iptables.c

   1 /*
   2  * firewall3 - 3rd OpenWrt UCI firewall implementation
   3  *
   4  *   Copyright (C) 2013 Jo-Philipp Wich <jo@mein.io>
   5  *
   6  * Permission to use, copy, modify, and/or distribute this software for any
   7  * purpose with or without fee is hereby granted, provided that the above
   8  * copyright notice and this permission notice appear in all copies.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17  */
  18
  19 #define _GNU_SOURCE /* RTLD_NEXT */
  20
  21 /* include userspace headers */
  22 #include <dlfcn.h>
  23 #include <unistd.h>
  24 #include <getopt.h>
  25 #include <net/if.h>
  26 #include <netinet/in.h>
  27 #include <sys/utsname.h>
  28 #include <sys/socket.h>
  29
  30 /* prevent indirect inclusion of kernel headers */
  31 #define _LINUX_IF_H
  32 #define _LINUX_IN_H
  33 #define _LINUX_IN6_H
  34
  35 /* prevent libiptc from including kernel headers */
  36 #define _FWCHAINS_KERNEL_HEADERS_H
  37
  38 /* finally include libiptc and xtables */
  39 #include <libiptc/libiptc.h>
  40 #include <libiptc/libip6tc.h>
  41 #include <xtables.h>
  42
  43 #include <setjmp.h>
  44
  45 #include "options.h"
  46
  47 /* xtables interface */
  48 #if (XTABLES_VERSION_CODE >= 10)
  49 # include "xtables-10.h"
  50 #elif (XTABLES_VERSION_CODE == 5)
  51 # include "xtables-5.h"
  52 #else
  53 # error "Unsupported xtables version"
  54 #endif
  55
  56 #include "iptables.h"
  57
  58
  59 struct fw3_ipt_rule {
  60         struct fw3_ipt_handle *h;
  61
  62         union {
  63                 struct ipt_entry e;
  64                 struct ip6t_entry e6;
  65         };
  66
  67         struct xtables_rule_match *matches;
  68         struct xtables_target *target;
  69
  70         int argc;
  71         char **argv;
  72
  73         uint32_t protocol;
  74         bool protocol_loaded;
  75 };
  76
  77 static struct option base_opts[] = {
  78         { .name = "match",         .has_arg = 1, .val = 'm' },
  79         { .name = "jump",          .has_arg = 1, .val = 'j' },
  80         { .name = "in-interface",  .has_arg = 1, .val = 'i' },
  81         { .name = "out-interface", .has_arg = 1, .val = 'o' },
  82         { .name = "source",        .has_arg = 1, .val = 's' },
  83         { .name = "destination",   .has_arg = 1, .val = 'd' },
  84         { NULL }
  85 };
  86
  87
  88 static jmp_buf fw3_ipt_error_jmp;
  89
  90 static __attribute__((noreturn))
  91 void fw3_ipt_error_handler(enum xtables_exittype status,
  92                            const char *fmt, ...)
  93 {
  94         va_list args;
  95
  96         fprintf(stderr, "     ! Exception: ");
  97
  98         va_start(args, fmt);
  99         vfprintf(stderr, fmt, args);
 100         va_end(args);
 101
 102         longjmp(fw3_ipt_error_jmp, status);
 103 }
 104
 105 static struct xtables_globals xtg = {
 106         .option_offset = 0,
 107         .program_version = "4",
 108         .orig_opts = base_opts,
 109         .exit_err = fw3_ipt_error_handler,
 110 #if XTABLES_VERSION_CODE > 10
 111         .compat_rev = xtables_compatible_revision,
 112 #endif
 113 };
 114
 115 static struct xtables_globals xtg6 = {
 116         .option_offset = 0,
 117         .program_version = "6",
 118         .orig_opts = base_opts,
 119         .exit_err = fw3_ipt_error_handler,
 120 #if XTABLES_VERSION_CODE > 10
 121         .compat_rev = xtables_compatible_revision,
 122 #endif
 123 };
 124
 125 static struct {
 126         bool retain;
 127         int mcount, tcount;
 128         struct xtables_match **matches;
 129         struct xtables_target **targets;
 130         void (*register_match)(struct xtables_match *);
 131         void (*register_target)(struct xtables_target *);
 132 } xext;
 133
 134
 135 /* Required by certain extensions like SNAT and DNAT */
 136 int kernel_version = 0;
 137
 138 void
 139 get_kernel_version(void)
 140 {
 141         static struct utsname uts;
 142         int x = 0, y = 0, z = 0;
 143
 144         if (uname(&uts) == -1)
 145                 sprintf(uts.release, "3.0.0");
 146
 147         sscanf(uts.release, "%d.%d.%d", &x, &y, &z);
 148         kernel_version = 0x10000 * x + 0x100 * y + z;
 149 }
 150
 151 static void fw3_init_extensions(void)
 152 {
 153         init_extensions();
 154         init_extensions4();
 155
 156 #ifndef DISABLE_IPV6
 157         init_extensions6();
 158 #endif
 159 }
 160
 161 struct fw3_ipt_handle *
 162 fw3_ipt_open(enum fw3_family family, enum fw3_table table)
 163 {
 164         int i;
 165         struct fw3_ipt_handle *h;
 166
 167         h = fw3_alloc(sizeof(*h));
 168
 169         xtables_init();
 170
 171         if (family == FW3_FAMILY_V6)
 172         {
 173 #ifndef DISABLE_IPV6
 174                 h->family = FW3_FAMILY_V6;
 175                 h->table  = table;
 176                 h->handle = ip6tc_init(fw3_flag_names[table]);
 177
 178                 xtables_set_params(&xtg6);
 179                 xtables_set_nfproto(NFPROTO_IPV6);
 180 #endif
 181         }
 182         else
 183         {
 184                 h->family = FW3_FAMILY_V4;
 185                 h->table  = table;
 186                 h->handle = iptc_init(fw3_flag_names[table]);
 187
 188                 xtables_set_params(&xtg);
 189                 xtables_set_nfproto(NFPROTO_IPV4);
 190         }
 191
 192         if (!h->handle)
 193         {
 194                 free(h);
 195                 return NULL;
 196         }
 197
 198         fw3_xt_reset();
 199         fw3_init_extensions();
 200
 201         if (xext.register_match)
 202                 for (i = 0; i < xext.mcount; i++)
 203                         xext.register_match(xext.matches[i]);
 204
 205         if (xext.register_target)
 206                 for (i = 0; i < xext.tcount; i++)
 207                         xext.register_target(xext.targets[i]);
 208
 209         return h;
 210 }
 211
 212 static void
 213 debug(struct fw3_ipt_handle *h, const char *fmt, ...)
