1 /* Library which manipulates firewall rules. Version $Revision: 6665 $ */ 2 3 /* Architecture of firewall rules is as follows: 4 * 5 * Chains go INPUT, FORWARD, OUTPUT then user chains. 6 * Each user chain starts with an ERROR node. 7 * Every chain ends with an unconditional jump: a RETURN for user chains, 8 * and a POLICY for built-ins. 9 */ 10 11 /* (C) 1999 Paul ``Rusty'' Russell - Placed under the GNU GPL (See 12 * COPYING for details). 13 * (C) 2000-2004 by the Netfilter Core Team <coreteam (at) netfilter.org> 14 * 15 * 2003-Jun-20: Harald Welte <laforge (at) netfilter.org>: 16 * - Reimplementation of chain cache to use offsets instead of entries 17 * 2003-Jun-23: Harald Welte <laforge (at) netfilter.org>: 18 * - performance optimization, sponsored by Astaro AG (http://www.astaro.com/) 19 * don't rebuild the chain cache after every operation, instead fix it 20 * up after a ruleset change. 21 * 2004-Aug-18: Harald Welte <laforge (at) netfilter.org>: 22 * - futher performance work: total reimplementation of libiptc. 23 * - libiptc now has a real internal (linked-list) represntation of the 24 * ruleset and a parser/compiler from/to this internal representation 25 * - again sponsored by Astaro AG (http://www.astaro.com/) 26 */ 27 #include <sys/types.h> 28 #include <sys/socket.h> 29 30 #include "linux_list.h" 31 32 //#define IPTC_DEBUG2 1 33 34 #ifdef IPTC_DEBUG2 35 #include <fcntl.h> 36 #define DEBUGP(x, args...) fprintf(stderr, "%s: " x, __FUNCTION__, ## args) 37 #define DEBUGP_C(x, args...) fprintf(stderr, x, ## args) 38 #else 39 #define DEBUGP(x, args...) 40 #define DEBUGP_C(x, args...) 41 #endif 42 43 #ifndef IPT_LIB_DIR 44 #define IPT_LIB_DIR "/usr/local/lib/iptables" 45 #endif 46 47 static int sockfd = -1; 48 static int sockfd_use = 0; 49 static void *iptc_fn = NULL; 50 51 static const char *hooknames[] 52 = { [HOOK_PRE_ROUTING] "PREROUTING", 53 [HOOK_LOCAL_IN] "INPUT", 54 [HOOK_FORWARD] "FORWARD", 55 [HOOK_LOCAL_OUT] "OUTPUT", 56 [HOOK_POST_ROUTING] "POSTROUTING", 57 #ifdef HOOK_DROPPING 58 [HOOK_DROPPING] "DROPPING" 59 #endif 60 }; 61 62 /* Convenience structures */ 63 struct ipt_error_target 64 { 65 STRUCT_ENTRY_TARGET t; 66 char error[TABLE_MAXNAMELEN]; 67 }; 68 69 struct chain_head; 70 struct rule_head; 71 72 struct counter_map 73 { 74 enum { 75 COUNTER_MAP_NOMAP, 76 COUNTER_MAP_NORMAL_MAP, 77 COUNTER_MAP_ZEROED, 78 COUNTER_MAP_SET 79 } maptype; 80 unsigned int mappos; 81 }; 82 83 enum iptcc_rule_type { 84 IPTCC_R_STANDARD, /* standard target (ACCEPT, ...) */ 85 IPTCC_R_MODULE, /* extension module (SNAT, ...) */ 86 IPTCC_R_FALLTHROUGH, /* fallthrough rule */ 87 IPTCC_R_JUMP, /* jump to other chain */ 88 }; 89 90 struct rule_head 91 { 92 struct list_head list; 93 struct chain_head *chain; 94 struct counter_map counter_map; 95 96 unsigned int index; /* index (needed for counter_map) */ 97 unsigned int offset; /* offset in rule blob */ 98 99 enum iptcc_rule_type type; 100 struct chain_head *jump; /* jump target, if IPTCC_R_JUMP */ 101 102 unsigned int size; /* size of entry data */ 103 STRUCT_ENTRY entry[0]; 104 }; 105 106 struct chain_head 107 { 108 struct list_head list; 109 char name[TABLE_MAXNAMELEN]; 110 unsigned int hooknum; /* hook number+1 if builtin */ 111 unsigned int references; /* how many jumps reference us */ 112 int verdict; /* verdict if builtin */ 113 114 STRUCT_COUNTERS counters; /* per-chain counters */ 115 struct counter_map counter_map; 116 117 unsigned int num_rules; /* number of rules in list */ 118 struct list_head rules; /* list of rules */ 119 120 unsigned int index; /* index (needed for jump resolval) */ 121 unsigned int head_offset; /* offset in rule blob */ 122 unsigned int foot_index; /* index (needed for counter_map) */ 123 unsigned int foot_offset; /* offset in rule blob */ 124 }; 125 126 STRUCT_TC_HANDLE 127 { 128 int changed; /* Have changes been made? */ 129 130 struct list_head chains; 131 132 struct chain_head *chain_iterator_cur; 133 struct rule_head *rule_iterator_cur; 134 135 STRUCT_GETINFO info; 136 STRUCT_GET_ENTRIES *entries; 137 }; 138 139 /* allocate a new chain head for the cache */ 140 static struct chain_head *iptcc_alloc_chain_head(const char *name, int hooknum) 141 { 142 struct chain_head *c = malloc(sizeof(*c)); 143 if (!c) 144 return NULL; 145 memset(c, 0, sizeof(*c)); 146 147 strncpy(c->name, name, TABLE_MAXNAMELEN); 148 c->hooknum = hooknum; 149 INIT_LIST_HEAD(&c->rules); 150 151 return c; 152 } 153 154 /* allocate and initialize a new rule for the cache */ 155 static struct rule_head *iptcc_alloc_rule(struct chain_head *c, unsigned int size) 156 { 157 struct rule_head *r = malloc(sizeof(*r)+size); 158 if (!r) 159 return NULL; 160 memset(r, 0, sizeof(*r)); 161 162 r->chain = c; 163 r->size = size; 164 165 return r; 166 } 167 168 /* notify us that the ruleset has been modified by the user */ 169 static void 170 set_changed(TC_HANDLE_T h) 171 { 172 h->changed = 1; 173 } 174 175 #ifdef IPTC_DEBUG 176 static void do_check(TC_HANDLE_T h, unsigned int line); 177 #define CHECK(h) do { if (!getenv("IPTC_NO_CHECK")) do_check((h), __LINE__); } while(0) 178 #else 179 #define CHECK(h) 180 #endif 181 182 183 /********************************************************************** 184 * iptc blob utility functions (iptcb_*) 185 **********************************************************************/ 186 187 static inline int 188 iptcb_get_number(const STRUCT_ENTRY *i, 189 const STRUCT_ENTRY *seek, 190 unsigned int *pos) 191 { 192 if (i == seek) 193 return 1; 194 (*pos)++; 195 return 0; 196 } 197 198 static inline int 199 iptcb_get_entry_n(STRUCT_ENTRY *i, 200 unsigned int number, 201 unsigned int *pos, 202 STRUCT_ENTRY **pe) 203 { 204 if (*pos == number) { 205 *pe = i; 206 return 1; 207 } 208 (*pos)++; 209 return 0; 210 } 211 212 static inline STRUCT_ENTRY * 213 iptcb_get_entry(TC_HANDLE_T h, unsigned int offset) 214 { 215 return (STRUCT_ENTRY *)((char *)h->entries->entrytable + offset); 216 } 217 218 static unsigned int 219 iptcb_entry2index(const TC_HANDLE_T h, const STRUCT_ENTRY *seek) 220 { 221 unsigned int pos = 0; 222 223 if (ENTRY_ITERATE(h->entries->entrytable, h->entries->size, 224 iptcb_get_number, seek, &pos) == 0) { 225 fprintf(stderr, "ERROR: offset %u not an entry!\n", 226 (unsigned int)((char *)seek - (char *)h->entries->entrytable)); 227 abort(); 228 } 229 return pos; 230 } 231 232 static inline STRUCT_ENTRY * 233 iptcb_offset2entry(TC_HANDLE_T h, unsigned int offset) 234 { 235 return (STRUCT_ENTRY *) ((void *)h->entries->entrytable+offset); 236 } 237 238 239 static inline unsigned long 240 iptcb_entry2offset(const TC_HANDLE_T h, const STRUCT_ENTRY *e) 241 { 242 return (void *)e - (void *)h->entries->entrytable; 243 } 244 245 static inline unsigned int 246 iptcb_offset2index(const TC_HANDLE_T h, unsigned int offset) 247 { 248 return iptcb_entry2index(h, iptcb_offset2entry(h, offset)); 249 } 250 251 /* Returns 0 if not hook entry, else hooknumber + 1 */ 252 static inline unsigned int 253 iptcb_ent_is_hook_entry(STRUCT_ENTRY *e, TC_HANDLE_T h) 254 { 255 unsigned int i; 256 257 for (i = 0; i < NUMHOOKS; i++) { 258 if ((h->info.valid_hooks & (1 << i)) 259 && iptcb_get_entry(h, h->info.hook_entry[i]) == e) 260 return i+1; 261 } 262 return 0; 263 } 264 265 266 /********************************************************************** 267 * iptc cache utility functions (iptcc_*) 268 **********************************************************************/ 269 270 /* Is the given chain builtin (1) or user-defined (0) */ 271 static unsigned int iptcc_is_builtin(struct chain_head *c) 272 { 273 return (c->hooknum ? 