projects / project / firewall3.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
iptables: rework extension loader
[project/firewall3.git] / iptables.c
1 /*
2 * firewall3 - 3rd OpenWrt UCI firewall implementation
3 *
4 * Copyright (C) 2013 Jo-Philipp Wich <jo@mein.io>
5 *
6 * Permission to use, copy, modify, and/or distribute this software for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
9 *
10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17 */
18
19 #include "iptables.h"
20
21
22 static struct option base_opts[] = {
23 { .name = "match", .has_arg = 1, .val = 'm' },
24 { .name = "jump", .has_arg = 1, .val = 'j' },
25 { NULL }
26 };
27
28 static struct xtables_globals xtg = {
29 .option_offset = 0,
30 .program_version = "4",
31 .orig_opts = base_opts,
32 #if XTABLES_VERSION_CODE > 10
33 .compat_rev = xtables_compatible_revision,
34 #endif
35 };
36
37 static struct xtables_globals xtg6 = {
38 .option_offset = 0,
39 .program_version = "6",
40 .orig_opts = base_opts,
41 #if XTABLES_VERSION_CODE > 10
42 .compat_rev = xtables_compatible_revision,
43 #endif
44 };
45
46 static struct {
47 bool retain;
48 int mcount, tcount;
49 struct xtables_match **matches;
50 struct xtables_target **targets;
51 void (*register_match)(struct xtables_match *);
52 void (*register_target)(struct xtables_target *);
53 } xext;
54
55
56 /* Required by certain extensions like SNAT and DNAT */
57 int kernel_version = 0;
58
59 void
60 get_kernel_version(void)
61 {
62 static struct utsname uts;
63 int x = 0, y = 0, z = 0;
64
65 if (uname(&uts) == -1)
66 sprintf(uts.release, "3.0.0");
67
68 sscanf(uts.release, "%d.%d.%d", &x, &y, &z);
69 kernel_version = 0x10000 * x + 0x100 * y + z;
70 }
71
72 static void fw3_init_extensions(void)
73 {
74 init_extensions();
75 init_extensions4();
76
77 #ifndef DISABLE_IPV6
78 init_extensions6();
79 #endif
80 }
81
82 struct fw3_ipt_handle *
83 fw3_ipt_open(enum fw3_family family, enum fw3_table table)
84 {
85 int i;
86 struct fw3_ipt_handle *h;
87
88 h = fw3_alloc(sizeof(*h));
89
90 xtables_init();
91
92 if (family == FW3_FAMILY_V6)
93 {
94 #ifndef DISABLE_IPV6
95 h->family = FW3_FAMILY_V6;
96 h->table = table;
97 h->handle = ip6tc_init(fw3_flag_names[table]);
98
99 xtables_set_params(&xtg6);
100 xtables_set_nfproto(NFPROTO_IPV6);
101 #endif
102 }
103 else
104 {
105 h->family = FW3_FAMILY_V4;
106 h->table = table;
107 h->handle = iptc_init(fw3_flag_names[table]);
108
109 xtables_set_params(&xtg);
110 xtables_set_nfproto(NFPROTO_IPV4);
111 }
112
113 if (!h->handle)
114 {
115 free(h);
116 return NULL;
117 }
118
119 fw3_xt_reset();
120 fw3_init_extensions();
121
122 if (xext.register_match)
123 for (i = 0; i < xext.mcount; i++)
124 xext.register_match(xext.matches[i]);
125
126 if (xext.register_target)
127 for (i = 0; i < xext.tcount; i++)
128 xext.register_target(xext.targets[i]);
129
130 return h;
131 }
132
133 static void
134 debug(struct fw3_ipt_handle *h, const char *fmt, ...)
