2 * firewall3 - 3rd OpenWrt UCI firewall implementation
4 * Copyright (C) 2013 Jo-Philipp Wich <jo@mein.io>
6 * Permission to use, copy, modify, and/or distribute this software for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19 #define _GNU_SOURCE /* RTLD_NEXT */
21 /* include userspace headers */
26 #include <netinet/in.h>
27 #include <sys/utsname.h>
28 #include <sys/socket.h>
30 /* prevent indirect inclusion of kernel headers */
35 /* prevent libiptc from including kernel headers */
36 #define _FWCHAINS_KERNEL_HEADERS_H
38 /* finally include libiptc and xtables */
39 #include <libiptc/libiptc.h>
40 #include <libiptc/libip6tc.h>
47 /* xtables interface */
48 #if (XTABLES_VERSION_CODE >= 10)
49 # include "xtables-10.h"
50 #elif (XTABLES_VERSION_CODE == 5)
51 # include "xtables-5.h"
53 # error "Unsupported xtables version"
58 #define XT_LOCK_NAME "/var/run/xtables.lock"
59 static int xt_lock_fd = -1;
62 struct fw3_ipt_handle *h;
69 struct xtables_rule_match *matches;
70 struct xtables_target *target;
79 static struct option base_opts[] = {
80 { .name = "match", .has_arg = 1, .val = 'm' },
81 { .name = "jump", .has_arg = 1, .val = 'j' },
82 { .name = "in-interface", .has_arg = 1, .val = 'i' },
83 { .name = "out-interface", .has_arg = 1, .val = 'o' },
84 { .name = "source", .has_arg = 1, .val = 's' },
85 { .name = "destination", .has_arg = 1, .val = 'd' },
90 static jmp_buf fw3_ipt_error_jmp;
92 static __attribute__((noreturn))
93 void fw3_ipt_error_handler(enum xtables_exittype status,
98 fprintf(stderr, " ! Exception: ");
101 vfprintf(stderr, fmt, args);
104 longjmp(fw3_ipt_error_jmp, status);
107 static struct xtables_globals xtg = {
109 .program_version = "4",
110 .orig_opts = base_opts,
111 .exit_err = fw3_ipt_error_handler,
112 #if XTABLES_VERSION_CODE > 10
113 .compat_rev = xtables_compatible_revision,
117 static struct xtables_globals xtg6 = {
119 .program_version = "6",
120 .orig_opts = base_opts,
121 .exit_err = fw3_ipt_error_handler,
122 #if XTABLES_VERSION_CODE > 10
123 .compat_rev = xtables_compatible_revision,
130 struct xtables_match **matches;
131 struct xtables_target **targets;
132 void (*register_match)(struct xtables_match *);
133 void (*register_target)(struct xtables_target *);
137 /* Required by certain extensions like SNAT and DNAT */
138 int kernel_version = 0;
141 get_kernel_version(void)
143 static struct utsname uts;
144 int x = 3, y = 0, z = 0;
146 if (uname(&uts) != -1)
147 sscanf(uts.release, "%d.%d.%d", &x, &y, &z);
149 kernel_version = 0x10000 * x + 0x100 * y + z;
152 static void fw3_init_extensions(void)
162 struct fw3_ipt_handle *
163 fw3_ipt_open(enum fw3_family family, enum fw3_table table)
166 struct fw3_ipt_handle *h;
168 h = fw3_alloc(sizeof(*h));
172 while (!fw3_lock_path(&xt_lock_fd, XT_LOCK_NAME)) {
173 warn("Currently busy xtables.lock - wait 1 second");
177 if (family == FW3_FAMILY_V6)
180 h->family = FW3_FAMILY_V6;
182 h->handle = ip6tc_init(fw3_flag_names[table]);
184 xtables_set_params(&xtg6);
185 xtables_set_nfproto(NFPROTO_IPV6);
190 h->family = FW3_FAMILY_V4;
192 h->handle = iptc_init(fw3_flag_names[table]);
194 xtables_set_params(&xtg);
195 xtables_set_nfproto(NFPROTO_IPV4);
201 fw3_unlock_path(&xt_lock_fd, XT_LOCK_NAME);
206 fw3_init_extensions();
208 if (xext.register_match)
209 for (i = 0; i < xext.mcount; i++)
210 xext.register_match(xext.matches[i]);
212 if (xext.register_target)
213 for (i = 0; i < xext.tcount; i++)
214 xext.register_target(xext.targets[i]);
220 debug(struct fw3_ipt_handle *h, const char *fmt, ...)
