xtables.c revision c19f880d8aac7c0372381e29d7cea09accd0db26
1/* 2 * (C) 2000-2006 by the netfilter coreteam <coreteam@netfilter.org>: 3 * 4 * This program is free software; you can redistribute it and/or modify 5 * it under the terms of the GNU General Public License as published by 6 * the Free Software Foundation; either version 2 of the License, or 7 * (at your option) any later version. 8 * 9 * This program is distributed in the hope that it will be useful, 10 * but WITHOUT ANY WARRANTY; without even the implied warranty of 11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 12 * GNU General Public License for more details. 13 * 14 * You should have received a copy of the GNU General Public License 15 * along with this program; if not, write to the Free Software 16 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. 17 */ 18 19#include <errno.h> 20#include <fcntl.h> 21#include <netdb.h> 22#include <stdarg.h> 23#include <stdbool.h> 24#include <stdio.h> 25#include <stdlib.h> 26#include <string.h> 27#include <unistd.h> 28#include <sys/socket.h> 29#include <sys/stat.h> 30#include <sys/types.h> 31#include <sys/wait.h> 32#include <arpa/inet.h> 33 34#include <xtables.h> 35#include <linux/netfilter_ipv4/ip_tables.h> 36#include <linux/netfilter_ipv6/ip6_tables.h> 37#include <libiptc/libxtc.h> 38 39#ifndef NO_SHARED_LIBS 40#include <dlfcn.h> 41#endif 42#ifndef IPT_SO_GET_REVISION_MATCH /* Old kernel source. */ 43# define IPT_SO_GET_REVISION_MATCH (IPT_BASE_CTL + 2) 44# define IPT_SO_GET_REVISION_TARGET (IPT_BASE_CTL + 3) 45#endif 46#ifndef IP6T_SO_GET_REVISION_MATCH /* Old kernel source. */ 47# define IP6T_SO_GET_REVISION_MATCH 68 48# define IP6T_SO_GET_REVISION_TARGET 69 49#endif 50 51 52#define NPROTO 255 53 54#ifndef PROC_SYS_MODPROBE 55#define PROC_SYS_MODPROBE "/proc/sys/kernel/modprobe" 56#endif 57 58void basic_exit_err(enum xtables_exittype status, const char *msg, ...) __attribute__((noreturn, format(printf,2,3))); 59 60struct xtables_globals *xt_params = NULL; 61 62void basic_exit_err(enum xtables_exittype status, const char *msg, ...) 63{ 64 va_list args; 65 66 va_start(args, msg); 67 fprintf(stderr, "%s v%s: ", xt_params->program_name, xt_params->program_version); 68 vfprintf(stderr, msg, args); 69 va_end(args); 70 fprintf(stderr, "\n"); 71 exit(status); 72} 73 74 75/** 76 * xtables_set_params - set the global parameters used by xtables 77 * @xtp: input xtables_globals structure 78 * 79 * The app is expected to pass a valid xtables_globals data-filled 80 * with proper values 81 * @xtp cannot be NULL 82 * 83 * Returns -1 on failure to set and 0 on success 84 */ 85int xtables_set_params(struct xtables_globals *xtp) 86{ 87 if (!xtp) { 88 fprintf(stderr, "%s: Illegal global params\n",__func__); 89 return -1; 90 } 91 92 xt_params = xtp; 93 94 if (!xt_params->exit_err) 95 xt_params->exit_err = basic_exit_err; 96 97 return 0; 98} 99 100void xtables_free_opts(int reset_offset, struct option *original_opts) 101{ 102 if (xt_params->opts != original_opts) { 103 if (original_opts) 104 free(xt_params->opts); 105 xt_params->opts = original_opts; 106 if (reset_offset) 107 xt_params->option_offset = 0; 108 } 109} 110 111/** 112 * xtables_afinfo - protocol family dependent information 113 * @kmod: kernel module basename (e.g. "ip_tables") 114 * @libprefix: prefix of .so library name (e.g. "libipt_") 115 * @family: nfproto family 116 * @ipproto: used by setsockopt (e.g. IPPROTO_IP) 117 * @so_rev_match: optname to check revision support of match 118 * @so_rev_target: optname to check revision support of target 119 */ 120struct xtables_afinfo { 121 const char *kmod; 122 const char *libprefix; 123 uint8_t family; 124 uint8_t ipproto; 125 int so_rev_match; 126 int so_rev_target; 127}; 128 129static const struct xtables_afinfo afinfo_ipv4 = { 130 .kmod = "ip_tables", 131 .libprefix = "libipt_", 132 .family = NFPROTO_IPV4, 133 .ipproto = IPPROTO_IP, 134 .so_rev_match = IPT_SO_GET_REVISION_MATCH, 135 .so_rev_target = IPT_SO_GET_REVISION_TARGET, 136}; 137 138static const struct xtables_afinfo afinfo_ipv6 = { 139 .kmod = "ip6_tables", 140 .libprefix = "libip6t_", 141 .family = NFPROTO_IPV6, 142 .ipproto = IPPROTO_IPV6, 143 .so_rev_match = IP6T_SO_GET_REVISION_MATCH, 144 .so_rev_target = IP6T_SO_GET_REVISION_TARGET, 145}; 146 147static const struct xtables_afinfo *afinfo; 148 149/** 150 * Program will set this to its own name. 151 */ 152const char *xtables_program_name; 153 154/* Search path for Xtables .so files */ 155static const char *xtables_libdir; 156 157/* the path to command to load kernel module */ 158const char *xtables_modprobe_program; 159 160/* Keeping track of external matches and targets: linked lists. */ 161struct xtables_match *xtables_matches; 162struct xtables_target *xtables_targets; 163 164void xtables_init(void) 165{ 166 xtables_libdir = getenv("XTABLES_LIBDIR"); 167 if (xtables_libdir != NULL) 168 return; 169 xtables_libdir = getenv("IPTABLES_LIB_DIR"); 170 if (xtables_libdir != NULL) { 171 fprintf(stderr, "IPTABLES_LIB_DIR is deprecated, " 172 "use XTABLES_LIBDIR.