1 : 0); 274 } 275 276 /* Get a specific rule within a chain */ 277 static struct rule_head *iptcc_get_rule_num(struct chain_head *c, 278 unsigned int rulenum) 279 { 280 struct rule_head *r; 281 unsigned int num = 0; 282 283 list_for_each_entry(r, &c->rules, list) { 284 num++; 285 if (num == rulenum) 286 return r; 287 } 288 return NULL; 289 } 290 291 /* Get a specific rule within a chain backwards */ 292 static struct rule_head *iptcc_get_rule_num_reverse(struct chain_head *c, 293 unsigned int rulenum) 294 { 295 struct rule_head *r; 296 unsigned int num = 0; 297 298 list_for_each_entry_reverse(r, &c->rules, list) { 299 num++; 300 if (num == rulenum) 301 return r; 302 } 303 return NULL; 304 } 305 306 /* Returns chain head if found, otherwise NULL. */ 307 static struct chain_head * 308 iptcc_find_chain_by_offset(TC_HANDLE_T handle, unsigned int offset) 309 { 310 struct list_head *pos; 311 312 if (list_empty(&handle->chains)) 313 return NULL; 314 315 list_for_each(pos, &handle->chains) { 316 struct chain_head *c = list_entry(pos, struct chain_head, list); 317 if (offset >= c->head_offset && offset <= c->foot_offset) 318 return c; 319 } 320 321 return NULL; 322 } 323 /* Returns chain head if found, otherwise NULL. */ 324 static struct chain_head * 325 iptcc_find_label(const char *name, TC_HANDLE_T handle) 326 { 327 struct list_head *pos; 328 329 if (list_empty(&handle->chains)) 330 return NULL; 331 332 list_for_each(pos, &handle->chains) { 333 struct chain_head *c = list_entry(pos, struct chain_head, list); 334 if (!strcmp(c->name, name)) 335 return c; 336 } 337 338 return NULL; 339 } 340 341 /* called when rule is to be removed from cache */ 342 static void iptcc_delete_rule(struct rule_head *r) 343 { 344 DEBUGP("deleting rule %p (offset %u)\n", r, r->offset); 345 /* clean up reference count of called chain */ 346 if (r->type == IPTCC_R_JUMP 347 && r->jump) 348 r->jump->references--; 349 350 list_del(&r->list); 351 free(r); 352 } 353 354 355 /********************************************************************** 356 * RULESET PARSER (blob -> cache) 357 **********************************************************************/ 358 359 /* Delete policy rule of previous chain, since cache doesn't contain 360 * chain policy rules. 361 * WARNING: This function has ugly design and relies on a lot of context, only 362 * to be called from specific places within the parser */ 363 static int __iptcc_p_del_policy(TC_HANDLE_T h, unsigned int num) 364 { 365 if (h->chain_iterator_cur) { 366 /* policy rule is last rule */ 367 struct rule_head *pr = (struct rule_head *) 368 h->chain_iterator_cur->rules.prev; 369 370 /* save verdict */ 371 h->chain_iterator_cur->verdict = 372 *(int *)GET_TARGET(pr->entry)->data; 373 374 /* save counter and counter_map information */ 375 h->chain_iterator_cur->counter_map.maptype = 376 COUNTER_MAP_NORMAL_MAP; 377 h->chain_iterator_cur->counter_map.mappos = num-1; 378 memcpy(&h->chain_iterator_cur->counters, &pr->entry->counters, 379 sizeof(h->chain_iterator_cur->counters)); 380 381 /* foot_offset points to verdict rule */ 382 h->chain_iterator_cur->foot_index = num; 383 h->chain_iterator_cur->foot_offset = pr->offset; 384 385 /* delete rule from cache */ 386 iptcc_delete_rule(pr); 387 h->chain_iterator_cur->num_rules--; 388 389 return 1; 390 } 391 return 0; 392 } 393 394 /* alphabetically insert a chain into the list */ 395 static inline void iptc_insert_chain(TC_HANDLE_T h, struct chain_head *c) 396 { 397 struct chain_head *tmp; 398 399 /* sort only user defined chains */ 400 if (!c->hooknum) { 401 list_for_each_entry(tmp, &h->chains, list) { 402 if (!tmp->hooknum && strcmp(c->name, tmp->name) <= 0) { 403 list_add(&c->list, tmp->list.prev); 404 return; 405 } 406 } 407 } 408 409 /* survived till end of list: add at tail */ 410 list_add_tail(&c->list, &h->chains); 411 } 412 413 /* Another ugly helper function split out of cache_add_entry to make it less 414 * spaghetti code */ 415 static void __iptcc_p_add_chain(TC_HANDLE_T h, struct chain_head *c, 416 unsigned int offset, unsigned int *num) 417 { 418 __iptcc_p_del_policy(h, *num); 419 420 c->head_offset = offset; 421 c->index = *num; 422 423 iptc_insert_chain(h, c); 424 425 h->chain_iterator_cur = c; 426 } 427 428 /* main parser function: add an entry from the blob to the cache */ 429 static int cache_add_entry(STRUCT_ENTRY *e, 430 TC_HANDLE_T h, 431 STRUCT_ENTRY **prev, 432 unsigned int *num) 433 { 434 unsigned int builtin; 435 unsigned int offset = (char *)e - (char *)h->entries->entrytable; 436 437 DEBUGP("entering..."); 438 439 /* Last entry ("policy rule"). End it.*/ 440 if (iptcb_entry2offset(h,e) + e->next_offset == h->entries->size) { 441 /* This is the ERROR node at the end of the chain */ 442 DEBUGP_C("%u:%u: end of table:\n", *num, offset); 443 444 __iptcc_p_del_policy(h, *num); 445 446 h->chain_iterator_cur = NULL; 447 goto out_inc; 448 } 449 450 /* We know this is the start of a new chain if it's an ERROR 451 * target, or a hook entry point */ 452 453 if (strcmp(GET_TARGET(e)->u.user.name, ERROR_TARGET) == 0) { 454 struct chain_head *c = 455 iptcc_alloc_chain_head((const char *)GET_TARGET(e)->data, 0); 456 DEBUGP_C("%u:%u:new userdefined chain %s: %p\n", *num, offset, 457 (char *)c->name, c); 458 if (!c) { 459 errno = -ENOMEM; 460 return -1; 461 } 462 463 __iptcc_p_add_chain(h, c, offset, num); 464 465 } else if ((builtin = iptcb_ent_is_hook_entry(e, h)) != 0) { 466 struct chain_head *c = 467 iptcc_alloc_chain_head((char *)hooknames[builtin-1], 468 builtin); 469 DEBUGP_C("%u:%u new builtin chain: %p (rules=%p)\n", 470 *num, offset, c, &c->rules); 471 if (!c) { 472 errno = -ENOMEM; 473 return -1; 474 } 475 476 c->hooknum = builtin; 477 478 __iptcc_p_add_chain(h, c, offset, num); 479 480 /* FIXME: this is ugly. */ 481 goto new_rule; 482 } else { 483 /* has to be normal rule */ 484 struct rule_head *r; 485 new_rule: 486 487 if (!(r = iptcc_alloc_rule(h->chain_iterator_cur, 488 e->next_offset))) { 489 errno = ENOMEM; 490 return -1; 491 } 492 DEBUGP_C("%u:%u normal rule: %p: ", *num, offset, r); 493 494 r->index = *num; 495 r->offset = offset; 496 memcpy(r->entry, e, e->next_offset); 497 r->counter_map.maptype = COUNTER_MAP_NORMAL_MAP; 498 r->counter_map.mappos = r->index; 499 500 /* handling of jumps, etc. */ 501 if (!strcmp(GET_TARGET(e)->u.user.name, STANDARD_TARGET)) { 502 STRUCT_STANDARD_TARGET *t; 503 504 t = (STRUCT_STANDARD_TARGET *)GET_TARGET(e); 505 if (t->target.u.target_size 506 != ALIGN(sizeof(STRUCT_STANDARD_TARGET))) { 507 errno = EINVAL; 508 return -1; 509 } 510 511 if (t->verdict < 0) { 512 DEBUGP_C("standard, verdict=%d\n", t->verdict); 513 r->type = IPTCC_R_STANDARD; 514 } else if (t->verdict == r->offset+e->next_offset) { 515 DEBUGP_C("fallthrough\n"); 516 r->type = IPTCC_R_FALLTHROUGH; 517 } else { 518 DEBUGP_C("jump, target=%u\n", t->verdict); 519 r->type = IPTCC_R_JUMP; 520 /* Jump target fixup has to be deferred 521 * until second pass, since we migh not 522 * yet have parsed the target */ 523 } 524 } else { 525 DEBUGP_C("module, target=%s\n", GET_TARGET(e)->u.user.name); 526 r->type = IPTCC_R_MODULE; 527 } 528 529 list_add_tail(&r->list, &h->chain_iterator_cur->rules); 530 h->chain_iterator_cur->num_rules++; 531 } 532 out_inc: 533 (*num)++; 534 return 0; 535 } 536 537 538 /* parse an iptables blob into it's pieces */ 539 static int parse_table(TC_HANDLE_T h) 540 { 541 