xtables.c revision 8b7baebc93989106fd5d26b262d0ce191f8ef7c0
14b562cf889bc59e1914dd2c5d9fbd7e7bfa1ad77Argyrios Kyrtzidis/* 24b562cf889bc59e1914dd2c5d9fbd7e7bfa1ad77Argyrios Kyrtzidis * (C) 2000-2006 by the netfilter coreteam <coreteam@netfilter.org>: 34b562cf889bc59e1914dd2c5d9fbd7e7bfa1ad77Argyrios Kyrtzidis * 44b562cf889bc59e1914dd2c5d9fbd7e7bfa1ad77Argyrios Kyrtzidis * This program is free software; you can redistribute it and/or modify 54b562cf889bc59e1914dd2c5d9fbd7e7bfa1ad77Argyrios Kyrtzidis * it under the terms of the GNU General Public License as published by 64b562cf889bc59e1914dd2c5d9fbd7e7bfa1ad77Argyrios Kyrtzidis * the Free Software Foundation; either version 2 of the License, or 74b562cf889bc59e1914dd2c5d9fbd7e7bfa1ad77Argyrios Kyrtzidis * (at your option) any later version. 84b562cf889bc59e1914dd2c5d9fbd7e7bfa1ad77Argyrios Kyrtzidis * 94b562cf889bc59e1914dd2c5d9fbd7e7bfa1ad77Argyrios Kyrtzidis * This program is distributed in the hope that it will be useful, 104b562cf889bc59e1914dd2c5d9fbd7e7bfa1ad77Argyrios Kyrtzidis * but WITHOUT ANY WARRANTY; without even the implied warranty of 114b562cf889bc59e1914dd2c5d9fbd7e7bfa1ad77Argyrios Kyrtzidis * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 124b562cf889bc59e1914dd2c5d9fbd7e7bfa1ad77Argyrios Kyrtzidis * GNU General Public License for more details. 134b562cf889bc59e1914dd2c5d9fbd7e7bfa1ad77Argyrios Kyrtzidis * 140853a02c3b04d96a3c432b883e403175c954cd81Argyrios Kyrtzidis * You should have received a copy of the GNU General Public License 150853a02c3b04d96a3c432b883e403175c954cd81Argyrios Kyrtzidis * along with this program; if not, write to the Free Software 160853a02c3b04d96a3c432b883e403175c954cd81Argyrios Kyrtzidis * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. 17eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregor */ 18eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregor 194ae8f298b1ea51b4c2234f9148e2e4349c9bdd23Douglas Gregor#include <errno.h> 2031b87d8006d4863dd9b17e515ac720941efc38e3Daniel Dunbar#include <fcntl.h> 21eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregor#include <netdb.h> 2228019772db70d4547be05a042eb950bc910f134fDouglas Gregor#include <stdarg.h> 230853a02c3b04d96a3c432b883e403175c954cd81Argyrios Kyrtzidis#include <stdbool.h> 24a88084b78fd4ca5d3d858c14b02414f8cc399f02Douglas Gregor#include <stdio.h> 25cc5888d833caf90ebda37f24da40d2cd06b4d820Douglas Gregor#include <stdlib.h> 26313e26c4e81f0e467490a530548450f4c824a6c4Douglas Gregor#include <string.h> 27385103b79c5338a2be5da0ca70652400bc267371Douglas Gregor#include <unistd.h> 28788f5a1242c04762f91eaa7565c07b9865846d88Douglas Gregor#include <sys/socket.h> 290853a02c3b04d96a3c432b883e403175c954cd81Argyrios Kyrtzidis#include <sys/stat.h> 30f772d1e2a5688572d07f42896a50ac57a4a41fe8Daniel Dunbar#include <sys/types.h> 31f772d1e2a5688572d07f42896a50ac57a4a41fe8Daniel Dunbar#include <sys/wait.h> 324db64a461cb3442934afe43c83ed3f17f7c11c1dDouglas Gregor#include <arpa/inet.h> 33cc5888d833caf90ebda37f24da40d2cd06b4d820Douglas Gregor 344db64a461cb3442934afe43c83ed3f17f7c11c1dDouglas Gregor#include <xtables.h> 354db64a461cb3442934afe43c83ed3f17f7c11c1dDouglas Gregor#include <linux/netfilter_ipv4/ip_tables.h> 364db64a461cb3442934afe43c83ed3f17f7c11c1dDouglas Gregor#include <linux/netfilter_ipv6/ip6_tables.h> 374db64a461cb3442934afe43c83ed3f17f7c11c1dDouglas Gregor#include <libiptc/libxtc.h> 380853a02c3b04d96a3c432b883e403175c954cd81Argyrios Kyrtzidis 390853a02c3b04d96a3c432b883e403175c954cd81Argyrios Kyrtzidis#ifndef NO_SHARED_LIBS 40521bf9c529e653ab28896d027352d3e16e2672d5Daniel Dunbar#include <dlfcn.h> 41521bf9c529e653ab28896d027352d3e16e2672d5Daniel Dunbar#endif 42521bf9c529e653ab28896d027352d3e16e2672d5Daniel Dunbar 43521bf9c529e653ab28896d027352d3e16e2672d5Daniel Dunbar#define NPROTO 255 44521bf9c529e653ab28896d027352d3e16e2672d5Daniel Dunbar 45521bf9c529e653ab28896d027352d3e16e2672d5Daniel Dunbar#ifndef PROC_SYS_MODPROBE 46521bf9c529e653ab28896d027352d3e16e2672d5Daniel Dunbar#define PROC_SYS_MODPROBE "/proc/sys/kernel/modprobe" 47521bf9c529e653ab28896d027352d3e16e2672d5Daniel Dunbar#endif 48521bf9c529e653ab28896d027352d3e16e2672d5Daniel Dunbar 49521bf9c529e653ab28896d027352d3e16e2672d5Daniel Dunbarvoid basic_exit_err(enum xtables_exittype status, const char *msg, ...) __attribute__((noreturn, format(printf,2,3))); 500853a02c3b04d96a3c432b883e403175c954cd81Argyrios Kyrtzidis 51f96b524306ccfa623235d375deee79637bd38f29Steve Naroffstruct xtables_globals *xt_params = NULL; 5244c181aec37789f25f6c15543c164416f72e562aDouglas Gregor 530853a02c3b04d96a3c432b883e403175c954cd81Argyrios Kyrtzidisvoid basic_exit_err(enum xtables_exittype status, const char *msg, ...) 540853a02c3b04d96a3c432b883e403175c954cd81Argyrios Kyrtzidis{ 550853a02c3b04d96a3c432b883e403175c954cd81Argyrios Kyrtzidis va_list args; 56788f5a1242c04762f91eaa7565c07b9865846d88Douglas Gregor 57788f5a1242c04762f91eaa7565c07b9865846d88Douglas Gregor va_start(args, msg); 58788f5a1242c04762f91eaa7565c07b9865846d88Douglas Gregor fprintf(stderr, "%s v%s: ", xt_params->program_name, xt_params->program_version); 59788f5a1242c04762f91eaa7565c07b9865846d88Douglas Gregor vfprintf(stderr, msg, args); 6028019772db70d4547be05a042eb950bc910f134fDouglas Gregor va_end(args); 61405634b215f19eec7183bd8005e34aa5a02f64a1Douglas Gregor fprintf(stderr, "\n"); 62405634b215f19eec7183bd8005e34aa5a02f64a1Douglas Gregor exit(status); 630853a02c3b04d96a3c432b883e403175c954cd81Argyrios Kyrtzidis} 640853a02c3b04d96a3c432b883e403175c954cd81Argyrios Kyrtzidis 650853a02c3b04d96a3c432b883e403175c954cd81Argyrios Kyrtzidis 660853a02c3b04d96a3c432b883e403175c954cd81Argyrios Kyrtzidis/** 674ae8f298b1ea51b4c2234f9148e2e4349c9bdd23Douglas Gregor * xtables_set_params - set the global parameters used by xtables 68807b06157a1a5c050520fc194d32f16d22d423a8Daniel Dunbar * @xtp: input xtables_globals structure 69807b06157a1a5c050520fc194d32f16d22d423a8Daniel Dunbar * 70807b06157a1a5c050520fc194d32f16d22d423a8Daniel Dunbar * The app is expected to pass a valid xtables_globals data-filled 71807b06157a1a5c050520fc194d32f16d22d423a8Daniel Dunbar * with proper values 727d1d49d2971b20a97b3c2a301470b9eaaa130137Douglas Gregor * @xtp cannot be NULL 737d1d49d2971b20a97b3c2a301470b9eaaa130137Douglas Gregor * 747d1d49d2971b20a97b3c2a301470b9eaaa130137Douglas Gregor * Returns -1 on failure to set and 0 on success 757d1d49d2971b20a97b3c2a301470b9eaaa130137Douglas Gregor */ 76c7822dbf3c01a2a5f837cff82ba7889ea755dacaDaniel Dunbarint xtables_set_params(struct xtables_globals *xtp) 77abc563f554951259bbe0315055cad92ee14d87e4Douglas Gregor{ 78abc563f554951259bbe0315055cad92ee14d87e4Douglas Gregor if (!xtp) { 79abc563f554951259bbe0315055cad92ee14d87e4Douglas Gregor fprintf(stderr, "%s: Illegal global params\n",__func__); 80f772d1e2a5688572d07f42896a50ac57a4a41fe8Daniel Dunbar return -1; 81c7822dbf3c01a2a5f837cff82ba7889ea755dacaDaniel Dunbar } 82c7822dbf3c01a2a5f837cff82ba7889ea755dacaDaniel Dunbar 83f772d1e2a5688572d07f42896a50ac57a4a41fe8Daniel Dunbar xt_params = xtp; 84f772d1e2a5688572d07f42896a50ac57a4a41fe8Daniel Dunbar 85f772d1e2a5688572d07f42896a50ac57a4a41fe8Daniel Dunbar if (!xt_params->exit_err) 86f772d1e2a5688572d07f42896a50ac57a4a41fe8Daniel Dunbar xt_params->exit_err = basic_exit_err; 87f772d1e2a5688572d07f42896a50ac57a4a41fe8Daniel Dunbar 88f772d1e2a5688572d07f42896a50ac57a4a41fe8Daniel