xtables.c revision 2338efd8f799d8373dc196c797bda9690283b698
1/* 2 * (C) 2000-2006 by the netfilter coreteam <coreteam@netfilter.org>: 3 * 4 * This program is free software; you can redistribute it and/or modify 5 * it under the terms of the GNU General Public License as published by 6 * the Free Software Foundation; either version 2 of the License, or 7 * (at your option) any later version. 8 * 9 * This program is distributed in the hope that it will be useful, 10 * but WITHOUT ANY WARRANTY; without even the implied warranty of 11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 12 * GNU General Public License for more details. 13 * 14 * You should have received a copy of the GNU General Public License 15 * along with this program; if not, write to the Free Software 16 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. 17 */ 18 19#include <errno.h> 20#include <fcntl.h> 21#include <netdb.h> 22#include <stdarg.h> 23#include <stdbool.h> 24#include <stdio.h> 25#include <stdlib.h> 26#include <string.h> 27#include <unistd.h> 28#include <sys/socket.h> 29#include <sys/stat.h> 30#include <sys/types.h> 31#include <sys/wait.h> 32#include <arpa/inet.h> 33 34#include <xtables.h> 35#include <libiptc/libxtc.h> 36 37#ifndef NO_SHARED_LIBS 38#include <dlfcn.h> 39#endif 40 41#define NPROTO 255 42 43#ifndef PROC_SYS_MODPROBE 44#define PROC_SYS_MODPROBE "/proc/sys/kernel/modprobe" 45#endif 46 47char *lib_dir; 48 49/* the path to command to load kernel module */ 50const char *xtables_modprobe_program; 51 52/* Keeping track of external matches and targets: linked lists. */ 53struct xtables_match *xtables_matches; 54struct xtables_target *xtables_targets; 55 56/** 57 * xtables_*alloc - wrappers that exit on failure 58 */ 59void *xtables_calloc(size_t count, size_t size) 60{ 61 void *p; 62 63 if ((p = calloc(count, size)) == NULL) { 64 perror("ip[6]tables: calloc failed"); 65 exit(1); 66 } 67 68 return p; 69} 70 71void *xtables_malloc(size_t size) 72{ 73 void *p; 74 75 if ((p = malloc(size)) == NULL) { 76 perror("ip[6]tables: malloc failed"); 77 exit(1); 78 } 79 80 return p; 81} 82 83static char *get_modprobe(void) 84{ 85 int procfile; 86 char *ret; 87 88#define PROCFILE_BUFSIZ 1024 89 procfile = open(PROC_SYS_MODPROBE, O_RDONLY); 90 if (procfile < 0) 91 return NULL; 92 93 ret = (char *) malloc(PROCFILE_BUFSIZ); 94 if (ret) { 95 memset(ret, 0, PROCFILE_BUFSIZ); 96 switch (read(procfile, ret, PROCFILE_BUFSIZ)) { 97 case -1: goto fail; 98 case PROCFILE_BUFSIZ: goto fail; /* Partial read. Wierd */ 99 } 100 if (ret[strlen(ret)-1]=='\n') 101 ret[strlen(ret)-1]=0; 102 close(procfile); 103 return ret; 104 } 105 fail: 106 free(ret); 107 close(procfile); 108 return NULL; 109} 110 111int xtables_insmod(const char *modname, const char *modprobe, bool quiet) 112{ 113 char *buf = NULL; 114 char *argv[4]; 115 int status; 116 117 /* If they don't explicitly set it, read out of kernel */ 118 if (!modprobe) { 119 buf = get_modprobe(); 120 if (!buf) 121 return -1; 122 modprobe = buf; 123 } 124 125 switch (fork()) { 126 case 0: 127 argv[0] = (char *)modprobe; 128 argv[1] = (char *)modname; 129 if (quiet) { 130 argv[2] = "-q"; 131 argv[3] = NULL; 132 } else { 133 argv[2] = NULL; 134 argv[3] = NULL; 135 } 136 execv(argv[0], argv); 137 138 /* not usually reached */ 139 exit(1); 140 case -1: 141 return -1; 142 143 default: /* parent */ 144 wait(&status); 145 } 146 147 free(buf); 148 if (WIFEXITED(status) && WEXITSTATUS(status) == 0) 149 return 0; 150 return -1; 151} 152 153int xtables_load_ko(const char *modprobe, bool quiet) 154{ 155 static bool loaded = false; 156 static int ret = -1; 157 158 if (!loaded) { 159 ret = xtables_insmod(afinfo.kmod, modprobe, quiet); 160 loaded = (ret == 0); 161 } 162 163 return ret; 164} 165 166int string_to_number_ll(const char *s, unsigned long long min, 167 unsigned long long max, unsigned long long *ret) 168{ 169 unsigned long long number; 170 char *end; 171 172 /* Handle hex, octal, etc. */ 173 errno = 0; 174 number = strtoull(s, &end, 0); 175 if (*end == '\0' && end != s) { 176 /* we parsed a number, let's see if we want this */ 177 if (errno != ERANGE && min <= number && (!max || number <= max)) { 178 *ret = number; 179 return 0; 180 } 181 } 182 return -1; 183} 184 185int string_to_number_l(const char *s, unsigned long min, unsigned long max, 186 unsigned long *ret) 187{ 188 int result; 189 unsigned long long number; 190 191 result = string_to_number_ll(s, min, max, &number); 192 *ret = (unsigned long)number; 193 194 return result; 195} 196 197int string_to_number(const char *s, unsigned int min, unsigned int max, 198 unsigned int *ret) 199{ 200 int result; 201 unsigned long number; 202 203 result = string_to_number_l(s, min, max, &number); 204 *ret = (unsigned int)number; 205 206 return result; 207} 208 209/* 210 * strtonum{,l} - string to number conversion 211 * 212 * If @end is NULL, we assume the caller does not want 213 * a case like "15a", so reject it. 214 */ 215bool strtonuml(const char *s, char **end, unsigned long *value, 216 unsigned long min, unsigned long max) 217{ 218 unsigned long v; 219 char *my_end; 220 221 errno = 0; 222 v = strtoul(s, &my_end, 0); 223 224 if (my_end == s) 225 return false; 226 if (end != NULL) 227 *end = my_end; 228 229 if (errno != ERANGE && min <= v && (max == 0 || v <= max)) { 230 if (value != NULL) 231 *value = v; 232 if (end == NULL) 233 return *my_end == '\0'; 234 return true; 235 } 236 237 return false; 238} 239 240bool strtonum(const char *s, char **end, unsigned int *value, 241 unsigned int min, unsigned int max) 242{ 243 unsigned long v; 244 bool ret; 245 246 ret = strtonuml(s, end, &v, min, max); 247 if (value != NULL) 248 *value = v; 249 return ret; 250} 251 252int service_to_port(const char *name, const char *proto) 253{ 254 struct servent *service; 255 256 if ((service = getservbyname(name, proto)) != NULL) 257 return ntohs((unsigned short) service->s_port); 258 259 return -1; 260} 261 262u_int16_t parse_port(const char *port, const char *proto) 263{ 264 unsigned int portnum; 265 266 if (string_to_number(port, 0, UINT16_MAX, &portnum) != -1 || 267 (portnum = service_to_port(port, proto)) != (unsigned)-1) 268 return portnum; 269 270 exit_error(PARAMETER_PROBLEM, 271 "invalid port/service `%s' specified", port); 272} 273 274void parse_interface(const char *arg, char *vianame, unsigned char *mask) 275{ 276 int vialen = strlen(arg); 277 unsigned int i; 278 279 memset(mask, 0, IFNAMSIZ); 280 memset(vianame, 0, IFNAMSIZ); 281 282 if (vialen + 1 > IFNAMSIZ) 283 exit_error(PARAMETER_PROBLEM, 284 "interface name `%s' must be shorter than IFNAMSIZ" 285 " (%i)", arg, IFNAMSIZ-1); 286 287 strcpy(vianame, arg); 288 if ((vialen == 0) || (vialen == 1 && vianame[0] == '+')) 289 memset(mask, 0, IFNAMSIZ); 290 else if (vianame[vialen - 1] == '+') { 291 memset(mask, 0xFF, vialen - 1); 292 memset(mask + vialen - 1, 0, IFNAMSIZ - vialen + 1); 293 /* Don't remove `+' here! -HW */ 294 } else { 295 /* Include nul-terminator in match */ 296 memset(mask, 0xFF, vialen + 1); 297 memset(mask + vialen + 1, 0, IFNAMSIZ - vialen - 1); 298 for (i = 0; vianame[i]; i++) { 299 if (vianame[i] == ':' || 300 vianame[i] == '!' || 301 vianame[i] == '*') { 302 fprintf(stderr, 303 "Warning: weird character in interface" 304 " `%s' (No aliases, :, ! or *).\n", 305 vianame); 306 break; 307 } 308 } 309 } 310} 311 312#ifndef NO_SHARED_LIBS 313static void *load_extension(const char *search_path, const char *prefix, 314 const char *name, bool is_target) 315{ 316 const char *dir = search_path, *next; 317 void *ptr = NULL; 318 struct stat sb; 319 char path[256]; 320 321 do { 322 next = strchr(dir, ':'); 323 if (next == NULL) 324 next = dir + strlen(dir); 325 snprintf(path, sizeof(path), "%.