iptables.c revision f1e71016dddb65709afe0746a96a3fefbec3ba27
1e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Code to take an iptables-style command line and do it. */ 2e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 3e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* 4e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher * Author: Paul.Russell@rustcorp.com.au and mneuling@radlogic.com.au 5e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher * 6d4ab5ad2b2c72d303c6ef8161076a973bc77ad3dHarald Welte * (C) 2000-2002 by the netfilter coreteam <coreteam@netfilter.org>: 7d4ab5ad2b2c72d303c6ef8161076a973bc77ad3dHarald Welte * Paul 'Rusty' Russell <rusty@rustcorp.com.au> 8d4ab5ad2b2c72d303c6ef8161076a973bc77ad3dHarald Welte * Marc Boucher <marc+nf@mbsi.ca> 9d4ab5ad2b2c72d303c6ef8161076a973bc77ad3dHarald Welte * James Morris <jmorris@intercode.com.au> 10d4ab5ad2b2c72d303c6ef8161076a973bc77ad3dHarald Welte * Harald Welte <laforge@gnumonks.org> 11d4ab5ad2b2c72d303c6ef8161076a973bc77ad3dHarald Welte * Jozsef Kadlecsik <kadlec@blackhole.kfki.hu> 12d4ab5ad2b2c72d303c6ef8161076a973bc77ad3dHarald Welte * 13e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher * This program is free software; you can redistribute it and/or modify 14e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher * it under the terms of the GNU General Public License as published by 15e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher * the Free Software Foundation; either version 2 of the License, or 16e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher * (at your option) any later version. 17e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher * 18e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher * This program is distributed in the hope that it will be useful, 19e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher * but WITHOUT ANY WARRANTY; without even the implied warranty of 20e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 21e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher * GNU General Public License for more details. 22e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher * 23e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher * You should have received a copy of the GNU General Public License 24e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher * along with this program; if not, write to the Free Software 25e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. 26e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher */ 27e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 28e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#include <getopt.h> 29e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#include <string.h> 30e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#include <netdb.h> 31e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#include <errno.h> 32c021c3ce7b1583eb5dd71b10ac3d8ab3cd36beaaJan Engelhardt#include <stdbool.h> 33e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#include <stdio.h> 34e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#include <stdlib.h> 35e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#include <ctype.h> 36e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#include <stdarg.h> 37e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#include <limits.h> 3882dd2ec8eef4991bd717f885b26080d993dd3498Harald Welte#include <unistd.h> 39e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#include <iptables.h> 403dfa4488b032fc32aaf2470f48ac1fc3a534794fYasuyuki KOZAKAI#include <xtables.h> 4182dd2ec8eef4991bd717f885b26080d993dd3498Harald Welte#include <fcntl.h> 428cf65913bb6353bf0e92eab0669d1c4c53b43623Phil Oester#include <sys/utsname.h> 43f89c1716a7743ca6e2e6164d3b64c15b2e285e1eJan Engelhardt#include "xshared.h" 44e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 45e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#ifndef TRUE 46e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define TRUE 1 47e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#endif 48e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#ifndef FALSE 49e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define FALSE 0 50e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#endif 51e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 52e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define FMT_NUMERIC 0x0001 53e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define FMT_NOCOUNTS 0x0002 54e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define FMT_KILOMEGAGIGA 0x0004 55e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define FMT_OPTIONS 0x0008 56e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define FMT_NOTABLE 0x0010 57e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define FMT_NOTARGET 0x0020 58e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define FMT_VIA 0x0040 59e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define FMT_NONEWLINE 0x0080 60e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define FMT_LINENUMBERS 0x0100 61e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 62e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define FMT_PRINT_RULE (FMT_NOCOUNTS | FMT_OPTIONS | FMT_VIA \ 63e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher | FMT_NUMERIC | FMT_NOTABLE) 64e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define FMT(tab,notab) ((format) & FMT_NOTABLE ? (notab) : (tab)) 65e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 66e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 67e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define CMD_NONE 0x0000U 68e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define CMD_INSERT 0x0001U 69e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define CMD_DELETE 0x0002U 70e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define CMD_DELETE_NUM 0x0004U 71e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define CMD_REPLACE 0x0008U 72e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define CMD_APPEND 0x0010U 73e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define CMD_LIST 0x0020U 74e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define CMD_FLUSH 0x0040U 75e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define CMD_ZERO 0x0080U 76e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define CMD_NEW_CHAIN 0x0100U 77e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define CMD_DELETE_CHAIN 0x0200U 78e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define CMD_SET_POLICY 0x0400U 790eca33f8a830d1aaca53b590abe791109a9524e3Harald Welte#define CMD_RENAME_CHAIN 0x0800U 8096296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom#define CMD_LIST_RULES 0x1000U 81b34199ee303d98ba00ed5ee19d4d5b19dd4cf563Mohit Mehta#define CMD_ZERO_NUM 0x2000U 82b34199ee303d98ba00ed5ee19d4d5b19dd4cf563Mohit Mehta#define NUMBER_OF_CMD 15 83e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherstatic const char cmdflags[] = { 'I', 'D', 'D', 'R', 'A', 'L', 'F', 'Z', 84b34199ee303d98ba00ed5ee19d4d5b19dd4cf563Mohit Mehta 'Z', 'N', 'X', 'P', 'E', 'S' }; 85e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 86e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define OPT_NONE 0x00000U 87e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define OPT_NUMERIC 0x00001U 88e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define OPT_SOURCE 0x00002U 89e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define OPT_DESTINATION 0x00004U 90e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define OPT_PROTOCOL 0x00008U 91e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define OPT_JUMP 0x00010U 92e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define OPT_VERBOSE 0x00020U 93e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define OPT_EXPANDED 0x00040U 94e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define OPT_VIANAMEIN 0x00080U 95e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#define OPT_VIANAMEOUT 0x00100U 96f1e71016dddb65709afe0746a96a3fefbec3ba27Jan Engelhardt#define OPT_LINENUMBERS 0x00200U 97f1e71016dddb65709afe0746a96a3fefbec3ba27Jan Engelhardt#define OPT_COUNTERS 0x00400U 98f1e71016dddb65709afe0746a96a3fefbec3ba27Jan Engelhardt#define OPT_FRAGMENT 0x00800U 99ccd49e5688c1edebc6b8a980c72a269618046acbHarald Welte#define NUMBER_OF_OPT 12 100e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherstatic const char optflags[NUMBER_OF_OPT] 101f1e71016dddb65709afe0746a96a3fefbec3ba27Jan Engelhardt= { 'n', 's', 'd', 'p', 'j', 'v', 'x', 'i', 'o', '0', 'c', 'f'}; 102e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 103e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherstatic struct option original_opts[] = { 1047bc3cb7eec4c4db5edc4b503a5dfab799e0bce62Gáspár Lajos {.name = "append", .has_arg = 1, .val = 'A'}, 1057bc3cb7eec4c4db5edc4b503a5dfab799e0bce62Gáspár Lajos {.name = "delete", .has_arg = 1, .val = 'D'}, 1067bc3cb7eec4c4db5edc4b503a5dfab799e0bce62Gáspár Lajos {.name = "insert", .has_arg = 1, .val = 'I'}, 1077bc3cb7eec4c4db5edc4b503a5dfab799e0bce62Gáspár Lajos {.name = "replace", .has_arg = 1, .val = 'R'}, 1087bc3cb7eec4c4db5edc4b503a5dfab799e0bce62Gáspár Lajos {.name = "list", .has_arg = 2, .val = 'L'}, 10996296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom {.name = "list-rules", .has_arg = 2, .val = 'S'}, 1107bc3cb7eec4c4db5edc4b503a5dfab799e0bce62Gáspár Lajos {.name = "flush", .has_arg = 2, .val = 'F'}, 1117bc3cb7eec4c4db5edc4b503a5dfab799e0bce62Gáspár Lajos {.name = "zero", .has_arg = 2, .val = 'Z'}, 1127bc3cb7eec4c4db5edc4b503a5dfab799e0bce62Gáspár Lajos {.name = "new-chain", .has_arg = 1, .val = 'N'}, 1137bc3cb7eec4c4db5edc4b503a5dfab799e0bce62Gáspár Lajos {.name = "delete-chain", .has_arg = 2, .val = 'X'}, 1147bc3cb7eec4c4db5edc4b503a5dfab799e0bce62Gáspár Lajos {.name = "rename-chain", .has_arg = 1, .val = 'E'}, 1157bc3cb7eec4c4db5edc4b503a5dfab799e0bce62Gáspár Lajos {.name = "policy", .has_arg = 1, .val = 'P'}, 1167bc3cb7eec4c4db5edc4b503a5dfab799e0bce62Gáspár Lajos {.name = "source", .has_arg = 1, .val = 's'}, 1177bc3cb7eec4c4db5edc4b503a5dfab799e0bce62Gáspár Lajos {.name = "destination", .has_arg = 1, .val = 'd'}, 1187bc3cb7eec4c4db5edc4b503a5dfab799e0bce62Gáspár Lajos {.name = "src", .has_arg = 1, .val = 's'}, /* synonym */ 1197bc3cb7eec4c4db5edc4b503a5dfab799e0bce62Gáspár Lajos {.name = "dst", .has_arg = 1, .val = 'd'}, /* synonym */ 1207bc3cb7eec4c4db5edc4b503a5dfab799e0bce62Gáspár Lajos {.name = "protocol", .has_arg = 1, .val = 'p'}, 1217bc3cb7eec4c4db5edc4b503a5dfab799e0bce62Gáspár Lajos {.name = "in-interface", .has_arg = 1, .val = 'i'}, 1227bc3cb7eec4c4db5edc4b503a5dfab799e0bce62Gáspár Lajos {.name = "jump", .has_arg = 1, .val = 'j'}, 1237bc3cb7eec4c4db5edc4b503a5dfab799e0bce62Gáspár Lajos {.name = "table", .has_arg = 1, .val = 't'}, 1247bc3cb7eec4c4db5edc4b503a5dfab799e0bce62Gáspár Lajos {.name = "match", .has_arg = 1, .val = 'm'}, 1257bc3cb7eec4c4db5edc4b503a5dfab799e0bce62Gáspár Lajos {.name = "numeric", .has_arg = 0, .val = 'n'}, 1267bc3cb7eec4c4db5edc4b503a5dfab799e0bce62Gáspár Lajos {.name = "out-interface", .has_arg = 1, .val = 'o'}, 1277bc3cb7eec4c4db5edc4b503a5dfab799e0bce62Gáspár Lajos {.name = "verbose", .has_arg = 0, .val = 'v'}, 1287bc3cb7eec4c4db5edc4b503a5dfab799e0bce62Gáspár Lajos {.name = "exact", .has_arg = 0, .val = 'x'}, 1297bc3cb7eec4c4db5edc4b503a5dfab799e0bce62Gáspár Lajos {.name = "fragments", .has_arg = 0, .val = 'f'}, 1307bc3cb7eec4c4db5edc4b503a5dfab799e0bce62Gáspár Lajos {.name = "version", .has_arg = 0, .val = 'V'}, 1317bc3cb7eec4c4db5edc4b503a5dfab799e0bce62Gáspár Lajos {.name = "help", .has_arg = 2, .val = 'h'}, 1327bc3cb7eec4c4db5edc4b503a5dfab799e0bce62Gáspár Lajos {.name = "line-numbers", .has_arg = 0, .val = '0'}, 1337bc3cb7eec4c4db5edc4b503a5dfab799e0bce62Gáspár Lajos {.name = "modprobe", .has_arg = 1, .val = 'M'}, 1347bc3cb7eec4c4db5edc4b503a5dfab799e0bce62Gáspár Lajos {.name = "set-counters", .has_arg = 1, .val = 'c'}, 1357bc3cb7eec4c4db5edc4b503a5dfab799e0bce62Gáspár Lajos {.name = "goto", .has_arg = 1, .val = 'g'}, 1367bc3cb7eec4c4db5edc4b503a5dfab799e0bce62Gáspár Lajos {NULL}, 137e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher}; 138e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 13963e9063a660809385fd17edb94da044c7c884e02Illes Marci/* we need this for iptables-restore. iptables-restore.c sets line to the 14063e9063a660809385fd17edb94da044c7c884e02Illes Marci * current line of the input file, in order to give a more precise error 14163e9063a660809385fd17edb94da044c7c884e02Illes Marci * message. iptables itself doesn't need this, so it is initialized to the 14263e9063a660809385fd17edb94da044c7c884e02Illes Marci * magic number of -1 */ 14363e9063a660809385fd17edb94da044c7c884e02Illes Marciint line = -1; 14463e9063a660809385fd17edb94da044c7c884e02Illes Marci 1458b7baebc93989106fd5d26b262d0ce191f8ef7c0Jamal Hadi Salimvoid iptables_exit_error(enum xtables_exittype status, const char *msg, ...) __attribute__((noreturn, format(printf,2,3))); 1468b7baebc93989106fd5d26b262d0ce191f8ef7c0Jamal Hadi Salim 1474dcdc9b3f8f42eb3b5a1d12e1b3d2fc1e2675725Jamal Hadi Salimstruct xtables_globals iptables_globals = { 1484dcdc9b3f8f42eb3b5a1d12e1b3d2fc1e2675725Jamal Hadi Salim .option_offset = 0, 1494dcdc9b3f8f42eb3b5a1d12e1b3d2fc1e2675725Jamal Hadi Salim .program_version = IPTABLES_VERSION, 150139b3fe4bd5121501e60fe07963ea527d7f0bd36Jamal Hadi Salim .orig_opts = original_opts, 1518b7baebc93989106fd5d26b262d0ce191f8ef7c0Jamal Hadi Salim .exit_err = iptables_exit_error, 1524dcdc9b3f8f42eb3b5a1d12e1b3d2fc1e2675725Jamal Hadi Salim}; 1534dcdc9b3f8f42eb3b5a1d12e1b3d2fc1e2675725Jamal Hadi Salim 154e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Table of legal combinations of commands and options. If any of the 155e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher * given commands make an option legal, that option is legal (applies to 156e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher * CMD_LIST and CMD_ZERO only). 157e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher * Key: 158e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher * + compulsory 159e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher * x illegal 160e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher * optional 161e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher */ 162e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 163d1435e0772e40c310dff35abe7bf1e7de5b18ee4Jan Engelhardtstatic const char commands_v_options[NUMBER_OF_CMD][NUMBER_OF_OPT] = 164e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Well, it's better than "Re: Linux vs FreeBSD" */ 165e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher{ 166f1e71016dddb65709afe0746a96a3fefbec3ba27Jan Engelhardt /* -n -s -d -p -j -v -x -i -o --line -c -f */ 167f1e71016dddb65709afe0746a96a3fefbec3ba27Jan Engelhardt/*INSERT*/ {'x',' ',' ',' ',' ',' ','x',' ',' ','x',' ',' '}, 168f1e71016dddb65709afe0746a96a3fefbec3ba27Jan Engelhardt/*DELETE*/ {'x',' ',' ',' ',' ',' ','x',' ',' ','x','x',' '}, 1692cfbd9f565e91356679bdee3f1e9b3133a9d14adPatrick McHardyHarald Welte/*DELETE_NUM*/{'x','x','x','x','x',' ','x','x','x','x','x','x'}, 170f1e71016dddb65709afe0746a96a3fefbec3ba27Jan Engelhardt/*REPLACE*/ {'x',' ',' ',' ',' ',' ','x',' ',' ','x',' ',' '}, 171f1e71016dddb65709afe0746a96a3fefbec3ba27Jan Engelhardt/*APPEND*/ {'x',' ',' ',' ',' ',' ','x',' ',' ','x',' ',' '}, 172f1e71016dddb65709afe0746a96a3fefbec3ba27Jan Engelhardt/*LIST*/ {' ','x','x','x','x',' ',' ','x','x',' ','x','x'}, 1732cfbd9f565e91356679bdee3f1e9b3133a9d14adPatrick McHardyHarald Welte/*FLUSH*/ {'x','x','x','x','x',' ','x','x','x','x','x','x'}, 1742cfbd9f565e91356679bdee3f1e9b3133a9d14adPatrick McHardyHarald Welte/*ZERO*/ {'x','x','x','x','x',' ','x','x','x','x','x','x'}, 175b34199ee303d98ba00ed5ee19d4d5b19dd4cf563Mohit Mehta/*ZERO_NUM*/ {'x','x','x','x','x',' ','x','x','x','x','x','x'}, 1762cfbd9f565e91356679bdee3f1e9b3133a9d14adPatrick McHardyHarald Welte/*NEW_CHAIN*/ {'x','x','x','x','x',' ','x','x','x','x','x','x'}, 1772cfbd9f565e91356679bdee3f1e9b3133a9d14adPatrick McHardyHarald Welte/*DEL_CHAIN*/ {'x','x','x','x','x',' ','x','x','x','x','x','x'}, 178f1e71016dddb65709afe0746a96a3fefbec3ba27Jan Engelhardt/*SET_POLICY*/{'x','x','x','x','x',' ','x','x','x','x',' ','x'}, 17996296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom/*RENAME*/ {'x','x','x','x','x',' ','x','x','x','x','x','x'}, 18096296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom/*LIST_RULES*/{'x','x','x','x','x',' ','x','x','x','x','x','x'} 181e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher}; 182e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 183d1435e0772e40c310dff35abe7bf1e7de5b18ee4Jan Engelhardtstatic const int inverse_for_options[NUMBER_OF_OPT] = 184e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher{ 185e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* -n */ 0, 186e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* -s */ IPT_INV_SRCIP, 187e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* -d */ IPT_INV_DSTIP, 188e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* -p */ IPT_INV_PROTO, 189e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* -j */ 0, 190e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* -v */ 0, 191e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* -x */ 0, 192e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* -i */ IPT_INV_VIA_IN, 193e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* -o */ IPT_INV_VIA_OUT, 194e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* -f */ IPT_INV_FRAG, 1952cfbd9f565e91356679bdee3f1e9b3133a9d14adPatrick McHardyHarald Welte/*--line*/ 0, 1962cfbd9f565e91356679bdee3f1e9b3133a9d14adPatrick McHardyHarald Welte/* -c */ 0, 197e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher}; 198e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 199f503cb8ad6360ca646e985f02c2eb0c4bfe8a2c8Pablo Neira Ayuso#define opts iptables_globals.opts 2005dd19de34380c91ad07bbe79a34726e59891cf54Jamal Hadi Salim#define prog_name iptables_globals.program_name 2015dd19de34380c91ad07bbe79a34726e59891cf54Jamal Hadi Salim#define prog_vers iptables_globals.program_version 202e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 2038cf65913bb6353bf0e92eab0669d1c4c53b43623Phil Oesterint kernel_version; 2048cf65913bb6353bf0e92eab0669d1c4c53b43623Phil Oester 205a3e6aaa5371937420dd44949d840d19726998abcRusty Russell/* Primitive headers... */ 206764316a133db8e5e2d1f2a9d941ffae993d7c9d9András Kis-Szabó/* defined in netinet/in.h */ 207764316a133db8e5e2d1f2a9d941ffae993d7c9d9András Kis-Szabó#if 0 208a3e6aaa5371937420dd44949d840d19726998abcRusty Russell#ifndef IPPROTO_ESP 209a3e6aaa5371937420dd44949d840d19726998abcRusty Russell#define IPPROTO_ESP 50 210a3e6aaa5371937420dd44949d840d19726998abcRusty Russell#endif 211a3e6aaa5371937420dd44949d840d19726998abcRusty Russell#ifndef IPPROTO_AH 212a3e6aaa5371937420dd44949d840d19726998abcRusty Russell#define IPPROTO_AH 51 213a3e6aaa5371937420dd44949d840d19726998abcRusty Russell#endif 214764316a133db8e5e2d1f2a9d941ffae993d7c9d9András Kis-Szabó#endif 215a3e6aaa5371937420dd44949d840d19726998abcRusty Russell 216267a57007e69d8f316dea80f79ce2560459e0c30Pablo Neira Ayusoenum { 217267a57007e69d8f316dea80f79ce2560459e0c30Pablo Neira Ayuso IPT_DOTTED_ADDR = 0, 218267a57007e69d8f316dea80f79ce2560459e0c30Pablo Neira Ayuso IPT_DOTTED_MASK 219267a57007e69d8f316dea80f79ce2560459e0c30Pablo Neira Ayuso}; 220267a57007e69d8f316dea80f79ce2560459e0c30Pablo Neira Ayuso 22124bb07802df1608319f40f77c606d45c14d59231Dmitry V. Levinstatic void __attribute__((noreturn)) 222e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherexit_tryhelp(int status) 223e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher{ 224edad9bb71861e807462285331f96f46288cd8b26Maciej Soltysiak if (line != -1) 225a5bb0a65c15ab040bc6b6ee2d6637fec50e80b13Harald Welte fprintf(stderr, "Error occurred at line: %d\n", line); 226e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher fprintf(stderr, "Try `%s -h' or '%s --help' for more information.\n", 2275dd19de34380c91ad07bbe79a34726e59891cf54Jamal Hadi Salim prog_name, prog_name); 228139b3fe4bd5121501e60fe07963ea527d7f0bd36Jamal Hadi Salim xtables_free_opts(1); 229e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher exit(status); 230e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher} 231e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 2320b63936140032deac44072951451bdf47b54296aPatrick McHardystatic void 233d1435e0772e40c310dff35abe7bf1e7de5b18ee4Jan Engelhardtexit_printhelp(const struct xtables_rule_match *matches) 234e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher{ 235e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher printf("%s v%s\n\n" 2360c4188f446e7c0ed07076c69d1d7f336a92efc8bAndrás Kis-Szabó"Usage: %s -[AD] chain rule-specification [options]\n" 2371791a45b279db742d6de35ea8dc1ad9dda4acb73Jan Engelhardt" %s -I chain [rulenum] rule-specification [options]\n" 2381791a45b279db742d6de35ea8dc1ad9dda4acb73Jan Engelhardt" %s -R chain rulenum rule-specification [options]\n" 239e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher" %s -D chain rulenum [options]\n" 240bb34082de25ec7fb6bffe5702062f087ca887466Henrik Nordstrom" %s -[LS] [chain [rulenum]] [options]\n" 241bb34082de25ec7fb6bffe5702062f087ca887466Henrik Nordstrom" %s -[FZ] [chain] [options]\n" 242e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher" %s -[NX] chain\n" 243e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher" %s -E old-chain-name new-chain-name\n" 244e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher" %s -P chain target [options]\n" 245e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher" %s -h (print this help information)\n\n", 2465dd19de34380c91ad07bbe79a34726e59891cf54Jamal Hadi Salim prog_name, prog_vers, prog_name, prog_name, 2475dd19de34380c91ad07bbe79a34726e59891cf54Jamal Hadi Salim prog_name, prog_name, prog_name, prog_name, 2481791a45b279db742d6de35ea8dc1ad9dda4acb73Jan Engelhardt prog_name, prog_name, prog_name, prog_name); 249e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 250e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher printf( 251e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher"Commands:\n" 252e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher"Either long or short options are allowed.