Dunbar return 0; 89f772d1e2a5688572d07f42896a50ac57a4a41fe8Daniel Dunbar} 90f772d1e2a5688572d07f42896a50ac57a4a41fe8Daniel Dunbar 91f772d1e2a5688572d07f42896a50ac57a4a41fe8Daniel Dunbarvoid xtables_free_opts(int reset_offset, struct option *original_opts) 9268d40e2d16b9fadba386853d6bbb60089291fdc5Daniel Dunbar{ 9368d40e2d16b9fadba386853d6bbb60089291fdc5Daniel Dunbar if (xt_params->opts != original_opts) { 9468d40e2d16b9fadba386853d6bbb60089291fdc5Daniel Dunbar if (original_opts) 95f96b524306ccfa623235d375deee79637bd38f29Steve Naroff free(xt_params->opts); 96f96b524306ccfa623235d375deee79637bd38f29Steve Naroff xt_params->opts = original_opts; 97f772d1e2a5688572d07f42896a50ac57a4a41fe8Daniel Dunbar if (reset_offset) 98a88084b78fd4ca5d3d858c14b02414f8cc399f02Douglas Gregor xt_params->option_offset = 0; 99a88084b78fd4ca5d3d858c14b02414f8cc399f02Douglas Gregor } 100405634b215f19eec7183bd8005e34aa5a02f64a1Douglas Gregor} 101a88084b78fd4ca5d3d858c14b02414f8cc399f02Douglas Gregor 102313e26c4e81f0e467490a530548450f4c824a6c4Douglas Gregor/** 103313e26c4e81f0e467490a530548450f4c824a6c4Douglas Gregor * xtables_afinfo - protocol family dependent information 104313e26c4e81f0e467490a530548450f4c824a6c4Douglas Gregor * @kmod: kernel module basename (e.g. "ip_tables") 105bdf6062bc10aa3b73b16402b440b8073310acd06Douglas Gregor * @libprefix: prefix of .so library name (e.g. "libipt_") 106788f5a1242c04762f91eaa7565c07b9865846d88Douglas Gregor * @family: nfproto family 107788f5a1242c04762f91eaa7565c07b9865846d88Douglas Gregor * @ipproto: used by setsockopt (e.g. IPPROTO_IP) 108788f5a1242c04762f91eaa7565c07b9865846d88Douglas Gregor * @so_rev_match: optname to check revision support of match 109788f5a1242c04762f91eaa7565c07b9865846d88Douglas Gregor * @so_rev_target: optname to check revision support of target 110788f5a1242c04762f91eaa7565c07b9865846d88Douglas Gregor */ 111788f5a1242c04762f91eaa7565c07b9865846d88Douglas Gregorstruct xtables_afinfo { 112788f5a1242c04762f91eaa7565c07b9865846d88Douglas Gregor const char *kmod; 113788f5a1242c04762f91eaa7565c07b9865846d88Douglas Gregor const char *libprefix; 114788f5a1242c04762f91eaa7565c07b9865846d88Douglas Gregor uint8_t family; 115bdf6062bc10aa3b73b16402b440b8073310acd06Douglas Gregor uint8_t ipproto; 116bdf6062bc10aa3b73b16402b440b8073310acd06Douglas Gregor int so_rev_match; 117bdf6062bc10aa3b73b16402b440b8073310acd06Douglas Gregor int so_rev_target; 118bdf6062bc10aa3b73b16402b440b8073310acd06Douglas Gregor}; 119bdf6062bc10aa3b73b16402b440b8073310acd06Douglas Gregor 120bdf6062bc10aa3b73b16402b440b8073310acd06Douglas Gregorstatic const struct xtables_afinfo afinfo_ipv4 = { 121bdf6062bc10aa3b73b16402b440b8073310acd06Douglas Gregor .kmod = "ip_tables", 122bdf6062bc10aa3b73b16402b440b8073310acd06Douglas Gregor .libprefix = "libipt_", 123bdf6062bc10aa3b73b16402b440b8073310acd06Douglas Gregor .family = NFPROTO_IPV4, 124175c4a9aa61f4449f27b729737e4438684ac6d92Douglas Gregor .ipproto = IPPROTO_IP, 125175c4a9aa61f4449f27b729737e4438684ac6d92Douglas Gregor .so_rev_match = IPT_SO_GET_REVISION_MATCH, 126385103b79c5338a2be5da0ca70652400bc267371Douglas Gregor .so_rev_target = IPT_SO_GET_REVISION_TARGET, 127175c4a9aa61f4449f27b729737e4438684ac6d92Douglas Gregor}; 128175c4a9aa61f4449f27b729737e4438684ac6d92Douglas Gregor 129175c4a9aa61f4449f27b729737e4438684ac6d92Douglas Gregorstatic const struct xtables_afinfo afinfo_ipv6 = { 130175c4a9aa61f4449f27b729737e4438684ac6d92Douglas Gregor .kmod = "ip6_tables", 131175c4a9aa61f4449f27b729737e4438684ac6d92Douglas Gregor .libprefix = "libip6t_", 132f4f6c9db68465b886ec2e596feaa6ecc782395a4Douglas Gregor .family = NFPROTO_IPV6, 133f4f6c9db68465b886ec2e596feaa6ecc782395a4Douglas Gregor .ipproto = IPPROTO_IPV6, 134f4f6c9db68465b886ec2e596feaa6ecc782395a4Douglas Gregor .so_rev_match = IP6T_SO_GET_REVISION_MATCH, 135f4f6c9db68465b886ec2e596feaa6ecc782395a4Douglas Gregor .so_rev_target = IP6T_SO_GET_REVISION_TARGET, 136f4f6c9db68465b886ec2e596feaa6ecc782395a4Douglas Gregor}; 137f4f6c9db68465b886ec2e596feaa6ecc782395a4Douglas Gregor 138175c4a9aa61f4449f27b729737e4438684ac6d92Douglas Gregorstatic const struct xtables_afinfo *afinfo; 139175c4a9aa61f4449f27b729737e4438684ac6d92Douglas Gregor 140175c4a9aa61f4449f27b729737e4438684ac6d92Douglas Gregor/** 141cc5888d833caf90ebda37f24da40d2cd06b4d820Douglas Gregor * Program will set this to its own name. 142cc5888d833caf90ebda37f24da40d2cd06b4d820Douglas Gregor */ 143cc5888d833caf90ebda37f24da40d2cd06b4d820Douglas Gregorconst char *xtables_program_name; 144cc5888d833caf90ebda37f24da40d2cd06b4d820Douglas Gregor 145cc5888d833caf90ebda37f24da40d2cd06b4d820Douglas Gregor/* Search path for Xtables .so files */ 146cc5888d833caf90ebda37f24da40d2cd06b4d820Douglas Gregorstatic const char *xtables_libdir; 147cc5888d833caf90ebda37f24da40d2cd06b4d820Douglas Gregor 148cc5888d833caf90ebda37f24da40d2cd06b4d820Douglas Gregor/* the path to command to load kernel module */ 14928233428da1ebec20c893d6297ae3191318940ddDouglas Gregorconst char *xtables_modprobe_program; 15028233428da1ebec20c893d6297ae3191318940ddDouglas Gregor 15128233428da1ebec20c893d6297ae3191318940ddDouglas Gregor/* Keeping track of external matches and targets: linked lists. */ 15228233428da1ebec20c893d6297ae3191318940ddDouglas Gregorstruct xtables_match *xtables_matches; 153c0659ec614c428c7d15746fcad15d50a2703751dDouglas Gregorstruct xtables_target *xtables_targets; 154c0659ec614c428c7d15746fcad15d50a2703751dDouglas Gregor 155c0659ec614c428c7d15746fcad15d50a2703751dDouglas Gregorvoid xtables_init(void) 156c0659ec614c428c7d15746fcad15d50a2703751dDouglas Gregor{ 157c0659ec614c428c7d15746fcad15d50a2703751dDouglas Gregor xtables_libdir = getenv("XTABLES_LIBDIR"); 158c0659ec614c428c7d15746fcad15d50a2703751dDouglas Gregor if (xtables_libdir != NULL) 159c0659ec614c428c7d15746fcad15d50a2703751dDouglas Gregor return; 160c0659ec614c428c7d15746fcad15d50a2703751dDouglas Gregor xtables_libdir = getenv("IPTABLES_LIB_DIR"); 161c0659ec614c428c7d15746fcad15d50a2703751dDouglas Gregor if (xtables_libdir != NULL) { 162c0659ec614c428c7d15746fcad15d50a2703751dDouglas Gregor fprintf(stderr, "IPTABLES_LIB_DIR is deprecated, " 163c0659ec614c428c7d15746fcad15d50a2703751dDouglas Gregor "use XTABLES_LIBDIR.\n"); 164c0659ec614c428c7d15746fcad15d50a2703751dDouglas Gregor return; 165c0659ec614c428c7d15746fcad15d50a2703751dDouglas Gregor } 166c0659ec614c428c7d15746fcad15d50a2703751dDouglas Gregor xtables_libdir = XTABLES_LIBDIR; 167c0659ec614c428c7d15746fcad15d50a2703751dDouglas Gregor} 168c0659ec614c428c7d15746fcad15d50a2703751dDouglas Gregor 169c0659ec614c428c7d15746fcad15d50a2703751dDouglas Gregorvoid xtables_set_nfproto(uint8_t nfproto) 170385103b79c5338a2be5da0ca70652400bc267371Douglas Gregor{ 171cc5888d833caf90ebda37f24da40d2cd06b4d820Douglas Gregor switch (nfproto) { 172eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregor case NFPROTO_IPV4: 173eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregor afinfo = &afinfo_ipv4; 174eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregor break; 175eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregor case NFPROTO_IPV6: 176eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregor afinfo = &afinfo_ipv6; 177385103b79c5338a2be5da0ca70652400bc267371Douglas Gregor break; 178385103b79c5338a2be5da0ca70652400bc267371Douglas Gregor default: 179385103b79c5338a2be5da0ca70652400bc267371Douglas