iptables.c

   1 /*
   2  * firewall3 - 3rd OpenWrt UCI firewall implementation
   3  *
   4  *   Copyright (C) 2013 Jo-Philipp Wich <jo@mein.io>
   5  *
   6  * Permission to use, copy, modify, and/or distribute this software for any
   7  * purpose with or without fee is hereby granted, provided that the above
   8  * copyright notice and this permission notice appear in all copies.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17  */
  18
  19 #define _GNU_SOURCE /* RTLD_NEXT */
  20
  21 /* include userspace headers */
  22 #include <dlfcn.h>
  23 #include <unistd.h>
  24 #include <getopt.h>
  25 #include <net/if.h>
  26 #include <netinet/in.h>
  27 #include <sys/utsname.h>
  28 #include <sys/socket.h>
  29
  30 /* prevent indirect inclusion of kernel headers */
  31 #define _LINUX_IF_H
  32 #define _LINUX_IN_H
  33 #define _LINUX_IN6_H
  34
  35 /* prevent libiptc from including kernel headers */
  36 #define _FWCHAINS_KERNEL_HEADERS_H
  37
  38 /* finally include libiptc and xtables */
  39 #include <libiptc/libiptc.h>
  40 #include <libiptc/libip6tc.h>
  41 #include <xtables.h>
  42
  43 #include <setjmp.h>
  44
  45 #include "options.h"
  46
  47 /* xtables interface */
  48 #if (XTABLES_VERSION_CODE >= 10)
  49 # include "xtables-10.h"
  50 #elif (XTABLES_VERSION_CODE == 5)
  51 # include "xtables-5.h"
  52 #else
  53 # error "Unsupported xtables version"
  54 #endif
  55
  56 #include "iptables.h"
  57
  58
  59 struct fw3_ipt_rule {
  60         struct fw3_ipt_handle *h;
  61
  62         union {
  63                 struct ipt_entry e;
  64                 struct ip6t_entry e6;
  65         };
  66
  67         struct xtables_rule_match *matches;
  68         struct xtables_target *target;
  69
  70         int argc;
  71         char **argv;
  72
  73         uint32_t protocol;
  74         bool protocol_loaded;
  75 };
  76
  77 static struct option base_opts[] = {
  78         { .name = "match",         .has_arg = 1, .val = 'm' },
  79         { .name = "jump",          .has_arg = 1, .val = 'j' },
  80         { .name = "in-interface",  .has_arg = 1, .val = 'i' },
  81         { .name = "out-interface", .has_arg = 1, .val = 'o' },
  82         { .name = "source",        .has_arg = 1, .val = 's' },
  83         { .name = "destination",   .has_arg = 1, .val = 'd' },
  84         { NULL }
  85 };
  86
  87
  88 static jmp_buf fw3_ipt_error_jmp;
  89
  90 static __attribute__((noreturn))
  91 void fw3_ipt_error_handler(enum xtables_exittype status,
  92                            const char *fmt, ...)
  93 {
  94         va_list args;
  95
  96         fprintf(stderr, "     ! Exception: ");
  97
  98         va_start(args, fmt);
  99         vfprintf(stderr, fmt, args);
 100         va_end(args);
 101
 102         longjmp(fw3_ipt_error_jmp, status);
 103 }
 104
 105 static struct xtables_globals xtg = {
 106         .option_offset = 0,
 107         .program_version = "4",
 108         .orig_opts = base_opts,
 109         .exit_err = fw3_ipt_error_handler,
 110 #if XTABLES_VERSION_CODE > 10
 111         .compat_rev = xtables_compatible_revision,
 112 #endif
 113 };
 114
 115 static struct xtables_globals xtg6 = {
 116         .option_offset = 0,
 117         .program_version = "6",
 118         .orig_opts = base_opts,
 119         .exit_err = fw3_ipt_error_handler,
 120 #if XTABLES_VERSION_CODE > 10
 121         .compat_rev = xtables_compatible_revision,
 122 #endif
 123 };
 124
 125 static struct {
 126         bool retain;
 127         int mcount, tcount;
 128         struct xtables_match **matches;
 129         struct xtables_target **targets;
 130         void (*register_match)(struct xtables_match *);
 131         void (*register_target)(struct xtables_target *);
 132 } xext;
 133
 134
 135 /* Required by certain extensions like SNAT and DNAT */
 136 int kernel_version = 0;
 137
 138 void
 139 get_kernel_version(void)
 140 {
 141         static struct utsname uts;
 142         int x = 0, y = 0, z = 0;
 143
 144         if (uname(&uts) == -1)
 145                 sprintf(uts.release, "3.0.0");
 146
 147         sscanf(uts.release, "%d.%d.%d", &x, &y, &z);
 148         kernel_version = 0x10000 * x + 0x100 * y + z;
 149 }
 150
 151 static void fw3_init_extensions(void)
 152 {
 153         init_extensions();
 154         init_extensions4();
 155
 156 #ifndef DISABLE_IPV6
 157         init_extensions6();
 158 #endif
 159 }
 160
 161 struct fw3_ipt_handle *
 162 fw3_ipt_open(enum fw3_family family, enum fw3_table table)
 163 {
 164         int i;
 165         struct fw3_ipt_handle *h;
 166
 167         h = fw3_alloc(sizeof(*h));
 168
 169         xtables_init();
 170
 171         if (family == FW3_FAMILY_V6)
 172         {
 173 #ifndef DISABLE_IPV6
 174                 h->family = FW3_FAMILY_V6;
 175                 h->table  = table;
 176                 h->handle = ip6tc_init(fw3_flag_names[table]);
 177
 178                 xtables_set_params(&xtg6);
 179                 xtables_set_nfproto(NFPROTO_IPV6);
 180 #endif
 181         }
 182         else
 183         {
 184                 h->family = FW3_FAMILY_V4;
 185                 h->table  = table;
 186                 h->handle = iptc_init(fw3_flag_names[table]);
 187
 188                 xtables_set_params(&xtg);
 189                 xtables_set_nfproto(NFPROTO_IPV4);
 190         }
 191
 192         if (!h->handle)
 193         {
 194                 free(h);
 195                 return NULL;
 196         }
 197
 198         fw3_xt_reset();
 199         fw3_init_extensions();
 200
 201         if (xext.register_match)
 202                 for (i = 0; i < xext.mcount; i++)
 203                         xext.register_match(xext.matches[i]);
 204
 205         if (xext.register_target)
 206                 for (i = 0; i < xext.tcount; i++)
 207                         xext.register_target(xext.targets[i]);
 208
 209         return h;
 210 }
 211
 212 static void
 213 debug(struct fw3_ipt_handle *h, const char *fmt, ...)
