X-Git-Url: http://git.archive.openwrt.org/?p=project%2Ffirewall3.git;a=blobdiff_plain;f=iptables.c;h=58ec752af8df55e68f0cc1fd3215f412dd7c781c;hp=87673ef01aa2f8273fb3d9063bb44643dda9b67a;hb=94e7253a1166c1a03061c12e7e469433111f8f6f;hpb=e7b6234df3d34d82b909f1e7367a89d322f87814 diff --git a/iptables.c b/iptables.c index 87673ef..58ec752 100644 --- a/iptables.c +++ b/iptables.c @@ -22,7 +22,6 @@ static struct option base_opts[] = { { .name = "match", .has_arg = 1, .val = 'm' }, { .name = "jump", .has_arg = 1, .val = 'j' }, - { .name = "append", .has_arg = 1, .val = 'A' }, { NULL } }; @@ -143,30 +142,21 @@ fw3_ipt_set_policy(struct fw3_ipt_handle *h, const char *chain, } void -fw3_ipt_delete_chain(struct fw3_ipt_handle *h, const char *chain) +fw3_ipt_flush_chain(struct fw3_ipt_handle *h, const char *chain) { if (fw3_pr_debug) - { debug(h, "-F %s\n", chain); - debug(h, "-X %s\n", chain); - } #ifndef DISABLE_IPV6 if (h->family == FW3_FAMILY_V6) - { - if (ip6tc_flush_entries(chain, h->handle)) - ip6tc_delete_chain(chain, h->handle); - } + ip6tc_flush_entries(chain, h->handle); else #endif - { - if (iptc_flush_entries(chain, h->handle)) - iptc_delete_chain(chain, h->handle); - } + iptc_flush_entries(chain, h->handle); } -void -fw3_ipt_delete_rules(struct fw3_ipt_handle *h, const char *target) +static void +delete_rules(struct fw3_ipt_handle *h, const char *target) { unsigned int num; const struct ipt_entry *e; @@ -236,6 +226,22 @@ fw3_ipt_delete_rules(struct fw3_ipt_handle *h, const char *target) } void +fw3_ipt_delete_chain(struct fw3_ipt_handle *h, const char *chain) +{ + delete_rules(h, chain); + + if (fw3_pr_debug) + debug(h, "-X %s\n", chain); + +#ifndef DISABLE_IPV6 + if (h->family == FW3_FAMILY_V6) + ip6tc_delete_chain(chain, h->handle); + else +#endif + iptc_delete_chain(chain, h->handle); +} + +void fw3_ipt_create_chain(struct fw3_ipt_handle *h, const char *fmt, ...) { char buf[32]; @@ -302,14 +308,14 @@ fw3_ipt_commit(struct fw3_ipt_handle *h) { rv = ip6tc_commit(h->handle); if (!rv) - fprintf(stderr, "ip6tc_commit(): %s\n", ip6tc_strerror(errno)); + warn("ip6tc_commit(): %s", ip6tc_strerror(errno)); } else #endif { rv = iptc_commit(h->handle); if (!rv) - fprintf(stderr, "iptc_commit(): %s\n", iptc_strerror(errno)); + warn("iptc_commit(): %s", iptc_strerror(errno)); } } @@ -603,7 +609,10 @@ fw3_ipt_rule_in_out(struct fw3_ipt_rule *r, static void ip4prefix2mask(int prefix, struct in_addr *mask) { - mask->s_addr = htonl(~((1 << (32 - prefix)) - 1)); + if (prefix > 0) + mask->s_addr = htonl(~((1 << (32 - prefix)) - 1)); + else + mask->s_addr = 0; } #ifndef DISABLE_IPV6 @@ -735,13 +744,29 @@ fw3_ipt_rule_sport_dport(struct fw3_ipt_rule *r, } void +fw3_ipt_rule_device(struct fw3_ipt_rule *r, const char *device, bool out) +{ + if (device) { + struct fw3_device dev = { .any = false }; + strncpy(dev.name, device, sizeof(dev.name) - 1); + fw3_ipt_rule_in_out(r, (out) ? NULL : &dev, (out) ? &dev : NULL); + } +} + +void fw3_ipt_rule_mac(struct fw3_ipt_rule *r, struct fw3_mac *mac) { + char buf[sizeof("ff:ff:ff:ff:ff:ff\0")]; + uint8_t *addr = mac->mac.ether_addr_octet; + if (!mac) return; + sprintf(buf, "%02x:%02x:%02x:%02x:%02x:%02x", + addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]); + fw3_ipt_rule_addarg(r, false, "-m", "mac"); - fw3_ipt_rule_addarg(r, mac->invert, "--mac-source", ether_ntoa(&mac->mac)); + fw3_ipt_rule_addarg(r, mac->invert, "--mac-source", buf); } void @@ -795,29 +820,35 @@ fw3_ipt_rule_limit(struct fw3_ipt_rule *r, struct fw3_limit *limit) } void -fw3_ipt_rule_ipset(struct fw3_ipt_rule *r, struct fw3_ipset *ipset, - bool invert) +fw3_ipt_rule_ipset(struct fw3_ipt_rule *r, struct fw3_setmatch *match) { char buf[sizeof("dst,dst,dst\0")]; char *p = buf; + int i = 0; + struct fw3_ipset *set; struct fw3_ipset_datatype *type; - if (!ipset) + if (!match || !match->set || !match->ptr) return; - list_for_each_entry(type, &ipset->datatypes, list) + set = match->ptr; + list_for_each_entry(type, &set->datatypes, list) { + if (i >= 3) + break; + if (p > buf) *p++ = ','; - p += sprintf(p, "%s", type->dest ? "dst" : "src"); + p += sprintf(p, "%s", match->dir[i] ? match->dir[i] : type->dir); + i++; } fw3_ipt_rule_addarg(r, false, "-m", "set"); - fw3_ipt_rule_addarg(r, invert, "--match-set", - ipset->external ? ipset->external : ipset->name); + fw3_ipt_rule_addarg(r, match->invert, "--match-set", + set->external ? set->external : set->name); fw3_ipt_rule_addarg(r, false, buf, NULL); } @@ -1080,9 +1111,9 @@ rule_print4(struct ipt_entry *e) } static void -rule_print(struct fw3_ipt_rule *r, const char *chain) +rule_print(struct fw3_ipt_rule *r, const char *prefix, const char *chain) { - debug(r->h, "-A %s", chain); + debug(r->h, "%s %s", prefix, chain); #ifndef DISABLE_IPV6 if (r->h->family == FW3_FAMILY_V6) @@ -1140,12 +1171,10 @@ parse_option(struct fw3_ipt_rule *r, int optc, bool inv) } if (optc == ':') - fprintf(stderr, "parse_option(): option '%s' needs argument\n", - r->argv[optind-1]); + warn("parse_option(): option '%s' needs argument", r->argv[optind-1]); if (optc == '?') - fprintf(stderr, "parse_option(): unknown option '%s'\n", - r->argv[optind-1]); + warn("parse_option(): unknown option '%s'", r->argv[optind-1]); return false; } @@ -1177,15 +1206,139 @@ fw3_ipt_rule_addarg(struct fw3_ipt_rule *r, bool inv, r->argv[r->argc++] = fw3_strdup(v); } -void -fw3_ipt_rule_append(struct fw3_ipt_rule *r, const char *fmt, ...) +static unsigned char * +rule_mask(struct fw3_ipt_rule *r) +{ + size_t s; + unsigned char *p, *mask = NULL; + struct xtables_rule_match *m; + +#define SZ(x) XT_ALIGN(sizeof(struct x)) + +#ifndef DISABLE_IPV6 + if (r->h->family == FW3_FAMILY_V6) + { + s = SZ(ip6t_entry); + + for (m = r->matches; m; m = m->next) + s += SZ(ip6t_entry_match) + m->match->size; + + s += SZ(ip6t_entry_target) + r->target->size; + + mask = fw3_alloc(s); + memset(mask, 