\n"); 173 return; 174 } 175 /* 176 * Well yes, IP6TABLES_LIB_DIR is of lower priority over 177 * IPTABLES_LIB_DIR since this moved to libxtables; I think that is ok 178 * for these env vars are deprecated anyhow, and in light of the 179 * (shared) libxt_*.so files, makes less sense to have 180 * IPTABLES_LIB_DIR != IP6TABLES_LIB_DIR. 181 */ 182 xtables_libdir = getenv("IP6TABLES_LIB_DIR"); 183 if (xtables_libdir != NULL) { 184 fprintf(stderr, "IP6TABLES_LIB_DIR is deprecated, " 185 "use XTABLES_LIBDIR.\n"); 186 return; 187 } 188 xtables_libdir = XTABLES_LIBDIR; 189} 190 191void xtables_set_nfproto(uint8_t nfproto) 192{ 193 switch (nfproto) { 194 case NFPROTO_IPV4: 195 afinfo = &afinfo_ipv4; 196 break; 197 case NFPROTO_IPV6: 198 afinfo = &afinfo_ipv6; 199 break; 200 default: 201 fprintf(stderr, "libxtables: unhandled NFPROTO in %s\n", 202 __func__); 203 } 204} 205 206/** 207 * xtables_*alloc - wrappers that exit on failure 208 */ 209void *xtables_calloc(size_t count, size_t size) 210{ 211 void *p; 212 213 if ((p = calloc(count, size)) == NULL) { 214 perror("ip[6]tables: calloc failed"); 215 exit(1); 216 } 217 218 return p; 219} 220 221void *xtables_malloc(size_t size) 222{ 223 void *p; 224 225 if ((p = malloc(size)) == NULL) { 226 perror("ip[6]tables: malloc failed"); 227 exit(1); 228 } 229 230 return p; 231} 232 233static char *get_modprobe(void) 234{ 235 int procfile; 236 char *ret; 237 238#define PROCFILE_BUFSIZ 1024 239 procfile = open(PROC_SYS_MODPROBE, O_RDONLY); 240 if (procfile < 0) 241 return NULL; 242 243 ret = (char *) malloc(PROCFILE_BUFSIZ); 244 if (ret) { 245 memset(ret, 0, PROCFILE_BUFSIZ); 246 switch (read(procfile, ret, PROCFILE_BUFSIZ)) { 247 case -1: goto fail; 248 case PROCFILE_BUFSIZ: goto fail; /* Partial read. Wierd */ 249 } 250 if (ret[strlen(ret)-1]=='\n') 251 ret[strlen(ret)-1]=0; 252 close(procfile); 253 return ret; 254 } 255 fail: 256 free(ret); 257 close(procfile); 258 return NULL; 259} 260 261int xtables_insmod(const char *modname, const char *modprobe, bool quiet) 262{ 263 char *buf = NULL; 264 char *argv[4]; 265 int status; 266 267 /* If they don't explicitly set it, read out of kernel */ 268 if (!modprobe) { 269 buf = get_modprobe(); 270 if (!buf) 271 return -1; 272 modprobe = buf; 273 } 274 275 /* 276 * Need to flush the buffer, or the child may output it again 277 * when switching the program thru execv. 278 */ 279 fflush(stdout); 280 281 switch (fork()) { 282 case 0: 283 argv[0] = (char *)modprobe; 284 argv[1] = (char *)modname; 285 if (quiet) { 286 argv[2] = "-q"; 287 argv[3] = NULL; 288 } else { 289 argv[2] = NULL; 290 argv[3] = NULL; 291 } 292 execv(argv[0], argv); 293 294 /* not usually reached */ 295 exit(1); 296 case -1: 297 return -1; 298 299 default: /* parent */ 300 wait(&status); 301 } 302 303 free(buf); 304 if (WIFEXITED(status) && WEXITSTATUS(status) == 0) 305 return 0; 306 return -1; 307} 308 309int xtables_load_ko(const char *modprobe, bool quiet) 310{ 311 static bool loaded = false; 312 static int ret = -1; 313 314 if (!loaded) { 315 ret = xtables_insmod(afinfo->kmod, modprobe, quiet); 316 loaded = (ret == 0); 317 } 318 319 return ret; 320} 321 322/** 323 * xtables_strtou{i,l} - string to number conversion 324 * @s: input string 325 * @end: like strtoul's "end" pointer 326 * @value: pointer for result 327 * @min: minimum accepted value 328 * @max: maximum accepted value 329 * 330 * If @end is NULL, we assume the caller wants a "strict strtoul", and hence 331 * "15a" is rejected. 332 * In either case, the value obtained is compared for min-max compliance. 333 * Base is always 0, i.e. autodetect depending on @s. 334 * 335 * Returns true/false whether number was accepted. On failure, *value has 336 * undefined contents. 337 */ 338bool xtables_strtoul(const char *s, char **end, unsigned long *value, 339 unsigned long min, unsigned long max) 340{ 341 unsigned long v; 342 char *my_end; 343 344 errno = 0; 345 v = strtoul(s, &my_end, 0); 346 347 if (my_end == s) 348 return false; 349 if (end != NULL) 350 *end = my_end; 351 352 if (errno != ERANGE && min <= v && (max == 0 || v <= max)) { 353 if (value != NULL) 354 *value = v; 355 if (end == NULL) 356 return *my_end == '\0'; 357 return true; 358 } 359 360 return false; 361} 362 363bool xtables_strtoui(const char *s, char **end, unsigned int *value, 364 unsigned int min, unsigned int max) 365{ 366 unsigned long v; 367 bool ret; 368 369 ret = xtables_strtoul(s, end, &v, min, max); 370 if (value != NULL) 371 *value = v; 372 return ret; 373} 374 375int xtables_service_to_port(const char *name, const char *proto) 376{ 377 struct servent *service; 378 379 if ((service = getservbyname(name, proto)) != NULL) 380 return ntohs((unsigned short) service->s_port); 381 