\n" 253e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher" --append -A chain Append to chain\n" 254e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher" --delete -D chain Delete matching rule from chain\n" 255e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher" --delete -D chain rulenum\n" 256e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher" Delete rule rulenum (1 = first) from chain\n" 257e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher" --insert -I chain [rulenum]\n" 258e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher" Insert in chain as rulenum (default 1=first)\n" 259e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher" --replace -R chain rulenum\n" 260e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher" Replace rule rulenum (1 = first) in chain\n" 261bb34082de25ec7fb6bffe5702062f087ca887466Henrik Nordstrom" --list -L [chain [rulenum]]\n" 262bb34082de25ec7fb6bffe5702062f087ca887466Henrik Nordstrom" List the rules in a chain or all chains\n" 263bb34082de25ec7fb6bffe5702062f087ca887466Henrik Nordstrom" --list-rules -S [chain [rulenum]]\n" 264bb34082de25ec7fb6bffe5702062f087ca887466Henrik Nordstrom" Print the rules in a chain or all chains\n" 265e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher" --flush -F [chain] Delete all rules in chain or all chains\n" 266b34199ee303d98ba00ed5ee19d4d5b19dd4cf563Mohit Mehta" --zero -Z [chain [rulenum]]\n" 267b34199ee303d98ba00ed5ee19d4d5b19dd4cf563Mohit Mehta" Zero counters in chain or all chains\n" 268e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher" --new -N chain Create a new user-defined chain\n" 269e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher" --delete-chain\n" 270e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher" -X [chain] Delete a user-defined chain\n" 271e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher" --policy -P chain target\n" 272e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher" Change policy on chain to target\n" 273e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher" --rename-chain\n" 274e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher" -E old-chain new-chain\n" 275e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher" Change chain name, (moving any references)\n" 276e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 277e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher"Options:\n" 278967279231a9ecfa99f26694a954afc535c63db1dJan Engelhardt"[!] --proto -p proto protocol: by number or name, eg. `tcp'\n" 279332e4acc574e3a348fe611d55bf642de0d50fbdaMichael Granzow"[!] --source -s address[/mask][...]\n" 280e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher" source specification\n" 281332e4acc574e3a348fe611d55bf642de0d50fbdaMichael Granzow"[!] --destination -d address[/mask][...]\n" 282e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher" destination specification\n" 283967279231a9ecfa99f26694a954afc535c63db1dJan Engelhardt"[!] --in-interface -i input name[+]\n" 284e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher" network interface name ([+] for wildcard)\n" 285967279231a9ecfa99f26694a954afc535c63db1dJan Engelhardt" --jump -j target\n" 286363112d6100f202124a7a0f0251bfa4c321bd20dRusty Russell" target for rule (may load target extension)\n" 28717fc163babc348780bae4321071845748f7b7985Henrik Nordstrom#ifdef IPT_F_GOTO 28817fc163babc348780bae4321071845748f7b7985Henrik Nordstrom" --goto -g chain\n" 28917fc163babc348780bae4321071845748f7b7985Henrik Nordstrom" jump to chain with no return\n" 29017fc163babc348780bae4321071845748f7b7985Henrik Nordstrom#endif 291363112d6100f202124a7a0f0251bfa4c321bd20dRusty Russell" --match -m match\n" 292363112d6100f202124a7a0f0251bfa4c321bd20dRusty Russell" extended match (may load extension)\n" 293e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher" --numeric -n numeric output of addresses and ports\n" 294967279231a9ecfa99f26694a954afc535c63db1dJan Engelhardt"[!] --out-interface -o output name[+]\n" 295e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher" network interface name ([+] for wildcard)\n" 296e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher" --table -t table table to manipulate (default: `filter')\n" 297e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher" --verbose -v verbose mode\n" 29882dd2ec8eef4991bd717f885b26080d993dd3498Harald Welte" --line-numbers print line numbers when listing\n" 299e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher" --exact -x expand numbers (display exact values)\n" 300e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher"[!] --fragment -f match second or further fragments only\n" 301a4d3e1fea254d63a2dd0e32bf6d70fa0f39159bcRusty Russell" --modprobe=<command> try to insert modules using this command\n" 302ccd49e5688c1edebc6b8a980c72a269618046acbHarald Welte" --set-counters PKTS BYTES set the counter during insert/append\n" 303e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher"[!] --version -V print package version.\n"); 304e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 305f89c1716a7743ca6e2e6164d3b64c15b2e285e1eJan Engelhardt print_extension_helps(xtables_targets, matches); 306e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher exit(0); 307e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher} 308e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 3090b63936140032deac44072951451bdf47b54296aPatrick McHardyvoid 3108b7baebc93989106fd5d26b262d0ce191f8ef7c0Jamal Hadi Salimiptables_exit_error(enum xtables_exittype status, const char *msg, ...) 3110b63936140032deac44072951451bdf47b54296aPatrick McHardy{ 3120b63936140032deac44072951451bdf47b54296aPatrick McHardy va_list args; 3130b63936140032deac44072951451bdf47b54296aPatrick McHardy 3140b63936140032deac44072951451bdf47b54296aPatrick McHardy va_start(args, msg); 3155dd19de34380c91ad07bbe79a34726e59891cf54Jamal Hadi Salim fprintf(stderr, "%s v%s: ", prog_name, prog_vers); 3160b63936140032deac44072951451bdf47b54296aPatrick McHardy vfprintf(stderr, msg, args); 3170b63936140032deac44072951451bdf47b54296aPatrick McHardy va_end(args); 3180b63936140032deac44072951451bdf47b54296aPatrick McHardy fprintf(stderr, "\n"); 3190b63936140032deac44072951451bdf47b54296aPatrick McHardy if (status == PARAMETER_PROBLEM) 3200b63936140032deac44072951451bdf47b54296aPatrick McHardy exit_tryhelp(status); 3210b63936140032deac44072951451bdf47b54296aPatrick McHardy if (status == VERSION_PROBLEM) 3220b63936140032deac44072951451bdf47b54296aPatrick McHardy fprintf(stderr, 3230b63936140032deac44072951451bdf47b54296aPatrick McHardy "Perhaps iptables or your kernel needs to be upgraded.\n"); 3240b63936140032deac44072951451bdf47b54296aPatrick McHardy /* On error paths, make sure that we don't leak memory */ 325139b3fe4bd5121501e60fe07963ea527d7f0bd36Jamal Hadi Salim xtables_free_opts(1); 3260b63936140032deac44072951451bdf47b54296aPatrick McHardy exit(status); 3270b63936140032deac44072951451bdf47b54296aPatrick McHardy} 3280b63936140032deac44072951451bdf47b54296aPatrick McHardy 329e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherstatic void 330e6869a8f59d779ff4d5a0984c86d80db7078496Marc Bouchergeneric_opt_check(int command, int options) 331e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher{ 332e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher int i, j, legal = 0; 333e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 334e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher /* Check that commands are valid with options. Complicated by the 335e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher * fact that if an option is legal with *any* command given, it is 336e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher * legal overall (ie. -z and -l). 337e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher */ 338e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher for (i = 0; i < NUMBER_OF_OPT; i++) { 339e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher legal = 0; /* -1 => illegal, 1 => legal, 0 => undecided. */ 340e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 341e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher for (j = 0; j < NUMBER_OF_CMD; j++) { 342e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (!(command & (1<<j))) 343e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher continue; 344e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 345e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (!(options & (1<<i))) { 346e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (commands_v_options[j][i] == '+') 3471829ed482efbc8b390cc760d012b3a4450494e1aJan Engelhardt xtables_error(PARAMETER_PROBLEM, 348e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher "You need to supply the `-%c' " 349e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher "option for this command\n", 350e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher optflags[i]); 351e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } else { 352e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (commands_v_options[j][i] != 'x') 353e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher legal = 1; 354e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher else if (legal == 0) 355e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher legal = -1; 356e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } 357e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } 358e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (legal == -1) 3591829ed482efbc8b390cc760d012b3a4450494e1aJan Engelhardt xtables_error(PARAMETER_PROBLEM, 360e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher "Illegal option `-%c' with this command\n", 361e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher optflags[i]); 362e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } 363e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher} 364e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 365e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherstatic char 366e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucheropt2char(int option) 367e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher{ 368e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const char *ptr; 369e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher for (ptr = optflags; option > 1; option >>= 1, ptr++); 370e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 371e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher return *ptr; 372e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher} 373e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 374e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherstatic char 375e6869a8f59d779ff4d5a0984c86d80db7078496Marc Bouchercmd2char(int option) 376e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher{ 377e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const char *ptr; 378e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher for (ptr = cmdflags; option > 1; option >>= 1, ptr++); 379e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 380e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher return *ptr; 381e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher} 382e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 383e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherstatic void 384efa8fc2123a2a9fc229ab471edd2b2688ce1da3aHarald Welteadd_command(unsigned int *cmd, const int newcmd, const int othercmds, 385efa8fc2123a2a9fc229ab471edd2b2688ce1da3aHarald Welte int invert) 386e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher{ 387e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (invert) 3881829ed482efbc8b390cc760d012b3a4450494e1aJan Engelhardt xtables_error(PARAMETER_PROBLEM, "unexpected ! flag"); 389e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (*cmd & (~othercmds)) 3901829ed482efbc8b390cc760d012b3a4450494e1aJan Engelhardt xtables_error(PARAMETER_PROBLEM, "Cannot use -%c with -%c\n", 391e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher cmd2char(newcmd), cmd2char(*cmd & (~othercmds))); 392e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher *cmd |= newcmd; 393e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher} 394e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 395e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* 396e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher * All functions starting with "parse" should succeed, otherwise 397e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher * the program fails. 398e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher * Most routines return pointers to static data that may change 399e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher * between calls to the same or other routines with a few exceptions: 400e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher * "host_to_addr", "parse_hostnetwork", and "parse_hostnetworkmask" 401e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher * return global static data. 402e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher*/ 403e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 40428381a4a8da8c967938de3981644190219380de4Rusty Russell/* Christophe Burki wants `-p 6' to imply `-m tcp'. */ 405e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Can't be zero. */ 406e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherstatic int 407e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherparse_rulenumber(const char *rule) 408e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher{ 409ed498493949c34e4b3292e93b41cda6776b7915eHarald Welte unsigned int rulenum; 410e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 4115f2922cfc0bbfbeb878f5c12e9fb3eb602ae5507Jan Engelhardt if (!xtables_strtoui(rule, NULL, &rulenum, 1, INT_MAX)) 4121829ed482efbc8b390cc760d012b3a4450494e1aJan Engelhardt xtables_error(PARAMETER_PROBLEM, 413e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher "Invalid rule number `%s'", rule); 414e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 415e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher return rulenum; 416e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher} 417e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 418e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherstatic const char * 419e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherparse_target(const char *targetname) 420e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher{ 421e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const char *ptr; 422e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 423e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (strlen(targetname) < 1) 4241829ed482efbc8b390cc760d012b3a4450494e1aJan Engelhardt xtables_error(PARAMETER_PROBLEM, 425e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher "Invalid target name (too short)"); 426e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 4270cb675b8f18c4b074d4c69461638820708e98100Jan Engelhardt if (strlen(targetname) >= XT_EXTENSION_MAXNAMELEN) 4281829ed482efbc8b390cc760d012b3a4450494e1aJan Engelhardt xtables_error(PARAMETER_PROBLEM, 429a28d495285ad7dd9f286d63958cf20d74eec6bcbMartin Josefsson "Invalid target name `%s' (%u chars max)", 4300cb675b8f18c4b074d4c69461638820708e98100Jan Engelhardt targetname, XT_EXTENSION_MAXNAMELEN - 1); 431e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 432e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher for (ptr = targetname; *ptr; ptr++) 433e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (isspace(*ptr)) 4341829ed482efbc8b390cc760d012b3a4450494e1aJan Engelhardt xtables_error(PARAMETER_PROBLEM, 435e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher "Invalid target name `%s'", targetname); 436e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher return targetname; 437e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher} 438e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 439e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherstatic void 4407ac405297ec38449b30e3b05fd6bf2082fd3d803Jan Engelhardtset_option(unsigned int *options, unsigned int option, uint8_t *invflg, 441e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher int invert) 442e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher{ 443e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (*options & option) 4441829ed482efbc8b390cc760d012b3a4450494e1aJan Engelhardt xtables_error(PARAMETER_PROBLEM, "multiple -%c flags not allowed", 445e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher opt2char(option)); 446e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher *options |= option; 447e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 448e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (invert) { 449e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher unsigned int i; 450e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher for (i = 0; 1 << i != option; i++); 451e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 452e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (!inverse_for_options[i]) 4531829ed482efbc8b390cc760d012b3a4450494e1aJan Engelhardt xtables_error(PARAMETER_PROBLEM, 454e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher "cannot have ! before -%c", 455e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher opt2char(option)); 456e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher *invflg |= inverse_for_options[i]; 457e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } 458e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher} 459e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 460e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherstatic void 4617ac405297ec38449b30e3b05fd6bf2082fd3d803Jan Engelhardtprint_num(uint64_t number, unsigned int format) 462a0b4f797dc8227ebebd2de2568026e8f27cc4750Harald Welte{ 463a0b4f797dc8227ebebd2de2568026e8f27cc4750Harald Welte if (format & FMT_KILOMEGAGIGA) { 464a0b4f797dc8227ebebd2de2568026e8f27cc4750Harald Welte if (number > 99999) { 465a0b4f797dc8227ebebd2de2568026e8f27cc4750Harald Welte number = (number + 500) / 1000; 466a0b4f797dc8227ebebd2de2568026e8f27cc4750Harald Welte if (number > 9999) { 467a0b4f797dc8227ebebd2de2568026e8f27cc4750Harald Welte number = (number + 500) / 1000; 468a0b4f797dc8227ebebd2de2568026e8f27cc4750Harald Welte if (number > 9999) { 469a0b4f797dc8227ebebd2de2568026e8f27cc4750Harald Welte number = (number + 500) / 1000; 4705a66fe45d99351c7b96ea68595053a6be5a2529cRusty Russell if (number > 9999) { 4715a66fe45d99351c7b96ea68595053a6be5a2529cRusty Russell number = (number + 500) / 1000; 472a28d495285ad7dd9f286d63958cf20d74eec6bcbMartin Josefsson printf(FMT("%4lluT ","%lluT "), (unsigned long long)number); 4735a66fe45d99351c7b96ea68595053a6be5a2529cRusty Russell } 474a28d495285ad7dd9f286d63958cf20d74eec6bcbMartin Josefsson else printf(FMT("%4lluG ","%lluG "), (unsigned long long)number); 475a0b4f797dc8227ebebd2de2568026e8f27cc4750Harald Welte } 476a28d495285ad7dd9f286d63958cf20d74eec6bcbMartin Josefsson else printf(FMT("%4lluM ","%lluM "), (unsigned long long)number); 477a0b4f797dc8227ebebd2de2568026e8f27cc4750Harald Welte } else 478a28d495285ad7dd9f286d63958cf20d74eec6bcbMartin Josefsson printf(FMT("%4lluK ","%lluK "), (unsigned long long)number); 479a0b4f797dc8227ebebd2de2568026e8f27cc4750Harald Welte } else 480a28d495285ad7dd9f286d63958cf20d74eec6bcbMartin Josefsson printf(FMT("%5llu ","%llu "), (unsigned long long)number); 481a0b4f797dc8227ebebd2de2568026e8f27cc4750Harald Welte } else 482a28d495285ad7dd9f286d63958cf20d74eec6bcbMartin Josefsson printf(FMT("%8llu ","%llu "), (unsigned long long)number); 483a0b4f797dc8227ebebd2de2568026e8f27cc4750Harald Welte} 484a0b4f797dc8227ebebd2de2568026e8f27cc4750Harald Welte 485a0b4f797dc8227ebebd2de2568026e8f27cc4750Harald Welte 486a0b4f797dc8227ebebd2de2568026e8f27cc4750Harald Weltestatic void 4871c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardtprint_header(unsigned int format, const char *chain, struct iptc_handle *handle) 488e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher{ 489e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher struct ipt_counters counters; 490e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const char *pol = iptc_get_policy(chain, &counters, handle); 491e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher printf("Chain %s", chain); 492e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (pol) { 493e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher printf(" (policy %s", pol); 494a0b4f797dc8227ebebd2de2568026e8f27cc4750Harald Welte if (!