224 printf("%s -t %s ", (h->family == FW3_FAMILY_V6) ? "ip6tables" : "iptables",
225 fw3_flag_names[h->table]);
233 fw3_ipt_set_policy(struct fw3_ipt_handle *h, const char *chain,
234 enum fw3_flag policy)
237 debug(h, "-P %s %s\n", chain, fw3_flag_names[policy]);
240 if (h->family == FW3_FAMILY_V6)
241 ip6tc_set_policy(chain, fw3_flag_names[policy], NULL, h->handle);
244 iptc_set_policy(chain, fw3_flag_names[policy], NULL, h->handle);
248 fw3_ipt_flush_chain(struct fw3_ipt_handle *h, const char *chain)
251 debug(h, "-F %s\n", chain);
254 if (h->family == FW3_FAMILY_V6)
255 ip6tc_flush_entries(chain, h->handle);
258 iptc_flush_entries(chain, h->handle);
262 delete_rules(struct fw3_ipt_handle *h, const char *target)
265 const struct ipt_entry *e;
271 if (h->family == FW3_FAMILY_V6)
273 for (chain = ip6tc_first_chain(h->handle);
275 chain = ip6tc_next_chain(h->handle))
280 const struct ip6t_entry *e6;
281 for (num = 0, e6 = ip6tc_first_rule(chain, h->handle);
283 num++, e6 = ip6tc_next_rule(e6, h->handle))
285 t = ip6tc_get_target(e6, h->handle);
287 if (*t && !strcmp(t, target))
290 debug(h, "-D %s %u\n", chain, num + 1);
292 ip6tc_delete_num_entry(chain, num, h->handle);
303 for (chain = iptc_first_chain(h->handle);
305 chain = iptc_next_chain(h->handle))
310 for (num = 0, e = iptc_first_rule(chain, h->handle);
312 num++, e = iptc_next_rule(e, h->handle))
314 t = iptc_get_target(e, h->handle);
316 if (*t && !strcmp(t, target))
319 debug(h, "-D %s %u\n", chain, num + 1);
321 iptc_delete_num_entry(chain, num, h->handle);
332 is_referenced(struct fw3_ipt_handle *h, const char *target)
334 const struct ipt_entry *e;
339 if (h->family == FW3_FAMILY_V6)
341 for (chain = ip6tc_first_chain(h->handle);
343 chain = ip6tc_next_chain(h->handle))
345 const struct ip6t_entry *e6;
346 for (e6 = ip6tc_first_rule(chain, h->handle);
348 e6 = ip6tc_next_rule(e6, h->handle))
350 t = ip6tc_get_target(e6, h->handle);
352 if (*t && !strcmp(t, target))
360 for (chain = iptc_first_chain(h->handle);
362 chain = iptc_next_chain(h->handle))
364 for (e = iptc_first_rule(chain, h->handle);
366 e = iptc_next_rule(e, h->handle))
368 t = iptc_get_target(e, h->handle);
370 if (*t && !strcmp(t, target))
380 fw3_ipt_delete_chain(struct fw3_ipt_handle *h, bool if_unused,
383 if (if_unused && is_referenced(h, chain))
386 delete_rules(h, chain);
389 debug(h, "-X %s\n", chain);
392 if (h->family == FW3_FAMILY_V6)
393 ip6tc_delete_chain(chain, h->handle);
396 iptc_delete_chain(chain, h->handle);
400 has_rule_tag(const void *base, unsigned int start, unsigned int end)
403 const struct xt_entry_match *em;
405 for (i = start; i < end; i += em->u.match_size)
409 if (strcmp(em->u.user.name, "comment"))
412 if (!memcmp(em->data, "!fw3", 4))
420 fw3_ipt_delete_id_rules(struct fw3_ipt_handle *h, const char *chain)
423 const struct ipt_entry *e;
427 if (h->family == FW3_FAMILY_V6)
429 if (!ip6tc_is_chain(chain, h->handle))
435 const struct ip6t_entry *e6;
436 for (num = 0, e6 = ip6tc_first_rule(chain, h->handle);
438 num++, e6 = ip6tc_next_rule(e6, h->handle))
440 if (has_rule_tag(e6, sizeof(*e6), e6->target_offset))
443 debug(h, "-D %s %u\n", chain, num + 1);
445 ip6tc_delete_num_entry(chain, num, h->handle);
455 if (!iptc_is_chain(chain, h->handle))
461 for (num = 0, e = iptc_first_rule(chain, h->handle);
463 num++, e = iptc_next_rule(e, h->handle))
465 if (has_rule_tag(e, sizeof(*e), e->target_offset))
468 debug(h, "-D %s %u\n", chain, num + 1);
470 iptc_delete_num_entry(chain, num, h->handle);
481 is_chain(struct fw3_ipt_handle *h, const char *name)
484 if (h->family == FW3_FAMILY_V6)
485 return ip6tc_is_chain(name, h->handle);
488 return iptc_is_chain(name, h->handle);
492 fw3_ipt_create_chain(struct fw3_ipt_handle *h, bool ignore_existing,
495 if (ignore_existing && is_chain(h, chain))
499 debug(h, "-N %s\n", chain);
501 iptc_create_chain(chain, h->handle);
505 fw3_ipt_flush(struct fw3_ipt_handle *h)
510 if (h->family == FW3_FAMILY_V6)
512 for (chain = ip6tc_first_chain(h->handle);