382 return -1; 383} 384 385u_int16_t xtables_parse_port(const char *port, const char *proto) 386{ 387 unsigned int portnum; 388 389 if (xtables_strtoui(port, NULL, &portnum, 0, UINT16_MAX) || 390 (portnum = xtables_service_to_port(port, proto)) != (unsigned)-1) 391 return portnum; 392 393 xt_params->exit_err(PARAMETER_PROBLEM, 394 "invalid port/service `%s' specified", port); 395} 396 397void xtables_parse_interface(const char *arg, char *vianame, 398 unsigned char *mask) 399{ 400 int vialen = strlen(arg); 401 unsigned int i; 402 403 memset(mask, 0, IFNAMSIZ); 404 memset(vianame, 0, IFNAMSIZ); 405 406 if (vialen + 1 > IFNAMSIZ) 407 xt_params->exit_err(PARAMETER_PROBLEM, 408 "interface name `%s' must be shorter than IFNAMSIZ" 409 " (%i)", arg, IFNAMSIZ-1); 410 411 strcpy(vianame, arg); 412 if ((vialen == 0) || (vialen == 1 && vianame[0] == '+')) 413 memset(mask, 0, IFNAMSIZ); 414 else if (vianame[vialen - 1] == '+') { 415 memset(mask, 0xFF, vialen - 1); 416 memset(mask + vialen - 1, 0, IFNAMSIZ - vialen + 1); 417 /* Don't remove `+' here! -HW */ 418 } else { 419 /* Include nul-terminator in match */ 420 memset(mask, 0xFF, vialen + 1); 421 memset(mask + vialen + 1, 0, IFNAMSIZ - vialen - 1); 422 for (i = 0; vianame[i]; i++) { 423 if (vianame[i] == ':' || 424 vianame[i] == '!' || 425 vianame[i] == '*') { 426 fprintf(stderr, 427 "Warning: weird character in interface" 428 " `%s' (No aliases, :, ! or *).\n", 429 vianame); 430 break; 431 } 432 } 433 } 434} 435 436#ifndef NO_SHARED_LIBS 437static void *load_extension(const char *search_path, const char *prefix, 438 const char *name, bool is_target) 439{ 440 const char *dir = search_path, *next; 441 void *ptr = NULL; 442 struct stat sb; 443 char path[256]; 444 445 do { 446 next = strchr(dir, ':'); 447 if (next == NULL) 448 next = dir + strlen(dir); 449 snprintf(path, sizeof(path), "%.*s/libxt_%s.so", 450 (unsigned int)(next - dir), dir, name); 451 452 if (dlopen(path, RTLD_NOW) != NULL) { 453 /* Found library. If it didn't register itself, 454 maybe they specified target as match. */ 455 if (is_target) 456 ptr = xtables_find_target(name, XTF_DONT_LOAD); 457 else 458 ptr = xtables_find_match(name, 459 XTF_DONT_LOAD, NULL); 460 } else if (stat(path, &sb) == 0) { 461 fprintf(stderr, "%s: %s\n", path, dlerror()); 462 } 463 464 if (ptr != NULL) 465 return ptr; 466 467 snprintf(path, sizeof(path), "%.*s/%s%s.so", 468 (unsigned int)(next - dir), dir, prefix, name); 469 if (dlopen(path, RTLD_NOW) != NULL) { 470 if (is_target) 471 ptr = xtables_find_target(name, XTF_DONT_LOAD); 472 else 473 ptr = xtables_find_match(name, 474 XTF_DONT_LOAD, NULL); 475 } else if (stat(path, &sb) == 0) { 476 fprintf(stderr, "%s: %s\n", path, dlerror()); 477 } 478 479 if (ptr != NULL) 480 return ptr; 481 482 dir = next + 1; 483 } while (*next != '\0'); 484 485 return NULL; 486} 487#endif 488 489struct xtables_match * 490xtables_find_match(const char *name, enum xtables_tryload tryload, 491 struct xtables_rule_match **matches) 492{ 493 struct xtables_match *ptr; 494 const char *icmp6 = "icmp6"; 495 496 /* This is ugly as hell. Nonetheless, there is no way of changing 497 * this without hurting backwards compatibility */ 498 if ( (strcmp(name,"icmpv6") == 0) || 499 (strcmp(name,"ipv6-icmp") == 0) || 500 (strcmp(name,"icmp6") == 0) ) 501 name = icmp6; 502 503 for (ptr = xtables_matches; ptr; ptr = ptr->next) { 504 if (strcmp(name, ptr->name) == 0) { 505 struct xtables_match *clone; 506 507 /* First match of this type: */ 508 if (ptr->m == NULL) 509 break; 510 511 /* Second and subsequent clones */ 512 clone = xtables_malloc(sizeof(struct xtables_match)); 513 memcpy(clone, ptr, sizeof(struct xtables_match)); 514 clone->mflags = 0; 515 /* This is a clone: */ 516 clone->next = clone; 517 518 ptr = clone; 519 break; 520 } 521 } 522 523#ifndef NO_SHARED_LIBS 524 if (!ptr && tryload != XTF_DONT_LOAD && tryload != XTF_DURING_LOAD) { 525 ptr = load_extension(xtables_libdir, afinfo->libprefix, 526 name, false); 527 528 if (ptr == NULL && tryload == XTF_LOAD_MUST_SUCCEED) 529 xt_params->exit_err(PARAMETER_PROBLEM, 530 "Couldn't load match `%s':%s\n", 531 name, dlerror()); 532 } 533#else 534 if (ptr && !ptr->loaded) { 535 if (tryload != XTF_DONT_LOAD) 536 ptr->loaded = 1; 537 else 538 ptr = NULL; 539 } 540 if(!ptr && (tryload == XTF_LOAD_MUST_SUCCEED)) { 541 xt_params->exit_err(PARAMETER_PROBLEM, 542 "Couldn't find match `%s'\n", name); 543 } 544#endif 545 546 if (ptr && matches) { 547 struct xtables_rule_match **i; 548 struct xtables_rule_match *newentry; 549 550 newentry = xtables_malloc(sizeof(struct xtables_rule_match)); 551 552 for (i = matches; *i; i = &(*i)->next) { 553 if (strcmp(name, (*i)->match->name) == 0) 554 (*i)->completed = true; 555 } 556 newentry->match = ptr; 557 newentry->completed = false; 558 newentry->next = NULL; 559 *i = newentry; 560 } 561 562 return ptr; 563} 564 565struct xtables_target * 566xtables_find_target(const char *name, enum xtables_tryload tryload) 567{ 568 struct xtables_target *ptr; 569 570 /* Standard target? */ 571 if (strcmp(name, "") == 0 572 || strcmp(name, XTC_LABEL_ACCEPT) == 0 573 || strcmp(name, XTC_LABEL_DROP) == 0 574 || strcmp(name, XTC_LABEL_QUEUE) == 0 575 || strcmp(name, XTC_LABEL_RETURN) == 0) 576 name = "standard"; 577 578 for (ptr = xtables_targets; ptr; ptr = ptr->next) { 579 if (strcmp(name, ptr->name) == 0) 580 break; 581 } 582 583#ifndef NO_SHARED_LIBS 584 if (!ptr && tryload != XTF_DONT_LOAD && tryload != XTF_DURING_LOAD) { 585 ptr = load_extension(xtables_libdir, afinfo->libprefix, 586 name, true); 587 588 if (ptr == NULL && tryload == XTF_LOAD_MUST_SUCCEED) 589 xt_params->exit_err(PARAMETER_PROBLEM, 590 "Couldn't load target `%s':%s\n", 591 name, dlerror()); 592 } 593#else 594 if (ptr && !ptr->loaded) { 595 if (tryload != XTF_DONT_LOAD) 596 ptr->loaded = 1; 597 else 598 ptr = NULL; 599 } 600 if(!ptr && (tryload == LOAD_MUST_SUCCEED)) { 601 xt_params->exit_err(PARAMETER_PROBLEM, 602 "Couldn't find target `%s'\n", name); 603 } 604#endif 605 606 if (ptr) 607 ptr->used = 1; 608 609 return ptr; 610} 611 612static int compatible_revision(const char *name, u_int8_t revision, int opt) 613{ 614 struct xt_get_revision rev; 615 socklen_t s = sizeof(rev); 616 int max_rev, sockfd; 617 618 sockfd = socket(afinfo->family, SOCK_RAW, IPPROTO_RAW); 619 if (sockfd < 0) { 620 if (errno == EPERM) { 621 /* revision 0 is always supported. */ 622 if (revision != 0) 623 fprintf(stderr, "Could not determine whether " 624 "revision %u is supported, " 625 "assuming it is.\n", 626 revision); 627 return 1; 628 } 629 fprintf(stderr, "Could not open socket to kernel: %s\n", 630 strerror(errno)); 631 exit(1); 632 } 633 634 xtables_load_ko(xtables_modprobe_program, true); 635 636 strcpy(rev.name, name); 637 rev.revision = revision; 638 639 max_rev = getsockopt(sockfd, afinfo->ipproto, opt, &rev, &s); 640 if (max_rev < 0) { 641 /* Definitely don't support this? */ 642 if (errno == ENOENT || errno == EPROTONOSUPPORT) { 643 close(sockfd); 644 return 0; 645 } else if (errno == ENOPROTOOPT) { 646 close(sockfd); 647 /* Assume only revision 0 support (old kernel) */ 648 return (revision == 0); 649 } else { 650 fprintf(stderr, "getsockopt failed strangely: %s\n", 651 strerror(errno)); 652 exit(1); 653 } 654 } 655 close(sockfd); 656 return 1; 657} 658 659 660static int compatible_match_revision(const char *name, u_int8_t revision) 661{ 662 return compatible_revision(name, revision, afinfo->so_rev_match); 663} 664 665static int compatible_target_revision(const char *name, u_int8_t revision) 666{ 667 return compatible_revision(name, revision, afinfo->so_rev_target); 668} 669 670void xtables_register_match(struct xtables_match *me) 671{ 672 struct xtables_match **i, *old; 673 674 if (strcmp(me->version, XTABLES_VERSION) != 0) { 675 fprintf(stderr, "%s: match \"%s\" has version \"%s\", " 676 "but \"%s\" is required.\n", 677 xtables_program_name, me->name, 678 me->version, XTABLES_VERSION); 679 exit(1); 680 } 681 682 /* Revision field stole a char from name. */ 683 if (strlen(me->name) >= XT_FUNCTION_MAXNAMELEN-1) { 684 fprintf(stderr, "%s: target `%s' has invalid name\n", 685 xtables_program_name, me->name); 686 exit(1); 687 } 688 689 if (me->family >= NPROTO) { 690 fprintf(stderr, 691 "%s: BUG: match %s has invalid protocol family\n", 692 xtables_program_name, me->name); 693 exit(1); 694 } 695 696 /* ignore not interested match */ 697 if (me->family != afinfo->family && me->family != AF_UNSPEC) 698 return; 699 700 old = xtables_find_match(me->name, XTF_DURING_LOAD, NULL); 701 if (old) { 702 if (old->revision == me->revision && 703 old->family == me->family) { 704 fprintf(stderr, 705 "%s: match `%s' already registered.\n", 706 xtables_program_name, me->name); 707 exit(1); 708 } 709 710 /* Now we have two (or more) options, check compatibility. */ 711 if (compatible_match_revision(old->name, old->revision) 712 && old->revision > me->revision) 713 return; 714 715 /* See if new match can be used. */ 716 if (!compatible_match_revision(me->name, me->revision)) 717 return; 718 719 /* Prefer !AF_UNSPEC over AF_UNSPEC for same revision. */ 720 if (old->revision == me->revision && me->family == AF_UNSPEC) 721 return; 722 723 /* Delete old one. */ 724 for (i = &xtables_matches; *i!=old; i = &(*i)->next); 725 *i = old->next; 726 } 727 728 if (me->size != XT_ALIGN(me->size)) { 729 fprintf(stderr, "%s: match `%s' has invalid size %u.\n", 730 xtables_program_name, me->name, (unsigned int)me->size); 731 exit(1); 732 } 733 734 /* Append to list. */ 735 for (i = &xtables_matches; *i; i = &(*i)->next); 736 me->next = NULL; 737 *i = me; 738 739 me->m = NULL; 740 me->mflags = 0; 741} 742 743void xtables_register_target(struct xtables_target *me) 744{ 745 struct xtables_target *old; 746 747 if (strcmp(me->version, XTABLES_VERSION) != 0) { 748 fprintf(stderr, "%s: target \"%s\" has version \"%s\", " 749 "but \"%s\" is required.