xtables.c revision a239728ec064666025de2723997d87b176d57fd6
1/* 2 * (C) 2000-2006 by the netfilter coreteam <coreteam@netfilter.org>: 3 * 4 * This program is free software; you can redistribute it and/or modify 5 * it under the terms of the GNU General Public License as published by 6 * the Free Software Foundation; either version 2 of the License, or 7 * (at your option) any later version. 8 * 9 * This program is distributed in the hope that it will be useful, 10 * but WITHOUT ANY WARRANTY; without even the implied warranty of 11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 12 * GNU General Public License for more details. 13 * 14 * You should have received a copy of the GNU General Public License 15 * along with this program; if not, write to the Free Software 16 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. 17 */ 18 19#include <errno.h> 20#include <fcntl.h> 21#include <netdb.h> 22#include <stdarg.h> 23#include <stdbool.h> 24#include <stdio.h> 25#include <stdlib.h> 26#include <string.h> 27#include <unistd.h> 28#include <sys/socket.h> 29#include <sys/stat.h> 30#include <sys/types.h> 31#include <sys/wait.h> 32#include <arpa/inet.h> 33 34#include <xtables.h> 35#include <limits.h> /* INT_MAX in ip_tables.h/ip6_tables.h */ 36#include <linux/netfilter_ipv4/ip_tables.h> 37#include <linux/netfilter_ipv6/ip6_tables.h> 38#include <libiptc/libxtc.h> 39 40#ifndef NO_SHARED_LIBS 41#include <dlfcn.h> 42#endif 43#ifndef IPT_SO_GET_REVISION_MATCH /* Old kernel source. */ 44# define IPT_SO_GET_REVISION_MATCH (IPT_BASE_CTL + 2) 45# define IPT_SO_GET_REVISION_TARGET (IPT_BASE_CTL + 3) 46#endif 47#ifndef IP6T_SO_GET_REVISION_MATCH /* Old kernel source. */ 48# define IP6T_SO_GET_REVISION_MATCH 68 49# define IP6T_SO_GET_REVISION_TARGET 69 50#endif 51#include <getopt.h> 52#include "xshared.h" 53 54#define NPROTO 255 55 56#ifndef PROC_SYS_MODPROBE 57#define PROC_SYS_MODPROBE "/proc/sys/kernel/modprobe" 58#endif 59 60void basic_exit_err(enum xtables_exittype status, const char *msg, ...) __attribute__((noreturn, format(printf,2,3))); 61 62struct xtables_globals *xt_params = NULL; 63 64void basic_exit_err(enum xtables_exittype status, const char *msg, ...) 65{ 66 va_list args; 67 68 va_start(args, msg); 69 fprintf(stderr, "%s v%s: ", xt_params->program_name, xt_params->program_version); 70 vfprintf(stderr, msg, args); 71 va_end(args); 72 fprintf(stderr, "\n"); 73 exit(status); 74} 75 76void xtables_free_opts(int unused) 77{ 78 if (xt_params->opts != xt_params->orig_opts) { 79 free(xt_params->opts); 80 xt_params->opts = NULL; 81 } 82} 83 84struct option *xtables_merge_options(struct option *orig_opts, 85 struct option *oldopts, 86 const struct option *newopts, 87 unsigned int *option_offset) 88{ 89 unsigned int num_oold = 0, num_old = 0, num_new = 0, i; 90 struct option *merge, *mp; 91 92 if (newopts == NULL) 93 return oldopts; 94 95 for (num_oold = 0; orig_opts[num_oold].name; num_oold++) ; 96 if (oldopts != NULL) 97 for (num_old = 0; oldopts[num_old].name; num_old++) ; 98 for (num_new = 0; newopts[num_new].name; num_new++) ; 99 100 /* 101 * Since @oldopts also has @orig_opts already (and does so at the 102 * start), skip these entries. 103 */ 104 oldopts += num_oold; 105 num_old -= num_oold; 106 107 merge = malloc(sizeof(*mp) * (num_oold + num_old + num_new + 1)); 108 if (merge == NULL) 109 return NULL; 110 111 /* Let the base options -[ADI...] have precedence over everything */ 112 memcpy(merge, orig_opts, sizeof(*mp) * num_oold); 113 mp = merge + num_oold; 114 115 /* Second, the new options */ 116 xt_params->option_offset += XT_OPTION_OFFSET_SCALE; 117 *option_offset = xt_params->option_offset; 118 memcpy(mp, newopts, sizeof(*mp) * num_new); 119 120 for (i = 0; i < num_new; ++i, ++mp) 121 mp->val += *option_offset; 122 123 /* Third, the old options */ 124 memcpy(mp, oldopts, sizeof(*mp) * num_old); 125 mp += num_old; 126 xtables_free_opts(0); 127 128 /* Clear trailing entry */ 129 memset(mp, 0, sizeof(*mp)); 130 return merge; 131} 132 133/** 134 * xtables_afinfo - protocol family dependent information 135 * @kmod: kernel module basename (e.g. "ip_tables") 136 * @libprefix: prefix of .so library name (e.g. "libipt_") 137 * @family: nfproto family 138 * @ipproto: used by setsockopt (e.g. IPPROTO_IP) 139 * @so_rev_match: optname to check revision support of match 140 * @so_rev_target: optname to check revision support of target 141 */ 142struct xtables_afinfo { 143 const char *kmod; 144 const char *libprefix; 145 uint8_t family; 146 uint8_t ipproto; 147 int so_rev_match; 148 int so_rev_target; 149}; 150 151static const struct xtables_afinfo afinfo_ipv4 = { 152 .kmod = "ip_tables", 153 .libprefix = "libipt_", 154 .family = NFPROTO_IPV4, 155 .ipproto = IPPROTO_IP, 156 .so_rev_match = IPT_SO_GET_REVISION_MATCH, 157 .so_rev_target = IPT_SO_GET_REVISION_TARGET, 158}; 159 160static const struct xtables_afinfo afinfo_ipv6 = { 161 .kmod = "ip6_tables", 162 .libprefix = "libip6t_", 163 .family = NFPROTO_IPV6, 164 .ipproto = IPPROTO_IPV6, 165 .so_rev_match = IP6T_SO_GET_REVISION_MATCH, 166 .so_rev_target = IP6T_SO_GET_REVISION_TARGET, 167}; 168 169static const struct xtables_afinfo *afinfo; 170 171/* Search path for Xtables .so files */ 172static const char *xtables_libdir; 173 174/* the path to command to load kernel module */ 175const char *xtables_modprobe_program; 176 177/* Keeping track of external matches and targets: linked lists. */ 178struct xtables_match *xtables_matches; 179struct xtables_target *xtables_targets; 180 181void xtables_init(void) 182{ 183 xtables_libdir = getenv("XTABLES_LIBDIR"); 184 if (xtables_libdir != NULL) 185 return; 186 xtables_libdir = getenv("IPTABLES_LIB_DIR"); 187 if (xtables_libdir != NULL) { 188 fprintf(stderr, "IPTABLES_LIB_DIR is deprecated, " 189 "use XTABLES_LIBDIR.