 214 {
 215         va_list ap;
 216
 217         printf("%s -t %s ", (h->family == FW3_FAMILY_V6) ? "ip6tables" : "iptables",
 218                             fw3_flag_names[h->table]);
 219
 220         va_start(ap, fmt);
 221         vprintf(fmt, ap);
 222         va_end(ap);
 223 }
 224
 225 void
 226 fw3_ipt_set_policy(struct fw3_ipt_handle *h, const char *chain,
 227                    enum fw3_flag policy)
 228 {
 229         if (fw3_pr_debug)
 230                 debug(h, "-P %s %s\n", chain, fw3_flag_names[policy]);
 231
 232 #ifndef DISABLE_IPV6
 233         if (h->family == FW3_FAMILY_V6)
 234                 ip6tc_set_policy(chain, fw3_flag_names[policy], NULL, h->handle);
 235         else
 236 #endif
 237                 iptc_set_policy(chain, fw3_flag_names[policy], NULL, h->handle);
 238 }
 239
 240 void
 241 fw3_ipt_flush_chain(struct fw3_ipt_handle *h, const char *chain)
 242 {
 243         if (fw3_pr_debug)
 244                 debug(h, "-F %s\n", chain);
 245
 246 #ifndef DISABLE_IPV6
 247         if (h->family == FW3_FAMILY_V6)
 248                 ip6tc_flush_entries(chain, h->handle);
 249         else
 250 #endif
 251                 iptc_flush_entries(chain, h->handle);
 252 }
 253
 254 static void
 255 delete_rules(struct fw3_ipt_handle *h, const char *target)
 256 {
 257         unsigned int num;
 258         const struct ipt_entry *e;
 259         const char *chain;
 260         const char *t;
 261         bool found;
 262
 263 #ifndef DISABLE_IPV6
 264         if (h->family == FW3_FAMILY_V6)
 265         {
 266                 for (chain = ip6tc_first_chain(h->handle);
 267                      chain != NULL;
 268                      chain = ip6tc_next_chain(h->handle))
 269                 {
 270                         do {
 271                                 found = false;
 272
 273                                 const struct ip6t_entry *e6;
 274                                 for (num = 0, e6 = ip6tc_first_rule(chain, h->handle);
 275                                          e6 != NULL;
 276                                          num++, e6 = ip6tc_next_rule(e6, h->handle))
 277                                 {
 278                                         t = ip6tc_get_target(e6, h->handle);
 279
 280                                         if (*t && !strcmp(t, target))
 281                                         {
 282                                                 if (fw3_pr_debug)
 283                                                         debug(h, "-D %s %u\n", chain, num + 1);
 284
 285                                                 ip6tc_delete_num_entry(chain, num, h->handle);
 286                                                 found = true;
 287                                                 break;
 288                                         }
 289                                 }
 290                         } while (found);
 291                 }
 292         }
 293         else
 294 #endif
 295         {
 296                 for (chain = iptc_first_chain(h->handle);
 297                      chain != NULL;
 298                      chain = iptc_next_chain(h->handle))
 299                 {
 300                         do {
 301                                 found = false;
 302
 303                                 for (num = 0, e = iptc_first_rule(chain, h->handle);
 304                                      e != NULL;
 305                                          num++, e = iptc_next_rule(e, h->handle))
 306                                 {
 307                                         t = iptc_get_target(e, h->handle);
 308
 309                                         if (*t && !strcmp(t, target))
 310                                         {
 311                                                 if (fw3_pr_debug)
 312                                                         debug(h, "-D %s %u\n", chain, num + 1);
 313
 314                                                 iptc_delete_num_entry(chain, num, h->handle);
 315                                                 found = true;
 316                                                 break;
 317                                         }
 318                                 }
 319                         } while (found);
 320                 }
 321         }
 322 }
 323
 324 void
 325 fw3_ipt_delete_chain(struct fw3_ipt_handle *h, const char *chain)
 326 {
 327         delete_rules(h, chain);
 328
 329         if (fw3_pr_debug)
 330                 debug(h, "-X %s\n", chain);
 331
 332 #ifndef DISABLE_IPV6
 333         if (h->family == FW3_FAMILY_V6)
 334                 ip6tc_delete_chain(chain, h->handle);
 335         else
 336 #endif
 337                 iptc_delete_chain(chain, h->handle);
 338 }
 339
 340 static bool
 341 has_rule_tag(const void *base, unsigned int start, unsigned int end)
 342 {
 343         unsigned int i;
 344         const struct xt_entry_match *em;
 345
 346         for (i = start; i < end; i += em->u.match_size)
 347         {
 348                 em = base + i;
 349
 350                 if (strcmp(em->u.user.name, "comment"))
 351                         continue;
 352
 353                 if (!memcmp(em->data, "!fw3", 4))
 354                         return true;
 355         }
 356
 357         return false;
 358 }
 359
 360 void
 361 fw3_ipt_delete_id_rules(struct fw3_ipt_handle *h, const char *chain)
 362 {
 363         unsigned int num;
 364         const struct ipt_entry *e;
 365         bool found;
 366
 367 #ifndef DISABLE_IPV6
 368         if (h->family == FW3_FAMILY_V6)
 369         {
 370                 if (!ip6tc_is_chain(chain, h->handle))
 371                         return;
 372
 373                 do {
 374                         found = false;
 375
 376                         const struct ip6t_entry *e6;
 377                         for (num = 0, e6 = ip6tc_first_rule(chain, h->handle);
 378                                  e6 != NULL;
 379                                  num++, e6 = ip6tc_next_rule(e6, h->handle))
 380                         {
 381                                 if (has_rule_tag(e6, sizeof(*e6), e6->target_offset))
 382                                 {
 383                                         if (fw3_pr_debug)
 384                                                 debug(h, "-D %s %u\n", chain, num + 1);
 385
 386                                         ip6tc_delete_num_entry(chain, num, h->handle);
 387                                         found = true;
 388                                         break;
 389                                 }
 390                         }
 391                 } while (found);
 392         }
 393         else
 394 #endif
 395         {
 396                 if (!iptc_is_chain(chain, h->handle))
 397                         return;
 398
 399                 do {
 400                         found = false;
 401
 402                         for (num = 0, e = iptc_first_rule(chain, h->handle);
 403                                  e != NULL;
 404                                  num++, e = iptc_next_rule(e, h->handle))
 405                         {
 406                                 if (has_rule_tag(e, sizeof(*e), e->target_offset))
 407                                 {
 408                                         if (fw3_pr_debug)
 409                                                 debug(h, "-D %s %u\n", chain, num + 1);
 410
 411                                         iptc_delete_num_entry(chain, num, h->handle);
 412                                         found = true;
 413                                         break;
 414                                 }
 415                         }
 416                 } while (found);
 417         }
 418 }
 419
 420 void
 421 fw3_ipt_create_chain(struct fw3_ipt_handle *h, const char *fmt, ...)