514 chain = ip6tc_next_chain(h->handle))
516 ip6tc_flush_entries(chain, h->handle);
519 for (chain = ip6tc_first_chain(h->handle);
521 chain = ip6tc_next_chain(h->handle))
523 ip6tc_delete_chain(chain, h->handle);
529 for (chain = iptc_first_chain(h->handle);
531 chain = iptc_next_chain(h->handle))
533 iptc_flush_entries(chain, h->handle);
536 for (chain = iptc_first_chain(h->handle);
538 chain = iptc_next_chain(h->handle))
540 iptc_delete_chain(chain, h->handle);
546 chain_is_empty(struct fw3_ipt_handle *h, const char *chain)
549 if (h->family == FW3_FAMILY_V6)
550 return (!ip6tc_builtin(chain, h->handle) &&
551 !ip6tc_first_rule(chain, h->handle));
554 return (!iptc_builtin(chain, h->handle) &&
555 !iptc_first_rule(chain, h->handle));
559 fw3_ipt_gc(struct fw3_ipt_handle *h)
565 if (h->family == FW3_FAMILY_V6)
570 for (chain = ip6tc_first_chain(h->handle);
572 chain = ip6tc_next_chain(h->handle))
574 if (!chain_is_empty(h, chain))
577 fw3_ipt_delete_chain(h, false, chain);
589 for (chain = iptc_first_chain(h->handle);
591 chain = iptc_next_chain(h->handle))
593 warn("C=%s\n", chain);
595 if (!chain_is_empty(h, chain))
598 warn("D=%s\n", chain);
600 fw3_ipt_delete_chain(h, false, chain);
609 fw3_ipt_commit(struct fw3_ipt_handle *h)
614 if (h->family == FW3_FAMILY_V6)
616 rv = ip6tc_commit(h->handle);
618 warn("ip6tc_commit(): %s", ip6tc_strerror(errno));
623 rv = iptc_commit(h->handle);
625 warn("iptc_commit(): %s", iptc_strerror(errno));
630 fw3_ipt_close(struct fw3_ipt_handle *h)
632 fw3_unlock_path(&xt_lock_fd, XT_LOCK_NAME);
636 struct fw3_ipt_rule *
637 fw3_ipt_rule_new(struct fw3_ipt_handle *h)
639 struct fw3_ipt_rule *r;
641 r = fw3_alloc(sizeof(*r));
644 r->argv = fw3_alloc(sizeof(char *));
645 r->argv[r->argc++] = "fw3";
652 get_protoname(struct fw3_ipt_rule *r)
654 const struct xtables_pprot *pp;
657 for (pp = xtables_chain_protos; pp->name; pp++)
658 if (pp->num == r->protocol)
659 return (char *)pp->name;
664 static struct xtables_match *
665 find_match(struct fw3_ipt_rule *r, const char *name)
667 struct xtables_match *m;
670 m = xtables_find_match(name, XTF_TRY_LOAD, &r->matches);
677 init_match(struct fw3_ipt_rule *r, struct xtables_match *m, bool no_clone)
680 struct xtables_globals *g;
685 s = XT_ALIGN(sizeof(struct xt_entry_match)) + m->size;
689 fw3_xt_set_match_name(m);
691 m->m->u.user.revision = m->revision;
692 m->m->u.match_size = s;
694 /* free previous userspace data */
695 fw3_xt_free_match_udata(m);
700 /* don't merge options if no_clone is set and this match is a clone */
701 if (no_clone && (m == m->next))
704 /* merge option table */
705 g = (r->h->family == FW3_FAMILY_V6) ? &xtg6 : &xtg;
706 fw3_xt_merge_match_options(g, m);
710 need_protomatch(struct fw3_ipt_rule *r, const char *pname)
715 if (!xtables_find_match(pname, XTF_DONT_LOAD, NULL))
718 return !r->protocol_loaded;
721 static struct xtables_match *
722 load_protomatch(struct fw3_ipt_rule *r)
724 const char *pname = get_protoname(r);
726 if (!need_protomatch(r, pname))
729 return find_match(r, pname);
732 static struct xtables_target *
733 find_target(struct fw3_ipt_rule *r, const char *name)
735 struct xtables_target *t;
739 if (is_chain(r->h, name))
740 t = xtables_find_target(XT_STANDARD_TARGET, XTF_TRY_LOAD);
742 t = xtables_find_target(name, XTF_TRY_LOAD);
749 static struct xtables_target *
750 get_target(struct fw3_ipt_rule *r, const char *name)
753 struct xtables_target *t;
754 struct xtables_globals *g;
756 t = find_target(r, name);
761 s = XT_ALIGN(sizeof(struct xt_entry_target)) + t->size;
764 fw3_xt_set_target_name(t, name);
766 t->t->u.user.revision = t->revision;
767 t->t->u.target_size = s;
769 /* free previous userspace data */
770 fw3_xt_free_target_udata(t);
775 /* merge option table */
776 g = (r->h->family == FW3_FAMILY_V6) ? &xtg6 : &xtg;
777 fw3_xt_merge_target_options(g, t);
785 fw3_ipt_rule_proto(struct fw3_ipt_rule *r, struct fw3_protocol *proto)
789 if (!proto || proto->any)
792 pr = proto->protocol;
