1 /* Library which manipulates firewall rules. Version 0.1. */ 2 3 /* Architecture of firewall rules is as follows: 4 * 5 * Chains go INPUT, FORWARD, OUTPUT then user chains. 6 * Each user chain starts with an ERROR node. 7 * Every chain ends with an unconditional jump: a RETURN for user chains, 8 * and a POLICY for built-ins. 9 */ 10 11 /* (C)1999 Paul ``Rusty'' Russell - Placed under the GNU GPL (See 12 COPYING for details). */ 13 14 #include <assert.h> 15 #include <string.h> 16 #include <errno.h> 17 #include <stdlib.h> 18 #include <stdio.h> 19 #include <unistd.h> 20 #include <arpa/inet.h> 21 22 #ifdef DEBUG_CONNTRACK 23 #define inline 24 #endif 25 26 #if !defined(__ANDROID__) && (!defined(__GLIBC__) || (__GLIBC__ < 2)) 27 typedef unsigned int socklen_t; 28 #endif 29 30 #include "libiptc/libip6tc.h" 31 32 #define HOOK_PRE_ROUTING NF_IP6_PRE_ROUTING 33 #define HOOK_LOCAL_IN NF_IP6_LOCAL_IN 34 #define HOOK_FORWARD NF_IP6_FORWARD 35 #define HOOK_LOCAL_OUT NF_IP6_LOCAL_OUT 36 #define HOOK_POST_ROUTING NF_IP6_POST_ROUTING 37 38 #define STRUCT_ENTRY_TARGET struct ip6t_entry_target 39 #define STRUCT_ENTRY struct ip6t_entry 40 #define STRUCT_ENTRY_MATCH struct ip6t_entry_match 41 #define STRUCT_GETINFO struct ip6t_getinfo 42 #define STRUCT_GET_ENTRIES struct ip6t_get_entries 43 #define STRUCT_COUNTERS struct ip6t_counters 44 #define STRUCT_COUNTERS_INFO struct ip6t_counters_info 45 #define STRUCT_STANDARD_TARGET struct ip6t_standard_target 46 #define STRUCT_REPLACE struct ip6t_replace 47 48 #define STRUCT_TC_HANDLE struct ip6tc_handle 49 #define xtc_handle ip6tc_handle 50 51 #define ENTRY_ITERATE IP6T_ENTRY_ITERATE 52 #define TABLE_MAXNAMELEN IP6T_TABLE_MAXNAMELEN 53 #define FUNCTION_MAXNAMELEN IP6T_FUNCTION_MAXNAMELEN 54 55 #define GET_TARGET ip6t_get_target 56 57 #define ERROR_TARGET IP6T_ERROR_TARGET 58 #define NUMHOOKS NF_IP6_NUMHOOKS 59 60 #define IPT_CHAINLABEL ip6t_chainlabel 61 62 #define TC_DUMP_ENTRIES dump_entries6 63 #define TC_IS_CHAIN ip6tc_is_chain 64 #define TC_FIRST_CHAIN ip6tc_first_chain 65 #define TC_NEXT_CHAIN ip6tc_next_chain 66 #define TC_FIRST_RULE ip6tc_first_rule 67 #define TC_NEXT_RULE ip6tc_next_rule 68 #define TC_GET_TARGET ip6tc_get_target 69 #define TC_BUILTIN ip6tc_builtin 70 #define TC_GET_POLICY ip6tc_get_policy 71 #define TC_INSERT_ENTRY ip6tc_insert_entry 72 #define TC_REPLACE_ENTRY ip6tc_replace_entry 73 #define TC_APPEND_ENTRY ip6tc_append_entry 74 #define TC_CHECK_ENTRY ip6tc_check_entry 75 #define TC_DELETE_ENTRY ip6tc_delete_entry 76 #define TC_DELETE_NUM_ENTRY ip6tc_delete_num_entry 77 #define TC_FLUSH_ENTRIES ip6tc_flush_entries 78 #define TC_ZERO_ENTRIES ip6tc_zero_entries 79 #define TC_ZERO_COUNTER ip6tc_zero_counter 80 #define TC_READ_COUNTER ip6tc_read_counter 81 #define TC_SET_COUNTER