 422 {
 423         char buf[32];
 424         va_list ap;
 425
 426         va_start(ap, fmt);
 427         vsnprintf(buf, sizeof(buf) - 1, fmt, ap);
 428         va_end(ap);
 429
 430         if (fw3_pr_debug)
 431                 debug(h, "-N %s\n", buf);
 432
 433         iptc_create_chain(buf, h->handle);
 434 }
 435
 436 void
 437 fw3_ipt_flush(struct fw3_ipt_handle *h)
 438 {
 439         const char *chain;
 440
 441 #ifndef DISABLE_IPV6
 442         if (h->family == FW3_FAMILY_V6)
 443         {
 444                 for (chain = ip6tc_first_chain(h->handle);
 445                      chain != NULL;
 446                      chain = ip6tc_next_chain(h->handle))
 447                 {
 448                         ip6tc_flush_entries(chain, h->handle);
 449                 }
 450
 451                 for (chain = ip6tc_first_chain(h->handle);
 452                      chain != NULL;
 453                      chain = ip6tc_next_chain(h->handle))
 454                 {
 455                         ip6tc_delete_chain(chain, h->handle);
 456                 }
 457         }
 458         else
 459 #endif
 460         {
 461                 for (chain = iptc_first_chain(h->handle);
 462                      chain != NULL;
 463                      chain = iptc_next_chain(h->handle))
 464                 {
 465                         iptc_flush_entries(chain, h->handle);
 466                 }
 467
 468                 for (chain = iptc_first_chain(h->handle);
 469                      chain != NULL;
 470                      chain = iptc_next_chain(h->handle))
 471                 {
 472                         iptc_delete_chain(chain, h->handle);
 473                 }
 474         }
 475 }
 476
 477 static bool
 478 chain_is_empty(struct fw3_ipt_handle *h, const char *chain)
 479 {
 480 #ifndef DISABLE_IPV6
 481         if (h->family == FW3_FAMILY_V6)
 482                 return (!ip6tc_builtin(chain, h->handle) &&
 483                         !ip6tc_first_rule(chain, h->handle));
 484 #endif
 485
 486         return (!iptc_builtin(chain, h->handle) &&
 487                 !iptc_first_rule(chain, h->handle));
 488 }
 489
 490 void
 491 fw3_ipt_gc(struct fw3_ipt_handle *h)
 492 {
 493         const char *chain;
 494         bool found;
 495
 496 #ifndef DISABLE_IPV6
 497         if (h->family == FW3_FAMILY_V6)
 498         {
 499                 do {
 500                         found = false;
 501
 502                         for (chain = ip6tc_first_chain(h->handle);
 503                                  chain != NULL;
 504                                  chain = ip6tc_next_chain(h->handle))
 505                         {
 506                                 if (!chain_is_empty(h, chain))
 507                                         continue;
 508
 509                                 fw3_ipt_delete_chain(h, chain);
 510                                 found = true;
 511                                 break;
 512                         }
 513                 } while(found);
 514         }
 515         else
 516 #endif
 517         {
 518                 do {
 519                         found = false;
 520
 521                         for (chain = iptc_first_chain(h->handle);
 522                                  chain != NULL;
 523                                  chain = iptc_next_chain(h->handle))
 524                         {
 525                                 warn("C=%s\n", chain);
 526
 527                                 if (!chain_is_empty(h, chain))
 528                                         continue;
 529
 530                                 warn("D=%s\n", chain);
 531
 532                                 fw3_ipt_delete_chain(h, chain);
 533                                 found = true;
 534                                 break;
 535                         }
 536                 } while (found);
 537         }
 538 }
 539
 540 void
 541 fw3_ipt_commit(struct fw3_ipt_handle *h)
 542 {
 543         int rv;
 544
 545 #ifndef DISABLE_IPV6
 546         if (h->family == FW3_FAMILY_V6)
 547         {
 548                 rv = ip6tc_commit(h->handle);
 549                 if (!rv)
 550                         warn("ip6tc_commit(): %s", ip6tc_strerror(errno));
 551         }
 552         else
 553 #endif
 554         {
 555                 rv = iptc_commit(h->handle);
 556                 if (!rv)
 557                         warn("iptc_commit(): %s", iptc_strerror(errno));
 558         }
 559 }
 560
 561 void
 562 fw3_ipt_close(struct fw3_ipt_handle *h)
 563 {
 564         free(h);
 565 }
 566
 567 struct fw3_ipt_rule *
 568 fw3_ipt_rule_new(struct fw3_ipt_handle *h)
 569 {
 570         struct fw3_ipt_rule *r;
 571
 572         r = fw3_alloc(sizeof(*r));
 573
 574         r->h = h;
 575         r->argv = fw3_alloc(sizeof(char *));
 576         r->argv[r->argc++] = "fw3";
 577
 578         return r;
 579 }
 580
 581
 582 static bool
 583 is_chain(struct fw3_ipt_handle *h, const char *name)
 584 {
 585 #ifndef DISABLE_IPV6
 586         if (h->family == FW3_FAMILY_V6)
 587                 return ip6tc_is_chain(name, h->handle);
 588         else
 589 #endif
 590                 return iptc_is_chain(name, h->handle);
 591 }
 592
 593 static char *
 594 get_protoname(struct fw3_ipt_rule *r)
 595 {
 596         const struct xtables_pprot *pp;
 597
 598         if (r->protocol)
 599                 for (pp = xtables_chain_protos; pp->name; pp++)
 600                         if (pp->num == r->protocol)
 601                                 return (char *)pp->name;
 602
 603         return NULL;
 604 }
 605
 606 static struct xtables_match *
 607 find_match(struct fw3_ipt_rule *r, const char *name)
 608 {
 609         struct xtables_match *m;
 610
 611         xext.retain = true;
 612         m = xtables_find_match(name, XTF_TRY_LOAD, &r->matches);
 613         xext.retain = false;
 614
 615         return m;
 616 }
 617
 618 static void
 619 init_match(struct fw3_ipt_rule *r, struct xtables_match *m, bool no_clone)
 620 {
 621         size_t s;
 622         struct xtables_globals *g;
 623
 624         if (!m)
 625                 return;
 626
 627         s = XT_ALIGN(sizeof(struct xt_entry_match)) + m->size;
 628
 629         m->m = fw3_alloc(s);
 630
 631         fw3_xt_set_match_name(m);
 632
 633         m->m->u.user.revision = m->revision;
 634         m->m->u.match_size = s;
 635
 636         /* free previous userspace data */
 637         fw3_xt_free_match_udata(m);
 638
 639         if (m->init)
 640                 m->init(m->m);
 641
 642         /* don't merge options if no_clone is set and this match is a clone */
 643         if (no_clone && (m == m->next))
 644                 return;
 645
 646         /* merge option table */
 647         g = (r->h->family == FW3_FAMILY_V6) ? &xtg6 : &xtg;
 648         fw3_xt_merge_match_options(g, m);
 649 }
 650
 651 static bool
 652 need_protomatch(struct fw3_ipt_rule *r, const char *pname)
 653 {
 654         if (!pname)
 655                 return false;
 656
 657         if (!xtables_find_match(pname, XTF_DONT_LOAD, NULL))
 658                 return true;
 659
 660         return !r->protocol_loaded;
 661 }
 662
 663 static struct xtables_match *
 664 load_protomatch(struct fw3_ipt_rule *r)
 665 {
 666         const char *pname = get_protoname(r);
 667
 668         if (!need_protomatch(r, pname))
 669                 return NULL;
 670
 671         return find_match(r, pname);
 672 }
 673
 674 static struct xtables_target *
 675 find_target(struct fw3_ipt_rule *r, const char *name)
 676 {
 677         struct xtables_target *t;
 678
 679         xext.retain = true;
 680
 681         if (is_chain(r->h, name))
 682                 t = xtables_find_target(XT_STANDARD_TARGET, XTF_TRY_LOAD);