795 if (r->h->family == FW3_FAMILY_V6)
800 r->e6.ipv6.proto = pr;
801 r->e6.ipv6.flags |= IP6T_F_PROTO;
804 r->e6.ipv6.invflags |= XT_INV_PROTO;
812 r->e.ip.invflags |= XT_INV_PROTO;
819 fw3_ipt_rule_in_out(struct fw3_ipt_rule *r,
820 struct fw3_device *in, struct fw3_device *out)
823 if (r->h->family == FW3_FAMILY_V6)
827 xtables_parse_interface(in->name, r->e6.ipv6.iniface,
828 r->e6.ipv6.iniface_mask);
831 r->e6.ipv6.invflags |= IP6T_INV_VIA_IN;
834 if (out && !out->any)
836 xtables_parse_interface(out->name, r->e6.ipv6.outiface,
837 r->e6.ipv6.outiface_mask);
840 r->e6.ipv6.invflags |= IP6T_INV_VIA_OUT;
848 xtables_parse_interface(in->name, r->e.ip.iniface,
849 r->e.ip.iniface_mask);
852 r->e.ip.invflags |= IPT_INV_VIA_IN;
855 if (out && !out->any)
857 xtables_parse_interface(out->name, r->e.ip.outiface,
858 r->e.ip.outiface_mask);
861 r->e.ip.invflags |= IPT_INV_VIA_OUT;
868 fw3_ipt_rule_src_dest(struct fw3_ipt_rule *r,
869 struct fw3_address *src, struct fw3_address *dest)
871 if ((src && src->range) || (dest && dest->range))
873 fw3_ipt_rule_addarg(r, false, "-m", "iprange");
880 fw3_ipt_rule_addarg(r, src->invert, "--src-range",
881 fw3_address_to_string(src, false, false));
884 else if (r->h->family == FW3_FAMILY_V6)
886 r->e6.ipv6.src = src->address.v6;
887 r->e6.ipv6.smsk = src->mask.v6;
890 for (i = 0; i < 4; i++)
891 r->e6.ipv6.src.s6_addr32[i] &= r->e6.ipv6.smsk.s6_addr32[i];
894 r->e6.ipv6.invflags |= IP6T_INV_SRCIP;
899 r->e.ip.src = src->address.v4;
900 r->e.ip.smsk = src->mask.v4;
902 r->e.ip.src.s_addr &= r->e.ip.smsk.s_addr;
905 r->e.ip.invflags |= IPT_INV_SRCIP;
909 if (dest && dest->set)
913 fw3_ipt_rule_addarg(r, dest->invert, "--dst-range",
914 fw3_address_to_string(dest, false, false));
917 else if (r->h->family == FW3_FAMILY_V6)
919 r->e6.ipv6.dst = dest->address.v6;
920 r->e6.ipv6.dmsk = dest->mask.v6;
923 for (i = 0; i < 4; i++)
924 r->e6.ipv6.dst.s6_addr32[i] &= r->e6.ipv6.dmsk.s6_addr32[i];
927 r->e6.ipv6.invflags |= IP6T_INV_DSTIP;
932 r->e.ip.dst = dest->address.v4;
933 r->e.ip.dmsk = dest->mask.v4;
935 r->e.ip.dst.s_addr &= r->e.ip.dmsk.s_addr;
938 r->e.ip.invflags |= IPT_INV_DSTIP;
944 fw3_ipt_rule_sport_dport(struct fw3_ipt_rule *r,
945 struct fw3_port *sp, struct fw3_port *dp)
947 char buf[sizeof("65535:65535")];
949 if ((!sp || !sp->set) && (!dp || !dp->set))
952 if (!get_protoname(r))
957 if (sp->port_min == sp->port_max)
958 snprintf(buf, sizeof(buf), "%u", sp->port_min);
960 snprintf(buf, sizeof(buf), "%u:%u", sp->port_min, sp->port_max);
962 fw3_ipt_rule_addarg(r, sp->invert, "--sport", buf);
967 if (dp->port_min == dp->port_max)
968 snprintf(buf, sizeof(buf), "%u", dp->port_min);
970 snprintf(buf, sizeof(buf), "%u:%u", dp->port_min, dp->port_max);
972 fw3_ipt_rule_addarg(r, dp->invert, "--dport", buf);
977 fw3_ipt_rule_device(struct fw3_ipt_rule *r, const char *device, bool out)
979 struct fw3_device dev = { .any = false };
982 snprintf(dev.name, sizeof(dev.name), "%s", device);
983 fw3_ipt_rule_in_out(r, (out) ? NULL : &dev, (out) ? &dev : NULL);
988 fw3_ipt_rule_mac(struct fw3_ipt_rule *r, struct fw3_mac *mac)
990 char buf[sizeof("ff:ff:ff:ff:ff:ff")];
991 uint8_t *addr = mac->mac.ether_addr_octet;
996 snprintf(buf, sizeof(buf), "%02x:%02x:%02x:%02x:%02x:%02x",
997 addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]);
999 fw3_ipt_rule_addarg(r, false, "-m", "mac");
1000 fw3_ipt_rule_addarg(r, mac->invert, "--mac-source", buf);
1004 fw3_ipt_rule_icmptype(struct fw3_ipt_rule *r, struct fw3_icmptype *icmp)
1006 char buf[sizeof("255/255")];
1011 #ifndef DISABLE_IPV6
1012 if (r->h->family == FW3_FAMILY_V6)
1014 if (icmp->code6_min == 0 && icmp->code6_max == 0xFF)
1015 snprintf(buf, sizeof(buf), "%u", icmp->type6);
1017 snprintf(buf, sizeof(buf), "%u/%u", icmp->type6, icmp->code6_min);
1019 fw3_ipt_rule_addarg(r, icmp->invert, "--icmpv6-type", buf);
1024 if (icmp->code_min == 0 && icmp->code_max == 0xFF)
1025 sprintf(buf, "%u", icmp->type);
1027 snprintf(buf, sizeof(buf), "%u/%u", icmp->type, icmp->code_min);
