libiptc.c revision efa8fc2123a2a9fc229ab471edd2b2688ce1da3a
1/* Library which manipulates firewall rules. Version $Revision$ */ 2 3/* Architecture of firewall rules is as follows: 4 * 5 * Chains go INPUT, FORWARD, OUTPUT then user chains. 6 * Each user chain starts with an ERROR node. 7 * Every chain ends with an unconditional jump: a RETURN for user chains, 8 * and a POLICY for built-ins. 9 */ 10 11/* (C) 1999 Paul ``Rusty'' Russell - Placed under the GNU GPL (See 12 * COPYING for details). 13 * (C) 2000-2004 by the Netfilter Core Team <coreteam@netfilter.org> 14 * 15 * 2003-Jun-20: Harald Welte <laforge@netfilter.org>: 16 * - Reimplementation of chain cache to use offsets instead of entries 17 * 2003-Jun-23: Harald Welte <laforge@netfilter.org>: 18 * - performance optimization, sponsored by Astaro AG (http://www.astaro.com/) 19 * don't rebuild the chain cache after every operation, instead fix it 20 * up after a ruleset change. 21 * 2004-Aug-18: Harald Welte <laforge@netfilter.org>: 22 * - futher performance work: total reimplementation of libiptc. 23 * - libiptc now has a real internal (linked-list) represntation of the 24 * ruleset and a parser/compiler from/to this internal representation 25 * - again sponsored by Astaro AG (http://www.astaro.com/) 26 */ 27#include <sys/types.h> 28#include <sys/socket.h> 29 30#include "linux_list.h" 31 32//#define IPTC_DEBUG2 1 33 34#ifdef IPTC_DEBUG2 35#include <fcntl.h> 36#define DEBUGP(x, args...) fprintf(stderr, "%s: " x, __FUNCTION__, ## args) 37#define DEBUGP_C(x, args...) fprintf(stderr, x, ## args) 38#else 39#define DEBUGP(x, args...) 40#define DEBUGP_C(x, args...) 41#endif 42 43#ifndef IPT_LIB_DIR 44#define IPT_LIB_DIR "/usr/local/lib/iptables" 45#endif 46 47static int sockfd = -1; 48static int sockfd_use = 0; 49static void *iptc_fn = NULL; 50 51static const char *hooknames[] 52= { [HOOK_PRE_ROUTING] "PREROUTING", 53 [HOOK_LOCAL_IN] "INPUT", 54 [HOOK_FORWARD] "FORWARD", 55 [HOOK_LOCAL_OUT] "OUTPUT", 56 [HOOK_POST_ROUTING] "POSTROUTING", 57#ifdef HOOK_DROPPING 58 [HOOK_DROPPING] "DROPPING" 59#endif 60}; 61 62/* Convenience structures */ 63struct ipt_error_target 64{ 65 STRUCT_ENTRY_TARGET t; 66 char error[TABLE_MAXNAMELEN]; 67}; 68 69struct chain_head; 70struct rule_head; 71 72struct counter_map 73{ 74 enum { 75 COUNTER_MAP_NOMAP, 76 COUNTER_MAP_NORMAL_MAP, 77 COUNTER_MAP_ZEROED, 78 COUNTER_MAP_SET 79 } maptype; 80 unsigned int mappos; 81}; 82 83enum iptcc_rule_type { 84 IPTCC_R_STANDARD, /* standard target (ACCEPT, ...) */ 85 IPTCC_R_MODULE, /* extension module (SNAT, ...) */ 86 IPTCC_R_FALLTHROUGH, /* fallthrough rule */ 87 IPTCC_R_JUMP, /* jump to other chain */ 88}; 89 90struct rule_head 91{ 92 struct list_head list; 93 struct chain_head *chain; 94 struct counter_map counter_map; 95 96 unsigned int index; /* index (needed for counter_map) */ 97 unsigned int offset; /* offset in rule blob */ 98 99 enum iptcc_rule_type type; 100 struct chain_head *jump; /* jump target, if IPTCC_R_JUMP */ 101 102 unsigned int size; /* size of entry data */ 103 STRUCT_ENTRY entry[0]; 104}; 105 106struct chain_head 107{ 108 struct list_head list; 109 char name[TABLE_MAXNAMELEN]; 110 unsigned int hooknum; /* hook number+1 if builtin */ 111 unsigned int references; /* how many jumps reference us */ 112 int verdict; /* verdict if builtin */ 113 114 STRUCT_COUNTERS counters; /* per-chain counters */ 115 struct counter_map counter_map; 116 117 unsigned int num_rules; /* number of rules in list */ 118 struct list_head rules; /* list of rules */ 119 120 unsigned int index; /* index (needed for jump resolval) */ 121 unsigned int head_offset; /* offset in rule blob */ 122 unsigned int foot_index; /* index (needed for counter_map) */ 123 unsigned int foot_offset; /* offset in rule blob */ 124}; 125 126STRUCT_TC_HANDLE 127{ 128 int changed; /* Have changes been made? */ 129 130 struct list_head chains; 131 132 struct chain_head *chain_iterator_cur; 133 struct rule_head *rule_iterator_cur; 134 135 STRUCT_GETINFO info; 136 STRUCT_GET_ENTRIES *entries; 137}; 138 139/* allocate a new chain head for the cache */ 140static struct chain_head *iptcc_alloc_chain_head(const char *name, int hooknum) 141{ 142 struct chain_head *c = malloc(sizeof(*c)); 143 if (!c) 144 return NULL; 145 memset(c, 0, sizeof(*c)); 146 147 strncpy(c->name, name, TABLE_MAXNAMELEN); 148 c->hooknum = hooknum; 149 INIT_LIST_HEAD(&c->rules); 150 151 return c; 152} 153 154/* allocate and initialize a new rule for the cache */ 155static struct rule_head *iptcc_alloc_rule(struct chain_head *c, unsigned int size) 156{ 157 struct rule_head *r = malloc(sizeof(*r)+size); 158 if (!r) 159 return NULL; 160 memset(r, 0, sizeof(*r)); 161 162 r->chain = c; 163 r->size = size; 164 165 return r; 166} 167 168/* notify us that the ruleset has been modified by the user */ 169static void 170set_changed(TC_HANDLE_T h) 171{ 172 h->changed = 1; 173} 174 175#ifdef IPTC_DEBUG 176static void do_check(TC_HANDLE_T h, unsigned int line); 177#define CHECK(h) do { if (!getenv("IPTC_NO_CHECK")) do_check((h), __LINE__); } while(0) 178#else 179#define CHECK(h) 180#endif 181 182 183/********************************************************************** 184 * iptc blob utility functions (iptcb_*) 185 **********************************************************************/ 186 187static inline int 188iptcb_get_number(const STRUCT_ENTRY *i, 189 const STRUCT_ENTRY *seek, 190 unsigned int *pos) 191{ 192 if (i == seek) 193 return 1; 194 (*pos)++; 195 return 0; 196} 197 198static inline int 199iptcb_get_entry_n(STRUCT_ENTRY *i, 200 unsigned int number, 201 unsigned int *pos, 202 STRUCT_ENTRY **pe) 203{ 204 if (*pos == number) { 205 *pe = i; 206 return 1; 207 } 208 (*pos)++; 209 return 0; 210} 211 212static inline STRUCT_ENTRY * 213iptcb_get_entry(TC_HANDLE_T h, unsigned int offset) 214{ 215 return (STRUCT_ENTRY *)((char *)h->entries->entrytable + offset); 216} 217 218static unsigned int 219iptcb_entry2index(const TC_HANDLE_T h, const STRUCT_ENTRY *seek) 220{ 221 unsigned int pos = 0; 222 223 if (ENTRY_ITERATE(h->entries->entrytable, h->entries->size, 224 iptcb_get_number, seek, &pos) == 0) { 225 fprintf(stderr, "ERROR: offset %u not an entry!\n", 226 (unsigned int)((char *)seek - (char *)h->entries->entrytable)); 227 abort(); 228 } 229 return pos; 230} 231 232static inline STRUCT_ENTRY * 233iptcb_offset2entry(TC_HANDLE_T h, unsigned int offset) 234{ 235 return (STRUCT_ENTRY *) ((void *)h->entries->entrytable+offset); 236} 237 238 239static inline unsigned long 240iptcb_entry2offset(const TC_HANDLE_T h, const STRUCT_ENTRY *e) 241{ 242 return (void *)e - (void *)h->entries->entrytable; 243} 244 245static inline unsigned int 246iptcb_offset2index(const TC_HANDLE_T h, unsigned int offset) 247{ 248 return iptcb_entry2index(h, iptcb_offset2entry(h, offset)); 249} 250 251/* Returns 0 if not hook entry, else hooknumber + 1 */ 252static inline unsigned int 253iptcb_ent_is_hook_entry(STRUCT_ENTRY *e, TC_HANDLE_T h) 254{ 255 unsigned int i; 256 257 for (i = 0; i < NUMHOOKS; i++) { 258 if ((h->info.valid_hooks & (1 << i)) 259 && iptcb_get_entry(h, h->info.hook_entry[i]) == e) 260 return i+1; 261 } 262 return 0; 263} 264 265 266/********************************************************************** 267 * iptc cache utility functions (iptcc_*) 268 **********************************************************************/ 269 270/* Is the given chain builtin (1) or user-defined (0) */ 271static unsigned int iptcc_is_builtin(struct chain_head *c) 272{ 273 return (c->hooknum ? 