1 /* Library which manipulates firewall rules. Version 0.1. */ 2 3 /* Architecture of firewall rules is as follows: 4 * 5 * Chains go INPUT, FORWARD, OUTPUT then user chains. 6 * Each user chain starts with an ERROR node. 7 * Every chain ends with an unconditional jump: a RETURN for user chains, 8 * and a POLICY for built-ins. 9 */ 10 11 /* (C)1999 Paul ``Rusty'' Russell - Placed under the GNU GPL (See 12 COPYING for details). */ 13 14 #include <assert.h> 15 #include <string.h> 16 #include <errno.h> 17 #include <stdlib.h> 18 #include <stdio.h> 19 #include <unistd.h> 20 #include <arpa/inet.h> 21 22 #ifdef DEBUG_CONNTRACK 23 #define inline 24 #endif 25 26 #if !defined(__GLIBC__) || (__GLIBC__ < 2) 27 typedef unsigned int socklen_t; 28 #endif 29 30 #include "libiptc/libip6tc.h" 31 32 #define HOOK_PRE_ROUTING NF_IP6_PRE_ROUTING 33 #define HOOK_LOCAL_IN NF_IP6_LOCAL_IN 34 #define HOOK_FORWARD NF_IP6_FORWARD 35 #define HOOK_LOCAL_OUT NF_IP6_LOCAL_OUT 36 #define HOOK_POST_ROUTING NF_IP6_POST_ROUTING 37 38 #define STRUCT_ENTRY_TARGET struct ip6t_entry_target 39 #define STRUCT_ENTRY struct ip6t_entry 40 #define STRUCT_ENTRY_MATCH struct ip6t_entry_match 41 #define STRUCT_GETINFO struct ip6t_getinfo 42 #define STRUCT_GET_ENTRIES struct ip6t_get_entries 43 #define STRUCT_COUNTERS struct ip6t_counters 44 #define STRUCT_COUNTERS_INFO struct ip6t_counters_info 45 #define STRUCT_STANDARD_TARGET struct ip6t_standard_target 46 #define STRUCT_REPLACE struct ip6t_replace 47 48 #define STRUCT_TC_HANDLE struct ip6tc_handle 49 #define TC_HANDLE_T ip6tc_handle_t 50 51 #define ENTRY_ITERATE IP6T_ENTRY_ITERATE 52 #define TABLE_MAXNAMELEN IP6T_TABLE_MAXNAMELEN 53 #define FUNCTION_MAXNAMELEN IP6T_FUNCTION_MAXNAMELEN 54 55 #define GET_TARGET ip6t_get_target 56 57 #define ERROR_TARGET IP6T_ERROR_TARGET 58 #define NUMHOOKS NF_IP6_NUMHOOKS 59 60 #define IPT_CHAINLABEL ip6t_chainlabel 61 62 #define TC_DUMP_ENTRIES dump_entries6 63 #define TC_IS_CHAIN ip6tc_is_chain 64 #define TC_FIRST_CHAIN ip6tc_first_chain 65 #define TC_NEXT_CHAIN ip6tc_next_chain 66 #define TC_FIRST_RULE ip6tc_first_rule 67 #define TC_NEXT_RULE ip6tc_next_rule 68 #define TC_GET_TARGET ip6tc_get_target 69 #define TC_BUILTIN ip6tc_builtin 70 #define TC_GET_POLICY ip6tc_get_policy 71 #define TC_INSERT_ENTRY ip6tc_insert_entry 72 #define TC_REPLACE_ENTRY ip6tc_replace_entry 73 #define TC_APPEND_ENTRY ip6tc_append_entry 74 #define TC_DELETE_ENTRY ip6tc_delete_entry 75 #define TC_DELETE_NUM_ENTRY ip6tc_delete_num_entry 76 #define TC_CHECK_PACKET ip6tc_check_packet 77 #define TC_FLUSH_ENTRIES ip6tc_flush_entries 78 #define TC_ZERO_ENTRIES ip6tc_zero_entries 79 #define TC_ZERO_COUNTER ip6tc_zero_counter 80 #define TC_READ_COUNTER ip6tc_read_counter 81 #define TC_SET_COUNTER ip6tc_set_counter 82 #define TC_CREATE_CHAIN