(format & FMT_NOCOUNTS)) { 495a0b4f797dc8227ebebd2de2568026e8f27cc4750Harald Welte fputc(' ', stdout); 496a0b4f797dc8227ebebd2de2568026e8f27cc4750Harald Welte print_num(counters.pcnt, (format|FMT_NOTABLE)); 497a0b4f797dc8227ebebd2de2568026e8f27cc4750Harald Welte fputs("packets, ", stdout); 498a0b4f797dc8227ebebd2de2568026e8f27cc4750Harald Welte print_num(counters.bcnt, (format|FMT_NOTABLE)); 499a0b4f797dc8227ebebd2de2568026e8f27cc4750Harald Welte fputs("bytes", stdout); 500a0b4f797dc8227ebebd2de2568026e8f27cc4750Harald Welte } 501e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher printf(")\n"); 502e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } else { 503e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher unsigned int refs; 5049e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell if (!iptc_get_references(&refs, chain, handle)) 5059e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell printf(" (ERROR obtaining refs)\n"); 5069e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell else 5079e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell printf(" (%u references)\n", refs); 508e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } 509e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 510e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (format & FMT_LINENUMBERS) 511e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher printf(FMT("%-4s ", "%s "), "num"); 512e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (!(format & FMT_NOCOUNTS)) { 513e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (format & FMT_KILOMEGAGIGA) { 514e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher printf(FMT("%5s ","%s "), "pkts"); 515e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher printf(FMT("%5s ","%s "), "bytes"); 516e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } else { 517e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher printf(FMT("%8s ","%s "), "pkts"); 518e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher printf(FMT("%10s ","%s "), "bytes"); 519e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } 520e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } 521e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (!(format & FMT_NOTARGET)) 522e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher printf(FMT("%-9s ","%s "), "target"); 523e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher fputs(" prot ", stdout); 524e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (format & FMT_OPTIONS) 525e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher fputs("opt", stdout); 526e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (format & FMT_VIA) { 527e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher printf(FMT(" %-6s ","%s "), "in"); 528e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher printf(FMT("%-6s ","%s "), "out"); 529e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } 530e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher printf(FMT(" %-19s ","%s "), "source"); 531e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher printf(FMT(" %-19s "," %s "), "destination"); 532e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher printf("\n"); 533e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher} 534e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 535e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 536e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherstatic int 537e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherprint_match(const struct ipt_entry_match *m, 538e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const struct ipt_ip *ip, 539e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher int numeric) 540e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher{ 541d1435e0772e40c310dff35abe7bf1e7de5b18ee4Jan Engelhardt const struct xtables_match *match = 5422338efd8f799d8373dc196c797bda9690283b698Jan Engelhardt xtables_find_match(m->u.user.name, XTF_TRY_LOAD, NULL); 543e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 544e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (match) { 545e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (match->print) 546e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher match->print(ip, m, numeric); 547629149f7a8f145b760d1d53be22786b12e843083Rusty Russell else 548b039b02c20a321bb26350d0903a6a1137ba237baRusty Russell printf("%s ", match->name); 549e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } else { 550228e98dd6303af11925235af4cf3c3ec450f3f41Rusty Russell if (m->u.user.name[0]) 551228e98dd6303af11925235af4cf3c3ec450f3f41Rusty Russell printf("UNKNOWN match `%s' ", m->u.user.name); 552e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } 553e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher /* Don't stop iterating. */ 554e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher return 0; 555e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher} 556e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 5576cf172ed4064df729ca83eb71133741dfbd6c6e7Jan Engelhardt/* e is called `fw' here for historical reasons */ 558e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherstatic void 559e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherprint_firewall(const struct ipt_entry *fw, 560e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const char *targname, 561e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher unsigned int num, 562e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher unsigned int format, 563fd1873110f8e57be578df17fc9d03536b10f4f73Jan Engelhardt struct iptc_handle *const handle) 564e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher{ 565d1435e0772e40c310dff35abe7bf1e7de5b18ee4Jan Engelhardt const struct xtables_target *target = NULL; 566e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const struct ipt_entry_target *t; 5677ac405297ec38449b30e3b05fd6bf2082fd3d803Jan Engelhardt uint8_t flags; 568e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher char buf[BUFSIZ]; 569e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 570e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (!iptc_is_chain(targname, handle)) 5712338efd8f799d8373dc196c797bda9690283b698Jan Engelhardt target = xtables_find_target(targname, XTF_TRY_LOAD); 572e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher else 5732338efd8f799d8373dc196c797bda9690283b698Jan Engelhardt target = xtables_find_target(IPT_STANDARD_TARGET, 5742338efd8f799d8373dc196c797bda9690283b698Jan Engelhardt XTF_LOAD_MUST_SUCCEED); 575e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 576e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher t = ipt_get_target((struct ipt_entry *)fw); 577e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher flags = fw->ip.flags; 578e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 579e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (format & FMT_LINENUMBERS) 5801564189568fb63292c7f586563d4fda430a40de3Henrik Nordstrom printf(FMT("%-4u ", "%u "), num); 581e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 582e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (!(format & FMT_NOCOUNTS)) { 583e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher print_num(fw->counters.pcnt, format); 584e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher print_num(fw->counters.bcnt, format); 585e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } 586e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 587e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (!(format & FMT_NOTARGET)) 588e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher printf(FMT("%-9s ", "%s "), targname); 589e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 590e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher fputc(fw->ip.invflags & IPT_INV_PROTO ? '!' : ' ', stdout); 591e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher { 5921de7edffc9085c0f41c261dca995e28ae4126c29Jan Engelhardt const char *pname = proto_to_name(fw->ip.proto, format&FMT_NUMERIC); 593e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (pname) 594e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher printf(FMT("%-5s", "%s "), pname); 595e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher else 596e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher printf(FMT("%-5hu", "%hu "), fw->ip.proto); 597e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } 598e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 599e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (format & FMT_OPTIONS) { 600e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (format & FMT_NOTABLE) 601e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher fputs("opt ", stdout); 602e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher fputc(fw->ip.invflags & IPT_INV_FRAG ? '!' : '-', stdout); 603e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher fputc(flags & IPT_F_FRAG ? 'f' : '-', stdout); 604e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher fputc(' ', stdout); 605e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } 606e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 607e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (format & FMT_VIA) { 608e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher char iface[IFNAMSIZ+2]; 609e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 610e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (fw->ip.invflags & IPT_INV_VIA_IN) { 611e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher iface[0] = '!'; 612e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher iface[1] = '\0'; 613e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } 614e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher else iface[0] = '\0'; 615e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 616e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (fw->ip.iniface[0] != '\0') { 617e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher strcat(iface, fw->ip.iniface); 618e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } 619e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher else if (format & FMT_NUMERIC) strcat(iface, "*"); 620e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher else strcat(iface, "any"); 621e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher printf(FMT(" %-6s ","in %s "), iface); 622e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 623e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (fw->ip.invflags & IPT_INV_VIA_OUT) { 624e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher iface[0] = '!'; 625e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher iface[1] = '\0'; 626e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } 627e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher else iface[0] = '\0'; 628e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 629e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (fw->ip.outiface[0] != '\0') { 630e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher strcat(iface, fw->ip.outiface); 631e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } 632e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher else if (format & FMT_NUMERIC) strcat(iface, "*"); 633e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher else strcat(iface, "any"); 634e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher printf(FMT("%-6s ","out %s "), iface); 635e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } 636e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 637e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher fputc(fw->ip.invflags & IPT_INV_SRCIP ? '!' : ' ', stdout); 638e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (fw->ip.smsk.s_addr == 0L && !(format & FMT_NUMERIC)) 639e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher printf(FMT("%-19s ","%s "), "anywhere"); 640e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher else { 641e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (format & FMT_NUMERIC) 642e44ea7faa17c10c68f14f5338a7cc6e3291a0ce7Jan Engelhardt strcpy(buf, xtables_ipaddr_to_numeric(&fw->ip.src)); 643e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher else 644e44ea7faa17c10c68f14f5338a7cc6e3291a0ce7Jan Engelhardt strcpy(buf, xtables_ipaddr_to_anyname(&fw->ip.src)); 645e44ea7faa17c10c68f14f5338a7cc6e3291a0ce7Jan Engelhardt strcat(buf, xtables_ipmask_to_numeric(&fw->ip.smsk)); 646e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher printf(FMT("%-19s ","%s "), buf); 647e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } 648e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 649e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher fputc(fw->ip.invflags & IPT_INV_DSTIP ? '!' : ' ', stdout); 650e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (fw->ip.dmsk.s_addr == 0L && !(format & FMT_NUMERIC)) 65125fc1d7c9ff5df951346d6cf07b24ea8a2f376acHarald Welte printf(FMT("%-19s ","-> %s"), "anywhere"); 652e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher else { 653e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (format & FMT_NUMERIC) 654e44ea7faa17c10c68f14f5338a7cc6e3291a0ce7Jan Engelhardt strcpy(buf, xtables_ipaddr_to_numeric(&fw->ip.dst)); 655e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher else 656e44ea7faa17c10c68f14f5338a7cc6e3291a0ce7Jan Engelhardt strcpy(buf, xtables_ipaddr_to_anyname(&fw->ip.dst)); 657e44ea7faa17c10c68f14f5338a7cc6e3291a0ce7Jan Engelhardt strcat(buf, xtables_ipmask_to_numeric(&fw->ip.dmsk)); 65825fc1d7c9ff5df951346d6cf07b24ea8a2f376acHarald Welte printf(FMT("%-19s ","-> %s"), buf); 659e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } 660e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 661e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (format & FMT_NOTABLE) 662e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher fputs(" ", stdout); 663e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 66472bd87e13b76818f5c690a9097080123ff698bc2Harald Welte#ifdef IPT_F_GOTO 66517fc163babc348780bae4321071845748f7b7985Henrik Nordstrom if(fw->ip.flags & IPT_F_GOTO) 66617fc163babc348780bae4321071845748f7b7985Henrik Nordstrom printf("[goto] "); 66772bd87e13b76818f5c690a9097080123ff698bc2Harald Welte#endif 66817fc163babc348780bae4321071845748f7b7985Henrik Nordstrom 669e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher IPT_MATCH_ITERATE(fw, print_match, &fw->ip, format & FMT_NUMERIC); 670e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 671e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (target) { 672e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (target->print) 673e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher /* Print the target information. */ 674e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher target->print(&fw->ip, t, format & FMT_NUMERIC); 675228e98dd6303af11925235af4cf3c3ec450f3f41Rusty Russell } else if (t->u.target_size != sizeof(*t)) 676e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher printf("[%u bytes of unknown target data] ", 677a28d495285ad7dd9f286d63958cf20d74eec6bcbMartin Josefsson (unsigned int)(t->u.target_size - sizeof(*t))); 678e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 679e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (!(format & FMT_NONEWLINE)) 680e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher fputc('\n', stdout); 681e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher} 682e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 683e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherstatic void 684e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherprint_firewall_line(const struct ipt_entry *fw, 685fd1873110f8e57be578df17fc9d03536b10f4f73Jan Engelhardt struct iptc_handle *const h) 686e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher{ 687e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher struct ipt_entry_target *t; 688e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 689e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher t = ipt_get_target((struct ipt_entry *)fw); 690228e98dd6303af11925235af4cf3c3ec450f3f41Rusty Russell print_firewall(fw, t->u.user.name, 0, FMT_PRINT_RULE, h); 691e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher} 692e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 693e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherstatic int 694e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherappend_entry(const ipt_chainlabel chain, 695e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher struct ipt_entry *fw, 696e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher unsigned int nsaddrs, 697e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const struct in_addr saddrs[], 698332e4acc574e3a348fe611d55bf642de0d50fbdaMichael Granzow const struct in_addr smasks[], 699e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher unsigned int ndaddrs, 700e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const struct in_addr daddrs[], 701332e4acc574e3a348fe611d55bf642de0d50fbdaMichael Granzow const struct in_addr dmasks[], 702e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher int verbose, 7031c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle) 704e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher{ 705e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher unsigned int i, j; 706e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher int ret = 1; 707e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 708e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher for (i = 0; i < nsaddrs; i++) { 709e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher fw->ip.src.s_addr = saddrs[i].s_addr; 710332e4acc574e3a348fe611d55bf642de0d50fbdaMichael Granzow fw->ip.smsk.s_addr = smasks[i].s_addr; 711e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher for (j = 0; j < ndaddrs; j++) { 712e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher fw->ip.dst.s_addr = daddrs[j].s_addr; 713332e4acc574e3a348fe611d55bf642de0d50fbdaMichael Granzow fw->ip.dmsk.s_addr = dmasks[j].s_addr; 714e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (verbose) 7151c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt print_firewall_line(fw, handle); 716e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher ret &= iptc_append_entry(chain, fw, handle); 717e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } 718e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } 719e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 720e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher return ret; 721e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher} 722e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 723e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherstatic int 724e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherreplace_entry(const ipt_chainlabel chain, 725e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher struct ipt_entry *fw, 726e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher unsigned int rulenum, 72775cb763b54a89bf9b9c61740c760abce89df06f3Jan Engelhardt const struct in_addr *saddr, const struct in_addr *smask, 72875cb763b54a89bf9b9c61740c760abce89df06f3Jan Engelhardt const struct in_addr *daddr, const struct in_addr *dmask, 729e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher int verbose, 7301c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle) 731e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher{ 732e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher fw->ip.src.s_addr = saddr->s_addr; 733e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher fw->ip.dst.s_addr = daddr->s_addr; 73475cb763b54a89bf9b9c61740c760abce89df06f3Jan Engelhardt fw->ip.smsk.s_addr = smask->s_addr; 73575cb763b54a89bf9b9c61740c760abce89df06f3Jan Engelhardt fw->ip.dmsk.s_addr = dmask->s_addr; 736e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 737e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (verbose) 7381c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt print_firewall_line(fw, handle); 739e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher return iptc_replace_entry(chain, fw, rulenum, handle); 740e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher} 741e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 742e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherstatic int 743e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherinsert_entry(const ipt_chainlabel chain, 744e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher struct ipt_entry *fw, 745e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher unsigned int rulenum, 746e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher unsigned int nsaddrs, 747e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const struct in_addr saddrs[], 748332e4acc574e3a348fe611d55bf642de0d50fbdaMichael Granzow const struct in_addr smasks[], 749e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher unsigned int ndaddrs, 750e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const struct in_addr daddrs[], 751332e4acc574e3a348fe611d55bf642de0d50fbdaMichael Granzow const struct in_addr dmasks[], 752e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher int verbose, 7531c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle) 754e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher{ 755e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher unsigned int i, j; 756e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher int ret = 1; 757e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 758e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher for (i = 0; i < nsaddrs; i++) { 759e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher fw->ip.src.s_addr = saddrs[i].s_addr; 760332e4acc574e3a348fe611d55bf642de0d50fbdaMichael