 683         else
 684                 t = xtables_find_target(name, XTF_TRY_LOAD);
 685
 686         xext.retain = false;
 687
 688         return t;
 689 }
 690
 691 static struct xtables_target *
 692 get_target(struct fw3_ipt_rule *r, const char *name)
 693 {
 694         size_t s;
 695         struct xtables_target *t;
 696         struct xtables_globals *g;
 697
 698         t = find_target(r, name);
 699
 700         if (!t)
 701                 return NULL;
 702
 703         s = XT_ALIGN(sizeof(struct xt_entry_target)) + t->size;
 704         t->t = fw3_alloc(s);
 705
 706         fw3_xt_set_target_name(t, name);
 707
 708         t->t->u.user.revision = t->revision;
 709         t->t->u.target_size = s;
 710
 711         /* free previous userspace data */
 712         fw3_xt_free_target_udata(t);
 713
 714         if (t->init)
 715                 t->init(t->t);
 716
 717         /* merge option table */
 718         g = (r->h->family == FW3_FAMILY_V6) ? &xtg6 : &xtg;
 719         fw3_xt_merge_target_options(g, t);
 720
 721         r->target = t;
 722
 723         return t;
 724 }
 725
 726 void
 727 fw3_ipt_rule_proto(struct fw3_ipt_rule *r, struct fw3_protocol *proto)
 728 {
 729         uint32_t pr;
 730
 731         if (!proto || proto->any)
 732                 return;
 733
 734         pr = proto->protocol;
 735
 736 #ifndef DISABLE_IPV6
 737         if (r->h->family == FW3_FAMILY_V6)
 738         {
 739                 if (pr == 1)
 740                         pr = 58;
 741
 742                 r->e6.ipv6.proto = pr;
 743                 r->e6.ipv6.flags |= IP6T_F_PROTO;
 744
 745                 if (proto->invert)
 746                         r->e6.ipv6.invflags |= XT_INV_PROTO;
 747         }
 748         else
 749 #endif
 750         {
 751                 r->e.ip.proto = pr;
 752
 753                 if (proto->invert)
 754                         r->e.ip.invflags |= XT_INV_PROTO;
 755         }
 756
 757         r->protocol = pr;
 758 }
 759
 760 void
 761 fw3_ipt_rule_in_out(struct fw3_ipt_rule *r,
 762                     struct fw3_device *in, struct fw3_device *out)
 763 {
 764 #ifndef DISABLE_IPV6
 765         if (r->h->family == FW3_FAMILY_V6)
 766         {
 767                 if (in && !in->any)
 768                 {
 769                         xtables_parse_interface(in->name, r->e6.ipv6.iniface,
 770                                                           r->e6.ipv6.iniface_mask);
 771
 772                         if (in->invert)
 773                                 r->e6.ipv6.invflags |= IP6T_INV_VIA_IN;
 774                 }
 775
 776                 if (out && !out->any)
 777                 {
 778                         xtables_parse_interface(out->name, r->e6.ipv6.outiface,
 779                                                            r->e6.ipv6.outiface_mask);
 780
 781                         if (out->invert)
 782                                 r->e6.ipv6.invflags |= IP6T_INV_VIA_OUT;
 783                 }
 784         }
 785         else
 786 #endif
 787         {
 788                 if (in && !in->any)
 789                 {
 790                         xtables_parse_interface(in->name, r->e.ip.iniface,
 791                                                           r->e.ip.iniface_mask);
 792
 793                         if (in->invert)
 794                                 r->e.ip.invflags |= IPT_INV_VIA_IN;
 795                 }
 796
 797                 if (out && !out->any)
 798                 {
 799                         xtables_parse_interface(out->name, r->e.ip.outiface,
 800                                                            r->e.ip.outiface_mask);
 801
 802                         if (out->invert)
 803                                 r->e.ip.invflags |= IPT_INV_VIA_OUT;
 804                 }
 805         }
 806 }
 807
 808
 809 void
 810 fw3_ipt_rule_src_dest(struct fw3_ipt_rule *r,
 811                       struct fw3_address *src, struct fw3_address *dest)
 812 {
 813         if ((src && src->range) || (dest && dest->range))
 814         {
 815                 fw3_ipt_rule_addarg(r, false, "-m", "iprange");
 816         }
 817
 818         if (src && src->set)
 819         {
 820                 if (src->range)
 821                 {
 822                         fw3_ipt_rule_addarg(r, src->invert, "--src-range",
 823                                             fw3_address_to_string(src, false, false));
 824                 }
 825 #ifndef DISABLE_IPV6
 826                 else if (r->h->family == FW3_FAMILY_V6)
 827                 {
 828                         r->e6.ipv6.src = src->address.v6;
 829                         r->e6.ipv6.smsk = src->mask.v6;
 830
 831                         int i;
 832                         for (i = 0; i < 4; i++)
 833                                 r->e6.ipv6.src.s6_addr32[i] &= r->e6.ipv6.smsk.s6_addr32[i];
 834
 835                         if (src->invert)
 836                                 r->e6.ipv6.invflags |= IP6T_INV_SRCIP;
 837                 }
 838 #endif
 839                 else
 840                 {
 841                         r->e.ip.src = src->address.v4;
 842                         r->e.ip.smsk = src->mask.v4;
 843
 844                         r->e.ip.src.s_addr &= r->e.ip.smsk.s_addr;
 845
 846                         if (src->invert)
 847                                 r->e.ip.invflags |= IPT_INV_SRCIP;
 848                 }
 849         }
 850
 851         if (dest && dest->set)
 852         {
 853                 if (dest->range)
 854                 {
 855                         fw3_ipt_rule_addarg(r, dest->invert, "--dst-range",
 856                                             fw3_address_to_string(dest, false, false));
 857                 }
 858 #ifndef DISABLE_IPV6
 859                 else if (r->h->family == FW3_FAMILY_V6)
 860                 {
 861                         r->e6.ipv6.dst = dest->address.v6;
 862                         r->e6.ipv6.dmsk = dest->mask.v6;
 863
 864                         int i;
 865                         for (i = 0; i < 4; i++)
 866                                 r->e6.ipv6.dst.s6_addr32[i] &= r->e6.ipv6.dmsk.s6_addr32[i];
 867
 868                         if (dest->invert)
 869                                 r->e6.ipv6.invflags |= IP6T_INV_DSTIP;
 870                 }
 871 #endif
 872                 else
 873                 {
 874                         r->e.ip.dst = dest->address.v4;
 875                         r->e.ip.dmsk = dest->mask.v4;
 876
 877                         r->e.ip.dst.s_addr &= r->e.ip.dmsk.s_addr;
 878
 879                         if (dest->invert)
 880                                 r->e.ip.invflags |= IPT_INV_DSTIP;
 881                 }
 882         }
 883 }
 884
 885 void
 886 fw3_ipt_rule_sport_dport(struct fw3_ipt_rule *r,
 887                          struct fw3_port *sp, struct fw3_port *dp)
 888 {
 889         char buf[sizeof("65535:65535\0")];
 890
 891         if ((!sp || !sp->set) && (!dp || !dp->set))
 892                 return;
 893
 894         if (!get_protoname(r))
 895                 return;
 896
 897         if (sp && sp->set)
 898         {
 899                 if (sp->port_min == sp->port_max)
 900                         sprintf(buf, "%u", sp->port_min);
 901                 else
 902                         sprintf(buf, "%u:%u", sp->port_min, sp->port_max);
 903
 904                 fw3_ipt_rule_addarg(r, sp->invert, "--sport", buf);
 905         }
 906
 907         if (dp && dp->set)
 908         {
 909                 if (dp->port_min == dp->port_max)
 910                         sprintf(buf, "%u", dp->port_min);
 911                 else
 912                         sprintf(buf, "%u:%u", dp->port_min, dp->port_max);
 913