Gregor fprintf(stderr, "libxtables: unhandled NFPROTO in %s\n", 180385103b79c5338a2be5da0ca70652400bc267371Douglas Gregor __func__); 18131b87d8006d4863dd9b17e515ac720941efc38e3Daniel Dunbar } 18231b87d8006d4863dd9b17e515ac720941efc38e3Daniel Dunbar} 183bdf6062bc10aa3b73b16402b440b8073310acd06Douglas Gregor 1843687e9d3a5dbfa9963af02a49a2b139d91310813Douglas Gregor/** 1858b96253907c47141af0b7b2a44a368748d006a87Douglas Gregor * xtables_*alloc - wrappers that exit on failure 186abc563f554951259bbe0315055cad92ee14d87e4Douglas Gregor */ 187754f3490c5b0f5d83361f001bc87944f23644abbDouglas Gregorvoid *xtables_calloc(size_t count, size_t size) 188175c4a9aa61f4449f27b729737e4438684ac6d92Douglas Gregor{ 189f4f6c9db68465b886ec2e596feaa6ecc782395a4Douglas Gregor void *p; 190f4f6c9db68465b886ec2e596feaa6ecc782395a4Douglas Gregor 191175c4a9aa61f4449f27b729737e4438684ac6d92Douglas Gregor if ((p = calloc(count, size)) == NULL) { 192754f3490c5b0f5d83361f001bc87944f23644abbDouglas Gregor perror("ip[6]tables: calloc failed"); 193eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregor exit(1); 194eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregor } 1950853a02c3b04d96a3c432b883e403175c954cd81Argyrios Kyrtzidis 196bdf6062bc10aa3b73b16402b440b8073310acd06Douglas Gregor return p; 197bdf6062bc10aa3b73b16402b440b8073310acd06Douglas Gregor} 198bdf6062bc10aa3b73b16402b440b8073310acd06Douglas Gregor 199bdf6062bc10aa3b73b16402b440b8073310acd06Douglas Gregorvoid *xtables_malloc(size_t size) 200bdf6062bc10aa3b73b16402b440b8073310acd06Douglas Gregor{ 201bdf6062bc10aa3b73b16402b440b8073310acd06Douglas Gregor void *p; 202bdf6062bc10aa3b73b16402b440b8073310acd06Douglas Gregor 203bdf6062bc10aa3b73b16402b440b8073310acd06Douglas Gregor if ((p = malloc(size)) == NULL) { 204bdf6062bc10aa3b73b16402b440b8073310acd06Douglas Gregor perror("ip[6]tables: malloc failed"); 205bdf6062bc10aa3b73b16402b440b8073310acd06Douglas Gregor exit(1); 206bdf6062bc10aa3b73b16402b440b8073310acd06Douglas Gregor } 207bdf6062bc10aa3b73b16402b440b8073310acd06Douglas Gregor 208bdf6062bc10aa3b73b16402b440b8073310acd06Douglas Gregor return p; 209bdf6062bc10aa3b73b16402b440b8073310acd06Douglas Gregor} 210bdf6062bc10aa3b73b16402b440b8073310acd06Douglas Gregor 211bdf6062bc10aa3b73b16402b440b8073310acd06Douglas Gregorstatic char *get_modprobe(void) 212bdf6062bc10aa3b73b16402b440b8073310acd06Douglas Gregor{ 213bdf6062bc10aa3b73b16402b440b8073310acd06Douglas Gregor int procfile; 2140853a02c3b04d96a3c432b883e403175c954cd81Argyrios Kyrtzidis char *ret; 2150853a02c3b04d96a3c432b883e403175c954cd81Argyrios Kyrtzidis 216c7822dbf3c01a2a5f837cff82ba7889ea755dacaDaniel Dunbar#define PROCFILE_BUFSIZ 1024 217c7822dbf3c01a2a5f837cff82ba7889ea755dacaDaniel Dunbar procfile = open(PROC_SYS_MODPROBE, O_RDONLY); 2183687e9d3a5dbfa9963af02a49a2b139d91310813Douglas Gregor if (procfile < 0) 2193687e9d3a5dbfa9963af02a49a2b139d91310813Douglas Gregor return NULL; 2203687e9d3a5dbfa9963af02a49a2b139d91310813Douglas Gregor 221405634b215f19eec7183bd8005e34aa5a02f64a1Douglas Gregor ret = (char *) malloc(PROCFILE_BUFSIZ); 222405634b215f19eec7183bd8005e34aa5a02f64a1Douglas Gregor if (ret) { 2230853a02c3b04d96a3c432b883e403175c954cd81Argyrios Kyrtzidis memset(ret, 0, PROCFILE_BUFSIZ); 2240853a02c3b04d96a3c432b883e403175c954cd81Argyrios Kyrtzidis switch (read(procfile, ret, PROCFILE_BUFSIZ)) { 2250853a02c3b04d96a3c432b883e403175c954cd81Argyrios Kyrtzidis case -1: goto fail; 2261eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump case PROCFILE_BUFSIZ: goto fail; /* Partial read. Wierd */ 2270853a02c3b04d96a3c432b883e403175c954cd81Argyrios Kyrtzidis } 2280853a02c3b04d96a3c432b883e403175c954cd81Argyrios Kyrtzidis if (ret[strlen(ret)-1]=='\n') 2290853a02c3b04d96a3c432b883e403175c954cd81Argyrios Kyrtzidis ret[strlen(ret)-1]=0; 230405634b215f19eec7183bd8005e34aa5a02f64a1Douglas Gregor close(procfile); 231405634b215f19eec7183bd8005e34aa5a02f64a1Douglas Gregor return ret; 232f772d1e2a5688572d07f42896a50ac57a4a41fe8Daniel Dunbar } 23377accc11f04ed4ff9afd4e27d430144d4714be56Steve Naroff fail: 234e19944c93961b7618f4f3f3185f698f46369ea54Steve Naroff free(ret); 235b85bca2676b433ae555db09de4dd2823ff13b856Zhongxing Xu close(procfile); 236313e26c4e81f0e467490a530548450f4c824a6c4Douglas Gregor return NULL; 237313e26c4e81f0e467490a530548450f4c824a6c4Douglas Gregor} 238313e26c4e81f0e467490a530548450f4c824a6c4Douglas Gregor 239313e26c4e81f0e467490a530548450f4c824a6c4Douglas Gregorint xtables_insmod(const char *modname, const char *modprobe, bool quiet) 240313e26c4e81f0e467490a530548450f4c824a6c4Douglas Gregor{ 241313e26c4e81f0e467490a530548450f4c824a6c4Douglas Gregor char *buf = NULL; 242313e26c4e81f0e467490a530548450f4c824a6c4Douglas Gregor char *argv[4]; 2437d1d49d2971b20a97b3c2a301470b9eaaa130137Douglas Gregor int status; 244f772d1e2a5688572d07f42896a50ac57a4a41fe8Daniel Dunbar 245eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregor /* If they don't explicitly set it, read out of kernel */ 246eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregor if (!modprobe) { 247eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregor buf = get_modprobe(); 248eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregor if (!buf) 249f96b524306ccfa623235d375deee79637bd38f29Steve Naroff return -1; 250f96b524306ccfa623235d375deee79637bd38f29Steve Naroff modprobe = buf; 251f772d1e2a5688572d07f42896a50ac57a4a41fe8Daniel Dunbar } 252eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregor 253eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregor switch (fork()) { 254eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregor case 0: 255f772d1e2a5688572d07f42896a50ac57a4a41fe8Daniel Dunbar argv[0] = (char *)modprobe; 256eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregor argv[1] = (char *)modname; 257eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregor if (quiet) { 258eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregor argv[2] = "-q"; 259f772d1e2a5688572d07f42896a50ac57a4a41fe8Daniel Dunbar argv[3] = NULL; 260eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregor } else { 261eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregor argv[2] = NULL; 262f772d1e2a5688572d07f42896a50ac57a4a41fe8Daniel Dunbar argv[3] = NULL; 263eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregor } 264eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregor execv(argv[0], argv); 265eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregor 266eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregor /* not usually reached */ 267eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregor exit(1); 268eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregor case -1: 269eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregor return -1; 270eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregor 271eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregor default: /* parent */ 272eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregor wait(&status); 273eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregor } 274eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregor 275eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregor free(buf); 276eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregor if (WIFEXITED(status) && WEXITSTATUS(status) == 0) 277eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregor return 0; 278eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregor return -1; 279eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregor} 280eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregor 281eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregorint xtables_load_ko(const char *modprobe, bool quiet) 282eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregor{ 283eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregor static bool loaded = false; 284eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregor static int ret = -1; 285eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregor 286eb8837b88c18631c69ac75f64ab1853762063180Douglas Gregor if (!loaded) { 287f772d1e2a5688572d07f42896a50ac57a4a41fe8Daniel Dunbar ret = xtables_insmod(afinfo->kmod, modprobe, quiet); 288f772d1e2a5688572d07f42896a50ac57a4a41fe8Daniel Dunbar loaded = (ret == 0); 289788f5a1242c04762f91eaa7565c07b9865846d88Douglas Gregor } 290788f5a1242c04762f91eaa7565c07b9865846d88Douglas Gregor 291788f5a1242c04762f91eaa7565c07b9865846d88Douglas Gregor return ret; 292788f5a1242c04762f91eaa7565c07b9865846d88Douglas Gregor} 293788f5a1242c04762f91eaa7565c07b9865846d88Douglas Gregor 294788f5a1242c04762f91eaa7565c07b9865846d88Douglas Gregor/** 295a88084b78fd4ca5d3d858c14b02414f8cc399f02Douglas Gregor * xtables_strtou{i,l} - string to number conversion 296405634b215f19eec7183bd8005e34aa5a02f64a1Douglas Gregor * @s: input string 297405634b215f19eec7183bd8005e34aa5a02f64a1Douglas Gregor * @end: like strtoul's "end" pointer 298405634b215f19eec7183bd8005e34aa5a02f64a1Douglas Gregor * @value: pointer for result 299405634b215f19eec7183bd8005e34aa5a02f64a1Douglas Gregor * @min: minimum accepted value 300405634b215f19eec7183bd8005e34aa5a02f64a1Douglas Gregor * @max: maximum accepted value 301405634b215f19eec7183bd8005e34aa5a02f64a1Douglas Gregor * 302405634b215f19eec7183bd8005e34aa5a02f64a1Douglas Gregor * If @end is NULL, we assume the caller wants a "strict strtoul", and hence 303405634b215f19eec7183bd8005e34aa5a02f64a1Douglas Gregor * "15a" is rejected. 304405634b215f19eec7183bd8005e34aa5a02f64a1Douglas Gregor * In either case, the value obtained is compared for min-max compliance. 305405634b215f19eec7183bd8005e34aa5a02f64a1Douglas Gregor * Base is always 0, i.e. autodetect depending on @s. 306405634b215f19eec7183bd8005e34aa5a02f64a1Douglas Gregor * 307a88084b78fd4ca5d3d858c14b02414f8cc399f02Douglas Gregor * Returns true/false whether number was accepted. On failure, *value has 308a88084b78fd4ca5d3d858c14b02414f8cc399f02Douglas Gregor * undefined contents. 3094db64a461cb3442934afe43c83ed3f17f7c11c1dDouglas Gregor */ 3104db64a461cb3442934afe43c83ed3f17f7c11c1dDouglas Gregorbool xtables_strtoul(const char *s, char **end, unsigned long *value, 3114db64a461cb3442934afe43c83ed3f17f7c11c1dDouglas Gregor unsigned long min, unsigned long max) 3124db64a461cb3442934afe43c83ed3f17f7c11c1dDouglas Gregor{ 3130853a02c3b04d96a3c432b883e403175c954cd81Argyrios Kyrtzidis unsigned long v; 3140853a02c3b04d96a3c432b883e403175c954cd81Argyrios Kyrtzidis char *my_end; 31531b87d8006d4863dd9b17e515ac720941efc38e3Daniel Dunbar 3160853a02c3b04d96a3c432b883e403175c954cd81Argyrios Kyrtzidis errno = 0; 3175262fda30b876c8aae95f2eb92e349418d6b14bbDaniel Dunbar v = strtoul(s, &my_end, 0); 3185262fda30b876c8aae95f2eb92e349418d6b14bbDaniel Dunbar 31931b87d8006d4863dd9b17e515ac720941efc38e3Daniel Dunbar if (my_end == s) 32031b87d8006d4863dd9b17e515ac720941efc38e3Daniel Dunbar return false; 3210853a02c3b04d96a3c432b883e403175c954cd81Argyrios Kyrtzidis if (end != NULL) 32228019772db70d4547be05a042eb950bc910f134fDouglas Gregor *end = my_end; 3235cf48766d626ff6b223acc9d4b7e415ca8480836Ted Kremenek 3244db64a461cb3442934afe43c83ed3f17f7c11c1dDouglas Gregor if (errno != ERANGE && min <= v && (max == 0 || v <= max)) { 325a88084b78fd4ca5d3d858c14b02414f8cc399f02Douglas Gregor if (value != NULL) 326a88084b78fd4ca5d3d858c14b02414f8cc399f02Douglas Gregor *value = v; 327521bf9c529e653ab28896d027352d3e16e2672d5Daniel Dunbar if (end == NULL) 328521bf9c529e653ab28896d027352d3e16e2672d5Daniel Dunbar return *my_end == '\0'; 329521bf9c529e653ab28896d027352d3e16e2672d5Daniel Dunbar return true; 330521bf9c529e653ab28896d027352d3e16e2672d5Daniel Dunbar } 331521bf9c529e653ab28896d027352d3e16e2672d5Daniel Dunbar 332f7acc37450d59ef751df73acb91de73850cc6517Daniel Dunbar return false; 333521bf9c529e653ab28896d027352d3e16e2672d5Daniel Dunbar} 3345262fda30b876c8aae95f2eb92e349418d6b14bbDaniel Dunbar 3355262fda30b876c8aae95f2eb92e349418d6b14bbDaniel Dunbarbool xtables_strtoui(const char *s, char **end, unsigned int *value, 336521bf9c529e653ab28896d027352d3e16e2672d5Daniel Dunbar unsigned int min, unsigned int max) 337521bf9c529e653ab28896d027352d3e16e2672d5Daniel Dunbar{ 338521bf9c529e653ab28896d027352d3e16e2672d5Daniel Dunbar unsigned long v; 339f7acc37450d59ef751df73acb91de73850cc6517Daniel Dunbar bool ret; 34028019772db70d4547be05a042eb950bc910f134fDouglas Gregor 341a88084b78fd4ca5d3d858c14b02414f8cc399f02Douglas Gregor ret = xtables_strtoul(s, end, &v, min, max); 34244c181aec37789f25f6c15543c164416f72e562aDouglas Gregor if (value != NULL) 34344c181aec37789f25f6c15543c164416f72e562aDouglas Gregor *value = v; 344521bf9c529e653ab28896d027352d3e16e2672d5Daniel Dunbar return ret; 3457b55668db7618334cc40011d3c1e128524d89462Daniel Dunbar} 3467b55668db7618334cc40011d3c1e128524d89462Daniel Dunbar 3477b55668db7618334cc40011d3c1e128524d89462Daniel Dunbarint xtables_service_to_port(const char *name, const char *proto) 3487b55668db7618334cc40011d3c1e128524d89462Daniel Dunbar{ 3497b55668db7618334cc40011d3c1e128524d89462Daniel Dunbar struct servent *service; 3507b55668db7618334cc40011d3c1e128524d89462Daniel Dunbar 3517b55668db7618334cc40011d3c1e128524d89462Daniel Dunbar if ((service = getservbyname(name, proto)) != NULL) 3525262fda30b876c8aae95f2eb92e349418d6b14bbDaniel Dunbar return ntohs((unsigned short) service->s_port); 3535262fda30b876c8aae95f2eb92e349418d6b14bbDaniel Dunbar 3547b55668db7618334cc40011d3c1e128524d89462Daniel Dunbar return -1; 355869824e87940f97b87064db2df2861e82e08a8c6Daniel Dunbar} 3567b55668db7618334cc40011d3c1e128524d89462Daniel Dunbar 3577b55668db7618334cc40011d3c1e128524d89462Daniel Dunbaru_int16_t xtables_parse_port(const char *port, const char *proto) 3587b55668db7618334cc40011d3c1e128524d89462Daniel Dunbar{ 3597b55668db7618334cc40011d3c1e128524d89462Daniel Dunbar unsigned int portnum; 3607b55668db7618334cc40011d3c1e128524d89462Daniel Dunbar 36128019772db70d4547be05a042eb950bc910f134fDouglas Gregor if (xtables_strtoui(port, NULL, &portnum, 0, UINT16_MAX) || 362869824e87940f97b87064db2df2861e82e08a8c6Daniel Dunbar (portnum = xtables_service_to_port(port, proto)) != (unsigned)-1) 3637b55668db7618334cc40011d3c1e128524d89462Daniel Dunbar return portnum; 3644db64a461cb3442934afe43c83ed3f17f7c11c1dDouglas Gregor 365a88084b78fd4ca5d3d858c14b02414f8cc399f02Douglas Gregor xt_params->exit_err(PARAMETER_PROBLEM, 36644c181aec37789f25f6c15543c164416f72e562aDouglas Gregor "invalid port/service `%s' specified", port); 36744c181aec37789f25f6c15543c164416f72e562aDouglas Gregor} 368abc563f554951259bbe0315055cad92ee14d87e4Douglas Gregor 369abc563f554951259bbe0315055cad92ee14d87e4Douglas Gregorvoid xtables_parse_interface(const char *arg, char *vianame, 370abc563f554951259bbe0315055cad92ee14d87e4Douglas