Granzow fw->ip.smsk.s_addr = smasks[i].s_addr; 761e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher for (j = 0; j < ndaddrs; j++) { 762e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher fw->ip.dst.s_addr = daddrs[j].s_addr; 763332e4acc574e3a348fe611d55bf642de0d50fbdaMichael Granzow fw->ip.dmsk.s_addr = dmasks[j].s_addr; 764e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (verbose) 7651c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt print_firewall_line(fw, handle); 766e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher ret &= iptc_insert_entry(chain, fw, rulenum, handle); 767e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } 768e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } 769e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 770e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher return ret; 771e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher} 772e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 7732e0a3216c501753709781769f83e29821e62c805Rusty Russellstatic unsigned char * 774d1435e0772e40c310dff35abe7bf1e7de5b18ee4Jan Engelhardtmake_delete_mask(const struct xtables_rule_match *matches, 7754f0d7b660e0ae8f678142fd2a1722b27ad472169Jan Engelhardt const struct xtables_target *target) 7762e0a3216c501753709781769f83e29821e62c805Rusty Russell{ 7772e0a3216c501753709781769f83e29821e62c805Rusty Russell /* Establish mask for comparison */ 7782e0a3216c501753709781769f83e29821e62c805Rusty Russell unsigned int size; 779d1435e0772e40c310dff35abe7bf1e7de5b18ee4Jan Engelhardt const struct xtables_rule_match *matchp; 7802e0a3216c501753709781769f83e29821e62c805Rusty Russell unsigned char *mask, *mptr; 7812e0a3216c501753709781769f83e29821e62c805Rusty Russell 7822e0a3216c501753709781769f83e29821e62c805Rusty Russell size = sizeof(struct ipt_entry); 78378cafdaf474a333fa39efab4aa4c9aed88ab9518Martin Josefsson for (matchp = matches; matchp; matchp = matchp->next) 78478cafdaf474a333fa39efab4aa4c9aed88ab9518Martin Josefsson size += IPT_ALIGN(sizeof(struct ipt_entry_match)) + matchp->match->size; 7852e0a3216c501753709781769f83e29821e62c805Rusty Russell 786630ef48037f3602333addfdb53789c9c6a4bb4c8Jan Engelhardt mask = xtables_calloc(1, size 78773f72f541ac4dab538d4d418b9bbf1707b31342bRusty Russell + IPT_ALIGN(sizeof(struct ipt_entry_target)) 7884f0d7b660e0ae8f678142fd2a1722b27ad472169Jan Engelhardt + target->size); 7892e0a3216c501753709781769f83e29821e62c805Rusty Russell 7909e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell memset(mask, 0xFF, sizeof(struct ipt_entry)); 7919e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell mptr = mask + sizeof(struct ipt_entry); 7922e0a3216c501753709781769f83e29821e62c805Rusty Russell 79378cafdaf474a333fa39efab4aa4c9aed88ab9518Martin Josefsson for (matchp = matches; matchp; matchp = matchp->next) { 7942e0a3216c501753709781769f83e29821e62c805Rusty Russell memset(mptr, 0xFF, 79573f72f541ac4dab538d4d418b9bbf1707b31342bRusty Russell IPT_ALIGN(sizeof(struct ipt_entry_match)) 79678cafdaf474a333fa39efab4aa4c9aed88ab9518Martin Josefsson + matchp->match->userspacesize); 79778cafdaf474a333fa39efab4aa4c9aed88ab9518Martin Josefsson mptr += IPT_ALIGN(sizeof(struct ipt_entry_match)) + matchp->match->size; 7982e0a3216c501753709781769f83e29821e62c805Rusty Russell } 7992e0a3216c501753709781769f83e29821e62c805Rusty Russell 800a4d3e1fea254d63a2dd0e32bf6d70fa0f39159bcRusty Russell memset(mptr, 0xFF, 80173f72f541ac4dab538d4d418b9bbf1707b31342bRusty Russell IPT_ALIGN(sizeof(struct ipt_entry_target)) 8024f0d7b660e0ae8f678142fd2a1722b27ad472169Jan Engelhardt + target->userspacesize); 8032e0a3216c501753709781769f83e29821e62c805Rusty Russell 8042e0a3216c501753709781769f83e29821e62c805Rusty Russell return mask; 8052e0a3216c501753709781769f83e29821e62c805Rusty Russell} 8062e0a3216c501753709781769f83e29821e62c805Rusty Russell 807e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherstatic int 808e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherdelete_entry(const ipt_chainlabel chain, 809e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher struct ipt_entry *fw, 810e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher unsigned int nsaddrs, 811e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const struct in_addr saddrs[], 812332e4acc574e3a348fe611d55bf642de0d50fbdaMichael Granzow const struct in_addr smasks[], 813e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher unsigned int ndaddrs, 814e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const struct in_addr daddrs[], 815332e4acc574e3a348fe611d55bf642de0d50fbdaMichael Granzow const struct in_addr dmasks[], 816e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher int verbose, 8171c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle, 8184f0d7b660e0ae8f678142fd2a1722b27ad472169Jan Engelhardt struct xtables_rule_match *matches, 8194f0d7b660e0ae8f678142fd2a1722b27ad472169Jan Engelhardt const struct xtables_target *target) 820e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher{ 821e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher unsigned int i, j; 822e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher int ret = 1; 8232e0a3216c501753709781769f83e29821e62c805Rusty Russell unsigned char *mask; 824e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 8254f0d7b660e0ae8f678142fd2a1722b27ad472169Jan Engelhardt mask = make_delete_mask(matches, target); 826e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher for (i = 0; i < nsaddrs; i++) { 827e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher fw->ip.src.s_addr = saddrs[i].s_addr; 828332e4acc574e3a348fe611d55bf642de0d50fbdaMichael Granzow fw->ip.smsk.s_addr = smasks[i].s_addr; 829e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher for (j = 0; j < ndaddrs; j++) { 830e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher fw->ip.dst.s_addr = daddrs[j].s_addr; 831332e4acc574e3a348fe611d55bf642de0d50fbdaMichael Granzow fw->ip.dmsk.s_addr = dmasks[j].s_addr; 832e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (verbose) 8331c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt print_firewall_line(fw, handle); 8342e0a3216c501753709781769f83e29821e62c805Rusty Russell ret &= iptc_delete_entry(chain, fw, mask, handle); 835e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } 836e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } 8374dd5fedadee415a646bc0e70d0b17668897ede63Martin Josefsson free(mask); 8384dd5fedadee415a646bc0e70d0b17668897ede63Martin Josefsson 839e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher return ret; 840e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher} 841e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 842ae1ff9f96a80379a650dec979b9902528a10d45aHarald Welteint 8431c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardtfor_each_chain(int (*fn)(const ipt_chainlabel, int, struct iptc_handle *), 8441c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt int verbose, int builtinstoo, struct iptc_handle *handle) 845e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher{ 846e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher int ret = 1; 8479e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell const char *chain; 8489e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell char *chains; 8499e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell unsigned int i, chaincount = 0; 8509e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell 8519e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell chain = iptc_first_chain(handle); 8529e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell while (chain) { 8539e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell chaincount++; 8549e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell chain = iptc_next_chain(handle); 8559e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell } 856e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 857630ef48037f3602333addfdb53789c9c6a4bb4c8Jan Engelhardt chains = xtables_malloc(sizeof(ipt_chainlabel) * chaincount); 8589e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell i = 0; 8599e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell chain = iptc_first_chain(handle); 8609e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell while (chain) { 8619e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell strcpy(chains + i*sizeof(ipt_chainlabel), chain); 8629e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell i++; 8639e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell chain = iptc_next_chain(handle); 864e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } 865e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 8669e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell for (i = 0; i < chaincount; i++) { 8679e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell if (!builtinstoo 8689e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell && iptc_builtin(chains + i*sizeof(ipt_chainlabel), 8691c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt handle) == 1) 8709e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell continue; 8719e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell ret &= fn(chains + i*sizeof(ipt_chainlabel), verbose, handle); 8729e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell } 8739e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell 8749e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell free(chains); 875e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher return ret; 876e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher} 877e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 878ae1ff9f96a80379a650dec979b9902528a10d45aHarald Welteint 879e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherflush_entries(const ipt_chainlabel chain, int verbose, 8801c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle) 881e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher{ 882e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (!chain) 8839e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell return for_each_chain(flush_entries, verbose, 1, handle); 8847e53bf9c2a697abdb6f1385557338423a86612a3Rusty Russell 8857e53bf9c2a697abdb6f1385557338423a86612a3Rusty Russell if (verbose) 8867e53bf9c2a697abdb6f1385557338423a86612a3Rusty Russell fprintf(stdout, "Flushing chain `%s'\n", chain); 8877e53bf9c2a697abdb6f1385557338423a86612a3Rusty Russell return iptc_flush_entries(chain, handle); 8887e53bf9c2a697abdb6f1385557338423a86612a3Rusty Russell} 889e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 890e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherstatic int 891e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherzero_entries(const ipt_chainlabel chain, int verbose, 8921c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle) 893e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher{ 894e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (!chain) 8959e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell return for_each_chain(zero_entries, verbose, 1, handle); 8967e53bf9c2a697abdb6f1385557338423a86612a3Rusty Russell 897e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (verbose) 898e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher fprintf(stdout, "Zeroing chain `%s'\n", chain); 899e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher return iptc_zero_entries(chain, handle); 900e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher} 901e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 902ae1ff9f96a80379a650dec979b9902528a10d45aHarald Welteint 903e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherdelete_chain(const ipt_chainlabel chain, int verbose, 9041c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle) 905e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher{ 9069e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell if (!chain) 9079e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell return for_each_chain(delete_chain, verbose, 0, handle); 908e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 909e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (verbose) 9105b76f682f722bebc2f0616fca4600eee2c08dfe2Max Kellermann fprintf(stdout, "Deleting chain `%s'\n", chain); 911e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher return iptc_delete_chain(chain, handle); 912e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher} 913e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 914e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherstatic int 915bb34082de25ec7fb6bffe5702062f087ca887466Henrik Nordstromlist_entries(const ipt_chainlabel chain, int rulenum, int verbose, int numeric, 9161c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt int expanded, int linenumbers, struct iptc_handle *handle) 917e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher{ 918e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher int found = 0; 9199e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell unsigned int format; 9209e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell const char *this; 921e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 922e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher format = FMT_OPTIONS; 923e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (!verbose) 924e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher format |= FMT_NOCOUNTS; 925e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher else 926e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher format |= FMT_VIA; 927e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 928e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (numeric) 929e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher format |= FMT_NUMERIC; 930e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 931e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (!expanded) 932e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher format |= FMT_KILOMEGAGIGA; 933e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 934e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (linenumbers) 935e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher format |= FMT_LINENUMBERS; 936e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 9379e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell for (this = iptc_first_chain(handle); 9389e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell this; 9399e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell this = iptc_next_chain(handle)) { 9409e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell const struct ipt_entry *i; 9419e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell unsigned int num; 942e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 943e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (chain && strcmp(chain, this) != 0) 944e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher continue; 945e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 946e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (found) printf("\n"); 947e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 948bb34082de25ec7fb6bffe5702062f087ca887466Henrik Nordstrom if (!rulenum) 949bb34082de25ec7fb6bffe5702062f087ca887466Henrik Nordstrom print_header(format, this, handle); 9509e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell i = iptc_first_rule(this, handle); 9519e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell 9529e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell num = 0; 9539e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell while (i) { 954bb34082de25ec7fb6bffe5702062f087ca887466Henrik Nordstrom num++; 955bb34082de25ec7fb6bffe5702062f087ca887466Henrik Nordstrom if (!rulenum || num == rulenum) 956bb34082de25ec7fb6bffe5702062f087ca887466Henrik Nordstrom print_firewall(i, 957bb34082de25ec7fb6bffe5702062f087ca887466Henrik Nordstrom iptc_get_target(i, handle), 958bb34082de25ec7fb6bffe5702062f087ca887466Henrik Nordstrom num, 959bb34082de25ec7fb6bffe5702062f087ca887466Henrik Nordstrom format, 9601c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt handle); 9619e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell i = iptc_next_rule(i, handle); 9629e1d214b30b916df55b4c1c5db224200f02e15a5Rusty Russell } 963e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher found = 1; 964e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } 965e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 966e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher errno = ENOENT; 967e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher return found; 968e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher} 969e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 9707ac405297ec38449b30e3b05fd6bf2082fd3d803Jan Engelhardtstatic void print_proto(uint16_t proto, int invert) 97196296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom{ 97296296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom if (proto) { 97396296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom unsigned int i; 97473866357e4a7a0fdc1b293bf8863fee2bd56da9eJan Engelhardt const char *invertstr = invert ? " !" : ""; 97596296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom 976d1435e0772e40c310dff35abe7bf1e7de5b18ee4Jan Engelhardt const struct protoent *pent = getprotobynumber(proto); 97796296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom if (pent) { 97873866357e4a7a0fdc1b293bf8863fee2bd56da9eJan Engelhardt printf("%s -p %s", invertstr, pent->p_name); 97996296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom return; 98096296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom } 98196296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom 9821de7edffc9085c0f41c261dca995e28ae4126c29Jan Engelhardt for (i = 0; xtables_chain_protos[i].name != NULL; ++i) 9831de7edffc9085c0f41c261dca995e28ae4126c29Jan Engelhardt if (xtables_chain_protos[i].num == proto) { 98473866357e4a7a0fdc1b293bf8863fee2bd56da9eJan Engelhardt printf("%s -p %s", 9851de7edffc9085c0f41c261dca995e28ae4126c29Jan Engelhardt invertstr, xtables_chain_protos[i].name); 98696296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom return; 98796296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom } 98896296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom 98973866357e4a7a0fdc1b293bf8863fee2bd56da9eJan Engelhardt printf("%s -p %u", invertstr, proto); 99096296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom } 99196296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom} 99296296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom 99396296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom#define IP_PARTS_NATIVE(n) \ 99496296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom(unsigned int)((n)>>24)&0xFF, \ 99596296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom(unsigned int)((n)>>16)&0xFF, \ 99696296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom(unsigned int)((n)>>8)&0xFF, \ 99796296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom(unsigned int)((n)&0xFF) 99896296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom 99996296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom#define IP_PARTS(n) IP_PARTS_NATIVE(ntohl(n)) 100096296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom 100196296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom/* This assumes that mask is contiguous, and byte-bounded. */ 100296296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstromstatic void 100396296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstromprint_iface(char letter, const char *iface, const unsigned char *mask, 100496296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom int invert) 100596296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom{ 100696296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom unsigned int i; 100796296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom 100896296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom if (mask[0] == 0) 100996296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom return; 101096296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom 101173866357e4a7a0fdc1b293bf8863fee2bd56da9eJan Engelhardt printf("%s -%c ", invert ? " !" : "", letter); 101296296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom 101396296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom for (i = 0; i < IFNAMSIZ; i++) { 101496296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom if (mask[i] != 0) { 101596296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom if (iface[i] != '\0') 101696296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom printf("%c", iface[i]); 101796296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom } else { 101896296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom /* we can access iface[i-1] here, because 101996296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom * a few lines above we make sure that mask[0] != 0 */ 102096296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom if (iface[i-1] != '\0') 102196296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom printf("+"); 102296296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom break; 102396296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom } 102496296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom } 102596296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom} 102696296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom 102796296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstromstatic int print_match_save(const struct ipt_entry_match *e, 102896296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom const struct ipt_ip *ip) 102996296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom{ 1030d1435e0772e40c310dff35abe7bf1e7de5b18ee4Jan Engelhardt const struct xtables_match *match = 10312338efd8f799d8373dc196c797bda9690283b698Jan Engelhardt xtables_find_match(e->u.user.name, XTF_TRY_LOAD, NULL); 103296296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom 103396296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom if (match) { 103473866357e4a7a0fdc1b293bf8863fee2bd56da9eJan Engelhardt printf(" -m %s", e->u.user.name); 103596296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom 103696296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom /* some matches don't provide a save function */ 103796296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom if (match->save) 103896296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom match->save(ip, e); 103996296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom } else { 104096296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom if (e->u.match_size) { 104196296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom fprintf(stderr, 104296296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom "Can't find library for match `%s'\n", 104396296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom e->u.user.name); 104496296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom exit(1); 104596296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom } 104696296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom } 104796296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom return 0; 104896296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom} 104996296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom 105096296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom/* print a given ip including mask if neccessary */ 10517ac405297ec38449b30e3b05fd6bf2082fd3d803Jan Engelhardtstatic void print_ip(const char *prefix, uint32_t ip, 10527ac405297ec38449b30e3b05fd6bf2082fd3d803Jan Engelhardt uint32_t mask, int invert) 105396296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom{ 10547ac405297ec38449b30e3b05fd6bf2082fd3d803Jan Engelhardt uint32_t bits, hmask = ntohl(mask); 105596296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom int i; 105696296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom 105796296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom if (!mask && !ip && !invert) 105896296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom return; 105996296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom 106073866357e4a7a0fdc1b293bf8863fee2bd56da9eJan Engelhardt printf("%s %s %u.