ip6tc_set_counter 82 #define TC_CREATE_CHAIN ip6tc_create_chain 83 #define TC_GET_REFERENCES ip6tc_get_references 84 #define TC_DELETE_CHAIN ip6tc_delete_chain 85 #define TC_RENAME_CHAIN ip6tc_rename_chain 86 #define TC_SET_POLICY ip6tc_set_policy 87 #define TC_GET_RAW_SOCKET ip6tc_get_raw_socket 88 #define TC_INIT ip6tc_init 89 #define TC_FREE ip6tc_free 90 #define TC_COMMIT ip6tc_commit 91 #define TC_STRERROR ip6tc_strerror 92 #define TC_NUM_RULES ip6tc_num_rules 93 #define TC_GET_RULE ip6tc_get_rule 94 95 #define TC_AF AF_INET6 96 #define TC_IPPROTO IPPROTO_IPV6 97 98 #define SO_SET_REPLACE IP6T_SO_SET_REPLACE 99 #define SO_SET_ADD_COUNTERS IP6T_SO_SET_ADD_COUNTERS 100 #define SO_GET_INFO IP6T_SO_GET_INFO 101 #define SO_GET_ENTRIES IP6T_SO_GET_ENTRIES 102 #define SO_GET_VERSION IP6T_SO_GET_VERSION 103 104 #define STANDARD_TARGET IP6T_STANDARD_TARGET 105 #define LABEL_RETURN IP6TC_LABEL_RETURN 106 #define LABEL_ACCEPT IP6TC_LABEL_ACCEPT 107 #define LABEL_DROP IP6TC_LABEL_DROP 108 #define LABEL_QUEUE IP6TC_LABEL_QUEUE 109 110 #define ALIGN XT_ALIGN 111 #define RETURN IP6T_RETURN 112 113 #include "libiptc.c" 114 115 #define BIT6(a, l) \ 116 ((ntohl(a->s6_addr32[(l) / 32]) >> (31 - ((l) & 31))) & 1) 117 118 int 119 ipv6_prefix_length(const struct in6_addr *a) 120 { 121 int l, i; 122 for (l = 0; l < 128; l++) { 123 if (BIT6(a, l) == 0) 124 break; 125 } 126 for (i = l + 1; i < 128; i++) { 127 if (BIT6(a, i) == 1) 128 return -1; 129 } 130 return l; 131 } 132 133 static int 134 dump_entry(struct ip6t_entry *e, struct ip6tc_handle *const handle) 135 { 136 size_t i; 137 char buf[40]; 138 int len; 139 struct ip6t_entry_target *t; 140 141 printf("Entry %u (%lu):\n", iptcb_entry2index(handle, e), 142 iptcb_entry2offset(handle, e)); 143 puts("SRC IP: "); 144 inet_ntop(AF_INET6, &e->ipv6.src, buf, sizeof buf); 145 puts(buf); 146 putchar('/'); 147 len = ipv6_prefix_length(&e->ipv6.smsk); 148 if (len != -1) 149 printf("%d", len); 150 else { 151 inet_ntop(AF_INET6, &e->ipv6.smsk, buf, sizeof buf); 152 puts(buf); 153 } 154 putchar('\n'); 155 156 puts("DST IP: "); 157 inet_ntop(AF_INET6, &e->ipv6.dst, buf, sizeof buf); 158 puts(buf); 159 putchar('/'); 160 len = ipv6_prefix_length(&e->ipv6.dmsk); 161 if (len != -1) 162 printf("%d", len); 163 else { 164 inet_ntop(AF_INET6, &e->ipv6.dmsk, buf, sizeof buf); 165 puts(buf); 166 } 167 putchar('\n'); 168 169 printf("Interface: `%s'/", e->ipv6.iniface); 170 for (i = 0; i < IFNAMSIZ; i++) 171 printf("%c", e->ipv6.iniface_mask[i] ? 'X' : '.'); 172 printf("to `%s'/", e->ipv6.outiface); 173 for (i = 0; i < IFNAMSIZ; i++) 174 printf("%c", e->ipv6.outiface_mask[i] ? 