Gregor unsigned char *mask) 371abc563f554951259bbe0315055cad92ee14d87e4Douglas Gregor{ 372abc563f554951259bbe0315055cad92ee14d87e4Douglas Gregor int vialen = strlen(arg); 373abc563f554951259bbe0315055cad92ee14d87e4Douglas Gregor unsigned int i; 374abc563f554951259bbe0315055cad92ee14d87e4Douglas Gregor 375abc563f554951259bbe0315055cad92ee14d87e4Douglas Gregor memset(mask, 0, IFNAMSIZ); 3760853a02c3b04d96a3c432b883e403175c954cd81Argyrios Kyrtzidis memset(vianame, 0, IFNAMSIZ); 3770853a02c3b04d96a3c432b883e403175c954cd81Argyrios Kyrtzidis 3780853a02c3b04d96a3c432b883e403175c954cd81Argyrios Kyrtzidis if (vialen + 1 > IFNAMSIZ) 3790853a02c3b04d96a3c432b883e403175c954cd81Argyrios Kyrtzidis xt_params->exit_err(PARAMETER_PROBLEM, 3800853a02c3b04d96a3c432b883e403175c954cd81Argyrios Kyrtzidis "interface name `%s' must be shorter than IFNAMSIZ" 381 " (%i)", arg, IFNAMSIZ-1); 382 383 strcpy(vianame, arg); 384 if ((vialen == 0) || (vialen == 1 && vianame[0] == '+')) 385 memset(mask, 0, IFNAMSIZ); 386 else if (vianame[vialen - 1] == '+') { 387 memset(mask, 0xFF, vialen - 1); 388 memset(mask + vialen - 1, 0, IFNAMSIZ - vialen + 1); 389 /* Don't remove `+' here! -HW */ 390 } else { 391 /* Include nul-terminator in match */ 392 memset(mask, 0xFF, vialen + 1); 393 memset(mask + vialen + 1, 0, IFNAMSIZ - vialen - 1); 394 for (i = 0; vianame[i]; i++) { 395 if (vianame[i] == ':' || 396 vianame[i] == '!' || 397 vianame[i] == '*') { 398 fprintf(stderr, 399 "Warning: weird character in interface" 400 " `%s' (No aliases, :, ! or *).\n", 401 vianame); 402 break; 403 } 404 } 405 } 406} 407 408#ifndef NO_SHARED_LIBS 409static void *load_extension(const char *search_path, const char *prefix, 410 const char *name, bool is_target) 411{ 412 const char *dir = search_path, *next; 413 void *ptr = NULL; 414 struct stat sb; 415 char path[256]; 416 417 do { 418 next = strchr(dir, ':'); 419 if (next == NULL) 420 next = dir + strlen(dir); 421 snprintf(path, sizeof(path), "%.*s/libxt_%s.so", 422 (unsigned int)(next - dir), dir, name); 423 424 if (dlopen(path, RTLD_NOW) != NULL) { 425 /* Found library. If it didn't register itself, 426 maybe they specified target as match. */ 427 if (is_target) 428 ptr = xtables_find_target(name, XTF_DONT_LOAD); 429 else 430 ptr = xtables_find_match(name, 431 XTF_DONT_LOAD, NULL); 432 } else if (stat(path, &sb) == 0) { 433 fprintf(stderr, "%s: %s\n", path, dlerror()); 434 } 435 436 if (ptr != NULL) 437 return ptr; 438 439 snprintf(path, sizeof(path), "%.*s/%s%s.so", 440 (unsigned int)(next - dir), dir, prefix, name); 441 if (dlopen(path, RTLD_NOW) != NULL) { 442 if (is_target) 443 ptr = xtables_find_target(name, XTF_DONT_LOAD); 444 else 445 ptr = xtables_find_match(name, 446 XTF_DONT_LOAD, NULL); 447 } else if (stat(path, &sb) == 0) { 448 fprintf(stderr, "%s: %s\n", path, dlerror()); 449 } 450 451 if (ptr != NULL) 452 return ptr; 453 454 dir = next + 1; 455 } while (*next != '\0'); 456 457 return NULL; 458} 459#endif 460 461struct xtables_match * 462xtables_find_match(const char *name, enum xtables_tryload tryload, 463 struct xtables_rule_match **matches) 464{ 465 struct xtables_match *ptr; 466 const char *icmp6 = "icmp6"; 467 468 /* This is ugly as hell. Nonetheless, there is no way of changing 469 * this without hurting backwards compatibility */ 470 if ( (strcmp(name,"icmpv6") == 0) || 471 (strcmp(name,"ipv6-icmp") == 0) || 472 (strcmp(name,"icmp6") == 0) ) 473 name = icmp6; 474 475 for (ptr = xtables_matches; ptr; ptr = ptr->next) { 476 if (strcmp(name, ptr->name) == 0) { 477 struct xtables_match *clone; 478 479 /* First match of this type: */ 480 if (ptr->m == NULL) 481 break; 482 483 /* Second and subsequent clones */ 484 clone = xtables_malloc(sizeof(struct xtables_match)); 485 memcpy(clone, ptr, sizeof(struct xtables_match)); 486 clone->mflags = 0; 487 /* This is a clone: */ 488 clone->next = clone; 489 490 ptr = clone; 491 break; 492 } 493 } 494 495#ifndef NO_SHARED_LIBS 496 if (!ptr && tryload != XTF_DONT_LOAD && tryload != XTF_DURING_LOAD) { 497 ptr = load_extension(xtables_libdir, afinfo->libprefix, 498 name, false); 499 500 if (ptr == NULL && tryload == XTF_LOAD_MUST_SUCCEED) 501 xt_params->exit_err(PARAMETER_PROBLEM, 502 "Couldn't load match `%s':%s\n", 503 name, dlerror()); 504 } 505#else 506 if (ptr && !ptr->loaded) { 507 if (tryload != XTF_DONT_LOAD) 508 ptr->loaded = 1; 509 else 510 ptr = NULL; 511 } 512 if(!ptr && (tryload == XTF_LOAD_MUST_SUCCEED)) { 513 xt_params->exit_err(PARAMETER_PROBLEM, 514 "Couldn't find match `%s'\n", name); 515 } 516#endif 517 518 if (ptr && matches) { 519 struct xtables_rule_match **i; 520 struct xtables_rule_match *newentry; 521 522 newentry = xtables_malloc(sizeof(struct xtables_rule_match)); 523 524 for (i = matches; *i; i = &(*i)->next) { 525 if (strcmp(name, (*i)->match->name) == 0) 526 (*i)->completed = true; 527 } 528 newentry->match = ptr; 529 newentry->completed = false; 530 newentry->next = NULL; 531 *i = newentry; 532 } 533 534 return ptr; 535} 536 537struct xtables_target * 538xtables_find_target(const char *name, enum xtables_tryload tryload) 539{ 540 struct xtables_target *ptr; 541 542 /* Standard target? */ 543 if (strcmp(name, "") == 0 544 || strcmp(name, XTC_LABEL_ACCEPT) == 0 545 || strcmp(name, XTC_LABEL_DROP) == 0 546 || strcmp(name, XTC_LABEL_QUEUE) == 0 547 || strcmp(name, XTC_LABEL_RETURN) == 0) 548 name = "standard"; 549 550 for (ptr = xtables_targets; ptr; ptr = ptr->next) { 551 if (strcmp(name, ptr->name) == 0) 552 break; 553 } 554 555#ifndef NO_SHARED_LIBS 556 if (!ptr && tryload != XTF_DONT_LOAD && tryload != XTF_DURING_LOAD) { 557 ptr = load_extension(xtables_libdir, afinfo->libprefix, 558 name, true); 559 560 if (ptr == NULL && tryload == XTF_LOAD_MUST_SUCCEED) 561 xt_params->exit_err(PARAMETER_PROBLEM, 562 "Couldn't load target `%s':%s\n", 563 name, dlerror()); 564 } 565#else 566 if (ptr && !ptr->loaded) { 567 if (tryload != XTF_DONT_LOAD) 568 ptr->loaded = 1; 569 else 570 ptr = NULL; 571 } 572 if(!ptr && (tryload == LOAD_MUST_SUCCEED)) { 573 xt_params->exit_err(PARAMETER_PROBLEM, 574 "Couldn't find target `%s'\n", name); 575 } 576#endif 577 578 if (ptr) 579 ptr->used = 1; 580 581 return ptr; 582} 583 584static int compatible_revision(const char *name, u_int8_t revision, int opt) 585{ 586 struct xt_get_revision rev; 587 socklen_t s = sizeof(rev); 588 int max_rev, sockfd; 589 590 sockfd = socket(afinfo->family, SOCK_RAW, IPPROTO_RAW); 591 if (sockfd < 0) { 592 if (errno == EPERM) { 593 /* revision 0 is always supported. */ 594 if (revision != 0) 595 fprintf(stderr, "Could not determine whether " 596 "revision %u is supported, " 597 "assuming it is.\n", 598 revision); 599 return 1; 600 } 601 fprintf(stderr, "Could not open socket to kernel: %s\n", 602 strerror(errno)); 603 exit(1); 604 } 605 606 xtables_load_ko(xtables_modprobe_program, true); 607 608 strcpy(rev.name, name); 609 rev.revision = revision; 610 611 max_rev = getsockopt(sockfd, afinfo->ipproto, opt, &rev, &s); 612 if (max_rev < 0) { 613 /* Definitely don't support this? */ 614 if (errno == ENOENT || errno == EPROTONOSUPPORT) { 615 close(sockfd); 616 return 0; 617 } else if (errno == ENOPROTOOPT) { 618 close(sockfd); 619 /* Assume only revision 0 support (old kernel) */ 620 return (revision == 0); 621 } else { 622 fprintf(stderr, "getsockopt failed strangely: %s\n", 623 strerror(errno)); 624 exit(1); 625 } 626 } 627 close(sockfd); 628 return 1; 629} 630 631 632static int compatible_match_revision(const char *name, u_int8_t revision) 633{ 634 return compatible_revision(name, revision, afinfo->so_rev_match); 635} 636 637static int compatible_target_revision(const char *name, u_int8_t revision) 638{ 639 return compatible_revision(name, revision, afinfo->so_rev_target); 640} 641 642void xtables_register_match(struct xtables_match *me) 643{ 644 struct xtables_match **i, *old; 645 646 if (strcmp(me->version, XTABLES_VERSION) != 0) { 647 fprintf(stderr, "%s: match \"%s\" has version \"%s\", " 648 "but \"%s\" is required.