%u.%u.%u", 106173866357e4a7a0fdc1b293bf8863fee2bd56da9eJan Engelhardt invert ? " !" : "", 1062b1d968c30dde563c2738fdacb723c18232fb5ccbJan Engelhardt prefix, 106396296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom IP_PARTS(ip)); 106496296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom 106596296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom if (mask == 0xFFFFFFFFU) { 106673866357e4a7a0fdc1b293bf8863fee2bd56da9eJan Engelhardt printf("/32"); 106796296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom return; 106896296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom } 106996296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom 107096296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom i = 32; 107196296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom bits = 0xFFFFFFFEU; 107296296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom while (--i >= 0 && hmask != bits) 107396296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom bits <<= 1; 107496296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom if (i >= 0) 107573866357e4a7a0fdc1b293bf8863fee2bd56da9eJan Engelhardt printf("/%u", i); 107696296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom else 107773866357e4a7a0fdc1b293bf8863fee2bd56da9eJan Engelhardt printf("/%u.%u.%u.%u", IP_PARTS(mask)); 107896296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom} 107996296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom 108096296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom/* We want this to be readable, so only print out neccessary fields. 108196296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom * Because that's the kind of world I want to live in. */ 108296296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstromvoid print_rule(const struct ipt_entry *e, 10831c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *h, const char *chain, int counters) 108496296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom{ 1085d1435e0772e40c310dff35abe7bf1e7de5b18ee4Jan Engelhardt const struct ipt_entry_target *t; 108696296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom const char *target_name; 108796296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom 108896296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom /* print counters for iptables-save */ 108996296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom if (counters > 0) 109096296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom printf("[%llu:%llu] ", (unsigned long long)e->counters.pcnt, (unsigned long long)e->counters.bcnt); 109196296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom 109296296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom /* print chain name */ 109373866357e4a7a0fdc1b293bf8863fee2bd56da9eJan Engelhardt printf("-A %s", chain); 109496296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom 109596296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom /* Print IP part. */ 109696296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom print_ip("-s", e->ip.src.s_addr,e->ip.smsk.s_addr, 109796296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom e->ip.invflags & IPT_INV_SRCIP); 109896296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom 109996296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom print_ip("-d", e->ip.dst.s_addr, e->ip.dmsk.s_addr, 110096296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom e->ip.invflags & IPT_INV_DSTIP); 110196296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom 110296296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom print_iface('i', e->ip.iniface, e->ip.iniface_mask, 110396296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom e->ip.invflags & IPT_INV_VIA_IN); 110496296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom 110596296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom print_iface('o', e->ip.outiface, e->ip.outiface_mask, 110696296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom e->ip.invflags & IPT_INV_VIA_OUT); 110796296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom 110896296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom print_proto(e->ip.proto, e->ip.invflags & IPT_INV_PROTO); 110996296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom 111096296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom if (e->ip.flags & IPT_F_FRAG) 111173866357e4a7a0fdc1b293bf8863fee2bd56da9eJan Engelhardt printf("%s -f", 111273866357e4a7a0fdc1b293bf8863fee2bd56da9eJan Engelhardt e->ip.invflags & IPT_INV_FRAG ? " !" : ""); 111396296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom 111496296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom /* Print matchinfo part */ 111596296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom if (e->target_offset) { 111696296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom IPT_MATCH_ITERATE(e, print_match_save, &e->ip); 111796296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom } 111896296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom 111996296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom /* print counters for iptables -R */ 112096296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom if (counters < 0) 112173866357e4a7a0fdc1b293bf8863fee2bd56da9eJan Engelhardt printf(" -c %llu %llu", (unsigned long long)e->counters.pcnt, (unsigned long long)e->counters.bcnt); 112296296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom 112396296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom /* Print target name */ 112496296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom target_name = iptc_get_target(e, h); 112596296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom if (target_name && (*target_name != '\0')) 112696296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom#ifdef IPT_F_GOTO 112773866357e4a7a0fdc1b293bf8863fee2bd56da9eJan Engelhardt printf(" -%c %s", e->ip.flags & IPT_F_GOTO ? 'g' : 'j', target_name); 112896296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom#else 112973866357e4a7a0fdc1b293bf8863fee2bd56da9eJan Engelhardt printf(" -j %s", target_name); 113096296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom#endif 113196296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom 113296296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom /* Print targinfo part */ 113396296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom t = ipt_get_target((struct ipt_entry *)e); 113496296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom if (t->u.user.name[0]) { 1135d1435e0772e40c310dff35abe7bf1e7de5b18ee4Jan Engelhardt const struct xtables_target *target = 11362338efd8f799d8373dc196c797bda9690283b698Jan Engelhardt xtables_find_target(t->u.user.name, XTF_TRY_LOAD); 113796296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom 113896296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom if (!target) { 113996296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom fprintf(stderr, "Can't find library for target `%s'\n", 114096296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom t->u.user.name); 114196296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom exit(1); 114296296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom } 114396296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom 114496296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom if (target->save) 114596296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom target->save(&e->ip, t); 114696296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom else { 114796296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom /* If the target size is greater than ipt_entry_target 114896296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom * there is something to be saved, we just don't know 114996296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom * how to print it */ 115096296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom if (t->u.target_size != 115196296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom sizeof(struct ipt_entry_target)) { 115296296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom fprintf(stderr, "Target `%s' is missing " 115396296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom "save function\n", 115496296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom t->u.user.name); 115596296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom exit(1); 115696296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom } 115796296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom } 115896296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom } 115996296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom printf("\n"); 116096296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom} 116196296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom 116296296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstromstatic int 1163bb34082de25ec7fb6bffe5702062f087ca887466Henrik Nordstromlist_rules(const ipt_chainlabel chain, int rulenum, int counters, 11641c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt struct iptc_handle *handle) 116596296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom{ 116696296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom const char *this = NULL; 116796296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom int found = 0; 116896296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom 116996296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom if (counters) 117096296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom counters = -1; /* iptables -c format */ 117196296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom 117296296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom /* Dump out chain names first, 117396296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom * thereby preventing dependency conflicts */ 1174bb34082de25ec7fb6bffe5702062f087ca887466Henrik Nordstrom if (!rulenum) for (this = iptc_first_chain(handle); 117596296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom this; 117696296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom this = iptc_next_chain(handle)) { 117796296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom if (chain && strcmp(this, chain) != 0) 117896296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom continue; 117996296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom 11801c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt if (iptc_builtin(this, handle)) { 118196296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom struct ipt_counters count; 118296296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom printf("-P %s %s", this, iptc_get_policy(this, &count, handle)); 118396296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom if (counters) 118496296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom printf(" -c %llu %llu", (unsigned long long)count.pcnt, (unsigned long long)count.bcnt); 118596296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom printf("\n"); 118696296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom } else { 118796296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom printf("-N %s\n", this); 118896296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom } 118996296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom } 119096296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom 119196296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom for (this = iptc_first_chain(handle); 119296296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom this; 119396296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom this = iptc_next_chain(handle)) { 119496296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom const struct ipt_entry *e; 1195bb34082de25ec7fb6bffe5702062f087ca887466Henrik Nordstrom int num = 0; 119696296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom 119796296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom if (chain && strcmp(this, chain) != 0) 119896296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom continue; 119996296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom 120096296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom /* Dump out rules */ 120196296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom e = iptc_first_rule(this, handle); 120296296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom while(e) { 1203bb34082de25ec7fb6bffe5702062f087ca887466Henrik Nordstrom num++; 1204bb34082de25ec7fb6bffe5702062f087ca887466Henrik Nordstrom if (!rulenum || num == rulenum) 1205bb34082de25ec7fb6bffe5702062f087ca887466Henrik Nordstrom print_rule(e, handle, this, counters); 120696296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom e = iptc_next_rule(e, handle); 120796296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom } 120896296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom found = 1; 120996296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom } 121096296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom 121196296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom errno = ENOENT; 121296296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom return found; 121396296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom} 121496296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom 1215e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucherstatic struct ipt_entry * 1216e6869a8f59d779ff4d5a0984c86d80db7078496Marc Bouchergenerate_entry(const struct ipt_entry *fw, 1217395e441e20ea9ab7f37122bcfd76fec527fa447bJan Engelhardt struct xtables_rule_match *matches, 1218e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher struct ipt_entry_target *target) 1219e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher{ 1220e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher unsigned int size; 1221395e441e20ea9ab7f37122bcfd76fec527fa447bJan Engelhardt struct xtables_rule_match *matchp; 1222e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher struct ipt_entry *e; 1223e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1224e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher size = sizeof(struct ipt_entry); 122578cafdaf474a333fa39efab4aa4c9aed88ab9518Martin Josefsson for (matchp = matches; matchp; matchp = matchp->next) 122678cafdaf474a333fa39efab4aa4c9aed88ab9518Martin Josefsson size += matchp->match->m->u.match_size; 1227e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1228630ef48037f3602333addfdb53789c9c6a4bb4c8Jan Engelhardt e = xtables_malloc(size + target->u.target_size); 1229e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher *e = *fw; 1230e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher e->target_offset = size; 1231228e98dd6303af11925235af4cf3c3ec450f3f41Rusty Russell e->next_offset = size + target->u.target_size; 1232e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1233e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher size = 0; 123478cafdaf474a333fa39efab4aa4c9aed88ab9518Martin Josefsson for (matchp = matches; matchp; matchp = matchp->next) { 123578cafdaf474a333fa39efab4aa4c9aed88ab9518Martin Josefsson memcpy(e->elems + size, matchp->match->m, matchp->match->m->u.match_size); 123678cafdaf474a333fa39efab4aa4c9aed88ab9518Martin Josefsson size += matchp->match->m->u.match_size; 1237e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } 1238228e98dd6303af11925235af4cf3c3ec450f3f41Rusty Russell memcpy(e->elems + size, target, target->u.target_size); 1239e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1240e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher return e; 1241e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher} 1242e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1243395e441e20ea9ab7f37122bcfd76fec527fa447bJan Engelhardtstatic void clear_rule_matches(struct xtables_rule_match **matches) 124478cafdaf474a333fa39efab4aa4c9aed88ab9518Martin Josefsson{ 1245395e441e20ea9ab7f37122bcfd76fec527fa447bJan Engelhardt struct xtables_rule_match *matchp, *tmp; 124678cafdaf474a333fa39efab4aa4c9aed88ab9518Martin Josefsson 124778cafdaf474a333fa39efab4aa4c9aed88ab9518Martin Josefsson for (matchp = *matches; matchp;) { 124878cafdaf474a333fa39efab4aa4c9aed88ab9518Martin Josefsson tmp = matchp->next; 1249d6bc6084bca3304a8cc800a57869bef1e21498deHarald Welte if (matchp->match->m) { 12504dd5fedadee415a646bc0e70d0b17668897ede63Martin Josefsson free(matchp->match->m); 1251d6bc6084bca3304a8cc800a57869bef1e21498deHarald Welte matchp->match->m = NULL; 1252d6bc6084bca3304a8cc800a57869bef1e21498deHarald Welte } 1253a258ad7002ae4b4f366800f512db938fb78d0661Joszef Kadlecsik if (matchp->match == matchp->match->next) { 1254a258ad7002ae4b4f366800f512db938fb78d0661Joszef Kadlecsik free(matchp->match); 1255a258ad7002ae4b4f366800f512db938fb78d0661Joszef Kadlecsik matchp->match = NULL; 1256a258ad7002ae4b4f366800f512db938fb78d0661Joszef Kadlecsik } 125778cafdaf474a333fa39efab4aa4c9aed88ab9518Martin Josefsson free(matchp); 125878cafdaf474a333fa39efab4aa4c9aed88ab9518Martin Josefsson matchp = tmp; 125978cafdaf474a333fa39efab4aa4c9aed88ab9518Martin Josefsson } 126078cafdaf474a333fa39efab4aa4c9aed88ab9518Martin Josefsson 126178cafdaf474a333fa39efab4aa4c9aed88ab9518Martin Josefsson *matches = NULL; 126278cafdaf474a333fa39efab4aa4c9aed88ab9518Martin Josefsson} 126378cafdaf474a333fa39efab4aa4c9aed88ab9518Martin Josefsson 12648cf65913bb6353bf0e92eab0669d1c4c53b43623Phil Oestervoid 12658cf65913bb6353bf0e92eab0669d1c4c53b43623Phil Oesterget_kernel_version(void) { 12668cf65913bb6353bf0e92eab0669d1c4c53b43623Phil Oester static struct utsname uts; 12678cf65913bb6353bf0e92eab0669d1c4c53b43623Phil Oester int x = 0, y = 0, z = 0; 12688cf65913bb6353bf0e92eab0669d1c4c53b43623Phil Oester 12698cf65913bb6353bf0e92eab0669d1c4c53b43623Phil Oester if (uname(&uts) == -1) { 12708cf65913bb6353bf0e92eab0669d1c4c53b43623Phil Oester fprintf(stderr, "Unable to retrieve kernel version.\n"); 1271139b3fe4bd5121501e60fe07963ea527d7f0bd36Jamal Hadi Salim xtables_free_opts(1); 12725b76f682f722bebc2f0616fca4600eee2c08dfe2Max Kellermann exit(1); 12738cf65913bb6353bf0e92eab0669d1c4c53b43623Phil Oester } 12748cf65913bb6353bf0e92eab0669d1c4c53b43623Phil Oester 12758cf65913bb6353bf0e92eab0669d1c4c53b43623Phil Oester sscanf(uts.release, "%d.%d.