STRUCT_ENTRY *prev; 542 unsigned int num = 0; 543 struct chain_head *c; 544 545 /* First pass: over ruleset blob */ 546 ENTRY_ITERATE(h->entries->entrytable, h->entries->size, 547 cache_add_entry, h, &prev, &num); 548 549 /* Second pass: fixup parsed data from first pass */ 550 list_for_each_entry(c, &h->chains, list) { 551 struct rule_head *r; 552 list_for_each_entry(r, &c->rules, list) { 553 struct chain_head *c; 554 STRUCT_STANDARD_TARGET *t; 555 556 if (r->type != IPTCC_R_JUMP) 557 continue; 558 559 t = (STRUCT_STANDARD_TARGET *)GET_TARGET(r->entry); 560 c = iptcc_find_chain_by_offset(h, t->verdict); 561 if (!c) 562 return -1; 563 r->jump = c; 564 c->references++; 565 } 566 } 567 568 /* FIXME: sort chains */ 569 570 return 1; 571 } 572 573 574 /********************************************************************** 575 * RULESET COMPILATION (cache -> blob) 576 **********************************************************************/ 577 578 /* Convenience structures */ 579 struct iptcb_chain_start{ 580 STRUCT_ENTRY e; 581 struct ipt_error_target name; 582 }; 583 #define IPTCB_CHAIN_START_SIZE (sizeof(STRUCT_ENTRY) + \ 584 ALIGN(sizeof(struct ipt_error_target))) 585 586 struct iptcb_chain_foot { 587 STRUCT_ENTRY e; 588 STRUCT_STANDARD_TARGET target; 589 }; 590 #define IPTCB_CHAIN_FOOT_SIZE (sizeof(STRUCT_ENTRY) + \ 591 ALIGN(sizeof(STRUCT_STANDARD_TARGET))) 592 593 struct iptcb_chain_error { 594 STRUCT_ENTRY entry; 595 struct ipt_error_target target; 596 }; 597 #define IPTCB_CHAIN_ERROR_SIZE (sizeof(STRUCT_ENTRY) + \ 598 ALIGN(sizeof(struct ipt_error_target))) 599 600 601 602 /* compile rule from cache into blob */ 603 static inline int iptcc_compile_rule (TC_HANDLE_T h, STRUCT_REPLACE *repl, struct rule_head *r) 604 { 605 /* handle jumps */ 606 if (r->type == IPTCC_R_JUMP) { 607 STRUCT_STANDARD_TARGET *t; 608 t = (STRUCT_STANDARD_TARGET *)GET_TARGET(r->entry); 609 /* memset for memcmp convenience on delete/replace */ 610 memset(t->target.u.user.name, 0, FUNCTION_MAXNAMELEN); 611 strcpy(t->target.u.user.name, STANDARD_TARGET); 612 /* Jumps can only happen to builtin chains, so we 613 * can safely assume that they always have a header */ 614 t->verdict = r->jump->head_offset + IPTCB_CHAIN_START_SIZE; 615 } else if (r->type == IPTCC_R_FALLTHROUGH) { 616 STRUCT_STANDARD_TARGET *t; 617 t = (STRUCT_STANDARD_TARGET *)GET_TARGET(r->entry); 618 t->verdict = r->offset + r->size; 619 } 620 621 /* copy entry from cache to blob */ 622 memcpy((char *)repl->entries+r->offset, r->entry, r->size); 623 624 return 1; 625 } 626 627 /* compile chain from cache into blob */ 628 static int iptcc_compile_chain(TC_HANDLE_T h, STRUCT_REPLACE *repl, struct chain_head *c) 629 { 630 int ret; 631 struct rule_head *r; 632 struct iptcb_chain_start *head; 633 struct iptcb_chain_foot *foot; 634 635 /* only user-defined chains have heaer */ 636 if (!iptcc_is_builtin(c)) { 637 /* put chain header in place */ 638 head = (void *)repl->entries + c->head_offset; 639 head->e.target_offset = sizeof(STRUCT_ENTRY); 640 head->e.next_offset = IPTCB_CHAIN_START_SIZE; 641 strcpy(head->name.t.u.user.name, ERROR_TARGET); 642 head->name.t.u.target_size = 643 ALIGN(sizeof(struct ipt_error_target)); 644 strcpy(head->name.error, c->name); 645 } else { 646 repl->hook_entry[c->hooknum-1] = c->head_offset; 647 repl->underflow[c->hooknum-1] = c->foot_offset; 648 } 649 650 /* iterate over rules */ 651 list_for_each_entry(r, &c->rules, list) { 652 ret = iptcc_compile_rule(h, repl, r); 653 if (ret < 0) 654 return ret; 655 } 656 657 /* put chain footer in place */ 658 foot = (void *)repl->entries + c->foot_offset; 659 foot->e.target_offset = sizeof(STRUCT_ENTRY); 660 foot->e.next_offset = IPTCB_CHAIN_FOOT_SIZE; 661 strcpy(foot->target.target.u.user.name, STANDARD_TARGET); 662 foot->target.target.u.target_size = 663 ALIGN(sizeof(STRUCT_STANDARD_TARGET)); 664 /* builtin targets have verdict, others return */ 665 if (iptcc_is_builtin(c)) 666 foot->target.verdict = c->verdict; 667 else 668 foot->target.verdict = RETURN; 669 /* set policy-counters */ 670 memcpy(&foot->e.counters, &c->counters, sizeof(STRUCT_COUNTERS)); 671 672 return 0; 673 } 674 675 /* calculate offset and number for every rule in the cache */ 676 static int iptcc_compile_chain_offsets(TC_HANDLE_T h, struct chain_head *c, 677 unsigned int *offset, unsigned int *num) 678 { 679 struct rule_head *r; 680 681 c->head_offset = *offset; 682 DEBUGP("%s: chain_head %u, offset=%u\n", c->name, *num, *offset); 683 684 if (!iptcc_is_builtin(c)) { 685 /* Chain has header */ 686 *offset += sizeof(STRUCT_ENTRY) 687 + ALIGN(sizeof(struct ipt_error_target)); 688 (*num)++; 689 } 690 691 list_for_each_entry(r, &c->rules, list) { 692 DEBUGP("rule %u, offset=%u, index=%u\n", *num, *offset, *num); 693 r->offset = *offset; 694 r->index = *num; 695 *offset += r->size; 696 (*num)++; 697 } 698 699 DEBUGP("%s; chain_foot %u, offset=%u, index=%u\n", c->name, *num, 700 *offset, *num); 701 c->foot_offset = *offset; 702 c->foot_index = *num; 703 *offset += sizeof(STRUCT_ENTRY) 704 + ALIGN(sizeof(STRUCT_STANDARD_TARGET)); 705 (*num)++; 706 707 return 1; 708 } 709 710 /* put the pieces back together again */ 711 static int iptcc_compile_table_prep(TC_HANDLE_T h, unsigned int *size) 712 { 713 struct chain_head *c; 714 unsigned int offset = 0, num = 0; 715 int ret = 0; 716 717 /* First pass: calculate offset for every rule */ 718 list_for_each_entry(c, &h->chains, list) { 719 ret = iptcc_compile_chain_offsets(h, c, &offset, &num); 720 if (ret < 0) 721 return ret; 722 } 723 724 /* Append one error rule at end of chain */ 725 num++; 726 offset += sizeof(STRUCT_ENTRY) 727 + ALIGN(sizeof(struct ipt_error_target)); 728 729 /* ruleset size is now in offset */ 730 *size = offset; 731 return num; 732 } 733 734 static int iptcc_compile_table(TC_HANDLE_T h, STRUCT_REPLACE *repl) 735 { 736 struct chain_head *c; 737 struct iptcb_chain_error *error; 738 739 /* Second pass: copy from cache to offsets, fill in jumps */ 740 list_for_each_entry(c, &h->chains, list) { 741 int ret = iptcc_compile_chain(h, repl, c); 742 if (ret < 0) 743 return ret; 744 } 745 746 /* Append error rule at end of chain */ 747 error = (void *)repl->entries + repl->size - IPTCB_CHAIN_ERROR_SIZE; 748 error->entry.target_offset = sizeof(STRUCT_ENTRY); 749 error->entry.next_offset = IPTCB_CHAIN_ERROR_SIZE; 750 error->target.t.u.user.target_size = 751 ALIGN(sizeof(struct ipt_error_target)); 752 strcpy((char *)&error->target.t.u.user.name, ERROR_TARGET); 753 strcpy((char *)&error->target.error, "ERROR"); 754 755 return 1; 756 } 757 758 /********************************************************************** 759 * EXTERNAL API (operates on cache only) 760 **********************************************************************/ 761 762 /* Allocate handle of given size */ 763 static TC_HANDLE_T 764 alloc_handle(const char *tablename, unsigned int size, unsigned int num_rules) 765 { 766 size_t len; 767 TC_HANDLE_T h; 768 769 len = sizeof(STRUCT_TC_HANDLE) + size; 770 771 h = malloc(sizeof(STRUCT_TC_HANDLE)); 772 if (!h) { 773 errno = ENOMEM; 774 return NULL; 775 } 776 memset(h, 0, sizeof(*h)); 777 INIT_LIST_HEAD(&h->chains); 778 strcpy(h->info.name, tablename); 779 780 h->entries = malloc(sizeof(STRUCT_GET_ENTRIES) + size); 781 if (!h->entries) 782 goto out_free_handle; 783 784 strcpy(h->entries->name, tablename); 785 h->entries->size = size; 786 787 return h; 788 789 out_free_handle: 790 free(h); 791 792 return NULL; 793 } 794 795 796 TC_HANDLE_T 797 