*s/libxt_%s.so", 326 (unsigned int)(next - dir), dir, name); 327 328 if (dlopen(path, RTLD_NOW) != NULL) { 329 /* Found library. If it didn't register itself, 330 maybe they specified target as match. */ 331 if (is_target) 332 ptr = xtables_find_target(name, XTF_DONT_LOAD); 333 else 334 ptr = xtables_find_match(name, 335 XTF_DONT_LOAD, NULL); 336 } else if (stat(path, &sb) == 0) { 337 fprintf(stderr, "%s: %s\n", path, dlerror()); 338 } 339 340 if (ptr != NULL) 341 return ptr; 342 343 snprintf(path, sizeof(path), "%.*s/%s%s.so", 344 (unsigned int)(next - dir), dir, prefix, name); 345 if (dlopen(path, RTLD_NOW) != NULL) { 346 if (is_target) 347 ptr = xtables_find_target(name, XTF_DONT_LOAD); 348 else 349 ptr = xtables_find_match(name, 350 XTF_DONT_LOAD, NULL); 351 } else if (stat(path, &sb) == 0) { 352 fprintf(stderr, "%s: %s\n", path, dlerror()); 353 } 354 355 if (ptr != NULL) 356 return ptr; 357 358 dir = next + 1; 359 } while (*next != '\0'); 360 361 return NULL; 362} 363#endif 364 365struct xtables_match * 366xtables_find_match(const char *name, enum xtables_tryload tryload, 367 struct xtables_rule_match **matches) 368{ 369 struct xtables_match *ptr; 370 const char *icmp6 = "icmp6"; 371 372 /* This is ugly as hell. Nonetheless, there is no way of changing 373 * this without hurting backwards compatibility */ 374 if ( (strcmp(name,"icmpv6") == 0) || 375 (strcmp(name,"ipv6-icmp") == 0) || 376 (strcmp(name,"icmp6") == 0) ) 377 name = icmp6; 378 379 for (ptr = xtables_matches; ptr; ptr = ptr->next) { 380 if (strcmp(name, ptr->name) == 0) { 381 struct xtables_match *clone; 382 383 /* First match of this type: */ 384 if (ptr->m == NULL) 385 break; 386 387 /* Second and subsequent clones */ 388 clone = xtables_malloc(sizeof(struct xtables_match)); 389 memcpy(clone, ptr, sizeof(struct xtables_match)); 390 clone->mflags = 0; 391 /* This is a clone: */ 392 clone->next = clone; 393 394 ptr = clone; 395 break; 396 } 397 } 398 399#ifndef NO_SHARED_LIBS 400 if (!ptr && tryload != XTF_DONT_LOAD && tryload != XTF_DURING_LOAD) { 401 ptr = load_extension(lib_dir, afinfo.libprefix, name, false); 402 403 if (ptr == NULL && tryload == XTF_LOAD_MUST_SUCCEED) 404 exit_error(PARAMETER_PROBLEM, 405 "Couldn't load match `%s':%s\n", 406 name, dlerror()); 407 } 408#else 409 if (ptr && !ptr->loaded) { 410 if (tryload != XTF_DONT_LOAD) 411 ptr->loaded = 1; 412 else 413 ptr = NULL; 414 } 415 if(!ptr && (tryload == XTF_LOAD_MUST_SUCCEED)) { 416 exit_error(PARAMETER_PROBLEM, 417 "Couldn't find match `%s'\n", name); 418 } 419#endif 420 421 if (ptr && matches) { 422 struct xtables_rule_match **i; 423 struct xtables_rule_match *newentry; 424 425 newentry = xtables_malloc(sizeof(struct xtables_rule_match)); 426 427 for (i = matches; *i; i = &(*i)->next) { 428 if (strcmp(name, (*i)->match->name) == 0) 429 (*i)->completed = true; 430 } 431 newentry->match = ptr; 432 newentry->completed = false; 433 newentry->next = NULL; 434 *i = newentry; 435 } 436 437 return ptr; 438} 439 440struct xtables_target * 441xtables_find_target(const char *name, enum xtables_tryload tryload) 442{ 443 struct xtables_target *ptr; 444 445 /* Standard target? */ 446 if (strcmp(name, "") == 0 447 || strcmp(name, XTC_LABEL_ACCEPT) == 0 448 || strcmp(name, XTC_LABEL_DROP) == 0 449 || strcmp(name, XTC_LABEL_QUEUE) == 0 450 || strcmp(name, XTC_LABEL_RETURN) == 0) 451 name = "standard"; 452 453 for (ptr = xtables_targets; ptr; ptr = ptr->next) { 454 if (strcmp(name, ptr->name) == 0) 455 break; 456 } 457 458#ifndef NO_SHARED_LIBS 459 if (!ptr && tryload != XTF_DONT_LOAD && tryload != XTF_DURING_LOAD) { 460 ptr = load_extension(lib_dir, afinfo.libprefix, name, true); 461 462 if (ptr == NULL && tryload == XTF_LOAD_MUST_SUCCEED) 463 exit_error(PARAMETER_PROBLEM, 464 "Couldn't load target `%s':%s\n", 465 name, dlerror()); 466 } 467#else 468 if (ptr && !ptr->loaded) { 469 if (tryload != XTF_DONT_LOAD) 470 ptr->loaded = 1; 471 else 472 ptr = NULL; 473 } 474 if(!ptr && (tryload == LOAD_MUST_SUCCEED)) { 475 exit_error(PARAMETER_PROBLEM, 476 "Couldn't find target `%s'\n", name); 477 } 478#endif 479 480 if (ptr) 481 ptr->used = 1; 482 483 return ptr; 484} 485 486static int compatible_revision(const char *name, u_int8_t revision, int opt) 487{ 488 struct xt_get_revision rev; 489 socklen_t s = sizeof(rev); 490 int max_rev, sockfd; 491 492 sockfd = socket(afinfo.family, SOCK_RAW, IPPROTO_RAW); 493 if (sockfd < 0) { 494 if (errno == EPERM) { 495 /* revision 0 is always supported. */ 496 if (revision != 0) 497 fprintf(stderr, "Could not determine whether " 498 "revision %u is supported, " 499 "assuming it is.