1029 fw3_ipt_rule_addarg(r, icmp->invert, "--icmp-type", buf);
1034 fw3_ipt_rule_limit(struct fw3_ipt_rule *r, struct fw3_limit *limit)
1036 char buf[sizeof("-4294967296/second")];
1038 if (!limit || limit->rate <= 0)
1041 fw3_ipt_rule_addarg(r, false, "-m", "limit");
1043 snprintf(buf, sizeof(buf), "%u/%s", limit->rate, fw3_limit_units[limit->unit]);
1044 fw3_ipt_rule_addarg(r, limit->invert, "--limit", buf);
1046 if (limit->burst > 0)
1048 snprintf(buf, sizeof(buf), "%u", limit->burst);
1049 fw3_ipt_rule_addarg(r, limit->invert, "--limit-burst", buf);
1054 fw3_ipt_rule_ipset(struct fw3_ipt_rule *r, struct fw3_setmatch *match)
1056 char buf[sizeof("dst,dst,dst")];
1059 size_t rem = sizeof(buf);
1061 struct fw3_ipset *set;
1062 struct fw3_ipset_datatype *type;
1064 if (!match || !match->set || !match->ptr)
1068 list_for_each_entry(type, &set->datatypes, list)
1082 len = snprintf(p, rem, "%s", match->dir[i] ? match->dir[i] : type->dir);
1084 if (len < 0 || len >= rem)
1093 fw3_ipt_rule_addarg(r, false, "-m", "set");
1095 fw3_ipt_rule_addarg(r, match->invert, "--match-set",
1096 set->external ? set->external : set->name);
1098 fw3_ipt_rule_addarg(r, false, buf, NULL);
1102 fw3_ipt_rule_helper(struct fw3_ipt_rule *r, struct fw3_cthelpermatch *match)
1104 if (!match || !match->set || !match->ptr)
1107 fw3_ipt_rule_addarg(r, false, "-m", "helper");
1108 fw3_ipt_rule_addarg(r, match->invert, "--helper", match->ptr->name);
1112 fw3_ipt_rule_time(struct fw3_ipt_rule *r, struct fw3_time *time)
1115 struct tm empty = { 0 };
1117 char buf[84]; /* sizeof("1,2,3,...,30,31") */
1120 bool d1 = memcmp(&time->datestart, &empty, sizeof(empty));
1121 bool d2 = memcmp(&time->datestop, &empty, sizeof(empty));
1125 if (!d1 && !d2 && !time->timestart && !time->timestop &&
1126 !(time->monthdays & 0xFFFFFFFE) && !(time->weekdays & 0xFE))
1131 fw3_ipt_rule_addarg(r, false, "-m", "time");
1134 fw3_ipt_rule_addarg(r, false, "--kerneltz", NULL);
1138 strftime(buf, sizeof(buf), "%Y-%m-%dT%H:%M:%S", &time->datestart);
1139 fw3_ipt_rule_addarg(r, false, "--datestart", buf);
1144 strftime(buf, sizeof(buf), "%Y-%m-%dT%H:%M:%S", &time->datestop);
1145 fw3_ipt_rule_addarg(r, false, "--datestop", buf);
1148 if (time->timestart)
1150 snprintf(buf, sizeof(buf), "%02d:%02d:%02d",
1151 time->timestart / 3600,
1152 time->timestart % 3600 / 60,
1153 time->timestart % 60);
1155 fw3_ipt_rule_addarg(r, false, "--timestart", buf);
1160 snprintf(buf, sizeof(buf), "%02d:%02d:%02d",
1161 time->timestop / 3600,
1162 time->timestop % 3600 / 60,
1163 time->timestop % 60);
1165 fw3_ipt_rule_addarg(r, false, "--timestop", buf);
1168 if (time->monthdays & 0xFFFFFFFE)
1170 for (i = 1, p = buf, rem = sizeof(buf); i < 32; i++)
1172 if (fw3_hasbit(time->monthdays, i))
1183 len = snprintf(p, rem, "%u", i);
1185 if (len < 0 || len >= rem)
1193 fw3_ipt_rule_addarg(r, fw3_hasbit(time->monthdays, 0), "--monthdays", buf);
1196 if (time->weekdays & 0xFE)
1198 for (i = 1, p = buf, rem = sizeof(buf); i < 8; i++)
1200 if (fw3_hasbit(time->weekdays, i))
1211 p += snprintf(p, rem, "%u", i);
1213 if (len < 0 || len >= rem)
1221 fw3_ipt_rule_addarg(r, fw3_hasbit(time->weekdays, 0), "--weekdays", buf);
1226 fw3_ipt_rule_mark(struct fw3_ipt_rule *r, struct fw3_mark *mark)
1228 char buf[sizeof("0xFFFFFFFF/0xFFFFFFFF")];
1230 if (!mark || !mark->set)
1233 if (mark->mask < 0xFFFFFFFF)
1234 snprintf(buf, sizeof(buf), "0x%x/0x%x", mark->mark, mark->mask);
1236 snprintf(buf, sizeof(buf), "0x%x", mark->mark);
1238 fw3_ipt_rule_addarg(r, false, "-m", "mark");
1239 fw3_ipt_rule_addarg(r, mark->invert, "--mark", buf);
1243 fw3_ipt_rule_dscp(struct fw3_ipt_rule *r, struct fw3_dscp *dscp)
1245 char buf[sizeof("0xFF")];
1247 if (!dscp || !dscp->set)
1250 snprintf(buf, sizeof(buf), "0x%x", dscp->dscp);
1252 fw3_ipt_rule_addarg(r, false, "-m", "dscp");
1253 fw3_ipt_rule_addarg(r, dscp->invert, "--dscp", buf);
1257 fw3_ipt_rule_comment(struct fw3_ipt_rule *r, const char *fmt, ...)
