Make IPv6 support optional

[project/firewall3.git] / iptables.c

diff --git a/iptables.c b/iptables.c
index 56f68c3..21c96b4 100644 (file)
--- a/iptables.c
+++ b/iptables.c
@@ -39,7 +39,7 @@ static struct xtables_globals xtg6 = {
 };
 
 /* Required by certain extensions like SNAT and DNAT */
-int kernel_version;
+int kernel_version = 0;
 
 void
 get_kernel_version(void)
@@ -51,35 +51,25 @@ get_kernel_version(void)
                sprintf(uts.release, "3.0.0");
 
        sscanf(uts.release, "%d.%d.%d", &x, &y, &z);
-       kernel_version = LINUX_VERSION(x, y, z);
+       kernel_version = 0x10000 * x + 0x100 * y + z;
 }
 
+#ifdef DISABLE_IPV6
+#undef __ipt_module
+#define __ipt_module(x) libxt_##x##_init, libipt_##x##_init,
+#else
+#undef __ipt_module
+#define __ipt_module(x) libxt_##x##_init, libipt_##x##_init, libip6t_##x##_init,
+#endif
+
 static void fw3_init_extensions(void)
 {
-       libip6t_icmp6_init();
-       libip6t_LOG_init();
-       libip6t_REJECT_init();
-       libipt_DNAT_init();
-       libipt_icmp_init();
-       libipt_LOG_init();
-       libipt_MASQUERADE_init();
-       libipt_REDIRECT_init();
-       libipt_REJECT_init();
-       libipt_SNAT_init();
-       libxt_comment_init();
-       libxt_conntrack_init();
-       libxt_CT_init();
-       libxt_limit_init();
-       libxt_mac_init();
-       libxt_mark_init();
-       libxt_MARK_init();
-       libxt_set_init();
-       libxt_SET_init();
-       libxt_standard_init();
-       libxt_TCPMSS_init();
-       libxt_tcp_init();
-       libxt_time_init();
-       libxt_udp_init();
+       int i;
+       void (*initfuncs[])(void) = { FW3_IPT_MODULES };
+
+       for (i = 0; i < sizeof(initfuncs)/sizeof(initfuncs[0]); i++)
+               if (initfuncs[i])
+                       initfuncs[i]();
 }
 
 struct fw3_ipt_handle *
@@ -93,12 +83,14 @@ fw3_ipt_open(enum fw3_family family, enum fw3_table table)
 
        if (family == FW3_FAMILY_V6)
        {
+#ifndef DISABLE_IPV6
                h->family = FW3_FAMILY_V6;
                h->table  = table;
                h->handle = ip6tc_init(fw3_flag_names[table]);
 
                xtables_set_params(&xtg6);
                xtables_set_nfproto(NFPROTO_IPV6);
+#endif
        }
        else
        {
@@ -116,12 +108,7 @@ fw3_ipt_open(enum fw3_family family, enum fw3_table table)
                return NULL;
        }
 
-       xtables_pending_matches = NULL;
-       xtables_pending_targets = NULL;
-
-       xtables_matches = NULL;
-       xtables_targets = NULL;
-
+       fw3_xt_reset();
        fw3_init_extensions();
 
        return h;
@@ -147,9 +134,11 @@ fw3_ipt_set_policy(struct fw3_ipt_handle *h, const char *chain,
        if (fw3_pr_debug)
                debug(h, "-P %s %s\n", chain, fw3_flag_names[policy]);
 
+#ifndef DISABLE_IPV6
        if (h->family == FW3_FAMILY_V6)
                ip6tc_set_policy(chain, fw3_flag_names[policy], NULL, h->handle);
        else
+#endif
                iptc_set_policy(chain, fw3_flag_names[policy], NULL, h->handle);
 }
 
@@ -162,12 +151,14 @@ fw3_ipt_delete_chain(struct fw3_ipt_handle *h, const char *chain)
                debug(h, "-X %s\n", chain);
        }
 
+#ifndef DISABLE_IPV6
        if (h->family == FW3_FAMILY_V6)
        {
                if (ip6tc_flush_entries(chain, h->handle))
                        ip6tc_delete_chain(chain, h->handle);
        }
        else
+#endif
        {
                if (iptc_flush_entries(chain, h->handle))
                        iptc_delete_chain(chain, h->handle);
@@ -179,11 +170,11 @@ fw3_ipt_delete_rules(struct fw3_ipt_handle *h, const char *target)
 {
        unsigned int num;
        const struct ipt_entry *e;
-       const struct ip6t_entry *e6;
        const char *chain;
        const char *t;
        bool found;
 
+#ifndef DISABLE_IPV6
        if (h->family == FW3_FAMILY_V6)
        {
                for (chain = ip6tc_first_chain(h->handle);
@@ -193,6 +184,7 @@ fw3_ipt_delete_rules(struct fw3_ipt_handle *h, const char *target)
                        do {
                                found = false;
 
