m_ipt.c revision 52d6a850505d70a699fc89604986c45b0cd0c54e 
1/*
2 * m_ipt.c	iptables based targets
3 * 		utilities mostly ripped from iptables <duh, its the linux way>
4 *
5 *		This program is free software; you can distribute it and/or
6 *		modify it under the terms of the GNU General Public License
7 *		as published by the Free Software Foundation; either version
8 *		2 of the License, or (at your option) any later version.
9 *
10 * Authors:  J Hadi Salim (hadi@cyberus.ca)
11 */
12
13#include <syslog.h>
14#include <sys/socket.h>
15#include <netinet/in.h>
16#include <arpa/inet.h>
17#include <linux/if.h>
18#include <iptables.h>
19#include <linux/netfilter.h>
20#include <linux/netfilter_ipv4/ip_tables.h>
21#include "utils.h"
22#include "tc_util.h"
23#include <linux/tc_act/tc_ipt.h>
24#include <stdio.h>
25#include <dlfcn.h>
26#include <getopt.h>
27#include <errno.h>
28#include <string.h>
29#include <netdb.h>
30#include <stdlib.h>
31#include <ctype.h>
32#include <stdarg.h>
33#include <unistd.h>
34#include <fcntl.h>
35#include <sys/wait.h>
36
37static const char *pname = "tc-ipt";
38static const char *tname = "mangle";
39static const char *pversion = "0.1";
40
41static const char *ipthooks[] = {
42	"NF_IP_PRE_ROUTING",
43	"NF_IP_LOCAL_IN",
44	"NF_IP_FORWARD",
45	"NF_IP_LOCAL_OUT",
46	"NF_IP_POST_ROUTING",
47};
48
49static struct option original_opts[] = {
50	{"jump", 1, 0, 'j'},
51	{0, 0, 0, 0}
52};
53
54static struct iptables_target *t_list = NULL;
55static struct option *opts = original_opts;
56static unsigned int global_option_offset = 0;
57#define OPTION_OFFSET 256
58
59char *lib_dir;
60
61void
62register_target(struct iptables_target *me)
63{
64/*      fprintf(stderr, "\nDummy register_target %s \n", me->name);
65*/
66	me->next = t_list;
67	t_list = me;
68
69}
70
71void
72xtables_register_target(struct iptables_target *me)
73{
74	me->next = t_list;
75	t_list = me;
76}
77
78void
79exit_tryhelp(int status)
80{
81	fprintf(stderr, "Try `%s -h' or '%s --help' for more information.\n",
82		pname, pname);
83	exit(status);
84}
85
86void
87exit_error(enum exittype status, char *msg, ...)
88{
89	va_list args;
90
91	va_start(args, msg);
92	fprintf(stderr, "%s v%s: ", pname, pversion);
93	vfprintf(stderr, msg, args);
94	va_end(args);
95	fprintf(stderr, "\n");
96	if (status == PARAMETER_PROBLEM)
97		exit_tryhelp(status);
98	if (status == VERSION_PROBLEM)
99		fprintf(stderr,
100			"Perhaps iptables or your kernel needs to be upgraded.\n");
101	exit(status);
102}
103
104/* stolen from iptables 1.2.11
105They should really have them as a library so i can link to them
106Email them next time i remember
107*/
108
109char *
110addr_to_dotted(const struct in_addr *addrp)
111{
112	static char buf[20];
113	const unsigned char *bytep;
114
115	bytep = (const unsigned char *) &(addrp->s_addr);
116	sprintf(buf, "%d.%d.%d.%d", bytep[0], bytep[1], bytep[2], bytep[3]);
117	return buf;
118}
119
120int string_to_number_ll(const char *s, unsigned long long min,
121			unsigned long long max,
122		 unsigned long long *ret)
123{
124	unsigned long long number;
125	char *end;
126
127	/* Handle hex, octal, etc. */
128	errno = 0;
129	number = strtoull(s, &end, 0);
130	if (*end == '\0' && end != s) {
131		/* we parsed a number, let's see if we want this */
132		if (errno != ERANGE && min <= number && (!max || number <= max)) {
133			*ret = number;
134			return 0;
135		}
136	}
137	return -1;
138}
139
140int string_to_number_l(const char *s, unsigned long min, unsigned long max,
141		       unsigned long *ret)
142{
143	int result;
144	unsigned long long number;
145
146	result = string_to_number_ll(s, min, max, &number);
147	*ret = (unsigned long)number;
148
149	return result;
150}
151
