + xtables_options_fcheck(m->name, m->mflags, m->x6_options); +} + +struct xtables_lmap *xtables_lmap_init(const char *file) +{ + struct xtables_lmap *lmap_head = NULL, *lmap_prev = NULL, *lmap_this; + char buf[512]; + FILE *fp; + char *cur, *nxt; + int id; + + fp = fopen(file, "re"); + if (fp == NULL) + return NULL; + + while (fgets(buf, sizeof(buf), fp) != NULL) { + cur = buf; + while (isspace(*cur)) + ++cur; + if (*cur == '#' || *cur == '\n' || *cur == '\0') + continue; + + /* iproute2 allows hex and dec format */ + errno = 0; + id = strtoul(cur, &nxt, strncmp(cur, "0x", 2) == 0 ? 16 : 10); + if (nxt == cur || errno != 0) + continue; + + /* same boundaries as in iproute2 */ + if (id < 0 || id > 255) + continue; + cur = nxt; + + if (!isspace(*cur)) + continue; + while (isspace(*cur)) + ++cur; + if (*cur == '#' || *cur == '\n' || *cur == '\0') + continue; + nxt = cur; + while (*nxt != '\0' && !isspace(*nxt)) + ++nxt; + if (nxt == cur) + continue; + *nxt = '\0'; + + /* found valid data */ + lmap_this = malloc(sizeof(*lmap_this)); + if (lmap_this == NULL) { + perror("malloc"); + goto out; + } + lmap_this->id = id; + lmap_this->name = strdup(cur); + if (lmap_this->name == NULL) { + free(lmap_this); + goto out; + } + lmap_this->next = NULL; + + if (lmap_prev != NULL) + lmap_prev->next = lmap_this; + else + lmap_head = lmap_this; + lmap_prev = lmap_this; + } + + fclose(fp); + return lmap_head; + out: + xtables_lmap_free(lmap_head); + return NULL; +} + +void xtables_lmap_free(struct xtables_lmap *head) +{ + struct xtables_lmap *next; + + for (; head != NULL; head = next) { + next = head->next; + free(head->name); + free(head); + } +} + +int xtables_lmap_name2id(const struct xtables_lmap *head, const char *name) +{ + for (; head != NULL; head = head->next) + if (strcmp(head->name, name) == 0) + return head->id; + return -1; +} + +const char *xtables_lmap_id2name(const struct xtables_lmap *head, int id) +{ + for (; head != NULL; head = head->next) + if (head->id == id) + return head->name; + return NULL; +} -- cgit v1.2.3