\n", 649 xtables_program_name, me->name, 650 me->version, XTABLES_VERSION); 651 exit(1); 652 } 653 654 /* Revision field stole a char from name. */ 655 if (strlen(me->name) >= XT_FUNCTION_MAXNAMELEN-1) { 656 fprintf(stderr, "%s: target `%s' has invalid name\n", 657 xtables_program_name, me->name); 658 exit(1); 659 } 660 661 if (me->family >= NPROTO) { 662 fprintf(stderr, 663 "%s: BUG: match %s has invalid protocol family\n", 664 xtables_program_name, me->name); 665 exit(1); 666 } 667 668 /* ignore not interested match */ 669 if (me->family != afinfo->family && me->family != AF_UNSPEC) 670 return; 671 672 old = xtables_find_match(me->name, XTF_DURING_LOAD, NULL); 673 if (old) { 674 if (old->revision == me->revision && 675 old->family == me->family) { 676 fprintf(stderr, 677 "%s: match `%s' already registered.\n", 678 xtables_program_name, me->name); 679 exit(1); 680 } 681 682 /* Now we have two (or more) options, check compatibility. */ 683 if (compatible_match_revision(old->name, old->revision) 684 && old->revision > me->revision) 685 return; 686 687 /* See if new match can be used. */ 688 if (!compatible_match_revision(me->name, me->revision)) 689 return; 690 691 /* Prefer !AF_UNSPEC over AF_UNSPEC for same revision. */ 692 if (old->revision == me->revision && me->family == AF_UNSPEC) 693 return; 694 695 /* Delete old one. */ 696 for (i = &xtables_matches; *i!=old; i = &(*i)->next); 697 *i = old->next; 698 } 699 700 if (me->size != XT_ALIGN(me->size)) { 701 fprintf(stderr, "%s: match `%s' has invalid size %u.\n", 702 xtables_program_name, me->name, (unsigned int)me->size); 703 exit(1); 704 } 705 706 /* Append to list. */ 707 for (i = &xtables_matches; *i; i = &(*i)->next); 708 me->next = NULL; 709 *i = me; 710 711 me->m = NULL; 712 me->mflags = 0; 713} 714 715void xtables_register_target(struct xtables_target *me) 716{ 717 struct xtables_target *old; 718 719 if (strcmp(me->version, XTABLES_VERSION) != 0) { 720 fprintf(stderr, "%s: target \"%s\" has version \"%s\", " 721 "but \"%s\" is required.\n", 722 xtables_program_name, me->name, 723 me->version, XTABLES_VERSION); 724 exit(1); 725 } 726 727 /* Revision field stole a char from name. */ 728 if (strlen(me->name) >= XT_FUNCTION_MAXNAMELEN-1) { 729 fprintf(stderr, "%s: target `%s' has invalid name\n", 730 xtables_program_name, me->name); 731 exit(1); 732 } 733 734 if (me->family >= NPROTO) { 735 fprintf(stderr, 736 "%s: BUG: target %s has invalid protocol family\n", 737 xtables_program_name, me->name); 738 exit(1); 739 } 740 741 /* ignore not interested target */ 742 if (me->family != afinfo->family && me->family != AF_UNSPEC) 743 return; 744 745 old = xtables_find_target(me->name, XTF_DURING_LOAD); 746 if (old) { 747 struct xtables_target **i; 748 749 if (old->revision == me->revision && 750 old->family == me->family) { 751 fprintf(stderr, 752 "%s: target `%s' already registered.\n", 753 xtables_program_name, me->name); 754 exit(1); 755 } 756 757 /* Now we have two (or more) options, check compatibility. */ 758 if (compatible_target_revision(old->name, old->revision) 759 && old->revision > me->revision) 760 return; 761 762 /* See if new target can be used. */ 763 if (!compatible_target_revision(me->name, me->revision)) 764 return; 765 766 /* Prefer !AF_UNSPEC over AF_UNSPEC for same revision. */ 767 if (old->revision == me->revision && me->family == AF_UNSPEC) 768 return; 769 770 /* Delete old one. */ 771 for (i = &xtables_targets; *i!=old; i = &(*i)->next); 772 *i = old->next; 773 } 774 775 if (me->size != XT_ALIGN(me->size)) { 776 fprintf(stderr, "%s: target `%s' has invalid size %u.\n", 777 xtables_program_name, me->name, (unsigned int)me->size); 778 exit(1); 779 } 780 781 /* Prepend to list. */ 782 me->next = xtables_targets; 783 xtables_targets = me; 784 me->t = NULL; 785 me->tflags = 0; 786} 787 788/** 789 * xtables_param_act - act on condition 790 * @status: a constant from enum xtables_exittype 791 * 792 * %XTF_ONLY_ONCE: print error message that option may only be used once. 793 * @p1: module name (e.g. "mark") 794 * @p2(...): option in conflict (e.g. "--mark") 795 * @p3(...): condition to match on (see extensions/ for examples) 796 * 797 * %XTF_NO_INVERT: option does not support inversion 798 * @p1: module name 799 * @p2: option in conflict 800 * @p3: condition to match on 801 * 802 * %XTF_BAD_VALUE: bad value for option 803 * @p1: module name 804 * @p2: option with which the problem occured (e.g. "--mark") 805 * @p3: string the user passed in (e.g. "99999999999999") 806 * 807 * %XTF_ONE_ACTION: two mutually exclusive actions have been specified 808 * @p1: module name 809 * 810 * Displays an error message and exits the program. 811 */ 812void xtables_param_act(unsigned int status, const char *p1, ...) 813{ 814 const char *p2, *p3; 815 va_list args; 816 bool b; 817 818 va_start(args, p1); 819 820 switch (status) { 821 case XTF_ONLY_ONCE: 822 p2 = va_arg(args, const char *); 823 b = va_arg(args, unsigned int); 824 if (!b) 825 return; 826 xt_params->exit_err(PARAMETER_PROBLEM, 827 "%s: \"%s\" option may only be specified once", 828 p1, p2); 829 break; 830 case XTF_NO_INVERT: 831 p2 = va_arg(args, const char *); 832 b = va_arg(args, unsigned int); 833 if (!b) 834 return; 835 xt_params->exit_err(PARAMETER_PROBLEM, 836 "%s: \"%s\" option cannot be inverted", p1, p2); 837 break; 838 case XTF_BAD_VALUE: 839 p2 = va_arg(args, const char *); 840 p3 = va_arg(args, const char *); 841 xt_params->exit_err(PARAMETER_PROBLEM, 842 "%s: Bad value for \"%s\" option: \"%s\"", 843 p1, p2, p3); 844 break; 845 case XTF_ONE_ACTION: 846 b = va_arg(args, unsigned int); 847 if (!b) 848 return; 849 xt_params->exit_err(PARAMETER_PROBLEM, 850 "%s: At most one action is possible", p1); 851 break; 852 default: 853 xt_params->exit_err(status, p1, args); 854 break; 855 } 856 857 va_end(args); 858} 859 860const char *xtables_ipaddr_to_numeric(const struct in_addr *addrp) 861{ 862 static char buf[20]; 863 const unsigned char *bytep = (const void *)&addrp->s_addr; 864 865 sprintf(buf, "%u.%u.%u.