1 : 0); 274} 275 276/* Get a specific rule within a chain */ 277static struct rule_head *iptcc_get_rule_num(struct chain_head *c, 278 unsigned int rulenum) 279{ 280 struct rule_head *r; 281 unsigned int num = 0; 282 283 list_for_each_entry(r, &c->rules, list) { 284 num++; 285 if (num == rulenum) 286 return r; 287 } 288 return NULL; 289} 290 291/* Get a specific rule within a chain backwards */ 292static struct rule_head *iptcc_get_rule_num_reverse(struct chain_head *c, 293 unsigned int rulenum) 294{ 295 struct rule_head *r; 296 unsigned int num = 0; 297 298 list_for_each_entry_reverse(r, &c->rules, list) { 299 num++; 300 if (num == rulenum) 301 return r; 302 } 303 return NULL; 304} 305 306/* Returns chain head if found, otherwise NULL. */ 307static struct chain_head * 308iptcc_find_chain_by_offset(TC_HANDLE_T handle, unsigned int offset) 309{ 310 struct list_head *pos; 311 312 if (list_empty(&handle->chains)) 313 return NULL; 314 315 list_for_each(pos, &handle->chains) { 316 struct chain_head *c = list_entry(pos, struct chain_head, list); 317 if (offset >= c->head_offset && offset <= c->foot_offset) 318 return c; 319 } 320 321 return NULL; 322} 323/* Returns chain head if found, otherwise NULL. */ 324static struct chain_head * 325iptcc_find_label(const char *name, TC_HANDLE_T handle) 326{ 327 struct list_head *pos; 328 329 if (list_empty(&handle->chains)) 330 return NULL; 331 332 list_for_each(pos, &handle->chains) { 333 struct chain_head *c = list_entry(pos, struct chain_head, list); 334 if (!strcmp(c->name, name)) 335 return c; 336 } 337 338 return NULL; 339} 340 341/* called when rule is to be removed from cache */ 342static void iptcc_delete_rule(struct rule_head *r) 343{ 344 DEBUGP("deleting rule %p (offset %u)\n", r, r->offset); 345 /* clean up reference count of called chain */ 346 if (r->type == IPTCC_R_JUMP 347 && r->jump) 348 r->jump->references--; 349 350 list_del(&r->list); 351 free(r); 352} 353 354 355/********************************************************************** 356 * RULESET PARSER (blob -> cache) 357 **********************************************************************/ 358 359/* Delete policy rule of previous chain, since cache doesn't contain 360 * chain policy rules. 361 * WARNING: This function has ugly design and relies on a lot of context, only 362 * to be called from specific places within the parser */ 363static int __iptcc_p_del_policy(TC_HANDLE_T h, unsigned int num) 364{ 365 if (h->chain_iterator_cur) { 366 /* policy rule is last rule */ 367 struct rule_head *pr = (struct rule_head *) 368 h->chain_iterator_cur->rules.prev; 369 370 /* save verdict */ 371 h->chain_iterator_cur->verdict = 372 *(int *)GET_TARGET(pr->entry)->data; 373 374 /* save counter and counter_map information */ 375 h->chain_iterator_cur->counter_map.maptype = 376 COUNTER_MAP_NORMAL_MAP; 377 h->chain_iterator_cur->counter_map.mappos = num-1; 378 memcpy(&h->chain_iterator_cur->counters, &pr->entry->counters, 379 sizeof(h->chain_iterator_cur->counters)); 380 381 /* foot_offset points to verdict rule */ 382 h->chain_iterator_cur->foot_index = num; 383 h->chain_iterator_cur->foot_offset = pr->offset; 384 385 /* delete rule from cache */ 386 iptcc_delete_rule(pr); 387 h->chain_iterator_cur->num_rules--; 388 389 return 1; 390 } 391 return 0; 392} 393 394/* alphabetically insert a chain into the list */ 395static inline void iptc_insert_chain(TC_HANDLE_T h, struct chain_head *c) 396{ 397 struct chain_head *tmp; 398 399 /* sort only user defined chains */ 400 if (!c->hooknum) { 401 list_for_each_entry(tmp, &h->chains, list) { 402 if (strcmp(c->name, tmp->name) <= 0) { 403 list_add(&c->list, tmp->list.prev); 404 return; 405 } 406 } 407 } 408 409 /* survived till end of list: add at tail */ 410 list_add_tail(&c->list, &h->chains); 411} 412 413/* Another ugly helper function split out of cache_add_entry to make it less 414 * spaghetti code */ 415static void __iptcc_p_add_chain(TC_HANDLE_T h, struct chain_head *c, 416 unsigned int offset, unsigned int *num) 417{ 418 __iptcc_p_del_policy(h, *num); 419 420 c->head_offset = offset; 421 c->index = *num; 422 423 iptc_insert_chain(h, c); 424 425 h->chain_iterator_cur = c; 426} 427 428/* main parser function: add an entry from the blob to the cache */ 429static int cache_add_entry(STRUCT_ENTRY *e, 430 TC_HANDLE_T h, 431 STRUCT_ENTRY **prev, 432 unsigned int *num) 433{ 434 unsigned int builtin; 435 unsigned int offset = (char *)e - (char *)h->entries->entrytable; 436 437 DEBUGP("entering..."); 438 439 /* Last entry ("policy rule"). End it.*/ 440 if (iptcb_entry2offset(h,e) + e->next_offset == h->entries->size) { 441 /* This is the ERROR node at the end of the chain */ 442 DEBUGP_C("%u:%u: end of table:\n", *num, offset); 443 444 __iptcc_p_del_policy(h, *num); 445 446 h->chain_iterator_cur = NULL; 447 goto out_inc; 448 } 449 450 /* We know this is the start of a new chain if it's an ERROR 451 * target, or a hook entry point */ 452 453 if (strcmp(GET_TARGET(e)->u.user.name, ERROR_TARGET) == 0) { 454 struct chain_head *c = 455 iptcc_alloc_chain_head((const char *)GET_TARGET(e)->data, 0); 456 DEBUGP_C("%u:%u:new userdefined chain %s: %p\n", *num, offset, 457 (char *)c->name, c); 458 if (!c) { 459 errno = -ENOMEM; 460 return -1; 461 } 462 463 __iptcc_p_add_chain(h, c, offset, num); 464 465 } else if ((builtin = iptcb_ent_is_hook_entry(e, h)) != 0) { 466 struct chain_head *c = 467 iptcc_alloc_chain_head((char *)hooknames[builtin-1], 468 builtin); 469 DEBUGP_C("%u:%u new builtin chain: %p (rules=%p)\n", 470 *num, offset, c, &c->rules); 471 if (!c) { 472 errno = -ENOMEM; 473 return -1; 474 } 475 476 c->hooknum = builtin; 477 478 __iptcc_p_add_chain(h, c, offset, num); 479 480 /* FIXME: this is ugly. */ 481 goto new_rule; 482 } else { 483 /* has to be normal rule */ 484 struct rule_head *r; 485new_rule: 486 487 if (!(r = iptcc_alloc_rule(h->chain_iterator_cur, 488 e->next_offset))) { 489 errno = ENOMEM; 490 return -1; 491 } 492 DEBUGP_C("%u:%u normal rule: %p: ", *num, offset, r); 493 494 r->index = *num; 495 r->offset = offset; 496 memcpy(r->entry, e, e->next_offset); 497 r->counter_map.maptype = COUNTER_MAP_NORMAL_MAP; 498 r->counter_map.mappos = r->index; 499 500 /* handling of jumps, etc. */ 501 if (!strcmp(GET_TARGET(e)->u.user.name, STANDARD_TARGET)) { 502 STRUCT_STANDARD_TARGET *t; 503 504 t = (STRUCT_STANDARD_TARGET *)GET_TARGET(e); 505 if (t->target.u.target_size 506 != ALIGN(sizeof(STRUCT_STANDARD_TARGET))) { 507 errno = EINVAL; 508 return -1; 509 } 510 511 if (t->verdict < 0) { 512 DEBUGP_C("standard, verdict=%d\n", t->verdict); 513 r->type = IPTCC_R_STANDARD; 514 } else if (t->verdict == r->offset+e->next_offset) { 515 DEBUGP_C("fallthrough\n"); 516 r->type = IPTCC_R_FALLTHROUGH; 517 } else { 518 DEBUGP_C("jump, target=%u\n", t->verdict); 519 r->type = IPTCC_R_JUMP; 520 /* Jump target fixup has to be deferred 521 * until second pass, since we migh not 522 * yet have parsed the target */ 523 } 524 } else { 525 DEBUGP_C("module, target=%s\n", GET_TARGET(e)->u.user.name); 526 r->type = IPTCC_R_MODULE; 527 } 528 529 list_add_tail(&r->list, &h->chain_iterator_cur->rules); 530 h->chain_iterator_cur->num_rules++; 531 } 532out_inc: 533 (*num)++; 534 return 0; 535} 536 537 538/* parse an iptables blob into