%d", &x, &y, &z); 12768cf65913bb6353bf0e92eab0669d1c4c53b43623Phil Oester kernel_version = LINUX_VERSION(x, y, z); 12778cf65913bb6353bf0e92eab0669d1c4c53b43623Phil Oester} 12788cf65913bb6353bf0e92eab0669d1c4c53b43623Phil Oester 1279f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardtstatic void command_default(struct iptables_command_state *cs) 1280f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt{ 1281f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt struct xtables_rule_match *matchp; 1282f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt struct xtables_match *m; 1283f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt 1284f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt if (cs->target == NULL || cs->target->parse == NULL || 1285f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt cs->c < cs->target->option_offset || 1286f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt cs->c >= cs->target->option_offset + XT_OPTION_OFFSET_SCALE || 1287f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt !cs->target->parse(cs->c - cs->target->option_offset, 1288f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt cs->argv, cs->invert, 1289f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt &cs->target->tflags, 1290f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt &cs->fw, &cs->target->t)) { 1291f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt for (matchp = cs->matches; matchp; matchp = matchp->next) { 1292f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt if (matchp->completed || 1293f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt matchp->match->parse == NULL) 1294f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt continue; 1295f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt if (cs->c < matchp->match->option_offset || 1296f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt cs->c >= matchp->match->option_offset + XT_OPTION_OFFSET_SCALE) 1297f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt continue; 1298f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt if (matchp->match->parse(cs->c - matchp->match->option_offset, 1299f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt cs->argv, cs->invert, 1300f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt &matchp->match->mflags, 1301f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt &cs->fw, 1302f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt &matchp->match->m)) 1303f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt break; 1304f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt } 1305f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt m = matchp ? matchp->match : NULL; 1306f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt 1307f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt /* If you listen carefully, you can 1308f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt actually hear this code suck. */ 1309f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt 1310f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt /* some explanations (after four different bugs 1311f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt * in 3 different releases): If we encounter a 1312f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt * parameter, that has not been parsed yet, 1313f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt * it's not an option of an explicitly loaded 1314f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt * match or a target. However, we support 1315f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt * implicit loading of the protocol match 1316f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt * extension. '-p tcp' means 'l4 proto 6' and 1317f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt * at the same time 'load tcp protocol match on 1318f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt * demand if we specify --dport'. 1319f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt * 1320f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt * To make this work, we need to make sure: 1321f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt * - the parameter has not been parsed by 1322f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt * a match (m above) 1323f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt * - a protocol has been specified 1324f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt * - the protocol extension has not been 1325f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt * loaded yet, or is loaded and unused 1326f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt * [think of iptables-restore!] 1327f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt * - the protocol extension can be successively 1328f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt * loaded 1329f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt */ 1330f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt if (m == NULL 1331f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt && cs->protocol 1332f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt && (!find_proto(cs->protocol, XTF_DONT_LOAD, 1333f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt cs->options&OPT_NUMERIC, NULL) 1334f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt || (find_proto(cs->protocol, XTF_DONT_LOAD, 1335f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt cs->options&OPT_NUMERIC, NULL) 1336f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt && (cs->proto_used == 0)) 1337f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt ) 1338f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt && (m = find_proto(cs->protocol, XTF_TRY_LOAD, 1339f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt cs->options&OPT_NUMERIC, &cs->matches))) { 1340f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt /* Try loading protocol */ 1341f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt size_t size; 1342f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt 1343f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt cs->proto_used = 1; 1344f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt 1345f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt size = IPT_ALIGN(sizeof(struct ipt_entry_match)) 1346f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt + m->size; 1347f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt 1348f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt m->m = xtables_calloc(1, size); 1349f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt m->m->u.match_size = size; 1350f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt strcpy(m->m->u.user.name, m->name); 1351f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt m->m->u.user.revision = m->revision; 1352f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt if (m->init != NULL) 1353f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt m->init(m->m); 1354f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt 1355f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt opts = xtables_merge_options( 1356f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt iptables_globals.orig_opts, 1357f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt opts, 1358f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt m->extra_opts, 1359f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt &m->option_offset); 1360f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt if (opts == NULL) 1361f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt xtables_error(OTHER_PROBLEM, 1362f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt "can't alloc memory!"); 1363f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt 1364f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt optind--; 1365f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt return; 1366f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt } 1367f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt if (!m) { 1368f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt if (cs->c == '?') { 1369f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt if (optopt) { 1370f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt xtables_error( 1371f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt PARAMETER_PROBLEM, 1372f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt "option `%s' " 1373f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt "requires an " 1374f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt "argument", 1375f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt cs->argv[optind-1]); 1376f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt } else { 1377f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt xtables_error( 1378f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt PARAMETER_PROBLEM, 1379f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt "unknown option " 1380f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt "`%s'", 1381f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt cs->argv[optind-1]); 1382f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt } 1383f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt } 1384f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt xtables_error(PARAMETER_PROBLEM, 1385f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt "Unknown arg `%s'", optarg); 1386f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt } 1387f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt } 1388f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt} 1389f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt 1390fd1873110f8e57be578df17fc9d03536b10f4f73Jan Engelhardtint do_command(int argc, char *argv[], char **table, struct iptc_handle **handle) 1391e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher{ 13923a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt struct iptables_command_state cs; 13933a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt struct ipt_entry *e = NULL; 1394e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher unsigned int nsaddrs = 0, ndaddrs = 0; 1395332e4acc574e3a348fe611d55bf642de0d50fbdaMichael Granzow struct in_addr *saddrs = NULL, *smasks = NULL; 1396332e4acc574e3a348fe611d55bf642de0d50fbdaMichael Granzow struct in_addr *daddrs = NULL, *dmasks = NULL; 1397e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 13983a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt int verbose = 0; 1399e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const char *chain = NULL; 1400e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const char *shostnetworkmask = NULL, *dhostnetworkmask = NULL; 1401e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const char *policy = NULL, *newname = NULL; 14023a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt unsigned int rulenum = 0, command = 0; 1403ccd49e5688c1edebc6b8a980c72a269618046acbHarald Welte const char *pcnt = NULL, *bcnt = NULL; 1404e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher int ret = 1; 14058b7c64d6ba156a99008fcd810cba874c73294333Jan Engelhardt struct xtables_match *m; 1406395e441e20ea9ab7f37122bcfd76fec527fa447bJan Engelhardt struct xtables_rule_match *matchp; 14078b7c64d6ba156a99008fcd810cba874c73294333Jan Engelhardt struct xtables_target *t; 1408e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher const char *jumpto = ""; 1409875441ea60d9fd9378475526f2f632b932790553Patrick McHardy unsigned long long cnt; 1410e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 14113a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt memset(&cs, 0, sizeof(cs)); 1412f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt cs.argv = argv; 1413e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1414ae1ff9f96a80379a650dec979b9902528a10d45aHarald Welte /* re-set optind to 0 in case do_command gets called 1415ae1ff9f96a80379a650dec979b9902528a10d45aHarald Welte * a second time */ 1416ae1ff9f96a80379a650dec979b9902528a10d45aHarald Welte optind = 0; 1417ae1ff9f96a80379a650dec979b9902528a10d45aHarald Welte 1418ae1ff9f96a80379a650dec979b9902528a10d45aHarald Welte /* clear mflags in case do_command gets called a second time 1419ae1ff9f96a80379a650dec979b9902528a10d45aHarald Welte * (we clear the global list of all matches for security)*/ 14200d502bcdbc97ed359e84f6a21dfa0049b3b60a6cYasuyuki KOZAKAI for (m = xtables_matches; m; m = m->next) 1421ae1ff9f96a80379a650dec979b9902528a10d45aHarald Welte m->mflags = 0; 1422ae1ff9f96a80379a650dec979b9902528a10d45aHarald Welte 14230d502bcdbc97ed359e84f6a21dfa0049b3b60a6cYasuyuki KOZAKAI for (t = xtables_targets; t; t = t->next) { 1424ae1ff9f96a80379a650dec979b9902528a10d45aHarald Welte t->tflags = 0; 1425ae1ff9f96a80379a650dec979b9902528a10d45aHarald Welte t->used = 0; 1426ae1ff9f96a80379a650dec979b9902528a10d45aHarald Welte } 1427ae1ff9f96a80379a650dec979b9902528a10d45aHarald Welte 1428e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher /* Suppress error messages: we may add new options if we 1429e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher demand-load a protocol. */ 1430e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher opterr = 0; 1431e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1432d3b2e391e3b944581e20e216af76339cc87d0590Jan Engelhardt opts = xt_params->orig_opts; 14333a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt while ((cs.c = getopt_long(argc, argv, 143496296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom "-A:D:R:I:L::S::M:F::Z::N:X::E:P:Vh::o:p:s:d:j:i:fbvnt:m:xc:g:", 1435e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher opts, NULL)) != -1) { 14363a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt switch (cs.c) { 1437e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher /* 1438e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher * Command selection 1439e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher */ 1440e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher case 'A': 1441e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher add_command(&command, CMD_APPEND, CMD_NONE, 14423a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.invert); 1443e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher chain = optarg; 1444e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher break; 1445e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1446e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher case 'D': 1447e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher add_command(&command, CMD_DELETE, CMD_NONE, 14483a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.invert); 1449e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher chain = optarg; 1450e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (optind < argc && argv[optind][0] != '-' 1451e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher && argv[optind][0] != '!') { 1452e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher rulenum = parse_rulenumber(argv[optind++]); 1453e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher command = CMD_DELETE_NUM; 1454e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } 1455e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher break; 1456e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1457e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher case 'R': 1458e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher add_command(&command, CMD_REPLACE, CMD_NONE, 14593a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.invert); 1460e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher chain = optarg; 1461e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (optind < argc && argv[optind][0] != '-' 1462e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher && argv[optind][0] != '!') 1463e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher rulenum = parse_rulenumber(argv[optind++]); 1464e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher else 14651829ed482efbc8b390cc760d012b3a4450494e1aJan Engelhardt xtables_error(PARAMETER_PROBLEM, 1466e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher "-%c requires a rule number", 1467e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher cmd2char(CMD_REPLACE)); 1468e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher break; 1469e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1470e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher case 'I': 1471e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher add_command(&command, CMD_INSERT, CMD_NONE, 14723a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.invert); 1473e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher chain = optarg; 1474e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (optind < argc && argv[optind][0] != '-' 1475e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher && argv[optind][0] != '!') 1476e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher rulenum = parse_rulenumber(argv[optind++]); 1477e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher else rulenum = 1; 1478e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher break; 1479e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1480e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher case 'L': 1481b34199ee303d98ba00ed5ee19d4d5b19dd4cf563Mohit Mehta add_command(&command, CMD_LIST, 14823a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt CMD_ZERO | CMD_ZERO_NUM, cs.invert); 1483e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (optarg) chain = optarg; 1484e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher else if (optind < argc && argv[optind][0] != '-' 1485e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher && argv[optind][0] != '!') 1486e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher chain = argv[optind++]; 1487bb34082de25ec7fb6bffe5702062f087ca887466Henrik Nordstrom if (optind < argc && argv[optind][0] != '-' 1488bb34082de25ec7fb6bffe5702062f087ca887466Henrik Nordstrom && argv[optind][0] != '!') 1489bb34082de25ec7fb6bffe5702062f087ca887466Henrik Nordstrom rulenum = parse_rulenumber(argv[optind++]); 1490e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher break; 1491e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 149296296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom case 'S': 1493b34199ee303d98ba00ed5ee19d4d5b19dd4cf563Mohit Mehta add_command(&command, CMD_LIST_RULES, 14943a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt CMD_ZERO|CMD_ZERO_NUM, cs.invert); 149596296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom if (optarg) chain = optarg; 149696296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom else if (optind < argc && argv[optind][0] != '-' 149796296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom && argv[optind][0] != '!') 149896296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom chain = argv[optind++]; 1499bb34082de25ec7fb6bffe5702062f087ca887466Henrik Nordstrom if (optind < argc && argv[optind][0] != '-' 1500bb34082de25ec7fb6bffe5702062f087ca887466Henrik Nordstrom && argv[optind][0] != '!') 1501bb34082de25ec7fb6bffe5702062f087ca887466Henrik Nordstrom rulenum = parse_rulenumber(argv[optind++]); 150296296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom break; 150396296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom 1504e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher case 'F': 1505e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher add_command(&command, CMD_FLUSH, CMD_NONE, 15063a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.invert); 1507e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (optarg) chain = optarg; 1508e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher else if (optind < argc && argv[optind][0] != '-' 1509e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher && argv[optind][0] != '!') 1510e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher chain = argv[optind++]; 1511e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher break; 1512e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1513e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher case 'Z': 151496296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom add_command(&command, CMD_ZERO, CMD_LIST|CMD_LIST_RULES, 15153a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.invert); 1516e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (optarg) chain = optarg; 1517e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher else if (optind < argc && argv[optind][0] != '-' 1518e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher && argv[optind][0] != '!') 1519e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher chain = argv[optind++]; 1520b34199ee303d98ba00ed5ee19d4d5b19dd4cf563Mohit Mehta if (optind < argc && argv[optind][0] != '-' 1521b34199ee303d98ba00ed5ee19d4d5b19dd4cf563Mohit Mehta && argv[optind][0] != '!') { 1522b34199ee303d98ba00ed5ee19d4d5b19dd4cf563Mohit Mehta rulenum = parse_rulenumber(argv[optind++]); 1523b34199ee303d98ba00ed5ee19d4d5b19dd4cf563Mohit Mehta command = CMD_ZERO_NUM; 1524b34199ee303d98ba00ed5ee19d4d5b19dd4cf563Mohit Mehta } 1525e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher break; 1526e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1527e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher case 'N': 15288d8c8ea5a6150694e7d6fdabd094de15d01bd74bYasuyuki KOZAKAI if (optarg && (*optarg == '-' || *optarg == '!')) 15291829ed482efbc8b390cc760d012b3a4450494e1aJan Engelhardt xtables_error(PARAMETER_PROBLEM, 15306336bfd128a56450184ec6790825575655b5d56aHarald Welte "chain name not allowed to start " 15318d8c8ea5a6150694e7d6fdabd094de15d01bd74bYasuyuki KOZAKAI "with `%c'\n", *optarg); 15322338efd8f799d8373dc196c797bda9690283b698Jan Engelhardt if (xtables_find_target(optarg, XTF_TRY_LOAD)) 15331829ed482efbc8b390cc760d012b3a4450494e1aJan Engelhardt xtables_error(PARAMETER_PROBLEM, 153408f1527fbcebc85f7149e551c9b26f526954b3c2Joszef Kadlecsik "chain name may not clash " 153508f1527fbcebc85f7149e551c9b26f526954b3c2Joszef Kadlecsik "with target name\n"); 1536e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher add_command(&command, CMD_NEW_CHAIN, CMD_NONE, 15373a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.invert); 1538e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher chain = optarg; 1539e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher break; 1540e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1541e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher case 'X': 1542e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher add_command(&command, CMD_DELETE_CHAIN, CMD_NONE, 15433a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.invert); 1544e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (optarg) chain = optarg; 1545e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher else if (optind < argc && argv[optind][0] != '-' 1546e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher && argv[optind][0] != '!') 