 914                 fw3_ipt_rule_addarg(r, dp->invert, "--dport", buf);
 915         }
 916 }
 917
 918 void
 919 fw3_ipt_rule_device(struct fw3_ipt_rule *r, const char *device, bool out)
 920 {
 921         if (device) {
 922                 struct fw3_device dev = { .any = false };
 923                 strncpy(dev.name, device, sizeof(dev.name) - 1);
 924                 fw3_ipt_rule_in_out(r, (out) ? NULL : &dev, (out) ? &dev : NULL);
 925         }
 926 }
 927
 928 void
 929 fw3_ipt_rule_mac(struct fw3_ipt_rule *r, struct fw3_mac *mac)
 930 {
 931         char buf[sizeof("ff:ff:ff:ff:ff:ff\0")];
 932         uint8_t *addr = mac->mac.ether_addr_octet;
 933
 934         if (!mac)
 935                 return;
 936
 937         sprintf(buf, "%02x:%02x:%02x:%02x:%02x:%02x",
 938                 addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]);
 939
 940         fw3_ipt_rule_addarg(r, false, "-m", "mac");
 941         fw3_ipt_rule_addarg(r, mac->invert, "--mac-source", buf);
 942 }
 943
 944 void
 945 fw3_ipt_rule_icmptype(struct fw3_ipt_rule *r, struct fw3_icmptype *icmp)
 946 {
 947         char buf[sizeof("255/255\0")];
 948
 949         if (!icmp)
 950                 return;
 951
 952 #ifndef DISABLE_IPV6
 953         if (r->h->family == FW3_FAMILY_V6)
 954         {
 955                 if (icmp->code6_min == 0 && icmp->code6_max == 0xFF)
 956                         sprintf(buf, "%u", icmp->type6);
 957                 else
 958                         sprintf(buf, "%u/%u", icmp->type6, icmp->code6_min);
 959
 960                 fw3_ipt_rule_addarg(r, icmp->invert, "--icmpv6-type", buf);
 961         }
 962         else
 963 #endif
 964         {
 965                 if (icmp->code_min == 0 && icmp->code_max == 0xFF)
 966                         sprintf(buf, "%u", icmp->type);
 967                 else
 968                         sprintf(buf, "%u/%u", icmp->type, icmp->code_min);
 969
 970                 fw3_ipt_rule_addarg(r, icmp->invert, "--icmp-type", buf);
 971         }
 972 }
 973
 974 void
 975 fw3_ipt_rule_limit(struct fw3_ipt_rule *r, struct fw3_limit *limit)
 976 {
 977         char buf[sizeof("-4294967296/second\0")];
 978
 979         if (!limit || limit->rate <= 0)
 980                 return;
 981
 982         fw3_ipt_rule_addarg(r, false, "-m", "limit");
 983
 984         sprintf(buf, "%u/%s", limit->rate, fw3_limit_units[limit->unit]);
 985         fw3_ipt_rule_addarg(r, limit->invert, "--limit", buf);
 986
 987         if (limit->burst > 0)
 988         {
 989                 sprintf(buf, "%u", limit->burst);
 990                 fw3_ipt_rule_addarg(r, limit->invert, "--limit-burst", buf);
 991         }
 992 }
 993
 994 void
 995 fw3_ipt_rule_ipset(struct fw3_ipt_rule *r, struct fw3_setmatch *match)
 996 {
 997         char buf[sizeof("dst,dst,dst\0")];
 998         char *p = buf;
 999         int i = 0;
1000
1001         struct fw3_ipset *set;
1002         struct fw3_ipset_datatype *type;
1003
1004         if (!match || !match->set || !match->ptr)
1005                 return;
1006
1007         set = match->ptr;
1008         list_for_each_entry(type, &set->datatypes, list)
1009         {
1010                 if (i >= 3)
1011                         break;
1012
1013                 if (p > buf)
1014                         *p++ = ',';
1015
1016                 p += sprintf(p, "%s", match->dir[i] ? match->dir[i] : type->dir);
1017                 i++;
1018         }
1019
1020         fw3_ipt_rule_addarg(r, false, "-m", "set");
1021
1022         fw3_ipt_rule_addarg(r, match->invert, "--match-set",
1023                             set->external ? set->external : set->name);
1024
1025         fw3_ipt_rule_addarg(r, false, buf, NULL);
1026 }
1027
1028 void
1029 fw3_ipt_rule_helper(struct fw3_ipt_rule *r, struct fw3_cthelpermatch *match)
1030 {
1031         if (!match || !match->set || !match->ptr)
1032                 return;
1033
1034         fw3_ipt_rule_addarg(r, false, "-m", "helper");
1035         fw3_ipt_rule_addarg(r, match->invert, "--helper", match->ptr->name);
1036 }
1037
1038 void
1039 fw3_ipt_rule_time(struct fw3_ipt_rule *r, struct fw3_time *time)
1040 {
1041         int i;
1042         struct tm empty = { 0 };
1043
1044         char buf[84]; /* sizeof("1,2,3,...,30,31\0") */
1045         char *p;
1046
1047         bool d1 = memcmp(&time->datestart, &empty, sizeof(empty));
1048         bool d2 = memcmp(&time->datestop, &empty, sizeof(empty));
1049
1050         if (!d1 && !d2 && !time->timestart && !time->timestop &&
1051             !(time->monthdays & 0xFFFFFFFE) && !(time->weekdays & 0xFE))
1052         {
1053                 return;
1054         }
1055
1056         fw3_ipt_rule_addarg(r, false, "-m", "time");
1057
1058         if (!time->utc)
1059                 fw3_ipt_rule_addarg(r, false, "--kerneltz", NULL);
1060
1061         if (d1)
1062         {
1063                 strftime(buf, sizeof(buf), "%Y-%m-%dT%H:%M:%S", &time->datestart);
1064                 fw3_ipt_rule_addarg(r, false, "--datestart", buf);
1065         }
1066
1067         if (d2)
1068         {
1069                 strftime(buf, sizeof(buf), "%Y-%m-%dT%H:%M:%S", &time->datestop);
1070                 fw3_ipt_rule_addarg(r, false, "--datestop", buf);
1071         }
1072
1073         if (time->timestart)
1074         {
1075                 sprintf(buf, "%02d:%02d:%02d",
1076                         time->timestart / 3600,
1077                         time->timestart % 3600 / 60,
1078                         time->timestart % 60);
1079
1080                 fw3_ipt_rule_addarg(r, false, "--timestart", buf);
1081         }
1082
1083         if (time->timestop)
1084         {
1085                 sprintf(buf, "%02d:%02d:%02d",
1086                         time->timestop / 3600,
1087                         time->timestop % 3600 / 60,
1088                         time->timestop % 60);
1089
1090                 fw3_ipt_rule_addarg(r, false, "--timestop", buf);
1091         }
1092
1093         if (time->monthdays & 0xFFFFFFFE)
1094         {
1095                 for (i = 1, p = buf; i < 32; i++)
1096                 {
1097                         if (fw3_hasbit(time->monthdays, i))
1098                         {
1099                                 if (p > buf)
1100                                         *p++ = ',';
1101
1102                                 p += sprintf(p, "%u", i);
1103                         }
1104                 }
1105
1106                 fw3_ipt_rule_addarg(r, fw3_hasbit(time->monthdays, 0), "--monthdays", buf);
1107         }
1108
1109         if (time->weekdays & 0xFE)
1110         {
1111                 for (i = 1, p = buf; i < 8; i++)
1112                 {
1113                         if (fw3_hasbit(time->weekdays, i))
1114                         {
1115                                 if (p > buf)
1116                                         *p++ = ',';
1117
1118                                 p += sprintf(p, "%u", i);
1119                         }
1120                 }
1121
1122                 fw3_ipt_rule_addarg(r, fw3_hasbit(time->weekdays, 0), "--weekdays", buf);
1123         }
1124 }
1125
1126 void
1127 fw3_ipt_rule_mark(struct fw3_ipt_rule *r, struct fw3_mark *mark)
1128 {
1129         char buf[sizeof("0xFFFFFFFF/0xFFFFFFFF\0")];
1130
1131         if (!mark || !mark->set)
1132                 return;
1133
1134         if (mark->mask < 0xFFFFFFFF)
1135                 sprintf(buf, "0x%x/0x%x", mark->mark, mark->mask);
1136         else
1137                 sprintf(buf, "0x%x", mark->mark);
1138
1139         fw3_ipt_rule_addarg(r, false, "-m", "mark");
1140         fw3_ipt_rule_addarg(r, mark->invert, "--mark", buf);
1141 }
1142
1143 void
1144 fw3_ipt_rule_comment(struct fw3_ipt_rule *r, const char *fmt, ...)
