iptables-save.c revision 296dca39be1166c4b7c6367c1b97ee95aebddfc3
1e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Code to save the iptables state, in human readable-form. */ 210a907f6736864f3f60d36f78c78e655b6bb64eeHarald Welte/* (C) 1999 by Paul 'Rusty' Russell <rusty@rustcorp.com.au> and 310a907f6736864f3f60d36f78c78e655b6bb64eeHarald Welte * (C) 2000-2002 by Harald Welte <laforge@gnumonks.org> 410a907f6736864f3f60d36f78c78e655b6bb64eeHarald Welte * 510a907f6736864f3f60d36f78c78e655b6bb64eeHarald Welte * This code is distributed under the terms of GNU GPL v2 610a907f6736864f3f60d36f78c78e655b6bb64eeHarald Welte * 7ae1ff9f96a80379a650dec979b9902528a10d45aHarald Welte */ 8e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#include <getopt.h> 9e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#include <sys/errno.h> 10e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#include <stdio.h> 11ae1ff9f96a80379a650dec979b9902528a10d45aHarald Welte#include <fcntl.h> 12ae1ff9f96a80379a650dec979b9902528a10d45aHarald Welte#include <stdlib.h> 13ae1ff9f96a80379a650dec979b9902528a10d45aHarald Welte#include <string.h> 14e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher#include <time.h> 15d8ac967249f78212e1fe5eb55e9a417ac1d737d6Harald Welte#include <netdb.h> 16b1f69befb5b35d0cbf607ed13a6e823a94cb79ffRusty Russell#include "libiptc/libiptc.h" 17b1f69befb5b35d0cbf607ed13a6e823a94cb79ffRusty Russell#include "iptables.h" 1833690a1aec0b6309ff90066ca56285b6e43013f2Jan Engelhardt#include "iptables-multi.h" 19e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 205a26b5fd7bf11ca93d54fe7dc24b3423fb7d89b2Mike Frysinger#ifndef NO_SHARED_LIBS 215a26b5fd7bf11ca93d54fe7dc24b3423fb7d89b2Mike Frysinger#include <dlfcn.h> 225a26b5fd7bf11ca93d54fe7dc24b3423fb7d89b2Mike Frysinger#endif 235a26b5fd7bf11ca93d54fe7dc24b3423fb7d89b2Mike Frysinger 24296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardtstatic int show_counters = 0; 25a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell 267bc3cb7eec4c4db5edc4b503a5dfab799e0bce62Gáspár Lajosstatic const struct option options[] = { 277bc3cb7eec4c4db5edc4b503a5dfab799e0bce62Gáspár Lajos {.name = "counters", .has_arg = false, .val = 'c'}, 287bc3cb7eec4c4db5edc4b503a5dfab799e0bce62Gáspár Lajos {.name = "dump", .has_arg = false, .val = 'd'}, 297bc3cb7eec4c4db5edc4b503a5dfab799e0bce62Gáspár Lajos {.name = "table", .has_arg = true, .val = 't'}, 30fbb5639c02218acfd84c4f25f134efecb564fee1Jan Engelhardt {.name = "modprobe", .has_arg = true, .val = 'M'}, 317bc3cb7eec4c4db5edc4b503a5dfab799e0bce62Gáspár Lajos {NULL}, 32e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher}; 33e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 34e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher/* Debugging prototype. */ 35a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russellstatic int for_each_table(int (*func)(const char *tablename)) 36e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher{ 375b76f682f722bebc2f0616fca4600eee2c08dfe2Max Kellermann int ret = 1; 38ae1ff9f96a80379a650dec979b9902528a10d45aHarald Welte FILE *procfile = NULL; 39a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell char tablename[IPT_TABLE_MAXNAMELEN+1]; 40a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell 41a239728ec064666025de2723997d87b176d57fd6Maciej Zenczykowski procfile = fopen("/proc/net/ip_tables_names", "re"); 42a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell if (!procfile) 43fbb5639c02218acfd84c4f25f134efecb564fee1Jan Engelhardt return ret; 44a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell 45a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell while (fgets(tablename, sizeof(tablename), procfile)) { 46a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell if (tablename[strlen(tablename) - 1] != '\n') 471829ed482efbc8b390cc760d012b3a4450494e1aJan Engelhardt xtables_error(OTHER_PROBLEM, 48a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell "Badly formed tablename `%s'\n", 49a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell tablename); 50a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell tablename[strlen(tablename) - 1] = '\0'; 51a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell ret &= func(tablename); 52a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell } 53e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 54f1afcc896e7f8be3a6419681fd8cdee1d600a3aaJan Engelhardt fclose(procfile); 55a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell return ret; 56a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell} 575b76f682f722bebc2f0616fca4600eee2c08dfe2Max Kellermann 58e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 59a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russellstatic int do_output(const char *tablename) 60a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell{ 61fd1873110f8e57be578df17fc9d03536b10f4f73Jan Engelhardt struct iptc_handle *h; 62a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell const char *chain = NULL; 63e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 64a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell if (!tablename) 65a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell return for_each_table(&do_output); 66e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 67a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell h = iptc_init(tablename); 68fbb5639c02218acfd84c4f25f134efecb564fee1Jan Engelhardt if (h == NULL) { 69fbb5639c02218acfd84c4f25f134efecb564fee1Jan Engelhardt xtables_load_ko(xtables_modprobe_program, false); 70fbb5639c02218acfd84c4f25f134efecb564fee1Jan Engelhardt h = iptc_init(tablename); 71fbb5639c02218acfd84c4f25f134efecb564fee1Jan Engelhardt } 72a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell if (!h) 731829ed482efbc8b390cc760d012b3a4450494e1aJan Engelhardt xtables_error(OTHER_PROBLEM, "Cannot initialize: %s\n", 74a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell iptc_strerror(errno)); 75e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 76296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt time_t now = time(NULL); 77296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt 78296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt printf("# Generated by iptables-save v%s on %s", 79296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt IPTABLES_VERSION, ctime(&now)); 80296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt printf("*%s\n", tablename); 81296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt 82296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt /* Dump out chain names first, 83296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt * thereby preventing dependency conflicts */ 84296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt for (chain = iptc_first_chain(h); 85296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt chain; 86296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt chain = iptc_next_chain(h)) { 87296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt 88296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt printf(":%s ", chain); 89296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt if (iptc_builtin(chain, h)) { 90296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt struct ipt_counters count; 91296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt printf("%s ", 92296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt iptc_get_policy(chain, &count, h)); 93296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt printf("[%llu:%llu]\n", (unsigned long long)count.pcnt, (unsigned long long)count.bcnt); 94296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt } else { 95296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt printf("- [0:0]\n"); 969f7fa49a6e1cd803de8a42fa849582d5d72822bfHarald Welte } 97296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt } 985b76f682f722bebc2f0616fca4600eee2c08dfe2Max Kellermann 99296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt for (chain = iptc_first_chain(h); 100296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt chain; 101296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt chain = iptc_next_chain(h)) { 102296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt const struct ipt_entry *e; 1039f7fa49a6e1cd803de8a42fa849582d5d72822bfHarald Welte 104296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt /* Dump out rules */ 105296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt e = iptc_first_rule(chain, h); 106296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt while(e) { 107296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt print_rule4(e, h, chain, show_counters); 108296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt e = iptc_next_rule(e, h); 109e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } 110a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell } 111a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell 112296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt now = time(NULL); 113296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt printf("COMMIT\n"); 114296dca39be1166c4b7c6367c1b97ee95aebddfc3Jan Engelhardt printf("# Completed on %s", ctime(&now)); 1151c9015b2cb483678f153121255e10ec0bbfde3e6Jan Engelhardt iptc_free(h); 116841e4aed2349046eb2c0b1375139c06569a93bd0Martin Josefsson 117a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell return 1; 118a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell} 119a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell 120a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell/* Format: 121a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell * :Chain name POLICY packets bytes 122a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell * rule 123a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell */ 1244e3771f04687657753f2a3666225341a3525f07eBastiaan Bakkerint 1254e3771f04687657753f2a3666225341a3525f07eBastiaan Bakkeriptables_save_main(int argc, char *argv[]) 126a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell{ 127a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell const char *tablename = NULL; 128a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell int c; 129a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell 130617d3d140f4739558dce2ef8ed01aef251cf5487Jamal Hadi Salim iptables_globals.program_name = "iptables-save"; 1317e4db2f50133007f549f222468bde4f3adcf41acJamal Hadi Salim c = xtables_init_all(&iptables_globals, NFPROTO_IPV4); 1327e4db2f50133007f549f222468bde4f3adcf41acJamal Hadi Salim if (c < 0) { 1337e4db2f50133007f549f222468bde4f3adcf41acJamal Hadi Salim fprintf(stderr, "%s/%s Failed to initialize xtables\n", 1347e4db2f50133007f549f222468bde4f3adcf41acJamal Hadi Salim iptables_globals.program_name, 1357e4db2f50133007f549f222468bde4f3adcf41acJamal Hadi Salim iptables_globals.program_version); 1367e4db2f50133007f549f222468bde4f3adcf41acJamal Hadi Salim exit(1); 1377e4db2f50133007f549f222468bde4f3adcf41acJamal Hadi Salim } 138b79ec69027fd8b65e7eccd78a445b6665e8ad53bJan Engelhardt#if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS) 1399a9694fbf1796a6a5011b60b2a15c01fa3c61368Maciej Żenczykowski init_extensions(); 1405e8f947becc00a79e78b2a6cf0e25fd674c57ec4Maciej Zenczykowski init_extensions4(); 1413efb6ead2e51fe1eca55bcb2b06afb4dc4b8cb7cHarald Welte#endif 1423efb6ead2e51fe1eca55bcb2b06afb4dc4b8cb7cHarald Welte 143163ad7801e93e4d8d3308741d34bcc1ee695d87bMarc Boucher while ((c = getopt_long(argc, argv, "bcdt:", options, NULL)) != -1) { 144a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell switch (c) { 145a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell case 'c': 146dbb77543ad6afe29e9a1881b2d4fc212de621a55Jan Engelhardt show_counters = 1; 147a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell break; 148a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell 149a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell case 't': 150a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell /* Select specific table. */ 151a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell tablename = optarg; 152a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell break; 153fbb5639c02218acfd84c4f25f134efecb564fee1Jan Engelhardt case 'M': 154fbb5639c02218acfd84c4f25f134efecb564fee1Jan Engelhardt xtables_modprobe_program = optarg; 155fbb5639c02218acfd84c4f25f134efecb564fee1Jan Engelhardt break; 156a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell case 'd': 157ae1ff9f96a80379a650dec979b9902528a10d45aHarald Welte do_output(tablename); 158a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell exit(0); 159a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell } 160a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell } 161a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell 162a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell if (optind < argc) { 163972af09e79618c5086e26ef6438bd38c45c4bb3fPavel Rusnak fprintf(stderr, "Unknown arguments found on commandline\n"); 164e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher exit(1); 165e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher } 166e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher 167a8f033e89981d019c8a4214b9094f2b2411bea18Rusty Russell return !do_output(tablename); 168e6869a8f59d779ff4d5a0984c86d80db7078496Marc Boucher} 169