xtables.c revision 41a9b481693b4c43c16d0588cc558dd455168af0
1/* 2 * (C) 2000-2006 by the netfilter coreteam <coreteam@netfilter.org>: 3 * 4 * This program is free software; you can redistribute it and/or modify 5 * it under the terms of the GNU General Public License as published by 6 * the Free Software Foundation; either version 2 of the License, or 7 * (at your option) any later version. 8 * 9 * This program is distributed in the hope that it will be useful, 10 * but WITHOUT ANY WARRANTY; without even the implied warranty of 11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 12 * GNU General Public License for more details. 13 * 14 * You should have received a copy of the GNU General Public License 15 * along with this program; if not, write to the Free Software 16 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. 17 */ 18#include "config.h" 19#include <ctype.h> 20#include <errno.h> 21#include <fcntl.h> 22#include <inttypes.h> 23#include <netdb.h> 24#include <stdarg.h> 25#include <stdbool.h> 26#include <stdio.h> 27#include <stdlib.h> 28#include <string.h> 29#include <unistd.h> 30#include <sys/socket.h> 31#include <sys/stat.h> 32#include <sys/statfs.h> 33#include <sys/types.h> 34#include <sys/wait.h> 35#include <arpa/inet.h> 36#if defined(HAVE_LINUX_MAGIC_H) 37# include <linux/magic.h> /* for PROC_SUPER_MAGIC */ 38#elif defined(HAVE_LINUX_PROC_FS_H) 39# include <linux/proc_fs.h> /* Linux 2.4 */ 40#else 41# define PROC_SUPER_MAGIC 0x9fa0 42#endif 43 44#include <xtables.h> 45#include <limits.h> /* INT_MAX in ip_tables.h/ip6_tables.h */ 46#include <linux/netfilter_ipv4/ip_tables.h> 47#include <linux/netfilter_ipv6/ip6_tables.h> 48#include <libiptc/libxtc.h> 49 50#ifndef NO_SHARED_LIBS 51#include <dlfcn.h> 52#endif 53#ifndef IPT_SO_GET_REVISION_MATCH /* Old kernel source. */ 54# define IPT_SO_GET_REVISION_MATCH (IPT_BASE_CTL + 2) 55# define IPT_SO_GET_REVISION_TARGET (IPT_BASE_CTL + 3) 56#endif 57#ifndef IP6T_SO_GET_REVISION_MATCH /* Old kernel source. */ 58# define IP6T_SO_GET_REVISION_MATCH 68 59# define IP6T_SO_GET_REVISION_TARGET 69 60#endif 61#include <getopt.h> 62#include "iptables/internal.h" 63#include "xshared.h" 64 65#define NPROTO 255 66 67#ifndef PROC_SYS_MODPROBE 68#define PROC_SYS_MODPROBE "/proc/sys/kernel/modprobe" 69#endif 70 71/* we need this for ip6?tables-restore. ip6?tables-restore.c sets line to the 72 * current line of the input file, in order to give a more precise error 73 * message. ip6?tables itself doesn't need this, so it is initialized to the 74 * magic number of -1 */ 75int line = -1; 76 77void basic_exit_err(enum xtables_exittype status, const char *msg, ...) __attribute__((noreturn, format(printf,2,3))); 78 79struct xtables_globals *xt_params = NULL; 80 81void basic_exit_err(enum xtables_exittype status, const char *msg, ...) 82{ 83 va_list args; 84 85 va_start(args, msg); 86 fprintf(stderr, "%s v%s: ", xt_params->program_name, xt_params->program_version); 87 vfprintf(stderr, msg, args); 88 va_end(args); 89 fprintf(stderr, "\n"); 90 exit(status); 91} 92 93void xtables_free_opts(int unused) 94{ 95 if (xt_params->opts != xt_params->orig_opts) { 96 free(xt_params->opts); 97 xt_params->opts = NULL; 98 } 99} 100 101struct option *xtables_merge_options(struct option *orig_opts, 102 struct option *oldopts, 103 const struct option *newopts, 104 unsigned int *option_offset) 105{ 106 unsigned int num_oold = 0, num_old = 0, num_new = 0, i; 107 struct option *merge, *mp; 108 109 if (newopts == NULL) 110 return oldopts; 111 112 for (num_oold = 0; orig_opts[num_oold].name; num_oold++) ; 113 if (oldopts != NULL) 114 for (num_old = 0; oldopts[num_old].name; num_old++) ; 115 for (num_new = 0; newopts[num_new].name; num_new++) ; 116 117 /* 118 * Since @oldopts also has @orig_opts already (and does so at the 119 * start), skip these entries. 120 */ 121 oldopts += num_oold; 122 num_old -= num_oold; 123 124 merge = malloc(sizeof(*mp) * (num_oold + num_old + num_new + 1)); 125 if (merge == NULL) 126 return NULL; 127 128 /* Let the base options -[ADI...] have precedence over everything */ 129 memcpy(merge, orig_opts, sizeof(*mp) * num_oold); 130 mp = merge + num_oold; 131 132 /* Second, the new options */ 133 xt_params->option_offset += XT_OPTION_OFFSET_SCALE; 134 *option_offset = xt_params->option_offset; 135 memcpy(mp, newopts, sizeof(*mp) * num_new); 136 137 for (i = 0; i < num_new; ++i, ++mp) 138 mp->val += *option_offset; 139 140 /* Third, the old options */ 141 memcpy(mp, oldopts, sizeof(*mp) * num_old); 142 mp += num_old; 143 xtables_free_opts(0); 144 145 /* Clear trailing entry */ 146 memset(mp, 0, sizeof(*mp)); 147 return merge; 148} 149 150static const struct xtables_afinfo afinfo_ipv4 = { 151 .kmod = "ip_tables", 152 .proc_exists = "/proc/net/ip_tables_names", 153 .libprefix = "libipt_", 154 .family = NFPROTO_IPV4, 155 .ipproto = IPPROTO_IP, 156 .so_rev_match = IPT_SO_GET_REVISION_MATCH, 157 .so_rev_target = IPT_SO_GET_REVISION_TARGET, 158}; 159 160static const struct xtables_afinfo afinfo_ipv6 = { 161 .kmod = "ip6_tables", 162 .proc_exists = "/proc/net/ip6_tables_names", 163 .libprefix = "libip6t_", 164 .family = NFPROTO_IPV6, 165 .ipproto = IPPROTO_IPV6, 166 .so_rev_match = IP6T_SO_GET_REVISION_MATCH, 167 .so_rev_target = IP6T_SO_GET_REVISION_TARGET, 168}; 169 170const struct xtables_afinfo *afinfo; 171 172/* Search path for Xtables .so files */ 173static const char *xtables_libdir; 174 175/* the path to command to load kernel module */ 176const char *xtables_modprobe_program; 177 178/* Keep track of matches/targets pending full registration: linked lists. */ 179struct xtables_match *xtables_pending_matches; 180struct xtables_target *xtables_pending_targets; 181 182/* Keep track of fully registered external matches/targets: linked lists. */ 183struct xtables_match *xtables_matches; 184struct xtables_target *xtables_targets; 185 186/* Fully register a match/target which was previously partially registered. */ 187static void xtables_fully_register_pending_match(struct xtables_match *me); 188static void xtables_fully_register_pending_target(struct xtables_target *me); 189 190void xtables_init(void) 191{ 192 xtables_libdir = getenv("XTABLES_LIBDIR"); 193 if (xtables_libdir != NULL) 194 return; 195 xtables_libdir = getenv("IPTABLES_LIB_DIR"); 196 if (xtables_libdir != NULL) { 197 fprintf(stderr, "IPTABLES_LIB_DIR is deprecated, " 198 "use XTABLES_LIBDIR.