 214 {
 215         va_list ap;
 216
 217         printf("%s -t %s ", (h->family == FW3_FAMILY_V6) ? "ip6tables" : "iptables",
 218                             fw3_flag_names[h->table]);
 219
 220         va_start(ap, fmt);
 221         vprintf(fmt, ap);
 222         va_end(ap);
 223 }
 224
 225 void
 226 fw3_ipt_set_policy(struct fw3_ipt_handle *h, const char *chain,
 227                    enum fw3_flag policy)
 228 {
 229         if (fw3_pr_debug)
 230                 debug(h, "-P %s %s\n", chain, fw3_flag_names[policy]);
 231
 232 #ifndef DISABLE_IPV6
 233         if (h->family == FW3_FAMILY_V6)
 234                 ip6tc_set_policy(chain, fw3_flag_names[policy], NULL, h->handle);
 235         else
 236 #endif
 237                 iptc_set_policy(chain, fw3_flag_names[policy], NULL, h->handle);
 238 }
 239
 240 void
 241 fw3_ipt_flush_chain(struct fw3_ipt_handle *h, const char *chain)
 242 {
 243         if (fw3_pr_debug)
 244                 debug(h, "-F %s\n", chain);
 245
 246 #ifndef DISABLE_IPV6
 247         if (h->family == FW3_FAMILY_V6)
 248                 ip6tc_flush_entries(chain, h->handle);
 249         else
 250 #endif
 251                 iptc_flush_entries(chain, h->handle);
 252 }
 253
 254 static void
 255 delete_rules(struct fw3_ipt_handle *h, const char *target)
 256 {
 257         unsigned int num;
 258         const struct ipt_entry *e;
 259         const char *chain;
 260         const char *t;
 261         bool found;
 262
 263 #ifndef DISABLE_IPV6
 264         if (h->family == FW3_FAMILY_V6)
 265         {
 266                 for (chain = ip6tc_first_chain(h->handle);
 267                      chain != NULL;
 268                      chain = ip6tc_next_chain(h->handle))
 269                 {
 270                         do {
 271                                 found = false;
 272
 273                                 const struct ip6t_entry *e6;
 274                                 for (num = 0, e6 = ip6tc_first_rule(chain, h->handle);
 275                                          e6 != NULL;
 276                                          num++, e6 = ip6tc_next_rule(e6, h->handle))
 277                                 {
 278                                         t = ip6tc_get_target(e6, h->handle);
 279
 280                                         if (*t && !strcmp(t, target))
 281                                         {
 282                                                 if (fw3_pr_debug)
 283                                                         debug(h, "-D %s %u\n", chain, num + 1);
 284
 285                                                 ip6tc_delete_num_entry(chain, num, h->handle);
 286                                                 found = true;
 287                                                 break;
 288                                         }
 289                                 }
 290                         } while (found);
 291                 }
 292         }
 293         else
 294 #endif
 295         {
 296                 for (chain = iptc_first_chain(h->handle);
 297                      chain != NULL;
 298                      chain = iptc_next_chain(h->handle))
 299                 {
 300                         do {
 301                                 found = false;
 302
 303                                 for (num = 0, e = iptc_first_rule(chain, h->handle);
 304                                      e != NULL;
 305                                          num++, e = iptc_next_rule(e, h->handle))
 306                                 {
 307                                         t = iptc_get_target(e, h->handle);
 308
 309                                         if (*t && !strcmp(t, target))
 310                                         {
 311                                                 if (fw3_pr_debug)
 312                                                         debug(h, "-D %s %u\n", chain, num + 1);
 313
 314                                                 iptc_delete_num_entry(chain, num, h->handle);
 315                                                 found = true;
 316                                                 break;
 317                                         }
 318                                 }
 319                         } while (found);
 320                 }
 321         }
 322 }
 323
 324 void
 325 fw3_ipt_delete_chain(struct fw3_ipt_handle *h, const char *chain)
 326 {
 327         delete_rules(h, chain);
 328
 329         if (fw3_pr_debug)
 330                 debug(h, "-X %s\n", chain);
 331
 332 #ifndef DISABLE_IPV6
 333         if (h->family == FW3_FAMILY_V6)
 334                 ip6tc_delete_chain(chain, h->handle);
 335         else
 336 #endif
 337                 iptc_delete_chain(chain, h->handle);
 338 }
 339
 340 static bool
 341 has_rule_tag(const void *base, unsigned int start, unsigned int end)
 342 {
 343         unsigned int i;
 344         const struct xt_entry_match *em;
 345
 346         for (i = start; i < end; i += em->u.match_size)
 347         {
 348                 em = base + i;
 349
 350                 if (strcmp(em->u.user.name, "comment"))
 351                         continue;
 352
 353                 if (!memcmp(em->data, "!fw3", 4))
 354                         return true;
 355         }
 356
 357         return false;
 358 }
 359
 360 void
 361 fw3_ipt_delete_id_rules(struct fw3_ipt_handle *h, const char *chain)
 362 {
 363         unsigned int num;
 364         const struct ipt_entry *e;
 365         bool found;
 366
 367 #ifndef DISABLE_IPV6
 368         if (h->family == FW3_FAMILY_V6)
 369         {
 370                 if (!ip6tc_is_chain(chain, h->handle))
 371                         return;
 372
 373                 do {
 374                         found = false;
 375
 376                         const struct ip6t_entry *e6;
 377                         for (num = 0, e6 = ip6tc_first_rule(chain, h->handle);
 378                                  e6 != NULL;
 379                                  num++, e6 = ip6tc_next_rule(e6, h->handle))
 380                         {
 381                                 if (has_rule_tag(e6, sizeof(*e6), e6->target_offset))
 382                                 {
 383                                         if (fw3_pr_debug)
 384                                                 debug(h, "-D %s %u\n", chain, num + 1);
 385
 386                                         ip6tc_delete_num_entry(chain, num, h->handle);
 387                                         found = true;
 388                                         break;
 389                                 }
 390                         }
 391                 } while (found);
 392         }
 393         else
 394 #endif
 395         {
 396                 if (!iptc_is_chain(chain, h->handle))
 397                         return;
 398
 399                 do {
 400                         found = false;
 401
 402                         for (num = 0, e = iptc_first_rule(chain, h->handle);
 403                                  e != NULL;
 404                                  num++, e = iptc_next_rule(e, h->handle))
 405                         {
 406                                 if (has_rule_tag(e, sizeof(*e), e->target_offset))
 407                                 {
 408                                         if (fw3_pr_debug)
 409                                                 debug(h, "-D %s %u\n", chain, num + 1);
 410
 411                                         iptc_delete_num_entry(chain, num, h->handle);
 412                                         found = true;
 413                                         break;
 414                                 }
 415                         }
 416                 } while (found);
 417         }
 418 }
 419
 420 void
 421 fw3_ipt_create_chain(struct fw3_ipt_handle *h, const char *fmt, ...)