it's pieces */ 539static int parse_table(TC_HANDLE_T h) 540{ 541 STRUCT_ENTRY *prev; 542 unsigned int num = 0; 543 struct chain_head *c; 544 545 /* First pass: over ruleset blob */ 546 ENTRY_ITERATE(h->entries->entrytable, h->entries->size, 547 cache_add_entry, h, &prev, &num); 548 549 /* Second pass: fixup parsed data from first pass */ 550 list_for_each_entry(c, &h->chains, list) { 551 struct rule_head *r; 552 list_for_each_entry(r, &c->rules, list) { 553 struct chain_head *c; 554 STRUCT_STANDARD_TARGET *t; 555 556 if (r->type != IPTCC_R_JUMP) 557 continue; 558 559 t = (STRUCT_STANDARD_TARGET *)GET_TARGET(r->entry); 560 c = iptcc_find_chain_by_offset(h, t->verdict); 561 if (!c) 562 return -1; 563 r->jump = c; 564 c->references++; 565 } 566 } 567 568 /* FIXME: sort chains */ 569 570 return 1; 571} 572 573 574/********************************************************************** 575 * RULESET COMPILATION (cache -> blob) 576 **********************************************************************/ 577 578/* Convenience structures */ 579struct iptcb_chain_start{ 580 STRUCT_ENTRY e; 581 struct ipt_error_target name; 582}; 583#define IPTCB_CHAIN_START_SIZE (sizeof(STRUCT_ENTRY) + \ 584 ALIGN(sizeof(struct ipt_error_target))) 585 586struct iptcb_chain_foot { 587 STRUCT_ENTRY e; 588 STRUCT_STANDARD_TARGET target; 589}; 590#define IPTCB_CHAIN_FOOT_SIZE (sizeof(STRUCT_ENTRY) + \ 591 ALIGN(sizeof(STRUCT_STANDARD_TARGET))) 592 593struct iptcb_chain_error { 594 STRUCT_ENTRY entry; 595 struct ipt_error_target target; 596}; 597#define IPTCB_CHAIN_ERROR_SIZE (sizeof(STRUCT_ENTRY) + \ 598 ALIGN(sizeof(struct ipt_error_target))) 599 600 601 602/* compile rule from cache into blob */ 603static inline int iptcc_compile_rule (TC_HANDLE_T h, STRUCT_REPLACE *repl, struct rule_head *r) 604{ 605 /* handle jumps */ 606 if (r->type == IPTCC_R_JUMP) { 607 STRUCT_STANDARD_TARGET *t; 608 t = (STRUCT_STANDARD_TARGET *)GET_TARGET(r->entry); 609 /* memset for memcmp convenience on delete/replace */ 610 memset(t->target.u.user.name, 0, FUNCTION_MAXNAMELEN); 611 strcpy(t->target.u.user.name, STANDARD_TARGET); 612 /* Jumps can only happen to builtin chains, so we 613 * can safely assume that they always have a header */ 614 t->verdict = r->jump->head_offset + IPTCB_CHAIN_START_SIZE; 615 } else if (r->type == IPTCC_R_FALLTHROUGH) { 616 STRUCT_STANDARD_TARGET *t; 617 t = (STRUCT_STANDARD_TARGET *)GET_TARGET(r->entry); 618 t->verdict = r->offset + r->size; 619 } 620 621 /* copy entry from cache to blob */ 622 memcpy((char *)repl->entries+r->offset, r->entry, r->size); 623 624 return 1; 625} 626 627/* compile chain from cache into blob */ 628static int iptcc_compile_chain(TC_HANDLE_T h, STRUCT_REPLACE *repl, struct chain_head *c) 629{ 630 int ret; 631 struct rule_head *r; 632 struct iptcb_chain_start *head; 633 struct iptcb_chain_foot *foot; 634 635 /* only user-defined chains have heaer */ 636 if (!iptcc_is_builtin(c)) { 637 /* put chain header in place */ 638 head = (void *)repl->entries + c->head_offset; 639 head->e.target_offset = sizeof(STRUCT_ENTRY); 640 head->e.next_offset = IPTCB_CHAIN_START_SIZE; 641 strcpy(head->name.t.u.user.name, ERROR_TARGET); 642 head->name.t.u.target_size = 643 ALIGN(sizeof(struct ipt_error_target)); 644 strcpy(head->name.error, c->name); 645 } else { 646 repl->hook_entry[c->hooknum-1] = c->head_offset; 647 repl->underflow[c->hooknum-1] = c->foot_offset; 648 } 649 650 /* iterate over rules */ 651 list_for_each_entry(r, &c->rules, list) { 652 ret = iptcc_compile_rule(h, repl, r); 653 if (ret < 0) 654 return ret; 655 } 656 657 /* put chain footer in place */ 658 foot = (void *)repl->entries + c->foot_offset; 659 foot->e.target_offset = sizeof(STRUCT_ENTRY); 660 foot->e.next_offset = IPTCB_CHAIN_FOOT_SIZE; 661 strcpy(foot->target.target.u.user.name, STANDARD_TARGET); 662 foot->target.target.u.target_size = 663 ALIGN(sizeof(STRUCT_STANDARD_TARGET)); 664 /* builtin targets have verdict, others return */ 665 if (iptcc_is_builtin(c)) 666 foot->target.verdict = c->verdict; 667 else 668 foot->target.verdict = RETURN; 669 /* set policy-counters */ 670 memcpy(&foot->e.counters, &c->counters, sizeof(STRUCT_COUNTERS)); 671 672 return 0; 673} 674 675/* calculate offset and number for every rule in the cache */ 676static int iptcc_compile_chain_offsets(TC_HANDLE_T h, struct chain_head *c, 677 unsigned int *offset, unsigned int *num) 678{ 679 struct rule_head *r; 680 681 c->head_offset = *offset; 682 DEBUGP("%s: chain_head %u, offset=%u\n", c->name, *num, *offset); 683 684 if (!iptcc_is_builtin(c)) { 685 /* Chain has header */ 686 *offset += sizeof(STRUCT_ENTRY) 687 + ALIGN(sizeof(struct ipt_error_target)); 688 (*num)++; 689 } 690 691 list_for_each_entry(r, &c->rules, list) { 692 DEBUGP("rule %u, offset=%u, index=%u\n", *num, *offset, *num); 693 r->offset = *offset; 694 r->index = *num; 695 *offset += r->size; 696 (*num)++; 697 } 698 699 DEBUGP("%s; chain_foot %u, offset=%u, index=%u\n", c->name, *num, 700 *offset, *num); 701 c->foot_offset = *offset; 702 c->foot_index = *num; 703 *offset += sizeof(STRUCT_ENTRY) 704 + ALIGN(sizeof(STRUCT_STANDARD_TARGET)); 705 (*num)++; 706 707 return 1; 708} 709 710/* put the pieces back together again */ 711static int iptcc_compile_table_prep(TC_HANDLE_T h, unsigned int *size) 712{ 713 struct chain_head *c; 714 unsigned int offset = 0, num = 0; 715 int ret = 0; 716 717 /* First pass: calculate offset for every rule */ 718 list_for_each_entry(c, &h->chains, list) { 719 ret = iptcc_compile_chain_offsets(h, c, &offset, &num); 720 if (ret < 0) 721 return ret; 722 } 723 724 /* Append one error rule at end of chain */ 725 num++; 726 offset += sizeof(STRUCT_ENTRY) 727 + ALIGN(sizeof(struct ipt_error_target)); 728 729 /* ruleset size is now in offset */ 730 *size = offset; 731 return num; 732} 733 734static int iptcc_compile_table(TC_HANDLE_T h, STRUCT_REPLACE *repl) 735{ 736 struct chain_head *c; 737 struct iptcb_chain_error *error; 738 739 /* Second pass: copy from cache to offsets, fill in jumps */ 740 list_for_each_entry(c, &h->chains, list) { 741 int ret = iptcc_compile_chain(h, repl, c); 742 if (ret < 0) 743 return ret; 744 } 745 746 /* Append error rule at end of chain */ 747 error = (void *)repl->entries + repl->size - IPTCB_CHAIN_ERROR_SIZE; 748 error->entry.target_offset = sizeof(STRUCT_ENTRY); 749 error->entry.next_offset = IPTCB_CHAIN_ERROR_SIZE; 750 error->target.t.u.user.target_size = 751 ALIGN(sizeof(struct ipt_error_target)); 752 strcpy((char *)&error->target.t.u.user.name, ERROR_TARGET); 753 strcpy((char *)&error->target.error, "ERROR"); 754 755 return 1; 756} 757 758/********************************************************************** 759 * EXTERNAL API (operates on cache only) 760 **********************************************************************/ 761 762/* Allocate handle of given size */ 763static TC_HANDLE_T 764alloc_handle(const char *tablename, unsigned int size, unsigned int num_rules) 765{ 766 size_t len; 767 TC_HANDLE_T h; 768 769 len = sizeof(STRUCT_TC_HANDLE) + size; 770 771 h = malloc(sizeof(STRUCT_TC_HANDLE)); 772 if (!h) { 773 errno = ENOMEM; 774 return NULL; 775 } 776 memset(h, 0, sizeof(*h)); 777 INIT_LIST_HEAD(&h->chains); 778 strcpy(h->info.name, tablename); 779 780 h->entries = malloc(sizeof(STRUCT_GET_ENTRIES) + size); 781 if (!h->entries) 782 goto out_free_handle; 783 784 strcpy(h->entries->name, tablename); 785 