m_ipt.c revision ece02ea0a388a0bda5e5dff425fe93e50b2d5c9b
1/* 2 * m_ipt.c iptables based targets 3 * utilities mostly ripped from iptables <duh, its the linux way> 4 * 5 * This program is free software; you can distribute it and/or 6 * modify it under the terms of the GNU General Public License 7 * as published by the Free Software Foundation; either version 8 * 2 of the License, or (at your option) any later version. 9 * 10 * Authors: J Hadi Salim (hadi@cyberus.ca) 11 */ 12 13#include <syslog.h> 14#include <sys/socket.h> 15#include <netinet/in.h> 16#include <arpa/inet.h> 17#include <linux/if.h> 18#include <iptables.h> 19#include <linux/netfilter.h> 20#include <linux/netfilter_ipv4/ip_tables.h> 21#include "utils.h" 22#include "tc_util.h" 23#include <linux/tc_act/tc_ipt.h> 24#include <stdio.h> 25#include <dlfcn.h> 26#include <getopt.h> 27#include <errno.h> 28#include <string.h> 29#include <netdb.h> 30#include <stdlib.h> 31#include <ctype.h> 32#include <stdarg.h> 33#include <limits.h> 34#include <unistd.h> 35#include <fcntl.h> 36#include <sys/wait.h> 37 38static const char *pname = "tc-ipt"; 39static const char *tname = "mangle"; 40static const char *pversion = "0.1"; 41 42static const char *ipthooks[] = { 43 "NF_IP_PRE_ROUTING", 44 "NF_IP_LOCAL_IN", 45 "NF_IP_FORWARD", 46 "NF_IP_LOCAL_OUT", 47 "NF_IP_POST_ROUTING", 48}; 49 50static struct option original_opts[] = { 51 {"jump", 1, 0, 'j'}, 52 {0, 0, 0, 0} 53}; 54 55static struct iptables_target *t_list = NULL; 56static struct option *opts = original_opts; 57static unsigned int global_option_offset = 0; 58#define OPTION_OFFSET 256 59 60char *lib_dir; 61 62void 63register_target(struct iptables_target *me) 64{ 65/* fprintf(stderr, "\nDummy register_target %s \n", me->name); 66*/ 67 me->next = t_list; 68 t_list = me; 69 70} 71 72void 73exit_tryhelp(int status) 74{ 75 fprintf(stderr, "Try `%s -h' or '%s --help' for more information.\n", 76 pname, pname); 77 exit(status); 78} 79 80void 81exit_error(enum exittype status, char *msg, ...) 82{ 83 va_list args; 84 85 va_start(args, msg); 86 fprintf(stderr, "%s v%s: ", pname, pversion); 87 vfprintf(stderr, msg, args); 88 va_end(args); 89 fprintf(stderr, "\n"); 90 if (status == PARAMETER_PROBLEM) 91 exit_tryhelp(status); 92 if (status == VERSION_PROBLEM) 93 fprintf(stderr, 94 "Perhaps iptables or your kernel needs to be upgraded.\n"); 95 exit(status); 96} 97 98/* stolen from iptables 1.2.11 99They should really have them as a library so i can link to them 100Email them next time i remember 101*/ 102 103char * 104addr_to_dotted(const struct in_addr *addrp) 105{ 106 static char buf[20]; 107 const unsigned char *bytep; 108 109 bytep = (const unsigned char *) &(addrp->s_addr); 110 sprintf(buf, "%d.%d.%d.%d", bytep[0], bytep[1], bytep[2], bytep[3]); 111 return buf; 112} 113 114int string_to_number_ll(const char *s, unsigned long long min, 115 unsigned long long max, 116 unsigned long long *ret) 117{ 118 unsigned long long number; 119 char *end; 120 121 /* Handle hex, octal, etc. */ 122 errno = 0; 123 number = strtoull(s, &end, 0); 124 if (*end == '\0' && end != s) { 125 /* we parsed a number, let's see if we want this */ 126 if (errno != ERANGE && min <= number && (!max || number <= max)) { 127 *ret = number; 128 return 0; 129 } 130 } 131 return -1; 132} 133 134int string_to_number_l(const char *s, unsigned long min, unsigned long max, 135 unsigned long *ret) 136{ 137 int result; 138 unsigned long