 422 {
 423         char buf[32];
 424         va_list ap;
 425
 426         va_start(ap, fmt);
 427         vsnprintf(buf, sizeof(buf) - 1, fmt, ap);
 428         va_end(ap);
 429
 430         if (fw3_pr_debug)
 431                 debug(h, "-N %s\n", buf);
 432
 433         iptc_create_chain(buf, h->handle);
 434 }
 435
 436 void
 437 fw3_ipt_flush(struct fw3_ipt_handle *h)
 438 {
 439         const char *chain;
 440
 441 #ifndef DISABLE_IPV6
 442         if (h->family == FW3_FAMILY_V6)
 443         {
 444                 for (chain = ip6tc_first_chain(h->handle);
 445                      chain != NULL;
 446                      chain = ip6tc_next_chain(h->handle))
 447                 {
 448                         ip6tc_flush_entries(chain, h->handle);
 449                 }
 450
 451                 for (chain = ip6tc_first_chain(h->handle);
 452                      chain != NULL;
 453                      chain = ip6tc_next_chain(h->handle))
 454                 {
 455                         ip6tc_delete_chain(chain, h->handle);
 456                 }
 457         }
 458         else
 459 #endif
 460         {
 461                 for (chain = iptc_first_chain(h->handle);
 462                      chain != NULL;
 463                      chain = iptc_next_chain(h->handle))
 464                 {
 465                         iptc_flush_entries(chain, h->handle);
 466                 }
 467
 468                 for (chain = iptc_first_chain(h->handle);
 469                      chain != NULL;
 470                      chain = iptc_next_chain(h->handle))
 471                 {
 472                         iptc_delete_chain(chain, h->handle);
 473                 }
 474         }
 475 }
 476
 477 static bool
 478 chain_is_empty(struct fw3_ipt_handle *h, const char *chain)
 479 {
 480 #ifndef DISABLE_IPV6
 481         if (h->family == FW3_FAMILY_V6)
 482                 return (!ip6tc_builtin(chain, h->handle) &&
 483                         !ip6tc_first_rule(chain, h->handle));
 484 #endif
 485
 486         return (!iptc_builtin(chain, h->handle) &&
 487                 !iptc_first_rule(chain, h->handle));
 488 }
 489
 490 void
 491 fw3_ipt_gc(struct fw3_ipt_handle *h)
 492 {
 493         const char *chain;
 494         bool found;
 495
 496 #ifndef DISABLE_IPV6
 497         if (h->family == FW3_FAMILY_V6)
 498         {
 499                 do {
 500                         found = false;
 501
 502                         for (chain = ip6tc_first_chain(h->handle);
 503                                  chain != NULL;
 504                                  chain = ip6tc_next_chain(h->handle))
 505                         {
 506                                 if (!chain_is_empty(h, chain))
 507                                         continue;
 508
 509                                 fw3_ipt_delete_chain(h, chain);
 510                                 found = true;
 511                                 break;
 512                         }
 513                 } while(found);
 514         }
 515         else
 516 #endif
 517         {
 518                 do {
 519                         found = false;
 520
 521                         for (chain = iptc_first_chain(h->handle);
 522                                  chain != NULL;
 523                                  chain = iptc_next_chain(h->handle))
 524                         {
 525                                 warn("C=%s\n", chain);
 526
 527                                 if (!chain_is_empty(h, chain))
 528                                         continue;
 529
 530                                 warn("D=%s\n", chain);
 531
 532                                 fw3_ipt_delete_chain(h, chain);
 533                                 found = true;
 534                                 break;
 535                         }
 536                 } while (found);
 537         }
 538 }
 539
 540 void
 541 fw3_ipt_commit(struct fw3_ipt_handle *h)
 542 {
 543         int rv;
 544
 545 #ifndef DISABLE_IPV6
 546         if (h->family == FW3_FAMILY_V6)
 547         {
 548                 rv = ip6tc_commit(h->handle);
 549                 if (!rv)
 550                         warn("ip6tc_commit(): %s", ip6tc_strerror(errno));
 551         }
 552         else
 553 #endif
 554         {
 555                 rv = iptc_commit(h->handle);
 556                 if (!rv)
 557                         warn("iptc_commit(): %s", iptc_strerror(errno));
 558         }
 559 }
 560
 561 void
 562 fw3_ipt_close(struct fw3_ipt_handle *h)
 563 {
 564         free(h);
 565 }
 566
 567 struct fw3_ipt_rule *
 568 fw3_ipt_rule_new(struct fw3_ipt_handle *h)
 569 {
 570         struct fw3_ipt_rule *r;
 571
 572         r = fw3_alloc(sizeof(*r));
 573
 574         r->h = h;
 575         r->argv = fw3_alloc(sizeof(char *));
 576         r->argv[r->argc++] = "fw3";
 577
 578         return r;
 579 }
 580
 581
 582 static bool
 583 is_chain(struct fw3_ipt_handle *h, const char *name)
 584 {
 585 #ifndef DISABLE_IPV6
 586         if (h->family == FW3_FAMILY_V6)
 587                 return ip6tc_is_chain(name, h->handle);
 588         else
 589 #endif
 590                 return iptc_is_chain(name, h->handle);
 591 }
 592
 593 static char *
 594 get_protoname(struct fw3_ipt_rule *r)
 595 {
 596         const struct xtables_pprot *pp;
 597
 598         if (r->protocol)
 599                 for (pp = xtables_chain_protos; pp->name; pp++)
 600                         if (pp->num == r->protocol)
 601                                 return (char *)pp->name;
 602
 603         return NULL;
 604 }
 605
 606 static struct xtables_match *
 607 find_match(struct fw3_ipt_rule *r, const char *name)
 608 {
 609         struct xtables_match *m;
 610
 611         xext.retain = true;
 612         m = xtables_find_match(name, XTF_TRY_LOAD, &r->matches);
 613         xext.retain = false;
 614
 615         return m;
 616 }
 617
 618 static void
 619 init_match(struct fw3_ipt_rule *r, struct xtables_match *m, bool no_clone)
 620 {
 621         size_t s;
 622         struct xtables_globals *g;
 623
 624         if (!m)
 625                 return;
 626
 627         s = XT_ALIGN(sizeof(struct xt_entry_match)) + m->size;
 628
 629         m->m = fw3_alloc(s);
 630
 631         fw3_xt_set_match_name(m);
 632
 633         m->m->u.user.revision = m->revision;
 634         m->m->u.match_size = s;
 635
 636         /* free previous userspace data */
 637         fw3_xt_free_match_udata(m);
 638
 639         if (m->init)
 640                 m->init(m->m);
 641
 642         /* don't merge options if no_clone is set and this match is a clone */
 643         if (no_clone && (m == m->next))
 644                 return;
 645
 646         /* merge option table */
 647         g = (r->h->family == FW3_FAMILY_V6) ? &xtg6 : &xtg;
 648         fw3_xt_merge_match_options(g, m);
 649 }
 650
 651 static bool
 652 need_protomatch(struct fw3_ipt_rule *r, const char *pname)
 653 {
 654         if (!pname)
 655                 return false;
 656
 657         if (!xtables_find_match(pname, XTF_DONT_LOAD, NULL))
 658                 return true;
 659
 660         return !r->protocol_loaded;
 661 }
 662
 663 static struct xtables_match *
 664 load_protomatch(struct fw3_ipt_rule *r)
 665 {
 666         const char *pname = get_protoname(r);
 667
 668         if (!need_protomatch(r, pname))
 669                 return NULL;
 670
 671         return find_match(r, pname);
 672 }
 673
 674 static struct xtables_target *
 675 find_target(struct fw3_ipt_rule *r, const char *name)
 676 {
 677         struct xtables_target *t;
 678
 679         xext.retain = true;
 680