\n", 500 revision); 501 return 1; 502 } 503 fprintf(stderr, "Could not open socket to kernel: %s\n", 504 strerror(errno)); 505 exit(1); 506 } 507 508 xtables_load_ko(xtables_modprobe_program, true); 509 510 strcpy(rev.name, name); 511 rev.revision = revision; 512 513 max_rev = getsockopt(sockfd, afinfo.ipproto, opt, &rev, &s); 514 if (max_rev < 0) { 515 /* Definitely don't support this? */ 516 if (errno == ENOENT || errno == EPROTONOSUPPORT) { 517 close(sockfd); 518 return 0; 519 } else if (errno == ENOPROTOOPT) { 520 close(sockfd); 521 /* Assume only revision 0 support (old kernel) */ 522 return (revision == 0); 523 } else { 524 fprintf(stderr, "getsockopt failed strangely: %s\n", 525 strerror(errno)); 526 exit(1); 527 } 528 } 529 close(sockfd); 530 return 1; 531} 532 533 534static int compatible_match_revision(const char *name, u_int8_t revision) 535{ 536 return compatible_revision(name, revision, afinfo.so_rev_match); 537} 538 539static int compatible_target_revision(const char *name, u_int8_t revision) 540{ 541 return compatible_revision(name, revision, afinfo.so_rev_target); 542} 543 544void xtables_register_match(struct xtables_match *me) 545{ 546 struct xtables_match **i, *old; 547 548 if (strcmp(me->version, program_version) != 0) { 549 fprintf(stderr, "%s: match `%s' v%s (I'm v%s).\n", 550 program_name, me->name, me->version, program_version); 551 exit(1); 552 } 553 554 /* Revision field stole a char from name. */ 555 if (strlen(me->name) >= XT_FUNCTION_MAXNAMELEN-1) { 556 fprintf(stderr, "%s: target `%s' has invalid name\n", 557 program_name, me->name); 558 exit(1); 559 } 560 561 if (me->family >= NPROTO) { 562 fprintf(stderr, 563 "%s: BUG: match %s has invalid protocol family\n", 564 program_name, me->name); 565 exit(1); 566 } 567 568 /* ignore not interested match */ 569 if (me->family != afinfo.family && me->family != AF_UNSPEC) 570 return; 571 572 old = xtables_find_match(me->name, XTF_DURING_LOAD, NULL); 573 if (old) { 574 if (old->revision == me->revision && 575 old->family == me->family) { 576 fprintf(stderr, 577 "%s: match `%s' already registered.\n", 578 program_name, me->name); 579 exit(1); 580 } 581 582 /* Now we have two (or more) options, check compatibility. */ 583 if (compatible_match_revision(old->name, old->revision) 584 && old->revision > me->revision) 585 return; 586 587 /* See if new match can be used. */ 588 if (!compatible_match_revision(me->name, me->revision)) 589 return; 590 591 /* Prefer !AF_UNSPEC over AF_UNSPEC for same revision. */ 592 if (old->revision == me->revision && me->family == AF_UNSPEC) 593 return; 594 595 /* Delete old one. */ 596 for (i = &xtables_matches; *i!=old; i = &(*i)->next); 597 *i = old->next; 598 } 599 600 if (me->size != XT_ALIGN(me->size)) { 601 fprintf(stderr, "%s: match `%s' has invalid size %u.\n", 602 program_name, me->name, (unsigned int)me->size); 603 exit(1); 604 } 605 606 /* Append to list. */ 607 for (i = &xtables_matches; *i; i = &(*i)->next); 608 me->next = NULL; 609 *i = me; 610 611 me->m = NULL; 612 me->mflags = 0; 613} 614 615void xtables_register_target(struct xtables_target *me) 616{ 617 struct xtables_target *old; 618 619 if (strcmp(me->version, program_version) != 0) { 620 fprintf(stderr, "%s: target `%s' v%s (I'm v%s).