\n"); 199 return; 200 } 201 /* 202 * Well yes, IP6TABLES_LIB_DIR is of lower priority over 203 * IPTABLES_LIB_DIR since this moved to libxtables; I think that is ok 204 * for these env vars are deprecated anyhow, and in light of the 205 * (shared) libxt_*.so files, makes less sense to have 206 * IPTABLES_LIB_DIR != IP6TABLES_LIB_DIR. 207 */ 208 xtables_libdir = getenv("IP6TABLES_LIB_DIR"); 209 if (xtables_libdir != NULL) { 210 fprintf(stderr, "IP6TABLES_LIB_DIR is deprecated, " 211 "use XTABLES_LIBDIR.\n"); 212 return; 213 } 214 xtables_libdir = XTABLES_LIBDIR; 215} 216 217void xtables_set_nfproto(uint8_t nfproto) 218{ 219 switch (nfproto) { 220 case NFPROTO_IPV4: 221 afinfo = &afinfo_ipv4; 222 break; 223 case NFPROTO_IPV6: 224 afinfo = &afinfo_ipv6; 225 break; 226 default: 227 fprintf(stderr, "libxtables: unhandled NFPROTO in %s\n", 228 __func__); 229 } 230} 231 232/** 233 * xtables_set_params - set the global parameters used by xtables 234 * @xtp: input xtables_globals structure 235 * 236 * The app is expected to pass a valid xtables_globals data-filled 237 * with proper values 238 * @xtp cannot be NULL 239 * 240 * Returns -1 on failure to set and 0 on success 241 */ 242int xtables_set_params(struct xtables_globals *xtp) 243{ 244 if (!xtp) { 245 fprintf(stderr, "%s: Illegal global params\n",__func__); 246 return -1; 247 } 248 249 xt_params = xtp; 250 251 if (!xt_params->exit_err) 252 xt_params->exit_err = basic_exit_err; 253 254 return 0; 255} 256 257int xtables_init_all(struct xtables_globals *xtp, uint8_t nfproto) 258{ 259 xtables_init(); 260 xtables_set_nfproto(nfproto); 261 return xtables_set_params(xtp); 262} 263 264/** 265 * xtables_*alloc - wrappers that exit on failure 266 */ 267void *xtables_calloc(size_t count, size_t size) 268{ 269 void *p; 270 271 if ((p = calloc(count, size)) == NULL) { 272 perror("ip[6]tables: calloc failed"); 273 exit(1); 274 } 275 276 return p; 277} 278 279void *xtables_malloc(size_t size) 280{ 281 void *p; 282 283 if ((p = malloc(size)) == NULL) { 284 perror("ip[6]tables: malloc failed"); 285 exit(1); 286 } 287 288 return p; 289} 290 291void *xtables_realloc(void *ptr, size_t size) 292{ 293 void *p; 294 295 if ((p = realloc(ptr, size)) == NULL) { 296 perror("ip[6]tables: realloc failed"); 297 exit(1); 298 } 299 300 return p; 301} 302 303static char *get_modprobe(void) 304{ 305 int procfile; 306 char *ret; 307 308#define PROCFILE_BUFSIZ 1024 309 procfile = open(PROC_SYS_MODPROBE, O_RDONLY); 310 if (procfile < 0) 311 return NULL; 312 if (fcntl(procfile, F_SETFD, FD_CLOEXEC) == -1) { 313 fprintf(stderr, "Could not set close on exec: %s\n", 314 strerror(errno)); 315 exit(1); 316 } 317 318 ret = malloc(PROCFILE_BUFSIZ); 319 if (ret) { 320 memset(ret, 0, PROCFILE_BUFSIZ); 321 switch (read(procfile, ret, PROCFILE_BUFSIZ)) { 322 case -1: goto fail; 323 case PROCFILE_BUFSIZ: goto fail; /* Partial read. Wierd */ 324 } 325 if (ret[strlen(ret)-1]=='\n') 326 ret[strlen(ret)-1]=0; 327 close(procfile); 328 return ret; 329 } 330 fail: 331 free(ret); 332 close(procfile); 333 return NULL; 334} 335 336int xtables_insmod(const char *modname, const char *modprobe, bool quiet) 337{ 338 char *buf = NULL; 339 char *argv[4]; 340 int status; 341 342 /* If they don't explicitly set it, read out of kernel */ 343 if (!modprobe) { 344 buf = get_modprobe(); 345 if (!buf) 346 return -1; 347 modprobe = buf; 348 } 349 350 /* 351 * Need to flush the buffer, or the child may output it again 352 * when switching the program thru execv. 353 */ 354 fflush(stdout); 355 356 switch (vfork()) { 357 case 0: 358 argv[0] = (char *)modprobe; 359 argv[1] = (char *)modname; 360 if (quiet) { 361 argv[2] = "-q"; 362 argv[3] = NULL; 363 } else { 364 argv[2] = NULL; 365 argv[3] = NULL; 366 } 367 execv(argv[0], argv); 368 369 /* not usually reached */ 370 exit(1); 371 case -1: 372 free(buf); 373 return -1; 374 375 default: /* parent */ 376 wait(&status); 377 } 378 379 free(buf); 380 if (WIFEXITED(status) && WEXITSTATUS(status) == 0) 381 return 0; 382 return -1; 383} 384 385/* return true if a given file exists within procfs */ 386static bool proc_file_exists(const char *filename) 387{ 388 struct stat s; 389 struct statfs f; 390 391 if (lstat(filename, &s)) 392 return false; 393 if (!S_ISREG(s.st_mode)) 394 return false; 395 if (statfs(filename, &f)) 396 return false; 397 if (f.f_type != PROC_SUPER_MAGIC) 398 return false; 399 return true; 400} 401 402int xtables_load_ko(const char *modprobe, bool quiet) 403{ 404 static bool loaded = false; 405 int ret; 406 407 if (loaded) 408 return 0; 409 410 if (proc_file_exists(afinfo->proc_exists)) { 411 loaded = true; 412 return 0; 413 }; 414 415 ret = xtables_insmod(afinfo->kmod, modprobe, quiet); 416 if (ret == 0) 417 loaded = true; 418 419 return ret; 420} 421 422/** 423 * xtables_strtou{i,l} - string to number conversion 424 * @s: input string 425 * @end: like strtoul's "end" pointer 426 * @value: pointer for result 427 * @min: minimum accepted value 428 * @max: maximum accepted value 429 * 430 * If @end is NULL, we assume the caller wants a "strict strtoul", and hence 431 * "15a" is rejected. 432 * In either case, the value obtained is compared for min-max compliance. 433 * Base is always 0, i.e. autodetect depending on @s. 434 * 435 * Returns true/false whether number was accepted. On failure, *value has 436 * undefined contents. 