 681         if (is_chain(r->h, name))
 682                 t = xtables_find_target(XT_STANDARD_TARGET, XTF_TRY_LOAD);
 683         else
 684                 t = xtables_find_target(name, XTF_TRY_LOAD);
 685
 686         xext.retain = false;
 687
 688         return t;
 689 }
 690
 691 static struct xtables_target *
 692 get_target(struct fw3_ipt_rule *r, const char *name)
 693 {
 694         size_t s;
 695         struct xtables_target *t;
 696         struct xtables_globals *g;
 697
 698         t = find_target(r, name);
 699
 700         if (!t)
 701                 return NULL;
 702
 703         s = XT_ALIGN(sizeof(struct xt_entry_target)) + t->size;
 704         t->t = fw3_alloc(s);
 705
 706         fw3_xt_set_target_name(t, name);
 707
 708         t->t->u.user.revision = t->revision;
 709         t->t->u.target_size = s;
 710
 711         /* free previous userspace data */
 712         fw3_xt_free_target_udata(t);
 713
 714         if (t->init)
 715                 t->init(t->t);
 716
 717         /* merge option table */
 718         g = (r->h->family == FW3_FAMILY_V6) ? &xtg6 : &xtg;
 719         fw3_xt_merge_target_options(g, t);
 720
 721         r->target = t;
 722
 723         return t;
 724 }
 725
 726 void
 727 fw3_ipt_rule_proto(struct fw3_ipt_rule *r, struct fw3_protocol *proto)
 728 {
 729         uint32_t pr;
 730
 731         if (!proto || proto->any)
 732                 return;
 733
 734         pr = proto->protocol;
 735
 736 #ifndef DISABLE_IPV6
 737         if (r->h->family == FW3_FAMILY_V6)
 738         {
 739                 if (pr == 1)
 740                         pr = 58;
 741
 742                 r->e6.ipv6.proto = pr;
 743                 r->e6.ipv6.flags |= IP6T_F_PROTO;
 744
 745                 if (proto->invert)
 746                         r->e6.ipv6.invflags |= XT_INV_PROTO;
 747         }
 748         else
 749 #endif
 750         {
 751                 r->e.ip.proto = pr;
 752
 753                 if (proto->invert)
 754                         r->e.ip.invflags |= XT_INV_PROTO;
 755         }
 756
 757         r->protocol = pr;
 758 }
 759
 760 void
 761 fw3_ipt_rule_in_out(struct fw3_ipt_rule *r,
 762                     struct fw3_device *in, struct fw3_device *out)
 763 {
 764 #ifndef DISABLE_IPV6
 765         if (r->h->family == FW3_FAMILY_V6)
 766         {
 767                 if (in && !in->any)
 768                 {
 769                         xtables_parse_interface(in->name, r->e6.ipv6.iniface,
 770                                                           r->e6.ipv6.iniface_mask);
 771
 772                         if (in->invert)
 773                                 r->e6.ipv6.invflags |= IP6T_INV_VIA_IN;
 774                 }
 775
 776                 if (out && !out->any)
 777                 {
 778                         xtables_parse_interface(out->name, r->e6.ipv6.outiface,
 779                                                            r->e6.ipv6.outiface_mask);
 780
 781                         if (out->invert)
 782                                 r->e6.ipv6.invflags |= IP6T_INV_VIA_OUT;
 783                 }
 784         }
 785         else
 786 #endif
 787         {
 788                 if (in && !in->any)
 789                 {
 790                         xtables_parse_interface(in->name, r->e.ip.iniface,
 791                                                           r->e.ip.iniface_mask);
 792
 793                         if (in->invert)
 794                                 r->e.ip.invflags |= IPT_INV_VIA_IN;
 795                 }
 796
 797                 if (out && !out->any)
 798                 {
 799                         xtables_parse_interface(out->name, r->e.ip.outiface,
 800                                                            r->e.ip.outiface_mask);
 801
 802                         if (out->invert)
 803                                 r->e.ip.invflags |= IPT_INV_VIA_OUT;
 804                 }
 805         }
 806 }
 807
 808
 809 void
 810 fw3_ipt_rule_src_dest(struct fw3_ipt_rule *r,
 811                       struct fw3_address *src, struct fw3_address *dest)
 812 {
 813         if ((src && src->range) || (dest && dest->range))
 814         {
 815                 fw3_ipt_rule_addarg(r, false, "-m", "iprange");
 816         }
 817
 818         if (src && src->set)
 819         {
 820                 if (src->range)
 821                 {
 822                         fw3_ipt_rule_addarg(r, src->invert, "--src-range",
 823                                             fw3_address_to_string(src, false, false));
 824                 }
 825 #ifndef DISABLE_IPV6
 826                 else if (r->h->family == FW3_FAMILY_V6)
 827                 {
 828                         r->e6.ipv6.src = src->address.v6;
 829                         r->e6.ipv6.smsk = src->mask.v6;
 830
 831                         int i;
 832                         for (i = 0; i < 4; i++)
 833                                 r->e6.ipv6.src.s6_addr32[i] &= r->e6.ipv6.smsk.s6_addr32[i];
 834
 835                         if (src->invert)
 836                                 r->e6.ipv6.invflags |= IP6T_INV_SRCIP;
 837                 }
 838 #endif
 839                 else
 840                 {
 841                         r->e.ip.src = src->address.v4;
 842                         r->e.ip.smsk = src->mask.v4;
 843
 844                         r->e.ip.src.s_addr &= r->e.ip.smsk.s_addr;
 845
 846                         if (src->invert)
 847                                 r->e.ip.invflags |= IPT_INV_SRCIP;
 848                 }
 849         }
 850
 851         if (dest && dest->set)
 852         {
 853                 if (dest->range)
 854                 {
 855                         fw3_ipt_rule_addarg(r, dest->invert, "--dst-range",
 856                                             fw3_address_to_string(dest, false, false));
 857                 }
 858 #ifndef DISABLE_IPV6
 859                 else if (r->h->family == FW3_FAMILY_V6)
 860                 {
 861                         r->e6.ipv6.dst = dest->address.v6;
 862                         r->e6.ipv6.dmsk = dest->mask.v6;
 863
 864                         int i;
 865                         for (i = 0; i < 4; i++)
 866                                 r->e6.ipv6.dst.s6_addr32[i] &= r->e6.ipv6.dmsk.s6_addr32[i];
 867
 868                         if (dest->invert)
 869                                 r->e6.ipv6.invflags |= IP6T_INV_DSTIP;
 870                 }
 871 #endif
 872                 else
 873                 {
 874                         r->e.ip.dst = dest->address.v4;
 875                         r->e.ip.dmsk = dest->mask.v4;
 876
 877                         r->e.ip.dst.s_addr &= r->e.ip.dmsk.s_addr;
 878
 879                         if (dest->invert)
 880                                 r->e.ip.invflags |= IPT_INV_DSTIP;
 881                 }
 882         }
 883 }
 884
 885 void
 886 fw3_ipt_rule_sport_dport(struct fw3_ipt_rule *r,
 887                          struct fw3_port *sp, struct fw3_port *dp)
 888 {
 889         char buf[sizeof("65535:65535\0")];
 890
 891         if ((!sp || !sp->set) && (!dp || !dp->set))
 892                 return;
 893
 894         if (!get_protoname(r))
 895                 return;
 896
 897         if (sp && sp->set)
 898         {
 899                 if (sp->port_min == sp->port_max)
 900                         sprintf(buf, "%u", sp->port_min);
 901                 else
 902                         sprintf(buf, "%u:%u", sp->port_min, sp->port_max);
 903
 904                 fw3_ipt_rule_addarg(r, sp->invert, "--sport", buf);
 905         }
 906
 907         if (dp && dp->set)
 908         {
