1e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Code to save the iptables state, in human readable-form. */ 210a907f6736864f3f60d36f78c78e655b6bb64eeHarald Welte/* (C) 1999 by Paul 'Rusty' Russell <rusty@rustcorp.com.au> and 310a907f6736864f3f60d36f78c78e655b6bb64eeHarald Welte * (C) 2000-2002 by Harald Welte <laforge@gnumonks.org> 410a907f6736864f3f60d36f78c78e655b6bb64eeHarald Welte * 510a907f6736864f3f60d36f78c78e655b6bb64eeHarald Welte * This code is distributed under the terms of GNU GPL v2 610a907f6736864f3f60d36f78c78e655b6bb64eeHarald Welte * 7ae1ff9f96a80379a650dec979b9902528a10d45aHarald Welte */ 8e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#include <getopt.h> 9043e52bc42021f71b85229f6d78bf7e75b282765Felix Janda#include <errno.h> 10e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#include <stdio.h> 11ae1ff9f96a80379a650dec979b9902528a10d45aHarald Welte#include <fcntl.h> 12ae1ff9f96a80379a650dec979b9902528a10d45aHarald Welte#include <stdlib.h> 13ae1ff9f96a80379a650dec979b9902528a10d45aHarald Welte#include <string.h> 14e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#include <time.h> 15d8ac967249f78212e1fe5eb55e9a417ac1d737d6Harald Welte#include <netdb.h> 16b1f69befb5b35d0cbf607ed13a6e823a94cb79ffRusty Russell#include "libiptc/libiptc.h" 17b1f69befb5b35d0cbf607ed13a6e823a94cb79ffRusty Russell#include "iptables.h" 1833690a1aec0b6309ff90066ca56285b6e43013f2Jan Engelhardt#include "iptables-multi.h" 19e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 20296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardtstatic int show_counters = 0; 21a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell 227bc3cb7eec4c4db5edc4b503a5dfab799e0bce62Gáspár Lajosstatic const struct option options[] = { 237bc3cb7eec4c4db5edc4b503a5dfab799e0bce62Gáspár Lajos {.name = "counters", .has_arg = false, .val = 'c'}, 247bc3cb7eec4c4db5edc4b503a5dfab799e0bce62Gáspár Lajos {.name = "dump", .has_arg = false, .val = 'd'}, 257bc3cb7eec4c4db5edc4b503a5dfab799e0bce62Gáspár Lajos {.name = "table", .has_arg = true, .val = 't'}, 26fbb5639c02218acfd84c4f25f134efecb564fee1Jan Engelhardt {.name = "modprobe", .has_arg = true, .val = 'M'}, 277bc3cb7eec4c4db5edc4b503a5dfab799e0bce62Gáspár Lajos {NULL}, 28e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher}; 29e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 30e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Debugging prototype. */ 31a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russellstatic int for_each_table(int (*func)(const char *tablename)) 32e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher{ 335b76f682f722bebc2f0616fca4600eee2c08dfe2Max Kellermann int ret = 1; 34ae1ff9f96a80379a650dec979b9902528a10d45aHarald Welte FILE *procfile = NULL; 3514da56743c6cdf25da35b7b5ca7a5d201771990dJan Engelhardt char tablename[XT_TABLE_MAXNAMELEN+1]; 36a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell 37a239728ec064666025de2723997d87b176d57fd6Maciej Zenczykowski procfile = fopen("/proc/net/ip_tables_names", "re"); 38a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell if (!procfile) 39fbb5639c02218acfd84c4f25f134efecb564fee1Jan Engelhardt return ret; 40a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell 41a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell while (fgets(tablename, sizeof(tablename), procfile)) { 42a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell if (tablename[strlen(tablename) - 1] != '\n') 431829ed482efbc8b390cc760d012b3a4450494e1aJan Engelhardt xtables_error(OTHER_PROBLEM, 44a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell "Badly formed tablename `%s'\n", 45a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell tablename); 46a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell tablename[strlen(tablename) - 1] = '\0'; 47a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell ret &= func(tablename); 48a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell } 49e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 50f1afcc896e7f8be3a6419681fd8cdee1d600a3aaJan Engelhardt fclose(procfile); 51a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell return ret; 52a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell} 535b76f682f722bebc2f0616fca4600eee2c08dfe2Max Kellermann 54e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 55a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russellstatic int do_output(const char *tablename) 56a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell{ 571639fe86579f86f5f6a954a9b0adde2e16ad1980Jan Engelhardt struct xtc_handle *h; 58a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell const char *chain = NULL; 59e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 60a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell if (!tablename) 61a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell return for_each_table(&do_output); 62e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 63a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell h = iptc_init(tablename); 64fbb5639c02218acfd84c4f25f134efecb564fee1Jan Engelhardt if (h == NULL) { 65fbb5639c02218acfd84c4f25f134efecb564fee1Jan Engelhardt xtables_load_ko(xtables_modprobe_program, false); 66fbb5639c02218acfd84c4f25f134efecb564fee1Jan Engelhardt h = iptc_init(tablename); 67fbb5639c02218acfd84c4f25f134efecb564fee1Jan Engelhardt } 68a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell if (!h) 691829ed482efbc8b390cc760d012b3a4450494e1aJan Engelhardt xtables_error(OTHER_PROBLEM, "Cannot initialize: %s\n", 70a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell iptc_strerror(errno)); 71e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 72296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt time_t now = time(NULL); 73296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt 74296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt printf("# Generated by iptables-save v%s on %s", 75296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt IPTABLES_VERSION, ctime(&now)); 76296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt printf("*%s\n", tablename); 77296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt 78296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt /* Dump out chain names first, 79296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt * thereby preventing dependency conflicts */ 80296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt for (chain = iptc_first_chain(h); 81296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt chain; 82296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt chain = iptc_next_chain(h)) { 