TC_INIT(const char *tablename) 798 { 799 TC_HANDLE_T h; 800 STRUCT_GETINFO info; 801 unsigned int tmp; 802 socklen_t s; 803 804 iptc_fn = TC_INIT; 805 806 if (strlen(tablename) >= TABLE_MAXNAMELEN) { 807 errno = EINVAL; 808 return NULL; 809 } 810 811 if (sockfd_use == 0) { 812 sockfd = socket(TC_AF, SOCK_RAW, IPPROTO_RAW); 813 if (sockfd < 0) 814 return NULL; 815 } 816 sockfd_use++; 817 818 s = sizeof(info); 819 820 strcpy(info.name, tablename); 821 if (getsockopt(sockfd, TC_IPPROTO, SO_GET_INFO, &info, &s) < 0) { 822 if (--sockfd_use == 0) { 823 close(sockfd); 824 sockfd = -1; 825 } 826 return NULL; 827 } 828 829 DEBUGP("valid_hooks=0x%08x, num_entries=%u, size=%u\n", 830 info.valid_hooks, info.num_entries, info.size); 831 832 if ((h = alloc_handle(info.name, info.size, info.num_entries)) 833 == NULL) { 834 if (--sockfd_use == 0) { 835 close(sockfd); 836 sockfd = -1; 837 } 838 return NULL; 839 } 840 841 /* Initialize current state */ 842 h->info = info; 843 844 h->entries->size = h->info.size; 845 846 tmp = sizeof(STRUCT_GET_ENTRIES) + h->info.size; 847 848 if (getsockopt(sockfd, TC_IPPROTO, SO_GET_ENTRIES, h->entries, 849 &tmp) < 0) 850 goto error; 851 852 #ifdef IPTC_DEBUG2 853 { 854 int fd = open("/tmp/libiptc-so_get_entries.blob", 855 O_CREAT|O_WRONLY); 856 if (fd >= 0) { 857 write(fd, h->entries, tmp); 858 close(fd); 859 } 860 } 861 #endif 862 863 if (parse_table(h) < 0) 864 goto error; 865 866 CHECK(h); 867 return h; 868 error: 869 if (--sockfd_use == 0) { 870 close(sockfd); 871 sockfd = -1; 872 } 873 TC_FREE(&h); 874 return NULL; 875 } 876 877 void 878 TC_FREE(TC_HANDLE_T *h) 879 { 880 struct chain_head *c, *tmp; 881 882 iptc_fn = TC_FREE; 883 if (--sockfd_use == 0) { 884 close(sockfd); 885 sockfd = -1; 886 } 887 888 list_for_each_entry_safe(c, tmp, &(*h)->chains, list) { 889 struct rule_head *r, *rtmp; 890 891 list_for_each_entry_safe(r, rtmp, &c->rules, list) { 892 free(r); 893 } 894 895 free(c); 896 } 897 898 free((*h)->entries); 899 free(*h); 900 901 *h = NULL; 902 } 903 904 static inline int 905 print_match(const STRUCT_ENTRY_MATCH *m) 906 { 907 printf("Match name: `%s'\n", m->u.user.name); 908 return 0; 909 } 910 911 static int dump_entry(STRUCT_ENTRY *e, const TC_HANDLE_T handle); 912 913 void 914 TC_DUMP_ENTRIES(const TC_HANDLE_T handle) 915 { 916 iptc_fn = TC_DUMP_ENTRIES; 917 CHECK(handle); 918 #if 0 919 printf("libiptc v%s. %u bytes.\n", 920 IPTABLES_VERSION, handle->entries->size); 921 printf("Table `%s'\n", handle->info.name); 922 printf("Hooks: pre/in/fwd/out/post = %u/%u/%u/%u/%u\n", 923 handle->info.hook_entry[HOOK_PRE_ROUTING], 924 handle->info.hook_entry[HOOK_LOCAL_IN], 925 handle->info.hook_entry[HOOK_FORWARD], 926 handle->info.hook_entry[HOOK_LOCAL_OUT], 927 handle->info.hook_entry[HOOK_POST_ROUTING]); 928 printf("Underflows: pre/in/fwd/out/post = %u/%u/%u/%u/%u\n", 929 handle->info.underflow[HOOK_PRE_ROUTING], 930 handle->info.underflow[HOOK_LOCAL_IN], 931 handle->info.underflow[HOOK_FORWARD], 932 handle->info.underflow[HOOK_LOCAL_OUT], 933 handle->info.underflow[HOOK_POST_ROUTING]); 934 935 ENTRY_ITERATE(handle->entries->entrytable, handle->entries->size, 936 dump_entry, handle); 937 #endif 938 } 939 940 /* Does this chain exist? */ 941 int TC_IS_CHAIN(const char *chain, const TC_HANDLE_T handle) 942 { 943 iptc_fn = TC_IS_CHAIN; 944 return iptcc_find_label(chain, handle) != NULL; 945 } 946 947 static void iptcc_chain_iterator_advance(TC_HANDLE_T handle) 948 { 949 struct chain_head *c = handle->chain_iterator_cur; 950 951 if (c->list.next == &handle->chains) 952 handle->chain_iterator_cur = NULL; 953 else 954 handle->chain_iterator_cur = 955 list_entry(c->list.next, struct chain_head, list); 956 } 957 958 /* Iterator functions to run through the chains. */ 959 const char * 960 TC_FIRST_CHAIN(TC_HANDLE_T *handle) 961 { 962 struct chain_head *c = list_entry((*handle)->chains.next, 963 struct chain_head, list); 964 965 iptc_fn = TC_FIRST_CHAIN; 966 967 968 if (list_empty(&(*handle)->chains)) { 969 DEBUGP(": no chains\n"); 970 return NULL; 971 } 972 973 (*handle)->chain_iterator_cur = c; 974 iptcc_chain_iterator_advance(*handle); 975 976 DEBUGP(": returning `%s'\n", c->name); 977 return c->name; 978 } 979 980 /* Iterator functions to run through the chains. Returns NULL at end. */ 981 const char * 982 TC_NEXT_CHAIN(TC_HANDLE_T *handle) 983 { 984 struct chain_head *c = (*handle)->chain_iterator_cur; 985 986 iptc_fn = TC_NEXT_CHAIN; 987 988 if (!c) { 989 DEBUGP(": no more chains\n"); 990 return NULL; 991 } 992 993 iptcc_chain_iterator_advance(*handle); 994 995 DEBUGP(": returning `%s'\n", c->name); 996 return c->name; 997 } 998 999 /* Get first rule in the given chain: NULL for empty chain. */ 1000 const STRUCT_ENTRY * 1001 TC_FIRST_RULE(const char *chain, TC_HANDLE_T *handle) 1002 { 1003 struct chain_head *c; 1004 struct rule_head *r; 1005 1006 iptc_fn = TC_FIRST_RULE; 1007 1008 DEBUGP("first rule(%s): ", chain); 1009 1010 c = iptcc_find_label(chain, *handle); 1011 if (!c) { 1012 errno = ENOENT; 1013 return NULL; 1014 } 1015 1016 /* Empty chain: single return/policy rule */ 1017 if (list_empty(&c->rules)) { 1018 DEBUGP_C("no rules, returning NULL\n"); 1019 return NULL; 1020 } 1021 1022 r = list_entry(c->rules.next, struct rule_head, list); 1023 (*handle)->rule_iterator_cur = r; 1024 DEBUGP_C("%p\n", r); 1025 1026 return r->entry; 1027 } 1028 1029 /* Returns NULL when rules run out. */ 1030 const STRUCT_ENTRY * 1031 TC_NEXT_RULE(const STRUCT_ENTRY *prev, TC_HANDLE_T *handle) 1032 { 1033 struct rule_head *r; 1034 1035 iptc_fn = TC_NEXT_RULE; 1036 DEBUGP("rule_iterator_cur=%p...", (*handle)->rule_iterator_cur); 1037 1038 if (!(*handle)->rule_iterator_cur) { 1039 DEBUGP_C("returning NULL\n"); 1040 return NULL; 1041 } 1042 1043 r = list_entry((*handle)->rule_iterator_cur->list.next, 1044 struct rule_head, list); 1045 1046 iptc_fn = TC_NEXT_RULE; 1047 1048 DEBUGP_C("next=%p, head=%p...", &r->list, 1049 &(*handle)->rule_iterator_cur->chain->rules); 1050 1051 if (&r->list == &(*handle)->rule_iterator_cur->chain->rules) { 1052 (*handle)->rule_iterator_cur = NULL; 1053 DEBUGP_C("finished, returning NULL\n"); 1054 return NULL; 1055 } 1056 1057 (*handle)->rule_iterator_cur = r; 1058 1059 /* NOTE: prev is without any influence ! */ 1060 DEBUGP_C("returning rule %p\n", r); 1061 return r->entry; 1062 } 1063 1064 /* How many rules in this chain? */ 1065 unsigned int 1066 TC_NUM_RULES(const char *chain, TC_HANDLE_T *handle) 1067 { 1068 struct chain_head *c; 1069 iptc_fn = TC_NUM_RULES; 1070 CHECK(*handle); 1071 1072 c = iptcc_find_label(chain, *handle); 1073 if (!c) { 1074 errno = ENOENT; 1075 return (unsigned int)-1; 1076 } 1077 1078 return c->num_rules; 1079 } 1080 1081 const STRUCT_ENTRY *TC_GET_RULE(const char *chain, 1082 unsigned int n, 1083 TC_HANDLE_T *handle) 1084 { 1085 struct chain_head *c; 1086 struct rule_head *r; 1087 1088 iptc_fn = TC_GET_RULE; 1089 1090 CHECK(*handle); 1091 1092 c = iptcc_find_label(chain, *handle); 1093 if (!c) { 1094 errno = ENOENT; 1095 return NULL; 1096 } 1097 1098 r = iptcc_get_rule_num(c, n); 1099 if (!r) 1100 return NULL; 1101 return r->entry; 1102 } 1103 1104 /* Returns a pointer to the target name of this position. */ 1105 const char *standard_target_map(int verdict) 1106 { 1107 switch (verdict) { 1108 case RETURN: 1109 return LABEL_RETURN; 1110 break; 1111 case -NF_ACCEPT-1: 1112 return LABEL_ACCEPT; 1113 break; 1114 case -NF_DROP-1: 1115 return LABEL_DROP; 1116 break; 1117 case -NF_QUEUE-1: 1118 return LABEL_QUEUE; 