 909                 if (dp->port_min == dp->port_max)
 910                         sprintf(buf, "%u", dp->port_min);
 911                 else
 912                         sprintf(buf, "%u:%u", dp->port_min, dp->port_max);
 913
 914                 fw3_ipt_rule_addarg(r, dp->invert, "--dport", buf);
 915         }
 916 }
 917
 918 void
 919 fw3_ipt_rule_device(struct fw3_ipt_rule *r, const char *device, bool out)
 920 {
 921         if (device) {
 922                 struct fw3_device dev = { .any = false };
 923                 strncpy(dev.name, device, sizeof(dev.name) - 1);
 924                 fw3_ipt_rule_in_out(r, (out) ? NULL : &dev, (out) ? &dev : NULL);
 925         }
 926 }
 927
 928 void
 929 fw3_ipt_rule_mac(struct fw3_ipt_rule *r, struct fw3_mac *mac)
 930 {
 931         char buf[sizeof("ff:ff:ff:ff:ff:ff\0")];
 932         uint8_t *addr = mac->mac.ether_addr_octet;
 933
 934         if (!mac)
 935                 return;
 936
 937         sprintf(buf, "%02x:%02x:%02x:%02x:%02x:%02x",
 938                 addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]);
 939
 940         fw3_ipt_rule_addarg(r, false, "-m", "mac");
 941         fw3_ipt_rule_addarg(r, mac->invert, "--mac-source", buf);
 942 }
 943
 944 void
 945 fw3_ipt_rule_icmptype(struct fw3_ipt_rule *r, struct fw3_icmptype *icmp)
 946 {
 947         char buf[sizeof("255/255\0")];
 948
 949         if (!icmp)
 950                 return;
 951
 952 #ifndef DISABLE_IPV6
 953         if (r->h->family == FW3_FAMILY_V6)
 954         {
 955                 if (icmp->code6_min == 0 && icmp->code6_max == 0xFF)
 956                         sprintf(buf, "%u", icmp->type6);
 957                 else
 958                         sprintf(buf, "%u/%u", icmp->type6, icmp->code6_min);
 959
 960                 fw3_ipt_rule_addarg(r, icmp->invert, "--icmpv6-type", buf);
 961         }
 962         else
 963 #endif
 964         {
 965                 if (icmp->code_min == 0 && icmp->code_max == 0xFF)
 966                         sprintf(buf, "%u", icmp->type);
 967                 else
 968                         sprintf(buf, "%u/%u", icmp->type, icmp->code_min);
 969
 970                 fw3_ipt_rule_addarg(r, icmp->invert, "--icmp-type", buf);
 971         }
 972 }
 973
 974 void
 975 fw3_ipt_rule_limit(struct fw3_ipt_rule *r, struct fw3_limit *limit)
 976 {
 977         char buf[sizeof("-4294967296/second\0")];
 978
 979         if (!limit || limit->rate <= 0)
 980                 return;
 981
 982         fw3_ipt_rule_addarg(r, false, "-m", "limit");
 983
 984         sprintf(buf, "%u/%s", limit->rate, fw3_limit_units[limit->unit]);
 985         fw3_ipt_rule_addarg(r, limit->invert, "--limit", buf);
 986
 987         if (limit->burst > 0)
 988         {
 989                 sprintf(buf, "%u", limit->burst);
 990                 fw3_ipt_rule_addarg(r, limit->invert, "--limit-burst", buf);
 991         }
 992 }
 993
 994 void
 995 fw3_ipt_rule_ipset(struct fw3_ipt_rule *r, struct fw3_setmatch *match)
 996 {
 997         char buf[sizeof("dst,dst,dst\0")];
 998         char *p = buf;
 999         int i = 0;
1000
1001         struct fw3_ipset *set;
1002         struct fw3_ipset_datatype *type;
1003
1004         if (!match || !match->set || !match->ptr)
1005                 return;
1006
1007         set = match->ptr;
1008         list_for_each_entry(type, &set->datatypes, list)
1009         {
1010                 if (i >= 3)
1011                         break;
1012
1013                 if (p > buf)
1014                         *p++ = ',';
1015
1016                 p += sprintf(p, "%s", match->dir[i] ? match->dir[i] : type->dir);
1017                 i++;
1018         }
1019
1020         fw3_ipt_rule_addarg(r, false, "-m", "set");
1021
1022         fw3_ipt_rule_addarg(r, match->invert, "--match-set",
1023                             set->external ? set->external : set->name);
1024
1025         fw3_ipt_rule_addarg(r, false, buf, NULL);
1026 }
1027
1028 void
1029 fw3_ipt_rule_time(struct fw3_ipt_rule *r, struct fw3_time *time)
1030 {
1031         int i;
1032         struct tm empty = { 0 };
1033
1034         char buf[84]; /* sizeof("1,2,3,...,30,31\0") */
1035         char *p;
1036
1037         bool d1 = memcmp(&time->datestart, &empty, sizeof(empty));
1038         bool d2 = memcmp(&time->datestop, &empty, sizeof(empty));
1039
1040         if (!d1 && !d2 && !time->timestart && !time->timestop &&
1041             !(time->monthdays & 0xFFFFFFFE) && !(time->weekdays & 0xFE))
1042         {
1043                 return;
1044         }
1045
1046         fw3_ipt_rule_addarg(r, false, "-m", "time");
1047
1048         if (!time->utc)
1049                 fw3_ipt_rule_addarg(r, false, "--kerneltz", NULL);
1050
1051         if (d1)
1052         {
1053                 strftime(buf, sizeof(buf), "%Y-%m-%dT%H:%M:%S", &time->datestart);
1054                 fw3_ipt_rule_addarg(r, false, "--datestart", buf);
1055         }
1056
1057         if (d2)
1058         {
1059                 strftime(buf, sizeof(buf), "%Y-%m-%dT%H:%M:%S", &time->datestop);
1060                 fw3_ipt_rule_addarg(r, false, "--datestop", buf);
1061         }
1062
1063         if (time->timestart)
1064         {
1065                 sprintf(buf, "%02d:%02d:%02d",
1066                         time->timestart / 3600,
1067                         time->timestart % 3600 / 60,
1068                         time->timestart % 60);
1069
1070                 fw3_ipt_rule_addarg(r, false, "--timestart", buf);
1071         }
1072
1073         if (time->timestop)
1074         {
1075                 sprintf(buf, "%02d:%02d:%02d",
1076                         time->timestop / 3600,
1077                         time->timestop % 3600 / 60,
1078                         time->timestop % 60);
1079
1080                 fw3_ipt_rule_addarg(r, false, "--timestop", buf);
1081         }
1082
1083         if (time->monthdays & 0xFFFFFFFE)
1084         {
1085                 for (i = 1, p = buf; i < 32; i++)
1086                 {
1087                         if (fw3_hasbit(time->monthdays, i))
1088                         {
1089                                 if (p > buf)
1090                                         *p++ = ',';
1091
1092                                 p += sprintf(p, "%u", i);
1093                         }
1094                 }
1095
1096                 fw3_ipt_rule_addarg(r, fw3_hasbit(time->monthdays, 0), "--monthdays", buf);
1097         }
1098
1099         if (time->weekdays & 0xFE)
1100         {
1101                 for (i = 1, p = buf; i < 8; i++)
1102                 {
1103                         if (fw3_hasbit(time->weekdays, i))
1104                         {
1105                                 if (p > buf)
1106                                         *p++ = ',';
1107
1108                                 p += sprintf(p, "%u", i);
1109                         }
1110                 }
1111
1112                 fw3_ipt_rule_addarg(r, fw3_hasbit(time->weekdays, 0), "--weekdays", buf);
1113         }
1114 }
1115
1116 void
1117 fw3_ipt_rule_mark(struct fw3_ipt_rule *r, struct fw3_mark *mark)
1118 {
1119         char buf[sizeof("0xFFFFFFFF/0xFFFFFFFF\0")];
1120
1121         if (!mark || !mark->set)
1122                 return;
1123
1124         if (mark->mask < 0xFFFFFFFF)
1125                 sprintf(buf, "0x%x/0x%x", mark->mark, mark->mask);
1126         else
1127                 sprintf(buf, "0x%x", mark->mark);
1128
1129         fw3_ipt_rule_addarg(r, false, "-m", "mark");
1130         fw3_ipt_rule_addarg(r, mark->invert, "--mark", buf);
1131 }
1132
1133 void
1134 fw3_ipt_rule_comment(struct fw3_ipt_rule *r, const char *fmt, ...)