1145 {
1146         va_list ap;
1147         char buf[256];
1148
1149         if (!fmt || !*fmt)
1150                 return;
1151
1152         va_start(ap, fmt);
1153         vsnprintf(buf, sizeof(buf) - 1, fmt, ap);
1154         va_end(ap);
1155
1156         fw3_ipt_rule_addarg(r, false, "-m", "comment");
1157         fw3_ipt_rule_addarg(r, false, "--comment", buf);
1158 }
1159
1160 void
1161 fw3_ipt_rule_extra(struct fw3_ipt_rule *r, const char *extra)
1162 {
1163         char *p, **tmp, *s;
1164
1165         if (!extra || !*extra)
1166                 return;
1167
1168         s = fw3_strdup(extra);
1169
1170         for (p = strtok(s, " \t"); p; p = strtok(NULL, " \t"))
1171         {
1172                 tmp = realloc(r->argv, (r->argc + 1) * sizeof(*r->argv));
1173
1174                 if (!tmp)
1175                         break;
1176
1177                 r->argv = tmp;
1178                 r->argv[r->argc++] = fw3_strdup(p);
1179         }
1180
1181         free(s);
1182 }
1183
1184 #ifndef DISABLE_IPV6
1185 static void
1186 rule_print6(struct ip6t_entry *e)
1187 {
1188         char buf1[INET6_ADDRSTRLEN], buf2[INET6_ADDRSTRLEN];
1189         char *pname;
1190
1191         if (e->ipv6.flags & IP6T_F_PROTO)
1192         {
1193                 if (e->ipv6.invflags & XT_INV_PROTO)
1194                         printf(" !");
1195
1196                 pname = get_protoname(container_of(e, struct fw3_ipt_rule, e6));
1197
1198                 if (pname)
1199                         printf(" -p %s", pname);
1200                 else
1201                         printf(" -p %u", e->ipv6.proto);
1202         }
1203
1204         if (e->ipv6.iniface[0])
1205         {
1206                 if (e->ipv6.invflags & IP6T_INV_VIA_IN)
1207                         printf(" !");
1208
1209                 printf(" -i %s", e->ipv6.iniface);
1210         }
1211
1212         if (e->ipv6.outiface[0])
1213         {
1214                 if (e->ipv6.invflags & IP6T_INV_VIA_OUT)
1215                         printf(" !");
1216
1217                 printf(" -o %s", e->ipv6.outiface);
1218         }
1219
1220         if (memcmp(&e->ipv6.src, &in6addr_any, sizeof(struct in6_addr)))
1221         {
1222                 if (e->ipv6.invflags & IP6T_INV_SRCIP)
1223                         printf(" !");
1224
1225                 printf(" -s %s/%s",
1226                        inet_ntop(AF_INET6, &e->ipv6.src, buf1, sizeof(buf1)),
1227                        inet_ntop(AF_INET6, &e->ipv6.smsk, buf2, sizeof(buf2)));
1228         }
1229
1230         if (memcmp(&e->ipv6.dst, &in6addr_any, sizeof(struct in6_addr)))
1231         {
1232                 if (e->ipv6.invflags & IP6T_INV_DSTIP)
1233                         printf(" !");
1234
1235                 printf(" -d %s/%s",
1236                        inet_ntop(AF_INET6, &e->ipv6.dst, buf1, sizeof(buf1)),
1237                        inet_ntop(AF_INET6, &e->ipv6.dmsk, buf2, sizeof(buf2)));
1238         }
1239 }
1240 #endif
1241
1242 static void
1243 rule_print4(struct ipt_entry *e)
1244 {
1245         struct in_addr in_zero = { 0 };
1246         char buf1[sizeof("255.255.255.255\0")], buf2[sizeof("255.255.255.255\0")];
1247         char *pname;
1248
1249         if (e->ip.proto)
1250         {
1251                 if (e->ip.invflags & XT_INV_PROTO)
1252                         printf(" !");
1253
1254                 pname = get_protoname(container_of(e, struct fw3_ipt_rule, e));
1255
1256                 if (pname)
1257                         printf(" -p %s", pname);
1258                 else
1259                         printf(" -p %u", e->ip.proto);
1260         }
1261
1262         if (e->ip.iniface[0])
1263         {
1264                 if (e->ip.invflags & IPT_INV_VIA_IN)
1265                         printf(" !");
1266
1267                 printf(" -i %s", e->ip.iniface);
1268         }
1269
1270         if (e->ip.outiface[0])
1271         {
1272                 if (e->ip.invflags & IPT_INV_VIA_OUT)
1273                         printf(" !");
1274
1275                 printf(" -o %s", e->ip.outiface);
1276         }
1277
1278         if (memcmp(&e->ip.src, &in_zero, sizeof(struct in_addr)))
1279         {
1280                 if (e->ip.invflags & IPT_INV_SRCIP)
1281                         printf(" !");
1282
1283                 printf(" -s %s/%s",
1284                        inet_ntop(AF_INET, &e->ip.src, buf1, sizeof(buf1)),
1285                        inet_ntop(AF_INET, &e->ip.smsk, buf2, sizeof(buf2)));
1286         }
1287
1288         if (memcmp(&e->ip.dst, &in_zero, sizeof(struct in_addr)))
1289         {
1290                 if (e->ip.invflags & IPT_INV_DSTIP)
1291                         printf(" !");
1292
1293                 printf(" -d %s/%s",
1294                        inet_ntop(AF_INET, &e->ip.dst, buf1, sizeof(buf1)),
1295                        inet_ntop(AF_INET, &e->ip.dmsk, buf2, sizeof(buf2)));
1296         }
1297 }
1298
1299 static void
1300 rule_print(struct fw3_ipt_rule *r, const char *prefix, const char *chain)
1301 {
1302         debug(r->h, "%s %s", prefix, chain);
1303
1304 #ifndef DISABLE_IPV6
1305         if (r->h->family == FW3_FAMILY_V6)
1306                 rule_print6(&r->e6);
1307         else
1308 #endif
1309                 rule_print4(&r->e);
1310
1311         fw3_xt_print_matches(&r->e.ip, r->matches);
1312         fw3_xt_print_target(&r->e.ip, r->target);
1313
1314         printf("\n");
1315 }
1316
1317 static bool
1318 parse_option(struct fw3_ipt_rule *r, int optc, bool inv)
1319 {
1320         struct xtables_rule_match *m;
1321         struct xtables_match *em;
1322
1323         /* is a target option */
1324         if (r->target && fw3_xt_has_target_parse(r->target) &&
1325                 optc >= r->target->option_offset &&
1326                 optc < (r->target->option_offset + 256))
1327         {
1328                 xtables_option_tpcall(optc, r->argv, inv, r->target, &r->e);
1329                 return false;
1330         }
1331
1332         /* try to dispatch argument to one of the match parsers */
1333         for (m = r->matches; m; m = m->next)
1334         {
1335                 em = m->match;
1336
1337                 if (m->completed || !fw3_xt_has_match_parse(em))
1338                         continue;
1339
1340                 if (optc < em->option_offset ||
1341                         optc >= (em->option_offset + 256))
1342                         continue;
1343
1344                 xtables_option_mpcall(optc, r->argv, inv, em, &r->e);
1345                 return false;
1346         }
1347
1348         /* unhandled option, might belong to a protocol match */
1349         if ((em = load_protomatch(r)) != NULL)
1350         {
1351                 init_match(r, em, false);
1352
1353                 r->protocol_loaded = true;
1354                 optind--;
1355
1356                 return true;
1357         }
1358
1359         if (optc == ':')
1360                 warn("parse_option(): option '%s' needs argument", r->argv[optind-1]);
1361
1362         if (optc == '?')