1119 break; 1120 default: 1121 fprintf(stderr, "ERROR: %d not a valid target)\n", 1122 verdict); 1123 abort(); 1124 break; 1125 } 1126 /* not reached */ 1127 return NULL; 1128 } 1129 1130 /* Returns a pointer to the target name of this position. */ 1131 const char *TC_GET_TARGET(const STRUCT_ENTRY *ce, 1132 TC_HANDLE_T *handle) 1133 { 1134 STRUCT_ENTRY *e = (STRUCT_ENTRY *)ce; 1135 struct rule_head *r = container_of(e, struct rule_head, entry[0]); 1136 1137 iptc_fn = TC_GET_TARGET; 1138 1139 switch(r->type) { 1140 int spos; 1141 case IPTCC_R_FALLTHROUGH: 1142 return ""; 1143 break; 1144 case IPTCC_R_JUMP: 1145 DEBUGP("r=%p, jump=%p, name=`%s'\n", r, r->jump, r->jump->name); 1146 return r->jump->name; 1147 break; 1148 case IPTCC_R_STANDARD: 1149 spos = *(int *)GET_TARGET(e)->data; 1150 DEBUGP("r=%p, spos=%d'\n", r, spos); 1151 return standard_target_map(spos); 1152 break; 1153 case IPTCC_R_MODULE: 1154 return GET_TARGET(e)->u.user.name; 1155 break; 1156 } 1157 return NULL; 1158 } 1159 /* Is this a built-in chain? Actually returns hook + 1. */ 1160 int 1161 TC_BUILTIN(const char *chain, const TC_HANDLE_T handle) 1162 { 1163 struct chain_head *c; 1164 1165 iptc_fn = TC_BUILTIN; 1166 1167 c = iptcc_find_label(chain, handle); 1168 if (!c) { 1169 errno = ENOENT; 1170 return 0; 1171 } 1172 1173 return iptcc_is_builtin(c); 1174 } 1175 1176 /* Get the policy of a given built-in chain */ 1177 const char * 1178 TC_GET_POLICY(const char *chain, 1179 STRUCT_COUNTERS *counters, 1180 TC_HANDLE_T *handle) 1181 { 1182 struct chain_head *c; 1183 1184 iptc_fn = TC_GET_POLICY; 1185 1186 DEBUGP("called for chain %s\n", chain); 1187 1188 c = iptcc_find_label(chain, *handle); 1189 if (!c) { 1190 errno = ENOENT; 1191 return NULL; 1192 } 1193 1194 if (!iptcc_is_builtin(c)) 1195 return NULL; 1196 1197 *counters = c->counters; 1198 1199 return standard_target_map(c->verdict); 1200 } 1201 1202 static int 1203 iptcc_standard_map(struct rule_head *r, int verdict) 1204 { 1205 STRUCT_ENTRY *e = r->entry; 1206 STRUCT_STANDARD_TARGET *t; 1207 1208 t = (STRUCT_STANDARD_TARGET *)GET_TARGET(e); 1209 1210 if (t->target.u.target_size 1211 != ALIGN(sizeof(STRUCT_STANDARD_TARGET))) { 1212 errno = EINVAL; 1213 return 0; 1214 } 1215 /* memset for memcmp convenience on delete/replace */ 1216 memset(t->target.u.user.name, 0, FUNCTION_MAXNAMELEN); 1217 strcpy(t->target.u.user.name, STANDARD_TARGET); 1218 t->verdict = verdict; 1219 1220 r->type = IPTCC_R_STANDARD; 1221 1222 return 1; 1223 } 1224 1225 static int 1226 iptcc_map_target(const TC_HANDLE_T handle, 1227 struct rule_head *r) 1228 { 1229 STRUCT_ENTRY *e = r->entry; 1230 STRUCT_ENTRY_TARGET *t = GET_TARGET(e); 1231 1232 /* Maybe it's empty (=> fall through) */ 1233 if (strcmp(t->u.user.name, "") == 0) { 1234 r->type = IPTCC_R_FALLTHROUGH; 1235 return 1; 1236 } 1237 /* Maybe it's a standard target name... */ 1238 else if (strcmp(t->u.user.name, LABEL_ACCEPT) == 0) 1239 return iptcc_standard_map(r, -NF_ACCEPT - 1); 1240 else if (strcmp(t->u.user.name, LABEL_DROP) == 0) 1241 return iptcc_standard_map(r, -NF_DROP - 1); 1242 else if (strcmp(t->u.user.name, LABEL_QUEUE) == 0) 1243 return iptcc_standard_map(r, -NF_QUEUE - 1); 1244 else if (strcmp(t->u.user.name, LABEL_RETURN) == 0) 1245 return iptcc_standard_map(r, RETURN); 1246 else if (TC_BUILTIN(t->u.user.name, handle)) { 1247 /* Can't jump to builtins. */ 1248 errno = EINVAL; 1249 return 0; 1250 } else { 1251 /* Maybe it's an existing chain name. */ 1252 struct chain_head *c; 1253 DEBUGP("trying to find chain `%s': ", t->u.user.name); 1254 1255 c = iptcc_find_label(t->u.user.name, handle); 1256 if (c) { 1257 DEBUGP_C("found!\n"); 1258 r->type = IPTCC_R_JUMP; 1259 r->jump = c; 1260 c->references++; 1261 return 1; 1262 } 1263 DEBUGP_C("not found :(\n"); 1264 } 1265 1266 /* Must be a module? If not, kernel will reject... */ 1267 /* memset to all 0 for your memcmp convenience: don't clear version */ 1268 memset(t->u.user.name + strlen(t->u.user.name), 1269 0, 1270 FUNCTION_MAXNAMELEN - 1 - strlen(t->u.user.name)); 1271 r->type = IPTCC_R_MODULE; 1272 set_changed(handle); 1273 return 1; 1274 } 1275 1276 /* Insert the entry `fw' in chain `chain' into position `rulenum'. */ 1277 int 1278 TC_INSERT_ENTRY(const IPT_CHAINLABEL chain, 1279 const STRUCT_ENTRY *e, 1280 unsigned int rulenum, 1281 TC_HANDLE_T *handle) 1282 { 1283 struct chain_head *c; 1284 struct rule_head *r; 1285 struct list_head *prev; 1286 1287 iptc_fn = TC_INSERT_ENTRY; 1288 1289 if (!(c = iptcc_find_label(chain, *handle))) { 1290 errno = ENOENT; 1291 return 0; 1292 } 1293 1294 /* first rulenum index = 0 1295 first c->num_rules index = 1 */ 1296 if (rulenum > c->num_rules) { 1297 errno = E2BIG; 1298 return 0; 1299 } 1300 1301 /* If we are inserting at the end just take advantage of the 1302 double linked list, insert will happen before the entry 1303 prev points to. */ 1304 if (rulenum == c->num_rules) { 1305 prev = &c->rules; 1306 } else if (rulenum + 1 <= c->num_rules/2) { 1307 r = iptcc_get_rule_num(c, rulenum + 1); 1308 prev = &r->list; 1309 } else { 1310 r = iptcc_get_rule_num_reverse(c, c->num_rules - rulenum); 1311 prev = &r->list; 1312 } 1313 1314 if (!(r = iptcc_alloc_rule(c, e->next_offset))) { 1315 errno = ENOMEM; 1316 return 0; 1317 } 1318 1319 memcpy(r->entry, e, e->next_offset); 1320 r->counter_map.maptype = COUNTER_MAP_SET; 1321 1322 if (!iptcc_map_target(*handle, r)) { 1323 free(r); 1324 return 0; 1325 } 1326 1327 list_add_tail(&r->list, prev); 1328 c->num_rules++; 1329 1330 set_changed(*handle); 1331 1332 return 1; 1333 } 1334 1335 /* Atomically replace rule `rulenum' in `chain' with `fw'. */ 1336 int 1337 TC_REPLACE_ENTRY(const IPT_CHAINLABEL chain, 1338 const STRUCT_ENTRY *e, 1339 unsigned int rulenum, 1340 TC_HANDLE_T *handle) 1341 { 1342 struct chain_head *c; 1343 struct rule_head *r, *old; 1344 1345 iptc_fn = TC_REPLACE_ENTRY; 1346 1347 if (!(c = iptcc_find_label(chain, *handle))) { 1348 errno = ENOENT; 1349 return 0; 1350 } 1351 1352 if (rulenum >= c->num_rules) { 1353 errno = E2BIG; 1354 return 0; 1355 } 1356 1357 /* Take advantage of the double linked list if possible. */ 1358 if (rulenum + 1 <= c->num_rules/2) { 1359 old = iptcc_get_rule_num(c, rulenum + 1); 1360 } else { 1361 old = iptcc_get_rule_num_reverse(c, c->num_rules - rulenum); 1362 } 1363 1364 if (!(r = iptcc_alloc_rule(c, e->next_offset))) { 1365 errno = ENOMEM; 1366 return 0; 1367 } 1368 1369 memcpy(r->entry, e, e->next_offset); 1370 r->counter_map.maptype = COUNTER_MAP_SET; 1371 1372 if (!iptcc_map_target(*handle, r)) { 1373 free(r); 1374 return 0; 1375 } 1376 1377 list_add(&r->list, &old->list); 1378 iptcc_delete_rule(old); 1379 1380 set_changed(*handle); 1381 1382 return 1; 1383 } 1384 1385 /* Append entry `fw' to chain `chain'. Equivalent to insert with 1386 rulenum = length of chain. */ 1387 int 1388 TC_APPEND_ENTRY(const IPT_CHAINLABEL chain, 1389 const STRUCT_ENTRY *e, 1390 TC_HANDLE_T *handle) 1391 { 1392 struct chain_head *c; 1393 struct rule_head *r; 1394 1395 iptc_fn = TC_APPEND_ENTRY; 1396 if (!(c = iptcc_find_label(chain, *handle))) { 1397 DEBUGP("unable to find chain `%s'\n", chain); 1398 errno = ENOENT; 1399 return 0; 1400 } 1401 1402 if (!