+                               const struct ip6t_entry *e6;
                                for (num = 0, e6 = ip6tc_first_rule(chain, h->handle);
                                         e6 != NULL;
                                         num++, e6 = ip6tc_next_rule(e6, h->handle))
@@ -213,6 +205,7 @@ fw3_ipt_delete_rules(struct fw3_ipt_handle *h, const char *target)
                }
        }
        else
+#endif
        {
                for (chain = iptc_first_chain(h->handle);
                     chain != NULL;
@@ -263,6 +256,7 @@ fw3_ipt_flush(struct fw3_ipt_handle *h)
 {
        const char *chain;
 
+#ifndef DISABLE_IPV6
        if (h->family == FW3_FAMILY_V6)
        {
                for (chain = ip6tc_first_chain(h->handle);
@@ -280,6 +274,7 @@ fw3_ipt_flush(struct fw3_ipt_handle *h)
                }
        }
        else
+#endif
        {
                for (chain = iptc_first_chain(h->handle);
                     chain != NULL;
@@ -302,6 +297,7 @@ fw3_ipt_commit(struct fw3_ipt_handle *h)
 {
        int rv;
 
+#ifndef DISABLE_IPV6
        if (h->family == FW3_FAMILY_V6)
        {
                rv = ip6tc_commit(h->handle);
@@ -309,6 +305,7 @@ fw3_ipt_commit(struct fw3_ipt_handle *h)
                        fprintf(stderr, "ip6tc_commit(): %s\n", ip6tc_strerror(errno));
        }
        else
+#endif
        {
                rv = iptc_commit(h->handle);
                if (!rv)
@@ -336,9 +333,11 @@ fw3_ipt_rule_new(struct fw3_ipt_handle *h)
 static bool
 is_chain(struct fw3_ipt_handle *h, const char *name)
 {
+#ifndef DISABLE_IPV6
        if (h->family == FW3_FAMILY_V6)
                return ip6tc_is_chain(name, h->handle);
        else
+#endif
                return iptc_is_chain(name, h->handle);
 }
 
@@ -373,16 +372,14 @@ init_match(struct fw3_ipt_rule *r, struct xtables_match *m, bool no_clone)
        s = XT_ALIGN(sizeof(struct xt_entry_match)) + m->size;
 
        m->m = fw3_alloc(s);
-       strcpy(m->m->u.user.name, m->real_name ? m->real_name : m->name);
+
+       fw3_xt_set_match_name(m);
+
        m->m->u.user.revision = m->revision;
        m->m->u.match_size = s;
 
        /* free previous userspace data */
-       if (m->udata_size)
-       {
-               free(m->udata);
-               m->udata = fw3_alloc(m->udata_size);
-       }
+       fw3_xt_free_match_udata(m);
 
        if (m->init)
                m->init(m->m);
@@ -393,14 +390,7 @@ init_match(struct fw3_ipt_rule *r, struct xtables_match *m, bool no_clone)
 
        /* merge option table */
        g = (r->h->family == FW3_FAMILY_V6) ? &xtg6 : &xtg;
-
-       if (m->x6_options)
-               g->opts = xtables_options_xfrm(g->orig_opts, g->opts,
-                                                                          m->x6_options, &m->option_offset);
-
-       if (m->extra_opts)
-               g->opts = xtables_merge_options(g->orig_opts, g->opts,
-                                                                               m->extra_opts, &m->option_offset);
+       fw3_xt_merge_match_options(g, m);
 }
 
 static bool
@@ -446,32 +436,20 @@ get_target(struct fw3_ipt_rule *r, const char *name)
        s = XT_ALIGN(sizeof(struct xt_entry_target)) + t->size;
        t->t = fw3_alloc(s);
 
-       if (!t->real_name)
-               strcpy(t->t->u.user.name, name);
-       else
-               strcpy(t->t->u.user.name, t->real_name);
+       fw3_xt_set_target_name(t, name);
 
        t->t->u.user.revision = t->revision;
        t->t->u.target_size = s;
 
-       if (t->udata_size)
-       {
-               free(t->udata);
-               t->udata = fw3_alloc(t->udata_size);
-       }
+       /* free previous userspace data */
+       fw3_xt_free_target_udata(t);
 
        if (t->init)
                t->init(t->t);
 
        /* merge option table */
        g = (r->h->family == FW3_FAMILY_V6) ? &xtg6 : &xtg;
-
-       if (t->x6_options)
-               g->opts = xtables_options_xfrm(g->orig_opts, g->opts,
-                                              t->x6_options, &t->option_offset);
-       else
-               g->opts = xtables_merge_options(g->orig_opts, g->opts,
-                                               t->extra_opts, &t->option_offset);
+       fw3_xt_merge_target_options(g, t);
 
        r->target = t;
 