1363                 warn("parse_option(): unknown option '%s'", r->argv[optind-1]);
1364
1365         return false;
1366 }
1367
1368 void
1369 fw3_ipt_rule_addarg(struct fw3_ipt_rule *r, bool inv,
1370                     const char *k, const char *v)
1371 {
1372         int n;
1373         char **tmp;
1374
1375         if (!k)
1376                 return;
1377
1378         n = inv + !!k + !!v;
1379         tmp = realloc(r->argv, (r->argc + n) * sizeof(*tmp));
1380
1381         if (!tmp)
1382                 return;
1383
1384         r->argv = tmp;
1385
1386         if (inv)
1387                 r->argv[r->argc++] = fw3_strdup("!");
1388
1389         r->argv[r->argc++] = fw3_strdup(k);
1390
1391         if (v)
1392                 r->argv[r->argc++] = fw3_strdup(v);
1393 }
1394
1395 static unsigned char *
1396 rule_mask(struct fw3_ipt_rule *r)
1397 {
1398         size_t s;
1399         unsigned char *p, *mask = NULL;
1400         struct xtables_rule_match *m;
1401
1402 #define SZ(x) XT_ALIGN(sizeof(struct x))
1403
1404 #ifndef DISABLE_IPV6
1405         if (r->h->family == FW3_FAMILY_V6)
1406         {
1407                 s = SZ(ip6t_entry);
1408
1409                 for (m = r->matches; m; m = m->next)
1410                         s += SZ(ip6t_entry_match) + m->match->size;
1411
1412                 s += SZ(ip6t_entry_target);
1413                 if (r->target)
1414                         s += r->target->size;
1415
1416                 mask = fw3_alloc(s);
1417                 memset(mask, 0xFF, SZ(ip6t_entry));
1418                 p = mask + SZ(ip6t_entry);
1419
1420                 for (m = r->matches; m; m = m->next)
1421                 {
1422                         memset(p, 0xFF, SZ(ip6t_entry_match) + m->match->userspacesize);
1423                         p += SZ(ip6t_entry_match) + m->match->size;
1424                 }
1425
1426                 memset(p, 0xFF, SZ(ip6t_entry_target) + (r->target) ? r->target->userspacesize : 0);
1427         }
1428         else
1429 #endif
1430         {
1431                 s = SZ(ipt_entry);
1432
1433                 for (m = r->matches; m; m = m->next)
1434                         s += SZ(ipt_entry_match) + m->match->size;
1435
1436                 s += SZ(ipt_entry_target);
1437                 if (r->target)
1438                         s += r->target->size;
1439
1440                 mask = fw3_alloc(s);
1441                 memset(mask, 0xFF, SZ(ipt_entry));
1442                 p = mask + SZ(ipt_entry);
1443
1444                 for (m = r->matches; m; m = m->next)
1445                 {
1446                         memset(p, 0xFF, SZ(ipt_entry_match) + m->match->userspacesize);
1447                         p += SZ(ipt_entry_match) + m->match->size;
1448                 }
1449
1450                 memset(p, 0xFF, SZ(ipt_entry_target) + (r->target) ? r->target->userspacesize : 0);
1451         }
1452
1453         return mask;
1454 }
1455
1456 static void *
1457 rule_build(struct fw3_ipt_rule *r)
1458 {
1459         size_t s, target_size = (r->target) ? r->target->t->u.target_size : 0;
1460         struct xtables_rule_match *m;
1461
1462 #ifndef DISABLE_IPV6
1463         if (r->h->family == FW3_FAMILY_V6)
1464         {
1465                 struct ip6t_entry *e6;
1466
1467                 s = XT_ALIGN(sizeof(struct ip6t_entry));
1468
1469                 for (m = r->matches; m; m = m->next)
1470                         s += m->match->m->u.match_size;
1471
1472                 e6 = fw3_alloc(s + target_size);
1473
1474                 memcpy(e6, &r->e6, sizeof(struct ip6t_entry));
1475
1476                 e6->target_offset = s;
1477                 e6->next_offset = s + target_size;
1478
1479                 s = 0;
1480
1481                 for (m = r->matches; m; m = m->next)
1482                 {
1483                         memcpy(e6->elems + s, m->match->m, m->match->m->u.match_size);
1484                         s += m->match->m->u.match_size;
1485                 }
1486
1487                 if (target_size)
1488                         memcpy(e6->elems + s, r->target->t, target_size);
1489
1490                 return e6;
1491         }
1492         else
1493 #endif
1494         {
1495                 struct ipt_entry *e;
1496
1497                 s = XT_ALIGN(sizeof(struct ipt_entry));
1498
1499                 for (m = r->matches; m; m = m->next)
1500                         s += m->match->m->u.match_size;
1501
1502                 e = fw3_alloc(s + target_size);
1503
1504                 memcpy(e, &r->e, sizeof(struct ipt_entry));
1505
1506                 e->target_offset = s;
1507                 e->next_offset = s + target_size;
1508
1509                 s = 0;
1510
1511                 for (m = r->matches; m; m = m->next)
1512                 {
1513                         memcpy(e->elems + s, m->match->m, m->match->m->u.match_size);
1514                         s += m->match->m->u.match_size;
1515                 }
1516
1517                 if (target_size)
1518                         memcpy(e->elems + s, r->target->t, target_size);
1519
1520                 return e;
1521         }
1522 }
1523
1524 static void
1525 set_rule_tag(struct fw3_ipt_rule *r)
1526 {
1527         int i;
1528         char *p, **tmp;
1529         const char *tag = "!fw3";
1530
1531         for (i = 0; i < r->argc; i++)
1532                 if (!strcmp(r->argv[i], "--comment") && (i + 1) < r->argc)
1533                         if (asprintf(&p, "%s: %s", tag, r->argv[i + 1]) > 0)
1534                         {
1535                                 free(r->argv[i + 1]);
1536                                 r->argv[i + 1] = p;
1537                                 return;
1538                         }
1539
1540         tmp = realloc(r->argv, (r->argc + 4) * sizeof(*r->argv));
1541
1542         if (tmp)
1543         {
1544                 r->argv = tmp;
1545                 r->argv[r->argc++] = fw3_strdup("-m");
1546                 r->argv[r->argc++] = fw3_strdup("comment");
1547                 r->argv[r->argc++] = fw3_strdup("--comment");
1548                 r->argv[r->argc++] = fw3_strdup(tag);
1549         }
1550 }
1551
1552 void
1553 __fw3_ipt_rule_append(struct fw3_ipt_rule *r, bool repl, const char *fmt, ...)