h->entries->size = size; 786 787 return h; 788 789out_free_handle: 790 free(h); 791 792 return NULL; 793} 794 795 796TC_HANDLE_T 797TC_INIT(const char *tablename) 798{ 799 TC_HANDLE_T h; 800 STRUCT_GETINFO info; 801 unsigned int tmp; 802 socklen_t s; 803 804 iptc_fn = TC_INIT; 805 806 if (strlen(tablename) >= TABLE_MAXNAMELEN) { 807 errno = EINVAL; 808 return NULL; 809 } 810 811 if (sockfd_use == 0) { 812 sockfd = socket(TC_AF, SOCK_RAW, IPPROTO_RAW); 813 if (sockfd < 0) 814 return NULL; 815 } 816 sockfd_use++; 817 818 s = sizeof(info); 819 820 strcpy(info.name, tablename); 821 if (getsockopt(sockfd, TC_IPPROTO, SO_GET_INFO, &info, &s) < 0) { 822 if (--sockfd_use == 0) { 823 close(sockfd); 824 sockfd = -1; 825 } 826 return NULL; 827 } 828 829 DEBUGP("valid_hooks=0x%08x, num_entries=%u, size=%u\n", 830 info.valid_hooks, info.num_entries, info.size); 831 832 if ((h = alloc_handle(info.name, info.size, info.num_entries)) 833 == NULL) { 834 if (--sockfd_use == 0) { 835 close(sockfd); 836 sockfd = -1; 837 } 838 return NULL; 839 } 840 841 /* Initialize current state */ 842 h->info = info; 843 844 h->entries->size = h->info.size; 845 846 tmp = sizeof(STRUCT_GET_ENTRIES) + h->info.size; 847 848 if (getsockopt(sockfd, TC_IPPROTO, SO_GET_ENTRIES, h->entries, 849 &tmp) < 0) 850 goto error; 851 852#ifdef IPTC_DEBUG2 853 { 854 int fd = open("/tmp/libiptc-so_get_entries.blob", 855 O_CREAT|O_WRONLY); 856 if (fd >= 0) { 857 write(fd, h->entries, tmp); 858 close(fd); 859 } 860 } 861#endif 862 863 if (parse_table(h) < 0) 864 goto error; 865 866 CHECK(h); 867 return h; 868error: 869 if (--sockfd_use == 0) { 870 close(sockfd); 871 sockfd = -1; 872 } 873 TC_FREE(&h); 874 return NULL; 875} 876 877void 878TC_FREE(TC_HANDLE_T *h) 879{ 880 struct chain_head *c, *tmp; 881 882 iptc_fn = TC_FREE; 883 if (--sockfd_use == 0) { 884 close(sockfd); 885 sockfd = -1; 886 } 887 888 list_for_each_entry_safe(c, tmp, &(*h)->chains, list) { 889 struct rule_head *r, *rtmp; 890 891 list_for_each_entry_safe(r, rtmp, &c->rules, list) { 892 free(r); 893 } 894 895 free(c); 896 } 897 898 free((*h)->entries); 899 free(*h); 900 901 *h = NULL; 902} 903 904static inline int 905print_match(const STRUCT_ENTRY_MATCH *m) 906{ 907 printf("Match name: `%s'\n", m->u.user.name); 908 return 0; 909} 910 911static int dump_entry(STRUCT_ENTRY *e, const TC_HANDLE_T handle); 912 913void 914TC_DUMP_ENTRIES(const TC_HANDLE_T handle) 915{ 916 iptc_fn = TC_DUMP_ENTRIES; 917 CHECK(handle); 918#if 0 919 printf("libiptc v%s. %u bytes.\n", 920 IPTABLES_VERSION, handle->entries->size); 921 printf("Table `%s'\n", handle->info.name); 922 printf("Hooks: pre/in/fwd/out/post = %u/%u/%u/%u/%u\n", 923 handle->info.hook_entry[HOOK_PRE_ROUTING], 924 handle->info.hook_entry[HOOK_LOCAL_IN], 925 handle->info.hook_entry[HOOK_FORWARD], 926 handle->info.hook_entry[HOOK_LOCAL_OUT], 927 handle->info.hook_entry[HOOK_POST_ROUTING]); 928 printf("Underflows: pre/in/fwd/out/post = %u/%u/%u/%u/%u\n", 929 handle->info.underflow[HOOK_PRE_ROUTING], 930 handle->info.underflow[HOOK_LOCAL_IN], 931 handle->info.underflow[HOOK_FORWARD], 932 handle->info.underflow[HOOK_LOCAL_OUT], 933 handle->info.underflow[HOOK_POST_ROUTING]); 934 935 ENTRY_ITERATE(handle->entries->entrytable, handle->entries->size, 936 dump_entry, handle); 937#endif 938} 939 940/* Does this chain exist? */ 941int TC_IS_CHAIN(const char *chain, const TC_HANDLE_T handle) 942{ 943 iptc_fn = TC_IS_CHAIN; 944 return iptcc_find_label(chain, handle) != NULL; 945} 946 947static void iptcc_chain_iterator_advance(TC_HANDLE_T handle) 948{ 949 struct chain_head *c = handle->chain_iterator_cur; 950 951 if (c->list.next == &handle->chains) 952 handle->chain_iterator_cur = NULL; 953 else 954 handle->chain_iterator_cur = 955 list_entry(c->list.next, struct chain_head, list); 956} 957 958/* Iterator functions to run through the chains. */ 959const char * 960TC_FIRST_CHAIN(TC_HANDLE_T *handle) 961{ 962 struct chain_head *c = list_entry((*handle)->chains.next, 963 struct chain_head, list); 964 965 iptc_fn = TC_FIRST_CHAIN; 966 967 968 if (list_empty(&(*handle)->chains)) { 969 DEBUGP(": no chains\n"); 970 return NULL; 971 } 972 973 (*handle)->chain_iterator_cur = c; 974 iptcc_chain_iterator_advance(*handle); 975 976 DEBUGP(": returning `%s'\n", c->name); 977 return c->name; 978} 979 980/* Iterator functions to run through the chains. Returns NULL at end. */ 981const char * 982TC_NEXT_CHAIN(TC_HANDLE_T *handle) 983{ 984 struct chain_head *c = (*handle)->chain_iterator_cur; 985 986 iptc_fn = TC_NEXT_CHAIN; 987 988 if (!c) { 989 DEBUGP(": no more chains\n"); 990 return NULL; 991 } 992 993 iptcc_chain_iterator_advance(*handle); 994 995 DEBUGP(": returning `%s'\n", c->name); 996 return c->name; 997} 998 999/* Get first rule in the given chain: NULL for empty chain. */ 1000const STRUCT_ENTRY * 1001TC_FIRST_RULE(const char *chain, TC_HANDLE_T *handle) 1002{ 1003 struct chain_head *c; 1004 struct rule_head *r; 1005 1006 iptc_fn = TC_FIRST_RULE; 1007 1008 DEBUGP("first rule(%s): ", chain); 1009 1010 c = iptcc_find_label(chain, *handle); 1011 if (!c) { 1012 errno = ENOENT; 1013 return NULL; 1014 } 1015 1016 /* Empty chain: single return/policy rule */ 1017 if (list_empty(&c->rules)) { 1018 DEBUGP_C("no rules, returning NULL\n"); 1019 return NULL; 1020 } 1021 1022 r = list_entry(c->rules.next, struct rule_head, list); 1023 (*handle)->rule_iterator_cur = r; 1024 DEBUGP_C("%p\n", r); 1025 1026 return r->entry; 1027} 1028 1029/* Returns NULL when rules run out. */ 1030const STRUCT_ENTRY * 1031TC_NEXT_RULE(const STRUCT_ENTRY *prev, TC_HANDLE_T *handle) 1032{ 1033 struct rule_head *r; 1034 1035 iptc_fn = TC_NEXT_RULE; 1036 DEBUGP("rule_iterator_cur=%p...", (*handle)->rule_iterator_cur); 1037 1038 if (!(*handle)->rule_iterator_cur) { 1039 DEBUGP_C("returning NULL\n"); 1040 return NULL; 1041 } 1042 1043 r = list_entry((*handle)->rule_iterator_cur->list.next, 1044 struct rule_head, list); 1045 1046 iptc_fn = TC_NEXT_RULE; 1047 1048 DEBUGP_C("next=%p, head=%p...", &r->list, 1049 &(*handle)->rule_iterator_cur->chain->rules); 1050 1051 if (&r->list == &(*handle)->rule_iterator_cur->chain->rules) { 1052 (*handle)->rule_iterator_cur = NULL; 1053 DEBUGP_C("finished, returning NULL\n"); 1054 return NULL; 1055 } 1056 1057 (*handle)->rule_iterator_cur = r; 1058 1059 /* NOTE: prev is without any influence ! */ 1060 DEBUGP_C("returning rule %p\n", r); 1061 return r->entry; 1062} 1063 1064/* How many rules in this chain? */ 1065unsigned int 1066TC_NUM_RULES(const char *chain, TC_HANDLE_T *handle) 1067{ 1068 struct chain_head *c; 1069 iptc_fn = TC_NUM_RULES; 1070 CHECK(*handle); 1071 1072 c = iptcc_find_label(chain, *handle); 1073 if (!c) { 1074 errno = ENOENT; 1075 return (unsigned int)-1; 1076 } 1077 1078 return c->num_rules; 1079} 1080 1081const STRUCT_ENTRY *TC_GET_RULE(const char *chain, 1082 unsigned int n, 1083 TC_HANDLE_T *handle) 1084{ 1085 struct chain_head *c; 1086 struct rule_head *r; 1087 1088 iptc_fn = TC_GET_RULE; 1089 1090 CHECK(*handle); 1091 1092 c = iptcc_find_label(chain, *handle); 1093 if (!c) { 1094 errno = ENOENT; 1095 return NULL; 1096 } 1097 1098 r = iptcc_get_rule_num(c, n); 1099 if (!r) 1100 return NULL; 1101 return r->entry; 1102} 1103 1104/* Returns a pointer to the target name of this position. */ 1105const char *standard_target_map(int verdict) 1106{ 1107 switch (verdict) { 1108 case RETURN: 1109 return LABEL_RETURN; 1110 break; 