'X' : '.'); 175 printf("\nProtocol: %u\n", e->ipv6.proto); 176 if (e->ipv6.flags & IP6T_F_TOS) 177 printf("TOS: %u\n", e->ipv6.tos); 178 printf("Flags: %02X\n", e->ipv6.flags); 179 printf("Invflags: %02X\n", e->ipv6.invflags); 180 printf("Counters: %llu packets, %llu bytes\n", 181 (unsigned long long)e->counters.pcnt, (unsigned long long)e->counters.bcnt); 182 printf("Cache: %08X\n", e->nfcache); 183 184 IP6T_MATCH_ITERATE(e, print_match); 185 186 t = ip6t_get_target(e); 187 printf("Target name: `%s' [%u]\n", t->u.user.name, t->u.target_size); 188 if (strcmp(t->u.user.name, IP6T_STANDARD_TARGET) == 0) { 189 const unsigned char *data = t->data; 190 int pos = *(const int *)data; 191 if (pos < 0) 192 printf("verdict=%s\n", 193 pos == -NF_ACCEPT-1 ? "NF_ACCEPT" 194 : pos == -NF_DROP-1 ? "NF_DROP" 195 : pos == IP6T_RETURN ? "RETURN" 196 : "UNKNOWN"); 197 else 198 printf("verdict=%u\n", pos); 199 } else if (strcmp(t->u.user.name, IP6T_ERROR_TARGET) == 0) 200 printf("error=`%s'\n", t->data); 201 202 printf("\n"); 203 return 0; 204 } 205 206 static unsigned char * 207 is_same(const STRUCT_ENTRY *a, const STRUCT_ENTRY *b, 208 unsigned char *matchmask) 209 { 210 unsigned int i; 211 unsigned char *mptr; 212 213 /* Always compare head structures: ignore mask here. */ 214 if (memcmp(&a->ipv6.src, &b->ipv6.src, sizeof(struct in6_addr)) 215 || memcmp(&a->ipv6.dst, &b->ipv6.dst, sizeof(struct in6_addr)) 216 || memcmp(&a->ipv6.smsk, &b->ipv6.smsk, sizeof(struct in6_addr)) 217 || memcmp(&a->ipv6.dmsk, &b->ipv6.dmsk, sizeof(struct in6_addr)) 218 || a->ipv6.proto != b->ipv6.proto 219 || a->ipv6.tos != b->ipv6.tos 220 || a->ipv6.flags != b->ipv6.flags 221 || a->ipv6.invflags != b->ipv6.invflags) 222 return NULL; 223 224 for (i = 0; i < IFNAMSIZ; i++) { 225 if (a->ipv6.iniface_mask[i] != b->ipv6.iniface_mask[i]) 226 return NULL; 227 if ((a->ipv6.iniface[i] & a->ipv6.iniface_mask[i]) 228 != (b->ipv6.iniface[i] & b->ipv6.iniface_mask[i])) 229 return NULL; 230 if (a->ipv6.outiface_mask[i] != b->ipv6.outiface_mask[i]) 231 return NULL; 232 if ((a->ipv6.outiface[i] & a->ipv6.outiface_mask[i]) 233 != (b->ipv6.outiface[i] & b->ipv6.outiface_mask[i])) 234 return NULL; 235 } 236 237 if (a->target_offset != b->target_offset 238 || a->next_offset != b->next_offset) 239 return NULL; 240 241 mptr = matchmask + sizeof(STRUCT_ENTRY); 242 if (IP6T_MATCH_ITERATE(a, match_different, a->elems, b->elems, &mptr)) 243 return NULL; 244 mptr += XT_ALIGN(sizeof(struct ip6t_entry_target)); 245 246 return mptr; 247 } 248 249 /* All zeroes == unconditional rule. */ 250 static inline int 251 unconditional(const struct ip6t_ip6 *ipv6) 252 { 253 unsigned int i; 254 255 for (i = 0; i < sizeof(*ipv6); i++) 256 if (((char *)ipv6)[i]) 257 break; 258 259 return (i == sizeof(*ipv6)); 260 } 261 262 #ifdef IPTC_DEBUG 263 /* Do every conceivable sanity check on the handle */ 264 static void 265 do_check(struct xtc_handle *h, unsigned int line) 266 { 267 