0xFF, SZ(ip6t_entry)); + p = mask + SZ(ip6t_entry); + + for (m = r->matches; m; m = m->next) + { + memset(p, 0xFF, SZ(ip6t_entry_match) + m->match->userspacesize); + p += SZ(ip6t_entry_match) + m->match->size; + } + + memset(p, 0xFF, SZ(ip6t_entry_target) + r->target->userspacesize); + } + else +#endif + { + s = SZ(ipt_entry); + + for (m = r->matches; m; m = m->next) + s += SZ(ipt_entry_match) + m->match->size; + + s += SZ(ipt_entry_target) + r->target->size; + + mask = fw3_alloc(s); + memset(mask, 0xFF, SZ(ipt_entry)); + p = mask + SZ(ipt_entry); + + for (m = r->matches; m; m = m->next) + { + memset(p, 0xFF, SZ(ipt_entry_match) + m->match->userspacesize); + p += SZ(ipt_entry_match) + m->match->size; + } + + memset(p, 0xFF, SZ(ipt_entry_target) + r->target->userspacesize); + } + + return mask; +} + +static void * +rule_build(struct fw3_ipt_rule *r) { size_t s; struct xtables_rule_match *m; + +#ifndef DISABLE_IPV6 + if (r->h->family == FW3_FAMILY_V6) + { + struct ip6t_entry *e6; + + s = XT_ALIGN(sizeof(struct ip6t_entry)); + + for (m = r->matches; m; m = m->next) + s += m->match->m->u.match_size; + + e6 = fw3_alloc(s + r->target->t->u.target_size); + + memcpy(e6, &r->e6, sizeof(struct ip6t_entry)); + + e6->target_offset = s; + e6->next_offset = s + r->target->t->u.target_size; + + s = 0; + + for (m = r->matches; m; m = m->next) + { + memcpy(e6->elems + s, m->match->m, m->match->m->u.match_size); + s += m->match->m->u.match_size; + } + + memcpy(e6->elems + s, r->target->t, r->target->t->u.target_size); + + return e6; + } + else +#endif + { + struct ipt_entry *e; + + s = XT_ALIGN(sizeof(struct ipt_entry)); + + for (m = r->matches; m; m = m->next) + s += m->match->m->u.match_size; + + e = fw3_alloc(s + r->target->t->u.target_size); + + memcpy(e, &r->e, sizeof(struct ipt_entry)); + + e->target_offset = s; + e->next_offset = s + r->target->t->u.target_size; + + s = 0; + + for (m = r->matches; m; m = m->next) + { + memcpy(e->elems + s, m->match->m, m->match->m->u.match_size); + s += m->match->m->u.match_size; + } + + memcpy(e->elems + s, r->target->t, r->target->t->u.target_size); + + return e; + } +} + +void +__fw3_ipt_rule_append(struct fw3_ipt_rule *r, bool repl, const char *fmt, ...) +{ + void *rule; + unsigned char *mask; + + struct xtables_rule_match *m; struct xtables_match *em; struct xtables_target *et; struct xtables_globals *g; - struct ipt_entry *e; int i, optc; bool inv = false; @@ -1202,7 +1355,8 @@ fw3_ipt_rule_append(struct fw3_ipt_rule *r, const char *fmt, ...) optind = 0; opterr = 0; - while ((optc = getopt_long(r->argc, r->argv, "m:j:", g->opts, NULL)) != -1) + while ((optc = getopt_long(r->argc, r->argv, "-:m:j:", g->opts, + NULL)) != -1) { switch (optc) { @@ -1211,7 +1365,7 @@ fw3_ipt_rule_append(struct fw3_ipt_rule *r, const char *fmt, ...) if (!em) { - fprintf(stderr, "fw3_ipt_rule_append(): Can't find match '%s'\n", optarg); + warn("fw3_ipt_rule_append(): Can't