437 */ 438bool xtables_strtoul(const char *s, char **end, uintmax_t *value, 439 uintmax_t min, uintmax_t max) 440{ 441 uintmax_t v; 442 const char *p; 443 char *my_end; 444 445 errno = 0; 446 /* Since strtoul allows leading minus, we have to check for ourself. */ 447 for (p = s; isspace(*p); ++p) 448 ; 449 if (*p == '-') 450 return false; 451 v = strtoumax(s, &my_end, 0); 452 if (my_end == s) 453 return false; 454 if (end != NULL) 455 *end = my_end; 456 457 if (errno != ERANGE && min <= v && (max == 0 || v <= max)) { 458 if (value != NULL) 459 *value = v; 460 if (end == NULL) 461 return *my_end == '\0'; 462 return true; 463 } 464 465 return false; 466} 467 468bool xtables_strtoui(const char *s, char **end, unsigned int *value, 469 unsigned int min, unsigned int max) 470{ 471 uintmax_t v; 472 bool ret; 473 474 ret = xtables_strtoul(s, end, &v, min, max); 475 if (value != NULL) 476 *value = v; 477 return ret; 478} 479 480int xtables_service_to_port(const char *name, const char *proto) 481{ 482 struct servent *service; 483 484 if ((service = getservbyname(name, proto)) != NULL) 485 return ntohs((unsigned short) service->s_port); 486 487 return -1; 488} 489 490uint16_t xtables_parse_port(const char *port, const char *proto) 491{ 492 unsigned int portnum; 493 494 if (xtables_strtoui(port, NULL, &portnum, 0, UINT16_MAX) || 495 (portnum = xtables_service_to_port(port, proto)) != (unsigned)-1) 496 return portnum; 497 498 xt_params->exit_err(PARAMETER_PROBLEM, 499 "invalid port/service `%s' specified", port); 500} 501 502void xtables_parse_interface(const char *arg, char *vianame, 503 unsigned char *mask) 504{ 505 unsigned int vialen = strlen(arg); 506 unsigned int i; 507 508 memset(mask, 0, IFNAMSIZ); 509 memset(vianame, 0, IFNAMSIZ); 510 511 if (vialen + 1 > IFNAMSIZ) 512 xt_params->exit_err(PARAMETER_PROBLEM, 513 "interface name `%s' must be shorter than IFNAMSIZ" 514 " (%i)", arg, IFNAMSIZ-1); 515 516 strcpy(vianame, arg); 517 if (vialen == 0) 518 memset(mask, 0, IFNAMSIZ); 519 else if (vianame[vialen - 1] == '+') { 520 memset(mask, 0xFF, vialen - 1); 521 memset(mask + vialen - 1, 0, IFNAMSIZ - vialen + 1); 522 /* Don't remove `+' here! -HW */ 523 } else { 524 /* Include nul-terminator in match */ 525 memset(mask, 0xFF, vialen + 1); 526 memset(mask + vialen + 1, 0, IFNAMSIZ - vialen - 1); 527 for (i = 0; vianame[i]; i++) { 528 if (vianame[i] == '/' || 529 vianame[i] == ' ') { 530 fprintf(stderr, 531 "Warning: weird character in interface" 532 " `%s' ('/' and ' ' are not allowed by the kernel).\n", 533 vianame); 534 break; 535 } 536 } 537 } 538} 539 540#ifndef NO_SHARED_LIBS 541static void *load_extension(const char *search_path, const char *af_prefix, 542 const char *name, bool is_target) 543{ 544 const char *all_prefixes[] = {"libxt_", af_prefix, NULL}; 545 const char **prefix; 546 const char *dir = search_path, *next; 547 void *ptr = NULL; 548 struct stat sb; 549 char path[256]; 550 551 do { 552 next = strchr(dir, ':'); 553 if (next == NULL) 554 next = dir + strlen(dir); 555 556 for (prefix = all_prefixes; *prefix != NULL; ++prefix) { 557 snprintf(path, sizeof(path), "%.*s/%s%s.so", 558 (unsigned int)(next - dir), dir, 559 *prefix, name); 560 561 if (stat(path, &sb) != 0) { 562 if (errno == ENOENT) 563 continue; 564 fprintf(stderr, "%s: %s\n", path, 565 strerror(errno)); 566 return NULL; 567 } 568 if (dlopen(path, RTLD_NOW) == NULL) { 569 fprintf(stderr, "%s: %s\n", path, dlerror()); 570 break; 571 } 572 573 if (is_target) 574 ptr = xtables_find_target(name, XTF_DONT_LOAD); 575 else 576 ptr = xtables_find_match(name, 577 XTF_DONT_LOAD, NULL); 578 579 if (ptr != NULL) 580 return ptr; 581 582 fprintf(stderr, "%s: no \"%s\" extension found for " 583 "this protocol\n", path, name); 584 errno = ENOENT; 585 return NULL; 586 } 587 dir = next + 1; 588 } while (*next != '\0'); 589 590 return NULL; 591} 592#endif 593 594struct xtables_match * 595xtables_find_match(const char *name, enum xtables_tryload tryload, 596 struct xtables_rule_match **matches) 597{ 598 struct xtables_match **dptr; 599 struct xtables_match *ptr; 600 const char *icmp6 = "icmp6"; 601 602 if (strlen(name) >= XT_EXTENSION_MAXNAMELEN) 603 xtables_error(PARAMETER_PROBLEM, 604 "Invalid match name \"%s\" (%u chars max)", 605 name, XT_EXTENSION_MAXNAMELEN - 1); 606 607 /* This is ugly as hell. Nonetheless, there is no way of changing 608 * this without hurting backwards compatibility */ 609 if ( (strcmp(name,"icmpv6") == 0) || 610 (strcmp(name,"ipv6-icmp") == 0) || 611 (strcmp(name,"icmp6") == 0) ) 612 name = icmp6; 613 614 /* Trigger delayed initialization */ 615 for (dptr = &xtables_pending_matches; *dptr; ) { 616 if (strcmp(name, (*dptr)->name) == 0) { 617 ptr = *dptr; 618 *dptr = (*dptr)->next; 619 ptr->next = NULL; 620 xtables_fully_register_pending_match(ptr); 621 } else { 622 dptr = &((*dptr)->next); 623 } 624 } 625 626 for (ptr = xtables_matches; ptr; ptr = ptr->next) { 627 if (strcmp(name, ptr->name) == 0) { 628 struct xtables_match *clone; 629 630 /* First match of this type: */ 631 if (ptr->m == NULL) 632 break; 633 634 /* Second and subsequent clones */ 635 clone = xtables_malloc(sizeof(struct xtables_match)); 636 memcpy(clone, ptr, sizeof(struct xtables_match)); 637 clone->udata = NULL; 638 clone->mflags = 0; 639 /* This is a clone: */ 640 clone->next = clone; 641 642 ptr = clone; 643 break; 644 } 645 } 646 647#ifndef NO_SHARED_LIBS 648 if (!ptr && tryload != XTF_DONT_LOAD && tryload != XTF_DURING_LOAD) { 649 ptr = load_extension(xtables_libdir, afinfo->libprefix, 650 name, false); 651 652 if (ptr == NULL && tryload == XTF_LOAD_MUST_SUCCEED) 653 xt_params->exit_err(PARAMETER_PROBLEM, 654 "Couldn't load match `%s':%s\n", 655 name, strerror(errno)); 656 } 657#else 658 if (ptr && !ptr->loaded) { 659 if (tryload != XTF_DONT_LOAD) 660 ptr->loaded = 1; 661 else 662 ptr = NULL; 663 } 664 if(!ptr && (tryload == XTF_LOAD_MUST_SUCCEED)) { 665 xt_params->exit_err(PARAMETER_PROBLEM, 666 "Couldn't find match `%s'\n", name); 667 } 668#endif 669 670 if (ptr && matches) { 671 struct xtables_rule_match **i; 672 struct xtables_rule_match *newentry; 673 674 newentry = xtables_malloc(sizeof(struct xtables_rule_match)); 675 676 for (i = matches; *i; i = &(*i)->next) { 677 if (strcmp(name, (*i)->match->name) == 0) 678 (*i)->completed = true; 679 } 680 newentry->match = ptr; 681 newentry->completed = false; 682 newentry->next = NULL; 683 *i = newentry; 684 } 685 686 return ptr; 687} 688 689struct xtables_target * 690xtables_find_target(const char *name, enum xtables_tryload tryload) 691{ 692 struct xtables_target **dptr; 693 struct xtables_target *ptr; 694 695 /* Standard target? */ 696 if (strcmp(name, "") == 0 697 || strcmp(name, XTC_LABEL_ACCEPT) == 