152int string_to_number(const char *s, unsigned int min, unsigned int max,
153		unsigned int *ret)
154{
155	int result;
156	unsigned long number;
157
158	result = string_to_number_l(s, min, max, &number);
159	*ret = (unsigned int)number;
160
161	return result;
162}
163
164static void free_opts(struct option *local_opts)
165{
166	if (local_opts != original_opts) {
167		free(local_opts);
168		opts = original_opts;
169		global_option_offset = 0;
170	}
171}
172
173static struct option *
174merge_options(struct option *oldopts, const struct option *newopts,
175	      unsigned int *option_offset)
176{
177	struct option *merge;
178	unsigned int num_old, num_new, i;
179
180	for (num_old = 0; oldopts[num_old].name; num_old++) ;
181	for (num_new = 0; newopts[num_new].name; num_new++) ;
182
183	*option_offset = global_option_offset + OPTION_OFFSET;
184
185	merge = malloc(sizeof (struct option) * (num_new + num_old + 1));
186	memcpy(merge, oldopts, num_old * sizeof (struct option));
187	for (i = 0; i < num_new; i++) {
188		merge[num_old + i] = newopts[i];
189		merge[num_old + i].val += *option_offset;
190	}
191	memset(merge + num_old + num_new, 0, sizeof (struct option));
192
193	return merge;
194}
195
196static void *
197fw_calloc(size_t count, size_t size)
198{
199	void *p;
200
201	if ((p = (void *) calloc(count, size)) == NULL) {
202		perror("iptables: calloc failed");
203		exit(1);
204	}
205	return p;
206}
207
208static struct iptables_target *
209find_t(char *name)
210{
211	struct iptables_target *m;
212	for (m = t_list; m; m = m->next) {
213		if (strcmp(m->name, name) == 0)
214			return m;
215	}
216
217	return NULL;
218}
219
220static struct iptables_target *
221get_target_name(const char *name)
222{
223	void *handle;
224	char *error;
225	char *new_name, *lname;
226	struct iptables_target *m;
227	char path[strlen(lib_dir) + sizeof ("/libipt_.so") + strlen(name)];
228
229	new_name = malloc(strlen(name) + 1);
230	lname = malloc(strlen(name) + 1);
231	if (new_name)
232		memset(new_name, '\0', strlen(name) + 1);
233	else
234		exit_error(PARAMETER_PROBLEM, "get_target_name");
235
236	if (lname)
237		memset(lname, '\0', strlen(name) + 1);
238	else
239		exit_error(PARAMETER_PROBLEM, "get_target_name");
240
241	strcpy(new_name, name);
242	strcpy(lname, name);
243
244	if (isupper(lname[0])) {
245		int i;
246		for (i = 0; i < strlen(name); i++) {
247			lname[i] = tolower(lname[i]);
248		}
249	}
250
251	if (islower(new_name[0])) {
252		int i;
253		for (i = 0; i < strlen(new_name); i++) {
254			new_name[i] = toupper(new_name[i]);
255		}
256	}
257
258	/* try libxt_xx first */
259	sprintf(path, "%s/libxt_%s.so", lib_dir, new_name);
260	handle = dlopen(path, RTLD_LAZY);
261	if (!handle) {
262		/* try libipt_xx next */
263		sprintf(path, "%s/libipt_%s.so", lib_dir, new_name);
264		handle = dlopen(path, RTLD_LAZY);
265
266		if (!handle) {
267			sprintf(path, "%s/libxt_%s.so", lib_dir , lname);
268			handle = dlopen(path, RTLD_LAZY);
269		}
270
271		if (!handle) {
272			sprintf(path, "%s/libipt_%s.so", lib_dir , lname);
273			handle = dlopen(path, RTLD_LAZY);
274		}
275		/* ok, lets give up .. */
276		if (!handle) {
277			fputs(dlerror(), stderr);
278			printf("\n");
279			free(new_name);
280			return NULL;
281		}
282	}
283
284	m = dlsym(handle, new_name);
285	if ((error = dlerror()) != NULL) {
286		m = (struct iptables_target *) dlsym(handle, lname);
287		if ((error = dlerror()) != NULL) {
288			m = find_t(new_name);
289			if (NULL == m) {
290				m = find_t(lname);
291				if (NULL == m) {
292					fputs(error, stderr);
293					fprintf(stderr, "\n");
294					dlclose(handle);
295					free(new_name);
296					return NULL;
297				}
298			}
299		}
300	}
301
302	free(new_name);
303	return m;