\n", 750 xtables_program_name, me->name, 751 me->version, XTABLES_VERSION); 752 exit(1); 753 } 754 755 /* Revision field stole a char from name. */ 756 if (strlen(me->name) >= XT_FUNCTION_MAXNAMELEN-1) { 757 fprintf(stderr, "%s: target `%s' has invalid name\n", 758 xtables_program_name, me->name); 759 exit(1); 760 } 761 762 if (me->family >= NPROTO) { 763 fprintf(stderr, 764 "%s: BUG: target %s has invalid protocol family\n", 765 xtables_program_name, me->name); 766 exit(1); 767 } 768 769 /* ignore not interested target */ 770 if (me->family != afinfo->family && me->family != AF_UNSPEC) 771 return; 772 773 old = xtables_find_target(me->name, XTF_DURING_LOAD); 774 if (old) { 775 struct xtables_target **i; 776 777 if (old->revision == me->revision && 778 old->family == me->family) { 779 fprintf(stderr, 780 "%s: target `%s' already registered.\n", 781 xtables_program_name, me->name); 782 exit(1); 783 } 784 785 /* Now we have two (or more) options, check compatibility. */ 786 if (compatible_target_revision(old->name, old->revision) 787 && old->revision > me->revision) 788 return; 789 790 /* See if new target can be used. */ 791 if (!compatible_target_revision(me->name, me->revision)) 792 return; 793 794 /* Prefer !AF_UNSPEC over AF_UNSPEC for same revision. */ 795 if (old->revision == me->revision && me->family == AF_UNSPEC) 796 return; 797 798 /* Delete old one. */ 799 for (i = &xtables_targets; *i!=old; i = &(*i)->next); 800 *i = old->next; 801 } 802 803 if (me->size != XT_ALIGN(me->size)) { 804 fprintf(stderr, "%s: target `%s' has invalid size %u.\n", 805 xtables_program_name, me->name, (unsigned int)me->size); 806 exit(1); 807 } 808 809 /* Prepend to list. */ 810 me->next = xtables_targets; 811 xtables_targets = me; 812 me->t = NULL; 813 me->tflags = 0; 814} 815 816/** 817 * xtables_param_act - act on condition 818 * @status: a constant from enum xtables_exittype 819 * 820 * %XTF_ONLY_ONCE: print error message that option may only be used once. 821 * @p1: module name (e.g. "mark") 822 * @p2(...): option in conflict (e.g. "--mark") 823 * @p3(...): condition to match on (see extensions/ for examples) 824 * 825 * %XTF_NO_INVERT: option does not support inversion 826 * @p1: module name 827 * @p2: option in conflict 828 * @p3: condition to match on 829 * 830 * %XTF_BAD_VALUE: bad value for option 831 * @p1: module name 832 * @p2: option with which the problem occured (e.g. "--mark") 833 * @p3: string the user passed in (e.g. "99999999999999") 834 * 835 * %XTF_ONE_ACTION: two mutually exclusive actions have been specified 836 * @p1: module name 837 * 838 * Displays an error message and exits the program. 839 */ 840void xtables_param_act(unsigned int status, const char *p1, ...) 841{ 842 const char *p2, *p3; 843 va_list args; 844 bool b; 845 846 va_start(args, p1); 847 848 switch (status) { 849 case XTF_ONLY_ONCE: 850 p2 = va_arg(args, const char *); 851 b = va_arg(args, unsigned int); 852 if (!b) 853 return; 854 xt_params->exit_err(PARAMETER_PROBLEM, 855 "%s: \"%s\" option may only be specified once", 856 p1, p2); 857 break; 858 case XTF_NO_INVERT: 859 p2 = va_arg(args, const char *); 860 b = va_arg(args, unsigned int); 861 if (!b) 862 return; 863 xt_params->exit_err(PARAMETER_PROBLEM, 864 "%s: \"%s\" option cannot be inverted", p1, p2); 865 break; 866 case XTF_BAD_VALUE: 867 p2 = va_arg(args, const char *); 868 p3 = va_arg(args, const char *); 869 xt_params->exit_err(PARAMETER_PROBLEM, 870 "%s: Bad value for \"%s\" option: \"%s\"", 871 p1, p2, p3); 872 break; 873 case XTF_ONE_ACTION: 874 b = va_arg(args, unsigned int); 875 if (!b) 876 return; 877 xt_params->exit_err(PARAMETER_PROBLEM, 878 "%s: At most one action is possible", p1); 879 break; 880 default: 881 xt_params->exit_err(status, p1, args); 882 break; 883 } 884 885 va_end(args); 886} 887 888const char *xtables_ipaddr_to_numeric(const struct in_addr *addrp) 889{ 890 static char buf[20]; 891 const unsigned char *bytep = (const void *)&addrp->s_addr; 892 893 sprintf(buf, "%u.%u.%u.%u", bytep[0], bytep[1], bytep[2], bytep[3]); 894 return buf; 895} 896 897static const char *ipaddr_to_host(const struct in_addr *addr) 898{ 899 struct hostent *host; 900 901 host = gethostbyaddr(addr, sizeof(struct in_addr), AF_INET); 902 if (host == NULL) 903 return NULL; 904 905 return host->h_name; 906} 907 908static const char *ipaddr_to_network(const struct in_addr *addr) 909{ 910 struct netent *net; 911 912 if ((net = getnetbyaddr(ntohl(addr->s_addr), AF_INET)) != NULL) 913 return net->n_name; 914 915 return NULL; 916} 917 918const char *xtables_ipaddr_to_anyname(const struct in_addr *addr) 919{ 920 const char *name; 921 922 if ((name = ipaddr_to_host(addr)) != NULL || 923 (name = ipaddr_to_network(addr)) != NULL) 924 return name; 925 926 return xtables_ipaddr_to_numeric(addr); 