0 698 || strcmp(name, XTC_LABEL_DROP) == 0 699 || strcmp(name, XTC_LABEL_QUEUE) == 0 700 || strcmp(name, XTC_LABEL_RETURN) == 0) 701 name = "standard"; 702 703 /* Trigger delayed initialization */ 704 for (dptr = &xtables_pending_targets; *dptr; ) { 705 if (strcmp(name, (*dptr)->name) == 0) { 706 ptr = *dptr; 707 *dptr = (*dptr)->next; 708 ptr->next = NULL; 709 xtables_fully_register_pending_target(ptr); 710 } else { 711 dptr = &((*dptr)->next); 712 } 713 } 714 715 for (ptr = xtables_targets; ptr; ptr = ptr->next) { 716 if (strcmp(name, ptr->name) == 0) 717 break; 718 } 719 720#ifndef NO_SHARED_LIBS 721 if (!ptr && tryload != XTF_DONT_LOAD && tryload != XTF_DURING_LOAD) { 722 ptr = load_extension(xtables_libdir, afinfo->libprefix, 723 name, true); 724 725 if (ptr == NULL && tryload == XTF_LOAD_MUST_SUCCEED) 726 xt_params->exit_err(PARAMETER_PROBLEM, 727 "Couldn't load target `%s':%s\n", 728 name, strerror(errno)); 729 } 730#else 731 if (ptr && !ptr->loaded) { 732 if (tryload != XTF_DONT_LOAD) 733 ptr->loaded = 1; 734 else 735 ptr = NULL; 736 } 737 if (ptr == NULL && tryload == XTF_LOAD_MUST_SUCCEED) { 738 xt_params->exit_err(PARAMETER_PROBLEM, 739 "Couldn't find target `%s'\n", name); 740 } 741#endif 742 743 if (ptr) 744 ptr->used = 1; 745 746 return ptr; 747} 748 749static int compatible_revision(const char *name, uint8_t revision, int opt) 750{ 751 struct xt_get_revision rev; 752 socklen_t s = sizeof(rev); 753 int max_rev, sockfd; 754 755 sockfd = socket(afinfo->family, SOCK_RAW, IPPROTO_RAW); 756 if (sockfd < 0) { 757 if (errno == EPERM) { 758 /* revision 0 is always supported. */ 759 if (revision != 0) 760 fprintf(stderr, "%s: Could not determine whether " 761 "revision %u is supported, " 762 "assuming it is.\n", 763 name, revision); 764 return 1; 765 } 766 fprintf(stderr, "Could not open socket to kernel: %s\n", 767 strerror(errno)); 768 exit(1); 769 } 770 771 if (fcntl(sockfd, F_SETFD, FD_CLOEXEC) == -1) { 772 fprintf(stderr, "Could not set close on exec: %s\n", 773 strerror(errno)); 774 exit(1); 775 } 776 777 xtables_load_ko(xtables_modprobe_program, true); 778 779 strcpy(rev.name, name); 780 rev.revision = revision; 781 782 max_rev = getsockopt(sockfd, afinfo->ipproto, opt, &rev, &s); 783 if (max_rev < 0) { 784 /* Definitely don't support this? */ 785 if (errno == ENOENT || errno == EPROTONOSUPPORT) { 786 close(sockfd); 787 return 0; 788 } else if (errno == ENOPROTOOPT) { 789 close(sockfd); 790 /* Assume only revision 0 support (old kernel) */ 791 return (revision == 0); 792 } else { 793 fprintf(stderr, "getsockopt failed strangely: %s\n", 794 strerror(errno)); 795 exit(1); 796 } 797 } 798 close(sockfd); 799 return 1; 800} 801 802 803static int compatible_match_revision(const char *name, uint8_t revision) 804{ 805 return compatible_revision(name, revision, afinfo->so_rev_match); 806} 807 808static int compatible_target_revision(const char *name, uint8_t revision) 809{ 810 return compatible_revision(name, revision, afinfo->so_rev_target); 811} 812 813static void xtables_check_options(const char *name, const struct option *opt) 814{ 815 for (; opt->name != NULL; ++opt) 816 if (opt->val < 0 || opt->val >= XT_OPTION_OFFSET_SCALE) { 817 fprintf(stderr, "%s: Extension %s uses invalid " 818 "option value %d\n",xt_params->program_name, 819 name, opt->val); 820 exit(1); 821 } 822} 823 824void xtables_register_match(struct xtables_match *me) 825{ 826 if (me->version == NULL) { 827 fprintf(stderr, "%s: match %s<%u> is missing a version\n", 828 xt_params->program_name, me->name, me->revision); 829 exit(1); 830 } 831 if (strcmp(me->version, XTABLES_VERSION) != 0) { 832 fprintf(stderr, "%s: match \"%s\" has version \"%s\", " 833 "but \"%s\" is required.\n", 834 xt_params->program_name, me->name, 835 me->version, XTABLES_VERSION); 836 exit(1); 837 } 838 839 if (strlen(me->name) >= XT_EXTENSION_MAXNAMELEN) { 840 fprintf(stderr, "%s: match `%s' has invalid name\n", 841 xt_params->program_name, me->name); 842 exit(1); 843 } 844 845 if (me->family >= NPROTO) { 846 fprintf(stderr, 847 "%s: BUG: match %s has invalid protocol family\n", 848 xt_params->program_name, me->name); 849 exit(1); 850 } 851 852 if (me->x6_options != NULL) 853 xtables_option_metavalidate(me->name, me->x6_options); 854 if (me->extra_opts != NULL) 855 xtables_check_options(me->name, me->extra_opts); 856 857 /* ignore not interested match */ 858 if (me->family != afinfo->family && me->family != AF_UNSPEC) 859 return; 860 861 /* place on linked list of matches pending full registration */ 862 me->next = xtables_pending_matches; 863 xtables_pending_matches = me; 864} 865 866static void xtables_fully_register_pending_match(struct xtables_match *me) 867{ 868 struct xtables_match **i, *old; 869 870 old = xtables_find_match(me->name, XTF_DURING_LOAD, NULL); 871 if (old) { 872 if (old->revision == me->revision && 873 old->family == me->family) { 874 fprintf(stderr, 875 "%s: match `%s' already registered.\n", 876 xt_params->program_name, me->name); 877 exit(1); 878 } 879 880 /* Now we have two (or more) options, check compatibility. */ 881 if (compatible_match_revision(old->name, old->revision) 882 && old->revision > me->revision) 883 return; 884 885 /* See if new match can be used. */ 886 if (!compatible_match_revision(me->name, me->revision)) 887 return; 888 889 /* Prefer !AF_UNSPEC over AF_UNSPEC for same revision. */ 890 if (old->revision == me->revision && me->family == AF_UNSPEC) 891 return; 892 893 /* Delete old one. */ 894 for (i = &xtables_matches; *i!=old; i = &(*i)->next); 895 *i = old->next; 896 } 897 898 if (me->size != XT_ALIGN(me->size)) { 899 fprintf(stderr, "%s: match `%s' has invalid size %u.\n", 900 xt_params->program_name, me->name, 901 (unsigned int)me->size); 902 exit(1); 903 } 904 905 /* Append to list. */ 906 for (i = &xtables_matches; *i; i = &(*i)->next); 907 me->next = NULL; 908 *i = me; 909 910 me->m = NULL; 911 me->mflags = 0; 912} 913 914void xtables_register_matches(struct xtables_match *match, unsigned int n) 915{ 916 do { 917 xtables_register_match(&match[--n]); 918 } while (n > 0); 919} 920 921void xtables_register_target(struct xtables_target *me) 922{ 923 if (me->version == NULL) { 924 fprintf(stderr, "%s: target %s<%u> is missing a version\n", 925 xt_params->program_name, me->name, me->revision); 926 exit(1); 927 } 928 if (strcmp(me->version, XTABLES_VERSION) != 0) { 929 fprintf(stderr, "%s: target \"%s\" has version \"%s\", " 930 "but \"%s\" is required.