X-Git-Url: http://git.openwrt.org/?a=blobdiff_plain;f=iptables.c;h=2a0d0ee29f453dba28025a269c917e76f9f7bb2c;hb=c5c87e46994635c11b75d01129a57ba42570fa03;hp=694dd4f6ab9a94bf58863a5acd9b1e11c8390239;hpb=635d8b088607ccb7a3124ce43469cda52150f484;p=project%2Ffirewall3.git diff --git a/iptables.c b/iptables.c index 694dd4f..2a0d0ee 100644 --- a/iptables.c +++ b/iptables.c @@ -1,7 +1,7 @@ /* * firewall3 - 3rd OpenWrt UCI firewall implementation * - * Copyright (C) 2013 Jo-Philipp Wich + * Copyright (C) 2013 Jo-Philipp Wich * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -37,6 +37,16 @@ static struct xtables_globals xtg6 = { .orig_opts = base_opts, }; +static struct { + bool retain; + int mcount, tcount; + struct xtables_match **matches; + struct xtables_target **targets; + void (*register_match)(struct xtables_match *); + void (*register_target)(struct xtables_target *); +} xext; + + /* Required by certain extensions like SNAT and DNAT */ int kernel_version = 0; @@ -53,27 +63,20 @@ get_kernel_version(void) kernel_version = 0x10000 * x + 0x100 * y + z; } -#ifdef DISABLE_IPV6 -#undef __ipt_module -#define __ipt_module(x) libxt_##x##_init, libipt_##x##_init, -#else -#undef __ipt_module -#define __ipt_module(x) libxt_##x##_init, libipt_##x##_init, libip6t_##x##_init, -#endif - static void fw3_init_extensions(void) { - int i; - void (*initfuncs[])(void) = { FW3_IPT_MODULES }; + init_extensions(); + init_extensions4(); - for (i = 0; i < sizeof(initfuncs)/sizeof(initfuncs[0]); i++) - if (initfuncs[i]) - initfuncs[i](); +#ifndef DISABLE_IPV6 + init_extensions6(); +#endif } struct fw3_ipt_handle * fw3_ipt_open(enum fw3_family family, enum fw3_table table) { + int i; struct fw3_ipt_handle *h; h = fw3_alloc(sizeof(*h)); @@ -110,6 +113,14 @@ fw3_ipt_open(enum fw3_family family, enum fw3_table table) fw3_xt_reset(); fw3_init_extensions(); + if (xext.register_match) + for (i = 0; i < xext.mcount; i++) + xext.register_match(xext.matches[i]); + + if (xext.register_target) + for (i = 0; i < xext.tcount; i++) + xext.register_target(xext.targets[i]); + return h; } @@ -241,6 +252,96 @@ fw3_ipt_delete_chain(struct fw3_ipt_handle *h, const char *chain) iptc_delete_chain(chain, h->handle); } +static int +get_rule_id(const void *base, unsigned int start, unsigned int end) +{ + uint32_t id; + unsigned int i; + const struct xt_entry_match *em; + + for (i = start; i < end; i += em->u.match_size) + { + em = base + i; + + if (strcmp(em->u.user.name, "id")) + continue; + + memcpy(&id, em->data, sizeof(id)); + + if ((id & FW3_ID_MASK) != FW3_ID_MAGIC) + continue; + + return (id & ~FW3_ID_MASK); + } + + return -1; +} + +void +fw3_ipt_delete_id_rules(struct fw3_ipt_handle *h, const char *chain) +{ + unsigned int num; + const struct ipt_entry *e; + bool found; + int id; + +#ifndef DISABLE_IPV6 + if (h->family == FW3_FAMILY_V6) + { + if (!ip6tc_is_chain(chain, h->handle)) + return; + + do { + found = false; + + const struct ip6t_entry *e6; + for (num = 0, e6 = ip6tc_first_rule(chain, h->handle); + e6 != NULL; + num++, e6 = ip6tc_next_rule(e6, h->handle)) + { + id = get_rule_id(e6, sizeof(*e6), e6->target_offset); + + if (id >= 0) + { + if (fw3_pr_debug) + debug(h, "-D %s %u\n", chain, num + 1); + + ip6tc_delete_num_entry(chain, num, h->handle); + found = true; + break; + } + } + } while (found); + } + else +#endif + { + if (!iptc_is_chain(chain, h->handle)) + return; + + do { + found = false; + + for (num = 0, e = iptc_first_rule(chain, h->handle); + e != NULL; + num++, e = iptc_next_rule(e, h->handle)) + { + id = get_rule_id(e, sizeof(*e), e->target_offset); + + if (id >= 0) + { + if (fw3_pr_debug) + debug(h, "-D %s %u\n", chain, num + 1); + + iptc_delete_num_entry(chain, num, h->handle); + found = true; + break; + } + } + } while (found); + } +} + void fw3_ipt_create_chain(struct fw3_ipt_handle *h, const char *fmt, ...) { @@ -298,6 +399,69 @@ fw3_ipt_flush(struct fw3_ipt_handle *h) } } +static bool +chain_is_empty(struct fw3_ipt_handle *h, const char *chain) +{ +#ifndef DISABLE_IPV6 + if (h->family == FW3_FAMILY_V6) + return (!ip6tc_builtin(chain, h->handle) && + !ip6tc_first_rule(chain, h->handle)); +#endif + + return (!iptc_builtin(chain, h->handle) && + !iptc_first_rule(chain, h->handle)); +} + +void +fw3_ipt_gc(struct fw3_ipt_handle *h) +{ + const char *chain; + bool found; + +#ifndef DISABLE_IPV6 + if (h->family == FW3_FAMILY_V6) + { + do { + found = false; + + for (chain = ip6tc_first_chain(h->handle); + chain != NULL; + chain = ip6tc_next_chain(h->handle)) + { + if (!chain_is_empty(h, chain)) + continue; + + fw3_ipt_delete_chain(h, chain); + found = true; + break; + } + } while(found); + } + else +#endif + { + do { + found = false; + + for (chain = iptc_first_chain(h->handle); + chain != NULL; + chain = iptc_next_chain(h->handle)) + { + warn("C=%s\n", chain); + + if (!chain_is_empty(h, chain)) + continue; + + warn("D=%s\n", chain); + + fw3_ipt_delete_chain(h, chain); + found = true; + break; + } + } while (found); + } +} + void fw3_ipt_commit(struct fw3_ipt_handle *h) { @@ -322,17 +486,6 @@ fw3_ipt_commit(struct fw3_ipt_handle *h) void fw3_ipt_close(struct fw3_ipt_handle *h) { - if (h->libv) - { - while (h->libc > 0) - { - h->libc--; - dlclose(h->libv[h->libc]); - } - - free(h->libv); - } - free(h); } @@ -344,6 +497,7 @@ fw3_ipt_rule_new(struct fw3_ipt_handle *h) r = fw3_alloc(sizeof(*r)); r->h = h; + r->id = 0; r->argv = fw3_alloc(sizeof(char *)); r->argv[r->argc++] = "fw3"; @@ -379,9 +533,11 @@ static bool load_extension(struct fw3_ipt_handle *h, const char *name) { char path[256]; - void *lib, **tmp; + void *lib; const char *pfx = (h->family == FW3_FAMILY_V6) ? "libip6t" : "libipt"; + xext.retain = true; + snprintf(path, sizeof(path), "/usr/lib/iptables/libxt_%s.so", name); if (!