(r = iptcc_alloc_rule(c, e->next_offset))) { 1403 DEBUGP("unable to allocate rule for chain `%s'\n", chain); 1404 errno = ENOMEM; 1405 return 0; 1406 } 1407 1408 memcpy(r->entry, e, e->next_offset); 1409 r->counter_map.maptype = COUNTER_MAP_SET; 1410 1411 if (!iptcc_map_target(*handle, r)) { 1412 DEBUGP("unable to map target of rule for chain `%s'\n", chain); 1413 free(r); 1414 return 0; 1415 } 1416 1417 list_add_tail(&r->list, &c->rules); 1418 c->num_rules++; 1419 1420 set_changed(*handle); 1421 1422 return 1; 1423 } 1424 1425 static inline int 1426 match_different(const STRUCT_ENTRY_MATCH *a, 1427 const unsigned char *a_elems, 1428 const unsigned char *b_elems, 1429 unsigned char **maskptr) 1430 { 1431 const STRUCT_ENTRY_MATCH *b; 1432 unsigned int i; 1433 1434 /* Offset of b is the same as a. */ 1435 b = (void *)b_elems + ((unsigned char *)a - a_elems); 1436 1437 if (a->u.match_size != b->u.match_size) 1438 return 1; 1439 1440 if (strcmp(a->u.user.name, b->u.user.name) != 0) 1441 return 1; 1442 1443 *maskptr += ALIGN(sizeof(*a)); 1444 1445 for (i = 0; i < a->u.match_size - ALIGN(sizeof(*a)); i++) 1446 if (((a->data[i] ^ b->data[i]) & (*maskptr)[i]) != 0) 1447 return 1; 1448 *maskptr += i; 1449 return 0; 1450 } 1451 1452 static inline int 1453 target_same(struct rule_head *a, struct rule_head *b,const unsigned char *mask) 1454 { 1455 unsigned int i; 1456 STRUCT_ENTRY_TARGET *ta, *tb; 1457 1458 if (a->type != b->type) 1459 return 0; 1460 1461 ta = GET_TARGET(a->entry); 1462 tb = GET_TARGET(b->entry); 1463 1464 switch (a->type) { 1465 case IPTCC_R_FALLTHROUGH: 1466 return 1; 1467 case IPTCC_R_JUMP: 1468 return a->jump == b->jump; 1469 case IPTCC_R_STANDARD: 1470 return ((STRUCT_STANDARD_TARGET *)ta)->verdict 1471 == ((STRUCT_STANDARD_TARGET *)tb)->verdict; 1472 case IPTCC_R_MODULE: 1473 if (ta->u.target_size != tb->u.target_size) 1474 return 0; 1475 if (strcmp(ta->u.user.name, tb->u.user.name) != 0) 1476 return 0; 1477 1478 for (i = 0; i < ta->u.target_size - sizeof(*ta); i++) 1479 if (((ta->data[i] ^ tb->data[i]) & mask[i]) != 0) 1480 return 0; 1481 return 1; 1482 default: 1483 fprintf(stderr, "ERROR: bad type %i\n", a->type); 1484 abort(); 1485 } 1486 } 1487 1488 static unsigned char * 1489 is_same(const STRUCT_ENTRY *a, 1490 const STRUCT_ENTRY *b, 1491 unsigned char *matchmask); 1492 1493 /* Delete the first rule in `chain' which matches `fw'. */ 1494 int 1495 TC_DELETE_ENTRY(const IPT_CHAINLABEL chain, 1496 const STRUCT_ENTRY *origfw, 1497 unsigned char *matchmask, 1498 TC_HANDLE_T *handle) 1499 { 1500 struct chain_head *c; 1501 struct rule_head *r, *i; 1502 1503 iptc_fn = TC_DELETE_ENTRY; 1504 if (!(c = iptcc_find_label(chain, *handle))) { 1505 errno = ENOENT; 1506 return 0; 1507 } 1508 1509 /* Create a rule_head from origfw. */ 1510 r = iptcc_alloc_rule(c, origfw->next_offset); 1511 if (!r) { 1512 errno = ENOMEM; 1513 return 0; 1514 } 1515 1516 memcpy(r->entry, origfw, origfw->next_offset); 1517 r->counter_map.maptype = COUNTER_MAP_NOMAP; 1518 if (!iptcc_map_target(*handle, r)) { 1519 DEBUGP("unable to map target of rule for chain `%s'\n", chain); 1520 free(r); 1521 return 0; 1522 } else { 1523 /* iptcc_map_target increment target chain references 1524 * since this is a fake rule only used for matching 1525 * the chain references count is decremented again. 1526 */ 1527 if (r->type == IPTCC_R_JUMP 1528 && r->jump) 1529 r->jump->references--; 1530 } 1531 1532 list_for_each_entry(i, &c->rules, list) { 1533 unsigned char *mask; 1534 1535 mask = is_same(r->entry, i->entry, matchmask); 1536 if (!mask) 1537 continue; 1538 1539 if (!target_same(r, i, mask)) 1540 continue; 1541 1542 /* If we are about to delete the rule that is the 1543 * current iterator, move rule iterator back. next 1544 * pointer will then point to real next node */ 1545 if (i == (*handle)->rule_iterator_cur) { 1546 (*handle)->rule_iterator_cur = 1547 list_entry((*handle)->rule_iterator_cur->list.prev, 1548 struct rule_head, list); 1549 } 1550 1551 c->num_rules--; 1552 iptcc_delete_rule(i); 1553 1554 set_changed(*handle); 1555 free(r); 1556 return 1; 1557 } 1558 1559 free(r); 1560 errno = ENOENT; 1561 return 0; 1562 } 1563 1564 1565 /* Delete the rule in position `rulenum' in `chain'. */ 1566 int 1567 TC_DELETE_NUM_ENTRY(const IPT_CHAINLABEL chain, 1568 unsigned int rulenum, 1569 TC_HANDLE_T *handle) 1570 { 1571 struct chain_head *c; 1572 struct rule_head *r; 1573 1574 iptc_fn = TC_DELETE_NUM_ENTRY; 1575 1576 if (!(c = iptcc_find_label(chain, *handle))) { 1577 errno = ENOENT; 1578 return 0; 1579 } 1580 1581 if (rulenum >= c->num_rules) { 1582 errno = E2BIG; 1583 return 0; 1584 } 1585 1586 /* Take advantage of the double linked list if possible. */ 1587 if (rulenum + 1 <= c->num_rules/2) { 1588 r = iptcc_get_rule_num(c, rulenum + 1); 1589 } else { 1590 r = iptcc_get_rule_num_reverse(c, c->num_rules - rulenum); 1591 } 1592 1593 /* If we are about to delete the rule that is the current 1594 * iterator, move rule iterator back. next pointer will then 1595 * point to real next node */ 1596 if (r == (*handle)->rule_iterator_cur) { 1597 (*handle)->rule_iterator_cur = 1598 list_entry((*handle)->rule_iterator_cur->list.prev, 1599 struct rule_head, list); 1600 } 1601 1602 c->num_rules--; 1603 iptcc_delete_rule(r); 1604 1605 set_changed(*handle); 1606 1607 return 1; 1608 } 1609 1610 /* Check the packet `fw' on chain `chain'. Returns the verdict, or 1611 NULL and sets errno. */ 1612 const char * 1613 TC_CHECK_PACKET(const IPT_CHAINLABEL chain, 1614 STRUCT_ENTRY *entry, 1615 TC_HANDLE_T *handle) 1616 { 1617 iptc_fn = TC_CHECK_PACKET; 1618 errno = ENOSYS; 1619 return NULL; 1620 } 1621 1622 /* Flushes the entries in the given chain (ie. empties chain). */ 1623 int 1624 TC_FLUSH_ENTRIES(const IPT_CHAINLABEL chain, TC_HANDLE_T *handle) 1625 { 1626 struct chain_head *c; 1627 struct rule_head *r, *tmp; 1628 1629 iptc_fn = TC_FLUSH_ENTRIES; 1630 if (!(c = iptcc_find_label(chain, *handle))) { 1631 errno = ENOENT; 1632 return 0; 1633 } 1634 1635 list_for_each_entry_safe(r, tmp, &c->rules, list) { 1636 iptcc_delete_rule(r); 1637 } 1638 1639 c->num_rules = 0; 1640 1641 set_changed(*handle); 1642 1643 return 1; 1644 } 1645 1646 /* Zeroes the counters in a chain. */ 1647 int 1648 TC_ZERO_ENTRIES(const IPT_CHAINLABEL chain, TC_HANDLE_T *handle) 1649 { 1650 struct chain_head *c; 1651 struct rule_head *r; 1652 1653 iptc_fn = TC_ZERO_ENTRIES; 1654 if (!(c = iptcc_find_label(chain, *handle))) { 1655 errno = ENOENT; 1656 return 0; 1657 } 1658 1659 if (c->counter_map.maptype == COUNTER_MAP_NORMAL_MAP) 1660 c->counter_map.maptype = COUNTER_MAP_ZEROED; 1661 1662 list_for_each_entry(r, &c->rules, list) { 1663 if (r->counter_map.maptype == COUNTER_MAP_NORMAL_MAP) 1664 r->counter_map.maptype = COUNTER_MAP_ZEROED; 1665 } 1666 1667 set_changed(*handle); 1668 1669 return 1; 1670 } 1671 1672 STRUCT_COUNTERS * 1673 TC_READ_COUNTER(const IPT_CHAINLABEL chain, 1674 unsigned int rulenum, 1675 TC_HANDLE_T *handle) 1676 { 1677 struct chain_head *c; 1678 struct rule_head *r; 1679 1680 iptc_fn = TC_READ_COUNTER; 1681 CHECK(*handle); 1682 1683 if (!(c = iptcc_find_label(chain, *handle))) { 1684 errno = ENOENT; 1685 return NULL; 1686 } 1687 1688 if (!(r = iptcc_get_rule_num(c, rulenum))) { 1689 errno = E2BIG; 1690 return NULL; 1691 } 1692 1693 return &r->entry[0].counters; 1694 } 1695 1696 int 1697 TC_ZERO_COUNTER(const IPT_CHAINLABEL chain, 1698 unsigned int rulenum, 1699 TC_HANDLE_T *handle) 1700 { 1701 struct chain_head *c; 1702 struct rule_head *r; 1703 1704 iptc_fn = TC_ZERO_COUNTER; 1705 CHECK(*handle); 1706 1707 if (!(c = iptcc_find_label(chain, *handle))) { 1708 errno = ENOENT; 1709 return 0; 1710 } 1711 1712 if (!