\n", 931 xt_params->program_name, me->name, 932 me->version, XTABLES_VERSION); 933 exit(1); 934 } 935 936 if (strlen(me->name) >= XT_EXTENSION_MAXNAMELEN) { 937 fprintf(stderr, "%s: target `%s' has invalid name\n", 938 xt_params->program_name, me->name); 939 exit(1); 940 } 941 942 if (me->family >= NPROTO) { 943 fprintf(stderr, 944 "%s: BUG: target %s has invalid protocol family\n", 945 xt_params->program_name, me->name); 946 exit(1); 947 } 948 949 if (me->x6_options != NULL) 950 xtables_option_metavalidate(me->name, me->x6_options); 951 if (me->extra_opts != NULL) 952 xtables_check_options(me->name, me->extra_opts); 953 954 /* ignore not interested target */ 955 if (me->family != afinfo->family && me->family != AF_UNSPEC) 956 return; 957 958 /* place on linked list of targets pending full registration */ 959 me->next = xtables_pending_targets; 960 xtables_pending_targets = me; 961} 962 963static void xtables_fully_register_pending_target(struct xtables_target *me) 964{ 965 struct xtables_target *old; 966 967 old = xtables_find_target(me->name, XTF_DURING_LOAD); 968 if (old) { 969 struct xtables_target **i; 970 971 if (old->revision == me->revision && 972 old->family == me->family) { 973 fprintf(stderr, 974 "%s: target `%s' already registered.\n", 975 xt_params->program_name, me->name); 976 exit(1); 977 } 978 979 /* Now we have two (or more) options, check compatibility. */ 980 if (compatible_target_revision(old->name, old->revision) 981 && old->revision > me->revision) 982 return; 983 984 /* See if new target can be used. */ 985 if (!compatible_target_revision(me->name, me->revision)) 986 return; 987 988 /* Prefer !AF_UNSPEC over AF_UNSPEC for same revision. */ 989 if (old->revision == me->revision && me->family == AF_UNSPEC) 990 return; 991 992 /* Delete old one. */ 993 for (i = &xtables_targets; *i!=old; i = &(*i)->next); 994 *i = old->next; 995 } 996 997 if (me->size != XT_ALIGN(me->size)) { 998 fprintf(stderr, "%s: target `%s' has invalid size %u.\n", 999 xt_params->program_name, me->name, 1000 (unsigned int)me->size); 1001 exit(1); 1002 } 1003 1004 /* Prepend to list. */ 1005 me->next = xtables_targets; 1006 xtables_targets = me; 1007 me->t = NULL; 1008 me->tflags = 0; 1009} 1010 1011void xtables_register_targets(struct xtables_target *target, unsigned int n) 1012{ 1013 do { 1014 xtables_register_target(&target[--n]); 1015 } while (n > 0); 1016} 1017 1018/** 1019 * xtables_param_act - act on condition 1020 * @status: a constant from enum xtables_exittype 1021 * 1022 * %XTF_ONLY_ONCE: print error message that option may only be used once. 1023 * @p1: module name (e.g. "mark") 1024 * @p2(...): option in conflict (e.g. "--mark") 1025 * @p3(...): condition to match on (see extensions/ for examples) 1026 * 1027 * %XTF_NO_INVERT: option does not support inversion 1028 * @p1: module name 1029 * @p2: option in conflict 1030 * @p3: condition to match on 1031 * 1032 * %XTF_BAD_VALUE: bad value for option 1033 * @p1: module name 1034 * @p2: option with which the problem occured (e.g. "--mark") 1035 * @p3: string the user passed in (e.g. "99999999999999") 1036 * 1037 * %XTF_ONE_ACTION: two mutually exclusive actions have been specified 1038 * @p1: module name 1039 * 1040 * Displays an error message and exits the program. 1041 */ 1042void xtables_param_act(unsigned int status, const char *p1, ...) 1043{ 1044 const char *p2, *p3; 1045 va_list args; 1046 bool b; 1047 1048 va_start(args, p1); 1049 1050 switch (status) { 1051 case XTF_ONLY_ONCE: 1052 p2 = va_arg(args, const char *); 1053 b = va_arg(args, unsigned int); 1054 if (!b) { 1055 va_end(args); 1056 return; 1057 } 1058 xt_params->exit_err(PARAMETER_PROBLEM, 1059 "%s: \"%s\" option may only be specified once", 1060 p1, p2); 1061 break; 1062 case XTF_NO_INVERT: 1063 p2 = va_arg(args, const char *); 1064 b = va_arg(args, unsigned int); 1065 if (!b) { 1066 va_end(args); 1067 return; 1068 } 1069 xt_params->exit_err(PARAMETER_PROBLEM, 1070 "%s: \"%s\" option cannot be inverted", p1, p2); 1071 break; 1072 case XTF_BAD_VALUE: 1073 p2 = va_arg(args, const char *); 1074 p3 = va_arg(args, const char *); 1075 xt_params->exit_err(PARAMETER_PROBLEM, 1076 "%s: Bad value for \"%s\" option: \"%s\"", 1077 p1, p2, p3); 1078 break; 1079 case XTF_ONE_ACTION: 1080 b = va_arg(args, unsigned int); 1081 if (!b) { 1082 va_end(args); 1083 return; 1084 } 1085 xt_params->exit_err(PARAMETER_PROBLEM, 1086 "%s: At most one action is possible", p1); 1087 break; 1088 default: 1089 xt_params->exit_err(status, p1, args); 1090 break; 1091 } 1092 1093 va_end(args); 1094} 1095 1096const char *xtables_ipaddr_to_numeric(const struct in_addr *addrp) 1097{ 1098 static char buf[20]; 1099 const unsigned char *bytep = (const void *)&addrp->s_addr; 1100 1101 sprintf(buf, "%u.%u.%u.%u", bytep[0], bytep[1], bytep[2], bytep[3]); 1102 return buf; 1103} 1104 1105static const char *ipaddr_to_host(const struct in_addr *addr) 1106{ 1107 struct hostent *host; 1108 1109 host = gethostbyaddr(addr, sizeof(struct in_addr), AF_INET); 1110 if (host == NULL) 1111 return NULL; 1112 1113 return host->h_name; 1114} 1115 1116static const char *ipaddr_to_network(const struct in_addr *addr) 1117{ 1118 struct netent *net; 1119 1120 if ((net = getnetbyaddr(ntohl(addr->s_addr), AF_INET)) != NULL) 1121 return net->n_name; 1122 1123 return NULL; 1124} 1125 1126const char *xtables_ipaddr_to_anyname(const struct in_addr *addr) 1127{ 1128 const char *name; 1129 1130 if ((name = ipaddr_to_host(addr)) != NULL || 1131 (name = ipaddr_to_network(addr)) != NULL) 1132 return name; 1133 1134 return xtables_ipaddr_to_numeric(addr); 1135} 1136 1137const char *xtables_ipmask_to_numeric(const struct in_addr *mask) 1138{ 1139 static char buf[20]; 1140 uint32_t maskaddr, bits; 1141 int i; 1142 1143 maskaddr = ntohl(mask->s_addr); 1144 1145 if (maskaddr == 0xFFFFFFFFL) 1146 /* we