1135 {
1136         va_list ap;
1137         char buf[256];
1138
1139         if (!fmt || !*fmt)
1140                 return;
1141
1142         va_start(ap, fmt);
1143         vsnprintf(buf, sizeof(buf) - 1, fmt, ap);
1144         va_end(ap);
1145
1146         fw3_ipt_rule_addarg(r, false, "-m", "comment");
1147         fw3_ipt_rule_addarg(r, false, "--comment", buf);
1148 }
1149
1150 void
1151 fw3_ipt_rule_extra(struct fw3_ipt_rule *r, const char *extra)
1152 {
1153         char *p, **tmp, *s;
1154
1155         if (!extra || !*extra)
1156                 return;
1157
1158         s = fw3_strdup(extra);
1159
1160         for (p = strtok(s, " \t"); p; p = strtok(NULL, " \t"))
1161         {
1162                 tmp = realloc(r->argv, (r->argc + 1) * sizeof(*r->argv));
1163
1164                 if (!tmp)
1165                         break;
1166
1167                 r->argv = tmp;
1168                 r->argv[r->argc++] = fw3_strdup(p);
1169         }
1170
1171         free(s);
1172 }
1173
1174 #ifndef DISABLE_IPV6
1175 static void
1176 rule_print6(struct ip6t_entry *e)
1177 {
1178         char buf1[INET6_ADDRSTRLEN], buf2[INET6_ADDRSTRLEN];
1179         char *pname;
1180
1181         if (e->ipv6.flags & IP6T_F_PROTO)
1182         {
1183                 if (e->ipv6.invflags & XT_INV_PROTO)
1184                         printf(" !");
1185
1186                 pname = get_protoname(container_of(e, struct fw3_ipt_rule, e6));
1187
1188                 if (pname)
1189                         printf(" -p %s", pname);
1190                 else
1191                         printf(" -p %u", e->ipv6.proto);
1192         }
1193
1194         if (e->ipv6.iniface[0])
1195         {
1196                 if (e->ipv6.invflags & IP6T_INV_VIA_IN)
1197                         printf(" !");
1198
1199                 printf(" -i %s", e->ipv6.iniface);
1200         }
1201
1202         if (e->ipv6.outiface[0])
1203         {
1204                 if (e->ipv6.invflags & IP6T_INV_VIA_OUT)
1205                         printf(" !");
1206
1207                 printf(" -o %s", e->ipv6.outiface);
1208         }
1209
1210         if (memcmp(&e->ipv6.src, &in6addr_any, sizeof(struct in6_addr)))
1211         {
1212                 if (e->ipv6.invflags & IP6T_INV_SRCIP)
1213                         printf(" !");
1214
1215                 printf(" -s %s/%s",
1216                        inet_ntop(AF_INET6, &e->ipv6.src, buf1, sizeof(buf1)),
1217                        inet_ntop(AF_INET6, &e->ipv6.smsk, buf2, sizeof(buf2)));
1218         }
1219
1220         if (memcmp(&e->ipv6.dst, &in6addr_any, sizeof(struct in6_addr)))
1221         {
1222                 if (e->ipv6.invflags & IP6T_INV_DSTIP)
1223                         printf(" !");
1224
1225                 printf(" -d %s/%s",
1226                        inet_ntop(AF_INET6, &e->ipv6.dst, buf1, sizeof(buf1)),
1227                        inet_ntop(AF_INET6, &e->ipv6.dmsk, buf2, sizeof(buf2)));
1228         }
1229 }
1230 #endif
1231
1232 static void
1233 rule_print4(struct ipt_entry *e)
1234 {
1235         struct in_addr in_zero = { 0 };
1236         char buf1[sizeof("255.255.255.255\0")], buf2[sizeof("255.255.255.255\0")];
1237         char *pname;
1238
1239         if (e->ip.proto)
1240         {
1241                 if (e->ip.invflags & XT_INV_PROTO)
1242                         printf(" !");
1243
1244                 pname = get_protoname(container_of(e, struct fw3_ipt_rule, e));
1245
1246                 if (pname)
1247                         printf(" -p %s", pname);
1248                 else
1249                         printf(" -p %u", e->ip.proto);
1250         }
1251
1252         if (e->ip.iniface[0])
1253         {
1254                 if (e->ip.invflags & IPT_INV_VIA_IN)
1255                         printf(" !");
1256
1257                 printf(" -i %s", e->ip.iniface);
1258         }
1259
1260         if (e->ip.outiface[0])
1261         {
1262                 if (e->ip.invflags & IPT_INV_VIA_OUT)
1263                         printf(" !");
1264
1265                 printf(" -o %s", e->ip.outiface);
1266         }
1267
1268         if (memcmp(&e->ip.src, &in_zero, sizeof(struct in_addr)))
1269         {
1270                 if (e->ip.invflags & IPT_INV_SRCIP)
1271                         printf(" !");
1272
1273                 printf(" -s %s/%s",
1274                        inet_ntop(AF_INET, &e->ip.src, buf1, sizeof(buf1)),
1275                        inet_ntop(AF_INET, &e->ip.smsk, buf2, sizeof(buf2)));
1276         }
1277
1278         if (memcmp(&e->ip.dst, &in_zero, sizeof(struct in_addr)))
1279         {
1280                 if (e->ip.invflags & IPT_INV_DSTIP)
1281                         printf(" !");
1282
1283                 printf(" -d %s/%s",
1284                        inet_ntop(AF_INET, &e->ip.dst, buf1, sizeof(buf1)),
1285                        inet_ntop(AF_INET, &e->ip.dmsk, buf2, sizeof(buf2)));
1286         }
1287 }
1288
1289 static void
1290 rule_print(struct fw3_ipt_rule *r, const char *prefix, const char *chain)
1291 {
1292         debug(r->h, "%s %s", prefix, chain);
1293
1294 #ifndef DISABLE_IPV6
1295         if (r->h->family == FW3_FAMILY_V6)
1296                 rule_print6(&r->e6);
1297         else
1298 #endif
1299                 rule_print4(&r->e);
1300
1301         fw3_xt_print_matches(&r->e.ip, r->matches);
1302         fw3_xt_print_target(&r->e.ip, r->target);
1303
1304         printf("\n");
1305 }
1306
1307 static bool
1308 parse_option(struct fw3_ipt_rule *r, int optc, bool inv)
1309 {
1310         struct xtables_rule_match *m;
1311         struct xtables_match *em;
1312
1313         /* is a target option */
1314         if (r->target && fw3_xt_has_target_parse(r->target) &&
1315                 optc >= r->target->option_offset &&
1316                 optc < (r->target->option_offset + 256))
1317         {
1318                 xtables_option_tpcall(optc, r->argv, inv, r->target, &r->e);
1319                 return false;
1320         }
1321
1322         /* try to dispatch argument to one of the match parsers */
1323         for (m = r->matches; m; m = m->next)
1324         {
1325                 em = m->match;
1326
1327                 if (m->completed || !fw3_xt_has_match_parse(em))
1328                         continue;
1329
1330                 if (optc < em->option_offset ||
1331                         optc >= (em->option_offset + 256))
1332                         continue;
1333
1334                 xtables_option_mpcall(optc, r->argv, inv, em, &r->e);
1335                 return false;
1336         }
1337
1338         /* unhandled option, might belong to a protocol match */
1339         if ((em = load_protomatch(r)) != NULL)
1340         {
1341                 init_match(r, em, false);
1342
1343                 r->protocol_loaded = true;
1344                 optind--;
1345
1346                 return true;
1347         }
1348
1349         if (optc == ':')
1350                 warn("parse_option(): option '%s' needs argument", r->argv[optind-1]);
1351
1352         if (optc == '?')