\n"); 190 return; 191 } 192 /* 193 * Well yes, IP6TABLES_LIB_DIR is of lower priority over 194 * IPTABLES_LIB_DIR since this moved to libxtables; I think that is ok 195 * for these env vars are deprecated anyhow, and in light of the 196 * (shared) libxt_*.so files, makes less sense to have 197 * IPTABLES_LIB_DIR != IP6TABLES_LIB_DIR. 198 */ 199 xtables_libdir = getenv("IP6TABLES_LIB_DIR"); 200 if (xtables_libdir != NULL) { 201 fprintf(stderr, "IP6TABLES_LIB_DIR is deprecated, " 202 "use XTABLES_LIBDIR.\n"); 203 return; 204 } 205 xtables_libdir = XTABLES_LIBDIR; 206} 207 208void xtables_set_nfproto(uint8_t nfproto) 209{ 210 switch (nfproto) { 211 case NFPROTO_IPV4: 212 afinfo = &afinfo_ipv4; 213 break; 214 case NFPROTO_IPV6: 215 afinfo = &afinfo_ipv6; 216 break; 217 default: 218 fprintf(stderr, "libxtables: unhandled NFPROTO in %s\n", 219 __func__); 220 } 221} 222 223/** 224 * xtables_set_params - set the global parameters used by xtables 225 * @xtp: input xtables_globals structure 226 * 227 * The app is expected to pass a valid xtables_globals data-filled 228 * with proper values 229 * @xtp cannot be NULL 230 * 231 * Returns -1 on failure to set and 0 on success 232 */ 233int xtables_set_params(struct xtables_globals *xtp) 234{ 235 if (!xtp) { 236 fprintf(stderr, "%s: Illegal global params\n",__func__); 237 return -1; 238 } 239 240 xt_params = xtp; 241 242 if (!xt_params->exit_err) 243 xt_params->exit_err = basic_exit_err; 244 245 return 0; 246} 247 248int xtables_init_all(struct xtables_globals *xtp, uint8_t nfproto) 249{ 250 xtables_init(); 251 xtables_set_nfproto(nfproto); 252 return xtables_set_params(xtp); 253} 254 255/** 256 * xtables_*alloc - wrappers that exit on failure 257 */ 258void *xtables_calloc(size_t count, size_t size) 259{ 260 void *p; 261 262 if ((p = calloc(count, size)) == NULL) { 263 perror("ip[6]tables: calloc failed"); 264 exit(1); 265 } 266 267 return p; 268} 269 270void *xtables_malloc(size_t size) 271{ 272 void *p; 273 274 if ((p = malloc(size)) == NULL) { 275 perror("ip[6]tables: malloc failed"); 276 exit(1); 277 } 278 279 return p; 280} 281 282void *xtables_realloc(void *ptr, size_t size) 283{ 284 void *p; 285 286 if ((p = realloc(ptr, size)) == NULL) { 287 perror("ip[6]tables: realloc failed"); 288 exit(1); 289 } 290 291 return p; 292} 293 294static char *get_modprobe(void) 295{ 296 int procfile; 297 char *ret; 298 299#define PROCFILE_BUFSIZ 1024 300 procfile = open(PROC_SYS_MODPROBE, O_RDONLY); 301 if (procfile < 0) 302 return NULL; 303 if (fcntl(procfile, F_SETFD, FD_CLOEXEC) == -1) { 304 fprintf(stderr, "Could not set close on exec: %s\n", 305 strerror(errno)); 306 exit(1); 307 } 308 309 ret = malloc(PROCFILE_BUFSIZ); 310 if (ret) { 311 memset(ret, 0, PROCFILE_BUFSIZ); 312 switch (read(procfile, ret, PROCFILE_BUFSIZ)) { 313 case -1: goto fail; 314 case PROCFILE_BUFSIZ: goto fail; /* Partial read. Wierd */ 315 } 316 if (ret[strlen(ret)-1]=='\n') 317 ret[strlen(ret)-1]=0; 318 close(procfile); 319 return ret; 320 } 321 fail: 322 free(ret); 323 close(procfile); 324 return NULL; 325} 326 327int xtables_insmod(const char *modname, const char *modprobe, bool quiet) 328{ 329 char *buf = NULL; 330 char *argv[4]; 331 int status; 332 333 /* If they don't explicitly set it, read out of kernel */ 334 if (!modprobe) { 335 buf = get_modprobe(); 336 if (!buf) 337 return -1; 338 modprobe = buf; 339 } 340 341 /* 342 * Need to flush the buffer, or the child may output it again 343 * when switching the program thru execv. 344 */ 345 fflush(stdout); 346 347 switch (vfork()) { 348 case 0: 349 argv[0] = (char *)modprobe; 350 argv[1] = (char *)modname; 351 if (quiet) { 352 argv[2] = "-q"; 353 argv[3] = NULL; 354 } else { 355 argv[2] = NULL; 356 argv[3] = NULL; 357 } 358 execv(argv[0], argv); 359 360 /* not usually reached */ 361 exit(1); 362 case -1: 363 return -1; 364 365 default: /* parent */ 366 wait(&status); 367 } 368 369 free(buf); 370 if (WIFEXITED(status) && WEXITSTATUS(status) == 0) 371 return 0; 372 return -1; 373} 374 375int xtables_load_ko(const char *modprobe, bool quiet) 376{ 377 static bool loaded = false; 378 static int ret = -1; 379 380 if (!loaded) { 381 ret = xtables_insmod(afinfo->kmod, modprobe, quiet); 382 loaded = (ret == 0); 383 } 384 385 return ret; 386} 387 388/** 389 * xtables_strtou{i,l} - string to number conversion 390 * @s: input string 391 * @end: like strtoul's "end" pointer 392 * @value: pointer for result 393 * @min: minimum accepted value 394 * @max: maximum accepted value 395 * 396 * If @end is NULL, we assume the caller wants a "strict strtoul", and hence 397 * "15a" is rejected. 398 * In either case, the value obtained is compared for min-max compliance. 399 * Base is always 0, i.e. autodetect depending on @s. 400 * 401 * Returns true/false whether number was accepted. On failure, *value has 402 * undefined contents. 403 */ 404bool xtables_strtoul(const char *s, char **end, unsigned long *value, 405 unsigned long min, unsigned long max) 406{ 407 unsigned long v; 408 char *my_end; 409 410 errno = 0; 411 v = strtoul(s, &my_end, 0); 412 413 if (my_end == s) 414 return false; 415 if (end != NULL) 416 *end = my_end; 417 418 if (errno != ERANGE && min <= v && (max == 0 || v <= max)) { 419 if (value != NULL) 420 *value = v; 421 if (end == NULL) 422 return *my_end == '\0'; 423 return true; 424 } 425 426 return false; 427} 428 429bool xtables_strtoui(const char *s, char **end, unsigned int *value, 430 unsigned int min, unsigned int max) 431{ 432 unsigned long v; 433 bool ret; 434 435 ret = xtables_strtoul(s, end, &v, min, max); 436 if (value != NULL) 437 *value = v; 438 return ret; 439} 440 441int xtables_service_to_port(const char *name, const char *proto) 442{ 443 struct servent *service; 444 445 if ((service = getservbyname(name, proto)) != NULL) 446 return ntohs((unsigned short) service->s_port); 447 448 return -1; 449} 450 451uint16_t xtables_parse_port(const char *port, const char *proto) 452{ 453 unsigned int portnum; 454 455 if (xtables_strtoui(port, NULL, &portnum, 