don't want to see "/32" */ 1147 return ""; 1148 1149 i = 32; 1150 bits = 0xFFFFFFFEL; 1151 while (--i >= 0 && maskaddr != bits) 1152 bits <<= 1; 1153 if (i >= 0) 1154 sprintf(buf, "/%d", i); 1155 else 1156 /* mask was not a decent combination of 1's and 0's */ 1157 sprintf(buf, "/%s", xtables_ipaddr_to_numeric(mask)); 1158 1159 return buf; 1160} 1161 1162static struct in_addr *__numeric_to_ipaddr(const char *dotted, bool is_mask) 1163{ 1164 static struct in_addr addr; 1165 unsigned char *addrp; 1166 unsigned int onebyte; 1167 char buf[20], *p, *q; 1168 int i; 1169 1170 /* copy dotted string, because we need to modify it */ 1171 strncpy(buf, dotted, sizeof(buf) - 1); 1172 buf[sizeof(buf) - 1] = '\0'; 1173 addrp = (void *)&addr.s_addr; 1174 1175 p = buf; 1176 for (i = 0; i < 3; ++i) { 1177 if ((q = strchr(p, '.')) == NULL) { 1178 if (is_mask) 1179 return NULL; 1180 1181 /* autocomplete, this is a network address */ 1182 if (!xtables_strtoui(p, NULL, &onebyte, 0, UINT8_MAX)) 1183 return NULL; 1184 1185 addrp[i] = onebyte; 1186 while (i < 3) 1187 addrp[++i] = 0; 1188 1189 return &addr; 1190 } 1191 1192 *q = '\0'; 1193 if (!xtables_strtoui(p, NULL, &onebyte, 0, UINT8_MAX)) 1194 return NULL; 1195 1196 addrp[i] = onebyte; 1197 p = q + 1; 1198 } 1199 1200 /* we have checked 3 bytes, now we check the last one */ 1201 if (!xtables_strtoui(p, NULL, &onebyte, 0, UINT8_MAX)) 1202 return NULL; 1203 1204 addrp[3] = onebyte; 1205 return &addr; 1206} 1207 1208struct in_addr *xtables_numeric_to_ipaddr(const char *dotted) 1209{ 1210 return __numeric_to_ipaddr(dotted, false); 1211} 1212 1213struct in_addr *xtables_numeric_to_ipmask(const char *dotted) 1214{ 1215 return __numeric_to_ipaddr(dotted, true); 1216} 1217 1218static struct in_addr *network_to_ipaddr(const char *name) 1219{ 1220 static struct in_addr addr; 1221 struct netent *net; 1222 1223 if ((net = getnetbyname(name)) != NULL) { 1224 if (net->n_addrtype != AF_INET) 1225 return NULL; 1226 addr.s_addr = htonl(net->n_net); 1227 return &addr; 1228 } 1229 1230 return NULL; 1231} 1232 1233static struct in_addr *host_to_ipaddr(const char *name, unsigned int *naddr) 1234{ 1235 struct hostent *host; 1236 struct in_addr *addr; 1237 unsigned int i; 1238 1239 *naddr = 0; 1240 if ((host = gethostbyname(name)) != NULL) { 1241 if (host->h_addrtype != AF_INET || 1242 host->h_length != sizeof(struct in_addr)) 1243 return NULL; 1244 1245 while (host->h_addr_list[*naddr] != NULL) 1246 ++*naddr; 1247 addr = xtables_calloc(*naddr, sizeof(struct in_addr)); 1248 for (i = 0; i < *naddr; i++) 1249 memcpy(&addr[i], host->h_addr_list[i], 1250 sizeof(struct in_addr)); 1251 return addr; 1252 } 1253 1254 return NULL; 1255} 1256 1257static struct in_addr * 1258ipparse_hostnetwork(const char *name, unsigned int *naddrs) 1259{ 1260 struct in_addr *addrptmp, *addrp; 1261 1262 if ((addrptmp = xtables_numeric_to_ipaddr(name)) != NULL || 1263 (addrptmp = network_to_ipaddr(name)) != NULL) { 1264 addrp = xtables_malloc(sizeof(struct in_addr)); 1265 memcpy(addrp, addrptmp, sizeof(*addrp)); 1266 *naddrs = 1; 1267 return addrp; 1268 } 1269 if ((addrptmp = host_to_ipaddr(name, naddrs)) != NULL) 1270 return addrptmp; 1271 1272 xt_params->exit_err(PARAMETER_PROBLEM, "host/network `%s' not found", name); 1273} 1274 1275static struct in_addr *parse_ipmask(const char *mask) 1276{ 1277 static struct in_addr maskaddr; 1278 struct in_addr *addrp; 1279 unsigned int bits; 1280 1281 if (mask == NULL) { 1282 /* no mask at all defaults to 32 bits */ 1283 maskaddr.s_addr = 0xFFFFFFFF; 1284 return &maskaddr; 1285 } 1286 if ((addrp = xtables_numeric_to_ipmask(mask)) != NULL) 1287 /* dotted_to_addr already returns a network byte order addr */ 1288 return addrp; 1289 if (!xtables_strtoui(mask, NULL, &bits, 0, 32)) 1290 xt_params->exit_err(PARAMETER_PROBLEM, 1291 "invalid mask `%s' specified", mask); 1292 if (bits != 0) { 1293 maskaddr.s_addr = htonl(0xFFFFFFFF << (32 - bits)); 1294 return &maskaddr; 1295 } 1296 1297 maskaddr.s_addr = 0U; 1298 return &maskaddr; 1299} 1300 1301void xtables_ipparse_multiple(const char *name, struct in_addr **addrpp, 1302 struct in_addr **maskpp, unsigned int *naddrs) 1303{ 1304 struct in_addr *addrp; 1305 char buf[256], *p, *next; 1306 unsigned int len, i, j, n, count = 1; 1307 const char *loop = name; 1308 1309 while ((loop = strchr(loop, ',')) != NULL) { 1310 ++count; 1311 ++loop; /* skip ',' */ 1312 } 1313 1314 *addrpp = xtables_malloc(sizeof(struct in_addr) * count); 1315 *maskpp = xtables_malloc(sizeof(struct in_addr) * count); 1316 1317 loop = name; 1318 1319 for (i = 0; i < count; ++i) { 1320 while (isspace(*loop)) 1321 ++loop; 1322 next = strchr(loop, ','); 1323 if (next != NULL) 1324 len = next - loop; 1325 else 1326 len = strlen(loop); 1327 if (len > sizeof(buf) - 1) 1328 xt_params->exit_err(PARAMETER_PROBLEM, 1329 "Hostname too long"); 1330 1331 strncpy(buf, loop, len); 1332 buf[len] = '\0'; 1333 if ((p = strrchr(buf, '/')) != NULL) { 1334 *p = '\0'; 1335 addrp = parse_ipmask(p + 1); 1336 } else { 1337 addrp = parse_ipmask(NULL); 1338 } 1339 memcpy(*maskpp + i, addrp, sizeof(*addrp)); 1340 1341 /* if a null mask is given, the name is ignored, like in "any/0" */ 1342 if ((*maskpp + i)->s_addr == 0) 1343 /* 1344 * A bit pointless to process multiple addresses 1345 * in this case... 1346 */ 1347 strcpy(buf, "0.0.0.0"); 1348 1349 addrp = ipparse_hostnetwork(buf, &n); 1350 if (n > 1) { 1351 count += n - 1; 1352 *addrpp = xtables_realloc(*addrpp, 1353 sizeof(struct in_addr) * count); 1354 *maskpp = xtables_realloc(*maskpp, 1355 sizeof(struct in_addr) * count); 1356 for (j = 0; j < n; ++j) 1357 /* for each new addr */ 1358 memcpy(*addrpp + i + j, addrp + j, 1359 sizeof(*addrp)); 1360 for (j = 1; j < n; ++j) 1361 /* for each new mask */ 1362 memcpy(*maskpp + i + j, *maskpp + i, 1363 sizeof(*addrp)); 1364 i += n - 1; 1365 } else { 1366 memcpy(*addrpp + i, addrp, sizeof(*addrp)); 1367 } 1368 /* free what ipparse_hostnetwork had allocated: */ 1369 free(addrp); 1370 if (next == NULL) 1371 break; 1372 loop = next + 1; 1373 } 1374 *naddrs = count; 1375 for (i = 0; i < count; ++i) 1376 (*addrpp+i)->s_addr &= (*maskpp+i)->s_addr; 1377} 1378 1379 1380/** 1381 * xtables_ipparse_any - transform arbitrary name to in_addr 1382 * 1383 * Possible inputs (pseudo regex): 1384 * m{^($hostname|$networkname|$ipaddr)(/$mask)?