X-Git-Url: http://git.archive.openwrt.org/?p=project%2Ffirewall3.git;a=blobdiff_plain;f=iptables.c;h=10bfea5e084333cf7b2db28ebda23acaa1c0dc2e;hp=ca847617a3e897ae856b899637ed2ff4e6ca89b3;hb=0a7d36d8cf56f160b531f3db9f045e3f9315dd15;hpb=165029cb8c0f1545628f44143aec965e64cef021 diff --git a/iptables.c b/iptables.c index ca84761..10bfea5 100644 --- a/iptables.c +++ b/iptables.c @@ -1,7 +1,7 @@ /* * firewall3 - 3rd OpenWrt UCI firewall implementation * - * Copyright (C) 2013 Jo-Philipp Wich + * Copyright (C) 2013 Jo-Philipp Wich * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -16,9 +16,62 @@ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ +#define _GNU_SOURCE /* RTLD_NEXT */ + +/* include userspace headers */ +#include +#include +#include +#include +#include +#include +#include + +/* prevent indirect inclusion of kernel headers */ +#define _LINUX_IF_H +#define _LINUX_IN_H +#define _LINUX_IN6_H + +/* prevent libiptc from including kernel headers */ +#define _FWCHAINS_KERNEL_HEADERS_H + +/* finally include libiptc and xtables */ +#include +#include +#include + +#include "options.h" + +/* xtables interface */ +#if (XTABLES_VERSION_CODE >= 10) +# include "xtables-10.h" +#elif (XTABLES_VERSION_CODE == 5) +# include "xtables-5.h" +#else +# error "Unsupported xtables version" +#endif + #include "iptables.h" +struct fw3_ipt_rule { + struct fw3_ipt_handle *h; + + union { + struct ipt_entry e; + struct ip6t_entry e6; + }; + + struct xtables_rule_match *matches; + struct xtables_target *target; + + int argc; + char **argv; + + uint32_t protocol; + bool protocol_loaded; +}; + static struct option base_opts[] = { { .name = "match", .has_arg = 1, .val = 'm' }, { .name = "jump", .has_arg = 1, .val = 'j' }, @@ -29,14 +82,30 @@ static struct xtables_globals xtg = { .option_offset = 0, .program_version = "4", .orig_opts = base_opts, +#if XTABLES_VERSION_CODE > 10 + .compat_rev = xtables_compatible_revision, +#endif }; static struct xtables_globals xtg6 = { .option_offset = 0, .program_version = "6", .orig_opts = base_opts, +#if XTABLES_VERSION_CODE > 10 + .compat_rev = xtables_compatible_revision, +#endif }; +static struct { + bool retain; + int mcount, tcount; + struct xtables_match **matches; + struct xtables_target **targets; + void (*register_match)(struct xtables_match *); + void (*register_target)(struct xtables_target *); +} xext; + + /* Required by certain extensions like SNAT and DNAT */ int kernel_version = 0; @@ -53,27 +122,20 @@ get_kernel_version(void) kernel_version = 0x10000 * x + 0x100 * y + z; } -#ifdef DISABLE_IPV6 -#undef __ipt_module -#define __ipt_module(x) libxt_##x##_init, libipt_##x##_init, -#else -#undef __ipt_module -#define __ipt_module(x) libxt_##x##_init, libipt_##x##_init, libip6t_##x##_init, -#endif - static void fw3_init_extensions(void) { - int i; - void (*initfuncs[])(void) = { FW3_IPT_MODULES }; + init_extensions(); + init_extensions4(); - for (i = 0; i < sizeof(initfuncs)/sizeof(initfuncs[0]); i++) - if (initfuncs[i]) - initfuncs[i](); +#ifndef DISABLE_IPV6 + init_extensions6(); +#endif } struct fw3_ipt_handle * fw3_ipt_open(enum fw3_family family, enum fw3_table table) { + int i; struct fw3_ipt_handle *h; h = fw3_alloc(sizeof(*h)); @@ -110,6 +172,14 @@ fw3_ipt_open(enum fw3_family family, enum fw3_table table) fw3_xt_reset(); fw3_init_extensions(); + if (xext.register_match) + for (i = 0; i < xext.mcount; i++) + xext.register_match(xext.matches[i]); + + if (xext.register_target) + for (i = 0; i < xext.tcount; i++) + xext.register_target(xext.targets[i]); + return h; } @@ -241,6 +311,86 @@ fw3_ipt_delete_chain(struct fw3_ipt_handle *h, const char *chain) iptc_delete_chain(chain, h->handle); } +static bool +has_rule_tag(const void *base, unsigned int start, unsigned int end) +{ + unsigned int i; + const struct xt_entry_match *em; + + for (i = start; i < end; i += em->u.match_size) + { + em = base + i; + + if (strcmp(em->u.user.name, "comment")) + continue; + + if (!memcmp(em->data, "!fw3", 4)) + return true; + } + + return false; +} + +void +fw3_ipt_delete_id_rules(struct fw3_ipt_handle *h, const char *chain) +{ + unsigned int num; + const struct ipt_entry *e; + bool found; + +#ifndef DISABLE_IPV6 + if (h->family == FW3_FAMILY_V6) + { + if (!ip6tc_is_chain(chain, h->handle)) + return; + + do { + found = false; + + const struct ip6t_entry *e6; + for (num = 0, e6 = ip6tc_first_rule(chain, h->handle); + e6 != NULL; + num++, e6 = ip6tc_next_rule(e6, h->handle)) + { + if (has_rule_tag(e6, sizeof(*e6), e6->target_offset)) + { + if (fw3_pr_debug) + debug(h, "-D %s %u\n", chain, num + 1); + + ip6tc_delete_num_entry(chain, num, h->handle); + found = true; + break; + } + } + } while (found); + } + else +#endif + { + if (!iptc_is_chain(chain, h->handle)) + return; + + do { + found = false; + + for (num = 0, e = iptc_first_rule(chain, h->handle); + e != NULL; + num++, e = iptc_next_rule(e, h->handle)) + { + if (has_rule_tag(e, sizeof(*e), e->target_offset)) + { + if (fw3_pr_debug) + debug(h, "-D %s %u\n", chain, num + 1); + + iptc_delete_num_entry(chain, num, h->handle); + found = true; + break; + } + } + } while (found); + } +} + void fw3_ipt_create_chain(struct fw3_ipt_handle *h, const char *fmt, ...) { @@ -298,6 +448,69 @@ fw3_ipt_flush(struct fw3_ipt_handle *h) } } +static bool +chain_is_empty(struct fw3_ipt_handle *h, const char *chain) +{ +#ifndef DISABLE_IPV6 + if (h->family == FW3_FAMILY_V6) + return (!ip6tc_builtin(chain, h->handle) && + !ip6tc_first_rule(chain, h->handle)); +#endif + + return (!iptc_builtin(chain, h->handle) && + !iptc_first_rule(chain, h->handle)); +} + +void +fw3_ipt_gc(struct fw3_ipt_handle *h) +{ + const char *chain; + bool found; + +#ifndef DISABLE_IPV6 + if (h->family == FW3_FAMILY_V6) + { + do { + found = false; + + for (chain = ip6tc_first_chain(h->handle); + chain != NULL; + chain = ip6tc_next_chain(h->handle)) + { + if (!chain_is_empty(h, chain)) + continue; + + fw3_ipt_delete_chain(h, chain); + found = true; + break; + } + } while(found); + } + else +#endif + { + do { + found = false; + + for (chain = iptc_first_chain(h->handle); + chain != NULL; + chain = iptc_next_chain(h->handle)) + { + warn("C=%s\n", chain); + + if (!chain_is_empty(h, chain)) + continue; + + warn("D=%s\n", chain); + + fw3_ipt_delete_chain(h, chain); + found = true; + break; + } + } while (found); + } +} + void fw3_ipt_commit(struct fw3_ipt_handle *h) { @@ -322,17 +535,6 @@ fw3_ipt_commit(struct fw3_ipt_handle *h) void fw3_ipt_close(struct fw3_ipt_handle *h) { - if (h->libv) - { - while (h->libc > 0) - { - h->libc--; - dlclose(h->libv[h->libc]); - } - - free(h->libv); - } - free(h); } @@ -375,43 +577,14 @@ get_protoname(struct fw3_ipt_rule *r) return NULL; } -static bool -load_extension(struct fw3_ipt_handle *h, const char *name) -{ - char path[256]; - void *lib, **tmp; - const char *pfx = (h->family == FW3_FAMILY_V6) ? "libip6t" : "libipt"; - - snprintf(path, sizeof(path), "/usr/lib/iptables/libxt_%s.so", name); - if (!