(lib = dlopen(path, RTLD_NOW))) { @@ -389,18 +545,9 @@ load_extension(struct fw3_ipt_handle *h, const char *name) lib = dlopen(path, RTLD_NOW); } - if (!lib) - return false; - - tmp = realloc(h->libv, sizeof(lib) * (h->libc + 1)); - - if (!tmp) - return false; - - h->libv = tmp; - h->libv[h->libc++] = lib; + xext.retain = false; - return true; + return !!lib; } static struct xtables_match * @@ -606,34 +753,6 @@ fw3_ipt_rule_in_out(struct fw3_ipt_rule *r, } -static void -ip4prefix2mask(int prefix, struct in_addr *mask) -{ - if (prefix > 0) - mask->s_addr = htonl(~((1 << (32 - prefix)) - 1)); - else - mask->s_addr = 0; -} - -#ifndef DISABLE_IPV6 -static void -ip6prefix2mask(int prefix, struct in6_addr *mask) -{ - char *p = (char *)mask; - - if (prefix > 0) - { - memset(p, 0xff, prefix / 8); - memset(p + (prefix / 8) + 1, 0, (128 - prefix) / 8); - p[prefix / 8] = 0xff << (8 - (prefix & 7)); - } - else - { - memset(mask, 0, sizeof(*mask)); - } -} -#endif - void fw3_ipt_rule_src_dest(struct fw3_ipt_rule *r, struct fw3_address *src, struct fw3_address *dest) @@ -648,13 +767,13 @@ fw3_ipt_rule_src_dest(struct fw3_ipt_rule *r, if (src->range) { fw3_ipt_rule_addarg(r, src->invert, "--src-range", - fw3_address_to_string(src, false)); + fw3_address_to_string(src, false, false)); } #ifndef DISABLE_IPV6 else if (r->h->family == FW3_FAMILY_V6) { r->e6.ipv6.src = src->address.v6; - ip6prefix2mask(src->mask, &r->e6.ipv6.smsk); + r->e6.ipv6.smsk = src->mask.v6; int i; for (i = 0; i < 4; i++) @@ -667,7 +786,7 @@ fw3_ipt_rule_src_dest(struct fw3_ipt_rule *r, else { r->e.ip.src = src->address.v4; - ip4prefix2mask(src->mask, &r->e.ip.smsk); + r->e.ip.smsk = src->mask.v4; r->e.ip.src.s_addr &= r->e.ip.smsk.s_addr; @@ -681,13 +800,13 @@ fw3_ipt_rule_src_dest(struct fw3_ipt_rule *r, if (dest->range) { fw3_ipt_rule_addarg(r, dest->invert, "--dst-range", - fw3_address_to_string(dest, false)); + fw3_address_to_string(dest, false, false)); } #ifndef DISABLE_IPV6 else if (r->h->family == FW3_FAMILY_V6) { r->e6.ipv6.dst = dest->address.v6; - ip6prefix2mask(dest->mask, &r->e6.ipv6.dmsk); + r->e6.ipv6.dmsk = dest->mask.v6; int i; for (i = 0; i < 4; i++) @@ -700,7 +819,7 @@ fw3_ipt_rule_src_dest(struct fw3_ipt_rule *r, else { r->e.ip.dst = dest->address.v4; - ip4prefix2mask(dest->mask, &r->e.ip.dmsk); + r->e.ip.dmsk = dest->mask.v4; r->e.ip.dst.s_addr &= r->e.ip.dmsk.s_addr; @@ -743,6 +862,16 @@ fw3_ipt_rule_sport_dport(struct fw3_ipt_rule *r, } } +void +fw3_ipt_rule_device(struct fw3_ipt_rule *r, const char *device, bool out) +{ + if (device) { + struct fw3_device dev = { .any = false }; + strncpy(dev.name, device, sizeof(dev.name) - 1); + fw3_ipt_rule_in_out(r, (out) ? NULL : &dev, (out) ? &dev : NULL); + } +} + void fw3_ipt_rule_mac(struct fw3_ipt_rule *r, struct fw3_mac *mac) { @@ -902,7 +1031,7 @@ fw3_ipt_rule_time(struct fw3_ipt_rule *r, struct fw3_time *time) { for (i = 1, p = buf; i < 