long number; 139 140 result = string_to_number_ll(s, min, max, &number); 141 *ret = (unsigned long)number; 142 143 return result; 144} 145 146int string_to_number(const char *s, unsigned int min, unsigned int max, 147 unsigned int *ret) 148{ 149 int result; 150 unsigned long number; 151 152 result = string_to_number_l(s, min, max, &number); 153 *ret = (unsigned int)number; 154 155 return result; 156} 157 158static void free_opts(struct option *opts) 159{ 160 if (opts != original_opts) { 161 free(opts); 162 opts = original_opts; 163 global_option_offset = 0; 164 } 165} 166 167static struct option * 168merge_options(struct option *oldopts, const struct option *newopts, 169 unsigned int *option_offset) 170{ 171 struct option *merge; 172 unsigned int num_old, num_new, i; 173 174 for (num_old = 0; oldopts[num_old].name; num_old++) ; 175 for (num_new = 0; newopts[num_new].name; num_new++) ; 176 177 *option_offset = global_option_offset + OPTION_OFFSET; 178 179 merge = malloc(sizeof (struct option) * (num_new + num_old + 1)); 180 memcpy(merge, oldopts, num_old * sizeof (struct option)); 181 for (i = 0; i < num_new; i++) { 182 merge[num_old + i] = newopts[i]; 183 merge[num_old + i].val += *option_offset; 184 } 185 memset(merge + num_old + num_new, 0, sizeof (struct option)); 186 187 return merge; 188} 189 190static void * 191fw_calloc(size_t count, size_t size) 192{ 193 void *p; 194 195 if ((p = (void *) calloc(count, size)) == NULL) { 196 perror("iptables: calloc failed"); 197 exit(1); 198 } 199 return p; 200} 201 202static struct iptables_target * 203find_t(char *name) 204{ 205 struct iptables_target *m; 206 for (m = t_list; m; m = m->next) { 207 if (strcmp(m->name, name) == 0) 208 return m; 209 } 210 211 return NULL; 212} 213 214static struct iptables_target * 215get_target_name(const char *name) 216{ 217 void *handle; 218 char *error; 219 char *new_name, *lname; 220 struct iptables_target *m; 221 char path[strlen(lib_dir) + sizeof ("/libipt_.so") + strlen(name)]; 222 223 new_name = malloc(strlen(name) + 1); 224 lname = malloc(strlen(name) + 1); 225 if (new_name) 226 memset(new_name, '\0', strlen(name) + 1); 227 else 228 exit_error(PARAMETER_PROBLEM, "get_target_name"); 229 230 if (lname) 231 memset(lname, '\0', strlen(name) + 1); 232 else 233 exit_error(PARAMETER_PROBLEM, "get_target_name"); 234 235 strcpy(new_name, name); 236 strcpy(lname, name); 237 238 if (isupper(lname[0])) { 239 int i; 240 for (i = 0; i < strlen(name); i++) { 241 lname[i] = tolower(lname[i]); 242 } 243 } 244 245 if (islower(new_name[0])) { 246 int i; 247 for (i = 0; i < strlen(new_name); i++) { 248 new_name[i] = toupper(new_name[i]); 249 } 250 } 251 252 sprintf(path, "%s/libipt_%s.so",lib_dir, new_name); 253 handle = dlopen(path, RTLD_LAZY); 254 if (!handle) { 255 sprintf(path, lib_dir, "/libipt_%s.so", lname); 256 handle = dlopen(path, RTLD_LAZY); 257 if (!handle) { 258 fputs(dlerror(), stderr); 259 printf("\n"); 260 return NULL; 261 } 262 } 263 264 m = dlsym(handle, new_name); 265 if ((error = dlerror()) != NULL) { 266 m = (struct iptables_target *) dlsym(handle, lname); 267 if ((error = dlerror()) != NULL) { 268 m = find_t(new_name); 269 if (NULL == m) { 270 m = find_t(lname); 271 if (NULL == m) { 272 fputs(error, stderr); 273 fprintf(stderr, "\n"); 274 dlclose(handle); 275 return NULL; 276 } 277 } 278 } 279 } 280 281 return m; 282} 283 284 285struct in_addr *dotted_to_addr(const char *dotted) 286{ 287 static