From 786b15ff1460e8611eaa35ec024efe08fd3a5ebe Mon Sep 17 00:00:00 2001 From: Jo-Philipp Wich Date: Sun, 6 Nov 2016 17:18:36 +0100 Subject: [PATCH] iptables: remove usage of xt_id Instead of relying on the nonstandard xt_id match, use the xt_comment match to tag own rules. Any rule with a comment starting with "!fw3" is considered to be firewall3 internal. Signed-off-by: Jo-Philipp Wich --- iptables.c | 74 +++++++++++++++++++++++++++--------------------------- iptables.h | 5 ---- 2 files changed, 37 insertions(+), 42 deletions(-) diff --git a/iptables.c b/iptables.c index b574f8d..ccfd29c 100644 --- a/iptables.c +++ b/iptables.c @@ -258,10 +258,9 @@ fw3_ipt_delete_chain(struct fw3_ipt_handle *h, const char *chain) iptc_delete_chain(chain, h->handle); } -static int -get_rule_id(const void *base, unsigned int start, unsigned int end) +static bool +has_rule_tag(const void *base, unsigned int start, unsigned int end) { - uint32_t id; unsigned int i; const struct xt_entry_match *em; @@ -269,18 +268,14 @@ get_rule_id(const void *base, unsigned int start, unsigned int end) { em = base + i; - if (strcmp(em->u.user.name, "id")) - continue; - - memcpy(&id, em->data, sizeof(id)); - - if ((id & FW3_ID_MASK) != FW3_ID_MAGIC) + if (strcmp(em->u.user.name, "comment")) continue; - return (id & ~FW3_ID_MASK); + if (!memcmp(em->data, "!fw3", 4)) + return true; } - return -1; + return false; } void @@ -289,7 +284,6 @@ fw3_ipt_delete_id_rules(struct fw3_ipt_handle *h, const char *chain) unsigned int num; const struct ipt_entry *e; bool found; - int id; #ifndef DISABLE_IPV6 if (h->family == FW3_FAMILY_V6) @@ -305,9 +299,7 @@ fw3_ipt_delete_id_rules(struct fw3_ipt_handle *h, const char *chain) e6 != NULL; num++, e6 = ip6tc_next_rule(e6, h->handle)) { - id = get_rule_id(e6, sizeof(*e6), e6->target_offset); - - if (id >= 0) + if (has_rule_tag(e6, sizeof(*e6), e6->target_offset)) { if (fw3_pr_debug) debug(h, "-D %s %u\n", chain, num + 1); @@ -332,9 +324,7 @@ fw3_ipt_delete_id_rules(struct fw3_ipt_handle *h, const char *chain) e != NULL; num++, e = iptc_next_rule(e, h->handle)) { - id = get_rule_id(e, sizeof(*e), e->target_offset); - - if (id >= 0) + if (has_rule_tag(e, sizeof(*e), e->target_offset)) { if (fw3_pr_debug) debug(h, "-D %s %u\n", chain, num + 1); @@ -503,7 +493,6 @@ fw3_ipt_rule_new(struct fw3_ipt_handle *h) r = fw3_alloc(sizeof(*r)); r->h = h; - r->id = 0; r->argv = fw3_alloc(sizeof(char *)); r->argv[r->argc++] = "fw3"; @@ -1443,6 +1432,34 @@ rule_build(struct fw3_ipt_rule *r) } } +static void +set_rule_tag(struct fw3_ipt_rule *r) +{ + int i; + char *p, **tmp; + const char *tag = "!fw3"; + + for (i = 0; i < r->argc; i++) + if (!strcmp(r->argv[i], "--comment") && (i + 1) < r->argc) + if (asprintf(&p, "%s: %s", tag, r->argv[i + 1]) > 0) + { + free(r->argv[i + 1]); + r->argv[i + 1] = p; + return; + } + + tmp = realloc(r->argv, (r->argc + 4) * sizeof(*r->argv)); + + if (tmp) + { + r->argv = tmp; + r->argv[r->argc++] = fw3_strdup("-m"); + r->argv[r->argc++] = fw3_strdup("comment"); + r->argv[r->argc++] = fw3_strdup("--comment"); + r->argv[r->argc++] = fw3_strdup(tag); + } +} + void __fw3_ipt_rule_append(struct fw3_ipt_rule *r, bool repl, const char *fmt, ...) { @@ -1455,7 +1472,6 @@ __fw3_ipt_rule_append(struct fw3_ipt_rule *r, bool repl, const char *fmt, ...) struct xtables_globals *g; int i, optc; - uint32_t id; bool inv = false; char buf[32]; va_list ap; @@ -1470,23 +1486,7 @@ __fw3_ipt_rule_append(struct fw3_ipt_rule *r, bool repl, const char *fmt, ...) optind = 0; opterr = 0; - if (r->id >= 0) - { - em = find_match(r, "id"); - - if (!em) - { - warn("fw3_ipt_rule_append(): Can't find match '%s'", "id"); - goto free; - } - - init_match(r, em, true); - - id = FW3_ID_MAGIC | (r->id & ~FW3_ID_MASK); - memcpy(em->m->data, &id, sizeof(id)); - - em->mflags = 1; - } + set_rule_tag(r); while ((optc = getopt_long(r->argc, r->argv, "-:m:j:", g->opts, NULL)) != -1) diff --git a/iptables.h b/iptables.h index 1d98b76..a2c733d 100644 --- a/iptables.h +++ b/iptables.h @@ -32,9 +32,6 @@ #include "options.h" -#define FW3_ID_MAGIC 0x66773300 /* 'f' 'w' '3' */ -#define FW3_ID_MASK 0xffffff00 - /* xtables interface */ #if (XTABLES_VERSION_CODE == 10 || XTABLES_VERSION_CODE == 11) # include "xtables-10.h" @@ -76,8 +73,6 @@ struct fw3_ipt_rule { struct xtables_rule_match *matches; struct xtables_target *target; - int id; - int argc; char **argv; -- 2.25.1