1266 vsnprintf(buf, sizeof(buf), fmt, ap);
1269 fw3_ipt_rule_addarg(r, false, "-m", "comment");
1270 fw3_ipt_rule_addarg(r, false, "--comment", buf);
1274 fw3_ipt_rule_extra(struct fw3_ipt_rule *r, const char *extra)
1278 if (!extra || !*extra)
1281 s = fw3_strdup(extra);
1283 for (p = strtok(s, " \t"); p; p = strtok(NULL, " \t"))
1285 tmp = realloc(r->argv, (r->argc + 1) * sizeof(*r->argv));
1291 r->argv[r->argc++] = fw3_strdup(p);
1297 #ifndef DISABLE_IPV6
1299 rule_print6(struct ip6t_entry *e)
1301 char buf1[INET6_ADDRSTRLEN], buf2[INET6_ADDRSTRLEN];
1304 if (e->ipv6.flags & IP6T_F_PROTO)
1306 if (e->ipv6.invflags & XT_INV_PROTO)
1309 pname = get_protoname(container_of(e, struct fw3_ipt_rule, e6));
1312 printf(" -p %s", pname);
1314 printf(" -p %u", e->ipv6.proto);
1317 if (e->ipv6.iniface[0])
1319 if (e->ipv6.invflags & IP6T_INV_VIA_IN)
1322 printf(" -i %s", e->ipv6.iniface);
1325 if (e->ipv6.outiface[0])
1327 if (e->ipv6.invflags & IP6T_INV_VIA_OUT)
1330 printf(" -o %s", e->ipv6.outiface);
1333 if (memcmp(&e->ipv6.src, &in6addr_any, sizeof(struct in6_addr)))
1335 if (e->ipv6.invflags & IP6T_INV_SRCIP)
1339 inet_ntop(AF_INET6, &e->ipv6.src, buf1, sizeof(buf1)),
1340 inet_ntop(AF_INET6, &e->ipv6.smsk, buf2, sizeof(buf2)));
1343 if (memcmp(&e->ipv6.dst, &in6addr_any, sizeof(struct in6_addr)))
1345 if (e->ipv6.invflags & IP6T_INV_DSTIP)
1349 inet_ntop(AF_INET6, &e->ipv6.dst, buf1, sizeof(buf1)),
1350 inet_ntop(AF_INET6, &e->ipv6.dmsk, buf2, sizeof(buf2)));
1356 rule_print4(struct ipt_entry *e)
1358 struct in_addr in_zero = { 0 };
1359 char buf1[sizeof("255.255.255.255")], buf2[sizeof("255.255.255.255")];
1364 if (e->ip.invflags & XT_INV_PROTO)
1367 pname = get_protoname(container_of(e, struct fw3_ipt_rule, e));
1370 printf(" -p %s", pname);
1372 printf(" -p %u", e->ip.proto);
1375 if (e->ip.iniface[0])
1377 if (e->ip.invflags & IPT_INV_VIA_IN)
1380 printf(" -i %s", e->ip.iniface);
1383 if (e->ip.outiface[0])
1385 if (e->ip.invflags & IPT_INV_VIA_OUT)
1388 printf(" -o %s", e->ip.outiface);
1391 if (memcmp(&e->ip.src, &in_zero, sizeof(struct in_addr)))
1393 if (e->ip.invflags & IPT_INV_SRCIP)
1397 inet_ntop(AF_INET, &e->ip.src, buf1, sizeof(buf1)),
1398 inet_ntop(AF_INET, &e->ip.smsk, buf2, sizeof(buf2)));
1401 if (memcmp(&e->ip.dst, &in_zero, sizeof(struct in_addr)))
1403 if (e->ip.invflags & IPT_INV_DSTIP)
1407 inet_ntop(AF_INET, &e->ip.dst, buf1, sizeof(buf1)),
1408 inet_ntop(AF_INET, &e->ip.dmsk, buf2, sizeof(buf2)));
1413 rule_print(struct fw3_ipt_rule *r, const char *prefix, const char *chain)
1415 debug(r->h, "%s %s", prefix, chain);
1417 #ifndef DISABLE_IPV6
1418 if (r->h->family == FW3_FAMILY_V6)
1419 rule_print6(&r->e6);
1424 fw3_xt_print_matches(&r->e.ip, r->matches);
1425 fw3_xt_print_target(&r->e.ip, r->target);
1431 parse_option(struct fw3_ipt_rule *r, int optc, bool inv)
1433 struct xtables_rule_match *m;
1434 struct xtables_match *em;
1436 /* is a target option */
1437 if (r->target && fw3_xt_has_target_parse(r->target) &&
1438 optc >= r->target->option_offset &&
1439 optc < (r->target->option_offset + 256))
1441 xtables_option_tpcall(optc, r->argv, inv, r->target, &r->e);
1445 /* try to dispatch argument to one of the match parsers */
1446 for (m = r->matches; m; m = m->next)
1450 if (m->completed || !fw3_xt_has_match_parse(em))
1453 if (optc < em->option_offset ||
1454 optc >= (em->option_offset + 256))
1457 xtables_option_mpcall(optc, r->argv, inv, em, &r->e);
1461 /* unhandled option, might belong to a protocol match */
1462 if ((em = load_protomatch(r)) != NULL)
1464 init_match(r, em, false);