} 1385 * "1.2.3.4/5", "1.2.3.4", "hostname", "networkname" 1386 */ 1387void xtables_ipparse_any(const char *name, struct in_addr **addrpp, 1388 struct in_addr *maskp, unsigned int *naddrs) 1389{ 1390 unsigned int i, j, k, n; 1391 struct in_addr *addrp; 1392 char buf[256], *p; 1393 1394 strncpy(buf, name, sizeof(buf) - 1); 1395 buf[sizeof(buf) - 1] = '\0'; 1396 if ((p = strrchr(buf, '/')) != NULL) { 1397 *p = '\0'; 1398 addrp = parse_ipmask(p + 1); 1399 } else { 1400 addrp = parse_ipmask(NULL); 1401 } 1402 memcpy(maskp, addrp, sizeof(*maskp)); 1403 1404 /* if a null mask is given, the name is ignored, like in "any/0" */ 1405 if (maskp->s_addr == 0U) 1406 strcpy(buf, "0.0.0.0"); 1407 1408 addrp = *addrpp = ipparse_hostnetwork(buf, naddrs); 1409 n = *naddrs; 1410 for (i = 0, j = 0; i < n; ++i) { 1411 addrp[j++].s_addr &= maskp->s_addr; 1412 for (k = 0; k < j - 1; ++k) 1413 if (addrp[k].s_addr == addrp[j-1].s_addr) { 1414 /* 1415 * Nuke the dup by copying an address from the 1416 * tail here, and check the current position 1417 * again (--j). 1418 */ 1419 memcpy(&addrp[--j], &addrp[--*naddrs], 1420 sizeof(struct in_addr)); 1421 break; 1422 } 1423 } 1424} 1425 1426const char *xtables_ip6addr_to_numeric(const struct in6_addr *addrp) 1427{ 1428 /* 0000:0000:0000:0000:0000:0000:000.000.000.000 1429 * 0000:0000:0000:0000:0000:0000:0000:0000 */ 1430 static char buf[50+1]; 1431 return inet_ntop(AF_INET6, addrp, buf, sizeof(buf)); 1432} 1433 1434static const char *ip6addr_to_host(const struct in6_addr *addr) 1435{ 1436 static char hostname[NI_MAXHOST]; 1437 struct sockaddr_in6 saddr; 1438 int err; 1439 1440 memset(&saddr, 0, sizeof(struct sockaddr_in6)); 1441 memcpy(&saddr.sin6_addr, addr, sizeof(*addr)); 1442 saddr.sin6_family = AF_INET6; 1443 1444 err = getnameinfo((const void *)&saddr, sizeof(struct sockaddr_in6), 1445 hostname, sizeof(hostname) - 1, NULL, 0, 0); 1446 if (err != 0) { 1447#ifdef DEBUG 1448 fprintf(stderr,"IP2Name: %s\n",gai_strerror(err)); 1449#endif 1450 return NULL; 1451 } 1452 1453#ifdef DEBUG 1454 fprintf (stderr, "\naddr2host: %s\n", hostname); 1455#endif 1456 return hostname; 1457} 1458 1459const char *xtables_ip6addr_to_anyname(const struct in6_addr *addr) 1460{ 1461 const char *name; 1462 1463 if ((name = ip6addr_to_host(addr)) != NULL) 1464 return name; 1465 1466 return xtables_ip6addr_to_numeric(addr); 1467} 1468 1469static int ip6addr_prefix_length(const struct in6_addr *k) 1470{ 1471 unsigned int bits = 0; 1472 uint32_t a, b, c, d; 1473 1474 a = ntohl(k->s6_addr32[0]); 1475 b = ntohl(k->s6_addr32[1]); 1476 c = ntohl(k->s6_addr32[2]); 1477 d = ntohl(k->s6_addr32[3]); 1478 while (a & 0x80000000U) { 1479 ++bits; 1480 a <<= 1; 1481 a |= (b >> 31) & 1; 1482 b <<= 1; 1483 b |= (c >> 31) & 1; 1484 c <<= 1; 1485 c |= (d >> 31) & 1; 1486 d <<= 1; 1487 } 1488 if (a != 0 || b != 0 || c != 0 || d != 0) 1489 return -1; 1490 return bits; 1491} 1492 1493const char *xtables_ip6mask_to_numeric(const struct in6_addr *addrp) 1494{ 1495 static char buf[50+2]; 1496 int l = ip6addr_prefix_length(addrp); 1497 1498 if (l == -1) { 1499 strcpy(buf, "/"); 1500 strcat(buf, xtables_ip6addr_to_numeric(addrp)); 1501 return buf; 1502 } 1503 sprintf(buf, "/%d", l); 1504 return buf; 1505} 1506 1507struct in6_addr *xtables_numeric_to_ip6addr(const char *num) 1508{ 1509 static struct in6_addr ap; 1510 int err; 1511 1512 if ((err = inet_pton(AF_INET6, num, &ap)) == 1) 1513 return ≈ 1514#ifdef DEBUG 1515 fprintf(stderr, "\nnumeric2addr: %d\n", err); 1516#endif 1517 return NULL; 1518} 1519 1520static struct in6_addr * 1521host_to_ip6addr(const char *name, unsigned int *naddr) 1522{ 1523 struct in6_addr *addr; 1524 struct addrinfo hints; 1525 struct addrinfo *res, *p; 1526 int err; 1527 unsigned int i; 1528 1529 memset(&hints, 0, sizeof(hints)); 1530 hints.ai_flags = AI_CANONNAME; 1531 hints.ai_family = AF_INET6; 1532 hints.ai_socktype = SOCK_RAW; 1533 1534 *naddr = 0; 1535 if ((err = getaddrinfo(name, NULL, &hints, &res)) != 0) { 1536#ifdef DEBUG 1537 fprintf(stderr,"Name2IP: %s\n",gai_strerror(err)); 1538#endif 1539 return NULL; 1540 } else { 1541 /* Find length of address chain */ 1542 for (p = res; p != NULL; p = p->ai_next) 1543 ++*naddr; 1544#ifdef DEBUG 1545 fprintf(stderr, "resolved: len=%d %s ", res->ai_addrlen, 1546 xtables_ip6addr_to_numeric(&((struct sockaddr_in6 *)res->ai_addr)->sin6_addr)); 1547#endif 1548 /* Copy each element of the address chain */ 1549 addr = xtables_calloc(*naddr, sizeof(struct in6_addr)); 1550 for (i = 0, p = res; p != NULL; p = p->ai_next) 1551 memcpy(&addr[i++], 1552 &((const struct sockaddr_in6 *)p->ai_addr)->sin6_addr, 1553 sizeof(struct in6_addr)); 1554 freeaddrinfo(res); 1555 return addr; 1556 } 1557 1558 return NULL; 1559} 1560 1561static struct in6_addr *network_to_ip6addr(const char *name) 1562{ 1563 /* abort();*/ 1564 /* TODO: not implemented yet, but the exception breaks the 1565 * name resolvation */ 1566 return NULL; 1567} 1568 1569static struct in6_addr * 1570ip6parse_hostnetwork(const char *name, unsigned int *naddrs) 1571{ 1572 struct in6_addr *addrp, *addrptmp; 1573 1574 if ((addrptmp = xtables_numeric_to_ip6addr(name)) != NULL || 1575 (addrptmp = network_to_ip6addr(name)) != NULL) { 1576 addrp = xtables_malloc(sizeof(struct in6_addr)); 1577 memcpy(addrp, addrptmp, sizeof(*addrp)); 1578 *naddrs = 1; 1579 return addrp; 1580 } 1581 if ((addrp = host_to_ip6addr(name, naddrs)) != NULL) 1582 return addrp; 1583 1584 xt_params->exit_err(PARAMETER_PROBLEM, "host/network `%s' not found", name); 1585} 1586 1587static struct in6_addr *parse_ip6mask(char *mask) 1588{ 1589 static struct in6_addr maskaddr; 1590 struct in6_addr *addrp; 1591 unsigned int bits; 1592 1593 if (mask == NULL) { 1594 /* no mask at all defaults to 128 bits */ 1595 memset(&maskaddr, 0xff, sizeof maskaddr); 1596 return &maskaddr; 1597 } 1598 if ((addrp = xtables_numeric_to_ip6addr(mask)) != NULL) 1599 return addrp; 1600 if (!xtables_strtoui(mask, NULL, &bits, 0, 128)) 1601 