304}
305
306
307struct in_addr *dotted_to_addr(const char *dotted)
308{
309	static struct in_addr addr;
310	unsigned char *addrp;
311	char *p, *q;
312	unsigned int onebyte;
313	int i;
314	char buf[20];
315
316	/* copy dotted string, because we need to modify it */
317	strncpy(buf, dotted, sizeof (buf) - 1);
318	addrp = (unsigned char *) &(addr.s_addr);
319
320	p = buf;
321	for (i = 0; i < 3; i++) {
322		if ((q = strchr(p, '.')) == NULL)
323			return (struct in_addr *) NULL;
324
325		*q = '\0';
326		if (string_to_number(p, 0, 255, &onebyte) == -1)
327			return (struct in_addr *) NULL;
328
329		addrp[i] = (unsigned char) onebyte;
330		p = q + 1;
331	}
332
333	/* we've checked 3 bytes, now we check the last one */
334	if (string_to_number(p, 0, 255, &onebyte) == -1)
335		return (struct in_addr *) NULL;
336
337	addrp[3] = (unsigned char) onebyte;
338
339	return &addr;
340}
341
342static void set_revision(char *name, u_int8_t revision)
343{
344	/* Old kernel sources don't have ".revision" field,
345	*  but we stole a byte from name. */
346	name[IPT_FUNCTION_MAXNAMELEN - 2] = '\0';
347	name[IPT_FUNCTION_MAXNAMELEN - 1] = revision;
348}
349
350/*
351 * we may need to check for version mismatch
352*/
353int
354build_st(struct iptables_target *target, struct ipt_entry_target *t)
355{
356	unsigned int nfcache = 0;
357
358	if (target) {
359		size_t size;
360
361		size =
362		    IPT_ALIGN(sizeof (struct ipt_entry_target)) + target->size;
363
364		if (NULL == t) {
365			target->t = fw_calloc(1, size);
366			target->t->u.target_size = size;
367
368			if (target->init != NULL)
369				target->init(target->t, &nfcache);
370			set_revision(target->t->u.user.name, target->revision);
371		} else {
372			target->t = t;
373		}
374		strcpy(target->t->u.user.name, target->name);
375		return 0;
376	}
377
378	return -1;
379}
380
381static int parse_ipt(struct action_util *a,int *argc_p,
382		     char ***argv_p, int tca_id, struct nlmsghdr *n)
383{
384	struct iptables_target *m = NULL;
385	struct ipt_entry fw;
386	struct rtattr *tail;
387	int c;
388	int rargc = *argc_p;
389	char **argv = *argv_p;
390	int argc = 0, iargc = 0;
391	char k[16];
392	int res = -1;
393	int size = 0;
394	int iok = 0, ok = 0;
395	__u32 hook = 0, index = 0;
396	res = 0;
397
398	lib_dir = getenv("IPTABLES_LIB_DIR");
399	if (!lib_dir)
400		lib_dir = IPT_LIB_DIR;
401
402	{
403		int i;
404		for (i = 0; i < rargc; i++) {
405			if (NULL == argv[i] || 0 == strcmp(argv[i], "action")) {
406				break;
407			}
408		}
409		iargc = argc = i;
410	}
411
412	if (argc <= 2) {
413		fprintf(stderr,"bad arguements to ipt %d vs %d \n", argc, rargc);
414		return -1;
415	}
416
417	while (1) {
418		c = getopt_long(argc, argv, "j:", opts, NULL);
419		if (c == -1)
420			break;
421		switch (c) {
422		case 'j':
423			m = get_target_name(optarg);
424			if (NULL != m) {
425
426				if (0 > build_st(m, NULL)) {
427					printf(" %s error \n", m->name);
428					return -1;
429				}
430				opts =
431				    merge_options(opts, m->extra_opts,
432						  &m->option_offset);
433			} else {
434				fprintf(stderr," failed to find target %s\n\n", optarg);
435				return -1;
436			}
437			ok++;
438			break;
439
440		default:
441			memset(&fw, 0, sizeof (fw));
442			if (m) {
443				m->parse(c - m->option_offset, argv, 0,
444					 &m->tflags, NULL, &m->t);
445			} else {
446				fprintf(stderr," failed to find target %s\n\n", optarg);
447				return -1;
448
449			}
450			ok++;
451			break;
452
453		}
454	}
455
456	if (iargc > optind) {
457		if (matches(argv[optind], "index") == 0) {
458			if (get_u32(&index, argv[optind + 1], 10)) {
459				fprintf(stderr, "Illegal \"index\"\n");
460				free_opts(opts);
461				return -1;
462			}
463			iok++;
464