(r = iptcc_get_rule_num(c, rulenum))) { 1713 errno = E2BIG; 1714 return 0; 1715 } 1716 1717 if (r->counter_map.maptype == COUNTER_MAP_NORMAL_MAP) 1718 r->counter_map.maptype = COUNTER_MAP_ZEROED; 1719 1720 set_changed(*handle); 1721 1722 return 1; 1723 } 1724 1725 int 1726 TC_SET_COUNTER(const IPT_CHAINLABEL chain, 1727 unsigned int rulenum, 1728 STRUCT_COUNTERS *counters, 1729 TC_HANDLE_T *handle) 1730 { 1731 struct chain_head *c; 1732 struct rule_head *r; 1733 STRUCT_ENTRY *e; 1734 1735 iptc_fn = TC_SET_COUNTER; 1736 CHECK(*handle); 1737 1738 if (!(c = iptcc_find_label(chain, *handle))) { 1739 errno = ENOENT; 1740 return 0; 1741 } 1742 1743 if (!(r = iptcc_get_rule_num(c, rulenum))) { 1744 errno = E2BIG; 1745 return 0; 1746 } 1747 1748 e = r->entry; 1749 r->counter_map.maptype = COUNTER_MAP_SET; 1750 1751 memcpy(&e->counters, counters, sizeof(STRUCT_COUNTERS)); 1752 1753 set_changed(*handle); 1754 1755 return 1; 1756 } 1757 1758 /* Creates a new chain. */ 1759 /* To create a chain, create two rules: error node and unconditional 1760 * return. */ 1761 int 1762 TC_CREATE_CHAIN(const IPT_CHAINLABEL chain, TC_HANDLE_T *handle) 1763 { 1764 static struct chain_head *c; 1765 1766 iptc_fn = TC_CREATE_CHAIN; 1767 1768 /* find_label doesn't cover built-in targets: DROP, ACCEPT, 1769 QUEUE, RETURN. */ 1770 if (iptcc_find_label(chain, *handle) 1771 || strcmp(chain, LABEL_DROP) == 0 1772 || strcmp(chain, LABEL_ACCEPT) == 0 1773 || strcmp(chain, LABEL_QUEUE) == 0 1774 || strcmp(chain, LABEL_RETURN) == 0) { 1775 DEBUGP("Chain `%s' already exists\n", chain); 1776 errno = EEXIST; 1777 return 0; 1778 } 1779 1780 if (strlen(chain)+1 > sizeof(IPT_CHAINLABEL)) { 1781 DEBUGP("Chain name `%s' too long\n", chain); 1782 errno = EINVAL; 1783 return 0; 1784 } 1785 1786 c = iptcc_alloc_chain_head(chain, 0); 1787 if (!c) { 1788 DEBUGP("Cannot allocate memory for chain `%s'\n", chain); 1789 errno = ENOMEM; 1790 return 0; 1791 1792 } 1793 1794 DEBUGP("Creating chain `%s'\n", chain); 1795 list_add_tail(&c->list, &(*handle)->chains); 1796 1797 set_changed(*handle); 1798 1799 return 1; 1800 } 1801 1802 /* Get the number of references to this chain. */ 1803 int 1804 TC_GET_REFERENCES(unsigned int *ref, const IPT_CHAINLABEL chain, 1805 TC_HANDLE_T *handle) 1806 { 1807 struct chain_head *c; 1808 1809 iptc_fn = TC_GET_REFERENCES; 1810 if (!(c = iptcc_find_label(chain, *handle))) { 1811 errno = ENOENT; 1812 return 0; 1813 } 1814 1815 *ref = c->references; 1816 1817 return 1; 1818 } 1819 1820 /* Deletes a chain. */ 1821 int 1822 TC_DELETE_CHAIN(const IPT_CHAINLABEL chain, TC_HANDLE_T *handle) 1823 { 1824 unsigned int references; 1825 struct chain_head *c; 1826 1827 iptc_fn = TC_DELETE_CHAIN; 1828 1829 if (!(c = iptcc_find_label(chain, *handle))) { 1830 DEBUGP("cannot find chain `%s'\n", chain); 1831 errno = ENOENT; 1832 return 0; 1833 } 1834 1835 if (TC_BUILTIN(chain, *handle)) { 1836 DEBUGP("cannot remove builtin chain `%s'\n", chain); 1837 errno = EINVAL; 1838 return 0; 1839 } 1840 1841 if (!TC_GET_REFERENCES(&references, chain, handle)) { 1842 DEBUGP("cannot get references on chain `%s'\n", chain); 1843 return 0; 1844 } 1845 1846 if (references > 0) { 1847 DEBUGP("chain `%s' still has references\n", chain); 1848 errno = EMLINK; 1849 return 0; 1850 } 1851 1852 if (c->num_rules) { 1853 DEBUGP("chain `%s' is not empty\n", chain); 1854 errno = ENOTEMPTY; 1855 return 0; 1856 } 1857 1858 /* If we are about to delete the chain that is the current 1859 * iterator, move chain iterator firward. */ 1860 if (c == (*handle)->chain_iterator_cur) 1861 iptcc_chain_iterator_advance(*handle); 1862 1863 list_del(&c->list); 1864 free(c); 1865 1866 DEBUGP("chain `%s' deleted\n", chain); 1867 1868 set_changed(*handle); 1869 1870 return 1; 1871 } 1872 1873 /* Renames a chain. */ 1874 int TC_RENAME_CHAIN(const IPT_CHAINLABEL oldname, 1875 const IPT_CHAINLABEL newname, 1876 TC_HANDLE_T *handle) 1877 { 1878 struct chain_head *c; 1879 iptc_fn = TC_RENAME_CHAIN; 1880 1881 /* find_label doesn't cover built-in targets: DROP, ACCEPT, 1882 QUEUE, RETURN. */ 1883 if (iptcc_find_label(newname, *handle) 1884 || strcmp(newname, LABEL_DROP) == 0 1885 || strcmp(newname, LABEL_ACCEPT) == 0 1886 || strcmp(newname, LABEL_QUEUE) == 0 1887 || strcmp(newname, LABEL_RETURN) == 0) { 1888 errno = EEXIST; 1889 return 0; 1890 } 1891 1892 if (!(c = iptcc_find_label(oldname, *handle)) 1893 || TC_BUILTIN(oldname, *handle)) { 1894 errno = ENOENT; 1895 return 0; 1896 } 1897 1898 if (strlen(newname)+1 > sizeof(IPT_CHAINLABEL)) { 1899 errno = EINVAL; 1900 return 0; 1901 } 1902 1903 strncpy(c->name, newname, sizeof(IPT_CHAINLABEL)); 1904 1905 set_changed(*handle); 1906 1907 return 1; 1908 } 1909 1910 /* Sets the policy on a built-in chain. */ 1911 int 1912 TC_SET_POLICY(const IPT_CHAINLABEL chain, 1913 const IPT_CHAINLABEL policy, 1914 STRUCT_COUNTERS *counters, 1915 TC_HANDLE_T *handle) 1916 { 1917 struct chain_head *c; 1918 1919 iptc_fn = TC_SET_POLICY; 1920 1921 if (!(c = iptcc_find_label(chain, *handle))) { 1922 DEBUGP("cannot find chain `%s'\n", chain); 1923 errno = ENOENT; 1924 return 0; 1925 } 1926 1927 if (!iptcc_is_builtin(c)) { 1928 DEBUGP("cannot set policy of userdefinedchain `%s'\n", chain); 1929 errno = ENOENT; 1930 return 0; 1931 } 1932 1933 if (strcmp(policy, LABEL_ACCEPT) == 0) 1934 c->verdict = -NF_ACCEPT - 1; 1935 else if (strcmp(policy, LABEL_DROP) == 0) 1936 c->verdict = -NF_DROP - 1; 1937 else { 1938 errno = EINVAL; 1939 return 0; 1940 } 1941 1942 if (counters) { 1943 /* set byte and packet counters */ 1944 memcpy(&c->counters, counters, sizeof(STRUCT_COUNTERS)); 1945 c->counter_map.maptype = COUNTER_MAP_SET; 1946 } else { 1947 c->counter_map.maptype = COUNTER_MAP_NOMAP; 1948 } 1949 1950 set_changed(*handle); 1951 1952 return 1; 1953 } 1954 1955 /* Without this, on gcc 2.7.2.3, we get: 1956 libiptc.c: In function `TC_COMMIT': 1957 libiptc.c:833: fixed or forbidden register was spilled. 1958 This may be due to a compiler bug or to impossible asm 1959 statements or clauses. 1960 */ 1961 static void 1962 subtract_counters(STRUCT_COUNTERS *answer, 1963 const STRUCT_COUNTERS *a, 1964 const STRUCT_COUNTERS *b) 1965 { 1966 answer->pcnt = a->pcnt - b->pcnt; 1967 answer->bcnt = a->bcnt - b->bcnt; 1968 } 1969 1970 1971 static void counters_nomap(STRUCT_COUNTERS_INFO *newcounters, 1972 unsigned int index) 1973 { 1974 newcounters->counters[index] = ((STRUCT_COUNTERS) { 0, 0}); 1975 DEBUGP_C("NOMAP => zero\n"); 1976 } 1977 1978 static void counters_normal_map(STRUCT_COUNTERS_INFO *newcounters, 1979 STRUCT_REPLACE *repl, 1980 unsigned int index, 1981 unsigned int mappos) 1982 { 1983 /* Original read: X. 1984 * Atomic read on replacement: X + Y. 1985 * Currently in kernel: Z. 1986 * Want in kernel: X + Y + Z. 1987 * => Add in X + Y 1988 * => Add in replacement read. 1989 */ 1990 newcounters->counters[index] = repl->counters[mappos]; 1991 DEBUGP_C("NORMAL_MAP => mappos %u \n", mappos); 1992 } 1993 1994 static void counters_map_zeroed(STRUCT_COUNTERS_INFO *newcounters, 1995 STRUCT_REPLACE *repl, 1996 unsigned int index, 1997 unsigned int mappos, 1998 STRUCT_COUNTERS *counters) 1999 { 2000 /* Original read: X. 2001 * Atomic read on replacement: X + Y. 2002 * Currently in kernel: Z. 2003 * Want in kernel: Y + Z. 2004 * => Add in Y. 2005 * => Add in (replacement read - original read). 