1547e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher chain = argv[optind++]; 1548e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher break; 1549e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1550e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher case 'E': 1551e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher add_command(&command, CMD_RENAME_CHAIN, CMD_NONE, 15523a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.invert); 1553e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher chain = optarg; 1554e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (optind < argc && argv[optind][0] != '-' 1555e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher && argv[optind][0] != '!') 1556e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher newname = argv[optind++]; 1557c9f20d3e25a09bee55f32733e9150316f5d5e89fM.P.Anand Babu else 15581829ed482efbc8b390cc760d012b3a4450494e1aJan Engelhardt xtables_error(PARAMETER_PROBLEM, 15595b76f682f722bebc2f0616fca4600eee2c08dfe2Max Kellermann "-%c requires old-chain-name and " 1560c9f20d3e25a09bee55f32733e9150316f5d5e89fM.P.Anand Babu "new-chain-name", 1561c9f20d3e25a09bee55f32733e9150316f5d5e89fM.P.Anand Babu cmd2char(CMD_RENAME_CHAIN)); 1562e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher break; 1563e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1564e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher case 'P': 1565e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher add_command(&command, CMD_SET_POLICY, CMD_NONE, 15663a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.invert); 1567e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher chain = optarg; 1568e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (optind < argc && argv[optind][0] != '-' 1569e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher && argv[optind][0] != '!') 1570e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher policy = argv[optind++]; 1571e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher else 15721829ed482efbc8b390cc760d012b3a4450494e1aJan Engelhardt xtables_error(PARAMETER_PROBLEM, 1573e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher "-%c requires a chain and a policy", 1574e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher cmd2char(CMD_SET_POLICY)); 1575e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher break; 1576e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1577e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher case 'h': 1578e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (!optarg) 1579e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher optarg = argv[optind]; 1580e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 15812e0a3216c501753709781769f83e29821e62c805Rusty Russell /* iptables -p icmp -h */ 15823a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt if (!cs.matches && cs.protocol) 15833a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt xtables_find_match(cs.protocol, 15843a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt XTF_TRY_LOAD, &cs.matches); 15852e0a3216c501753709781769f83e29821e62c805Rusty Russell 15863a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt exit_printhelp(cs.matches); 1587e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1588e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher /* 1589e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher * Option selection 1590e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher */ 1591e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher case 'p': 15923a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt xtables_check_inverse(optarg, &cs.invert, &optind, argc, argv); 15933a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt set_option(&cs.options, OPT_PROTOCOL, &cs.fw.ip.invflags, 15943a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.invert); 1595e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1596e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher /* Canonicalize into lower case */ 15973a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt for (cs.protocol = optarg; *cs.protocol; cs.protocol++) 15983a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt *cs.protocol = tolower(*cs.protocol); 1599e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 16003a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.protocol = optarg; 16013a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.fw.ip.proto = xtables_parse_protocol(cs.protocol); 1602e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 16033a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt if (cs.fw.ip.proto == 0 16043a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt && (cs.fw.ip.invflags & IPT_INV_PROTO)) 16051829ed482efbc8b390cc760d012b3a4450494e1aJan Engelhardt xtables_error(PARAMETER_PROBLEM, 1606e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher "rule would never match protocol"); 1607e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher break; 1608e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1609e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher case 's': 16103a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt xtables_check_inverse(optarg, &cs.invert, &optind, argc, argv); 16113a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt set_option(&cs.options, OPT_SOURCE, &cs.fw.ip.invflags, 16123a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.invert); 1613bbe83862a5e1baf15f7c923352d4afdf59bc70e2Jan Engelhardt shostnetworkmask = optarg; 1614e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher break; 1615e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1616e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher case 'd': 16173a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt xtables_check_inverse(optarg, &cs.invert, &optind, argc, argv); 16183a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt set_option(&cs.options, OPT_DESTINATION, &cs.fw.ip.invflags, 16193a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.invert); 1620bbe83862a5e1baf15f7c923352d4afdf59bc70e2Jan Engelhardt dhostnetworkmask = optarg; 1621e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher break; 1622e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 162317fc163babc348780bae4321071845748f7b7985Henrik Nordstrom#ifdef IPT_F_GOTO 162417fc163babc348780bae4321071845748f7b7985Henrik Nordstrom case 'g': 16253a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt set_option(&cs.options, OPT_JUMP, &cs.fw.ip.invflags, 16263a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.invert); 16273a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.fw.ip.flags |= IPT_F_GOTO; 162817fc163babc348780bae4321071845748f7b7985Henrik Nordstrom jumpto = parse_target(optarg); 162917fc163babc348780bae4321071845748f7b7985Henrik Nordstrom break; 163017fc163babc348780bae4321071845748f7b7985Henrik Nordstrom#endif 163117fc163babc348780bae4321071845748f7b7985Henrik Nordstrom 1632e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher case 'j': 16333a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt set_option(&cs.options, OPT_JUMP, &cs.fw.ip.invflags, 16343a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.invert); 1635e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher jumpto = parse_target(optarg); 1636859f7261b68ac000f0b796d519e4a2b736745208Rusty Russell /* TRY_LOAD (may be chain name) */ 16373a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.target = xtables_find_target(jumpto, XTF_TRY_LOAD); 1638e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 16393a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt if (cs.target) { 1640228e98dd6303af11925235af4cf3c3ec450f3f41Rusty Russell size_t size; 1641228e98dd6303af11925235af4cf3c3ec450f3f41Rusty Russell 164273f72f541ac4dab538d4d418b9bbf1707b31342bRusty Russell size = IPT_ALIGN(sizeof(struct ipt_entry_target)) 16433a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt + cs.target->size; 16443a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt 16453a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.target->t = xtables_calloc(1, size); 16463a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.target->t->u.target_size = size; 16473a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt strcpy(cs.target->t->u.user.name, jumpto); 16483a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.target->t->u.user.revision = cs.target->revision; 16493a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt if (cs.target->init != NULL) 16503a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.target->init(cs.target->t); 1651600f38db82548a683775fd89b6e136673e924097Jan Engelhardt opts = xtables_merge_options( 1652600f38db82548a683775fd89b6e136673e924097Jan Engelhardt iptables_globals.orig_opts, 1653600f38db82548a683775fd89b6e136673e924097Jan Engelhardt opts, 16543a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.target->extra_opts, 16553a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt &cs.target->option_offset); 16568e707d7c64c53c92a36b6c609b129aba8e51fab7Pablo Neira Ayuso if (opts == NULL) 16571829ed482efbc8b390cc760d012b3a4450494e1aJan Engelhardt xtables_error(OTHER_PROBLEM, 16588e707d7c64c53c92a36b6c609b129aba8e51fab7Pablo Neira Ayuso "can't alloc memory!"); 1659e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } 1660e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher break; 1661e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1662e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1663e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher case 'i': 16645b1fecc7d017df093db7c667bcd1718e45b1df67Jan Engelhardt if (*optarg == '\0') 16655b1fecc7d017df093db7c667bcd1718e45b1df67Jan Engelhardt xtables_error(PARAMETER_PROBLEM, 16665b1fecc7d017df093db7c667bcd1718e45b1df67Jan Engelhardt "Empty interface is likely to be " 16675b1fecc7d017df093db7c667bcd1718e45b1df67Jan Engelhardt "undesired"); 16683a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt xtables_check_inverse(optarg, &cs.invert, &optind, argc, argv); 16693a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt set_option(&cs.options, OPT_VIANAMEIN, &cs.fw.ip.invflags, 16703a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.invert); 1671bbe83862a5e1baf15f7c923352d4afdf59bc70e2Jan Engelhardt xtables_parse_interface(optarg, 16723a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.fw.ip.iniface, 16733a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.fw.ip.iniface_mask); 1674e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher break; 1675e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1676e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher case 'o': 16775b1fecc7d017df093db7c667bcd1718e45b1df67Jan Engelhardt if (*optarg == '\0') 16785b1fecc7d017df093db7c667bcd1718e45b1df67Jan Engelhardt xtables_error(PARAMETER_PROBLEM, 16795b1fecc7d017df093db7c667bcd1718e45b1df67Jan Engelhardt "Empty interface is likely to be " 16805b1fecc7d017df093db7c667bcd1718e45b1df67Jan Engelhardt "undesired"); 16813a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt xtables_check_inverse(optarg, &cs.invert, &optind, argc, argv); 16823a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt set_option(&cs.options, OPT_VIANAMEOUT, &cs.fw.ip.invflags, 16833a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.invert); 1684bbe83862a5e1baf15f7c923352d4afdf59bc70e2Jan Engelhardt xtables_parse_interface(optarg, 16853a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.fw.ip.outiface, 16863a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.fw.ip.outiface_mask); 1687e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher break; 1688e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1689e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher case 'f': 16903a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt set_option(&cs.options, OPT_FRAGMENT, &cs.fw.ip.invflags, 16913a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.invert); 16923a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.fw.ip.flags |= IPT_F_FRAG; 1693e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher break; 1694e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1695e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher case 'v': 1696e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (!verbose) 16973a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt set_option(&cs.options, OPT_VERBOSE, 16983a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt &cs.fw.ip.invflags, cs.invert); 1699e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher verbose++; 1700e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher break; 1701e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 170252a5149d58d027168b86855106f975a2364e7505Rusty Russell case 'm': { 170352a5149d58d027168b86855106f975a2364e7505Rusty Russell size_t size; 170452a5149d58d027168b86855106f975a2364e7505Rusty Russell 17053a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt if (cs.invert) 17061829ed482efbc8b390cc760d012b3a4450494e1aJan Engelhardt xtables_error(PARAMETER_PROBLEM, 1707e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher "unexpected ! flag before --match"); 1708e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 17092338efd8f799d8373dc196c797bda9690283b698Jan Engelhardt m = xtables_find_match(optarg, XTF_LOAD_MUST_SUCCEED, 17103a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt &cs.matches); 171173f72f541ac4dab538d4d418b9bbf1707b31342bRusty Russell size = IPT_ALIGN(sizeof(struct ipt_entry_match)) 171273f72f541ac4dab538d4d418b9bbf1707b31342bRusty Russell + m->size; 1713630ef48037f3602333addfdb53789c9c6a4bb4c8Jan Engelhardt m->m = xtables_calloc(1, size); 171452a5149d58d027168b86855106f975a2364e7505Rusty Russell m->m->u.match_size = size; 171527ff3475d2c737a67fc745818a380ffa932e5fbaRusty Russell strcpy(m->m->u.user.name, m->name); 171611c2dd54b69e06ae3f35dea130ecba3df3859243Jan Engelhardt m->m->u.user.revision = m->revision; 17178115e5425721cd610b6390c3d4c24540773b0520Pablo Neira if (m->init != NULL) 1718ea146a982e26c42f9954f140276f8deeb2edbe98Peter Riley m->init(m->m); 17198e707d7c64c53c92a36b6c609b129aba8e51fab7Pablo Neira Ayuso if (m != m->next) { 1720a258ad7002ae4b4f366800f512db938fb78d0661Joszef Kadlecsik /* Merge options for non-cloned matches */ 1721600f38db82548a683775fd89b6e136673e924097Jan Engelhardt opts = xtables_merge_options( 1722600f38db82548a683775fd89b6e136673e924097Jan Engelhardt iptables_globals.orig_opts, 1723600f38db82548a683775fd89b6e136673e924097Jan Engelhardt opts, 17245b76f682f722bebc2f0616fca4600eee2c08dfe2Max Kellermann m->extra_opts, 17258e707d7c64c53c92a36b6c609b129aba8e51fab7Pablo Neira Ayuso &m->option_offset); 17268e707d7c64c53c92a36b6c609b129aba8e51fab7Pablo Neira Ayuso if (opts == NULL) 17271829ed482efbc8b390cc760d012b3a4450494e1aJan Engelhardt xtables_error(OTHER_PROBLEM, 17288e707d7c64c53c92a36b6c609b129aba8e51fab7Pablo Neira Ayuso "can't alloc memory!"); 17298e707d7c64c53c92a36b6c609b129aba8e51fab7Pablo Neira Ayuso } 173052a5149d58d027168b86855106f975a2364e7505Rusty Russell } 173152a5149d58d027168b86855106f975a2364e7505Rusty Russell break; 1732e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1733e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher case 'n': 17343a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt set_option(&cs.options, OPT_NUMERIC, &cs.fw.ip.invflags, 17353a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.invert); 1736e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher break; 1737e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1738e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher case 't': 17393a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt if (cs.invert) 17401829ed482efbc8b390cc760d012b3a4450494e1aJan Engelhardt xtables_error(PARAMETER_PROBLEM, 1741e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher "unexpected ! flag before --table"); 1742d0cbf5f34d3421064eb0fbbcdc6b90cda4e81f2dJan Engelhardt *table = optarg; 1743e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher break; 1744e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1745e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher case 'x': 17463a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt set_option(&cs.options, OPT_EXPANDED, &cs.fw.ip.invflags, 17473a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.invert); 1748e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher break; 1749e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1750e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher case 'V': 17513a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt if (cs.invert) 17525dd19de34380c91ad07bbe79a34726e59891cf54Jamal Hadi Salim printf("Not %s ;-)\n", prog_vers); 1753e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher else 1754e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher printf("%s v%s\n", 17555dd19de34380c91ad07bbe79a34726e59891cf54Jamal Hadi Salim prog_name, prog_vers); 1756e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher exit(0); 1757e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1758e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher case '0': 17593a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt set_option(&cs.options, OPT_LINENUMBERS, &cs.fw.ip.invflags, 17603a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.invert); 1761e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher break; 1762e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 176382dd2ec8eef4991bd717f885b26080d993dd3498Harald Welte case 'M': 1764c021c3ce7b1583eb5dd71b10ac3d8ab3cd36beaaJan Engelhardt xtables_modprobe_program = optarg; 176582dd2ec8eef4991bd717f885b26080d993dd3498Harald Welte break; 176682dd2ec8eef4991bd717f885b26080d993dd3498Harald Welte 1767ccd49e5688c1edebc6b8a980c72a269618046acbHarald Welte case 'c': 1768ccd49e5688c1edebc6b8a980c72a269618046acbHarald Welte 17693a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt set_option(&cs.options, OPT_COUNTERS, &cs.fw.ip.invflags, 17703a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.invert); 1771ccd49e5688c1edebc6b8a980c72a269618046acbHarald Welte pcnt = optarg; 177260a6073690a456770bf18d190beb57e8f2c8759fHenrik Nordstrom bcnt = strchr(pcnt + 1, ','); 177360a6073690a456770bf18d190beb57e8f2c8759fHenrik Nordstrom if (bcnt) 177460a6073690a456770bf18d190beb57e8f2c8759fHenrik Nordstrom bcnt++; 177560a6073690a456770bf18d190beb57e8f2c8759fHenrik Nordstrom if (!bcnt && optind < argc && argv[optind][0] != '-' 1776ccd49e5688c1edebc6b8a980c72a269618046acbHarald Welte && argv[optind][0] != '!') 1777ccd49e5688c1edebc6b8a980c72a269618046acbHarald Welte bcnt = argv[optind++]; 177860a6073690a456770bf18d190beb57e8f2c8759fHenrik Nordstrom if (!bcnt) 17791829ed482efbc8b390cc760d012b3a4450494e1aJan Engelhardt xtables_error(PARAMETER_PROBLEM, 1780ccd49e5688c1edebc6b8a980c72a269618046acbHarald Welte "-%c requires packet and byte counter", 1781ccd49e5688c1edebc6b8a980c72a269618046acbHarald Welte opt2char(OPT_COUNTERS)); 1782ccd49e5688c1edebc6b8a980c72a269618046acbHarald Welte 178360a6073690a456770bf18d190beb57e8f2c8759fHenrik Nordstrom if (sscanf(pcnt, "%llu", &cnt) != 1) 17841829ed482efbc8b390cc760d012b3a4450494e1aJan Engelhardt xtables_error(PARAMETER_PROBLEM, 1785ccd49e5688c1edebc6b8a980c72a269618046acbHarald Welte "-%c packet counter not numeric", 1786ccd49e5688c1edebc6b8a980c72a269618046acbHarald Welte opt2char(OPT_COUNTERS)); 17873a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.fw.counters.pcnt = cnt; 1788ccd49e5688c1edebc6b8a980c72a269618046acbHarald Welte 178960a6073690a456770bf18d190beb57e8f2c8759fHenrik Nordstrom if (sscanf(bcnt, "%llu", &cnt) != 1) 17901829ed482efbc8b390cc760d012b3a4450494e1aJan Engelhardt xtables_error(PARAMETER_PROBLEM, 1791ccd49e5688c1edebc6b8a980c72a269618046acbHarald Welte "-%c byte counter not numeric", 1792ccd49e5688c1edebc6b8a980c72a269618046acbHarald Welte opt2char(OPT_COUNTERS)); 17933a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.fw.counters.bcnt = cnt; 1794ccd49e5688c1edebc6b8a980c72a269618046acbHarald Welte break; 1795ccd49e5688c1edebc6b8a980c72a269618046acbHarald Welte 1796ccd49e5688c1edebc6b8a980c72a269618046acbHarald Welte 1797e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher case 1: /* non option */ 1798e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (optarg[0] == '!' && optarg[1] == '\0') { 17993a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt if (cs.invert) 18001829ed482efbc8b390cc760d012b3a4450494e1aJan Engelhardt xtables_error(PARAMETER_PROBLEM, 1801e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher "multiple consecutive ! not" 1802e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher " allowed"); 18033a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.invert = TRUE; 1804e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher optarg[0] = '\0'; 1805e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher continue; 1806e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } 1807aae4f82eb83d923f59a328d6e13396f424be28f9Max Kellermann fprintf(stderr, "Bad argument `%s'\n", optarg); 1808e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher exit_tryhelp(2); 1809e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1810e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher default: 1811f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt command_default(&cs); 1812f935ae05040d2d790433abee49ef79f4a8ed393cJan Engelhardt break; 1813e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } 18143a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.invert = FALSE; 1815e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } 1816e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 18171eada72b7da712bffb87e829b3b9deb3de6bca3cJan Engelhardt if (strcmp(*table, "nat") == 0 && 18181eada72b7da712bffb87e829b3b9deb3de6bca3cJan Engelhardt ((policy != NULL && strcmp(policy, "DROP") == 0) || 18191eada72b7da712bffb87e829b3b9deb3de6bca3cJan Engelhardt (jumpto != NULL && strcmp(jumpto, "DROP") == 0))) 1820e0390bee2aa51dd76725c1a9e0d2cb53379767b8Jan Engelhardt xtables_error(PARAMETER_PROBLEM, 1821e0390bee2aa51dd76725c1a9e0d2cb53379767b8Jan Engelhardt "\nThe \"nat\" table is not intended for filtering, " 1822e0390bee2aa51dd76725c1a9e0d2cb53379767b8Jan Engelhardt "the use of DROP is therefore inhibited.