%u", bytep[0], bytep[1], bytep[2], bytep[3]); 866 return buf; 867} 868 869static const char *ipaddr_to_host(const struct in_addr *addr) 870{ 871 struct hostent *host; 872 873 host = gethostbyaddr(addr, sizeof(struct in_addr), AF_INET); 874 if (host == NULL) 875 return NULL; 876 877 return host->h_name; 878} 879 880static const char *ipaddr_to_network(const struct in_addr *addr) 881{ 882 struct netent *net; 883 884 if ((net = getnetbyaddr(ntohl(addr->s_addr), AF_INET)) != NULL) 885 return net->n_name; 886 887 return NULL; 888} 889 890const char *xtables_ipaddr_to_anyname(const struct in_addr *addr) 891{ 892 const char *name; 893 894 if ((name = ipaddr_to_host(addr)) != NULL || 895 (name = ipaddr_to_network(addr)) != NULL) 896 return name; 897 898 return xtables_ipaddr_to_numeric(addr); 899} 900 901const char *xtables_ipmask_to_numeric(const struct in_addr *mask) 902{ 903 static char buf[20]; 904 uint32_t maskaddr, bits; 905 int i; 906 907 maskaddr = ntohl(mask->s_addr); 908 909 if (maskaddr == 0xFFFFFFFFL) 910 /* we don't want to see "/32" */ 911 return ""; 912 913 i = 32; 914 bits = 0xFFFFFFFEL; 915 while (--i >= 0 && maskaddr != bits) 916 bits <<= 1; 917 if (i >= 0) 918 sprintf(buf, "/%d", i); 919 else 920 /* mask was not a decent combination of 1's and 0's */ 921 sprintf(buf, "/%s", xtables_ipaddr_to_numeric(mask)); 922 923 return buf; 924} 925 926static struct in_addr *__numeric_to_ipaddr(const char *dotted, bool is_mask) 927{ 928 static struct in_addr addr; 929 unsigned char *addrp; 930 unsigned int onebyte; 931 char buf[20], *p, *q; 932 int i; 933 934 /* copy dotted string, because we need to modify it */ 935 strncpy(buf, dotted, sizeof(buf) - 1); 936 buf[sizeof(buf) - 1] = '\0'; 937 addrp = (void *)&addr.s_addr; 938 939 p = buf; 940 for (i = 0; i < 3; ++i) { 941 if ((q = strchr(p, '.')) == NULL) { 942 if (is_mask) 943 return NULL; 944 945 /* autocomplete, this is a network address */ 946 if (!xtables_strtoui(p, NULL, &onebyte, 0, UINT8_MAX)) 947 return NULL; 948 949 addrp[i] = onebyte; 950 while (i < 3) 951 addrp[++i] = 0; 952 953 return &addr; 954 } 955 956 *q = '\0'; 957 if (!xtables_strtoui(p, NULL, &onebyte, 0, UINT8_MAX)) 958 return NULL; 959 960 addrp[i] = onebyte; 961 p = q + 1; 962 } 963 964 /* we have checked 3 bytes, now we check the last one */ 965 if (!xtables_strtoui(p, NULL, &onebyte, 0, UINT8_MAX)) 966 return NULL; 967 968 addrp[3] = onebyte; 969 return &addr; 970} 971 972struct in_addr *xtables_numeric_to_ipaddr(const char *dotted) 973{ 974 return __numeric_to_ipaddr(dotted, false); 975} 976 977struct in_addr *xtables_numeric_to_ipmask(const char *dotted) 978{ 979 return __numeric_to_ipaddr(dotted, true); 980} 981 982static struct in_addr *network_to_ipaddr(const char *name) 983{ 984 static struct in_addr addr; 985 struct netent *net; 986 987 if ((net = getnetbyname(name)) != NULL) { 988 if (net->n_addrtype != AF_INET) 989 return NULL; 990 addr.s_addr = htonl(net->n_net); 991 return &addr; 992 } 993 994 return NULL; 995} 996 997static struct in_addr *host_to_ipaddr(const char *name, unsigned int *naddr) 998{ 999 struct hostent *host; 1000 struct in_addr *addr; 1001 unsigned int i; 1002 1003 *naddr = 0; 1004 if ((host = gethostbyname(name)) != NULL) { 1005 if (host->h_addrtype != AF_INET || 1006 host->h_length != sizeof(struct in_addr)) 1007 return NULL; 1008 1009 while (host->h_addr_list[*naddr] != NULL) 1010 ++*naddr; 1011 addr = xtables_calloc(*naddr, sizeof(struct in_addr) * *naddr); 1012 for (i = 0; i < *naddr; i++) 1013 memcpy(&addr[i], host->h_addr_list[i], 1014 sizeof(struct in_addr)); 1015 return addr; 1016 } 1017 1018 return NULL; 1019} 1020 1021static struct in_addr * 1022ipparse_hostnetwork(const char *name, unsigned int *naddrs) 1023{ 1024 struct in_addr *addrptmp, *addrp; 1025 1026 if ((addrptmp = xtables_numeric_to_ipaddr(name)) != NULL || 1027 (addrptmp = network_to_ipaddr(name)) != NULL) { 1028 addrp = xtables_malloc(sizeof(struct in_addr)); 1029 memcpy(addrp, addrptmp, sizeof(*addrp)); 1030 *naddrs = 1; 1031 return addrp; 1032 } 1033 if ((addrptmp = host_to_ipaddr(name, naddrs)) != NULL) 1034 return addrptmp; 1035 1036 xt_params->exit_err(PARAMETER_PROBLEM, "host/network `%s' not found", name); 1037} 1038 1039static struct in_addr *parse_ipmask(const char *mask) 1040{ 1041 static struct in_addr maskaddr; 1042 struct in_addr *addrp; 1043 unsigned int bits; 1044 1045 if (mask == NULL) { 1046 /* no mask at all defaults to 32 bits */ 1047 maskaddr.s_addr = 0xFFFFFFFF; 1048 return &maskaddr; 1049 } 1050 if ((addrp = xtables_numeric_to_ipmask(mask)) != NULL) 1051 /* dotted_to_addr already returns a network byte order addr */ 1052 return addrp; 1053 if (!xtables_strtoui(mask, NULL, &bits, 0, 32)) 1054 xt_params->exit_err(PARAMETER_PROBLEM, 1055 "invalid mask `%s' specified", mask); 1056 if (bits != 0) { 1057 maskaddr.s_addr = htonl(0xFFFFFFFF << (32 - bits)); 1058 return &maskaddr; 1059 } 1060 1061 maskaddr.s_addr = 0U; 1062 return &maskaddr; 1063} 1064 1065/** 1066 * xtables_ipparse_any - transform arbitrary name to in_addr 1067 * 1068 * Possible inputs (pseudo regex): 1069 * m{^($hostname|$networkname|$ipaddr)(/$mask)?} 1070 * "1.2.3.4/5", "1.2.3.4", "hostname", "networkname" 1071 */ 1072void xtables_ipparse_any(const char *name, struct in_addr **addrpp, 1073 struct in_addr *maskp, unsigned int *naddrs) 1074{ 1075 unsigned int i, j, k, n; 1076 struct in_addr *addrp; 1077 char buf[256], *p; 1078 1079 strncpy(buf, name, sizeof(buf) - 1); 1080 buf[sizeof(buf) - 1] = '\0'; 1081 if ((p = strrchr(buf, '/')) != NULL) { 1082 *p = '\0'; 1083 addrp = parse_ipmask(p + 1); 1084 } else { 1085 addrp = parse_ipmask(NULL); 1086 } 1087 memcpy(maskp, addrp, sizeof(*maskp)); 1088 1089 /* if a null mask is given, the name is ignored, like in "any/0" */ 1090 if (maskp->s_addr == 0U) 1091 strcpy(buf, "0.0.0.0"); 1092 1093 addrp = *addrpp = ipparse_hostnetwork(buf, naddrs); 1094 n = *naddrs; 1095 for (i = 0, j = 0; i < n; ++i) { 1096 addrp[j++].s_addr &= maskp->s_addr; 1097 for (k = 0; k < j - 1; ++k) 1098 if (addrp[k].s_addr == addrp[j-1].s_addr) { 1099 --*naddrs; 1100 --j; 1101 break; 1102 } 1103 } 1104} 1105 1106const char *xtables_ip6addr_to_numeric(const struct in6_addr *addrp) 1107{ 1108 /* 0000:0000:0000:0000:0000:000.000.000.000 1109 * 0000:0000:0000:0000:0000:0000:0000:0000 */ 1110 static char buf[50+1]; 1111 return inet_ntop(AF_INET6, addrp, buf, sizeof(buf)); 1112} 1113 1114static const char *ip6addr_to_host(const struct in6_addr *addr) 1115{ 1116 static char hostname[NI_MAXHOST]; 1117 struct sockaddr_in6 saddr; 1118 int err; 1119 1120 memset(&saddr, 0, sizeof(struct sockaddr_in6)); 1121 memcpy(&saddr.sin6_addr, addr, sizeof(*addr)); 1122 saddr.sin6_family = AF_INET6; 1123 1124 err = getnameinfo((const void *)&saddr, sizeof(struct sockaddr_in6), 1125 hostname, sizeof(hostname) - 1, NULL, 0, 0); 1126 if (err != 0) { 1127#ifdef DEBUG 1128 fprintf(stderr,"IP2Name: %s\n",gai_strerror(err)); 1129#endif 1130 return NULL; 1131 } 1132 1133#ifdef DEBUG 1134 fprintf (stderr, "\naddr2host: %s\n", hostname); 1135#endif 1136 return hostname; 1137} 1138 1139const char *xtables_ip6addr_to_anyname(const struct in6_addr *addr) 1140{ 1141 const char *name; 1142 1143 if ((name = ip6addr_to_host(addr)) != NULL) 1144 return name; 1145 1146 return xtables_ip6addr_to_numeric(addr); 1147} 1148 1149static int ip6addr_prefix_length(const struct in6_addr *k) 1150{ 1151 unsigned int bits = 0; 1152 uint32_t a, b, c, d; 1153 1154 a = ntohl(k->s6_addr32[0]); 1155 b = ntohl(k->s6_addr32[1]); 1156 c = ntohl(k->s6_addr32[2]); 1157 d = ntohl(k->s6_addr32[3]); 1158 while (a & 0x80000000U) { 1159 ++bits; 1160 a <<= 1; 1161 a |= (b >> 31) & 1; 1162 b <<= 1; 1163 b |= (c >> 31) & 1; 1164 c <<= 1; 1165 c |= (d >> 31) & 1; 1166 d <<= 1; 1167 } 1168 if (a != 0 || b != 0 || c != 0 || d != 0) 1169 return -1; 1170 return bits; 1171} 1172 1173const char *xtables_ip6mask_to_numeric(const struct in6_addr *addrp) 1174{ 1175 static char buf[50+2]; 1176 int l = ip6addr_prefix_length(addrp); 1177 1178 if (l == -1) { 1179 strcpy(buf, "/"); 1180 