struct in_addr addr; 288 unsigned char *addrp; 289 char *p, *q; 290 unsigned int onebyte; 291 int i; 292 char buf[20]; 293 294 /* copy dotted string, because we need to modify it */ 295 strncpy(buf, dotted, sizeof (buf) - 1); 296 addrp = (unsigned char *) &(addr.s_addr); 297 298 p = buf; 299 for (i = 0; i < 3; i++) { 300 if ((q = strchr(p, '.')) == NULL) 301 return (struct in_addr *) NULL; 302 303 *q = '\0'; 304 if (string_to_number(p, 0, 255, &onebyte) == -1) 305 return (struct in_addr *) NULL; 306 307 addrp[i] = (unsigned char) onebyte; 308 p = q + 1; 309 } 310 311 /* we've checked 3 bytes, now we check the last one */ 312 if (string_to_number(p, 0, 255, &onebyte) == -1) 313 return (struct in_addr *) NULL; 314 315 addrp[3] = (unsigned char) onebyte; 316 317 return &addr; 318} 319 320static void set_revision(char *name, u_int8_t revision) 321{ 322 /* Old kernel sources don't have ".revision" field, 323 * but we stole a byte from name. */ 324 name[IPT_FUNCTION_MAXNAMELEN - 2] = '\0'; 325 name[IPT_FUNCTION_MAXNAMELEN - 1] = revision; 326} 327 328/* 329 * we may need to check for version mismatch 330*/ 331int 332build_st(struct iptables_target *target, struct ipt_entry_target *t) 333{ 334 unsigned int nfcache = 0; 335 336 if (target) { 337 size_t size; 338 339 size = 340 IPT_ALIGN(sizeof (struct ipt_entry_target)) + target->size; 341 342 if (NULL == t) { 343 target->t = fw_calloc(1, size); 344 target->t->u.target_size = size; 345 346 if (target->init != NULL) 347 target->init(target->t, &nfcache); 348 set_revision(target->t->u.user.name, target->revision); 349 } else { 350 target->t = t; 351 } 352 strcpy(target->t->u.user.name, target->name); 353 return 0; 354 } 355 356 return -1; 357} 358 359static int parse_ipt(struct action_util *a,int *argc_p, 360 char ***argv_p, int tca_id, struct nlmsghdr *n) 361{ 362 struct iptables_target *m = NULL; 363 struct ipt_entry fw; 364 struct rtattr *tail; 365 int c; 366 int rargc = *argc_p; 367 char **argv = *argv_p; 368 int argc = 0, iargc = 0; 369 char k[16]; 370 int res = -1; 371 int size = 0; 372 int iok = 0, ok = 0; 373 __u32 hook = 0, index = 0; 374 res = 0; 375 376 lib_dir = getenv("IPTABLES_LIB_DIR"); 377 if (!lib_dir) 378 lib_dir = IPT_LIB_DIR; 379 380 { 381 int i; 382 for (i = 0; i < rargc; i++) { 383 if (NULL == argv[i] || 0 == strcmp(argv[i], "action")) { 384 break; 385 } 386 } 387 iargc = argc = i; 388 } 389 390 if (argc <= 2) { 391 fprintf(stderr,"bad arguements to ipt %d vs %d \n", argc, rargc); 392 return -1; 393 } 394 395 while (1) { 396 c = getopt_long(argc, argv, "j:", opts, NULL); 397 if (c == -1) 398 break; 399 switch (c) { 400 case 'j': 401 m = get_target_name(optarg); 402 if (NULL != m) { 403 404 if (0 > build_st(m, NULL)) { 405 printf(" %s error \n", m->name); 406 return -1; 407 } 408 opts = 409 merge_options(opts, m->extra_opts, 410 &m->option_offset); 411 } else { 412 fprintf(stderr," failed to find target %s\n\n", optarg); 413 return -1; 414 } 415 ok++; 416 break; 417 418 default: 419 memset(&fw, 0, sizeof (fw)); 420 if (m) { 421 m->parse(c - m->option_offset, argv, 0, 422 &m->tflags, NULL, &m->t); 423 } else { 424 fprintf(stderr," failed to find target %s\n\n", optarg); 425 return -1; 426 427 } 428 ok++; 429 break; 430 431 } 432 } 433 434 if (iargc > optind) { 435 if (matches(argv[optind], "index") == 0) { 436 if (get_u32(&index, argv[optind + 1], 10)) { 437 fprintf(stderr, "Illegal \"index\"\n"); 438 free_opts(opts); 