32; i++) { - if (hasbit(time->monthdays, i)) + if (fw3_hasbit(time->monthdays, i)) { if (p > buf) *p++ = ','; @@ -911,14 +1040,14 @@ fw3_ipt_rule_time(struct fw3_ipt_rule *r, struct fw3_time *time) } } - fw3_ipt_rule_addarg(r, hasbit(time->monthdays, 0), "--monthdays", buf); + fw3_ipt_rule_addarg(r, fw3_hasbit(time->monthdays, 0), "--monthdays", buf); } if (time->weekdays & 0xFE) { for (i = 1, p = buf; i < 8; i++) { - if (hasbit(time->weekdays, i)) + if (fw3_hasbit(time->weekdays, i)) { if (p > buf) *p++ = ','; @@ -927,7 +1056,7 @@ fw3_ipt_rule_time(struct fw3_ipt_rule *r, struct fw3_time *time) } } - fw3_ipt_rule_addarg(r, hasbit(time->weekdays, 0), "--weekdays", buf); + fw3_ipt_rule_addarg(r, fw3_hasbit(time->weekdays, 0), "--weekdays", buf); } } @@ -993,12 +1122,12 @@ fw3_ipt_rule_extra(struct fw3_ipt_rule *r, const char *extra) static void rule_print6(struct ip6t_entry *e) { - char buf[INET6_ADDRSTRLEN]; + char buf1[INET6_ADDRSTRLEN], buf2[INET6_ADDRSTRLEN]; char *pname; if (e->ipv6.flags & IP6T_F_PROTO) { - if (e->ipv6.flags & XT_INV_PROTO) + if (e->ipv6.invflags & XT_INV_PROTO) printf(" !"); pname = get_protoname(container_of(e, struct fw3_ipt_rule, e6)); @@ -1011,7 +1140,7 @@ rule_print6(struct ip6t_entry *e) if (e->ipv6.iniface[0]) { - if (e->ipv6.flags & IP6T_INV_VIA_IN) + if (e->ipv6.invflags & IP6T_INV_VIA_IN) printf(" !"); printf(" -i %s", e->ipv6.iniface); @@ -1019,7 +1148,7 @@ rule_print6(struct ip6t_entry *e) if (e->ipv6.outiface[0]) { - if (e->ipv6.flags & IP6T_INV_VIA_OUT) + if (e->ipv6.invflags & IP6T_INV_VIA_OUT) printf(" !"); printf(" -o %s", e->ipv6.outiface); @@ -1027,20 +1156,22 @@ rule_print6(struct ip6t_entry *e) if (memcmp(&e->ipv6.src, &in6addr_any, sizeof(struct in6_addr))) { - if (e->ipv6.flags & IP6T_INV_SRCIP) + if (e->ipv6.invflags & IP6T_INV_SRCIP) printf(" !"); - printf(" -s %s/%u", inet_ntop(AF_INET6, &e->ipv6.src, buf, sizeof(buf)), - xtables_ip6mask_to_cidr(&e->ipv6.smsk)); + printf(" -s %s/%s", + inet_ntop(AF_INET6, &e->ipv6.src, buf1, sizeof(buf1)), + inet_ntop(AF_INET6, &e->ipv6.smsk, buf2, sizeof(buf2))); } if (memcmp(&e->ipv6.dst, &in6addr_any, sizeof(struct in6_addr))) { - if (e->ipv6.flags & IP6T_INV_DSTIP) + if (e->ipv6.invflags & IP6T_INV_DSTIP) printf(" !"); - printf(" -d %s/%u", inet_ntop(AF_INET6, &e->ipv6.dst, buf, sizeof(buf)), - xtables_ip6mask_to_cidr(&e->ipv6.dmsk)); + printf(" -d %s/%s", + inet_ntop(AF_INET6, &e->ipv6.dst, buf1, sizeof(buf1)), + inet_ntop(AF_INET6, &e->ipv6.dmsk, buf2, sizeof(buf2))); } } #endif @@ -1049,12 +1180,12 @@ static void rule_print4(struct ipt_entry *e) { struct in_addr in_zero = { 0 }; - char buf[sizeof("255.255.255.255\0")]; + char buf1[sizeof("255.255.255.255\0")], buf2[sizeof("255.255.255.255\0")]; char *pname; if (e->ip.proto) { - if (e->ip.flags & XT_INV_PROTO) + if (e->ip.invflags & XT_INV_PROTO) printf(" !"); pname = get_protoname(container_of(e, struct