0, UINT16_MAX) || 456 (portnum = xtables_service_to_port(port, proto)) != (unsigned)-1) 457 return portnum; 458 459 xt_params->exit_err(PARAMETER_PROBLEM, 460 "invalid port/service `%s' specified", port); 461} 462 463void xtables_parse_interface(const char *arg, char *vianame, 464 unsigned char *mask) 465{ 466 unsigned int vialen = strlen(arg); 467 unsigned int i; 468 469 memset(mask, 0, IFNAMSIZ); 470 memset(vianame, 0, IFNAMSIZ); 471 472 if (vialen + 1 > IFNAMSIZ) 473 xt_params->exit_err(PARAMETER_PROBLEM, 474 "interface name `%s' must be shorter than IFNAMSIZ" 475 " (%i)", arg, IFNAMSIZ-1); 476 477 strcpy(vianame, arg); 478 if (vialen == 0) 479 memset(mask, 0, IFNAMSIZ); 480 else if (vianame[vialen - 1] == '+') { 481 memset(mask, 0xFF, vialen - 1); 482 memset(mask + vialen - 1, 0, IFNAMSIZ - vialen + 1); 483 /* Don't remove `+' here! -HW */ 484 } else { 485 /* Include nul-terminator in match */ 486 memset(mask, 0xFF, vialen + 1); 487 memset(mask + vialen + 1, 0, IFNAMSIZ - vialen - 1); 488 for (i = 0; vianame[i]; i++) { 489 if (vianame[i] == '/' || 490 vianame[i] == ' ') { 491 fprintf(stderr, 492 "Warning: weird character in interface" 493 " `%s' ('/' and ' ' are not allowed by the kernel).\n", 494 vianame); 495 break; 496 } 497 } 498 } 499} 500 501#ifndef NO_SHARED_LIBS 502static void *load_extension(const char *search_path, const char *af_prefix, 503 const char *name, bool is_target) 504{ 505 const char *all_prefixes[] = {"libxt_", af_prefix, NULL}; 506 const char **prefix; 507 const char *dir = search_path, *next; 508 void *ptr = NULL; 509 struct stat sb; 510 char path[256]; 511 512 do { 513 next = strchr(dir, ':'); 514 if (next == NULL) 515 next = dir + strlen(dir); 516 517 for (prefix = all_prefixes; *prefix != NULL; ++prefix) { 518 snprintf(path, sizeof(path), "%.*s/%s%s.so", 519 (unsigned int)(next - dir), dir, 520 *prefix, name); 521 522 if (stat(path, &sb) != 0) { 523 if (errno == ENOENT) 524 continue; 525 fprintf(stderr, "%s: %s\n", path, 526 strerror(errno)); 527 return NULL; 528 } 529 if (dlopen(path, RTLD_NOW) == NULL) { 530 fprintf(stderr, "%s: %s\n", path, dlerror()); 531 break; 532 } 533 534 if (is_target) 535 ptr = xtables_find_target(name, XTF_DONT_LOAD); 536 else 537 ptr = xtables_find_match(name, 538 XTF_DONT_LOAD, NULL); 539 540 if (ptr != NULL) 541 return ptr; 542 543 fprintf(stderr, "%s: no \"%s\" extension found for " 544 "this protocol\n", path, name); 545 errno = ENOENT; 546 return NULL; 547 } 548 dir = next + 1; 549 } while (*next != '\0'); 550 551 return NULL; 552} 553#endif 554 555struct xtables_match * 556xtables_find_match(const char *name, enum xtables_tryload tryload, 557 struct xtables_rule_match **matches) 558{ 559 struct xtables_match *ptr; 560 const char *icmp6 = "icmp6"; 561 562 if (strlen(name) >= XT_EXTENSION_MAXNAMELEN) 563 xtables_error(PARAMETER_PROBLEM, 564 "Invalid match name \"%s\" (%u chars max)", 565 name, XT_EXTENSION_MAXNAMELEN - 1); 566 567 /* This is ugly as hell. Nonetheless, there is no way of changing 568 * this without hurting backwards compatibility */ 569 if ( (strcmp(name,"icmpv6") == 0) || 570 (strcmp(name,"ipv6-icmp") == 0) || 571 (strcmp(name,"icmp6") == 0) ) 572 name = icmp6; 573 574 for (ptr = xtables_matches; ptr; ptr = ptr->next) { 575 if (strcmp(name, ptr->name) == 0) { 576 struct xtables_match *clone; 577 578 /* First match of this type: */ 579 if (ptr->m == NULL) 580 break; 581 582 /* Second and subsequent clones */ 583 clone = xtables_malloc(sizeof(struct xtables_match)); 584 memcpy(clone, ptr, sizeof(struct xtables_match)); 585 clone->mflags = 0; 586 /* This is a clone: */ 587 clone->next = clone; 588 589 ptr = clone; 590 break; 591 } 592 } 593 594#ifndef NO_SHARED_LIBS 595 if (!ptr && tryload != XTF_DONT_LOAD && tryload != XTF_DURING_LOAD) { 596 ptr = load_extension(xtables_libdir, afinfo->libprefix, 597 name, false); 598 599 if (ptr == NULL && tryload == XTF_LOAD_MUST_SUCCEED) 600 xt_params->exit_err(PARAMETER_PROBLEM, 601 "Couldn't load match `%s':%s\n", 602 name, strerror(errno)); 603 } 604#else 605 if (ptr && !ptr->loaded) { 606 if (tryload != XTF_DONT_LOAD) 607 ptr->loaded = 1; 608 else 609 ptr = NULL; 610 } 611 if(!ptr && (tryload == XTF_LOAD_MUST_SUCCEED)) { 612 xt_params->exit_err(PARAMETER_PROBLEM, 613 "Couldn't find match `%s'\n", name); 614 } 615#endif 616 617 if (ptr && matches) { 618 struct xtables_rule_match **i; 619 struct xtables_rule_match *newentry; 620 621 newentry = xtables_malloc(sizeof(struct xtables_rule_match)); 622 623 for (i = matches; *i; i = &(*i)->next) { 624 if (strcmp(name, (*i)->match->name) == 0) 625 (*i)->completed = true; 626 } 627 newentry->match = ptr; 628 newentry->completed = false; 629 newentry->next = NULL; 630 *i = newentry; 631 } 632 633 return ptr; 634} 635 636struct xtables_target * 637xtables_find_target(const char *name, enum xtables_tryload tryload) 638{ 639 struct xtables_target *ptr; 640 641 /* Standard target? */ 642 if (strcmp(name, "") == 0 643 || strcmp(name, XTC_LABEL_ACCEPT) == 0 644 || strcmp(name, XTC_LABEL_DROP) == 0 645 || strcmp(name, XTC_LABEL_QUEUE) == 0 646 || strcmp(name, XTC_LABEL_RETURN) == 0) 647 name = "standard"; 648 649 for (ptr = xtables_targets; ptr; ptr = ptr->next) { 650 if (strcmp(name, ptr->name) == 0) 651 break; 652 } 653 654#ifndef NO_SHARED_LIBS 655 if (!ptr && tryload != XTF_DONT_LOAD && tryload != XTF_DURING_LOAD) { 656 ptr = load_extension(xtables_libdir, afinfo->libprefix, 657 name, true); 658 659 if (ptr == NULL && tryload == XTF_LOAD_MUST_SUCCEED) 660 xt_params->exit_err(PARAMETER_PROBLEM, 661 "Couldn't load target `%s':%s\n", 662 name, strerror(errno)); 663 } 664#else 665 if (ptr && !ptr->loaded) { 666 if (tryload != XTF_DONT_LOAD) 667 ptr->loaded = 1; 668 else 669 ptr = NULL; 670 } 671 if (ptr == NULL && tryload == XTF_LOAD_MUST_SUCCEED) { 672 xt_params->exit_err(PARAMETER_PROBLEM, 673 "Couldn't find target `%s'\n", name); 674 } 675#endif 676 677 if (ptr) 678 ptr->used = 1; 679 680 return ptr; 681} 682 683static int compatible_revision(const char *name, uint8_t revision, int opt) 684{ 685 struct xt_get_revision rev; 686 socklen_t s = sizeof(rev); 687 int max_rev, sockfd; 688 689 sockfd = socket(afinfo->family, SOCK_RAW, IPPROTO_RAW); 690 if (sockfd < 0) { 691 if (errno == EPERM) { 692 /* revision 0 is always supported. */ 693 if (revision != 0) 694 fprintf(stderr, "Could not determine whether " 695 "revision %u is supported, " 696 "assuming it is.