1353                 warn("parse_option(): unknown option '%s'", r->argv[optind-1]);
1354
1355         return false;
1356 }
1357
1358 void
1359 fw3_ipt_rule_addarg(struct fw3_ipt_rule *r, bool inv,
1360                     const char *k, const char *v)
1361 {
1362         int n;
1363         char **tmp;
1364
1365         if (!k)
1366                 return;
1367
1368         n = inv + !!k + !!v;
1369         tmp = realloc(r->argv, (r->argc + n) * sizeof(*tmp));
1370
1371         if (!tmp)
1372                 return;
1373
1374         r->argv = tmp;
1375
1376         if (inv)
1377                 r->argv[r->argc++] = fw3_strdup("!");
1378
1379         r->argv[r->argc++] = fw3_strdup(k);
1380
1381         if (v)
1382                 r->argv[r->argc++] = fw3_strdup(v);
1383 }
1384
1385 static unsigned char *
1386 rule_mask(struct fw3_ipt_rule *r)
1387 {
1388         size_t s;
1389         unsigned char *p, *mask = NULL;
1390         struct xtables_rule_match *m;
1391
1392 #define SZ(x) XT_ALIGN(sizeof(struct x))
1393
1394 #ifndef DISABLE_IPV6
1395         if (r->h->family == FW3_FAMILY_V6)
1396         {
1397                 s = SZ(ip6t_entry);
1398
1399                 for (m = r->matches; m; m = m->next)
1400                         s += SZ(ip6t_entry_match) + m->match->size;
1401
1402                 s += SZ(ip6t_entry_target);
1403                 if (r->target)
1404                         s += r->target->size;
1405
1406                 mask = fw3_alloc(s);
1407                 memset(mask, 0xFF, SZ(ip6t_entry));
1408                 p = mask + SZ(ip6t_entry);
1409
1410                 for (m = r->matches; m; m = m->next)
1411                 {
1412                         memset(p, 0xFF, SZ(ip6t_entry_match) + m->match->userspacesize);
1413                         p += SZ(ip6t_entry_match) + m->match->size;
1414                 }
1415
1416                 memset(p, 0xFF, SZ(ip6t_entry_target) + (r->target) ? r->target->userspacesize : 0);
1417         }
1418         else
1419 #endif
1420         {
1421                 s = SZ(ipt_entry);
1422
1423                 for (m = r->matches; m; m = m->next)
1424                         s += SZ(ipt_entry_match) + m->match->size;
1425
1426                 s += SZ(ipt_entry_target);
1427                 if (r->target)
1428                         s += r->target->size;
1429
1430                 mask = fw3_alloc(s);
1431                 memset(mask, 0xFF, SZ(ipt_entry));
1432                 p = mask + SZ(ipt_entry);
1433
1434                 for (m = r->matches; m; m = m->next)
1435                 {
1436                         memset(p, 0xFF, SZ(ipt_entry_match) + m->match->userspacesize);
1437                         p += SZ(ipt_entry_match) + m->match->size;
1438                 }
1439
1440                 memset(p, 0xFF, SZ(ipt_entry_target) + (r->target) ? r->target->userspacesize : 0);
1441         }
1442
1443         return mask;
1444 }
1445
1446 static void *
1447 rule_build(struct fw3_ipt_rule *r)
1448 {
1449         size_t s, target_size = (r->target) ? r->target->t->u.target_size : 0;
1450         struct xtables_rule_match *m;
1451
1452 #ifndef DISABLE_IPV6
1453         if (r->h->family == FW3_FAMILY_V6)
1454         {
1455                 struct ip6t_entry *e6;
1456
1457                 s = XT_ALIGN(sizeof(struct ip6t_entry));
1458
1459                 for (m = r->matches; m; m = m->next)
1460                         s += m->match->m->u.match_size;
1461
1462                 e6 = fw3_alloc(s + target_size);
1463
1464                 memcpy(e6, &r->e6, sizeof(struct ip6t_entry));
1465
1466                 e6->target_offset = s;
1467                 e6->next_offset = s + target_size;
1468
1469                 s = 0;
1470
1471                 for (m = r->matches; m; m = m->next)
1472                 {
1473                         memcpy(e6->elems + s, m->match->m, m->match->m->u.match_size);
1474                         s += m->match->m->u.match_size;
1475                 }
1476
1477                 if (target_size)
1478                         memcpy(e6->elems + s, r->target->t, target_size);
1479
1480                 return e6;
1481         }
1482         else
1483 #endif
1484         {
1485                 struct ipt_entry *e;
1486
1487                 s = XT_ALIGN(sizeof(struct ipt_entry));
1488
1489                 for (m = r->matches; m; m = m->next)
1490                         s += m->match->m->u.match_size;
1491
1492                 e = fw3_alloc(s + target_size);
1493
1494                 memcpy(e, &r->e, sizeof(struct ipt_entry));
1495
1496                 e->target_offset = s;
1497                 e->next_offset = s + target_size;
1498
1499                 s = 0;
1500
1501                 for (m = r->matches; m; m = m->next)
1502                 {
1503                         memcpy(e->elems + s, m->match->m, m->match->m->u.match_size);
1504                         s += m->match->m->u.match_size;
1505                 }
1506
1507                 if (target_size)
1508                         memcpy(e->elems + s, r->target->t, target_size);
1509
1510                 return e;
1511         }
1512 }
1513
1514 static void
1515 set_rule_tag(struct fw3_ipt_rule *r)
1516 {
1517         int i;
1518         char *p, **tmp;
1519         const char *tag = "!fw3";
1520
1521         for (i = 0; i < r->argc; i++)
1522                 if (!strcmp(r->argv[i], "--comment") && (i + 1) < r->argc)
1523                         if (asprintf(&p, "%s: %s", tag, r->argv[i + 1]) > 0)
1524                         {
1525                                 free(r->argv[i + 1]);
1526                                 r->argv[i + 1] = p;
1527                                 return;
1528                         }
1529
1530         tmp = realloc(r->argv, (r->argc + 4) * sizeof(*r->argv));
1531
1532         if (tmp)
1533         {
1534                 r->argv = tmp;
1535                 r->argv[r->argc++] = fw3_strdup("-m");
1536                 r->argv[r->argc++] = fw3_strdup("comment");
1537                 r->argv[r->argc++] = fw3_strdup("--comment");
1538                 r->argv[r->argc++] = fw3_strdup(tag);
1539         }
1540 }
1541
1542 void
1543 __fw3_ipt_rule_append(struct fw3_ipt_rule *r, bool repl, const char *fmt, ...)