927} 928 929const char *xtables_ipmask_to_numeric(const struct in_addr *mask) 930{ 931 static char buf[20]; 932 uint32_t maskaddr, bits; 933 int i; 934 935 maskaddr = ntohl(mask->s_addr); 936 937 if (maskaddr == 0xFFFFFFFFL) 938 /* we don't want to see "/32" */ 939 return ""; 940 941 i = 32; 942 bits = 0xFFFFFFFEL; 943 while (--i >= 0 && maskaddr != bits) 944 bits <<= 1; 945 if (i >= 0) 946 sprintf(buf, "/%d", i); 947 else 948 /* mask was not a decent combination of 1's and 0's */ 949 sprintf(buf, "/%s", xtables_ipaddr_to_numeric(mask)); 950 951 return buf; 952} 953 954static struct in_addr *__numeric_to_ipaddr(const char *dotted, bool is_mask) 955{ 956 static struct in_addr addr; 957 unsigned char *addrp; 958 unsigned int onebyte; 959 char buf[20], *p, *q; 960 int i; 961 962 /* copy dotted string, because we need to modify it */ 963 strncpy(buf, dotted, sizeof(buf) - 1); 964 buf[sizeof(buf) - 1] = '\0'; 965 addrp = (void *)&addr.s_addr; 966 967 p = buf; 968 for (i = 0; i < 3; ++i) { 969 if ((q = strchr(p, '.')) == NULL) { 970 if (is_mask) 971 return NULL; 972 973 /* autocomplete, this is a network address */ 974 if (!xtables_strtoui(p, NULL, &onebyte, 0, UINT8_MAX)) 975 return NULL; 976 977 addrp[i] = onebyte; 978 while (i < 3) 979 addrp[++i] = 0; 980 981 return &addr; 982 } 983 984 *q = '\0'; 985 if (!xtables_strtoui(p, NULL, &onebyte, 0, UINT8_MAX)) 986 return NULL; 987 988 addrp[i] = onebyte; 989 p = q + 1; 990 } 991 992 /* we have checked 3 bytes, now we check the last one */ 993 if (!xtables_strtoui(p, NULL, &onebyte, 0, UINT8_MAX)) 994 return NULL; 995 996 addrp[3] = onebyte; 997 return &addr; 998} 999 1000struct in_addr *xtables_numeric_to_ipaddr(const char *dotted) 1001{ 1002 return __numeric_to_ipaddr(dotted, false); 1003} 1004 1005struct in_addr *xtables_numeric_to_ipmask(const char *dotted) 1006{ 1007 return __numeric_to_ipaddr(dotted, true); 1008} 1009 1010static struct in_addr *network_to_ipaddr(const char *name) 1011{ 1012 static struct in_addr addr; 1013 struct netent *net; 1014 1015 if ((net = getnetbyname(name)) != NULL) { 1016 if (net->n_addrtype != AF_INET) 1017 return NULL; 1018 addr.s_addr = htonl(net->n_net); 1019 return &addr; 1020 } 1021 1022 return NULL; 1023} 1024 1025static struct in_addr *host_to_ipaddr(const char *name, unsigned int *naddr) 1026{ 1027 struct hostent *host; 1028 struct in_addr *addr; 1029 unsigned int i; 1030 1031 *naddr = 0; 1032 if ((host = gethostbyname(name)) != NULL) { 1033 if (host->h_addrtype != AF_INET || 1034 host->h_length != sizeof(struct in_addr)) 1035 return NULL; 1036 1037 while (host->h_addr_list[*naddr] != NULL) 1038 ++*naddr; 1039 addr = xtables_calloc(*naddr, sizeof(struct in_addr) * *naddr); 1040 for (i = 0; i < *naddr; i++) 1041 memcpy(&addr[i], host->h_addr_list[i], 1042 sizeof(struct in_addr)); 1043 return addr; 1044 } 1045 1046 return NULL; 1047} 1048 1049static struct in_addr * 1050ipparse_hostnetwork(const char *name, unsigned int *naddrs) 1051{ 1052 struct in_addr *addrptmp, *addrp; 1053 1054 if ((addrptmp = xtables_numeric_to_ipaddr(name)) != NULL || 1055 (addrptmp = network_to_ipaddr(name)) != NULL) { 1056 addrp = xtables_malloc(sizeof(struct in_addr)); 1057 memcpy(addrp, addrptmp, sizeof(*addrp)); 1058 *naddrs = 1; 1059 return addrp; 1060 } 1061 if ((addrptmp = host_to_ipaddr(name, naddrs)) != NULL) 1062 return addrptmp; 1063 1064 xt_params->exit_err(PARAMETER_PROBLEM, "host/network `%s' not found", name); 1065} 1066 1067static struct in_addr *parse_ipmask(const char *mask) 1068{ 1069 static struct in_addr maskaddr; 1070 struct in_addr *addrp; 1071 unsigned int bits; 1072 1073 if (mask == NULL) { 1074 /* no mask at all defaults to 32 bits */ 1075 maskaddr.s_addr = 0xFFFFFFFF; 1076 return &maskaddr; 1077 } 1078 if ((addrp = xtables_numeric_to_ipmask(mask)) != NULL) 1079 /* dotted_to_addr already returns a network byte order addr */ 1080 return addrp; 1081 if (!xtables_strtoui(mask, NULL, &bits, 0, 32)) 1082 xt_params->exit_err(PARAMETER_PROBLEM, 1083 "invalid mask `%s' specified", mask); 1084 if (bits != 0) { 1085 maskaddr.s_addr = htonl(0xFFFFFFFF << (32 - bits)); 1086 return &maskaddr; 1087 } 1088 1089 maskaddr.s_addr = 0U; 1090 return &maskaddr; 1091} 1092 1093/** 1094 * xtables_ipparse_any - transform arbitrary name to in_addr 1095 * 1096 * Possible inputs (pseudo regex): 1097 * m{^($hostname|$networkname|$ipaddr)(/$mask)?