\n", 621 program_name, me->name, me->version, program_version); 622 exit(1); 623 } 624 625 /* Revision field stole a char from name. */ 626 if (strlen(me->name) >= XT_FUNCTION_MAXNAMELEN-1) { 627 fprintf(stderr, "%s: target `%s' has invalid name\n", 628 program_name, me->name); 629 exit(1); 630 } 631 632 if (me->family >= NPROTO) { 633 fprintf(stderr, 634 "%s: BUG: target %s has invalid protocol family\n", 635 program_name, me->name); 636 exit(1); 637 } 638 639 /* ignore not interested target */ 640 if (me->family != afinfo.family && me->family != AF_UNSPEC) 641 return; 642 643 old = xtables_find_target(me->name, XTF_DURING_LOAD); 644 if (old) { 645 struct xtables_target **i; 646 647 if (old->revision == me->revision && 648 old->family == me->family) { 649 fprintf(stderr, 650 "%s: target `%s' already registered.\n", 651 program_name, me->name); 652 exit(1); 653 } 654 655 /* Now we have two (or more) options, check compatibility. */ 656 if (compatible_target_revision(old->name, old->revision) 657 && old->revision > me->revision) 658 return; 659 660 /* See if new target can be used. */ 661 if (!compatible_target_revision(me->name, me->revision)) 662 return; 663 664 /* Prefer !AF_UNSPEC over AF_UNSPEC for same revision. */ 665 if (old->revision == me->revision && me->family == AF_UNSPEC) 666 return; 667 668 /* Delete old one. */ 669 for (i = &xtables_targets; *i!=old; i = &(*i)->next); 670 *i = old->next; 671 } 672 673 if (me->size != XT_ALIGN(me->size)) { 674 fprintf(stderr, "%s: target `%s' has invalid size %u.\n", 675 program_name, me->name, (unsigned int)me->size); 676 exit(1); 677 } 678 679 /* Prepend to list. */ 680 me->next = xtables_targets; 681 xtables_targets = me; 682 me->t = NULL; 683 me->tflags = 0; 684} 685 686void param_act(unsigned int status, const char *p1, ...) 687{ 688 const char *p2, *p3; 689 va_list args; 690 bool b; 691 692 va_start(args, p1); 693 694 switch (status) { 695 case P_ONLY_ONCE: 696 p2 = va_arg(args, const char *); 697 b = va_arg(args, unsigned int); 698 if (!b) 699 return; 700 exit_error(PARAMETER_PROBLEM, 701 "%s: \"%s\" option may only be specified once", 702 p1, p2); 703 break; 704 case P_NO_INVERT: 705 p2 = va_arg(args, const char *); 706 b = va_arg(args, unsigned int); 707 if (!b) 708 return; 709 exit_error(PARAMETER_PROBLEM, 710 "%s: \"%s\" option cannot be inverted", p1, p2); 711 break; 712 case P_BAD_VALUE: 713 p2 = va_arg(args, const char *); 714 p3 = va_arg(args, const char *); 715 exit_error(PARAMETER_PROBLEM, 716 "%s: Bad value for \"%s\" option: \"%s\"", 717 p1, p2, p3); 718 break; 719 case P_ONE_ACTION: 720 b = va_arg(args, unsigned int); 721 if (!b) 722 return; 723 exit_error(PARAMETER_PROBLEM, 724 "%s: At most one action is possible", p1); 725 break; 726 default: 727 exit_error(status, p1, args); 728 break; 729 } 730 731 va_end(args); 732} 733 734const char *ipaddr_to_numeric(const struct in_addr *addrp) 735{ 736 static char buf[20]; 737 const unsigned char *bytep = (const void *)&addrp->s_addr; 738 739 sprintf(buf, "%u.%u.%u.%u", bytep[0], bytep[1], bytep[2], bytep[3]); 740 return buf; 741} 742 743static const char *ipaddr_to_host(const struct in_addr *addr) 744{ 745 struct hostent *host; 746 747 host = gethostbyaddr(addr, sizeof(struct in_addr), AF_INET); 748 if (host == NULL) 749 return NULL; 750 751 return host->h_name; 752} 753 754static const char *ipaddr_to_network(const struct in_addr *addr) 755{ 756 struct netent *net; 757 758 if ((net = getnetbyaddr(ntohl(addr->s_addr), AF_INET)) != NULL) 759 return net->n_name; 760 761 return NULL; 762} 763 764const char *ipaddr_to_anyname(const struct in_addr *addr) 765{ 766 const char *name; 767 768 if ((name = ipaddr_to_host(addr)) != NULL || 769 (name = ipaddr_to_network(addr)) != NULL) 770 return name; 771 772 return ipaddr_to_numeric(addr); 773} 774 775const char *ipmask_to_numeric(const struct in_addr *mask) 776{ 777 static char buf[20]; 778 uint32_t maskaddr, bits; 779 int i; 780 781 maskaddr = ntohl(mask->s_addr); 782 783 if (maskaddr == 0xFFFFFFFFL) 784 /* we don't want to