\n", 697 revision); 698 return 1; 699 } 700 fprintf(stderr, "Could not open socket to kernel: %s\n", 701 strerror(errno)); 702 exit(1); 703 } 704 705 if (fcntl(sockfd, F_SETFD, FD_CLOEXEC) == -1) { 706 fprintf(stderr, "Could not set close on exec: %s\n", 707 strerror(errno)); 708 exit(1); 709 } 710 711 xtables_load_ko(xtables_modprobe_program, true); 712 713 strcpy(rev.name, name); 714 rev.revision = revision; 715 716 max_rev = getsockopt(sockfd, afinfo->ipproto, opt, &rev, &s); 717 if (max_rev < 0) { 718 /* Definitely don't support this? */ 719 if (errno == ENOENT || errno == EPROTONOSUPPORT) { 720 close(sockfd); 721 return 0; 722 } else if (errno == ENOPROTOOPT) { 723 close(sockfd); 724 /* Assume only revision 0 support (old kernel) */ 725 return (revision == 0); 726 } else { 727 fprintf(stderr, "getsockopt failed strangely: %s\n", 728 strerror(errno)); 729 exit(1); 730 } 731 } 732 close(sockfd); 733 return 1; 734} 735 736 737static int compatible_match_revision(const char *name, uint8_t revision) 738{ 739 return compatible_revision(name, revision, afinfo->so_rev_match); 740} 741 742static int compatible_target_revision(const char *name, uint8_t revision) 743{ 744 return compatible_revision(name, revision, afinfo->so_rev_target); 745} 746 747static void xtables_check_options(const char *name, const struct option *opt) 748{ 749 for (; opt->name != NULL; ++opt) 750 if (opt->val < 0 || opt->val >= XT_OPTION_OFFSET_SCALE) { 751 fprintf(stderr, "%s: Extension %s uses invalid " 752 "option value %d\n",xt_params->program_name, 753 name, opt->val); 754 exit(1); 755 } 756} 757 758void xtables_register_match(struct xtables_match *me) 759{ 760 struct xtables_match **i, *old; 761 762 if (me->version == NULL) { 763 fprintf(stderr, "%s: match %s<%u> is missing a version\n", 764 xt_params->program_name, me->name, me->revision); 765 exit(1); 766 } 767 if (strcmp(me->version, XTABLES_VERSION) != 0) { 768 fprintf(stderr, "%s: match \"%s\" has version \"%s\", " 769 "but \"%s\" is required.\n", 770 xt_params->program_name, me->name, 771 me->version, XTABLES_VERSION); 772 exit(1); 773 } 774 775 if (strlen(me->name) >= XT_EXTENSION_MAXNAMELEN) { 776 fprintf(stderr, "%s: match `%s' has invalid name\n", 777 xt_params->program_name, me->name); 778 exit(1); 779 } 780 781 if (me->family >= NPROTO) { 782 fprintf(stderr, 783 "%s: BUG: match %s has invalid protocol family\n", 784 xt_params->program_name, me->name); 785 exit(1); 786 } 787 788 if (me->extra_opts != NULL) 789 xtables_check_options(me->name, me->extra_opts); 790 791 /* ignore not interested match */ 792 if (me->family != afinfo->family && me->family != AF_UNSPEC) 793 return; 794 795 old = xtables_find_match(me->name, XTF_DURING_LOAD, NULL); 796 if (old) { 797 if (old->revision == me->revision && 798 old->family == me->family) { 799 fprintf(stderr, 800 "%s: match `%s' already registered.\n", 801 xt_params->program_name, me->name); 802 exit(1); 803 } 804 805 /* Now we have two (or more) options, check compatibility. */ 806 if (compatible_match_revision(old->name, old->revision) 807 && old->revision > me->revision) 808 return; 809 810 /* See if new match can be used. */ 811 if (!compatible_match_revision(me->name, me->revision)) 812 return; 813 814 /* Prefer !AF_UNSPEC over AF_UNSPEC for same revision. */ 815 if (old->revision == me->revision && me->family == AF_UNSPEC) 816 return; 817 818 /* Delete old one. */ 819 for (i = &xtables_matches; *i!=old; i = &(*i)->next); 820 *i = old->next; 821 } 822 823 if (me->size != XT_ALIGN(me->size)) { 824 fprintf(stderr, "%s: match `%s' has invalid size %u.\n", 825 xt_params->program_name, me->name, 826 (unsigned int)me->size); 827 exit(1); 828 } 829 830 /* Append to list. */ 831 for (i = &xtables_matches; *i; i = &(*i)->next); 832 me->next = NULL; 833 *i = me; 834 835 me->m = NULL; 836 me->mflags = 0; 837} 838 839void xtables_register_matches(struct xtables_match *match, unsigned int n) 840{ 841 do { 842 xtables_register_match(&match[--n]); 843 } while (n > 0); 844} 845 846void xtables_register_target(struct xtables_target *me) 847{ 848 struct xtables_target *old; 849 850 if (me->version == NULL) { 851 fprintf(stderr, "%s: target %s<%u> is missing a version\n", 852 xt_params->program_name, me->name, me->revision); 853 exit(1); 854 } 855 if (strcmp(me->version, XTABLES_VERSION) != 0) { 856 fprintf(stderr, "%s: target \"%s\" has version \"%s\", " 857 "but \"%s\" is required.\n", 858 xt_params->program_name, me->name, 859 me->version, XTABLES_VERSION); 860 exit(1); 861 } 862 863 if (strlen(me->name) >= XT_EXTENSION_MAXNAMELEN) { 864 fprintf(stderr, "%s: target `%s' has invalid name\n", 865 xt_params->program_name, me->name); 866 exit(1); 867 } 868 869 if (me->family >= NPROTO) { 870 fprintf(stderr, 871 "%s: BUG: target %s has invalid protocol family\n", 872 xt_params->program_name, me->name); 873 exit(1); 874 } 875 876 if (me->extra_opts != NULL) 877 xtables_check_options(me->name, me->extra_opts); 878 879 /* ignore not interested target */ 880 if (me->family != afinfo->family && me->family != AF_UNSPEC) 881 return; 882 883 old = xtables_find_target(me->name, XTF_DURING_LOAD); 884 if (old) { 885 struct xtables_target **i; 886 887 if (old->revision == me->revision && 888 old->family == me->family) { 889 fprintf(stderr, 890 "%s: target `%s' already registered.