xt_params->exit_err(PARAMETER_PROBLEM, 1602 "invalid mask `%s' specified", mask); 1603 if (bits != 0) { 1604 char *p = (void *)&maskaddr; 1605 memset(p, 0xff, bits / 8); 1606 memset(p + (bits / 8) + 1, 0, (128 - bits) / 8); 1607 p[bits/8] = 0xff << (8 - (bits & 7)); 1608 return &maskaddr; 1609 } 1610 1611 memset(&maskaddr, 0, sizeof(maskaddr)); 1612 return &maskaddr; 1613} 1614 1615void 1616xtables_ip6parse_multiple(const char *name, struct in6_addr **addrpp, 1617 struct in6_addr **maskpp, unsigned int *naddrs) 1618{ 1619 static const struct in6_addr zero_addr; 1620 struct in6_addr *addrp; 1621 char buf[256], *p, *next; 1622 unsigned int len, i, j, n, count = 1; 1623 const char *loop = name; 1624 1625 while ((loop = strchr(loop, ',')) != NULL) { 1626 ++count; 1627 ++loop; /* skip ',' */ 1628 } 1629 1630 *addrpp = xtables_malloc(sizeof(struct in6_addr) * count); 1631 *maskpp = xtables_malloc(sizeof(struct in6_addr) * count); 1632 1633 loop = name; 1634 1635 for (i = 0; i < count /*NB: count can grow*/; ++i) { 1636 while (isspace(*loop)) 1637 ++loop; 1638 next = strchr(loop, ','); 1639 if (next != NULL) 1640 len = next - loop; 1641 else 1642 len = strlen(loop); 1643 if (len > sizeof(buf) - 1) 1644 xt_params->exit_err(PARAMETER_PROBLEM, 1645 "Hostname too long"); 1646 1647 strncpy(buf, loop, len); 1648 buf[len] = '\0'; 1649 if ((p = strrchr(buf, '/')) != NULL) { 1650 *p = '\0'; 1651 addrp = parse_ip6mask(p + 1); 1652 } else { 1653 addrp = parse_ip6mask(NULL); 1654 } 1655 memcpy(*maskpp + i, addrp, sizeof(*addrp)); 1656 1657 /* if a null mask is given, the name is ignored, like in "any/0" */ 1658 if (memcmp(*maskpp + i, &zero_addr, sizeof(zero_addr)) == 0) 1659 strcpy(buf, "::"); 1660 1661 addrp = ip6parse_hostnetwork(buf, &n); 1662 if (n > 1) { 1663 count += n - 1; 1664 *addrpp = xtables_realloc(*addrpp, 1665 sizeof(struct in6_addr) * count); 1666 *maskpp = xtables_realloc(*maskpp, 1667 sizeof(struct in6_addr) * count); 1668 for (j = 0; j < n; ++j) 1669 /* for each new addr */ 1670 memcpy(*addrpp + i + j, addrp + j, 1671 sizeof(*addrp)); 1672 for (j = 1; j < n; ++j) 1673 /* for each new mask */ 1674 memcpy(*maskpp + i + j, *maskpp + i, 1675 sizeof(*addrp)); 1676 i += n - 1; 1677 } else { 1678 memcpy(*addrpp + i, addrp, sizeof(*addrp)); 1679 } 1680 /* free what ip6parse_hostnetwork had allocated: */ 1681 free(addrp); 1682 if (next == NULL) 1683 break; 1684 loop = next + 1; 1685 } 1686 *naddrs = count; 1687 for (i = 0; i < count; ++i) 1688 for (j = 0; j < 4; ++j) 1689 (*addrpp+i)->s6_addr32[j] &= (*maskpp+i)->s6_addr32[j]; 1690} 1691 1692void xtables_ip6parse_any(const char *name, struct in6_addr **addrpp, 1693 struct in6_addr *maskp, unsigned int *naddrs) 1694{ 1695 static const struct in6_addr zero_addr; 1696 struct in6_addr *addrp; 1697 unsigned int i, j, k, n; 1698 char buf[256], *p; 1699 1700 strncpy(buf, name, sizeof(buf) - 1); 1701 buf[sizeof(buf)-1] = '\0'; 1702 if ((p = strrchr(buf, '/')) != NULL) { 1703 *p = '\0'; 1704 addrp = parse_ip6mask(p + 1); 1705 } else { 1706 addrp = parse_ip6mask(NULL); 1707 } 1708 memcpy(maskp, addrp, sizeof(*maskp)); 1709 1710 /* if a null mask is given, the name is ignored, like in "any/0" */ 1711 if (memcmp(maskp, &zero_addr, sizeof(zero_addr)) == 0) 1712 strcpy(buf, "::"); 1713 1714 addrp = *addrpp = ip6parse_hostnetwork(buf, naddrs); 1715 n = *naddrs; 1716 for (i = 0, j = 0; i < n; ++i) { 1717 for (k = 0; k < 4; ++k) 1718 addrp[j].s6_addr32[k] &= maskp->s6_addr32[k]; 1719 ++j; 1720 for (k = 0; k < j - 1; ++k) 1721 if (IN6_ARE_ADDR_EQUAL(&addrp[k], &addrp[j - 1])) { 1722 /* 1723 * Nuke the dup by copying an address from the 1724 * tail here, and check the current position 1725 * again (--j). 1726 */ 1727 memcpy(&addrp[--j], &addrp[--*naddrs], 1728 sizeof(struct in_addr)); 1729 break; 1730 } 1731 } 1732} 1733 1734void xtables_save_string(const char *value) 1735{ 1736 static const char no_quote_chars[] = "_-0123456789" 1737 "abcdefghijklmnopqrstuvwxyz" 1738 "ABCDEFGHIJKLMNOPQRSTUVWXYZ"; 1739 static const char escape_chars[] = "\"\\'"; 1740 size_t length; 1741 const char *p; 1742 1743 length = strspn(value, no_quote_chars); 1744 if (length > 0 && value[length] == 0) { 1745 /* no quoting required */ 1746 putchar(' '); 1747 fputs(value, stdout); 1748 } else { 1749 /* there is at least one dangerous character in the 1750 value, which we have to quote. Write double quotes 1751 around the value and escape special characters with 1752 a backslash */ 1753 printf(" \""); 1754 1755 for (p = strpbrk(value, escape_chars); p != NULL; 1756 p = strpbrk(value, escape_chars)) { 1757 if (p > value) 1758 fwrite(value, 1, p - value, stdout); 1759 putchar('\\'); 1760 putchar(*p); 1761 value = p + 1; 1762 } 1763 1764 /* print the rest and finish the double quoted 1765 string */ 1766 fputs(value, stdout); 1767 putchar('\"'); 1768 } 1769} 1770 1771const struct xtables_pprot xtables_chain_protos[] = { 1772 {"tcp", IPPROTO_TCP}, 1773 {"sctp", IPPROTO_SCTP}, 1774 {"udp", IPPROTO_UDP}, 1775 {"udplite", IPPROTO_UDPLITE}, 1776 {"icmp", IPPROTO_ICMP}, 1777 {"icmpv6", IPPROTO_ICMPV6}, 1778 {"ipv6-icmp", IPPROTO_ICMPV6}, 1779 {"esp", IPPROTO_ESP}, 1780 {"ah", IPPROTO_AH}, 1781 {"ipv6-mh", IPPROTO_MH}, 1782 {"mh", IPPROTO_MH}, 1783 {"all", 0}, 1784 {NULL}, 1785}; 1786 1787uint16_t 1788xtables_parse_protocol(const char *s) 1789{ 1790 const struct protoent *pent; 1791 unsigned int proto, i; 1792 1793 if (xtables_strtoui(s, NULL, &proto, 0, UINT8_MAX)) 1794 return proto; 1795 1796 /* first deal with the special case of 'all' to prevent 1797 * people from being able to redefine 'all' in nsswitch 1798 * and/or provoke expensive [not working] ldap/nis/... 1799 * lookups */ 1800 if (strcmp(s, "all") == 0) 1801 return 0; 1802 1803 pent = getprotobyname(s); 1804 if (pent != NULL) 1805 return pent->p_proto; 1806 1807 for (i = 0; i < ARRAY_SIZE(xtables_chain_protos); ++i) { 1808 if (xtables_chain_protos[i].name == NULL) 1809 continue; 1810 if (strcmp(s, xtables_chain_protos[i].name) == 0) 1811 return xtables_chain_protos[i].num; 1812 } 1813 xt_params->exit_err(PARAMETER_PROBLEM, 1814 "unknown protocol \"%s\" specified", s); 1815 return -1; 1816} 1817