see "/32" */ 785 return ""; 786 787 i = 32; 788 bits = 0xFFFFFFFEL; 789 while (--i >= 0 && maskaddr != bits) 790 bits <<= 1; 791 if (i >= 0) 792 sprintf(buf, "/%d", i); 793 else 794 /* mask was not a decent combination of 1's and 0's */ 795 sprintf(buf, "/%s", ipaddr_to_numeric(mask)); 796 797 return buf; 798} 799 800static struct in_addr *__numeric_to_ipaddr(const char *dotted, bool is_mask) 801{ 802 static struct in_addr addr; 803 unsigned char *addrp; 804 unsigned int onebyte; 805 char buf[20], *p, *q; 806 int i; 807 808 /* copy dotted string, because we need to modify it */ 809 strncpy(buf, dotted, sizeof(buf) - 1); 810 buf[sizeof(buf) - 1] = '\0'; 811 addrp = (void *)&addr.s_addr; 812 813 p = buf; 814 for (i = 0; i < 3; ++i) { 815 if ((q = strchr(p, '.')) == NULL) { 816 if (is_mask) 817 return NULL; 818 819 /* autocomplete, this is a network address */ 820 if (!strtonum(p, NULL, &onebyte, 0, UINT8_MAX)) 821 return NULL; 822 823 addrp[i] = onebyte; 824 while (i < 3) 825 addrp[++i] = 0; 826 827 return &addr; 828 } 829 830 *q = '\0'; 831 if (!strtonum(p, NULL, &onebyte, 0, UINT8_MAX)) 832 return NULL; 833 834 addrp[i] = onebyte; 835 p = q + 1; 836 } 837 838 /* we have checked 3 bytes, now we check the last one */ 839 if (!strtonum(p, NULL, &onebyte, 0, UINT8_MAX)) 840 return NULL; 841 842 addrp[3] = onebyte; 843 return &addr; 844} 845 846struct in_addr *numeric_to_ipaddr(const char *dotted) 847{ 848 return __numeric_to_ipaddr(dotted, false); 849} 850 851struct in_addr *numeric_to_ipmask(const char *dotted) 852{ 853 return __numeric_to_ipaddr(dotted, true); 854} 855 856static struct in_addr *network_to_ipaddr(const char *name) 857{ 858 static struct in_addr addr; 859 struct netent *net; 860 861 if ((net = getnetbyname(name)) != NULL) { 862 if (net->n_addrtype != AF_INET) 863 return NULL; 864 addr.s_addr = htonl(net->n_net); 865 return &addr; 866 } 867 868 return NULL; 869} 870 871static struct in_addr *host_to_ipaddr(const char *name, unsigned int *naddr) 872{ 873 struct hostent *host; 874 struct in_addr *addr; 875 unsigned int i; 876 877 *naddr = 0; 878 if ((host = gethostbyname(name)) != NULL) { 879 if (host->h_addrtype != AF_INET || 880 host->h_length != sizeof(struct in_addr)) 881 return NULL; 882 883 while (host->h_addr_list[*naddr] != NULL) 884 ++*naddr; 885 addr = xtables_calloc(*naddr, sizeof(struct in_addr) * *naddr); 886 for (i = 0; i < *naddr; i++) 887 memcpy(&addr[i], host->h_addr_list[i], 888 sizeof(struct in_addr)); 889 return addr; 890 } 891 892 return NULL; 893} 894 895static struct in_addr * 896ipparse_hostnetwork(const char *name, unsigned int *naddrs) 897{ 898 struct in_addr *addrptmp, *addrp; 899 900 if ((addrptmp = numeric_to_ipaddr(name)) != NULL || 901 (addrptmp = network_to_ipaddr(name)) != NULL) { 902 addrp = xtables_malloc(sizeof(struct in_addr)); 903 memcpy(addrp, addrptmp, sizeof(*addrp)); 904 *naddrs = 1; 905 return addrp; 906 } 907 if ((addrptmp = host_to_ipaddr(name, naddrs)) != NULL) 908 return addrptmp; 909 910 exit_error(PARAMETER_PROBLEM, "host/network `%s' not found", name); 911} 912 913static struct in_addr *parse_ipmask(const char *mask) 914{ 915 static struct in_addr maskaddr; 916 struct in_addr *addrp; 917 unsigned int bits; 918 919 if (mask == NULL) { 920 /* no mask at all defaults to 32 bits */ 921 maskaddr.s_addr = 0xFFFFFFFF; 922 return &maskaddr; 923 } 924 if ((addrp = numeric_to_ipmask(mask)) != NULL) 925 /* dotted_to_addr already returns a network byte order addr */ 926 return addrp; 927 if (string_to_number(mask, 0, 32, &bits) == -1) 928 exit_error(PARAMETER_PROBLEM, 929 "invalid mask `%s' specified", mask); 930 if (bits != 0) { 931 maskaddr.s_addr = htonl(0xFFFFFFFF << (32 - bits)); 932 return &maskaddr; 933 } 934 935 maskaddr.s_addr = 0U; 936 return &maskaddr; 937} 938 939void ipparse_hostnetworkmask(const char *name, struct in_addr **addrpp, 940 struct in_addr *maskp, unsigned int *naddrs) 941{ 942 unsigned