1554 {
1555         void *rule;
1556         unsigned char *mask;
1557
1558         struct xtables_rule_match *m;
1559         struct xtables_match *em;
1560         struct xtables_target *et;
1561         struct xtables_globals *g;
1562
1563         struct fw3_device dev;
1564         struct fw3_address addr;
1565
1566         enum xtables_exittype status;
1567
1568         int i, optc;
1569         bool inv = false;
1570         char buf[32];
1571         va_list ap;
1572
1573         va_start(ap, fmt);
1574         vsnprintf(buf, sizeof(buf) - 1, fmt, ap);
1575         va_end(ap);
1576
1577         g = (r->h->family == FW3_FAMILY_V6) ? &xtg6 : &xtg;
1578         g->opts = g->orig_opts;
1579
1580         optind = 0;
1581         opterr = 0;
1582
1583         status = setjmp(fw3_ipt_error_jmp);
1584
1585         if (status > 0)
1586         {
1587                 info("     ! Skipping due to previous exception (code %u)", status);
1588                 goto free;
1589         }
1590
1591         set_rule_tag(r);
1592
1593         while ((optc = getopt_long(r->argc, r->argv, "-:m:j:i:o:s:d:", g->opts,
1594                                    NULL)) != -1)
1595         {
1596                 switch (optc)
1597                 {
1598                 case 'm':
1599                         em = find_match(r, optarg);
1600
1601                         if (!em)
1602                         {
1603                                 warn("fw3_ipt_rule_append(): Can't find match '%s'", optarg);
1604                                 goto free;
1605                         }
1606
1607                         init_match(r, em, true);
1608                         break;
1609
1610                 case 'j':
1611                         et = get_target(r, optarg);
1612
1613                         if (!et)
1614                         {
1615                                 warn("fw3_ipt_rule_append(): Can't find target '%s'", optarg);
1616                                 goto free;
1617                         }
1618
1619                         break;
1620
1621                 case 'i':
1622                 case 'o':
1623                         if (!fw3_parse_device(&dev, optarg, false) ||
1624                             dev.any || dev.invert || *dev.network)
1625                         {
1626                                 warn("fw3_ipt_rule_append(): Bad argument '%s'", optarg);
1627                                 goto free;
1628                         }
1629
1630                         dev.invert = inv;
1631                         fw3_ipt_rule_in_out(r, (optc == 'i') ? &dev : NULL,
1632                                                (optc == 'o') ? &dev : NULL);
1633                         break;
1634
1635                 case 's':
1636                 case 'd':
1637                         if (!fw3_parse_address(&addr, optarg, false) ||
1638                             addr.range || addr.invert)
1639                         {
1640                                 warn("fw3_ipt_rule_append(): Bad argument '%s'", optarg);
1641                                 goto free;
1642                         }
1643
1644                         addr.invert = inv;
1645                         fw3_ipt_rule_src_dest(r, (optc == 's') ? &addr : NULL,
1646                                                  (optc == 'd') ? &addr : NULL);
1647                         break;
1648
1649                 case 1:
1650                         if ((optarg[0] == '!') && (optarg[1] == '\0'))
1651                         {
1652                                 optarg[0] = '\0';
1653                                 inv = true;
1654                                 continue;
1655                         }
1656
1657                         warn("fw3_ipt_rule_append(): Bad argument '%s'", optarg);
1658                         goto free;
1659
1660                 default:
1661                         if (parse_option(r, optc, inv))
1662                                 continue;
1663                         break;
1664                 }
1665
1666                 inv = false;
1667         }
1668
1669         for (m = r->matches; m; m = m->next)
1670                 xtables_option_mfcall(m->match);
1671
1672         if (r->target)
1673                 xtables_option_tfcall(r->target);
1674
1675         rule = rule_build(r);
1676
1677 #ifndef DISABLE_IPV6
1678         if (r->h->family == FW3_FAMILY_V6)
1679         {
1680                 if (repl)
1681                 {
1682                         mask = rule_mask(r);
1683
1684                         while (ip6tc_delete_entry(buf, rule, mask, r->h->handle))
1685                                 if (fw3_pr_debug)
1686                                         rule_print(r, "-D", buf);
1687
1688                         free(mask);
1689                 }
1690
1691                 if (fw3_pr_debug)
1692                         rule_print(r, "-A", buf);
1693
1694                 if (!ip6tc_append_entry(buf, rule, r->h->handle))
1695                         warn("ip6tc_append_entry(): %s", ip6tc_strerror(errno));
1696         }
1697         else
1698 #endif
1699         {
1700                 if (repl)
1701                 {
1702                         mask = rule_mask(r);
1703
1704                         while (iptc_delete_entry(buf, rule, mask, r->h->handle))
1705                                 if (fw3_pr_debug)
1706                                         rule_print(r, "-D", buf);
1707
1708                         free(mask);
1709                 }
1710
1711                 if (fw3_pr_debug)
1712                         rule_print(r, "-A", buf);
1713
1714                 if (!iptc_append_entry(buf, rule, r->h->handle))
1715                         warn("iptc_append_entry(): %s\n", iptc_strerror(errno));
1716         }
1717
1718         free(rule);
1719
1720 free:
1721         for (i = 1; i < r->argc; i++)
1722                 free(r->argv[i]);
1723
1724         free(r->argv);
1725
1726         xtables_rule_matches_free(&r->matches);
1727
1728         if (r->target)
1729                 free(r->target->t);
1730
1731         free(r);
1732
1733         /* reset all targets and matches */
1734         for (em = xtables_matches; em; em = em->next)
1735                 em->mflags = 0;
1736
1737         for (et = xtables_targets; et; et = et->next)
1738         {
1739                 et->tflags = 0;
1740                 et->used = 0;
1741         }
1742
1743         xtables_free_opts(1);
1744 }
1745
1746 struct fw3_ipt_rule *
1747 fw3_ipt_rule_create(struct fw3_ipt_handle *handle, struct fw3_protocol *proto,
1748                     struct fw3_device *in, struct fw3_device *out,
1749                     struct fw3_address *src, struct fw3_address *dest)
1750 {
1751         struct fw3_ipt_rule *r;
1752
1753         r = fw3_ipt_rule_new(handle);
1754
1755         fw3_ipt_rule_proto(r, proto);
1756         fw3_ipt_rule_in_out(r, in, out);
1757         fw3_ipt_rule_src_dest(r, src, dest);
1758
1759         return r;
1760 }
1761
1762 void
1763 xtables_register_match(struct xtables_match *me)
1764 {
1765         int i;
1766         static struct xtables_match **tmp;
1767
1768         if (!xext.register_match)
1769                 xext.register_match = dlsym(RTLD_NEXT, "xtables_register_match");
1770
1771         if (!xext.register_match)
1772                 return;
1773
1774         xext.register_match(me);
1775
1776         if (xext.retain)
1777         {
1778                 for (i = 0; i < xext.mcount; i++)
1779                         if (xext.matches[i] == me)
1780                                 return;
1781
1782                 tmp = realloc(xext.matches, sizeof(me) * (xext.mcount + 1));
1783
1784                 if (!tmp)
1785                         return;
1786
1787                 xext.matches = tmp;
1788                 xext.matches[xext.mcount++] = me;
1789         }
1790 }
1791
1792 void
1793 xtables_register_target(struct xtables_target *me)
1794 {
1795         int i;
1796         static struct xtables_target **tmp;
1797
1798         if (!xext.register_target)
1799                 xext.register_target = dlsym(RTLD_NEXT, "xtables_register_target");
1800
1801         if (!xext.register_target)
1802                 return;
1803
1804         xext.register_target(me);
1805
1806         if (xext.retain)
1807         {
1808                 for (i = 0; i < xext.tcount; i++)
1809                         if (xext.targets[i] == me)
1810                                 return;
1811
1812                 tmp = realloc(xext.targets, sizeof(me) * (xext.tcount + 1));
1813
1814                 if (!tmp)
1815                         return;
1816
1817                 xext.targets = tmp;
1818                 xext.targets[xext.tcount++] = me;
1819         }
1820 }