2006 */ 2007 subtract_counters(&newcounters->counters[index], 2008 &repl->counters[mappos], 2009 counters); 2010 DEBUGP_C("ZEROED => mappos %u\n", mappos); 2011 } 2012 2013 static void counters_map_set(STRUCT_COUNTERS_INFO *newcounters, 2014 unsigned int index, 2015 STRUCT_COUNTERS *counters) 2016 { 2017 /* Want to set counter (iptables-restore) */ 2018 2019 memcpy(&newcounters->counters[index], counters, 2020 sizeof(STRUCT_COUNTERS)); 2021 2022 DEBUGP_C("SET\n"); 2023 } 2024 2025 2026 int 2027 TC_COMMIT(TC_HANDLE_T *handle) 2028 { 2029 /* Replace, then map back the counters. */ 2030 STRUCT_REPLACE *repl; 2031 STRUCT_COUNTERS_INFO *newcounters; 2032 struct chain_head *c; 2033 int ret; 2034 size_t counterlen; 2035 int new_number; 2036 unsigned int new_size; 2037 2038 iptc_fn = TC_COMMIT; 2039 CHECK(*handle); 2040 2041 /* Don't commit if nothing changed. */ 2042 if (!(*handle)->changed) 2043 goto finished; 2044 2045 new_number = iptcc_compile_table_prep(*handle, &new_size); 2046 if (new_number < 0) { 2047 errno = ENOMEM; 2048 goto out_zero; 2049 } 2050 2051 repl = malloc(sizeof(*repl) + new_size); 2052 if (!repl) { 2053 errno = ENOMEM; 2054 goto out_zero; 2055 } 2056 memset(repl, 0, sizeof(*repl) + new_size); 2057 2058 #if 0 2059 TC_DUMP_ENTRIES(*handle); 2060 #endif 2061 2062 counterlen = sizeof(STRUCT_COUNTERS_INFO) 2063 + sizeof(STRUCT_COUNTERS) * new_number; 2064 2065 /* These are the old counters we will get from kernel */ 2066 repl->counters = malloc(sizeof(STRUCT_COUNTERS) 2067 * (*handle)->info.num_entries); 2068 if (!repl->counters) { 2069 errno = ENOMEM; 2070 goto out_free_repl; 2071 } 2072 /* These are the counters we're going to put back, later. */ 2073 newcounters = malloc(counterlen); 2074 if (!newcounters) { 2075 errno = ENOMEM; 2076 goto out_free_repl_counters; 2077 } 2078 memset(newcounters, 0, counterlen); 2079 2080 strcpy(repl->name, (*handle)->info.name); 2081 repl->num_entries = new_number; 2082 repl->size = new_size; 2083 2084 repl->num_counters = (*handle)->info.num_entries; 2085 repl->valid_hooks = (*handle)->info.valid_hooks; 2086 2087 DEBUGP("num_entries=%u, size=%u, num_counters=%u\n", 2088 repl->num_entries, repl->size, repl->num_counters); 2089 2090 ret = iptcc_compile_table(*handle, repl); 2091 if (ret < 0) { 2092 errno = ret; 2093 goto out_free_newcounters; 2094 } 2095 2096 2097 #ifdef IPTC_DEBUG2 2098 { 2099 int fd = open("/tmp/libiptc-so_set_replace.blob", 2100 O_CREAT|O_WRONLY); 2101 if (fd >= 0) { 2102 write(fd, repl, sizeof(*repl) + repl->size); 2103 close(fd); 2104 } 2105 } 2106 #endif 2107 2108 ret = setsockopt(sockfd, TC_IPPROTO, SO_SET_REPLACE, repl, 2109 sizeof(*repl) + repl->size); 2110 if (ret < 0) 2111 goto out_free_newcounters; 2112 2113 /* Put counters back. */ 2114 strcpy(newcounters->name, (*handle)->info.name); 2115 newcounters->num_counters = new_number; 2116 2117 list_for_each_entry(c, &(*handle)->chains, list) { 2118 struct rule_head *r; 2119 2120 /* Builtin chains have their own counters */ 2121 if (iptcc_is_builtin(c)) { 2122 DEBUGP("counter for chain-index %u: ", c->foot_index); 2123 switch(c->counter_map.maptype) { 2124 case COUNTER_MAP_NOMAP: 2125 counters_nomap(newcounters, c->foot_index); 2126 break; 2127 case COUNTER_MAP_NORMAL_MAP: 2128 counters_normal_map(newcounters, repl, 2129 c->foot_index, 2130 c->counter_map.mappos); 2131 break; 2132 case COUNTER_MAP_ZEROED: 2133 counters_map_zeroed(newcounters, repl, 2134 c->foot_index, 2135 c->counter_map.mappos, 2136 &c->counters); 2137 break; 2138 case COUNTER_MAP_SET: 2139 counters_map_set(newcounters, c->foot_index, 2140 &c->counters); 2141 break; 2142 } 2143 } 2144 2145 list_for_each_entry(r, &c->rules, list) { 2146 DEBUGP("counter for index %u: ", r->index); 2147 switch (r->counter_map.maptype) { 2148 case COUNTER_MAP_NOMAP: 2149 counters_nomap(newcounters, r->index); 2150 break; 2151 2152 case COUNTER_MAP_NORMAL_MAP: 2153 counters_normal_map(newcounters, repl, 2154 r->index, 2155 r->counter_map.mappos); 2156 break; 2157 2158 case COUNTER_MAP_ZEROED: 2159 counters_map_zeroed(newcounters, repl, 2160 r->index, 2161 r->counter_map.mappos, 2162 &r->entry->counters); 2163 break; 2164 2165 case COUNTER_MAP_SET: 2166 counters_map_set(newcounters, r->index, 2167 &r->entry->counters); 2168 break; 2169 } 2170 } 2171 } 2172 2173 2174 #ifdef KERNEL_64_USERSPACE_32 2175 { 2176 /* Kernel will think that pointer should be 64-bits, and get 2177 padding. So we accomodate here (assumption: alignment of 2178 `counters' is on 64-bit boundary). */ 2179 u_int64_t *kernptr = (u_int64_t *)&newcounters->counters; 2180 if ((unsigned long)&newcounters->counters % 8 != 0) { 2181 fprintf(stderr, 2182 "counters alignment incorrect! Mail rusty!\n"); 2183 abort(); 2184 } 2185 *kernptr = newcounters->counters; 2186 } 2187 #endif /* KERNEL_64_USERSPACE_32 */ 2188 2189 #ifdef IPTC_DEBUG2 2190 { 2191 int fd = open("/tmp/libiptc-so_set_add_counters.blob", 2192 O_CREAT|O_WRONLY); 2193 if (fd >= 0) { 2194 write(fd, newcounters, counterlen); 2195 close(fd); 2196 } 2197 } 2198 #endif 2199 2200 ret = setsockopt(sockfd, TC_IPPROTO, SO_SET_ADD_COUNTERS, 2201 newcounters, counterlen); 2202 if (ret < 0) 2203 goto out_free_newcounters; 2204 2205 free(repl->counters); 2206 free(repl); 2207 free(newcounters); 2208 2209 finished: 2210 TC_FREE(handle); 2211 return 1; 2212 2213 out_free_newcounters: 2214 free(newcounters); 2215 out_free_repl_counters: 2216 free(repl->counters); 2217 out_free_repl: 2218 free(repl); 2219 out_zero: 2220 return 0; 2221 } 2222 2223 /* Get raw socket. */ 2224 int 2225 TC_GET_RAW_SOCKET() 2226 { 2227 return sockfd; 2228 } 2229 2230 /* Translates errno numbers into more human-readable form than strerror. */ 2231 const char * 2232 TC_STRERROR(int err) 2233 { 2234 unsigned int i; 2235 struct table_struct { 2236 void *fn; 2237 int err; 2238 const char *message; 2239 } table [] = 2240 { { TC_INIT, EPERM, "Permission denied (you must be root)" }, 2241 { TC_INIT, EINVAL, "Module is wrong version" }, 2242 { TC_INIT, ENOENT, 2243 "Table does not exist (do you need to insmod?)" }, 2244 { TC_DELETE_CHAIN, ENOTEMPTY, "Chain is not empty" }, 2245 { TC_DELETE_CHAIN, EINVAL, "Can't delete built-in chain" }, 2246 { TC_DELETE_CHAIN, EMLINK, 2247 "Can't delete chain with references left" }, 2248 { TC_CREATE_CHAIN, EEXIST, "Chain already exists" }, 2249 { TC_INSERT_ENTRY, E2BIG, "Index of insertion too big" }, 2250 { TC_REPLACE_ENTRY, E2BIG, "Index of replacement too big" }, 2251 { TC_DELETE_NUM_ENTRY, E2BIG, "Index of deletion too big" }, 2252 { TC_READ_COUNTER, E2BIG, "Index of counter too big" }, 2253 { TC_ZERO_COUNTER, E2BIG, "Index of counter too big" }, 2254 { TC_INSERT_ENTRY, ELOOP, "Loop found in table" }, 2255 { TC_INSERT_ENTRY, EINVAL, "Target problem" }, 2256 /* EINVAL for CHECK probably means bad interface. */ 2257 { TC_CHECK_PACKET, EINVAL, 2258 "Bad arguments (does that interface exist?)" }, 2259 { TC_CHECK_PACKET, ENOSYS, 2260 "Checking will most likely never get implemented" }, 2261 /* ENOENT for DELETE probably means no matching rule */ 2262 { TC_DELETE_ENTRY, ENOENT, 2263 "Bad rule (does a matching rule exist in that chain?)" }, 2264 { TC_SET_POLICY, ENOENT, 2265 "Bad built-in chain name" }, 2266 { TC_SET_POLICY, EINVAL, 2267 "Bad policy name" }, 2268 2269 { NULL, 0, "Incompatible with this kernel" }, 2270 { NULL, ENOPROTOOPT, "iptables who? (do you need to insmod?)" }, 2271 { NULL, ENOSYS, "Will be implemented real soon. I promise ;)" }, 2272 { NULL, ENOMEM, "Memory allocation problem" }, 2273 { NULL, ENOENT, "No chain/target/match by that name" }, 2274 }; 2275 2276 for (i = 0; i < sizeof(table)/sizeof(struct table_struct); i++) { 2277 if ((!table[i].fn || table[i].fn == iptc_fn) 2278 && table[i].err == err) 2279 return table[i].message; 2280 } 2281 2282 return strerror(err); 2283 } 2284