} 1098 * "1.2.3.4/5", "1.2.3.4", "hostname", "networkname" 1099 */ 1100void xtables_ipparse_any(const char *name, struct in_addr **addrpp, 1101 struct in_addr *maskp, unsigned int *naddrs) 1102{ 1103 unsigned int i, j, k, n; 1104 struct in_addr *addrp; 1105 char buf[256], *p; 1106 1107 strncpy(buf, name, sizeof(buf) - 1); 1108 buf[sizeof(buf) - 1] = '\0'; 1109 if ((p = strrchr(buf, '/')) != NULL) { 1110 *p = '\0'; 1111 addrp = parse_ipmask(p + 1); 1112 } else { 1113 addrp = parse_ipmask(NULL); 1114 } 1115 memcpy(maskp, addrp, sizeof(*maskp)); 1116 1117 /* if a null mask is given, the name is ignored, like in "any/0" */ 1118 if (maskp->s_addr == 0U) 1119 strcpy(buf, "0.0.0.0"); 1120 1121 addrp = *addrpp = ipparse_hostnetwork(buf, naddrs); 1122 n = *naddrs; 1123 for (i = 0, j = 0; i < n; ++i) { 1124 addrp[j++].s_addr &= maskp->s_addr; 1125 for (k = 0; k < j - 1; ++k) 1126 if (addrp[k].s_addr == addrp[j-1].s_addr) { 1127 --*naddrs; 1128 --j; 1129 break; 1130 } 1131 } 1132} 1133 1134const char *xtables_ip6addr_to_numeric(const struct in6_addr *addrp) 1135{ 1136 /* 0000:0000:0000:0000:0000:000.000.000.000 1137 * 0000:0000:0000:0000:0000:0000:0000:0000 */ 1138 static char buf[50+1]; 1139 return inet_ntop(AF_INET6, addrp, buf, sizeof(buf)); 1140} 1141 1142static const char *ip6addr_to_host(const struct in6_addr *addr) 1143{ 1144 static char hostname[NI_MAXHOST]; 1145 struct sockaddr_in6 saddr; 1146 int err; 1147 1148 memset(&saddr, 0, sizeof(struct sockaddr_in6)); 1149 memcpy(&saddr.sin6_addr, addr, sizeof(*addr)); 1150 saddr.sin6_family = AF_INET6; 1151 1152 err = getnameinfo((const void *)&saddr, sizeof(struct sockaddr_in6), 1153 hostname, sizeof(hostname) - 1, NULL, 0, 0); 1154 if (err != 0) { 1155#ifdef DEBUG 1156 fprintf(stderr,"IP2Name: %s\n",gai_strerror(err)); 1157#endif 1158 return NULL; 1159 } 1160 1161#ifdef DEBUG 1162 fprintf (stderr, "\naddr2host: %s\n", hostname); 1163#endif 1164 return hostname; 1165} 1166 1167const char *xtables_ip6addr_to_anyname(const struct in6_addr *addr) 1168{ 1169 const char *name; 1170 1171 if ((name = ip6addr_to_host(addr)) != NULL) 1172 return name; 1173 1174 return xtables_ip6addr_to_numeric(addr); 1175} 1176 1177static int ip6addr_prefix_length(const struct in6_addr *k) 1178{ 1179 unsigned int bits = 0; 1180 uint32_t a, b, c, d; 1181 1182 a = ntohl(k->s6_addr32[0]); 1183 b = ntohl(k->s6_addr32[1]); 1184 c = ntohl(k->s6_addr32[2]); 1185 d = ntohl(k->s6_addr32[3]); 1186 while (a & 0x80000000U) { 1187 ++bits; 1188 a <<= 1; 1189 a |= (b >> 31) & 1; 1190 b <<= 1; 1191 b |= (c >> 31) & 1; 1192 c <<= 1; 1193 c |= (d >> 31) & 1; 1194 d <<= 1; 1195 } 1196 if (a != 0 || b != 0 || c != 0 || d != 0) 1197 return -1; 1198 return bits; 1199} 1200 1201const char *xtables_ip6mask_to_numeric(const struct in6_addr *addrp) 1202{ 1203 static char buf[50+2]; 1204 int l = ip6addr_prefix_length(addrp); 1205 1206 if (l == -1) { 1207 strcpy(buf, "/"); 1208 strcat(buf, xtables_ip6addr_to_numeric(addrp)); 1209 return buf; 1210 } 1211 sprintf(buf, "/%d", l); 1212 return buf; 1213} 1214 1215struct in6_addr *xtables_numeric_to_ip6addr(const char *num) 1216{ 1217 static struct in6_addr ap; 1218 int err; 1219 1220 if ((err = inet_pton(AF_INET6, num, &ap)) == 1) 1221 return ≈ 1222#ifdef DEBUG 1223 fprintf(stderr, "\nnumeric2addr: %d\n", err); 1224#endif 1225 return NULL; 1226} 1227 1228static struct in6_addr * 1229host_to_ip6addr(const char *name, unsigned int *naddr) 1230{ 1231 static struct in6_addr *addr; 1232 struct addrinfo hints; 1233 struct addrinfo *res; 1234 int err; 1235 1236 memset(&hints, 0, sizeof(hints)); 1237 hints.ai_flags = AI_CANONNAME; 1238 hints.ai_family = AF_INET6; 1239 hints.ai_socktype = SOCK_RAW; 1240 hints.ai_protocol = IPPROTO_IPV6; 1241 hints.ai_next = NULL; 1242 1243 *naddr = 0; 1244 if ((err = getaddrinfo(name, NULL, &hints, &res)) != 0) { 1245#ifdef DEBUG 1246 fprintf(stderr,"Name2IP: %s\n",gai_strerror(err)); 1247#endif 1248 return NULL; 1249 } else { 1250 if (res->ai_family != AF_INET6 || 1251 res->ai_addrlen != sizeof(struct sockaddr_in6)) 1252 return NULL; 1253 1254#ifdef DEBUG 1255 fprintf(stderr, "resolved: len=%d %s ", res->ai_addrlen, 1256 ip6addr_to_numeric(&((struct sockaddr_in6 *)res->ai_addr)->sin6_addr)); 1257#endif 1258 /* Get the first element of the address-chain */ 1259 addr = xtables_malloc(sizeof(struct in6_addr)); 1260 memcpy(addr, &((const struct sockaddr_in6 *)res->ai_addr)->sin6_addr, 1261 sizeof(struct in6_addr)); 1262 freeaddrinfo(res); 1263 *naddr = 1; 1264 return addr; 1265 } 1266 1267 return NULL; 1268} 1269 1270static struct in6_addr *network_to_ip6addr(const char *name) 1271{ 1272 /* abort();*/ 1273 /* TODO: not implemented yet, but the exception breaks the 1274 * name resolvation */ 1275 return NULL; 1276} 1277 1278static struct in6_addr * 1279ip6parse_hostnetwork(const char *name, unsigned int *naddrs) 1280{ 1281 struct in6_addr *addrp, *addrptmp; 1282 1283 if ((addrptmp = xtables_numeric_to_ip6addr(name)) != NULL || 1284 (addrptmp = network_to_ip6addr(name)) != NULL) { 1285 addrp = xtables_malloc(sizeof(struct in6_addr)); 1286 memcpy(addrp, addrptmp, sizeof(*addrp)); 1287 *naddrs = 1; 1288 return addrp; 1289 } 1290 if ((addrp = host_to_ip6addr(name, naddrs)) != NULL) 1291 return addrp; 1292 1293 xt_params->exit_err(PARAMETER_PROBLEM, "host/network `%s' not found", name); 1294} 1295 1296static struct in6_addr *parse_ip6mask(char *mask) 1297{ 