strcat(buf, xtables_ip6addr_to_numeric(addrp)); 1181 return buf; 1182 } 1183 sprintf(buf, "/%d", l); 1184 return buf; 1185} 1186 1187struct in6_addr *xtables_numeric_to_ip6addr(const char *num) 1188{ 1189 static struct in6_addr ap; 1190 int err; 1191 1192 if ((err = inet_pton(AF_INET6, num, &ap)) == 1) 1193 return ≈ 1194#ifdef DEBUG 1195 fprintf(stderr, "\nnumeric2addr: %d\n", err); 1196#endif 1197 return NULL; 1198} 1199 1200static struct in6_addr * 1201host_to_ip6addr(const char *name, unsigned int *naddr) 1202{ 1203 static struct in6_addr *addr; 1204 struct addrinfo hints; 1205 struct addrinfo *res; 1206 int err; 1207 1208 memset(&hints, 0, sizeof(hints)); 1209 hints.ai_flags = AI_CANONNAME; 1210 hints.ai_family = AF_INET6; 1211 hints.ai_socktype = SOCK_RAW; 1212 hints.ai_protocol = IPPROTO_IPV6; 1213 hints.ai_next = NULL; 1214 1215 *naddr = 0; 1216 if ((err = getaddrinfo(name, NULL, &hints, &res)) != 0) { 1217#ifdef DEBUG 1218 fprintf(stderr,"Name2IP: %s\n",gai_strerror(err)); 1219#endif 1220 return NULL; 1221 } else { 1222 if (res->ai_family != AF_INET6 || 1223 res->ai_addrlen != sizeof(struct sockaddr_in6)) 1224 return NULL; 1225 1226#ifdef DEBUG 1227 fprintf(stderr, "resolved: len=%d %s ", res->ai_addrlen, 1228 ip6addr_to_numeric(&((struct sockaddr_in6 *)res->ai_addr)->sin6_addr)); 1229#endif 1230 /* Get the first element of the address-chain */ 1231 addr = xtables_malloc(sizeof(struct in6_addr)); 1232 memcpy(addr, &((const struct sockaddr_in6 *)res->ai_addr)->sin6_addr, 1233 sizeof(struct in6_addr)); 1234 freeaddrinfo(res); 1235 *naddr = 1; 1236 return addr; 1237 } 1238 1239 return NULL; 1240} 1241 1242static struct in6_addr *network_to_ip6addr(const char *name) 1243{ 1244 /* abort();*/ 1245 /* TODO: not implemented yet, but the exception breaks the 1246 * name resolvation */ 1247 return NULL; 1248} 1249 1250static struct in6_addr * 1251ip6parse_hostnetwork(const char *name, unsigned int *naddrs) 1252{ 1253 struct in6_addr *addrp, *addrptmp; 1254 1255 if ((addrptmp = xtables_numeric_to_ip6addr(name)) != NULL || 1256 (addrptmp = network_to_ip6addr(name)) != NULL) { 1257 addrp = xtables_malloc(sizeof(struct in6_addr)); 1258 memcpy(addrp, addrptmp, sizeof(*addrp)); 1259 *naddrs = 1; 1260 return addrp; 1261 } 1262 if ((addrp = host_to_ip6addr(name, naddrs)) != NULL) 1263 return addrp; 1264 1265 xt_params->exit_err(PARAMETER_PROBLEM, "host/network `%s' not found", name); 1266} 1267 1268static struct in6_addr *parse_ip6mask(char *mask) 1269{ 1270 static struct in6_addr maskaddr; 1271 struct in6_addr *addrp; 1272 unsigned int bits; 1273 1274 if (mask == NULL) { 1275 /* no mask at all defaults to 128 bits */ 1276 memset(&maskaddr, 0xff, sizeof maskaddr); 1277 return &maskaddr; 1278 } 1279 if ((addrp = xtables_numeric_to_ip6addr(mask)) != NULL) 1280 return addrp; 1281 if (!xtables_strtoui(mask, NULL, &bits, 0, 128)) 1282 xt_params->exit_err(PARAMETER_PROBLEM, 1283 "invalid mask `%s' specified", mask); 1284 if (bits != 0) { 1285 char *p = (void *)&maskaddr; 1286 memset(p, 0xff, bits / 8); 1287 memset(p + (bits / 8) + 1, 0, (128 - bits) / 8); 1288 p[bits/8] = 0xff << (8 - (bits & 7)); 1289 return &maskaddr; 1290 } 1291 1292 memset(&maskaddr, 0, sizeof(maskaddr)); 1293 return &maskaddr; 1294} 1295 1296void xtables_ip6parse_any(const char *name, struct in6_addr **addrpp, 1297 struct in6_addr *maskp, unsigned int *naddrs) 1298{ 1299 struct in6_addr *addrp; 1300 unsigned int i, j, k, n; 1301 char buf[256], *p; 1302 1303 strncpy(buf, name, sizeof(buf) - 1); 1304 buf[sizeof(buf)-1] = '\0'; 1305 if ((p = strrchr(buf, '/')) != NULL) { 1306 *p = '\0'; 1307 addrp = parse_ip6mask(p + 1); 1308 } else { 1309 addrp = parse_ip6mask(NULL); 1310 } 1311 memcpy(maskp, addrp, sizeof(*maskp)); 1312 1313 /* if a null mask is given, the name is ignored, like in "any/0" */ 1314 if (memcmp(maskp, &in6addr_any, sizeof(in6addr_any)) == 0) 1315 strcpy(buf, "::"); 1316 1317 addrp = *addrpp = ip6parse_hostnetwork(buf, naddrs); 1318 n = *naddrs; 1319 for (i = 0, j = 0; i < n; ++i) { 1320 for (k = 0; k < 4; ++k) 1321 addrp[j].s6_addr32[k] &= maskp->s6_addr32[k]; 1322 ++j; 1323 for (k = 0; k < j - 1; ++k) 1324 if (IN6_ARE_ADDR_EQUAL(&addrp[k], &addrp[j - 1])) { 1325 --*naddrs; 1326 --j; 1327 break; 1328 } 1329 } 1330} 1331 1332void xtables_save_string(const char *value) 1333{ 1334 static const char no_quote_chars[] = "_-0123456789" 1335 "abcdefghijklmnopqrstuvwxyz" 1336 "ABCDEFGHIJKLMNOPQRSTUVWXYZ"; 1337 static const char escape_chars[] = "\"\\'"; 1338 size_t length; 1339 const char *p; 1340 1341 length = strcspn(value, no_quote_chars); 1342 if (length > 0 && value[length] == 0) { 1343 /* no quoting required */ 1344 fputs(value, stdout); 1345 putchar(' '); 1346 } else { 1347 /* there is at least one dangerous character in the 1348 value, which we have to quote. Write double quotes 1349 around the value and escape special characters with 1350 a backslash */ 1351 putchar('"'); 1352 1353 for (p = strpbrk(value, escape_chars); p != NULL; 1354 p = strpbrk(value, escape_chars)) { 1355 if (p > value) 1356 fwrite(value, 1, p - value, stdout); 1357 putchar('\\'); 1358 putchar(*p); 1359 value = p + 1; 1360 } 1361 1362 /* print the rest and finish the double quoted 1363 string */ 1364 fputs(value, stdout); 1365 printf("\" "); 1366 } 1367} 1368 1369/** 1370 * Check for option-intrapositional negation. 1371 * Do not use in new code. 1372 */ 1373int xtables_check_inverse(const char option[], int *invert, 1374 int *my_optind, int argc) 1375{ 1376 if (option && strcmp(option, "!") == 0) { 1377 fprintf(stderr, "Using intrapositioned negation " 1378 "(`--option ! this`) is deprecated in favor of " 1379 "extrapositioned (`! --option this`).\n"); 1380 1381 if (*invert) 1382 xt_params->exit_err(PARAMETER_PROBLEM, 1383 "Multiple `!' flags not allowed"); 1384 *invert = true; 1385 if (my_optind != NULL) { 1386 ++*my_optind; 1387 if (argc && *my_optind > argc) 1388 xt_params->exit_err(PARAMETER_PROBLEM, 1389 "no argument following `!'"); 1390 } 1391 1392 return true; 1393 } 1394 return false; 1395} 1396 1397const struct xtables_pprot xtables_chain_protos[] = { 1398 {"tcp", IPPROTO_TCP}, 1399 {"sctp", IPPROTO_SCTP}, 1400 {"udp", IPPROTO_UDP}, 1401 {"udplite", IPPROTO_UDPLITE}, 1402 {"icmp", IPPROTO_ICMP}, 1403 {"icmpv6", IPPROTO_ICMPV6}, 1404 {"ipv6-icmp", IPPROTO_ICMPV6}, 1405 {"esp", IPPROTO_ESP}, 1406 {"ah", IPPROTO_AH}, 1407 {"ipv6-mh", IPPROTO_MH}, 1408 {"mh", IPPROTO_MH}, 1409 {"all", 0}, 1410 {NULL}, 1411}; 1412 1413u_int16_t 1414xtables_parse_protocol(const char *s) 1415{ 1416 unsigned int proto; 1417 1418 if (!xtables_strtoui(s, NULL, &proto, 0, UINT8_MAX)) { 1419 struct protoent *pent; 1420 1421 /* first deal with the special case of 'all' to prevent 1422 * people from being able to redefine 'all' in nsswitch 1423 * and/or provoke expensive [not working] ldap/nis/... 1424 * lookups */ 1425 if (!strcmp(s, "all")) 1426 return 0; 1427 1428 if ((pent = getprotobyname(s))) 1429 proto = pent->p_proto; 1430 else { 1431 unsigned int i; 1432 for (i = 0; i < ARRAY_SIZE(xtables_chain_protos); ++i) { 1433 if (strcmp(s, xtables_chain_protos[i].name) == 0) { 1434 proto = xtables_chain_protos[i].num; 1435 break; 1436 } 1437 } 1438 if (i == ARRAY_SIZE(xtables_chain_protos)) 1439 xt_params->exit_err(PARAMETER_PROBLEM, 1440 "unknown protocol `%s' specified", 1441 s); 1442 } 1443 } 1444 1445 return proto; 1446} 1447