fw3_ipt_rule, e)); @@ -1067,7 +1198,7 @@ rule_print4(struct ipt_entry *e) if (e->ip.iniface[0]) { - if (e->ip.flags & IPT_INV_VIA_IN) + if (e->ip.invflags & IPT_INV_VIA_IN) printf(" !"); printf(" -i %s", e->ip.iniface); @@ -1075,7 +1206,7 @@ rule_print4(struct ipt_entry *e) if (e->ip.outiface[0]) { - if (e->ip.flags & IPT_INV_VIA_OUT) + if (e->ip.invflags & IPT_INV_VIA_OUT) printf(" !"); printf(" -o %s", e->ip.outiface); @@ -1083,20 +1214,22 @@ rule_print4(struct ipt_entry *e) if (memcmp(&e->ip.src, &in_zero, sizeof(struct in_addr))) { - if (e->ip.flags & IPT_INV_SRCIP) + if (e->ip.invflags & IPT_INV_SRCIP) printf(" !"); - printf(" -s %s/%u", inet_ntop(AF_INET, &e->ip.src, buf, sizeof(buf)), - xtables_ipmask_to_cidr(&e->ip.smsk)); + printf(" -s %s/%s", + inet_ntop(AF_INET, &e->ip.src, buf1, sizeof(buf1)), + inet_ntop(AF_INET, &e->ip.smsk, buf2, sizeof(buf2))); } if (memcmp(&e->ip.dst, &in_zero, sizeof(struct in_addr))) { - if (e->ip.flags & IPT_INV_DSTIP) + if (e->ip.invflags & IPT_INV_DSTIP) printf(" !"); - printf(" -d %s/%u", inet_ntop(AF_INET, &e->ip.dst, buf, sizeof(buf)), - xtables_ipmask_to_cidr(&e->ip.dmsk)); + printf(" -d %s/%s", + inet_ntop(AF_INET, &e->ip.dst, buf1, sizeof(buf1)), + inet_ntop(AF_INET, &e->ip.dmsk, buf2, sizeof(buf2))); } } @@ -1213,7 +1346,9 @@ rule_mask(struct fw3_ipt_rule *r) for (m = r->matches; m; m = m->next) s += SZ(ip6t_entry_match) + m->match->size; - s += SZ(ip6t_entry_target) + r->target->size; + s += SZ(ip6t_entry_target); + if (r->target) + s += r->target->size; mask = fw3_alloc(s); memset(mask, 0xFF, SZ(ip6t_entry)); @@ -1225,7 +1360,7 @@ rule_mask(struct fw3_ipt_rule *r) p += SZ(ip6t_entry_match) + m->match->size; } - memset(p, 0xFF, SZ(ip6t_entry_target) + r->target->userspacesize); + memset(p, 0xFF, SZ(ip6t_entry_target) + (r->target) ? r->target->userspacesize : 0); } else #endif @@ -1235,7 +1370,9 @@ rule_mask(struct fw3_ipt_rule *r) for (m = r->matches; m; m = m->next) s += SZ(ipt_entry_match) + m->match->size; - s += SZ(ipt_entry_target) + r->target->size; + s += SZ(ipt_entry_target); + if (r->target) + s += r->target->size; mask = fw3_alloc(s); memset(mask, 0xFF, SZ(ipt_entry)); @@ -1247,7 +1384,7 @@ rule_mask(struct fw3_ipt_rule *r) p += SZ(ipt_entry_match) + m->match->size; } - memset(p, 0xFF, SZ(ipt_entry_target) + r->target->userspacesize); + memset(p, 0xFF, SZ(ipt_entry_target) + (r->target) ? r->target->userspacesize : 0); } return mask; @@ -1256,7 +1393,7 @@ rule_mask(struct fw3_ipt_rule *r) static void * rule_build(struct fw3_ipt_rule *r) { - size_t s; + size_t s, target_size = (r->target) ? r->target->t->u.target_size : 0; struct xtables_rule_match *m; #ifndef DISABLE_IPV6 @@ -1269,12 +1406,12 @@ rule_build(struct fw3_ipt_rule *r) for (m = r->matches; m; m = m->next) s += m->match->m->u.match_size; - e6 = fw3_alloc(s + r->target->t->u.target_size); + e6 = fw3_alloc(s + target_size); memcpy(e6, &r->e6, sizeof(struct ip6t_entry)); e6->target_offset = s; - e6->next_offset = s + r->target->t->u.target_size; + e6->next_offset = s + target_size; s = 0; @@ -1284,7 +1421,8 @@ rule_build(struct fw3_ipt_rule *r) s += m->match->m->u.match_size; } - memcpy(e6->elems + s, r->target->t, r->target->t->u.target_size); + if (target_size) + memcpy(e6->elems + s, r->target->t, target_size); return e6; } @@ -1298,12 +1436,12 @@ rule_build(struct fw3_ipt_rule *r) for (m = r->matches; m; m = m->next) s += m->match->m->u.match_size; - e = fw3_alloc(s + r->target->t->u.target_size); + e = fw3_alloc(s + target_size); memcpy(e, &r->e, sizeof(struct ipt_entry)); e->target_offset = s; - e->next_offset = s + r->target->t->u.target_size; + e->next_offset = s + target_size; s = 0; @@ -1313,7 +1451,8 @@ rule_build(struct fw3_ipt_rule *r) s += m->match->m->u.match_size; } - memcpy(e->elems + s, r->target->t, r->target->t->u.target_size); + if (target_size) + memcpy(e->elems + s, r->target->t, target_size); return e; } @@ -1331,6 +1470,7 @@ __fw3_ipt_rule_append(struct fw3_ipt_rule *r, bool repl, const char *fmt, ...) struct xtables_globals *g; int i, optc; + uint32_t id; bool inv = false; char buf[32]; va_list ap; @@ -1345,6 +1485,24 @@ __fw3_ipt_rule_append(struct fw3_ipt_rule *r, bool repl, const char *fmt, ...) optind = 0; opterr = 0; + if (r->id >= 0) + { + em = find_match(r, "id"); + + if (!em) + { + warn("fw3_ipt_rule_append(): Can't find match '%s'", "id"); + goto free; + } + + init_match(r, em, true); + + id = FW3_ID_MAGIC | (r->id & ~FW3_ID_MASK); + memcpy(em->m->data, &id, sizeof(id)); + + em->mflags = 1; + } + while ((optc = getopt_long(r->argc, r->argv, "-:m:j:", g->opts, NULL)) != -1) { @@ -1485,3 +1643,63 @@ fw3_ipt_rule_create(struct fw3_ipt_handle *handle, struct fw3_protocol *proto, return r; } + +void +xtables_register_match(struct xtables_match *me) +{ + int i; + static struct xtables_match **tmp; + + if (!xext.register_match) + xext.register_match = dlsym(RTLD_NEXT, "xtables_register_match"); + + if (!xext.register_match) + return; + + xext.register_match(me); + + if (xext.retain) + { + for (i = 0; i < xext.mcount; i++) + if (xext.matches[i] == me) + return; + + tmp = realloc(xext.matches, sizeof(me) * (xext.mcount + 1)); + + if (!tmp) + return; + + xext.matches = tmp; + xext.matches[xext.mcount++] = me; + } +} + +void +xtables_register_target(struct xtables_target *me) +{ + int i; + static struct xtables_target **tmp; + + if (!xext.register_target) + xext.register_target = dlsym(RTLD_NEXT, "xtables_register_target"); + + if (!xext.register_target) + return; + + xext.register_target(me); + + if (xext.retain) + { + for (i = 0; i < xext.tcount; i++) + if (xext.targets[i] == me) + return; + + tmp = realloc(xext.targets, sizeof(me) * (xext.tcount + 1)); + + if (!tmp) + return; + + xext.targets = tmp; + xext.targets[xext.tcount++] = me; + } +}