(lib = dlopen(path, RTLD_NOW))) - { - snprintf(path, sizeof(path), "/usr/lib/iptables/%s_%s.so", pfx, name); - lib = dlopen(path, RTLD_NOW); - } - - if (!lib) - return false; - - tmp = realloc(h->libv, sizeof(lib) * (h->libc + 1)); - - if (!tmp) - return false; - - h->libv = tmp; - h->libv[h->libc++] = lib; - - return true; -} - static struct xtables_match * find_match(struct fw3_ipt_rule *r, const char *name) { struct xtables_match *m; - m = xtables_find_match(name, XTF_DONT_LOAD, &r->matches); - - if (!m && load_extension(r->h, name)) - m = xtables_find_match(name, XTF_DONT_LOAD, &r->matches); + xext.retain = true; + m = xtables_find_match(name, XTF_TRY_LOAD, &r->matches); + xext.retain = false; return m; } @@ -477,13 +650,14 @@ find_target(struct fw3_ipt_rule *r, const char *name) { struct xtables_target *t; - if (is_chain(r->h, name)) - return xtables_find_target(XT_STANDARD_TARGET, XTF_LOAD_MUST_SUCCEED); + xext.retain = true; - t = xtables_find_target(name, XTF_DONT_LOAD); + if (is_chain(r->h, name)) + t = xtables_find_target(XT_STANDARD_TARGET, XTF_TRY_LOAD); + else + t = xtables_find_target(name, XTF_TRY_LOAD); - if (!t && load_extension(r->h, name)) - t = xtables_find_target(name, XTF_DONT_LOAD); + xext.retain = false; return t; } @@ -845,8 +1019,8 @@ fw3_ipt_rule_time(struct fw3_ipt_rule *r, struct fw3_time *time) fw3_ipt_rule_addarg(r, false, "-m", "time"); - if (time->utc) - fw3_ipt_rule_addarg(r, false, "--utc", NULL); + if (!time->utc) + fw3_ipt_rule_addarg(r, false, "--kerneltz", NULL); if (d1) { @@ -884,7 +1058,7 @@ fw3_ipt_rule_time(struct fw3_ipt_rule *r, struct fw3_time *time) { for (i = 1, p = buf; i < 32; i++) { - if (hasbit(time->monthdays, i)) + if (fw3_hasbit(time->monthdays, i)) { if (p > buf) *p++ = ','; @@ -893,14 +1067,14 @@ fw3_ipt_rule_time(struct fw3_ipt_rule *r, struct fw3_time *time) } } - fw3_ipt_rule_addarg(r, hasbit(time->monthdays, 0), "--monthdays", buf); + fw3_ipt_rule_addarg(r, fw3_hasbit(time->monthdays, 0), "--monthdays", buf); } if (time->weekdays & 0xFE) { for (i = 1, p = buf; i < 8; i++) { - if (hasbit(time->weekdays, i)) + if (fw3_hasbit(time->weekdays, i)) { if (p > buf) *p++ = ','; @@ -909,7 +1083,7 @@ fw3_ipt_rule_time(struct fw3_ipt_rule *r, struct fw3_time *time) } } - fw3_ipt_rule_addarg(r, hasbit(time->weekdays, 0), "--weekdays", buf); + fw3_ipt_rule_addarg(r, fw3_hasbit(time->weekdays, 0), "--weekdays", buf); } } @@ -980,7 +1154,7 @@ rule_print6(struct ip6t_entry *e) if (e->ipv6.flags & IP6T_F_PROTO) { - if (e->ipv6.flags & XT_INV_PROTO) + if (e->ipv6.invflags & XT_INV_PROTO) printf(" !"); pname = get_protoname(container_of(e, struct fw3_ipt_rule, e6)); @@ -993,7 +1167,7 @@ rule_print6(struct ip6t_entry *e) if (e->ipv6.iniface[0]) { - if (e->ipv6.flags & IP6T_INV_VIA_IN) + if (e->ipv6.invflags & IP6T_INV_VIA_IN) printf(" !"); printf(" -i %s", e->ipv6.iniface); @@ -1001,7 +1175,7 @@ rule_print6(struct ip6t_entry *e) if (e->ipv6.outiface[0]) { - if (e->ipv6.flags & IP6T_INV_VIA_OUT) + if (e->ipv6.invflags & IP6T_INV_VIA_OUT) printf(" !"); printf(" -o %s", e->ipv6.outiface); @@ -1009,7 +1183,7 @@ rule_print6(struct ip6t_entry *e) if (memcmp(&e->ipv6.src, &in6addr_any, sizeof(struct in6_addr))) { - if (e->ipv6.flags & IP6T_INV_SRCIP) + if (e->ipv6.invflags & IP6T_INV_SRCIP) printf(" !"); printf(" -s %s/%s", @@ -1019,7 +1193,7 @@ rule_print6(struct ip6t_entry *e) if (memcmp(&e->ipv6.dst, &in6addr_any, sizeof(struct in6_addr))) { - if (e->ipv6.flags & IP6T_INV_DSTIP) + if (e->ipv6.invflags & IP6T_INV_DSTIP) printf(" !"); printf(" -d %s/%s", @@ -1038,7 +1212,7 @@ rule_print4(struct ipt_entry *e) if (e->ip.proto) { - if (e->ip.flags & XT_INV_PROTO) + if (e->ip.invflags & XT_INV_PROTO) printf(" !"); pname = get_protoname(container_of(e, struct fw3_ipt_rule, e)); @@ -1051,7 +1225,7 @@ rule_print4(struct ipt_entry *e) if (e->ip.iniface[0]) { - if (e->ip.flags & IPT_INV_VIA_IN) + if (e->ip.invflags & IPT_INV_VIA_IN) printf(" !"); printf(" -i %s", e->ip.iniface); @@ -1059,7 +1233,7 @@ rule_print4(struct ipt_entry *e) if (e->ip.outiface[0]) { - if (e->ip.flags & IPT_INV_VIA_OUT) + if (e->ip.invflags & IPT_INV_VIA_OUT) printf(" !"); printf(" -o %s", e->ip.outiface); @@ -1067,7 +1241,7 @@ rule_print4(struct ipt_entry *e) if (memcmp(&e->ip.src, &in_zero, sizeof(struct in_addr))) { - if (e->ip.flags & IPT_INV_SRCIP) + if (e->ip.invflags & IPT_INV_SRCIP) printf(" !"); printf(" -s %s/%s", @@ -1077,7 +1251,7 @@ rule_print4(struct ipt_entry *e) if (memcmp(&e->ip.dst, &in_zero, sizeof(struct in_addr))) { - if (e->ip.flags & IPT_INV_DSTIP) + if (e->ip.invflags & IPT_INV_DSTIP) printf(" !"); printf(" -d %s/%s", @@ -1311,6 +1485,34 @@ rule_build(struct fw3_ipt_rule *r) } } +static void +set_rule_tag(struct fw3_ipt_rule *r) +{ + int i; + char *p, **tmp; + const char *tag = "!fw3"; + + for (i = 0; i < r->argc; i++) + if (!strcmp(r->argv[i], "--comment") && (i + 1) < r->argc) + if (asprintf(&p, "%s: %s", tag, r->argv[i + 1]) > 0) + { + free(r->argv[i + 1]); + r->argv[i + 1] = p; + return; + } + + tmp = realloc(r->argv, (r->argc + 4) * sizeof(*r->argv)); + + if (tmp) + { + r->argv = tmp; + r->argv[r->argc++] = fw3_strdup("-m"); + r->argv[r->argc++] = fw3_strdup("comment"); + r->argv[r->argc++] = fw3_strdup("--comment"); + r->argv[r->argc++] = fw3_strdup(tag); + } +} + void __fw3_ipt_rule_append(struct fw3_ipt_rule *r, bool repl, const char *fmt, ...) { @@ -1337,6 +1539,8 @@ __fw3_ipt_rule_append(struct fw3_ipt_rule *r, bool repl, const char *fmt, ...) optind = 0; opterr = 0; + set_rule_tag(r); + while ((optc = getopt_long(r->argc, r->argv, "-:m:j:", g->opts, NULL)) != -1) { @@ -1477,3 +1681,63 @@ fw3_ipt_rule_create(struct fw3_ipt_handle *handle, struct fw3_protocol *proto, return r; } + +void +xtables_register_match(struct xtables_match *me) +{ + int i; + static struct xtables_match **tmp; + + if (!xext.register_match) + xext.register_match = dlsym(RTLD_NEXT, "xtables_register_match"); + + if (!xext.register_match) + return; + + xext.register_match(me); + + if (xext.retain) + { + for (i = 0; i < xext.mcount; i++) + if (xext.matches[i] == me) + return; + + tmp = realloc(xext.matches, sizeof(me) * (xext.mcount + 1)); + + if (!tmp) + return; + + xext.matches = tmp; + xext.matches[xext.mcount++] = me; + } +} + +void +xtables_register_target(struct xtables_target *me) +{ + int i; + static struct xtables_target **tmp; + + if (!xext.register_target) + xext.register_target = dlsym(RTLD_NEXT, "xtables_register_target"); + + if (!xext.register_target) + return; + + xext.register_target(me); + + if (xext.retain) + { + for (i = 0; i < xext.tcount; i++) + if (xext.targets[i] == me) + return; + + tmp = realloc(xext.targets, sizeof(me) * (xext.tcount + 1)); + + if (!tmp) + return; + + xext.targets = tmp; + xext.targets[xext.tcount++] = me; + } +}