ip6tc_create_chain 83 #define TC_GET_REFERENCES ip6tc_get_references 84 #define TC_DELETE_CHAIN ip6tc_delete_chain 85 #define TC_RENAME_CHAIN ip6tc_rename_chain 86 #define TC_SET_POLICY ip6tc_set_policy 87 #define TC_GET_RAW_SOCKET ip6tc_get_raw_socket 88 #define TC_INIT ip6tc_init 89 #define TC_FREE ip6tc_free 90 #define TC_COMMIT ip6tc_commit 91 #define TC_STRERROR ip6tc_strerror 92 #define TC_NUM_RULES ip6tc_num_rules 93 #define TC_GET_RULE ip6tc_get_rule 94 95 #define TC_AF AF_INET6 96 #define TC_IPPROTO IPPROTO_IPV6 97 98 #define SO_SET_REPLACE IP6T_SO_SET_REPLACE 99 #define SO_SET_ADD_COUNTERS IP6T_SO_SET_ADD_COUNTERS 100 #define SO_GET_INFO IP6T_SO_GET_INFO 101 #define SO_GET_ENTRIES IP6T_SO_GET_ENTRIES 102 #define SO_GET_VERSION IP6T_SO_GET_VERSION 103 104 #define STANDARD_TARGET IP6T_STANDARD_TARGET 105 #define LABEL_RETURN IP6TC_LABEL_RETURN 106 #define LABEL_ACCEPT IP6TC_LABEL_ACCEPT 107 #define LABEL_DROP IP6TC_LABEL_DROP 108 #define LABEL_QUEUE IP6TC_LABEL_QUEUE 109 110 #define ALIGN IP6T_ALIGN 111 #define RETURN IP6T_RETURN 112 113 #include "libiptc.c" 114 115 #define BIT6(a, l) \ 116 ((ntohl(a->in6_u.u6_addr32[(l) / 32]) >> (31 - ((l) & 31))) & 1) 117 118 int 119 ipv6_prefix_length(const struct in6_addr *a) 120 { 121 int l, i; 122 for (l = 0; l < 128; l++) { 123 if (BIT6(a, l) == 0) 124 break; 125 } 126 for (i = l + 1; i < 128; i++) { 127 if (BIT6(a, i) == 1) 128 return -1; 129 } 130 return l; 131 } 132 133 static int 134 dump_entry(struct ip6t_entry *e, const ip6tc_handle_t handle) 135 { 136 size_t i; 137 char buf[40]; 138 int len; 139 struct ip6t_entry_target *t; 140 141 printf("Entry %u (%lu):\n", iptcb_entry2index(handle, e), 142 iptcb_entry2offset(handle, e)); 143 puts("SRC IP: "); 144 inet_ntop(AF_INET6, &e->ipv6.src, buf, sizeof buf); 145 puts(buf); 146 putchar('/'); 147 len = ipv6_prefix_length(&e->ipv6.smsk); 148 if (len != -1) 149 printf("%d", len); 150 else { 151 inet_ntop(AF_INET6, &e->ipv6.smsk, buf, sizeof buf); 152 puts(buf); 153 } 154 putchar('\n'); 155 156 puts("DST IP: "); 157 inet_ntop(AF_INET6, &e->ipv6.dst, buf, sizeof buf); 158 puts(buf); 159 putchar('/'); 160 len = ipv6_prefix_length(&e->ipv6.dmsk); 161 if (len != -1) 162 printf("%d", len); 163 else { 164 inet_ntop(AF_INET6, &e->ipv6.dmsk, buf, sizeof buf); 165 puts(buf); 166 } 167 putchar('\n'); 168 169 printf("Interface: `%s'/", e->ipv6.iniface); 170 for (i = 0; i < IFNAMSIZ; i++) 171 printf("%c", e->ipv6.iniface_mask[i] ? 'X' : '.'); 172 printf("to `%s'/", e->ipv6.outiface); 173 for (i = 0; i < IFNAMSIZ; i++) 174 printf("%c", e->ipv6.outiface_mask[i] ? 