83296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt 84296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt printf(":%s ", chain); 85296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt if (iptc_builtin(chain, h)) { 8614da56743c6cdf25da35b7b5ca7a5d201771990dJan Engelhardt struct xt_counters count; 87296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt printf("%s ", 88296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt iptc_get_policy(chain, &count, h)); 89296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt printf("[%llu:%llu]\n", (unsigned long long)count.pcnt, (unsigned long long)count.bcnt); 90296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt } else { 91296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt printf("- [0:0]\n"); 929f7fa49a6e1cd803de8a42fa849582d5d72822bfHarald Welte } 93296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt } 945b76f682f722bebc2f0616fca4600eee2c08dfe2Max Kellermann 95296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt for (chain = iptc_first_chain(h); 96296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt chain; 97296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt chain = iptc_next_chain(h)) { 98296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt const struct ipt_entry *e; 999f7fa49a6e1cd803de8a42fa849582d5d72822bfHarald Welte 100296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt /* Dump out rules */ 101296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt e = iptc_first_rule(chain, h); 102296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt while(e) { 103296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt print_rule4(e, h, chain, show_counters); 104296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt e = iptc_next_rule(e, h); 105e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } 106a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell } 107a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell 108296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt now = time(NULL); 109296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt printf("COMMIT\n"); 110296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt printf("# Completed on %s", ctime(&now)); 1111c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt iptc_free(h); 112841e4aed2349046eb2c0b1375139c06569a93bd0Martin Josefsson 113a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell return 1; 114a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell} 115a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell 116a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell/* Format: 117a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell * :Chain name POLICY packets bytes 118a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell * rule 119a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell */ 1204e3771f04687657753f2a3666225341a3525f07eBastiaan Bakkerint 1214e3771f04687657753f2a3666225341a3525f07eBastiaan Bakkeriptables_save_main(int argc, char *argv[]) 122a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell{ 123a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell const char *tablename = NULL; 124a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell int c; 125a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell 126617d3d140f4739558dce2ef8ed01aef251cf5487Jamal Hadi Salim iptables_globals.program_name = "iptables-save"; 1277e4db2f50133007f549f222468bde4f3adcf41acJamal Hadi Salim c = xtables_init_all(&iptables_globals, NFPROTO_IPV4); 1287e4db2f50133007f549f222468bde4f3adcf41acJamal Hadi Salim if (c < 0) { 1297e4db2f50133007f549f222468bde4f3adcf41acJamal Hadi Salim fprintf(stderr, "%s/%s Failed to initialize xtables\n", 1307e4db2f50133007f549f222468bde4f3adcf41acJamal Hadi Salim iptables_globals.program_name, 1317e4db2f50133007f549f222468bde4f3adcf41acJamal Hadi Salim iptables_globals.program_version); 1327e4db2f50133007f549f222468bde4f3adcf41acJamal Hadi Salim exit(1); 1337e4db2f50133007f549f222468bde4f3adcf41acJamal Hadi Salim } 134b79ec69027fd8b65e7eccd78a445b6665e8ad53bJan Engelhardt#if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS) 1359a9694fbf1796a6a5011b60b2a15c01fa3c61368Maciej Żenczykowski init_extensions(); 1365e8f947becc00a79e78b2a6cf0e25fd674c57ec4Maciej Zenczykowski init_extensions4(); 1373efb6ead2e51fe1eca55bcb2b06afb4dc4b8cb7cHarald Welte#endif 1383efb6ead2e51fe1eca55bcb2b06afb4dc4b8cb7cHarald Welte 139d25f308e54730677698d93f29ca4630e25237935Jiri Popelka while ((c = getopt_long(argc, argv, "bcdt:M:", options, NULL)) != -1) { 140a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell switch (c) { 141991ad3874826d560efcf81c8422b1e9b5b935bbcJiri Popelka case 'b': 142991ad3874826d560efcf81c8422b1e9b5b935bbcJiri Popelka fprintf(stderr, "-b/--binary option is not implemented\n"); 143991ad3874826d560efcf81c8422b1e9b5b935bbcJiri Popelka break; 144a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell case 'c': 145dbb77543ad6afe29e9a1881b2d4fc212de621a55Jan Engelhardt show_counters = 1; 146a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell break; 147a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell 148a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell case 't': 149a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell /* Select specific table. */ 150a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell tablename = optarg; 151a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell break; 152fbb5639c02218acfd84c4f25f134efecb564fee1Jan Engelhardt case 'M': 153fbb5639c02218acfd84c4f25f134efecb564fee1Jan Engelhardt xtables_modprobe_program = optarg; 154fbb5639c02218acfd84c4f25f134efecb564fee1Jan Engelhardt break; 155a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell case 'd': 156ae1ff9f96a80379a650dec979b9902528a10d45aHarald Welte do_output(tablename); 157a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell exit(0); 158a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell } 159a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell } 160a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell 161a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell if (optind < argc) { 162972af09e79618c5086e26ef6438bd38c45c4bb3fPavel Rusnak fprintf(stderr, "Unknown arguments found on commandline\n"); 163e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher exit(1); 164e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } 165e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 166a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell return !do_output(tablename); 167e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher} 168