1466 r->protocol_loaded = true;
1473 warn("parse_option(): option '%s' needs argument", r->argv[optind-1]);
1476 warn("parse_option(): unknown option '%s'", r->argv[optind-1]);
1482 fw3_ipt_rule_addarg(struct fw3_ipt_rule *r, bool inv,
1483 const char *k, const char *v)
1491 n = inv + !!k + !!v;
1492 tmp = realloc(r->argv, (r->argc + n) * sizeof(*tmp));
1500 r->argv[r->argc++] = fw3_strdup("!");
1502 r->argv[r->argc++] = fw3_strdup(k);
1505 r->argv[r->argc++] = fw3_strdup(v);
1508 static unsigned char *
1509 rule_mask(struct fw3_ipt_rule *r)
1512 unsigned char *p, *mask = NULL;
1513 struct xtables_rule_match *m;
1515 #define SZ(x) XT_ALIGN(sizeof(struct x))
1517 #ifndef DISABLE_IPV6
1518 if (r->h->family == FW3_FAMILY_V6)
1522 for (m = r->matches; m; m = m->next)
1523 s += SZ(ip6t_entry_match) + m->match->size;
1525 s += SZ(ip6t_entry_target);
1527 s += r->target->size;
1529 mask = fw3_alloc(s);
1530 memset(mask, 0xFF, SZ(ip6t_entry));
1531 p = mask + SZ(ip6t_entry);
1533 for (m = r->matches; m; m = m->next)
1535 memset(p, 0xFF, SZ(ip6t_entry_match) + m->match->userspacesize);
1536 p += SZ(ip6t_entry_match) + m->match->size;
1539 memset(p, 0xFF, SZ(ip6t_entry_target) + (r->target ? r->target->userspacesize : 0));
1546 for (m = r->matches; m; m = m->next)
1547 s += SZ(ipt_entry_match) + m->match->size;
1549 s += SZ(ipt_entry_target);
1551 s += r->target->size;
1553 mask = fw3_alloc(s);
1554 memset(mask, 0xFF, SZ(ipt_entry));
1555 p = mask + SZ(ipt_entry);
1557 for (m = r->matches; m; m = m->next)
1559 memset(p, 0xFF, SZ(ipt_entry_match) + m->match->userspacesize);
1560 p += SZ(ipt_entry_match) + m->match->size;
1563 memset(p, 0xFF, SZ(ipt_entry_target) + (r->target ? r->target->userspacesize : 0));
1570 rule_build(struct fw3_ipt_rule *r)
1572 size_t s, target_size = (r->target) ? r->target->t->u.target_size : 0;
1573 struct xtables_rule_match *m;
1575 #ifndef DISABLE_IPV6
1576 if (r->h->family == FW3_FAMILY_V6)
1578 struct ip6t_entry *e6;
1580 s = XT_ALIGN(sizeof(struct ip6t_entry));
1582 for (m = r->matches; m; m = m->next)
1583 s += m->match->m->u.match_size;
1585 e6 = fw3_alloc(s + target_size);
1587 memcpy(e6, &r->e6, sizeof(struct ip6t_entry));
1589 e6->target_offset = s;
1590 e6->next_offset = s + target_size;
1594 for (m = r->matches; m; m = m->next)
1596 memcpy(e6->elems + s, m->match->m, m->match->m->u.match_size);
1597 s += m->match->m->u.match_size;
1601 memcpy(e6->elems + s, r->target->t, target_size);
1608 struct ipt_entry *e;
1610 s = XT_ALIGN(sizeof(struct ipt_entry));
1612 for (m = r->matches; m; m = m->next)
1613 s += m->match->m->u.match_size;
1615 e = fw3_alloc(s + target_size);
1617 memcpy(e, &r->e, sizeof(struct ipt_entry));
1619 e->target_offset = s;
1620 e->next_offset = s + target_size;
1624 for (m = r->matches; m; m = m->next)
1626 memcpy(e->elems + s, m->match->m, m->match->m->u.match_size);
1627 s += m->match->m->u.match_size;
1631 memcpy(e->elems + s, r->target->t, target_size);
1638 set_rule_tag(struct fw3_ipt_rule *r)
1642 const char *tag = "!fw3";
1644 for (i = 0; i < r->argc; i++)
1645 if (!strcmp(r->argv[i], "--comment") && (i + 1) < r->argc)
1646 if (asprintf(&p, "%s: %s", tag, r->argv[i + 1]) > 0)
1648 free(r->argv[i + 1]);
1653 tmp = realloc(r->argv, (r->argc + 4) * sizeof(*r->argv));
1658 r->argv[r->argc++] = fw3_strdup("-m");
1659 r->argv[r->argc++] = fw3_strdup("comment");
1660 r->argv[r->argc++] = fw3_strdup("--comment");
1661 r->argv[r->argc++] = fw3_strdup(tag);
1666 __fw3_ipt_rule_append(struct fw3_ipt_rule *r, bool repl, const char *fmt, ...)