1111 case -NF_ACCEPT-1: 1112 return LABEL_ACCEPT; 1113 break; 1114 case -NF_DROP-1: 1115 return LABEL_DROP; 1116 break; 1117 case -NF_QUEUE-1: 1118 return LABEL_QUEUE; 1119 break; 1120 default: 1121 fprintf(stderr, "ERROR: %d not a valid target)\n", 1122 verdict); 1123 abort(); 1124 break; 1125 } 1126 /* not reached */ 1127 return NULL; 1128} 1129 1130/* Returns a pointer to the target name of this position. */ 1131const char *TC_GET_TARGET(const STRUCT_ENTRY *ce, 1132 TC_HANDLE_T *handle) 1133{ 1134 STRUCT_ENTRY *e = (STRUCT_ENTRY *)ce; 1135 struct rule_head *r = container_of(e, struct rule_head, entry[0]); 1136 1137 iptc_fn = TC_GET_TARGET; 1138 1139 switch(r->type) { 1140 int spos; 1141 case IPTCC_R_FALLTHROUGH: 1142 return ""; 1143 break; 1144 case IPTCC_R_JUMP: 1145 DEBUGP("r=%p, jump=%p, name=`%s'\n", r, r->jump, r->jump->name); 1146 return r->jump->name; 1147 break; 1148 case IPTCC_R_STANDARD: 1149 spos = *(int *)GET_TARGET(e)->data; 1150 DEBUGP("r=%p, spos=%d'\n", r, spos); 1151 return standard_target_map(spos); 1152 break; 1153 case IPTCC_R_MODULE: 1154 return GET_TARGET(e)->u.user.name; 1155 break; 1156 } 1157 return NULL; 1158} 1159/* Is this a built-in chain? Actually returns hook + 1. */ 1160int 1161TC_BUILTIN(const char *chain, const TC_HANDLE_T handle) 1162{ 1163 struct chain_head *c; 1164 1165 iptc_fn = TC_BUILTIN; 1166 1167 c = iptcc_find_label(chain, handle); 1168 if (!c) { 1169 errno = ENOENT; 1170 return 0; 1171 } 1172 1173 return iptcc_is_builtin(c); 1174} 1175 1176/* Get the policy of a given built-in chain */ 1177const char * 1178TC_GET_POLICY(const char *chain, 1179 STRUCT_COUNTERS *counters, 1180 TC_HANDLE_T *handle) 1181{ 1182 struct chain_head *c; 1183 1184 iptc_fn = TC_GET_POLICY; 1185 1186 DEBUGP("called for chain %s\n", chain); 1187 1188 c = iptcc_find_label(chain, *handle); 1189 if (!c) { 1190 errno = ENOENT; 1191 return NULL; 1192 } 1193 1194 if (!iptcc_is_builtin(c)) 1195 return NULL; 1196 1197 *counters = c->counters; 1198 1199 return standard_target_map(c->verdict); 1200} 1201 1202static int 1203iptcc_standard_map(struct rule_head *r, int verdict) 1204{ 1205 STRUCT_ENTRY *e = r->entry; 1206 STRUCT_STANDARD_TARGET *t; 1207 1208 t = (STRUCT_STANDARD_TARGET *)GET_TARGET(e); 1209 1210 if (t->target.u.target_size 1211 != ALIGN(sizeof(STRUCT_STANDARD_TARGET))) { 1212 errno = EINVAL; 1213 return 0; 1214 } 1215 /* memset for memcmp convenience on delete/replace */ 1216 memset(t->target.u.user.name, 0, FUNCTION_MAXNAMELEN); 1217 strcpy(t->target.u.user.name, STANDARD_TARGET); 1218 t->verdict = verdict; 1219 1220 r->type = IPTCC_R_STANDARD; 1221 1222 return 1; 1223} 1224 1225static int 1226iptcc_map_target(const TC_HANDLE_T handle, 1227 struct rule_head *r) 1228{ 1229 STRUCT_ENTRY *e = r->entry; 1230 STRUCT_ENTRY_TARGET *t = GET_TARGET(e); 1231 1232 /* Maybe it's empty (=> fall through) */ 1233 if (strcmp(t->u.user.name, "") == 0) { 1234 r->type = IPTCC_R_FALLTHROUGH; 1235 return 1; 1236 } 1237 /* Maybe it's a standard target name... */ 1238 else if (strcmp(t->u.user.name, LABEL_ACCEPT) == 0) 1239 return iptcc_standard_map(r, -NF_ACCEPT - 1); 1240 else if (strcmp(t->u.user.name, LABEL_DROP) == 0) 1241 return iptcc_standard_map(r, -NF_DROP - 1); 1242 else if (strcmp(t->u.user.name, LABEL_QUEUE) == 0) 1243 return iptcc_standard_map(r, -NF_QUEUE - 1); 1244 else if (strcmp(t->u.user.name, LABEL_RETURN) == 0) 1245 return iptcc_standard_map(r, RETURN); 1246 else if (TC_BUILTIN(t->u.user.name, handle)) { 1247 /* Can't jump to builtins. */ 1248 errno = EINVAL; 1249 return 0; 1250 } else { 1251 /* Maybe it's an existing chain name. */ 1252 struct chain_head *c; 1253 DEBUGP("trying to find chain `%s': ", t->u.user.name); 1254 1255 c = iptcc_find_label(t->u.user.name, handle); 1256 if (c) { 1257 DEBUGP_C("found!\n"); 1258 r->type = IPTCC_R_JUMP; 1259 r->jump = c; 1260 c->references++; 1261 return 1; 1262 } 1263 DEBUGP_C("not found :(\n"); 1264 } 1265 1266 /* Must be a module? If not, kernel will reject... */ 1267 /* memset to all 0 for your memcmp convenience: don't clear version */ 1268 memset(t->u.user.name + strlen(t->u.user.name), 1269 0, 1270 FUNCTION_MAXNAMELEN - 1 - strlen(t->u.user.name)); 1271 r->type = IPTCC_R_MODULE; 1272 set_changed(handle); 1273 return 1; 1274} 1275 1276/* Insert the entry `fw' in chain `chain' into position `rulenum'. */ 1277int 1278TC_INSERT_ENTRY(const IPT_CHAINLABEL chain, 1279 const STRUCT_ENTRY *e, 1280 unsigned int rulenum, 1281 TC_HANDLE_T *handle) 1282{ 1283 struct chain_head *c; 1284 struct rule_head *r; 1285 struct list_head *prev; 1286 1287 iptc_fn = TC_INSERT_ENTRY; 1288 1289 if (!(c = iptcc_find_label(chain, *handle))) { 1290 errno = ENOENT; 1291 return 0; 1292 } 1293 1294 /* first rulenum index = 0 1295 first c->num_rules index = 1 */ 1296 if (rulenum > c->num_rules) { 1297 errno = E2BIG; 1298 return 0; 1299 } 1300 1301 /* If we are inserting at the end just take advantage of the 1302 double linked list, insert will happen before the entry 1303 prev points to. */ 1304 if (rulenum == c->num_rules) { 1305 prev = &c->rules; 1306 } else if (rulenum + 1 <= c->num_rules/2) { 1307 r = iptcc_get_rule_num(c, rulenum + 1); 1308 prev = &r->list; 1309 } else { 1310 r = iptcc_get_rule_num_reverse(c, c->num_rules - rulenum); 1311 prev = &r->list; 1312 } 1313 1314 if (!(r = iptcc_alloc_rule(c, e->next_offset))) { 1315 errno = ENOMEM; 1316 return 0; 1317 } 1318 1319 memcpy(r->entry, e, e->next_offset); 1320 r->counter_map.maptype = COUNTER_MAP_SET; 1321 1322 if (!iptcc_map_target(*handle, r)) { 1323 free(r); 1324 return 0; 1325 } 1326 1327 list_add_tail(&r->list, prev); 1328 c->num_rules++; 1329 1330 set_changed(*handle); 1331 1332 return 1; 1333} 1334 1335/* Atomically replace rule `rulenum' in `chain' with `fw'. */ 1336int 1337TC_REPLACE_ENTRY(const IPT_CHAINLABEL chain, 1338 const STRUCT_ENTRY *e, 1339 unsigned int rulenum, 1340 TC_HANDLE_T *handle) 1341{ 1342 struct chain_head *c; 1343 struct rule_head *r, *old; 1344 1345 iptc_fn = TC_REPLACE_ENTRY; 1346 1347 if (!(c = iptcc_find_label(chain, *handle))) { 1348 errno = ENOENT; 1349 return 0; 1350 } 1351 1352 if (rulenum >= c->num_rules) { 1353 errno = E2BIG; 1354 return 0; 1355 } 1356 1357 /* Take advantage of the double linked list if possible. */ 1358 if (rulenum + 1 <= c->num_rules/2) { 1359 old = iptcc_get_rule_num(c, rulenum + 1); 1360 } else { 1361 old = iptcc_get_rule_num_reverse(c, c->num_rules - rulenum); 1362 } 1363 1364 if (!(r = iptcc_alloc_rule(c, e->next_offset))) { 1365 errno = ENOMEM; 1366 return 0; 1367 } 1368 1369 memcpy(r->entry, e, e->next_offset); 1370 r->counter_map.maptype = COUNTER_MAP_SET; 1371 1372 if (!iptcc_map_target(*handle, r)) { 1373 free(r); 1374 return 0; 1375 } 1376 1377 list_add(&r->list, &old->list); 1378 iptcc_delete_rule(old); 1379 1380 set_changed(*handle); 1381 1382 return 1; 1383} 1384 1385/* Append entry `fw' to chain `chain'. Equivalent to insert with 1386 rulenum = length of chain. */ 1387int 1388TC_APPEND_ENTRY(const IPT_CHAINLABEL chain, 1389 const STRUCT_ENTRY *e, 1390 TC_HANDLE_T *handle) 1391{ 1392 struct chain_head *c; 1393 struct rule_head *r; 1394 1395 iptc_fn = TC_APPEND_ENTRY; 1396 if (!(c = iptcc_find_label(chain, *handle))) { 1397 DEBUGP("unable to find chain `%s'\n", chain); 1398 errno = ENOENT; 1399 return 0; 1400 } 1401 1402 if (!