int i, j, k, n; 943 struct in_addr *addrp; 944 char buf[256], *p; 945 946 strncpy(buf, name, sizeof(buf) - 1); 947 buf[sizeof(buf) - 1] = '\0'; 948 if ((p = strrchr(buf, '/')) != NULL) { 949 *p = '\0'; 950 addrp = parse_ipmask(p + 1); 951 } else { 952 addrp = parse_ipmask(NULL); 953 } 954 memcpy(maskp, addrp, sizeof(*maskp)); 955 956 /* if a null mask is given, the name is ignored, like in "any/0" */ 957 if (maskp->s_addr == 0U) 958 strcpy(buf, "0.0.0.0"); 959 960 addrp = *addrpp = ipparse_hostnetwork(buf, naddrs); 961 n = *naddrs; 962 for (i = 0, j = 0; i < n; ++i) { 963 addrp[j++].s_addr &= maskp->s_addr; 964 for (k = 0; k < j - 1; ++k) 965 if (addrp[k].s_addr == addrp[j-1].s_addr) { 966 --*naddrs; 967 --j; 968 break; 969 } 970 } 971} 972 973const char *ip6addr_to_numeric(const struct in6_addr *addrp) 974{ 975 /* 0000:0000:0000:0000:0000:000.000.000.000 976 * 0000:0000:0000:0000:0000:0000:0000:0000 */ 977 static char buf[50+1]; 978 return inet_ntop(AF_INET6, addrp, buf, sizeof(buf)); 979} 980 981static const char *ip6addr_to_host(const struct in6_addr *addr) 982{ 983 static char hostname[NI_MAXHOST]; 984 struct sockaddr_in6 saddr; 985 int err; 986 987 memset(&saddr, 0, sizeof(struct sockaddr_in6)); 988 memcpy(&saddr.sin6_addr, addr, sizeof(*addr)); 989 saddr.sin6_family = AF_INET6; 990 991 err = getnameinfo((const void *)&saddr, sizeof(struct sockaddr_in6), 992 hostname, sizeof(hostname) - 1, NULL, 0, 0); 993 if (err != 0) { 994#ifdef DEBUG 995 fprintf(stderr,"IP2Name: %s\n",gai_strerror(err)); 996#endif 997 return NULL; 998 } 999 1000#ifdef DEBUG 1001 fprintf (stderr, "\naddr2host: %s\n", hostname); 1002#endif 1003 return hostname; 1004} 1005 1006const char *ip6addr_to_anyname(const struct in6_addr *addr) 1007{ 1008 const char *name; 1009 1010 if ((name = ip6addr_to_host(addr)) != NULL) 1011 return name; 1012 1013 return ip6addr_to_numeric(addr); 1014} 1015 1016static int ip6addr_prefix_length(const struct in6_addr *k) 1017{ 1018 unsigned int bits = 0; 1019 uint32_t a, b, c, d; 1020 1021 a = ntohl(k->s6_addr32[0]); 1022 b = ntohl(k->s6_addr32[1]); 1023 c = ntohl(k->s6_addr32[2]); 1024 d = ntohl(k->s6_addr32[3]); 1025 while (a & 0x80000000U) { 1026 ++bits; 1027 a <<= 1; 1028 a |= (b >> 31) & 1; 1029 b <<= 1; 1030 b |= (c >> 31) & 1; 1031 c <<= 1; 1032 c |= (d >> 31) & 1; 1033 d <<= 1; 1034 } 1035 if (a != 0 || b != 0 || c != 0 || d != 0) 1036 return -1; 1037 return bits; 1038} 1039 1040const char *ip6mask_to_numeric(const struct in6_addr *addrp) 1041{ 1042 static char buf[50+2]; 1043 int l = ip6addr_prefix_length(addrp); 1044 1045 if (l == -1) { 1046 strcpy(buf, "/"); 1047 strcat(buf, ip6addr_to_numeric(addrp)); 1048 return buf; 1049 } 1050 sprintf(buf, "/%d", l); 1051 return buf; 1052} 1053 1054struct in6_addr *numeric_to_ip6addr(const char *num) 1055{ 1056 static struct in6_addr ap; 1057 int err; 1058 1059 if ((err = inet_pton(AF_INET6, num, &ap)) == 1) 1060 return ≈ 1061#ifdef DEBUG 1062 fprintf(stderr, "\nnumeric2addr: %d\n", err); 1063#endif 1064 return NULL; 1065} 1066 1067static struct in6_addr * 1068host_to_ip6addr(const char *name, unsigned int *naddr) 1069{ 1070 static struct in6_addr *addr; 1071 struct addrinfo hints; 1072 struct addrinfo *res; 1073 int err; 1074 1075 memset(&hints, 0, sizeof(hints)); 1076 hints.ai_flags = AI_CANONNAME; 1077 hints.ai_family = AF_INET6; 1078 hints.ai_socktype = SOCK_RAW; 1079 hints.ai_protocol = IPPROTO_IPV6; 1080 hints.ai_next = NULL; 1081 1082 *naddr = 0; 1083 if ((err = getaddrinfo(name, NULL, &hints, &res)) != 0) { 1084#ifdef DEBUG 1085 fprintf(stderr,"Name2IP: %s\n",gai_strerror(err)); 1086#endif 1087 return NULL; 1088 } else { 1089 if (res->ai_family != AF_INET6 || 1090 res->ai_addrlen != sizeof(struct sockaddr_in6)) 1091 return NULL; 1092 1093#ifdef DEBUG 1094 fprintf(stderr, "resolved: len=%d %s ", res->ai_addrlen, 1095 ip6addr_to_numeric(&((struct sockaddr_in6 *)res->ai_addr)->sin6_addr)); 1096#endif 1097 /* Get the first element of the address-chain */ 1098 addr = xtables_malloc(sizeof(struct in6_addr)); 1099 memcpy(addr, &((const struct sockaddr_in6 *)res->ai_addr)->sin6_addr, 1100 sizeof(struct in6_addr)); 1101 freeaddrinfo(res); 1102 *naddr = 1; 1103 return addr; 1104 } 1105 1106 return NULL; 1107} 1108 1109static struct in6_addr *network_to_ip6addr(const char *name) 1110{ 1111 /* abort();*/ 1112 /* TODO: not implemented yet, but the exception breaks the 1113 * name resolvation */ 1114 return NULL; 1115} 1116 1117static struct in6_addr * 1118ip6parse_hostnetwork(const char *name, unsigned int *naddrs) 1119{ 1120 struct in6_addr *addrp, *addrptmp; 1121 1122 if ((addrptmp = numeric_to_ip6addr(name)) != NULL || 1123 (addrptmp = network_to_ip6addr(name)) != NULL) { 1124 addrp = xtables_malloc(sizeof(struct in6_addr)); 1125 memcpy(addrp, addrptmp, sizeof(*addrp)); 1126 *naddrs = 1; 1127 return addrp; 1128 } 1129 if ((addrp = host_to_ip6addr(name, naddrs)) != NULL) 1130 return addrp; 1131 1132 exit_error(PARAMETER_PROBLEM, "host/network `%s' not found", name); 1133} 1134 1135static struct in6_addr *parse_ip6mask(char *mask) 1136{ 1137 static struct in6_addr maskaddr; 1138 struct in6_addr *addrp; 1139 unsigned int bits; 1140 1141 if (mask == NULL) { 1142 /* no mask at all defaults to 128 bits */ 1143 memset(&maskaddr, 0xff, sizeof maskaddr); 1144 return &maskaddr; 1145 } 1146 if ((addrp = numeric_to_ip6addr(mask)) != NULL) 1147 return addrp; 1148 if (string_to_number(mask, 0, 128, &bits) == -1) 1149 exit_error(PARAMETER_PROBLEM, 1150 "invalid mask `%s' specified", mask); 1151 if (bits != 0) { 1152 char *p = (void *)&maskaddr; 1153 memset(p, 0xff, bits / 8); 1154 memset(p + (bits / 8) + 1, 0, (128 - bits) / 8); 1155 p[bits/8] = 0xff << (8 - (bits & 7)); 1156 return &maskaddr; 1157 } 1158 1159 memset(&maskaddr, 0, sizeof(maskaddr)); 1160 return &maskaddr; 1161} 1162 1163void ip6parse_hostnetworkmask(const char *name, struct in6_addr **addrpp, 1164 struct in6_addr *maskp, unsigned int *naddrs) 1165{ 1166 struct in6_addr *addrp; 1167 unsigned int i, j, k, n; 1168 char buf[256], *p; 1169 1170 strncpy(buf, name, sizeof(buf) - 1); 1171 buf[sizeof(buf)-1] = '\0'; 1172 if ((p = strrchr(buf, '/')) != NULL) { 1173 *p = '\0'; 1174 addrp = parse_ip6mask(p + 1); 1175 } else { 1176 addrp = parse_ip6mask(NULL); 1177 } 1178 memcpy(maskp, addrp, sizeof(*maskp)); 1179 1180 /* if a null mask is given, the name is ignored, like in "any/0" */ 1181 if (memcmp(maskp, &in6addr_any, sizeof(in6addr_any)) == 0) 1182 strcpy(buf, "::"); 1183 1184 addrp = *addrpp = ip6parse_hostnetwork(buf, naddrs); 1185 n = *naddrs; 1186 for (i = 0, j = 0; i < n; ++i) { 1187 for (k = 0; k < 4; ++k) 1188 addrp[j].s6_addr32[k] &= maskp->s6_addr32[k]; 1189 ++j; 1190 for (k = 0; k < j - 1; ++k) 1191 if (IN6_ARE_ADDR_EQUAL(&addrp[k], &addrp[j - 1])) { 1192 --*naddrs; 1193 --j; 1194 break; 1195 } 1196 } 1197} 1198 1199void save_string(const char *value) 1200{ 1201 static const char no_quote_chars[] = "_-0123456789" 1202 "abcdefghijklmnopqrstuvwxyz" 1203 "ABCDEFGHIJKLMNOPQRSTUVWXYZ"; 1204 static const char escape_chars[] = "\"\\'"; 1205 size_t length; 1206 const char *p; 1207 1208 length = strcspn(value, no_quote_chars); 1209 if (length > 0 && value[length] == 0) { 1210 /* no quoting required */ 1211 fputs(value, stdout); 1212 putchar(' '); 1213 } else { 1214 /* there is at least one dangerous character in the 1215 value, which we have to quote. Write double quotes 1216 around the value and escape special characters with 1217 a backslash */ 1218 putchar('"'); 1219 1220 for (p = strpbrk(value, escape_chars); p != NULL; 1221 p = strpbrk(value, escape_chars)) { 1222 if (p > value) 1223 fwrite(value, 1, p - value, stdout); 1224 putchar('\\'); 1225 putchar(*p); 1226 value = p + 1; 1227 } 1228 1229 /* print the rest and finish the double quoted 1230 string */ 1231 fputs(value, stdout); 1232 printf("\" "); 1233 } 1234} 1235