iptables: remove usage of xt_id

Instead of relying on the nonstandard xt_id match, use the xt_comment match
to tag own rules. Any rule with a comment starting with "!fw3" is considered
to be firewall3 internal.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

diff --git a/iptables.c b/iptables.c
index b574f8d..ccfd29c 100644 (file)
--- a/iptables.c
+++ b/iptables.c
@@ -258,10 +258,9 @@ fw3_ipt_delete_chain(struct fw3_ipt_handle *h, const char *chain)
                iptc_delete_chain(chain, h->handle);
 }
 
-static int
-get_rule_id(const void *base, unsigned int start, unsigned int end)
+static bool
+has_rule_tag(const void *base, unsigned int start, unsigned int end)
 {
-       uint32_t id;
        unsigned int i;
        const struct xt_entry_match *em;
 
@@ -269,18 +268,14 @@ get_rule_id(const void *base, unsigned int start, unsigned int end)
        {
                em = base + i;
 
-               if (strcmp(em->u.user.name, "id"))
-                       continue;
-
-               memcpy(&id, em->data, sizeof(id));
-
-               if ((id & FW3_ID_MASK) != FW3_ID_MAGIC)
+               if (strcmp(em->u.user.name, "comment"))
                        continue;
 
-               return (id & ~FW3_ID_MASK);
+               if (!memcmp(em->data, "!fw3", 4))
+                       return true;
        }
 
-       return -1;
+       return false;
 }
 
 void
@@ -289,7 +284,6 @@ fw3_ipt_delete_id_rules(struct fw3_ipt_handle *h, const char *chain)
        unsigned int num;
        const struct ipt_entry *e;
        bool found;
-       int id;
 
 #ifndef DISABLE_IPV6
        if (h->family == FW3_FAMILY_V6)
@@ -305,9 +299,7 @@ fw3_ipt_delete_id_rules(struct fw3_ipt_handle *h, const char *chain)
                                 e6 != NULL;
                                 num++, e6 = ip6tc_next_rule(e6, h->handle))
                        {
-                               id = get_rule_id(e6, sizeof(*e6), e6->target_offset);
-
-                               if (id >= 0)
+                               if (has_rule_tag(e6, sizeof(*e6), e6->target_offset))
                                {
                                        if (fw3_pr_debug)
                                                debug(h, "-D %s %u\n", chain, num + 1);
@@ -332,9 +324,7 @@ fw3_ipt_delete_id_rules(struct fw3_ipt_handle *h, const char *chain)
                                 e != NULL;
                                 num++, e = iptc_next_rule(e, h->handle))
                        {
-                               id = get_rule_id(e, sizeof(*e), e->target_offset);
-
-                               if (id >= 0)
+                               if (has_rule_tag(e, sizeof(*e), e->target_offset))
                                {
                                        if (fw3_pr_debug)
                                                debug(h, "-D %s %u\n", chain, num + 1);
@@ -503,7 +493,6 @@ fw3_ipt_rule_new(struct fw3_ipt_handle *h)
        r = fw3_alloc(sizeof(*r));
 
        r->h = h;
-       r->id = 0;
        r->argv = fw3_alloc(sizeof(char *));
        r->argv[r->argc++] = "fw3";
 
@@ -1443,6 +1432,34 @@ rule_build(struct fw3_ipt_rule *r)
        }
 }
 
+static void
+set_rule_tag(struct fw3_ipt_rule *r)
+{
+       int i;
+       char *p, **tmp;
+       const char *tag = "!fw3";
+
+       for (i = 0; i < r->argc; i++)
+               if (!strcmp(r->argv[i], "--comment") && (i + 1) < r->argc)
+                       if (asprintf(&p, "%s: %s", tag, r->argv[i + 1]) > 0)
+                       {
+                               free(r->argv[i + 1]);
+                               r->argv[i + 1] = p;
+                               return;
+                       }
+
+       tmp = realloc(r->argv, (r->argc + 4) * sizeof(*r->argv));
+
+       if (tmp)
+       {
+               r->argv = tmp;
+               r->argv[r->argc++] = fw3_strdup("-m");
+               r->argv[r->argc++] = fw3_strdup("comment");
+               r->argv[r->argc++] = fw3_strdup("--comment");
+               r->argv[r->argc++] = fw3_strdup(tag);
+       }
+}
+
 void
 __fw3_ipt_rule_append(struct fw3_ipt_rule *r, bool repl, const char *fmt, ...)
 {
@@ -1455,7 +1472,6 @@ __fw3_ipt_rule_append(struct fw3_ipt_rule *r, bool repl, const char *fmt, ...)
        struct xtables_globals *g;
 
        int i, optc;
-       uint32_t id;
        bool inv = false;
        char buf[32];
        va_list ap;
@@ -1470,23 +1486,7 @@ __fw3_ipt_rule_append(struct fw3_ipt_rule *r, bool repl, const char *fmt, ...)
        optind = 0;
        opterr = 0;
 
-       if (r->id >= 0)
-       {
-               em = find_match(r, "id");
-
-               if (!em)
-               {
-                       warn("fw3_ipt_rule_append(): Can't find match '%s'", "id");
-                       goto free;
-               }
-
-               init_match(r, em, true);
-
-               id = FW3_ID_MAGIC | (r->id & ~FW3_ID_MASK);
-               memcpy(em->m->data, &id, sizeof(id));
-
-               em->mflags = 1;
-       }
+       set_rule_tag(r);
 
        while ((optc = getopt_long(r->argc, r->argv, "-:m:j:", g->opts,
                                   NULL)) != -1)

diff --git a/iptables.h b/iptables.h
index 1d98b76..a2c733d 100644 (file)
--- a/iptables.h
+++ b/iptables.h
@@ -32,9 +32,6 @@
 
 #include "options.h"
 
-#define FW3_ID_MAGIC   0x66773300      /* 'f' 'w' '3' */
-#define FW3_ID_MASK            0xffffff00
-
 /* xtables interface */
 #if (XTABLES_VERSION_CODE == 10 || XTABLES_VERSION_CODE == 11)
 # include "xtables-10.h"
@@ -76,8 +73,6 @@ struct fw3_ipt_rule {
        struct xtables_rule_match *matches;
        struct xtables_target *target;
 
-       int id;
-
        int argc;
        char **argv;