(r = iptcc_alloc_rule(c, e->next_offset))) { 1403 DEBUGP("unable to allocate rule for chain `%s'\n", chain); 1404 errno = ENOMEM; 1405 return 0; 1406 } 1407 1408 memcpy(r->entry, e, e->next_offset); 1409 r->counter_map.maptype = COUNTER_MAP_SET; 1410 1411 if (!iptcc_map_target(*handle, r)) { 1412 DEBUGP("unable to map target of rule for chain `%s'\n", chain); 1413 free(r); 1414 return 0; 1415 } 1416 1417 list_add_tail(&r->list, &c->rules); 1418 c->num_rules++; 1419 1420 set_changed(*handle); 1421 1422 return 1; 1423} 1424 1425static inline int 1426match_different(const STRUCT_ENTRY_MATCH *a, 1427 const unsigned char *a_elems, 1428 const unsigned char *b_elems, 1429 unsigned char **maskptr) 1430{ 1431 const STRUCT_ENTRY_MATCH *b; 1432 unsigned int i; 1433 1434 /* Offset of b is the same as a. */ 1435 b = (void *)b_elems + ((unsigned char *)a - a_elems); 1436 1437 if (a->u.match_size != b->u.match_size) 1438 return 1; 1439 1440 if (strcmp(a->u.user.name, b->u.user.name) != 0) 1441 return 1; 1442 1443 *maskptr += ALIGN(sizeof(*a)); 1444 1445 for (i = 0; i < a->u.match_size - ALIGN(sizeof(*a)); i++) 1446 if (((a->data[i] ^ b->data[i]) & (*maskptr)[i]) != 0) 1447 return 1; 1448 *maskptr += i; 1449 return 0; 1450} 1451 1452static inline int 1453target_same(struct rule_head *a, struct rule_head *b,const unsigned char *mask) 1454{ 1455 unsigned int i; 1456 STRUCT_ENTRY_TARGET *ta, *tb; 1457 1458 if (a->type != b->type) 1459 return 0; 1460 1461 ta = GET_TARGET(a->entry); 1462 tb = GET_TARGET(b->entry); 1463 1464 switch (a->type) { 1465 case IPTCC_R_FALLTHROUGH: 1466 return 1; 1467 case IPTCC_R_JUMP: 1468 return a->jump == b->jump; 1469 case IPTCC_R_STANDARD: 1470 return ((STRUCT_STANDARD_TARGET *)ta)->verdict 1471 == ((STRUCT_STANDARD_TARGET *)tb)->verdict; 1472 case IPTCC_R_MODULE: 1473 if (ta->u.target_size != tb->u.target_size) 1474 return 0; 1475 if (strcmp(ta->u.user.name, tb->u.user.name) != 0) 1476 return 0; 1477 1478 for (i = 0; i < ta->u.target_size - sizeof(*ta); i++) 1479 if (((ta->data[i] ^ tb->data[i]) & mask[i]) != 0) 1480 return 0; 1481 return 1; 1482 default: 1483 fprintf(stderr, "ERROR: bad type %i\n", a->type); 1484 abort(); 1485 } 1486} 1487 1488static unsigned char * 1489is_same(const STRUCT_ENTRY *a, 1490 const STRUCT_ENTRY *b, 1491 unsigned char *matchmask); 1492 1493/* Delete the first rule in `chain' which matches `fw'. */ 1494int 1495TC_DELETE_ENTRY(const IPT_CHAINLABEL chain, 1496 const STRUCT_ENTRY *origfw, 1497 unsigned char *matchmask, 1498 TC_HANDLE_T *handle) 1499{ 1500 struct chain_head *c; 1501 struct rule_head *r, *i; 1502 1503 iptc_fn = TC_DELETE_ENTRY; 1504 if (!(c = iptcc_find_label(chain, *handle))) { 1505 errno = ENOENT; 1506 return 0; 1507 } 1508 1509 /* Create a rule_head from origfw. */ 1510 r = iptcc_alloc_rule(c, origfw->next_offset); 1511 if (!r) { 1512 errno = ENOMEM; 1513 return 0; 1514 } 1515 1516 memcpy(r->entry, origfw, origfw->next_offset); 1517 r->counter_map.maptype = COUNTER_MAP_NOMAP; 1518 if (!iptcc_map_target(*handle, r)) { 1519 DEBUGP("unable to map target of rule for chain `%s'\n", chain); 1520 free(r); 1521 return 0; 1522 } 1523 1524 list_for_each_entry(i, &c->rules, list) { 1525 unsigned char *mask; 1526 1527 mask = is_same(r->entry, i->entry, matchmask); 1528 if (!mask) 1529 continue; 1530 1531 if (!target_same(r, i, mask)) 1532 continue; 1533 1534 /* If we are about to delete the rule that is the 1535 * current iterator, move rule iterator back. next 1536 * pointer will then point to real next node */ 1537 if (i == (*handle)->rule_iterator_cur) { 1538 (*handle)->rule_iterator_cur = 1539 list_entry((*handle)->rule_iterator_cur->list.prev, 1540 struct rule_head, list); 1541 } 1542 1543 c->num_rules--; 1544 iptcc_delete_rule(i); 1545 1546 set_changed(*handle); 1547 free(r); 1548 return 1; 1549 } 1550 1551 free(r); 1552 errno = ENOENT; 1553 return 0; 1554} 1555 1556 1557/* Delete the rule in position `rulenum' in `chain'. */ 1558int 1559TC_DELETE_NUM_ENTRY(const IPT_CHAINLABEL chain, 1560 unsigned int rulenum, 1561 TC_HANDLE_T *handle) 1562{ 1563 struct chain_head *c; 1564 struct rule_head *r; 1565 1566 iptc_fn = TC_DELETE_NUM_ENTRY; 1567 1568 if (!(c = iptcc_find_label(chain, *handle))) { 1569 errno = ENOENT; 1570 return 0; 1571 } 1572 1573 if (rulenum >= c->num_rules) { 1574 errno = E2BIG; 1575 return 0; 1576 } 1577 1578 /* Take advantage of the double linked list if possible. */ 1579 if (rulenum + 1 <= c->num_rules/2) { 1580 r = iptcc_get_rule_num(c, rulenum + 1); 1581 } else { 1582 r = iptcc_get_rule_num_reverse(c, c->num_rules - rulenum); 1583 } 1584 1585 /* If we are about to delete the rule that is the current 1586 * iterator, move rule iterator back. next pointer will then 1587 * point to real next node */ 1588 if (r == (*handle)->rule_iterator_cur) { 1589 (*handle)->rule_iterator_cur = 1590 list_entry((*handle)->rule_iterator_cur->list.prev, 1591 struct rule_head, list); 1592 } 1593 1594 c->num_rules--; 1595 iptcc_delete_rule(r); 1596 1597 set_changed(*handle); 1598 1599 return 1; 1600} 1601 1602/* Check the packet `fw' on chain `chain'. Returns the verdict, or 1603 NULL and sets errno. */ 1604const char * 1605TC_CHECK_PACKET(const IPT_CHAINLABEL chain, 1606 STRUCT_ENTRY *entry, 1607 TC_HANDLE_T *handle) 1608{ 1609 iptc_fn = TC_CHECK_PACKET; 1610 errno = ENOSYS; 1611 return NULL; 1612} 1613 1614/* Flushes the entries in the given chain (ie. empties chain). */ 1615int 1616TC_FLUSH_ENTRIES(const IPT_CHAINLABEL chain, TC_HANDLE_T *handle) 1617{ 1618 struct chain_head *c; 1619 struct rule_head *r, *tmp; 1620 1621 iptc_fn = TC_FLUSH_ENTRIES; 1622 if (!(c = iptcc_find_label(chain, *handle))) { 1623 errno = ENOENT; 1624 return 0; 1625 } 1626 1627 list_for_each_entry_safe(r, tmp, &c->rules, list) { 1628 iptcc_delete_rule(r); 1629 } 1630 1631 c->num_rules = 0; 1632 1633 set_changed(*handle); 1634 1635 return 1; 1636} 1637 1638/* Zeroes the counters in a chain. */ 1639int 1640TC_ZERO_ENTRIES(const IPT_CHAINLABEL chain, TC_HANDLE_T *handle) 1641{ 1642 struct chain_head *c; 1643 struct rule_head *r; 1644 1645 iptc_fn = TC_ZERO_ENTRIES; 1646 if (!(c = iptcc_find_label(chain, *handle))) { 1647 errno = ENOENT; 1648 return 0; 1649 } 1650 1651 list_for_each_entry(r, &c->rules, list) { 1652 if (r->counter_map.maptype == COUNTER_MAP_NORMAL_MAP) 1653 r->counter_map.maptype = COUNTER_MAP_ZEROED; 1654 } 1655 1656 set_changed(*handle); 1657 1658 return 1; 1659} 1660 1661STRUCT_COUNTERS * 1662TC_READ_COUNTER(const IPT_CHAINLABEL chain, 1663 unsigned int rulenum, 1664 TC_HANDLE_T *handle) 1665{ 1666 struct chain_head *c; 1667 struct rule_head *r; 1668 1669 iptc_fn = TC_READ_COUNTER; 1670 CHECK(*handle); 1671 1672 if (!(c = iptcc_find_label(chain, *handle))) { 1673 errno = ENOENT; 1674 return NULL; 1675 } 1676 1677 if (!(r = iptcc_get_rule_num(c, rulenum))) { 1678 errno = E2BIG; 1679 return NULL; 1680 } 1681 1682 return &r->entry[0].counters; 1683} 1684 1685int 1686TC_ZERO_COUNTER(const IPT_CHAINLABEL chain, 1687 unsigned int rulenum, 1688 TC_HANDLE_T *handle) 1689{ 1690 struct chain_head *c; 1691 struct rule_head *r; 1692 1693 iptc_fn = TC_ZERO_COUNTER; 1694 CHECK(*handle); 1695 1696 if (!(c = iptcc_find_label(chain, *handle))) { 1697 errno = ENOENT; 1698 return 0; 1699 } 1700 1701 if (!