'X' : '.'); 175 printf("\nProtocol: %u\n", e->ipv6.proto); 176 if (e->ipv6.flags & IP6T_F_TOS) 177 printf("TOS: %u\n", e->ipv6.tos); 178 printf("Flags: %02X\n", e->ipv6.flags); 179 printf("Invflags: %02X\n", e->ipv6.invflags); 180 printf("Counters: %llu packets, %llu bytes\n", 181 (unsigned long long)e->counters.pcnt, (unsigned long long)e->counters.bcnt); 182 printf("Cache: %08X ", e->nfcache); 183 if (e->nfcache & NFC_ALTERED) printf("ALTERED "); 184 if (e->nfcache & NFC_UNKNOWN) printf("UNKNOWN "); 185 printf("\n"); 186 187 IP6T_MATCH_ITERATE(e, print_match); 188 189 t = ip6t_get_target(e); 190 printf("Target name: `%s' [%u]\n", t->u.user.name, t->u.target_size); 191 if (strcmp(t->u.user.name, IP6T_STANDARD_TARGET) == 0) { 192 int pos = *(int *)t->data; 193 if (pos < 0) 194 printf("verdict=%s\n", 195 pos == -NF_ACCEPT-1 ? "NF_ACCEPT" 196 : pos == -NF_DROP-1 ? "NF_DROP" 197 : pos == IP6T_RETURN ? "RETURN" 198 : "UNKNOWN"); 199 else 200 printf("verdict=%u\n", pos); 201 } else if (strcmp(t->u.user.name, IP6T_ERROR_TARGET) == 0) 202 printf("error=`%s'\n", t->data); 203 204 printf("\n"); 205 return 0; 206 } 207 208 static unsigned char * 209 is_same(const STRUCT_ENTRY *a, const STRUCT_ENTRY *b, 210 unsigned char *matchmask) 211 { 212 unsigned int i; 213 unsigned char *mptr; 214 215 /* Always compare head structures: ignore mask here. */ 216 if (memcmp(&a->ipv6.src, &b->ipv6.src, sizeof(struct in6_addr)) 217 || memcmp(&a->ipv6.dst, &b->ipv6.dst, sizeof(struct in6_addr)) 218 || memcmp(&a->ipv6.smsk, &b->ipv6.smsk, sizeof(struct in6_addr)) 219 || memcmp(&a->ipv6.dmsk, &b->ipv6.dmsk, sizeof(struct in6_addr)) 220 || a->ipv6.proto != b->ipv6.proto 221 || a->ipv6.tos != b->ipv6.tos 222 || a->ipv6.flags != b->ipv6.flags 223 || a->ipv6.invflags != b->ipv6.invflags) 224 return NULL; 225 226 for (i = 0; i < IFNAMSIZ; i++) { 227 if (a->ipv6.iniface_mask[i] != b->ipv6.iniface_mask[i]) 228 return NULL; 229 if ((a->ipv6.iniface[i] & a->ipv6.iniface_mask[i]) 230 != (b->ipv6.iniface[i] & b->ipv6.iniface_mask[i])) 231 return NULL; 232 if (a->ipv6.outiface_mask[i] != b->ipv6.outiface_mask[i]) 233 return NULL; 234 if ((a->ipv6.outiface[i] & a->ipv6.outiface_mask[i]) 235 != (b->ipv6.outiface[i] & b->ipv6.outiface_mask[i])) 236 return NULL; 237 } 238 239 if (a->nfcache != b->nfcache 240 || a->target_offset != b->target_offset 241 || a->next_offset != b->next_offset) 242 return NULL; 243 244 mptr = matchmask + sizeof(STRUCT_ENTRY); 245 if (IP6T_MATCH_ITERATE(a, match_different, a->elems, b->elems, &mptr)) 246 return NULL; 247 mptr += IP6T_ALIGN(sizeof(struct ip6t_entry_target)); 248 249 return mptr; 250 } 251 252 /* All zeroes == unconditional rule. */ 253 static inline int 254 unconditional(const struct ip6t_ip6 *ipv6) 255 { 256 unsigned int i; 257 258 for (i = 0; i < sizeof(*ipv6); i++) 259 if (((char *)ipv6)[i]) 260 break; 261 262 return (i == sizeof(*ipv6)); 263 } 264 265 #ifdef IPTC_DEBUG 266 /* Do every conceivable sanity check on the handle */ 267 static void 268 do_check(TC_HANDLE_T