@@ -488,6 +466,7 @@ fw3_ipt_rule_proto(struct fw3_ipt_rule *r, struct fw3_protocol *proto)
 
        pr = proto->protocol;
 
+#ifndef DISABLE_IPV6
        if (r->h->family == FW3_FAMILY_V6)
        {
                if (pr == 1)
@@ -500,6 +479,7 @@ fw3_ipt_rule_proto(struct fw3_ipt_rule *r, struct fw3_protocol *proto)
                        r->e6.ipv6.invflags |= XT_INV_PROTO;
        }
        else
+#endif
        {
                r->e.ip.proto = pr;
 
@@ -514,6 +494,7 @@ void
 fw3_ipt_rule_in_out(struct fw3_ipt_rule *r,
                     struct fw3_device *in, struct fw3_device *out)
 {
+#ifndef DISABLE_IPV6
        if (r->h->family == FW3_FAMILY_V6)
        {
                if (in && !in->any)
@@ -535,6 +516,7 @@ fw3_ipt_rule_in_out(struct fw3_ipt_rule *r,
                }
        }
        else
+#endif
        {
                if (in && !in->any)
                {
@@ -563,6 +545,7 @@ ip4prefix2mask(int prefix, struct in_addr *mask)
        mask->s_addr = htonl(~((1 << (32 - prefix)) - 1));
 }
 
+#ifndef DISABLE_IPV6
 static void
 ip6prefix2mask(int prefix, struct in6_addr *mask)
 {
@@ -579,13 +562,12 @@ ip6prefix2mask(int prefix, struct in6_addr *mask)
                memset(mask, 0, sizeof(*mask));
        }
 }
+#endif
 
 void
 fw3_ipt_rule_src_dest(struct fw3_ipt_rule *r,
                       struct fw3_address *src, struct fw3_address *dest)
 {
-       int i;
-
        if ((src && src->range) || (dest && dest->range))
        {
                fw3_ipt_rule_addarg(r, false, "-m", "iprange");
@@ -598,17 +580,20 @@ fw3_ipt_rule_src_dest(struct fw3_ipt_rule *r,
                        fw3_ipt_rule_addarg(r, src->invert, "--src-range",
                                            fw3_address_to_string(src, false));
                }
+#ifndef DISABLE_IPV6
                else if (r->h->family == FW3_FAMILY_V6)
                {
                        r->e6.ipv6.src = src->address.v6;
                        ip6prefix2mask(src->mask, &r->e6.ipv6.smsk);
 
+                       int i;
                        for (i = 0; i < 4; i++)
                                r->e6.ipv6.src.s6_addr32[i] &= r->e6.ipv6.smsk.s6_addr32[i];
 
                        if (src->invert)
                                r->e6.ipv6.invflags |= IP6T_INV_SRCIP;
                }
+#endif
                else
                {
                        r->e.ip.src = src->address.v4;
@@ -628,17 +613,20 @@ fw3_ipt_rule_src_dest(struct fw3_ipt_rule *r,
                        fw3_ipt_rule_addarg(r, dest->invert, "--dst-range",
                                            fw3_address_to_string(dest, false));
                }
+#ifndef DISABLE_IPV6
                else if (r->h->family == FW3_FAMILY_V6)
                {
                        r->e6.ipv6.dst = dest->address.v6;
                        ip6prefix2mask(dest->mask, &r->e6.ipv6.dmsk);
 
+                       int i;
                        for (i = 0; i < 4; i++)
                                r->e6.ipv6.dst.s6_addr32[i] &= r->e6.ipv6.dmsk.s6_addr32[i];
 
                        if (dest->invert)
                                r->e6.ipv6.invflags |= IP6T_INV_DSTIP;
                }
+#endif
                else
                {
                        r->e.ip.dst = dest->address.v4;
@@ -703,6 +691,7 @@ fw3_ipt_rule_icmptype(struct fw3_ipt_rule *r, struct fw3_icmptype *icmp)
        if (!icmp)
                return;
 
+#ifndef DISABLE_IPV6
        if (r->h->family == FW3_FAMILY_V6)
        {
                if (icmp->code6_min == 0 && icmp->code6_max == 0xFF)
@@ -713,6 +702,7 @@ fw3_ipt_rule_icmptype(struct fw3_ipt_rule *r, struct fw3_icmptype *icmp)
                fw3_ipt_rule_addarg(r, icmp->invert, "--icmpv6-type", buf);
        }
        else
+#endif
        {
                if (icmp->code_min == 0 && icmp->code_max == 0xFF)
                        sprintf(buf, "%u", icmp->type);
@@ -917,6 +907,7 @@ fw3_ipt_rule_extra(struct fw3_ipt_rule *r, const char *extra)
        free(s);
 }
 