(r = iptcc_get_rule_num(c, rulenum))) { 1702 errno = E2BIG; 1703 return 0; 1704 } 1705 1706 if (r->counter_map.maptype == COUNTER_MAP_NORMAL_MAP) 1707 r->counter_map.maptype = COUNTER_MAP_ZEROED; 1708 1709 set_changed(*handle); 1710 1711 return 1; 1712} 1713 1714int 1715TC_SET_COUNTER(const IPT_CHAINLABEL chain, 1716 unsigned int rulenum, 1717 STRUCT_COUNTERS *counters, 1718 TC_HANDLE_T *handle) 1719{ 1720 struct chain_head *c; 1721 struct rule_head *r; 1722 STRUCT_ENTRY *e; 1723 1724 iptc_fn = TC_SET_COUNTER; 1725 CHECK(*handle); 1726 1727 if (!(c = iptcc_find_label(chain, *handle))) { 1728 errno = ENOENT; 1729 return 0; 1730 } 1731 1732 if (!(r = iptcc_get_rule_num(c, rulenum))) { 1733 errno = E2BIG; 1734 return 0; 1735 } 1736 1737 e = r->entry; 1738 r->counter_map.maptype = COUNTER_MAP_SET; 1739 1740 memcpy(&e->counters, counters, sizeof(STRUCT_COUNTERS)); 1741 1742 set_changed(*handle); 1743 1744 return 1; 1745} 1746 1747/* Creates a new chain. */ 1748/* To create a chain, create two rules: error node and unconditional 1749 * return. */ 1750int 1751TC_CREATE_CHAIN(const IPT_CHAINLABEL chain, TC_HANDLE_T *handle) 1752{ 1753 static struct chain_head *c; 1754 1755 iptc_fn = TC_CREATE_CHAIN; 1756 1757 /* find_label doesn't cover built-in targets: DROP, ACCEPT, 1758 QUEUE, RETURN. */ 1759 if (iptcc_find_label(chain, *handle) 1760 || strcmp(chain, LABEL_DROP) == 0 1761 || strcmp(chain, LABEL_ACCEPT) == 0 1762 || strcmp(chain, LABEL_QUEUE) == 0 1763 || strcmp(chain, LABEL_RETURN) == 0) { 1764 DEBUGP("Chain `%s' already exists\n", chain); 1765 errno = EEXIST; 1766 return 0; 1767 } 1768 1769 if (strlen(chain)+1 > sizeof(IPT_CHAINLABEL)) { 1770 DEBUGP("Chain name `%s' too long\n", chain); 1771 errno = EINVAL; 1772 return 0; 1773 } 1774 1775 c = iptcc_alloc_chain_head(chain, 0); 1776 if (!c) { 1777 DEBUGP("Cannot allocate memory for chain `%s'\n", chain); 1778 errno = ENOMEM; 1779 return 0; 1780 1781 } 1782 1783 DEBUGP("Creating chain `%s'\n", chain); 1784 list_add_tail(&c->list, &(*handle)->chains); 1785 1786 set_changed(*handle); 1787 1788 return 1; 1789} 1790 1791/* Get the number of references to this chain. */ 1792int 1793TC_GET_REFERENCES(unsigned int *ref, const IPT_CHAINLABEL chain, 1794 TC_HANDLE_T *handle) 1795{ 1796 struct chain_head *c; 1797 1798 iptc_fn = TC_GET_REFERENCES; 1799 if (!(c = iptcc_find_label(chain, *handle))) { 1800 errno = ENOENT; 1801 return 0; 1802 } 1803 1804 *ref = c->references; 1805 1806 return 1; 1807} 1808 1809/* Deletes a chain. */ 1810int 1811TC_DELETE_CHAIN(const IPT_CHAINLABEL chain, TC_HANDLE_T *handle) 1812{ 1813 unsigned int references; 1814 struct chain_head *c; 1815 1816 iptc_fn = TC_DELETE_CHAIN; 1817 1818 if (!(c = iptcc_find_label(chain, *handle))) { 1819 DEBUGP("cannot find chain `%s'\n", chain); 1820 errno = ENOENT; 1821 return 0; 1822 } 1823 1824 if (TC_BUILTIN(chain, *handle)) { 1825 DEBUGP("cannot remove builtin chain `%s'\n", chain); 1826 errno = EINVAL; 1827 return 0; 1828 } 1829 1830 if (!TC_GET_REFERENCES(&references, chain, handle)) { 1831 DEBUGP("cannot get references on chain `%s'\n", chain); 1832 return 0; 1833 } 1834 1835 if (references > 0) { 1836 DEBUGP("chain `%s' still has references\n", chain); 1837 errno = EMLINK; 1838 return 0; 1839 } 1840 1841 if (c->num_rules) { 1842 DEBUGP("chain `%s' is not empty\n", chain); 1843 errno = ENOTEMPTY; 1844 return 0; 1845 } 1846 1847 /* If we are about to delete the chain that is the current 1848 * iterator, move chain iterator firward. */ 1849 if (c == (*handle)->chain_iterator_cur) 1850 iptcc_chain_iterator_advance(*handle); 1851 1852 list_del(&c->list); 1853 free(c); 1854 1855 DEBUGP("chain `%s' deleted\n", chain); 1856 1857 set_changed(*handle); 1858 1859 return 1; 1860} 1861 1862/* Renames a chain. */ 1863int TC_RENAME_CHAIN(const IPT_CHAINLABEL oldname, 1864 const IPT_CHAINLABEL newname, 1865 TC_HANDLE_T *handle) 1866{ 1867 struct chain_head *c; 1868 iptc_fn = TC_RENAME_CHAIN; 1869 1870 /* find_label doesn't cover built-in targets: DROP, ACCEPT, 1871 QUEUE, RETURN. */ 1872 if (iptcc_find_label(newname, *handle) 1873 || strcmp(newname, LABEL_DROP) == 0 1874 || strcmp(newname, LABEL_ACCEPT) == 0 1875 || strcmp(newname, LABEL_QUEUE) == 0 1876 || strcmp(newname, LABEL_RETURN) == 0) { 1877 errno = EEXIST; 1878 return 0; 1879 } 1880 1881 if (!(c = iptcc_find_label(oldname, *handle)) 1882 || TC_BUILTIN(oldname, *handle)) { 1883 errno = ENOENT; 1884 return 0; 1885 } 1886 1887 if (strlen(newname)+1 > sizeof(IPT_CHAINLABEL)) { 1888 errno = EINVAL; 1889 return 0; 1890 } 1891 1892 strncpy(c->name, newname, sizeof(IPT_CHAINLABEL)); 1893 1894 set_changed(*handle); 1895 1896 return 1; 1897} 1898 1899/* Sets the policy on a built-in chain. */ 1900int 1901TC_SET_POLICY(const IPT_CHAINLABEL chain, 1902 const IPT_CHAINLABEL policy, 1903 STRUCT_COUNTERS *counters, 1904 TC_HANDLE_T *handle) 1905{ 1906 struct chain_head *c; 1907 1908 iptc_fn = TC_SET_POLICY; 1909 1910 if (!(c = iptcc_find_label(chain, *handle))) { 1911 DEBUGP("cannot find chain `%s'\n", chain); 1912 errno = ENOENT; 1913 return 0; 1914 } 1915 1916 if (!iptcc_is_builtin(c)) { 1917 DEBUGP("cannot set policy of userdefinedchain `%s'\n", chain); 1918 errno = ENOENT; 1919 return 0; 1920 } 1921 1922 if (strcmp(policy, LABEL_ACCEPT) == 0) 1923 c->verdict = -NF_ACCEPT - 1; 1924 else if (strcmp(policy, LABEL_DROP) == 0) 1925 c->verdict = -NF_DROP - 1; 1926 else { 1927 errno = EINVAL; 1928 return 0; 1929 } 1930 1931 if (counters) { 1932 /* set byte and packet counters */ 1933 memcpy(&c->counters, counters, sizeof(STRUCT_COUNTERS)); 1934 c->counter_map.maptype = COUNTER_MAP_SET; 1935 } else { 1936 c->counter_map.maptype = COUNTER_MAP_NOMAP; 1937 } 1938 1939 set_changed(*handle); 1940 1941 return 1; 1942} 1943 1944/* Without this, on gcc 2.7.2.3, we get: 1945 libiptc.c: In function `TC_COMMIT': 1946 libiptc.c:833: fixed or forbidden register was spilled. 1947 This may be due to a compiler bug or to impossible asm 1948 statements or clauses. 1949*/ 1950static void 1951subtract_counters(STRUCT_COUNTERS *answer, 1952 const STRUCT_COUNTERS *a, 1953 const STRUCT_COUNTERS *b) 1954{ 1955 answer->pcnt = a->pcnt - b->pcnt; 1956 answer->bcnt = a->bcnt - b->bcnt; 1957} 1958 1959 1960static void counters_nomap(STRUCT_COUNTERS_INFO *newcounters, 1961 unsigned int index) 1962{ 1963 newcounters->counters[index] = ((STRUCT_COUNTERS) { 0, 0}); 1964 DEBUGP_C("NOMAP => zero\n"); 1965} 1966 1967static void counters_normal_map(STRUCT_COUNTERS_INFO *newcounters, 1968 STRUCT_REPLACE *repl, 1969 unsigned int index, 1970 unsigned int mappos) 1971{ 1972 /* Original read: X. 1973 * Atomic read on replacement: X + Y. 1974 * Currently in kernel: Z. 1975 * Want in kernel: X + Y + Z. 1976 * => Add in X + Y 1977 * => Add in replacement read. 1978 */ 1979 newcounters->counters[index] = repl->counters[mappos]; 1980 DEBUGP_C("NORMAL_MAP => mappos %u \n", mappos); 1981} 1982 1983static void counters_map_zeroed(STRUCT_COUNTERS_INFO *newcounters, 1984 STRUCT_REPLACE *repl, 1985 unsigned int index, 1986 unsigned int mappos, 1987 STRUCT_COUNTERS *counters) 1988{ 1989 /* Original read: X. 1990 * Atomic read on replacement: X + Y. 1991 * Currently in kernel: Z. 1992 * Want in kernel: Y + Z. 1993 * => Add in Y. 1994 * => Add in (replacement read - original read). 