find match '%s'", optarg); goto free; } @@ -1223,7 +1377,7 @@ fw3_ipt_rule_append(struct fw3_ipt_rule *r, const char *fmt, ...) if (!et) { - fprintf(stderr, "fw3_ipt_rule_append(): Can't find target '%s'\n", optarg); + warn("fw3_ipt_rule_append(): Can't find target '%s'", optarg); goto free; } @@ -1232,12 +1386,13 @@ fw3_ipt_rule_append(struct fw3_ipt_rule *r, const char *fmt, ...) case 1: if ((optarg[0] == '!') && (optarg[1] == '\0')) { + optarg[0] = '\0'; inv = true; continue; } - fprintf(stderr, "fw3_ipt_rule_append(): Bad argument '%s'\n", optarg); - return; + warn("fw3_ipt_rule_append(): Bad argument '%s'", optarg); + goto free; default: if (parse_option(r, optc, inv)) @@ -1254,69 +1409,51 @@ fw3_ipt_rule_append(struct fw3_ipt_rule *r, const char *fmt, ...) if (r->target) xtables_option_tfcall(r->target); - if (fw3_pr_debug) - rule_print(r, buf); + rule = rule_build(r); #ifndef DISABLE_IPV6 if (r->h->family == FW3_FAMILY_V6) { - struct ip6t_entry *e6; - - s = XT_ALIGN(sizeof(struct ip6t_entry)); - - for (m = r->matches; m; m = m->next) - s += m->match->m->u.match_size; - - e6 = fw3_alloc(s + r->target->t->u.target_size); - - memcpy(e6, &r->e6, sizeof(struct ip6t_entry)); - - e6->target_offset = s; - e6->next_offset = s + r->target->t->u.target_size; + if (repl) + { + mask = rule_mask(r); - s = 0; + while (ip6tc_delete_entry(buf, rule, mask, r->h->handle)) + if (fw3_pr_debug) + rule_print(r, "-D", buf); - for (m = r->matches; m; m = m->next) - { - memcpy(e6->elems + s, m->match->m, m->match->m->u.match_size); - s += m->match->m->u.match_size; + free(mask); } - memcpy(e6->elems + s, r->target->t, r->target->t->u.target_size); - ip6tc_append_entry(buf, e6, r->h->handle); - free(e6); + if (fw3_pr_debug) + rule_print(r, "-A", buf); + + if (!ip6tc_append_entry(buf, rule, r->h->handle)) + warn("ip6tc_append_entry(): %s", ip6tc_strerror(errno)); } else #endif { - s = XT_ALIGN(sizeof(struct ipt_entry)); - - for (m = r->matches; m; m = m->next) - s += m->match->m->u.match_size; - - e = fw3_alloc(s + r->target->t->u.target_size); - - memcpy(e, &r->e, sizeof(struct ipt_entry)); - - e->target_offset = s; - e->next_offset = s + r->target->t->u.target_size; + if (repl) + { + mask = rule_mask(r); - s = 0; + while (iptc_delete_entry(buf, rule, mask, r->h->handle)) + if (fw3_pr_debug) + rule_print(r, "-D", buf); - for (m = r->matches; m; m = m->next) - { - memcpy(e->elems + s, m->match->m, m->match->m->u.match_size); - s += m->match->m->u.match_size; + free(mask); } - memcpy(e->elems + s, r->target->t, r->target->t->u.target_size); + if (fw3_pr_debug) + rule_print(r, "-A", buf); - if (!iptc_append_entry(buf, e, r->h->handle)) - fprintf(stderr, "iptc_append_entry(): %s\n", iptc_strerror(errno)); - - free(e); + if (!iptc_append_entry(buf, rule, r->h->handle)) + warn("iptc_append_entry(): %s\n", iptc_strerror(errno)); } + free(rule); + free: for (i = 1; i < r->argc; i++) free(r->argv[i]);