439 return -1; 440 } 441 iok++; 442 443 optind += 2; 444 } 445 } 446 447 if (!ok && !iok) { 448 fprintf(stderr," ipt Parser BAD!! (%s)\n", *argv); 449 return -1; 450 } 451 452 /* check that we passed the correct parameters to the target */ 453 if (m) 454 m->final_check(m->tflags); 455 456 { 457 struct tcmsg *t = NLMSG_DATA(n); 458 if (t->tcm_parent != TC_H_ROOT 459 && t->tcm_parent == TC_H_MAJ(TC_H_INGRESS)) { 460 hook = NF_IP_PRE_ROUTING; 461 } else { 462 hook = NF_IP_POST_ROUTING; 463 } 464 } 465 466 tail = NLMSG_TAIL(n); 467 addattr_l(n, MAX_MSG, tca_id, NULL, 0); 468 fprintf(stdout, "tablename: %s hook: %s\n ", tname, ipthooks[hook]); 469 fprintf(stdout, "\ttarget: "); 470 471 if (m) 472 m->print(NULL, m->t, 0); 473 fprintf(stdout, " index %d\n", index); 474 475 if (strlen(tname) > 16) { 476 size = 16; 477 k[15] = 0; 478 } else { 479 size = 1 + strlen(tname); 480 } 481 strncpy(k, tname, size); 482 483 addattr_l(n, MAX_MSG, TCA_IPT_TABLE, k, size); 484 addattr_l(n, MAX_MSG, TCA_IPT_HOOK, &hook, 4); 485 addattr_l(n, MAX_MSG, TCA_IPT_INDEX, &index, 4); 486 if (m) 487 addattr_l(n, MAX_MSG, TCA_IPT_TARG, m->t, m->t->u.target_size); 488 tail->rta_len = (void *) NLMSG_TAIL(n) - (void *) tail; 489 490 argc -= optind; 491 argv += optind; 492 *argc_p = rargc - iargc; 493 *argv_p = argv; 494 495 optind = 1; 496 free_opts(opts); 497 498 return 0; 499 500} 501 502static int 503print_ipt(struct action_util *au,FILE * f, struct rtattr *arg) 504{ 505 struct rtattr *tb[TCA_IPT_MAX + 1]; 506 struct ipt_entry_target *t = NULL; 507 508 if (arg == NULL) 509 return -1; 510 511 lib_dir = getenv("IPTABLES_LIB_DIR"); 512 if (!lib_dir) 513 lib_dir = IPT_LIB_DIR; 514 515 parse_rtattr_nested(tb, TCA_IPT_MAX, arg); 516 517 if (tb[TCA_IPT_TABLE] == NULL) { 518 fprintf(f, "[NULL ipt table name ] assuming mangle "); 519 } else { 520 fprintf(f, "tablename: %s ", 521 (char *) RTA_DATA(tb[TCA_IPT_TABLE])); 522 } 523 524 if (tb[TCA_IPT_HOOK] == NULL) { 525 fprintf(f, "[NULL ipt hook name ]\n "); 526 return -1; 527 } else { 528 __u32 hook; 529 hook = *(__u32 *) RTA_DATA(tb[TCA_IPT_HOOK]); 530 fprintf(f, " hook: %s \n", ipthooks[hook]); 531 } 532 533 if (tb[TCA_IPT_TARG] == NULL) { 534 fprintf(f, "\t[NULL ipt target parameters ] \n"); 535 return -1; 536 } else { 537 struct iptables_target *m = NULL; 538 t = RTA_DATA(tb[TCA_IPT_TARG]); 539 m = get_target_name(t->u.user.name); 540 if (NULL != m) { 541 if (0 > build_st(m, t)) { 542 fprintf(stderr, " %s error \n", m->name); 543 return -1; 544 } 545 546 opts = 547 merge_options(opts, m->extra_opts, 548 &m->option_offset); 549 } else { 550 fprintf(stderr, " failed to find target %s\n\n", 551 t->u.user.name); 552 return -1; 553 } 554 fprintf(f, "\ttarget "); 555 m->print(NULL, m->t, 0); 556 if (tb[TCA_IPT_INDEX] == NULL) { 557 fprintf(f, " [NULL ipt target index ]\n"); 558 } else { 559 __u32 index; 560 index = *(__u32 *) RTA_DATA(tb[TCA_IPT_INDEX]); 561 fprintf(f, " \n\tindex %d", index); 562 } 563 564 if (tb[TCA_IPT_CNT]) { 565 struct tc_cnt *c = RTA_DATA(tb[TCA_IPT_CNT]);; 566 fprintf(f, " ref %d bind %d", c->refcnt, c->bindcnt); 567 } 568 if (show_stats) { 569 if (tb[TCA_IPT_TM]) { 570 struct tcf_t *tm = RTA_DATA(tb[TCA_IPT_TM]); 571 print_tm(f,tm); 572 } 573 } 574 fprintf(f, " \n"); 575 576 } 577 free_opts(opts); 578 579 return 0; 580} 581 582struct action_util ipt_action_util = { 583 .id = "ipt", 584 .parse_aopt = parse_ipt, 585 .print_aopt = print_ipt, 586}; 587 588