h, unsigned int line) 269 { 270 unsigned int i, n; 271 unsigned int user_offset; /* Offset of first user chain */ 272 int was_return; 273 274 assert(h->changed == 0 || h->changed == 1); 275 if (strcmp(h->info.name, "filter") == 0) { 276 assert(h->info.valid_hooks 277 == (1 << NF_IP6_LOCAL_IN 278 | 1 << NF_IP6_FORWARD 279 | 1 << NF_IP6_LOCAL_OUT)); 280 281 /* Hooks should be first three */ 282 assert(h->info.hook_entry[NF_IP6_LOCAL_IN] == 0); 283 284 n = get_chain_end(h, 0); 285 n += get_entry(h, n)->next_offset; 286 assert(h->info.hook_entry[NF_IP6_FORWARD] == n); 287 288 n = get_chain_end(h, n); 289 n += get_entry(h, n)->next_offset; 290 assert(h->info.hook_entry[NF_IP6_LOCAL_OUT] == n); 291 292 user_offset = h->info.hook_entry[NF_IP6_LOCAL_OUT]; 293 } else if (strcmp(h->info.name, "nat") == 0) { 294 assert((h->info.valid_hooks 295 == (1 << NF_IP6_PRE_ROUTING 296 | 1 << NF_IP6_LOCAL_OUT 297 | 1 << NF_IP6_POST_ROUTING)) || 298 (h->info.valid_hooks 299 == (1 << NF_IP6_PRE_ROUTING 300 | 1 << NF_IP6_LOCAL_IN 301 | 1 << NF_IP6_LOCAL_OUT 302 | 1 << NF_IP6_POST_ROUTING))); 303 304 assert(h->info.hook_entry[NF_IP6_PRE_ROUTING] == 0); 305 306 n = get_chain_end(h, 0); 307 308 n += get_entry(h, n)->next_offset; 309 assert(h->info.hook_entry[NF_IP6_POST_ROUTING] == n); 310 n = get_chain_end(h, n); 311 312 n += get_entry(h, n)->next_offset; 313 assert(h->info.hook_entry[NF_IP6_LOCAL_OUT] == n); 314 user_offset = h->info.hook_entry[NF_IP6_LOCAL_OUT]; 315 316 if (h->info.valid_hooks & (1 << NF_IP6_LOCAL_IN)) { 317 n = get_chain_end(h, n); 318 n += get_entry(h, n)->next_offset; 319 assert(h->info.hook_entry[NF_IP6_LOCAL_IN] == n); 320 user_offset = h->info.hook_entry[NF_IP6_LOCAL_IN]; 321 } 322 323 } else if (strcmp(h->info.name, "mangle") == 0) { 324 /* This code is getting ugly because linux < 2.4.18-pre6 had 325 * two mangle hooks, linux >= 2.4.18-pre6 has five mangle hooks 326 * */ 327 assert((h->info.valid_hooks 328 == (1 << NF_IP6_PRE_ROUTING 329 | 1 << NF_IP6_LOCAL_OUT)) || 330 (h->info.valid_hooks 331 == (1 << NF_IP6_PRE_ROUTING 332 | 1 << NF_IP6_LOCAL_IN 333 | 1 << NF_IP6_FORWARD 334 | 1 << NF_IP6_LOCAL_OUT 335 | 1 << NF_IP6_POST_ROUTING))); 336 337 /* Hooks should be first five */ 338 assert(h->info.hook_entry[NF_IP6_PRE_ROUTING] == 0); 339 340 n = get_chain_end(h, 0); 341 342 if (h->info.valid_hooks & (1 << NF_IP6_LOCAL_IN)) { 343 n += get_entry(h, n)->next_offset; 344 assert(h->info.hook_entry[NF_IP6_LOCAL_IN] == n); 345 n = get_chain_end(h, n); 346 } 347 348 if (h->info.valid_hooks & (1 << NF_IP6_FORWARD)) { 349 n += get_entry(h, n)->next_offset; 350 assert(h->info.hook_entry[NF_IP6_FORWARD] == n); 351 n = get_chain_end(h, n); 352 } 353 354 n += get_entry(h, n)->next_offset; 355 assert(h->info.hook_entry[NF_IP6_LOCAL_OUT] == n); 356 user_offset = h->info.hook_entry[NF_IP6_LOCAL_OUT]; 357 358 if (h->info.valid_hooks & (1 << NF_IP6_POST_ROUTING)) { 359 n = get_chain_end(h, n); 360 n += get_entry(h, n)->next_offset; 361 assert(h->info.hook_entry[NF_IP6_POST_ROUTING] == n); 362 user_offset = h->info.hook_entry[NF_IP6_POST_ROUTING]; 363 } 364 } else if (strcmp(h->info.name, "raw") == 0) { 365 assert(h->info.valid_hooks 366 == (1 << NF_IP6_PRE_ROUTING 367 | 1 << NF_IP6_LOCAL_OUT)); 368 369 /* Hooks should be first three */ 370 assert(h->info.hook_entry[NF_IP6_PRE_ROUTING] == 0); 371 372 n = get_chain_end(h, n); 373 n += get_entry(h, n)->next_offset; 374 assert(h->info.hook_entry[NF_IP6_LOCAL_OUT] == n); 375 376 user_offset = h->info.hook_entry[NF_IP6_LOCAL_OUT]; 377 } else { 378 fprintf(stderr, "Unknown table `%s'\n", h->info.name); 379 abort(); 380 } 381 382 /* User chain == end of last builtin + policy entry */ 383 user_offset = get_chain_end(h, user_offset); 384 user_offset += get_entry(h, user_offset)->next_offset; 385 386 /* Overflows should be end of entry chains, and unconditional 387 policy nodes. */ 388 for (i = 0; i < NUMHOOKS; i++) { 389 STRUCT_ENTRY *e; 390 STRUCT_STANDARD_TARGET *t; 391 392 if (!(h->info.valid_hooks & (1 << i))) 393 continue; 394 assert(h->info.underflow[i] 395 == get_chain_end(h, h->info.hook_entry[i])); 396 397 e = get_entry(h, get_chain_end(h, h->info.hook_entry[i])); 398 assert(unconditional(&e->ipv6)); 399 assert(e->target_offset == sizeof(*e)); 400 t = (STRUCT_STANDARD_TARGET *)GET_TARGET(e); 401 printf("target_size=%u, align=%u\n", 402 t->target.u.target_size, ALIGN(sizeof(*t))); 403 assert(t->target.u.target_size == ALIGN(sizeof(*t))); 404 assert(e->next_offset == sizeof(*e) + ALIGN(sizeof(*t))); 405 406 assert(strcmp(t->target.u.user.name, STANDARD_TARGET)==0); 407 assert(t->verdict == -NF_DROP-1 || t->verdict == -NF_ACCEPT-1); 408 409 /* Hooks and underflows must be valid entries */ 410 iptcb_entry2index(h, get_entry(h, h->info.hook_entry[i])); 411 iptcb_entry2index(h, get_entry(h, h->info.underflow[i])); 412 } 413 414 assert(h->info.size 415 >= h->info.num_entries * (sizeof(STRUCT_ENTRY) 416 +sizeof(STRUCT_STANDARD_TARGET))); 417 418 assert(h->entries.size 419 >= (h->new_number 420 * (sizeof(STRUCT_ENTRY) 421 + sizeof(STRUCT_STANDARD_TARGET)))); 422 assert(strcmp(h->info.name, h->entries.name) == 0); 423 424 i = 0; n = 0; 425 was_return = 0; 426 427 #if 0 428 /* Check all the entries. */ 429 ENTRY_ITERATE(h->entries.entrytable, h->entries.size, 430 check_entry, &i, &n, user_offset, &was_return, h); 431 432 assert(i == h->new_number); 433 assert(n == h->entries.size); 434 435 /* Final entry must be error node */ 436 assert(strcmp(GET_TARGET(index2entry(h, h->new_number-1)) 437 ->u.user.name, 438 ERROR_TARGET) == 0); 439 #endif 440 } 441 #endif /*IPTC_DEBUG*/ 442