\n\n"); 18231eada72b7da712bffb87e829b3b9deb3de6bca3cJan Engelhardt 18243a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt for (matchp = cs.matches; matchp; matchp = matchp->next) 1825830132ac9c0d270bf9dcfe85c2464e3fe8c73fb9Jan Engelhardt if (matchp->match->final_check != NULL) 1826830132ac9c0d270bf9dcfe85c2464e3fe8c73fb9Jan Engelhardt matchp->match->final_check(matchp->match->mflags); 1827fb1279a75b44dc8f5720fef2a507251e79268f10Sven Koch 18283a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt if (cs.target != NULL && cs.target->final_check != NULL) 18293a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.target->final_check(cs.target->tflags); 1830e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1831e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher /* Fix me: must put inverse options checking here --MN */ 1832e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1833e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (optind < argc) 18341829ed482efbc8b390cc760d012b3a4450494e1aJan Engelhardt xtables_error(PARAMETER_PROBLEM, 1835e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher "unknown arguments found on commandline"); 1836e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (!command) 18371829ed482efbc8b390cc760d012b3a4450494e1aJan Engelhardt xtables_error(PARAMETER_PROBLEM, "no command specified"); 18383a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt if (cs.invert) 18391829ed482efbc8b390cc760d012b3a4450494e1aJan Engelhardt xtables_error(PARAMETER_PROBLEM, 1840e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher "nothing appropriate following !"); 1841e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 18426336bfd128a56450184ec6790825575655b5d56aHarald Welte if (command & (CMD_REPLACE | CMD_INSERT | CMD_DELETE | CMD_APPEND)) { 18433a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt if (!(cs.options & OPT_DESTINATION)) 1844e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher dhostnetworkmask = "0.0.0.0/0"; 18453a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt if (!(cs.options & OPT_SOURCE)) 1846e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher shostnetworkmask = "0.0.0.0/0"; 1847e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } 1848e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1849e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (shostnetworkmask) 1850332e4acc574e3a348fe611d55bf642de0d50fbdaMichael Granzow xtables_ipparse_multiple(shostnetworkmask, &saddrs, 1851332e4acc574e3a348fe611d55bf642de0d50fbdaMichael Granzow &smasks, &nsaddrs); 1852e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1853e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (dhostnetworkmask) 1854332e4acc574e3a348fe611d55bf642de0d50fbdaMichael Granzow xtables_ipparse_multiple(dhostnetworkmask, &daddrs, 1855332e4acc574e3a348fe611d55bf642de0d50fbdaMichael Granzow &dmasks, &ndaddrs); 1856e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1857e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if ((nsaddrs > 1 || ndaddrs > 1) && 18583a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt (cs.fw.ip.invflags & (IPT_INV_SRCIP | IPT_INV_DSTIP))) 18591829ed482efbc8b390cc760d012b3a4450494e1aJan Engelhardt xtables_error(PARAMETER_PROBLEM, "! not allowed with multiple" 1860e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher " source or destination IP addresses"); 1861e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1862e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (command == CMD_REPLACE && (nsaddrs != 1 || ndaddrs != 1)) 18631829ed482efbc8b390cc760d012b3a4450494e1aJan Engelhardt xtables_error(PARAMETER_PROBLEM, "Replacement rule does not " 1864e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher "specify a unique address"); 1865e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 18663a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt generic_opt_check(command, cs.options); 1867e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 18685429b41c2bb4ac8fe672a1513a041c0ed0c241f6Jan Engelhardt if (chain != NULL && strlen(chain) >= XT_EXTENSION_MAXNAMELEN) 18691829ed482efbc8b390cc760d012b3a4450494e1aJan Engelhardt xtables_error(PARAMETER_PROBLEM, 18705429b41c2bb4ac8fe672a1513a041c0ed0c241f6Jan Engelhardt "chain name `%s' too long (must be under %u chars)", 18715429b41c2bb4ac8fe672a1513a041c0ed0c241f6Jan Engelhardt chain, XT_EXTENSION_MAXNAMELEN); 1872e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1873ae1ff9f96a80379a650dec979b9902528a10d45aHarald Welte /* only allocate handle if we weren't called with a handle */ 18748371e15a49d422755fbd185ab8415b9b12ec9d9aMartin Josefsson if (!*handle) 1875ae1ff9f96a80379a650dec979b9902528a10d45aHarald Welte *handle = iptc_init(*table); 1876ae1ff9f96a80379a650dec979b9902528a10d45aHarald Welte 18778beb0492c84dbec73febce36559ff244f77ec08eRusty Russell /* try to insmod the module if iptc_init failed */ 1878c021c3ce7b1583eb5dd71b10ac3d8ab3cd36beaaJan Engelhardt if (!*handle && xtables_load_ko(xtables_modprobe_program, false) != -1) 187982dd2ec8eef4991bd717f885b26080d993dd3498Harald Welte *handle = iptc_init(*table); 188082dd2ec8eef4991bd717f885b26080d993dd3498Harald Welte 1881e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (!*handle) 18821829ed482efbc8b390cc760d012b3a4450494e1aJan Engelhardt xtables_error(VERSION_PROBLEM, 1883e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher "can't initialize iptables table `%s': %s", 1884e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher *table, iptc_strerror(errno)); 1885e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 18866336bfd128a56450184ec6790825575655b5d56aHarald Welte if (command == CMD_APPEND 1887e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher || command == CMD_DELETE 1888e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher || command == CMD_INSERT 1889e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher || command == CMD_REPLACE) { 1890a4860fd18610d1f12ecf11357744f65d8ca226f3Rusty Russell if (strcmp(chain, "PREROUTING") == 0 1891a4860fd18610d1f12ecf11357744f65d8ca226f3Rusty Russell || strcmp(chain, "INPUT") == 0) { 1892a4860fd18610d1f12ecf11357744f65d8ca226f3Rusty Russell /* -o not valid with incoming packets. */ 18933a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt if (cs.options & OPT_VIANAMEOUT) 18941829ed482efbc8b390cc760d012b3a4450494e1aJan Engelhardt xtables_error(PARAMETER_PROBLEM, 1895e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher "Can't use -%c with %s\n", 1896e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher opt2char(OPT_VIANAMEOUT), 1897e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher chain); 1898e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } 1899e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1900a4860fd18610d1f12ecf11357744f65d8ca226f3Rusty Russell if (strcmp(chain, "POSTROUTING") == 0 1901a4860fd18610d1f12ecf11357744f65d8ca226f3Rusty Russell || strcmp(chain, "OUTPUT") == 0) { 1902a4860fd18610d1f12ecf11357744f65d8ca226f3Rusty Russell /* -i not valid with outgoing packets */ 19033a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt if (cs.options & OPT_VIANAMEIN) 19041829ed482efbc8b390cc760d012b3a4450494e1aJan Engelhardt xtables_error(PARAMETER_PROBLEM, 1905e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher "Can't use -%c with %s\n", 1906e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher opt2char(OPT_VIANAMEIN), 1907e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher chain); 1908e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } 1909e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 19103a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt if (cs.target && iptc_is_chain(jumpto, *handle)) { 1911aae4f82eb83d923f59a328d6e13396f424be28f9Max Kellermann fprintf(stderr, 1912aae4f82eb83d923f59a328d6e13396f424be28f9Max Kellermann "Warning: using chain %s, not extension\n", 1913aae4f82eb83d923f59a328d6e13396f424be28f9Max Kellermann jumpto); 1914e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 19153a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt if (cs.target->t) 19163a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt free(cs.target->t); 19174dd5fedadee415a646bc0e70d0b17668897ede63Martin Josefsson 19183a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.target = NULL; 1919e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } 1920e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1921e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher /* If they didn't specify a target, or it's a chain 1922e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher name, use standard. */ 19233a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt if (!cs.target 1924e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher && (strlen(jumpto) == 0 1925e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher || iptc_is_chain(jumpto, *handle))) { 1926e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher size_t size; 1927e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 19283a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.target = xtables_find_target(IPT_STANDARD_TARGET, 19292338efd8f799d8373dc196c797bda9690283b698Jan Engelhardt XTF_LOAD_MUST_SUCCEED); 1930e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1931e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher size = sizeof(struct ipt_entry_target) 19323a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt + cs.target->size; 19333a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.target->t = xtables_calloc(1, size); 19343a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.target->t->u.target_size = size; 19353a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt strcpy(cs.target->t->u.user.name, jumpto); 19360b90564c5082d602d6bc0618f4a285ab45b22c4bPablo Neira if (!iptc_is_chain(jumpto, *handle)) 19373a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.target->t->u.user.revision = cs.target->revision; 19383a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt if (cs.target->init != NULL) 19393a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.target->init(cs.target->t); 1940e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } 1941e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 19423a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt if (!cs.target) { 1943f2a24bd5c8b380d94ac383420b5b8c42141e777bHarald Welte /* it is no chain, and we can't load a plugin. 1944f2a24bd5c8b380d94ac383420b5b8c42141e777bHarald Welte * We cannot know if the plugin is corrupt, non 1945a4d3e1fea254d63a2dd0e32bf6d70fa0f39159bcRusty Russell * existant OR if the user just misspelled a 1946f2a24bd5c8b380d94ac383420b5b8c42141e777bHarald Welte * chain. */ 194717fc163babc348780bae4321071845748f7b7985Henrik Nordstrom#ifdef IPT_F_GOTO 19483a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt if (cs.fw.ip.flags & IPT_F_GOTO) 19491829ed482efbc8b390cc760d012b3a4450494e1aJan Engelhardt xtables_error(PARAMETER_PROBLEM, 195017fc163babc348780bae4321071845748f7b7985Henrik Nordstrom "goto '%s' is not a chain\n", jumpto); 195117fc163babc348780bae4321071845748f7b7985Henrik Nordstrom#endif 19522338efd8f799d8373dc196c797bda9690283b698Jan Engelhardt xtables_find_target(jumpto, XTF_LOAD_MUST_SUCCEED); 1953e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } else { 19543a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt e = generate_entry(&cs.fw, cs.matches, cs.target->t); 19553a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt free(cs.target->t); 1956e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } 1957e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } 1958e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 1959e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher switch (command) { 1960e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher case CMD_APPEND: 1961e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher ret = append_entry(chain, e, 1962332e4acc574e3a348fe611d55bf642de0d50fbdaMichael Granzow nsaddrs, saddrs, smasks, 1963332e4acc574e3a348fe611d55bf642de0d50fbdaMichael Granzow ndaddrs, daddrs, dmasks, 19643a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.options&OPT_VERBOSE, 19651c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt *handle); 1966e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher break; 1967e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher case CMD_DELETE: 1968e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher ret = delete_entry(chain, e, 1969332e4acc574e3a348fe611d55bf642de0d50fbdaMichael Granzow nsaddrs, saddrs, smasks, 1970332e4acc574e3a348fe611d55bf642de0d50fbdaMichael Granzow ndaddrs, daddrs, dmasks, 19713a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.options&OPT_VERBOSE, 19723a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt *handle, cs.matches, cs.target); 1973e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher break; 1974e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher case CMD_DELETE_NUM: 19751c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt ret = iptc_delete_num_entry(chain, rulenum - 1, *handle); 1976e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher break; 1977e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher case CMD_REPLACE: 1978e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher ret = replace_entry(chain, e, rulenum - 1, 197975cb763b54a89bf9b9c61740c760abce89df06f3Jan Engelhardt saddrs, smasks, daddrs, dmasks, 19803a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.options&OPT_VERBOSE, *handle); 1981e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher break; 1982e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher case CMD_INSERT: 1983e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher ret = insert_entry(chain, e, rulenum - 1, 1984332e4acc574e3a348fe611d55bf642de0d50fbdaMichael Granzow nsaddrs, saddrs, smasks, 1985332e4acc574e3a348fe611d55bf642de0d50fbdaMichael Granzow ndaddrs, daddrs, dmasks, 19863a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.options&OPT_VERBOSE, 19871c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt *handle); 1988e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher break; 1989e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher case CMD_FLUSH: 19903a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt ret = flush_entries(chain, cs.options&OPT_VERBOSE, *handle); 1991e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher break; 1992e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher case CMD_ZERO: 19933a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt ret = zero_entries(chain, cs.options&OPT_VERBOSE, *handle); 1994e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher break; 1995b34199ee303d98ba00ed5ee19d4d5b19dd4cf563Mohit Mehta case CMD_ZERO_NUM: 1996b34199ee303d98ba00ed5ee19d4d5b19dd4cf563Mohit Mehta ret = iptc_zero_counter(chain, rulenum, *handle); 1997b34199ee303d98ba00ed5ee19d4d5b19dd4cf563Mohit Mehta break; 199896296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom case CMD_LIST: 1999e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher case CMD_LIST|CMD_ZERO: 2000b34199ee303d98ba00ed5ee19d4d5b19dd4cf563Mohit Mehta case CMD_LIST|CMD_ZERO_NUM: 2001e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher ret = list_entries(chain, 2002bb34082de25ec7fb6bffe5702062f087ca887466Henrik Nordstrom rulenum, 20033a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.options&OPT_VERBOSE, 20043a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.options&OPT_NUMERIC, 20053a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.options&OPT_EXPANDED, 20063a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.options&OPT_LINENUMBERS, 20071c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt *handle); 200896296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom if (ret && (command & CMD_ZERO)) 200996296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom ret = zero_entries(chain, 20103a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.options&OPT_VERBOSE, *handle); 2011b34199ee303d98ba00ed5ee19d4d5b19dd4cf563Mohit Mehta if (ret && (command & CMD_ZERO_NUM)) 2012b34199ee303d98ba00ed5ee19d4d5b19dd4cf563Mohit Mehta ret = iptc_zero_counter(chain, rulenum, *handle); 201396296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom break; 201496296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom case CMD_LIST_RULES: 201596296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom case CMD_LIST_RULES|CMD_ZERO: 2016b34199ee303d98ba00ed5ee19d4d5b19dd4cf563Mohit Mehta case CMD_LIST_RULES|CMD_ZERO_NUM: 201796296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom ret = list_rules(chain, 2018bb34082de25ec7fb6bffe5702062f087ca887466Henrik Nordstrom rulenum, 20193a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.options&OPT_VERBOSE, 20201c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt *handle); 202196296cfb7e01298234c7fa9403619f50391620d1Henrik Nordstrom if (ret && (command & CMD_ZERO)) 2022e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher ret = zero_entries(chain, 20233a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt cs.options&OPT_VERBOSE, *handle); 2024b34199ee303d98ba00ed5ee19d4d5b19dd4cf563Mohit Mehta if (ret && (command & CMD_ZERO_NUM)) 2025b34199ee303d98ba00ed5ee19d4d5b19dd4cf563Mohit Mehta ret = iptc_zero_counter(chain, rulenum, *handle); 2026e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher break; 2027e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher case CMD_NEW_CHAIN: 20281c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt ret = iptc_create_chain(chain, *handle); 2029e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher break; 2030e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher case CMD_DELETE_CHAIN: 20313a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt ret = delete_chain(chain, cs.options&OPT_VERBOSE, *handle); 2032e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher break; 2033e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher case CMD_RENAME_CHAIN: 20341c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt ret = iptc_rename_chain(chain, newname, *handle); 2035e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher break; 2036e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher case CMD_SET_POLICY: 20373a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt ret = iptc_set_policy(chain, policy, cs.options&OPT_COUNTERS ? &cs.fw.counters : NULL, *handle); 2038e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher break; 2039e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher default: 2040e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher /* We should never reach this... */ 2041e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher exit_tryhelp(2); 2042e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } 2043e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 2044e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher if (verbose > 1) 2045e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher dump_entries(*handle); 2046e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 20473a9d8b0bcaeeb7f260c881fbaaea62f705d0d47eJan Engelhardt clear_rule_matches(&cs.matches); 204878cafdaf474a333fa39efab4aa4c9aed88ab9518Martin Josefsson 20494dd5fedadee415a646bc0e70d0b17668897ede63Martin Josefsson if (e != NULL) { 20504dd5fedadee415a646bc0e70d0b17668897ede63Martin Josefsson free(e); 20514dd5fedadee415a646bc0e70d0b17668897ede63Martin Josefsson e = NULL; 20524dd5fedadee415a646bc0e70d0b17668897ede63Martin Josefsson } 20534dd5fedadee415a646bc0e70d0b17668897ede63Martin Josefsson 20546997cdf4ef385771711d877bbf8d67d63bf3ba5dkeso free(saddrs); 2055332e4acc574e3a348fe611d55bf642de0d50fbdaMichael Granzow free(smasks); 20566997cdf4ef385771711d877bbf8d67d63bf3ba5dkeso free(daddrs); 2057332e4acc574e3a348fe611d55bf642de0d50fbdaMichael Granzow free(dmasks); 2058139b3fe4bd5121501e60fe07963ea527d7f0bd36Jamal Hadi Salim xtables_free_opts(1); 20594dd5fedadee415a646bc0e70d0b17668897ede63Martin Josefsson 2060e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher return ret; 2061e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher} 2062