\n", 891 xt_params->program_name, me->name); 892 exit(1); 893 } 894 895 /* Now we have two (or more) options, check compatibility. */ 896 if (compatible_target_revision(old->name, old->revision) 897 && old->revision > me->revision) 898 return; 899 900 /* See if new target can be used. */ 901 if (!compatible_target_revision(me->name, me->revision)) 902 return; 903 904 /* Prefer !AF_UNSPEC over AF_UNSPEC for same revision. */ 905 if (old->revision == me->revision && me->family == AF_UNSPEC) 906 return; 907 908 /* Delete old one. */ 909 for (i = &xtables_targets; *i!=old; i = &(*i)->next); 910 *i = old->next; 911 } 912 913 if (me->size != XT_ALIGN(me->size)) { 914 fprintf(stderr, "%s: target `%s' has invalid size %u.\n", 915 xt_params->program_name, me->name, 916 (unsigned int)me->size); 917 exit(1); 918 } 919 920 /* Prepend to list. */ 921 me->next = xtables_targets; 922 xtables_targets = me; 923 me->t = NULL; 924 me->tflags = 0; 925} 926 927void xtables_register_targets(struct xtables_target *target, unsigned int n) 928{ 929 do { 930 xtables_register_target(&target[--n]); 931 } while (n > 0); 932} 933 934/** 935 * xtables_param_act - act on condition 936 * @status: a constant from enum xtables_exittype 937 * 938 * %XTF_ONLY_ONCE: print error message that option may only be used once. 939 * @p1: module name (e.g. "mark") 940 * @p2(...): option in conflict (e.g. "--mark") 941 * @p3(...): condition to match on (see extensions/ for examples) 942 * 943 * %XTF_NO_INVERT: option does not support inversion 944 * @p1: module name 945 * @p2: option in conflict 946 * @p3: condition to match on 947 * 948 * %XTF_BAD_VALUE: bad value for option 949 * @p1: module name 950 * @p2: option with which the problem occured (e.g. "--mark") 951 * @p3: string the user passed in (e.g. "99999999999999") 952 * 953 * %XTF_ONE_ACTION: two mutually exclusive actions have been specified 954 * @p1: module name 955 * 956 * Displays an error message and exits the program. 957 */ 958void xtables_param_act(unsigned int status, const char *p1, ...) 959{ 960 const char *p2, *p3; 961 va_list args; 962 bool b; 963 964 va_start(args, p1); 965 966 switch (status) { 967 case XTF_ONLY_ONCE: 968 p2 = va_arg(args, const char *); 969 b = va_arg(args, unsigned int); 970 if (!b) 971 return; 972 xt_params->exit_err(PARAMETER_PROBLEM, 973 "%s: \"%s\" option may only be specified once", 974 p1, p2); 975 break; 976 case XTF_NO_INVERT: 977 p2 = va_arg(args, const char *); 978 b = va_arg(args, unsigned int); 979 if (!b) 980 return; 981 xt_params->exit_err(PARAMETER_PROBLEM, 982 "%s: \"%s\" option cannot be inverted", p1, p2); 983 break; 984 case XTF_BAD_VALUE: 985 p2 = va_arg(args, const char *); 986 p3 = va_arg(args, const char *); 987 xt_params->exit_err(PARAMETER_PROBLEM, 988 "%s: Bad value for \"%s\" option: \"%s\"", 989 p1, p2, p3); 990 break; 991 case XTF_ONE_ACTION: 992 b = va_arg(args, unsigned int); 993 if (!b) 994 return; 995 xt_params->exit_err(PARAMETER_PROBLEM, 996 "%s: At most one action is possible", p1); 997 break; 998 default: 999 xt_params->exit_err(status, p1, args); 1000 break; 1001 } 1002 1003 va_end(args); 1004} 1005 1006const char *xtables_ipaddr_to_numeric(const struct in_addr *addrp) 1007{ 1008 static char buf[20]; 1009 const unsigned char *bytep = (const void *)&addrp->s_addr; 1010 1011 sprintf(buf, "%u.%u.%u.%u", bytep[0], bytep[1], bytep[2], bytep[3]); 1012 return buf; 1013} 1014 1015static const char *ipaddr_to_host(const struct in_addr *addr) 1016{ 1017 struct hostent *host; 1018 1019 host = gethostbyaddr(addr, sizeof(struct in_addr), AF_INET); 1020 if (host == NULL) 1021 return NULL; 1022 1023 return host->h_name; 1024} 1025 1026static const char *ipaddr_to_network(const struct in_addr *addr) 1027{ 1028 struct netent *net; 1029 1030 if ((net = getnetbyaddr(ntohl(addr->s_addr), AF_INET)) != NULL) 1031 return net->n_name; 1032 1033 return NULL; 1034} 1035 1036const char *xtables_ipaddr_to_anyname(const struct in_addr *addr) 1037{ 1038 const char *name; 1039 1040 if ((name = ipaddr_to_host(addr)) != NULL || 1041 (name = ipaddr_to_network(addr)) != NULL) 1042 return name; 1043 1044 return xtables_ipaddr_to_numeric(addr); 1045} 1046 1047const char *xtables_ipmask_to_numeric(const struct in_addr *mask) 1048{ 1049 static char buf[20]; 1050 uint32_t maskaddr, bits; 1051 int i; 1052 1053 maskaddr = ntohl(mask->s_addr); 1054 1055 if (maskaddr == 0xFFFFFFFFL) 1056 /* we don't want to see "/32" */ 1057 return ""; 1058 1059 i = 32; 1060 bits = 0xFFFFFFFEL; 1061 while (--i >= 0 && maskaddr != bits) 1062 bits <<= 1; 1063 if (i >= 0) 1064 sprintf(buf, "/%d", i); 1065 else 1066 /* mask was not a decent combination of 1's and 0's */ 1067 sprintf(buf, "/%s", xtables_ipaddr_to_numeric(mask)); 1068 1069 return buf; 1070} 1071 1072static struct in_addr *__numeric_to_ipaddr(const char *dotted, bool is_mask) 1073{ 1074 static struct in_addr addr; 1075 unsigned char *addrp; 1076 unsigned int onebyte; 1077 char buf[20], *p, *q; 1078 int i; 1079 1080 /* copy dotted string, because we need to modify it */ 1081 strncpy(buf, dotted, sizeof(buf) - 1); 1082 buf[sizeof(buf) - 1] = '\0'; 1083 addrp = (void *)&addr.s_addr; 1084 1085 p = buf; 1086 for (i = 0; i < 3; ++i) { 1087 if ((q = strchr(p, '.')) == NULL) { 1088 if (is_mask) 1089 return NULL; 1090 1091 /* autocomplete, this is a network address */ 1092 if (!xtables_strtoui(p, NULL, &onebyte, 0, UINT8_MAX)) 1093 return NULL; 1094 1095 addrp[i] = onebyte; 1096 while (i < 3) 1097 addrp[++i] = 0; 1098 1099 return &addr; 1100 } 1101 1102 *q = '\0'; 1103 if (!xtables_strtoui(p, NULL, &onebyte, 0, UINT8_MAX)) 1104 return NULL; 1105 1106 addrp[i] = onebyte; 1107 p = q + 1; 1108 } 1109 1110 /* we have checked 3 bytes, now we check the last one */ 1111 if (!xtables_strtoui(p, NULL, &onebyte, 0, UINT8_MAX)) 1112 return NULL; 1113 1114 addrp[3] = onebyte; 1115 return &addr; 1116} 1117 1118struct in_addr *xtables_numeric_to_ipaddr(const char *dotted) 1119{ 1120 return __numeric_to_ipaddr(dotted, false); 1121} 1122 1123struct in_addr *xtables_numeric_to_ipmask(const char *dotted) 1124{ 1125 return __numeric_to_ipaddr(dotted, true); 1126} 1127 1128static struct in_addr *network_to_ipaddr(const char *name) 1129{ 1130 static struct in_addr addr; 1131 struct netent *net; 1132 1133 if ((net = getnetbyname(name)) != NULL) { 1134 if (net->n_addrtype != AF_INET) 1135 return NULL; 1136 addr.s_addr = htonl(net->n_net); 1137 return &addr; 1138 } 1139 1140 return NULL; 1141} 1142 1143static struct in_addr *host_to_ipaddr(const char *name, unsigned int *naddr) 1144{ 1145 struct hostent *host; 1146 struct in_addr *addr; 1147 unsigned int i; 1148 1149 *naddr = 0; 1150 if ((host = gethostbyname(name)) != NULL) { 1151 if (host->h_addrtype != AF_INET || 1152 host->h_length != sizeof(struct in_addr)) 1153 return NULL; 1154 1155 while (host->h_addr_list[*naddr] != NULL) 1156 ++*naddr; 1157 addr = xtables_calloc(*naddr, sizeof(struct in_addr)); 1158 for (i = 0; i < *naddr; i++) 1159 memcpy(&addr[i], host->h_addr_list[i], 1160 sizeof(struct in_addr)); 1161 return addr; 1162 } 1163 1164 return NULL; 1165} 1166 1167static struct in_addr * 1168ipparse_hostnetwork(const char *name, unsigned int *naddrs) 1169{ 1170 struct in_addr *addrptmp, *addrp; 1171 1172 if ((addrptmp = xtables_numeric_to_ipaddr(name)) != NULL || 1173 (addrptmp = network_to_ipaddr(name)) != NULL) { 1174 addrp = xtables_malloc(sizeof(struct in_addr)); 1175 memcpy(addrp, addrptmp, sizeof(*addrp)); 1176 *naddrs = 1; 1177 return addrp; 1178 } 1179 if ((addrptmp = host_to_ipaddr(name, naddrs)) != NULL) 1180 return addrptmp; 1181 1182 xt_params->exit_err(PARAMETER_PROBLEM, "host/network `%s' not found", name); 1183} 1184 1185static struct in_addr *parse_ipmask(const char *mask) 1186{ 1187 static struct in_addr maskaddr; 1188 struct in_addr *addrp; 1189 unsigned int bits; 1190 1191 if (mask == NULL) { 1192 /* no mask at all defaults to 32 bits */ 1193 maskaddr.s_addr = 0xFFFFFFFF; 1194 return &maskaddr; 1195 } 1196 if ((addrp = xtables_numeric_to_ipmask(mask)) != NULL) 1197 /* dotted_to_addr already returns a network byte order addr */ 1198 return addrp; 1199 if (!xtables_strtoui(mask, NULL, &bits, 0, 32)) 1200 xt_params->exit_err(PARAMETER_PROBLEM, 1201 "invalid mask `%s' specified", mask); 1202 if (bits != 0) { 1203 maskaddr.s_addr = htonl(0xFFFFFFFF << (32 - bits)); 1204 return &maskaddr; 1205 } 1206 1207 maskaddr.s_addr = 0U; 1208 return &maskaddr; 1209} 1210 1211void xtables_ipparse_multiple(const char *name, struct in_addr **addrpp, 1212 struct in_addr **maskpp, unsigned int *naddrs) 1213{ 1214 struct in_addr *addrp; 1215 char buf[256], *p; 1216 unsigned int len, i, j, n, count = 1; 1217 const char *loop = name; 1218 1219 while ((loop = strchr(loop, ',')) != NULL) { 1220 ++count; 1221 ++loop; /* skip ',' */ 1222 } 1223 1224 *addrpp = xtables_malloc(sizeof(struct in_addr) * count); 1225 *maskpp = xtables_malloc(sizeof(struct in_addr) * count); 1226 1227 loop = name; 1228 1229 for (i = 0; i < count; ++i) { 1230 if (loop == NULL) 1231 break; 1232 if (*loop == ',') 1233 ++loop; 1234 if (*loop == '\0') 1235 break; 1236 p = strchr(loop, ','); 1237 if (p != NULL) 1238 len = p - loop; 1239 else 1240 len = strlen(loop); 1241 if (len == 0 || sizeof(buf) - 1 < len) 1242 break; 1243 1244 strncpy(buf, loop, len); 1245 buf[len] = '\0'; 1246 loop += len; 1247 if ((p = strrchr(buf, '/')) != NULL) { 1248 *p = '\0'; 1249 addrp = parse_ipmask(p + 1); 1250 } else { 1251 addrp = parse_ipmask(NULL); 1252 } 1253 memcpy(*maskpp + i, addrp, sizeof(*addrp)); 1254 1255 /* if a null mask is given, the name is ignored, like in "any/0" */ 1256 if ((*maskpp + i)->s_addr == 0) 1257 /* 1258 * A bit pointless to process multiple addresses 1259 * in this case... 1260 */ 1261 strcpy(buf, "0.0.0.0"); 1262 1263 addrp = ipparse_hostnetwork(buf, &n); 1264 if (n > 1) { 1265 count += n - 1; 1266 *addrpp = xtables_realloc(*addrpp, 1267 sizeof(struct in_addr) * count); 1268 *maskpp = xtables_realloc(*maskpp, 1269 sizeof(struct in_addr) * count); 1270 for (j = 0; j < n; ++j) 1271 /* for each new addr */ 1272 memcpy(*addrpp + i + j, addrp + j, 1273 sizeof(*addrp)); 1274 for (j = 1; j < n; ++j) 1275 /* for each new mask */ 1276 memcpy(*maskpp + i + j, *maskpp + i, 1277 sizeof(*addrp)); 1278 i += n - 1; 1279 } else { 1280 memcpy(*addrpp + i, addrp, sizeof(*addrp)); 1281 } 1282 /* free what ipparse_hostnetwork had allocated: */ 1283 free(addrp); 1284 } 1285 *naddrs = count; 1286 for (i = 0; i < count; ++i) 1287 (*addrpp+i)->s_addr &= (*maskpp+i)->s_addr; 1288} 1289 1290 1291/** 1292 * xtables_ipparse_any - transform arbitrary name to in_addr 1293 * 1294 * Possible inputs (pseudo regex): 1295 * m{^($hostname|$networkname|$ipaddr)(/$mask)?} 1296 * "1.2.3.4/5", "1.2.3.4", "hostname", "networkname" 1297 */ 1298void xtables_ipparse_any(const char *name, struct in_addr **addrpp, 1299 struct in_addr *maskp, unsigned int *naddrs) 1300{ 1301 unsigned int i, j, k, n; 1302 struct in_addr *addrp; 1303 char buf[256], *p; 1304 1305 strncpy(buf, name, sizeof(buf) - 1); 1306 buf[sizeof(buf) - 1] = '\0'; 1307 if ((p = strrchr(buf, '/')) != NULL) { 1308 *p = '\0'; 1309 addrp = parse_ipmask(p + 1); 1310 } else { 1311 addrp = parse_ipmask(NULL); 1312 } 1313 memcpy(maskp, addrp, sizeof(*maskp)); 1314 1315 /* if a null mask is given, the name is ignored, like in "any/0" */ 1316 if (maskp->s_addr == 0U) 1317 strcpy(buf, "0.0.0.0"); 1318 1319 addrp = *addrpp = ipparse_hostnetwork(buf, naddrs); 1320 n = *naddrs; 1321 for (i = 0, j = 0; i < n; ++i) { 1322 addrp[j++].s_addr &= maskp->s_addr; 1323 for (k = 0; k < j - 1; ++k) 1324 if (addrp[k].s_addr == addrp[j-1].s_addr) { 1325 /* 1326 * Nuke the dup by copying an address from the 1327 * tail here, and check the current position 1328 * again (--j). 