1544 {
1545         void *rule;
1546         unsigned char *mask;
1547
1548         struct xtables_rule_match *m;
1549         struct xtables_match *em;
1550         struct xtables_target *et;
1551         struct xtables_globals *g;
1552
1553         struct fw3_device dev;
1554         struct fw3_address addr;
1555
1556         enum xtables_exittype status;
1557
1558         int i, optc;
1559         bool inv = false;
1560         char buf[32];
1561         va_list ap;
1562
1563         va_start(ap, fmt);
1564         vsnprintf(buf, sizeof(buf) - 1, fmt, ap);
1565         va_end(ap);
1566
1567         g = (r->h->family == FW3_FAMILY_V6) ? &xtg6 : &xtg;
1568         g->opts = g->orig_opts;
1569
1570         optind = 0;
1571         opterr = 0;
1572
1573         status = setjmp(fw3_ipt_error_jmp);
1574
1575         if (status > 0)
1576         {
1577                 info("     ! Skipping due to previous exception (code %u)", status);
1578                 goto free;
1579         }
1580
1581         set_rule_tag(r);
1582
1583         while ((optc = getopt_long(r->argc, r->argv, "-:m:j:i:o:s:d:", g->opts,
1584                                    NULL)) != -1)
1585         {
1586                 switch (optc)
1587                 {
1588                 case 'm':
1589                         em = find_match(r, optarg);
1590
1591                         if (!em)
1592                         {
1593                                 warn("fw3_ipt_rule_append(): Can't find match '%s'", optarg);
1594                                 goto free;
1595                         }
1596
1597                         init_match(r, em, true);
1598                         break;
1599
1600                 case 'j':
1601                         et = get_target(r, optarg);
1602
1603                         if (!et)
1604                         {
1605                                 warn("fw3_ipt_rule_append(): Can't find target '%s'", optarg);
1606                                 goto free;
1607                         }
1608
1609                         break;
1610
1611                 case 'i':
1612                 case 'o':
1613                         if (!fw3_parse_device(&dev, optarg, false) ||
1614                             dev.any || dev.invert || *dev.network)
1615                         {
1616                                 warn("fw3_ipt_rule_append(): Bad argument '%s'", optarg);
1617                                 goto free;
1618                         }
1619
1620                         dev.invert = inv;
1621                         fw3_ipt_rule_in_out(r, (optc == 'i') ? &dev : NULL,
1622                                                (optc == 'o') ? &dev : NULL);
1623                         break;
1624
1625                 case 's':
1626                 case 'd':
1627                         if (!fw3_parse_address(&addr, optarg, false) ||
1628                             addr.range || addr.invert)
1629                         {
1630                                 warn("fw3_ipt_rule_append(): Bad argument '%s'", optarg);
1631                                 goto free;
1632                         }
1633
1634                         addr.invert = inv;
1635                         fw3_ipt_rule_src_dest(r, (optc == 's') ? &addr : NULL,
1636                                                  (optc == 'd') ? &addr : NULL);
1637                         break;
1638
1639                 case 1:
1640                         if ((optarg[0] == '!') && (optarg[1] == '\0'))
1641                         {
1642                                 optarg[0] = '\0';
1643                                 inv = true;
1644                                 continue;
1645                         }
1646
1647                         warn("fw3_ipt_rule_append(): Bad argument '%s'", optarg);
1648                         goto free;
1649
1650                 default:
1651                         if (parse_option(r, optc, inv))
1652                                 continue;
1653                         break;
1654                 }
1655
1656                 inv = false;
1657         }
1658
1659         for (m = r->matches; m; m = m->next)
1660                 xtables_option_mfcall(m->match);
1661
1662         if (r->target)
1663                 xtables_option_tfcall(r->target);
1664
1665         rule = rule_build(r);
1666
1667 #ifndef DISABLE_IPV6
1668         if (r->h->family == FW3_FAMILY_V6)
1669         {
1670                 if (repl)
1671                 {
1672                         mask = rule_mask(r);
1673
1674                         while (ip6tc_delete_entry(buf, rule, mask, r->h->handle))
1675                                 if (fw3_pr_debug)
1676                                         rule_print(r, "-D", buf);
1677
1678                         free(mask);
1679                 }
1680
1681                 if (fw3_pr_debug)
1682                         rule_print(r, "-A", buf);
1683
1684                 if (!ip6tc_append_entry(buf, rule, r->h->handle))
1685                         warn("ip6tc_append_entry(): %s", ip6tc_strerror(errno));
1686         }
1687         else
1688 #endif
1689         {
1690                 if (repl)
1691                 {
1692                         mask = rule_mask(r);
1693
1694                         while (iptc_delete_entry(buf, rule, mask, r->h->handle))
1695                                 if (fw3_pr_debug)
1696                                         rule_print(r, "-D", buf);
1697
1698                         free(mask);
1699                 }
1700
1701                 if (fw3_pr_debug)
1702                         rule_print(r, "-A", buf);
1703
1704                 if (!iptc_append_entry(buf, rule, r->h->handle))
1705                         warn("iptc_append_entry(): %s\n", iptc_strerror(errno));
1706         }
1707
1708         free(rule);
1709
1710 free:
1711         for (i = 1; i < r->argc; i++)
1712                 free(r->argv[i]);
1713
1714         free(r->argv);
1715
1716         xtables_rule_matches_free(&r->matches);
1717
1718         if (r->target)
1719                 free(r->target->t);
1720
1721         free(r);
1722
1723         /* reset all targets and matches */
1724         for (em = xtables_matches; em; em = em->next)
1725                 em->mflags = 0;
1726
1727         for (et = xtables_targets; et; et = et->next)
1728         {
1729                 et->tflags = 0;
1730                 et->used = 0;
1731         }
1732
1733         xtables_free_opts(1);
1734 }
1735
1736 struct fw3_ipt_rule *
1737 fw3_ipt_rule_create(struct fw3_ipt_handle *handle, struct fw3_protocol *proto,
1738                     struct fw3_device *in, struct fw3_device *out,
1739                     struct fw3_address *src, struct fw3_address *dest)
1740 {
1741         struct fw3_ipt_rule *r;
1742
1743         r = fw3_ipt_rule_new(handle);
1744
1745         fw3_ipt_rule_proto(r, proto);
1746         fw3_ipt_rule_in_out(r, in, out);
1747         fw3_ipt_rule_src_dest(r, src, dest);
1748
1749         return r;
1750 }
1751
1752 void
1753 xtables_register_match(struct xtables_match *me)
1754 {
1755         int i;
1756         static struct xtables_match **tmp;
1757
1758         if (!xext.register_match)
1759                 xext.register_match = dlsym(RTLD_NEXT, "xtables_register_match");
1760
1761         if (!xext.register_match)
1762                 return;
1763
1764         xext.register_match(me);
1765
1766         if (xext.retain)
1767         {
1768                 for (i = 0; i < xext.mcount; i++)
1769                         if (xext.matches[i] == me)
1770                                 return;
1771
1772                 tmp = realloc(xext.matches, sizeof(me) * (xext.mcount + 1));
1773
1774                 if (!tmp)
1775                         return;
1776
1777                 xext.matches = tmp;
1778                 xext.matches[xext.mcount++] = me;
1779         }
1780 }
1781
1782 void
1783 xtables_register_target(struct xtables_target *me)
1784 {
1785         int i;
1786         static struct xtables_target **tmp;
1787
1788         if (!xext.register_target)
1789                 xext.register_target = dlsym(RTLD_NEXT, "xtables_register_target");
1790
1791         if (!xext.register_target)
1792                 return;
1793
1794         xext.register_target(me);
1795
1796         if (xext.retain)
1797         {
1798                 for (i = 0; i < xext.tcount; i++)
1799                         if (xext.targets[i] == me)
1800                                 return;
1801
1802                 tmp = realloc(xext.targets, sizeof(me) * (xext.tcount + 1));
1803
1804                 if (!tmp)
1805                         return;
1806
1807                 xext.targets = tmp;
1808                 xext.targets[xext.tcount++] = me;
1809         }
1810 }