1298 static struct in6_addr maskaddr; 1299 struct in6_addr *addrp; 1300 unsigned int bits; 1301 1302 if (mask == NULL) { 1303 /* no mask at all defaults to 128 bits */ 1304 memset(&maskaddr, 0xff, sizeof maskaddr); 1305 return &maskaddr; 1306 } 1307 if ((addrp = xtables_numeric_to_ip6addr(mask)) != NULL) 1308 return addrp; 1309 if (!xtables_strtoui(mask, NULL, &bits, 0, 128)) 1310 xt_params->exit_err(PARAMETER_PROBLEM, 1311 "invalid mask `%s' specified", mask); 1312 if (bits != 0) { 1313 char *p = (void *)&maskaddr; 1314 memset(p, 0xff, bits / 8); 1315 memset(p + (bits / 8) + 1, 0, (128 - bits) / 8); 1316 p[bits/8] = 0xff << (8 - (bits & 7)); 1317 return &maskaddr; 1318 } 1319 1320 memset(&maskaddr, 0, sizeof(maskaddr)); 1321 return &maskaddr; 1322} 1323 1324void xtables_ip6parse_any(const char *name, struct in6_addr **addrpp, 1325 struct in6_addr *maskp, unsigned int *naddrs) 1326{ 1327 struct in6_addr *addrp; 1328 unsigned int i, j, k, n; 1329 char buf[256], *p; 1330 1331 strncpy(buf, name, sizeof(buf) - 1); 1332 buf[sizeof(buf)-1] = '\0'; 1333 if ((p = strrchr(buf, '/')) != NULL) { 1334 *p = '\0'; 1335 addrp = parse_ip6mask(p + 1); 1336 } else { 1337 addrp = parse_ip6mask(NULL); 1338 } 1339 memcpy(maskp, addrp, sizeof(*maskp)); 1340 1341 /* if a null mask is given, the name is ignored, like in "any/0" */ 1342 if (memcmp(maskp, &in6addr_any, sizeof(in6addr_any)) == 0) 1343 strcpy(buf, "::"); 1344 1345 addrp = *addrpp = ip6parse_hostnetwork(buf, naddrs); 1346 n = *naddrs; 1347 for (i = 0, j = 0; i < n; ++i) { 1348 for (k = 0; k < 4; ++k) 1349 addrp[j].s6_addr32[k] &= maskp->s6_addr32[k]; 1350 ++j; 1351 for (k = 0; k < j - 1; ++k) 1352 if (IN6_ARE_ADDR_EQUAL(&addrp[k], &addrp[j - 1])) { 1353 --*naddrs; 1354 --j; 1355 break; 1356 } 1357 } 1358} 1359 1360void xtables_save_string(const char *value) 1361{ 1362 static const char no_quote_chars[] = "_-0123456789" 1363 "abcdefghijklmnopqrstuvwxyz" 1364 "ABCDEFGHIJKLMNOPQRSTUVWXYZ"; 1365 static const char escape_chars[] = "\"\\'"; 1366 size_t length; 1367 const char *p; 1368 1369 length = strcspn(value, no_quote_chars); 1370 if (length > 0 && value[length] == 0) { 1371 /* no quoting required */ 1372 fputs(value, stdout); 1373 putchar(' '); 1374 } else { 1375 /* there is at least one dangerous character in the 1376 value, which we have to quote. Write double quotes 1377 around the value and escape special characters with 1378 a backslash */ 1379 putchar('"'); 1380 1381 for (p = strpbrk(value, escape_chars); p != NULL; 1382 p = strpbrk(value, escape_chars)) { 1383 if (p > value) 1384 fwrite(value, 1, p - value, stdout); 1385 putchar('\\'); 1386 putchar(*p); 1387 value = p + 1; 1388 } 1389 1390 /* print the rest and finish the double quoted 1391 string */ 1392 fputs(value, stdout); 1393 printf("\" "); 1394 } 1395} 1396 1397/** 1398 * Check for option-intrapositional negation. 1399 * Do not use in new code. 1400 */ 1401int xtables_check_inverse(const char option[], int *invert, 1402 int *my_optind, int argc) 1403{ 1404 if (option && strcmp(option, "!") == 0) { 1405 fprintf(stderr, "Using intrapositioned negation " 1406 "(`--option ! this`) is deprecated in favor of " 1407 "extrapositioned (`! --option this`).\n"); 1408 1409 if (*invert) 1410 xt_params->exit_err(PARAMETER_PROBLEM, 1411 "Multiple `!' flags not allowed"); 1412 *invert = true; 1413 if (my_optind != NULL) { 1414 ++*my_optind; 1415 if (argc && *my_optind > argc) 1416 xt_params->exit_err(PARAMETER_PROBLEM, 1417 "no argument following `!'"); 1418 } 1419 1420 return true; 1421 } 1422 return false; 1423} 1424 1425const struct xtables_pprot xtables_chain_protos[] = { 1426 {"tcp", IPPROTO_TCP}, 1427 {"sctp", IPPROTO_SCTP}, 1428 {"udp", IPPROTO_UDP}, 1429 {"udplite", IPPROTO_UDPLITE}, 1430 {"icmp", IPPROTO_ICMP}, 1431 {"icmpv6", IPPROTO_ICMPV6}, 1432 {"ipv6-icmp", IPPROTO_ICMPV6}, 1433 {"esp", IPPROTO_ESP}, 1434 {"ah", IPPROTO_AH}, 1435 {"ipv6-mh", IPPROTO_MH}, 1436 {"mh", IPPROTO_MH}, 1437 {"all", 0}, 1438 {NULL}, 1439}; 1440 1441u_int16_t 1442xtables_parse_protocol(const char *s) 1443{ 1444 unsigned int proto; 1445 1446 if (!xtables_strtoui(s, NULL, &proto, 0, UINT8_MAX)) { 1447 struct protoent *pent; 1448 1449 /* first deal with the special case of 'all' to prevent 1450 * people from being able to redefine 'all' in nsswitch 1451 * and/or provoke expensive [not working] ldap/nis/... 1452 * lookups */ 1453 if (!strcmp(s, "all")) 1454 return 0; 1455 1456 if ((pent = getprotobyname(s))) 1457 proto = pent->p_proto; 1458 else { 1459 unsigned int i; 1460 for (i = 0; i < ARRAY_SIZE(xtables_chain_protos); ++i) { 1461 if (strcmp(s, xtables_chain_protos[i].name) == 0) { 1462 proto = xtables_chain_protos[i].num; 1463 break; 1464 } 1465 } 1466 if (i == ARRAY_SIZE(xtables_chain_protos)) 1467 xt_params->exit_err(PARAMETER_PROBLEM, 1468 "unknown protocol `%s' specified", 1469 s); 1470 } 1471 } 1472 1473 return proto; 1474} 1475