1329 */ 1330 memcpy(&addrp[--j], &addrp[--*naddrs], 1331 sizeof(struct in_addr)); 1332 break; 1333 } 1334 } 1335} 1336 1337const char *xtables_ip6addr_to_numeric(const struct in6_addr *addrp) 1338{ 1339 /* 0000:0000:0000:0000:0000:000.000.000.000 1340 * 0000:0000:0000:0000:0000:0000:0000:0000 */ 1341 static char buf[50+1]; 1342 return inet_ntop(AF_INET6, addrp, buf, sizeof(buf)); 1343} 1344 1345static const char *ip6addr_to_host(const struct in6_addr *addr) 1346{ 1347 static char hostname[NI_MAXHOST]; 1348 struct sockaddr_in6 saddr; 1349 int err; 1350 1351 memset(&saddr, 0, sizeof(struct sockaddr_in6)); 1352 memcpy(&saddr.sin6_addr, addr, sizeof(*addr)); 1353 saddr.sin6_family = AF_INET6; 1354 1355 err = getnameinfo((const void *)&saddr, sizeof(struct sockaddr_in6), 1356 hostname, sizeof(hostname) - 1, NULL, 0, 0); 1357 if (err != 0) { 1358#ifdef DEBUG 1359 fprintf(stderr,"IP2Name: %s\n",gai_strerror(err)); 1360#endif 1361 return NULL; 1362 } 1363 1364#ifdef DEBUG 1365 fprintf (stderr, "\naddr2host: %s\n", hostname); 1366#endif 1367 return hostname; 1368} 1369 1370const char *xtables_ip6addr_to_anyname(const struct in6_addr *addr) 1371{ 1372 const char *name; 1373 1374 if ((name = ip6addr_to_host(addr)) != NULL) 1375 return name; 1376 1377 return xtables_ip6addr_to_numeric(addr); 1378} 1379 1380static int ip6addr_prefix_length(const struct in6_addr *k) 1381{ 1382 unsigned int bits = 0; 1383 uint32_t a, b, c, d; 1384 1385 a = ntohl(k->s6_addr32[0]); 1386 b = ntohl(k->s6_addr32[1]); 1387 c = ntohl(k->s6_addr32[2]); 1388 d = ntohl(k->s6_addr32[3]); 1389 while (a & 0x80000000U) { 1390 ++bits; 1391 a <<= 1; 1392 a |= (b >> 31) & 1; 1393 b <<= 1; 1394 b |= (c >> 31) & 1; 1395 c <<= 1; 1396 c |= (d >> 31) & 1; 1397 d <<= 1; 1398 } 1399 if (a != 0 || b != 0 || c != 0 || d != 0) 1400 return -1; 1401 return bits; 1402} 1403 1404const char *xtables_ip6mask_to_numeric(const struct in6_addr *addrp) 1405{ 1406 static char buf[50+2]; 1407 int l = ip6addr_prefix_length(addrp); 1408 1409 if (l == -1) { 1410 strcpy(buf, "/"); 1411 strcat(buf, xtables_ip6addr_to_numeric(addrp)); 1412 return buf; 1413 } 1414 sprintf(buf, "/%d", l); 1415 return buf; 1416} 1417 1418struct in6_addr *xtables_numeric_to_ip6addr(const char *num) 1419{ 1420 static struct in6_addr ap; 1421 int err; 1422 1423 if ((err = inet_pton(AF_INET6, num, &ap)) == 1) 1424 return ≈ 1425#ifdef DEBUG 1426 fprintf(stderr, "\nnumeric2addr: %d\n", err); 1427#endif 1428 return NULL; 1429} 1430 1431static struct in6_addr * 1432host_to_ip6addr(const char *name, unsigned int *naddr) 1433{ 1434 struct in6_addr *addr; 1435 struct addrinfo hints; 1436 struct addrinfo *res, *p; 1437 int err; 1438 unsigned int i; 1439 1440 memset(&hints, 0, sizeof(hints)); 1441 hints.ai_flags = AI_CANONNAME; 1442 hints.ai_family = AF_INET6; 1443 hints.ai_socktype = SOCK_RAW; 1444 1445 *naddr = 0; 1446 if ((err = getaddrinfo(name, NULL, &hints, &res)) != 0) { 1447#ifdef DEBUG 1448 fprintf(stderr,"Name2IP: %s\n",gai_strerror(err)); 1449#endif 1450 return NULL; 1451 } else { 1452 /* Find length of address chain */ 1453 for (p = res; p != NULL; p = p->ai_next) 1454 ++*naddr; 1455#ifdef DEBUG 1456 fprintf(stderr, "resolved: len=%d %s ", res->ai_addrlen, 1457 xtables_ip6addr_to_numeric(&((struct sockaddr_in6 *)res->ai_addr)->sin6_addr)); 1458#endif 1459 /* Copy each element of the address chain */ 1460 addr = xtables_calloc(*naddr, sizeof(struct in6_addr)); 1461 for (i = 0, p = res; p != NULL; p = p->ai_next) 1462 memcpy(&addr[i++], 1463 &((const struct sockaddr_in6 *)p->ai_addr)->sin6_addr, 1464 sizeof(struct in6_addr)); 1465 freeaddrinfo(res); 1466 return addr; 1467 } 1468 1469 return NULL; 1470} 1471 1472static struct in6_addr *network_to_ip6addr(const char *name) 1473{ 1474 /* abort();*/ 1475 /* TODO: not implemented yet, but the exception breaks the 1476 * name resolvation */ 1477 return NULL; 1478} 1479 1480static struct in6_addr * 1481ip6parse_hostnetwork(const char *name, unsigned int *naddrs) 1482{ 1483 struct in6_addr *addrp, *addrptmp; 1484 1485 if ((addrptmp = xtables_numeric_to_ip6addr(name)) != NULL || 1486 (addrptmp = network_to_ip6addr(name)) != NULL) { 1487 addrp = xtables_malloc(sizeof(struct in6_addr)); 1488 memcpy(addrp, addrptmp, sizeof(*addrp)); 1489 *naddrs = 1; 1490 return addrp; 1491 } 1492 if ((addrp = host_to_ip6addr(name, naddrs)) != NULL) 1493 return addrp; 1494 1495 xt_params->exit_err(PARAMETER_PROBLEM, "host/network `%s' not found", name); 1496} 1497 1498static struct in6_addr *parse_ip6mask(char *mask) 1499{ 1500 static struct in6_addr maskaddr; 1501 struct in6_addr *addrp; 1502 unsigned int bits; 1503 1504 if (mask == NULL) { 1505 /* no mask at all defaults to 128 bits */ 1506 memset(&maskaddr, 0xff, sizeof maskaddr); 1507 return &maskaddr; 1508 } 1509 if ((addrp = xtables_numeric_to_ip6addr(mask)) != NULL) 1510 return addrp; 1511 if (!xtables_strtoui(mask, NULL, &bits, 0, 128)) 1512 xt_params->exit_err(PARAMETER_PROBLEM, 1513 "invalid mask `%s' specified", mask); 1514 if (bits != 0) { 1515 char *p = (void *)&maskaddr; 1516 memset(p, 0xff, bits / 8); 1517 memset(p + (bits / 8) + 1, 0, (128 - bits) / 8); 1518 p[bits/8] = 0xff << (8 - (bits & 7)); 1519 return &maskaddr; 1520 } 1521 1522 memset(&maskaddr, 0, sizeof(maskaddr)); 1523 return &maskaddr; 1524} 1525 1526void 1527xtables_ip6parse_multiple(const char *name, struct in6_addr **addrpp, 1528 struct in6_addr **maskpp, unsigned int *naddrs) 1529{ 1530 static const struct in6_addr zero_addr; 1531 struct in6_addr *addrp; 1532 char buf[256], *p; 1533 unsigned int len, i, j, n, count = 1; 1534 const char *loop = name; 1535 1536 while ((loop = strchr(loop, ',')) != NULL) { 1537 ++count; 1538 ++loop; /* skip ',' */ 1539 } 1540 1541 *addrpp = xtables_malloc(sizeof(struct in6_addr) * count); 1542 *maskpp = xtables_malloc(sizeof(struct in6_addr) * count); 1543 1544 loop = name; 1545 1546 for (i = 0; i < count /*NB: count can grow*/; ++i) { 1547 if (loop == NULL) 1548 break; 1549 if (*loop == ',') 1550 ++loop; 1551 if (*loop == '\0') 1552 break; 1553 p = strchr(loop, ','); 1554 if (p != NULL) 1555 len = p - loop; 1556 else 1557 len = strlen(loop); 1558 if (len == 0 || sizeof(buf) - 1 < len) 1559 break; 1560 1561 strncpy(buf, loop, len); 1562 buf[len] = '\0'; 1563 loop += len; 1564 if ((p = strrchr(buf, '/')) != NULL) { 1565 *p = '\0'; 1566 addrp = parse_ip6mask(p + 1); 1567 } else { 1568 addrp = parse_ip6mask(NULL); 1569 } 1570 memcpy(*maskpp + i, addrp, sizeof(*addrp)); 1571 1572 /* if a null mask is given, the name is ignored, like in "any/0" */ 1573 if (memcmp(*maskpp + i, &zero_addr, sizeof(zero_addr)) == 0) 1574 strcpy(buf, "::"); 1575 1576 addrp = ip6parse_hostnetwork(buf, &n); 1577 if (n > 1) { 1578 count += n - 1; 1579 *addrpp = xtables_realloc(*addrpp, 1580 sizeof(struct in6_addr) * count); 1581 *maskpp = xtables_realloc(*maskpp, 1582 sizeof(struct in6_addr) * count); 1583 for (j = 0; j < n; ++j) 1584 /* for each new addr */ 1585 memcpy(*addrpp + i + j, addrp + j, 1586 sizeof(*addrp)); 1587 for (j = 1; j < n; ++j) 1588 /* for each new mask */ 1589 memcpy(*maskpp + i + j, *maskpp + i, 1590 sizeof(*addrp)); 1591 i += n - 1; 1592 } else { 1593 memcpy(*addrpp + i, addrp, sizeof(*addrp)); 1594 } 1595 /* free what ip6parse_hostnetwork had allocated: */ 1596 free(addrp); 1597 } 1598 *naddrs = count; 1599 for (i = 0; i < count; ++i) 1600 for (j = 0; j < 4; ++j) 1601 (*addrpp+i)->s6_addr32[j] &= (*maskpp+i)->s6_addr32[j]; 1602} 1603 1604void xtables_ip6parse_any(const char *name, struct in6_addr **addrpp, 1605 struct in6_addr *maskp, unsigned int *naddrs) 1606{ 1607 static const struct in6_addr zero_addr; 1608 struct in6_addr *addrp; 1609 unsigned int i, j, k, n; 1610 char buf[256], *p; 1611 1612 strncpy(buf, name, sizeof(buf) - 1); 1613 buf[sizeof(buf)-1] = '\0'; 1614 if ((p = strrchr(buf, '/')) != NULL) { 1615 *p = '\0'; 1616 addrp = parse_ip6mask(p + 1); 1617 } else { 1618 addrp = parse_ip6mask(NULL); 1619 } 1620 memcpy(maskp, addrp, sizeof(*maskp)); 1621 1622 /* if a null mask is given, the name is ignored, like in "any/0" */ 1623 if (memcmp(maskp, &zero_addr, sizeof(zero_addr)) == 0) 1624 strcpy(buf, "::"); 1625 1626 addrp = *addrpp = ip6parse_hostnetwork(buf, naddrs); 1627 n = *naddrs; 1628 for (i = 0, j = 0; i < n; ++i) { 1629 for (k = 0; k < 4; ++k) 1630 addrp[j].s6_addr32[k] &= maskp->s6_addr32[k]; 1631 ++j; 1632 for (k = 0; k < j - 1; ++k) 1633 if (IN6_ARE_ADDR_EQUAL(&addrp[k], &addrp[j - 1])) { 1634 /* 1635 * Nuke the dup by copying an address from the 1636 * tail here, and check the current position 1637 * again (--j). 1638 */ 1639 memcpy(&addrp[--j], &addrp[--*naddrs], 1640 sizeof(struct in_addr)); 1641 break; 1642 } 1643 } 1644} 1645 1646void xtables_save_string(const char *value) 1647{ 1648 static const char no_quote_chars[] = "_-0123456789" 1649 "abcdefghijklmnopqrstuvwxyz" 1650 "ABCDEFGHIJKLMNOPQRSTUVWXYZ"; 1651 static const char escape_chars[] = "\"\\'"; 1652 size_t length; 1653 const char *p; 1654 1655 length = strspn(value, no_quote_chars); 1656 if (length > 0 && value[length] == 0) { 1657 /* no quoting required */ 1658 putchar(' '); 1659 fputs(value, stdout); 1660 } else { 1661 /* there is at least one dangerous character in the 1662 value, which we have to quote. Write double quotes 1663 around the value and escape special characters with 1664 a backslash */ 1665 printf(" \""); 1666 1667 for (p = strpbrk(value, escape_chars); p != NULL; 1668 p = strpbrk(value, escape_chars)) { 1669 if (p > value) 1670 fwrite(value, 1, p - value, stdout); 1671 putchar('\\'); 1672 putchar(*p); 1673 value = p + 1; 1674 } 1675 1676 /* print the rest and finish the double quoted 1677 string */ 1678 fputs(value, stdout); 1679 putchar('\"'); 1680 } 1681} 1682 1683/** 1684 * Check for option-intrapositional negation. 1685 * Do not use in new code. 1686 */ 1687int xtables_check_inverse(const char option[], int *invert, 1688 int *my_optind, int argc, char **argv) 1689{ 1690 if (option == NULL || strcmp(option, "!") != 0) 1691 return false; 1692 1693 fprintf(stderr, "Using intrapositioned negation " 1694 "(`--option ! this`) is deprecated in favor of " 1695 "extrapositioned (`! --option this`).\n"); 1696 1697 if (*invert) 1698 xt_params->exit_err(PARAMETER_PROBLEM, 1699 "Multiple `!' flags not allowed"); 1700 *invert = true; 1701 if (my_optind != NULL) { 1702 optarg = argv[*my_optind]; 1703 ++*my_optind; 1704 if (argc && *my_optind > argc) 1705 xt_params->exit_err(PARAMETER_PROBLEM, 1706 "no argument following `!'"); 1707 } 1708 1709 return true; 1710} 1711 1712const struct xtables_pprot xtables_chain_protos[] = { 1713 {"tcp", IPPROTO_TCP}, 1714 {"sctp", IPPROTO_SCTP}, 1715 {"udp", IPPROTO_UDP}, 1716 {"udplite", IPPROTO_UDPLITE}, 1717 {"icmp", IPPROTO_ICMP}, 1718 {"icmpv6", IPPROTO_ICMPV6}, 1719 {"ipv6-icmp", IPPROTO_ICMPV6}, 1720 {"esp", IPPROTO_ESP}, 1721 {"ah", IPPROTO_AH}, 1722 {"ipv6-mh", IPPROTO_MH}, 1723 {"mh", IPPROTO_MH}, 1724 {"all", 0}, 1725 {NULL}, 1726}; 1727 1728uint16_t 1729xtables_parse_protocol(const char *s) 1730{ 1731 unsigned int proto; 1732 1733 if (!xtables_strtoui(s, NULL, &proto, 0, UINT8_MAX)) { 1734 struct protoent *pent; 1735 1736 /* first deal with the special case of 'all' to prevent 1737 * people from being able to redefine 'all' in nsswitch 1738 * and/or provoke expensive [not working] ldap/nis/... 1739 * lookups */ 1740 if (!strcmp(s, "all")) 1741 return 0; 1742 1743 if ((pent = getprotobyname(s))) 1744 proto = pent->p_proto; 1745 else { 1746 unsigned int i; 1747 for (i = 0; i < ARRAY_SIZE(xtables_chain_protos); ++i) { 1748 if (xtables_chain_protos[i].name == NULL) 1749 continue; 1750 1751 if (strcmp(s, xtables_chain_protos[i].name) == 0) { 1752 proto = xtables_chain_protos[i].num; 1753 break; 1754 } 1755 } 1756 if (i == ARRAY_SIZE(xtables_chain_protos)) 1757 xt_params->exit_err(PARAMETER_PROBLEM, 1758 "unknown protocol `%s' specified", 1759 s); 1760 } 1761 } 1762 1763 return proto; 1764} 1765