unsigned int i, n; 268 unsigned int user_offset; /* Offset of first user chain */ 269 int was_return; 270 271 assert(h->changed == 0 || h->changed == 1); 272 if (strcmp(h->info.name, "filter") == 0) { 273 assert(h->info.valid_hooks 274 == (1 << NF_IP6_LOCAL_IN 275 | 1 << NF_IP6_FORWARD 276 | 1 << NF_IP6_LOCAL_OUT)); 277 278 /* Hooks should be first three */ 279 assert(h->info.hook_entry[NF_IP6_LOCAL_IN] == 0); 280 281 n = get_chain_end(h, 0); 282 n += get_entry(h, n)->next_offset; 283 assert(h->info.hook_entry[NF_IP6_FORWARD] == n); 284 285 n = get_chain_end(h, n); 286 n += get_entry(h, n)->next_offset; 287 assert(h->info.hook_entry[NF_IP6_LOCAL_OUT] == n); 288 289 user_offset = h->info.hook_entry[NF_IP6_LOCAL_OUT]; 290 } else if (strcmp(h->info.name, "nat") == 0) { 291 assert((h->info.valid_hooks 292 == (1 << NF_IP6_PRE_ROUTING 293 | 1 << NF_IP6_LOCAL_OUT 294 | 1 << NF_IP6_POST_ROUTING)) || 295 (h->info.valid_hooks 296 == (1 << NF_IP6_PRE_ROUTING 297 | 1 << NF_IP6_LOCAL_IN 298 | 1 << NF_IP6_LOCAL_OUT 299 | 1 << NF_IP6_POST_ROUTING))); 300 301 assert(h->info.hook_entry[NF_IP6_PRE_ROUTING] == 0); 302 303 n = get_chain_end(h, 0); 304 305 n += get_entry(h, n)->next_offset; 306 assert(h->info.hook_entry[NF_IP6_POST_ROUTING] == n); 307 n = get_chain_end(h, n); 308 309 n += get_entry(h, n)->next_offset; 310 assert(h->info.hook_entry[NF_IP6_LOCAL_OUT] == n); 311 user_offset = h->info.hook_entry[NF_IP6_LOCAL_OUT]; 312 313 if (h->info.valid_hooks & (1 << NF_IP6_LOCAL_IN)) { 314 n = get_chain_end(h, n); 315 n += get_entry(h, n)->next_offset; 316 assert(h->info.hook_entry[NF_IP6_LOCAL_IN] == n); 317 user_offset = h->info.hook_entry[NF_IP6_LOCAL_IN]; 318 } 319 320 } else if (strcmp(h->info.name, "mangle") == 0) { 321 /* This code is getting ugly because linux < 2.4.18-pre6 had 322 * two mangle hooks, linux >= 2.4.18-pre6 has five mangle hooks 323 * */ 324 assert((h->info.valid_hooks 325 == (1 << NF_IP6_PRE_ROUTING 326 | 1 << NF_IP6_LOCAL_OUT)) || 327 (h->info.valid_hooks 328 == (1 << NF_IP6_PRE_ROUTING 329 | 1 << NF_IP6_LOCAL_IN 330 | 1 << NF_IP6_FORWARD 331 | 1 << NF_IP6_LOCAL_OUT 332 | 1 << NF_IP6_POST_ROUTING))); 333 334 /* Hooks should be first five */ 335 assert(h->info.hook_entry[NF_IP6_PRE_ROUTING] == 0); 336 337 n = get_chain_end(h, 0); 338 339 if (h->info.valid_hooks & (1 << NF_IP6_LOCAL_IN)) { 340 n += get_entry(h, n)->next_offset; 341 assert(h->info.hook_entry[NF_IP6_LOCAL_IN] == n); 342 n = get_chain_end(h, n); 343 } 344 345 if (h->info.valid_hooks & (1 << NF_IP6_FORWARD)) { 346 n += get_entry(h, n)->next_offset; 347 assert(h->info.hook_entry[NF_IP6_FORWARD] == n); 348 n = get_chain_end(h, n); 349 } 350 351 n += get_entry(h, n)->next_offset; 352 assert(h->info.hook_entry[NF_IP6_LOCAL_OUT] == n); 353 user_offset = h->info.hook_entry[NF_IP6_LOCAL_OUT]; 