1995 */ 1996 subtract_counters(&newcounters->counters[index], 1997 &repl->counters[mappos], 1998 counters); 1999 DEBUGP_C("ZEROED => mappos %u\n", mappos); 2000} 2001 2002static void counters_map_set(STRUCT_COUNTERS_INFO *newcounters, 2003 unsigned int index, 2004 STRUCT_COUNTERS *counters) 2005{ 2006 /* Want to set counter (iptables-restore) */ 2007 2008 memcpy(&newcounters->counters[index], counters, 2009 sizeof(STRUCT_COUNTERS)); 2010 2011 DEBUGP_C("SET\n"); 2012} 2013 2014 2015int 2016TC_COMMIT(TC_HANDLE_T *handle) 2017{ 2018 /* Replace, then map back the counters. */ 2019 STRUCT_REPLACE *repl; 2020 STRUCT_COUNTERS_INFO *newcounters; 2021 struct chain_head *c; 2022 int ret; 2023 size_t counterlen; 2024 int new_number; 2025 unsigned int new_size; 2026 2027 iptc_fn = TC_COMMIT; 2028 CHECK(*handle); 2029 2030 /* Don't commit if nothing changed. */ 2031 if (!(*handle)->changed) 2032 goto finished; 2033 2034 new_number = iptcc_compile_table_prep(*handle, &new_size); 2035 if (new_number < 0) { 2036 errno = ENOMEM; 2037 return 0; 2038 } 2039 2040 repl = malloc(sizeof(*repl) + new_size); 2041 if (!repl) { 2042 errno = ENOMEM; 2043 return 0; 2044 } 2045 memset(repl, 0, sizeof(*repl) + new_size); 2046 2047#if 0 2048 TC_DUMP_ENTRIES(*handle); 2049#endif 2050 2051 counterlen = sizeof(STRUCT_COUNTERS_INFO) 2052 + sizeof(STRUCT_COUNTERS) * new_number; 2053 2054 /* These are the old counters we will get from kernel */ 2055 repl->counters = malloc(sizeof(STRUCT_COUNTERS) 2056 * (*handle)->info.num_entries); 2057 if (!repl->counters) { 2058 free(repl); 2059 errno = ENOMEM; 2060 return 0; 2061 } 2062 /* These are the counters we're going to put back, later. */ 2063 newcounters = malloc(counterlen); 2064 if (!newcounters) { 2065 free(repl->counters); 2066 free(repl); 2067 errno = ENOMEM; 2068 return 0; 2069 } 2070 memset(newcounters, 0, counterlen); 2071 2072 strcpy(repl->name, (*handle)->info.name); 2073 repl->num_entries = new_number; 2074 repl->size = new_size; 2075 2076 repl->num_counters = (*handle)->info.num_entries; 2077 repl->valid_hooks = (*handle)->info.valid_hooks; 2078 2079 DEBUGP("num_entries=%u, size=%u, num_counters=%u\n", 2080 repl->num_entries, repl->size, repl->num_counters); 2081 2082 ret = iptcc_compile_table(*handle, repl); 2083 if (ret < 0) { 2084 errno = ret; 2085 free(repl->counters); 2086 free(repl); 2087 return 0; 2088 } 2089 2090 2091#ifdef IPTC_DEBUG2 2092 { 2093 int fd = open("/tmp/libiptc-so_set_replace.blob", 2094 O_CREAT|O_WRONLY); 2095 if (fd >= 0) { 2096 write(fd, repl, sizeof(*repl) + repl->size); 2097 close(fd); 2098 } 2099 } 2100#endif 2101 2102 if (setsockopt(sockfd, TC_IPPROTO, SO_SET_REPLACE, repl, 2103 sizeof(*repl) + repl->size) < 0) { 2104 free(repl->counters); 2105 free(repl); 2106 free(newcounters); 2107 return 0; 2108 } 2109 2110 /* Put counters back. */ 2111 strcpy(newcounters->name, (*handle)->info.name); 2112 newcounters->num_counters = new_number; 2113 2114 list_for_each_entry(c, &(*handle)->chains, list) { 2115 struct rule_head *r; 2116 2117 /* Builtin chains have their own counters */ 2118 if (iptcc_is_builtin(c)) { 2119 DEBUGP("counter for chain-index %u: ", c->foot_index); 2120 switch(c->counter_map.maptype) { 2121 case COUNTER_MAP_NOMAP: 2122 counters_nomap(newcounters, c->foot_index); 2123 break; 2124 case COUNTER_MAP_NORMAL_MAP: 2125 counters_normal_map(newcounters, repl, 2126 c->foot_index, 2127 c->counter_map.mappos); 2128 break; 2129 case COUNTER_MAP_ZEROED: 2130 counters_map_zeroed(newcounters, repl, 2131 c->foot_index, 2132 c->counter_map.mappos, 2133 &c->counters); 2134 break; 2135 case COUNTER_MAP_SET: 2136 counters_map_set(newcounters, c->foot_index, 2137 &c->counters); 2138 break; 2139 } 2140 } 2141 2142 list_for_each_entry(r, &c->rules, list) { 2143 DEBUGP("counter for index %u: ", r->index); 2144 switch (r->counter_map.maptype) { 2145 case COUNTER_MAP_NOMAP: 2146 counters_nomap(newcounters, r->index); 2147 break; 2148 2149 case COUNTER_MAP_NORMAL_MAP: 2150 counters_normal_map(newcounters, repl, 2151 r->index, 2152 r->counter_map.mappos); 2153 break; 2154 2155 case COUNTER_MAP_ZEROED: 2156 counters_map_zeroed(newcounters, repl, 2157 r->index, 2158 r->counter_map.mappos, 2159 &r->entry->counters); 2160 break; 2161 2162 case COUNTER_MAP_SET: 2163 counters_map_set(newcounters, r->index, 2164 &r->entry->counters); 2165 break; 2166 } 2167 } 2168 } 2169 2170 2171#ifdef KERNEL_64_USERSPACE_32 2172 { 2173 /* Kernel will think that pointer should be 64-bits, and get 2174 padding. So we accomodate here (assumption: alignment of 2175 `counters' is on 64-bit boundary). */ 2176 u_int64_t *kernptr = (u_int64_t *)&newcounters->counters; 2177 if ((unsigned long)&newcounters->counters % 8 != 0) { 2178 fprintf(stderr, 2179 "counters alignment incorrect! Mail rusty!\n"); 2180 abort(); 2181 } 2182 *kernptr = newcounters->counters; 2183 } 2184#endif /* KERNEL_64_USERSPACE_32 */ 2185 2186#ifdef IPTC_DEBUG2 2187 { 2188 int fd = open("/tmp/libiptc-so_set_add_counters.blob", 2189 O_CREAT|O_WRONLY); 2190 if (fd >= 0) { 2191 write(fd, newcounters, counterlen); 2192 close(fd); 2193 } 2194 } 2195#endif 2196 2197 if (setsockopt(sockfd, TC_IPPROTO, SO_SET_ADD_COUNTERS, 2198 newcounters, counterlen) < 0) { 2199 free(repl->counters); 2200 free(repl); 2201 free(newcounters); 2202 return 0; 2203 } 2204 2205 free(repl->counters); 2206 free(repl); 2207 free(newcounters); 2208 2209 finished: 2210 TC_FREE(handle); 2211 return 1; 2212} 2213 2214/* Get raw socket. */ 2215int 2216TC_GET_RAW_SOCKET() 2217{ 2218 return sockfd; 2219} 2220 2221/* Translates errno numbers into more human-readable form than strerror. */ 2222const char * 2223TC_STRERROR(int err) 2224{ 2225 unsigned int i; 2226 struct table_struct { 2227 void *fn; 2228 int err; 2229 const char *message; 2230 } table [] = 2231 { { TC_INIT, EPERM, "Permission denied (you must be root)" }, 2232 { TC_INIT, EINVAL, "Module is wrong version" }, 2233 { TC_INIT, ENOENT, 2234 "Table does not exist (do you need to insmod?)" }, 2235 { TC_DELETE_CHAIN, ENOTEMPTY, "Chain is not empty" }, 2236 { TC_DELETE_CHAIN, EINVAL, "Can't delete built-in chain" }, 2237 { TC_DELETE_CHAIN, EMLINK, 2238 "Can't delete chain with references left" }, 2239 { TC_CREATE_CHAIN, EEXIST, "Chain already exists" }, 2240 { TC_INSERT_ENTRY, E2BIG, "Index of insertion too big" }, 2241 { TC_REPLACE_ENTRY, E2BIG, "Index of replacement too big" }, 2242 { TC_DELETE_NUM_ENTRY, E2BIG, "Index of deletion too big" }, 2243 { TC_READ_COUNTER, E2BIG, "Index of counter too big" }, 2244 { TC_ZERO_COUNTER, E2BIG, "Index of counter too big" }, 2245 { TC_INSERT_ENTRY, ELOOP, "Loop found in table" }, 2246 { TC_INSERT_ENTRY, EINVAL, "Target problem" }, 2247 /* EINVAL for CHECK probably means bad interface. */ 2248 { TC_CHECK_PACKET, EINVAL, 2249 "Bad arguments (does that interface exist?)" }, 2250 { TC_CHECK_PACKET, ENOSYS, 2251 "Checking will most likely never get implemented" }, 2252 /* ENOENT for DELETE probably means no matching rule */ 2253 { TC_DELETE_ENTRY, ENOENT, 2254 "Bad rule (does a matching rule exist in that chain?)" }, 2255 { TC_SET_POLICY, ENOENT, 2256 "Bad built-in chain name" }, 2257 { TC_SET_POLICY, EINVAL, 2258 "Bad policy name" }, 2259 2260 { NULL, 0, "Incompatible with this kernel" }, 2261 { NULL, ENOPROTOOPT, "iptables who? (do you need to insmod?)" }, 2262 { NULL, ENOSYS, "Will be implemented real soon. I promise ;)" }, 2263 { NULL, ENOMEM, "Memory allocation problem" }, 2264 { NULL, ENOENT, "No chain/target/match by that name" }, 2265 }; 2266 2267 for (i = 0; i < sizeof(table)/sizeof(struct table_struct); i++) { 2268 if ((!table[i].fn || table[i].fn == iptc_fn) 2269 && table[i].err == err) 2270 return table[i].message; 2271 } 2272 2273 return strerror(err); 2274} 2275