X-Git-Url: http://git.archive.openwrt.org/?a=blobdiff_plain;f=iptables.c;h=95fc0d45835d565217d8caad63dc4486a92c426b;hb=dd013720b42d6df91176dc9e87f815dcd5d69519;hp=a27da142acaa11640ebc5b7111628c1640681d83;hpb=410cff5e62db45e8415bf25bf50395b4e7e22482;p=project%2Ffirewall3.git diff --git a/iptables.c b/iptables.c index a27da14..95fc0d4 100644 --- a/iptables.c +++ b/iptables.c @@ -1,7 +1,7 @@ /* * firewall3 - 3rd OpenWrt UCI firewall implementation * - * Copyright (C) 2013 Jo-Philipp Wich + * Copyright (C) 2013 Jo-Philipp Wich * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -29,14 +29,30 @@ static struct xtables_globals xtg = { .option_offset = 0, .program_version = "4", .orig_opts = base_opts, +#if XTABLES_VERSION_CODE > 10 + .compat_rev = xtables_compatible_revision, +#endif }; static struct xtables_globals xtg6 = { .option_offset = 0, .program_version = "6", .orig_opts = base_opts, +#if XTABLES_VERSION_CODE > 10 + .compat_rev = xtables_compatible_revision, +#endif }; +static struct { + bool retain; + int mcount, tcount; + struct xtables_match **matches; + struct xtables_target **targets; + void (*register_match)(struct xtables_match *); + void (*register_target)(struct xtables_target *); +} xext; + + /* Required by certain extensions like SNAT and DNAT */ int kernel_version = 0; @@ -66,6 +82,7 @@ static void fw3_init_extensions(void) struct fw3_ipt_handle * fw3_ipt_open(enum fw3_family family, enum fw3_table table) { + int i; struct fw3_ipt_handle *h; h = fw3_alloc(sizeof(*h)); @@ -102,6 +119,14 @@ fw3_ipt_open(enum fw3_family family, enum fw3_table table) fw3_xt_reset(); fw3_init_extensions(); + if (xext.register_match) + for (i = 0; i < xext.mcount; i++) + xext.register_match(xext.matches[i]); + + if (xext.register_target) + for (i = 0; i < xext.tcount; i++) + xext.register_target(xext.targets[i]); + return h; } @@ -467,17 +492,6 @@ fw3_ipt_commit(struct fw3_ipt_handle *h) void fw3_ipt_close(struct fw3_ipt_handle *h) { - if (h->libv) - { - while (h->libc > 0) - { - h->libc--; - dlclose(h->libv[h->libc]); - } - - free(h->libv); - } - free(h); } @@ -525,9 +539,11 @@ static bool load_extension(struct fw3_ipt_handle *h, const char *name) { char path[256]; - void *lib, **tmp; + void *lib; const char *pfx = (h->family == FW3_FAMILY_V6) ? "libip6t" : "libipt"; + xext.retain = true; + snprintf(path, sizeof(path), "/usr/lib/iptables/libxt_%s.so", name); if (!(lib = dlopen(path, RTLD_NOW))) { @@ -535,18 +551,9 @@ load_extension(struct fw3_ipt_handle *h, const char *name) lib = dlopen(path, RTLD_NOW); } - if (!lib) - return false; - - tmp = realloc(h->libv, sizeof(lib) * (h->libc + 1)); + xext.retain = false; - if (!tmp) - return false; - - h->libv = tmp; - h->libv[h->libc++] = lib; - - return true; + return !!lib; } static struct xtables_match * @@ -1030,7 +1037,7 @@ fw3_ipt_rule_time(struct fw3_ipt_rule *r, struct fw3_time *time) { for (i = 1, p = buf; i < 32; i++) { - if (hasbit(time->monthdays, i)) + if (fw3_hasbit(time->monthdays, i)) { if (p > buf) *p++ = ','; @@ -1039,14 +1046,14 @@ fw3_ipt_rule_time(struct fw3_ipt_rule *r, struct fw3_time *time) } } - fw3_ipt_rule_addarg(r, hasbit(time->monthdays, 0), "--monthdays", buf); + fw3_ipt_rule_addarg(r, fw3_hasbit(time->monthdays, 0), "--monthdays", buf); } if (time->weekdays & 0xFE) { for (i = 1, p = buf; i < 8; i++) { - if (hasbit(time->weekdays, i)) + if (fw3_hasbit(time->weekdays, i)) { if (p > buf) *p++ = ','; @@ -1055,7 +1062,7 @@ fw3_ipt_rule_time(struct fw3_ipt_rule *r, struct fw3_time *time) } } - fw3_ipt_rule_addarg(r, hasbit(time->weekdays, 0), "--weekdays", buf); + fw3_ipt_rule_addarg(r, fw3_hasbit(time->weekdays, 0), "--weekdays", buf); } } @@ -1126,7 +1133,7 @@ rule_print6(struct ip6t_entry *e) if (e->ipv6.flags & IP6T_F_PROTO) { - if (e->ipv6.flags & XT_INV_PROTO) + if (e->ipv6.invflags & XT_INV_PROTO) printf(" !"); pname = get_protoname(container_of(e, struct fw3_ipt_rule, e6)); @@ -1139,7 +1146,7 @@ rule_print6(struct ip6t_entry *e) if (e->ipv6.iniface[0]) { - if (e->ipv6.flags & IP6T_INV_VIA_IN) + if (e->ipv6.invflags & IP6T_INV_VIA_IN) printf(" !"); printf(" -i %s", e->ipv6.iniface); @@ -1147,7 +1154,7 @@ rule_print6(struct ip6t_entry *e) if (e->ipv6.outiface[0]) { - if (e->ipv6.flags & IP6T_INV_VIA_OUT) + if (e->ipv6.invflags & IP6T_INV_VIA_OUT) printf(" !"); printf(" -o %s", e->ipv6.outiface); @@ -1155,7 +1162,7 @@ rule_print6(struct ip6t_entry *e) if (memcmp(&e->ipv6.src, &in6addr_any, sizeof(struct in6_addr))) { - if (e->ipv6.flags & IP6T_INV_SRCIP) + if (e->ipv6.invflags & IP6T_INV_SRCIP) printf(" !"); printf(" -s %s/%s", @@ -1165,7 +1172,7 @@ rule_print6(struct ip6t_entry *e) if (memcmp(&e->ipv6.dst, &in6addr_any, sizeof(struct in6_addr))) { - if (e->ipv6.flags & IP6T_INV_DSTIP) + if (e->ipv6.invflags & IP6T_INV_DSTIP) printf(" !"); printf(" -d %s/%s", @@ -1184,7 +1191,7 @@ rule_print4(struct ipt_entry *e) if (e->ip.proto) { - if (e->ip.flags & XT_INV_PROTO) + if (e->ip.invflags & XT_INV_PROTO) printf(" !"); pname = get_protoname(container_of(e, struct fw3_ipt_rule, e)); @@ -1197,7 +1204,7 @@ rule_print4(struct ipt_entry *e) if (e->ip.iniface[0]) { - if (e->ip.flags & IPT_INV_VIA_IN) + if (e->ip.invflags & IPT_INV_VIA_IN) printf(" !"); printf(" -i %s", e->ip.iniface); @@ -1205,7 +1212,7 @@ rule_print4(struct ipt_entry *e) if (e->ip.outiface[0]) { - if (e->ip.flags & IPT_INV_VIA_OUT) + if (e->ip.invflags & IPT_INV_VIA_OUT) printf(" !"); printf(" -o %s", e->ip.outiface); @@ -1213,7 +1220,7 @@ rule_print4(struct ipt_entry *e) if (memcmp(&e->ip.src, &in_zero, sizeof(struct in_addr))) { - if (e->ip.flags & IPT_INV_SRCIP) + if (e->ip.invflags & IPT_INV_SRCIP) printf(" !"); printf(" -s %s/%s", @@ -1223,7 +1230,7 @@ rule_print4(struct ipt_entry *e) if (memcmp(&e->ip.dst, &in_zero, sizeof(struct in_addr))) { - if (e->ip.flags & IPT_INV_DSTIP) + if (e->ip.invflags & IPT_INV_DSTIP) printf(" !"); printf(" -d %s/%s", @@ -1642,3 +1649,63 @@ fw3_ipt_rule_create(struct fw3_ipt_handle *handle, struct fw3_protocol *proto, return r; } + +void +xtables_register_match(struct xtables_match *me) +{ + int i; + static struct xtables_match **tmp; + + if (!xext.register_match) + xext.register_match = dlsym(RTLD_NEXT, "xtables_register_match"); + + if (!xext.register_match) + return; + + xext.register_match(me); + + if (xext.retain) + { + for (i = 0; i < xext.mcount; i++) + if (xext.matches[i] == me) + return; + + tmp = realloc(xext.matches, sizeof(me) * (xext.mcount + 1)); + + if (!tmp) + return; + + xext.matches = tmp; + xext.matches[xext.mcount++] = me; + } +} + +void +xtables_register_target(struct xtables_target *me) +{ + int i; + static struct xtables_target **tmp; + + if (!xext.register_target) + xext.register_target = dlsym(RTLD_NEXT, "xtables_register_target"); + + if (!xext.register_target) + return; + + xext.register_target(me); + + if (xext.retain) + { + for (i = 0; i < xext.tcount; i++) + if (xext.targets[i] == me) + return; + + tmp = realloc(xext.targets, sizeof(me) * (xext.tcount + 1)); + + if (!tmp) + return; + + xext.targets = tmp; + xext.targets[xext.tcount++] = me; + } +}