465			optind += 2;
466		}
467	}
468
469	if (!ok && !iok) {
470		fprintf(stderr," ipt Parser BAD!! (%s)\n", *argv);
471		return -1;
472	}
473
474	/* check that we passed the correct parameters to the target */
475	if (m)
476		m->final_check(m->tflags);
477
478	{
479		struct tcmsg *t = NLMSG_DATA(n);
480		if (t->tcm_parent != TC_H_ROOT
481		    && t->tcm_parent == TC_H_MAJ(TC_H_INGRESS)) {
482			hook = NF_IP_PRE_ROUTING;
483		} else {
484			hook = NF_IP_POST_ROUTING;
485		}
486	}
487
488	tail = NLMSG_TAIL(n);
489	addattr_l(n, MAX_MSG, tca_id, NULL, 0);
490	fprintf(stdout, "tablename: %s hook: %s\n ", tname, ipthooks[hook]);
491	fprintf(stdout, "\ttarget: ");
492
493	if (m)
494		m->print(NULL, m->t, 0);
495	fprintf(stdout, " index %d\n", index);
496
497	if (strlen(tname) > 16) {
498		size = 16;
499		k[15] = 0;
500	} else {
501		size = 1 + strlen(tname);
502	}
503	strncpy(k, tname, size);
504
505	addattr_l(n, MAX_MSG, TCA_IPT_TABLE, k, size);
506	addattr_l(n, MAX_MSG, TCA_IPT_HOOK, &hook, 4);
507	addattr_l(n, MAX_MSG, TCA_IPT_INDEX, &index, 4);
508	if (m)
509		addattr_l(n, MAX_MSG, TCA_IPT_TARG, m->t, m->t->u.target_size);
510	tail->rta_len = (void *) NLMSG_TAIL(n) - (void *) tail;
511
512	argc -= optind;
513	argv += optind;
514	*argc_p = rargc - iargc;
515	*argv_p = argv;
516
517	optind = 0;
518	free_opts(opts);
519	/* Clear flags if target will be used again */
520        m->tflags=0;
521        m->used=0;
522	/* Free allocated memory */
523        if (m->t)
524            free(m->t);
525
526
527	return 0;
528
529}
530
531static int
532print_ipt(struct action_util *au,FILE * f, struct rtattr *arg)
533{
534	struct rtattr *tb[TCA_IPT_MAX + 1];
535	struct ipt_entry_target *t = NULL;
536
537	if (arg == NULL)
538		return -1;
539
540	lib_dir = getenv("IPTABLES_LIB_DIR");
541	if (!lib_dir)
542		lib_dir = IPT_LIB_DIR;
543
544	parse_rtattr_nested(tb, TCA_IPT_MAX, arg);
545
546	if (tb[TCA_IPT_TABLE] == NULL) {
547		fprintf(f, "[NULL ipt table name ] assuming mangle ");
548	} else {
549		fprintf(f, "tablename: %s ",
550			(char *) RTA_DATA(tb[TCA_IPT_TABLE]));
551	}
552
553	if (tb[TCA_IPT_HOOK] == NULL) {
554		fprintf(f, "[NULL ipt hook name ]\n ");
555		return -1;
556	} else {
557		__u32 hook;
558		hook = *(__u32 *) RTA_DATA(tb[TCA_IPT_HOOK]);
559		fprintf(f, " hook: %s \n", ipthooks[hook]);
560	}
561
562	if (tb[TCA_IPT_TARG] == NULL) {
563		fprintf(f, "\t[NULL ipt target parameters ] \n");
564		return -1;
565	} else {
566		struct iptables_target *m = NULL;
567		t = RTA_DATA(tb[TCA_IPT_TARG]);
568		m = get_target_name(t->u.user.name);
569		if (NULL != m) {
570			if (0 > build_st(m, t)) {
571				fprintf(stderr, " %s error \n", m->name);
572				return -1;
573			}
574
575			opts =
576			    merge_options(opts, m->extra_opts,
577					  &m->option_offset);
578		} else {
579			fprintf(stderr, " failed to find target %s\n\n",
580				t->u.user.name);
581			return -1;
582		}
583		fprintf(f, "\ttarget ");
584		m->print(NULL, m->t, 0);
585		if (tb[TCA_IPT_INDEX] == NULL) {
586			fprintf(f, " [NULL ipt target index ]\n");
587		} else {
588			__u32 index;
589			index = *(__u32 *) RTA_DATA(tb[TCA_IPT_INDEX]);
590			fprintf(f, " \n\tindex %d", index);
591		}
592
593		if (tb[TCA_IPT_CNT]) {
594			struct tc_cnt *c  = RTA_DATA(tb[TCA_IPT_CNT]);;
595			fprintf(f, " ref %d bind %d", c->refcnt, c->bindcnt);
596		}
597		if (show_stats) {
598			if (tb[TCA_IPT_TM]) {
599				struct tcf_t *tm = RTA_DATA(tb[TCA_IPT_TM]);
600				print_tm(f,tm);
601			}
602		}
603		fprintf(f, " \n");
604
605	}
606	free_opts(opts);
607
608	return 0;
609}
610
611struct action_util ipt_action_util = {
612        .id = "ipt",
613        .parse_aopt = parse_ipt,
614        .print_aopt = print_ipt,
615};
616
617