354 355 if (h->info.valid_hooks & (1 << NF_IP6_POST_ROUTING)) { 356 n = get_chain_end(h, n); 357 n += get_entry(h, n)->next_offset; 358 assert(h->info.hook_entry[NF_IP6_POST_ROUTING] == n); 359 user_offset = h->info.hook_entry[NF_IP6_POST_ROUTING]; 360 } 361 } else if (strcmp(h->info.name, "raw") == 0) { 362 assert(h->info.valid_hooks 363 == (1 << NF_IP6_PRE_ROUTING 364 | 1 << NF_IP6_LOCAL_OUT)); 365 366 /* Hooks should be first three */ 367 assert(h->info.hook_entry[NF_IP6_PRE_ROUTING] == 0); 368 369 n = get_chain_end(h, n); 370 n += get_entry(h, n)->next_offset; 371 assert(h->info.hook_entry[NF_IP6_LOCAL_OUT] == n); 372 373 user_offset = h->info.hook_entry[NF_IP6_LOCAL_OUT]; 374 } else { 375 fprintf(stderr, "Unknown table `%s'\n", h->info.name); 376 abort(); 377 } 378 379 /* User chain == end of last builtin + policy entry */ 380 user_offset = get_chain_end(h, user_offset); 381 user_offset += get_entry(h, user_offset)->next_offset; 382 383 /* Overflows should be end of entry chains, and unconditional 384 policy nodes. */ 385 for (i = 0; i < NUMHOOKS; i++) { 386 STRUCT_ENTRY *e; 387 STRUCT_STANDARD_TARGET *t; 388 389 if (!(h->info.valid_hooks & (1 << i))) 390 continue; 391 assert(h->info.underflow[i] 392 == get_chain_end(h, h->info.hook_entry[i])); 393 394 e = get_entry(h, get_chain_end(h, h->info.hook_entry[i])); 395 assert(unconditional(&e->ipv6)); 396 assert(e->target_offset == sizeof(*e)); 397 t = (STRUCT_STANDARD_TARGET *)GET_TARGET(e); 398 printf("target_size=%u, align=%u\n", 399 t->target.u.target_size, ALIGN(sizeof(*t))); 400 assert(t->target.u.target_size == ALIGN(sizeof(*t))); 401 assert(e->next_offset == sizeof(*e) + ALIGN(sizeof(*t))); 402 403 assert(strcmp(t->target.u.user.name, STANDARD_TARGET)==0); 404 assert(t->verdict == -NF_DROP-1 || t->verdict == -NF_ACCEPT-1); 405 406 /* Hooks and underflows must be valid entries */ 407 iptcb_entry2index(h, get_entry(h, h->info.hook_entry[i])); 408 iptcb_entry2index(h, get_entry(h, h->info.underflow[i])); 409 } 410 411 assert(h->info.size 412 >= h->info.num_entries * (sizeof(STRUCT_ENTRY) 413 +sizeof(STRUCT_STANDARD_TARGET))); 414 415 assert(h->entries.size 416 >= (h->new_number 417 * (sizeof(STRUCT_ENTRY) 418 + sizeof(STRUCT_STANDARD_TARGET)))); 419 assert(strcmp(h->info.name, h->entries.name) == 0); 420 421 i = 0; n = 0; 422 was_return = 0; 423 424 #if 0 425 /* Check all the entries. */ 426 ENTRY_ITERATE(h->entries.entrytable, h->entries.size, 427 check_entry, &i, &n, user_offset, &was_return, h); 428 429 assert(i == h->new_number); 430 assert(n == h->entries.size); 431 432 /* Final entry must be error node */ 433 assert(strcmp(GET_TARGET(index2entry(h, h->new_number-1)) 434 ->u.user.name, 435 ERROR_TARGET) == 0); 436 #endif 437 } 438 #endif /*IPTC_DEBUG*/ 439