+#ifndef DISABLE_IPV6
 static void
 rule_print6(struct ip6t_entry *e)
 {
@@ -970,6 +961,7 @@ rule_print6(struct ip6t_entry *e)
                                    xtables_ip6mask_to_cidr(&e->ipv6.dmsk));
        }
 }
+#endif
 
 static void
 rule_print4(struct ipt_entry *e)
@@ -1035,15 +1027,17 @@ rule_print(struct fw3_ipt_rule *r, const char *chain)
 
        debug(r->h, "-A %s", chain);
 
+#ifndef DISABLE_IPV6
        if (r->h->family == FW3_FAMILY_V6)
                rule_print6(&r->e6);
        else
+#endif
                rule_print4(&r->e);
 
        for (rm = r->matches; rm; rm = rm->next)
        {
                m = rm->match;
-               printf(" -m %s", m->alias ? m->alias(m->m) : m->m->u.user.name);
+               printf(" -m %s", fw3_xt_get_match_name(m));
 
                if (m->save)
                        m->save(&r->e.ip, m->m);
@@ -1052,7 +1046,7 @@ rule_print(struct fw3_ipt_rule *r, const char *chain)
        if (r->target)
        {
                t = r->target;
-               printf(" -j %s", t->alias ? t->alias(t->t) : t->t->u.user.name);
+               printf(" -j %s", fw3_xt_get_target_name(t));
 
                if (t->save)
                        t->save(&r->e.ip, t->t);
@@ -1068,7 +1062,7 @@ parse_option(struct fw3_ipt_rule *r, int optc, bool inv)
        struct xtables_match *em;
 
        /* is a target option */
-       if (r->target && (r->target->parse || r->target->x6_parse) &&
+       if (r->target && fw3_xt_has_target_parse(r->target) &&
                optc >= r->target->option_offset &&
                optc < (r->target->option_offset + 256))
        {
@@ -1081,7 +1075,7 @@ parse_option(struct fw3_ipt_rule *r, int optc, bool inv)
        {
                em = m->match;
 
-               if (m->completed || (!em->parse && !em->x6_parse))
+               if (m->completed || !fw3_xt_has_match_parse(em))
                        continue;
 
                if (optc < em->option_offset ||
@@ -1150,7 +1144,6 @@ fw3_ipt_rule_append(struct fw3_ipt_rule *r, const char *fmt, ...)
        struct xtables_target *et;
        struct xtables_globals *g;
        struct ipt_entry *e;
-       struct ip6t_entry *e6;
 
        int i, optc;
        bool inv = false;
@@ -1177,7 +1170,7 @@ fw3_ipt_rule_append(struct fw3_ipt_rule *r, const char *fmt, ...)
                        if (!em)
                        {
                                fprintf(stderr, "fw3_ipt_rule_append(): Can't find match '%s'\n", optarg);
-                               return;
+                               goto free;
                        }
 
                        init_match(r, em, true);
@@ -1189,7 +1182,7 @@ fw3_ipt_rule_append(struct fw3_ipt_rule *r, const char *fmt, ...)
                        if (!et)
                        {
                                fprintf(stderr, "fw3_ipt_rule_append(): Can't find target '%s'\n", optarg);
-                               return;
+                               goto free;
                        }
 
                        break;
@@ -1222,8 +1215,11 @@ fw3_ipt_rule_append(struct fw3_ipt_rule *r, const char *fmt, ...)
        if (fw3_pr_debug)
                rule_print(r, buf);
 
+#ifndef DISABLE_IPV6
        if (r->h->family == FW3_FAMILY_V6)
        {
+               struct ip6t_entry *e6;
+
                s = XT_ALIGN(sizeof(struct ip6t_entry));
 
                for (m = r->matches; m; m = m->next)
@@ -1249,6 +1245,7 @@ fw3_ipt_rule_append(struct fw3_ipt_rule *r, const char *fmt, ...)
                free(e6);
        }
        else
+#endif
        {
                s = XT_ALIGN(sizeof(struct ipt_entry));
 
@@ -1278,6 +1275,7 @@ fw3_ipt_rule_append(struct fw3_ipt_rule *r, const char *fmt, ...)
                free(e);
        }
 
+free:
        for (i = 1; i < r->argc; i++)
                free(r->argv[i]);
 
@@ -1285,7 +1283,9 @@ fw3_ipt_rule_append(struct fw3_ipt_rule *r, const char *fmt, ...)
 
        xtables_rule_matches_free(&r->matches);
 
-       free(r->target->t);
+       if (r->target)
+               free(r->target->t);
+
        free(r);
 
        /* reset all targets and matches */