1669 unsigned char *mask;
1671 struct xtables_rule_match *m;
1672 struct xtables_match *em;
1673 struct xtables_target *et;
1674 struct xtables_globals *g;
1676 struct fw3_device dev;
1677 struct fw3_address addr;
1679 enum xtables_exittype status;
1687 vsnprintf(buf, sizeof(buf) - 1, fmt, ap);
1690 g = (r->h->family == FW3_FAMILY_V6) ? &xtg6 : &xtg;
1691 g->opts = g->orig_opts;
1696 status = setjmp(fw3_ipt_error_jmp);
1700 info(" ! Skipping due to previous exception (code %u)", status);
1706 while ((optc = getopt_long(r->argc, r->argv, "-:m:j:i:o:s:d:", g->opts,
1712 em = find_match(r, optarg);
1716 warn("fw3_ipt_rule_append(): Can't find match '%s'", optarg);
1720 init_match(r, em, true);
1724 et = get_target(r, optarg);
1728 warn("fw3_ipt_rule_append(): Can't find target '%s'", optarg);
1736 if (!fw3_parse_device(&dev, optarg, false) ||
1737 dev.any || dev.invert || *dev.network)
1739 warn("fw3_ipt_rule_append(): Bad argument '%s'", optarg);
1744 fw3_ipt_rule_in_out(r, (optc == 'i') ? &dev : NULL,
1745 (optc == 'o') ? &dev : NULL);
1750 if (!fw3_parse_address(&addr, optarg, false) ||
1751 addr.range || addr.invert)
1753 warn("fw3_ipt_rule_append(): Bad argument '%s'", optarg);
1758 fw3_ipt_rule_src_dest(r, (optc == 's') ? &addr : NULL,
1759 (optc == 'd') ? &addr : NULL);
1763 if ((optarg[0] == '!') && (optarg[1] == '\0'))
1770 warn("fw3_ipt_rule_append(): Bad argument '%s'", optarg);
1774 if (parse_option(r, optc, inv))
1782 for (m = r->matches; m; m = m->next)
1783 xtables_option_mfcall(m->match);
1786 xtables_option_tfcall(r->target);
1788 rule = rule_build(r);
1790 #ifndef DISABLE_IPV6
1791 if (r->h->family == FW3_FAMILY_V6)
1795 mask = rule_mask(r);
1797 while (ip6tc_delete_entry(buf, rule, mask, r->h->handle))
1799 rule_print(r, "-D", buf);
1805 rule_print(r, "-A", buf);
1807 if (!ip6tc_append_entry(buf, rule, r->h->handle))
1808 warn("ip6tc_append_entry(): %s", ip6tc_strerror(errno));
1815 mask = rule_mask(r);
1817 while (iptc_delete_entry(buf, rule, mask, r->h->handle))
1819 rule_print(r, "-D", buf);
1825 rule_print(r, "-A", buf);
1827 if (!iptc_append_entry(buf, rule, r->h->handle))
1828 warn("iptc_append_entry(): %s\n", iptc_strerror(errno));
1834 for (i = 1; i < r->argc; i++)
1839 xtables_rule_matches_free(&r->matches);
1846 /* reset all targets and matches */
1847 for (em = xtables_matches; em; em = em->next)
1850 for (et = xtables_targets; et; et = et->next)
1856 xtables_free_opts(1);
1859 struct fw3_ipt_rule *
1860 fw3_ipt_rule_create(struct fw3_ipt_handle *handle, struct fw3_protocol *proto,
1861 struct fw3_device *in, struct fw3_device *out,
1862 struct fw3_address *src, struct fw3_address *dest)
1864 struct fw3_ipt_rule *r;
1866 r = fw3_ipt_rule_new(handle);
1868 fw3_ipt_rule_proto(r, proto);
1869 fw3_ipt_rule_in_out(r, in, out);
1870 fw3_ipt_rule_src_dest(r, src, dest);
1876 xtables_register_match(struct xtables_match *me)
1879 static struct xtables_match **tmp;
1881 if (!xext.register_match)
1882 xext.register_match = dlsym(RTLD_NEXT, "xtables_register_match");
1884 if (!xext.register_match)
1887 xext.register_match(me);
1891 for (i = 0; i < xext.mcount; i++)
1892 if (xext.matches[i] == me)
1895 tmp = realloc(xext.matches, sizeof(me) * (xext.mcount + 1));
1901 xext.matches[xext.mcount++] = me;
1906 xtables_register_target(struct xtables_target *me)
1909 static struct xtables_target **tmp;
1911 if (!xext.register_target)
1912 xext.register_target = dlsym(RTLD_NEXT, "xtables_register_target");
1914 if (!xext.register_target)
1917 xext.register_target(me);
1921 for (i = 0; i < xext.tcount; i++)
1922 if (xext.targets[i] == me)
1925 tmp = realloc(xext.targets, sizeof(me) * (xext.tcount + 1));
1931 xext.targets[xext.tcount++] = me;