135 {
136 va_list ap;
137
138 printf("%s -t %s ", (h->family == FW3_FAMILY_V6) ? "ip6tables" : "iptables",
139 fw3_flag_names[h->table]);
140
141 va_start(ap, fmt);
142 vprintf(fmt, ap);
143 va_end(ap);
144 }
145
146 void
147 fw3_ipt_set_policy(struct fw3_ipt_handle *h, const char *chain,
148 enum fw3_flag policy)
149 {
150 if (fw3_pr_debug)
151 debug(h, "-P %s %s\n", chain, fw3_flag_names[policy]);
152
153 #ifndef DISABLE_IPV6
154 if (h->family == FW3_FAMILY_V6)
155 ip6tc_set_policy(chain, fw3_flag_names[policy], NULL, h->handle);
156 else
157 #endif
158 iptc_set_policy(chain, fw3_flag_names[policy], NULL, h->handle);
159 }
160
161 void
162 fw3_ipt_flush_chain(struct fw3_ipt_handle *h, const char *chain)
163 {
164 if (fw3_pr_debug)
165 debug(h, "-F %s\n", chain);
166
167 #ifndef DISABLE_IPV6
168 if (h->family == FW3_FAMILY_V6)
169 ip6tc_flush_entries(chain, h->handle);
170 else
171 #endif
172 iptc_flush_entries(chain, h->handle);
173 }
174
175 static void
176 delete_rules(struct fw3_ipt_handle *h, const char *target)
177 {
178 unsigned int num;
179 const struct ipt_entry *e;
180 const char *chain;
181 const char *t;
182 bool found;
183
184 #ifndef DISABLE_IPV6
185 if (h->family == FW3_FAMILY_V6)
186 {
187 for (chain = ip6tc_first_chain(h->handle);
188 chain != NULL;
189 chain = ip6tc_next_chain(h->handle))
190 {
191 do {
192 found = false;
193
194 const struct ip6t_entry *e6;
195 for (num = 0, e6 = ip6tc_first_rule(chain, h->handle);
196 e6 != NULL;
197 num++, e6 = ip6tc_next_rule(e6, h->handle))
198 {
199 t = ip6tc_get_target(e6, h->handle);
200
201 if (*t && !strcmp(t, target))
202 {
203 if (fw3_pr_debug)
204 debug(h, "-D %s %u\n", chain, num + 1);
205
206 ip6tc_delete_num_entry(chain, num, h->handle);
207 found = true;
208 break;
209 }
210 }
211 } while (found);
212 }
213 }
214 else
215 #endif
216 {
217 for (chain = iptc_first_chain(h->handle);
218 chain != NULL;
219 chain = iptc_next_chain(h->handle))
220 {
221 do {
222 found = false;
223
224 for (num = 0, e = iptc_first_rule(chain, h->handle);
225 e != NULL;
226 num++, e = iptc_next_rule(e, h->handle))
227 {
228 t = iptc_get_target(e, h->handle);
229
230 if (*t && !strcmp(t, target))
231 {
232 if (fw3_pr_debug)
233 debug(h, "-D %s %u\n", chain, num + 1);
234
235 iptc_delete_num_entry(chain, num, h->handle);
236 found = true;
237 break;
238 }
239 }
240 } while (found);
241 }
242 }
243 }
244
245 void
246 fw3_ipt_delete_chain(struct fw3_ipt_handle *h, const char *chain)
247 {
248 delete_rules(h, chain);
249
250 if (fw3_pr_debug)
251 debug(h, "-X %s\n", chain);
252
253 #ifndef DISABLE_IPV6
254 if (h->family == FW3_FAMILY_V6)
255 ip6tc_delete_chain(chain, h->handle);
256 else
257 #endif
258 iptc_delete_chain(chain, h->handle);
259 }
260
261 static int
262 get_rule_id(const void *base, unsigned int start, unsigned int end)
263 {
264 uint32_t id;
265 unsigned int i;
266 const struct xt_entry_match *em;
267
268 for (i = start; i < end; i += em->u.match_size)
269 {
270 em = base + i;
271
272 if (strcmp(em->u.user.name, "id"))
273 continue;
274
275 memcpy(&id, em->data, sizeof(id));
276
277 if ((id & FW3_ID_MASK) != FW3_ID_MAGIC)
278 continue;
279
280 return (id & ~FW3_ID_MASK);
281 }
282
283 return -1;
284 }
285
286 void
287 fw3_ipt_delete_id_rules(struct fw3_ipt_handle *h, const char *chain)
288 {
289 unsigned int num;
290 const struct ipt_entry *e;
291 bool found;
292 int id;
293
294 #ifndef DISABLE_IPV6
295 if (h->family == FW3_FAMILY_V6)
296 {
297 if (!ip6tc_is_chain(chain, h->handle))
298 return;
299
300 do {
301 found = false;
302
303 const struct ip6t_entry *e6;
304 for (num = 0, e6 = ip6tc_first_rule(chain, h->handle);
305 e6 != NULL;
306 num++, e6 = ip6tc_next_rule(e6, h->handle))
307 {
308 id = get_rule_id(e6, sizeof(*e6), e6->target_offset);
309
310 if (id >= 0)
311 {
312 if (fw3_pr_debug)
313 debug(h, "-D %s %u\n", chain, num + 1);
314
315 ip6tc_delete_num_entry(chain, num, h->handle);
316 found = true;
317 break;
318 }
319 }
320 } while (found);
321 }
322 else
323 #endif
324 {
325 if (!iptc_is_chain(chain, h->handle))
326 return;
327
328 do {
329 found = false;
330
331 for (num = 0, e = iptc_first_rule(chain, h->handle);
332 e != NULL;
333 num++, e = iptc_next_rule(e, h->handle))
334 {
335 id = get_rule_id(e, sizeof(*e), e->target_offset);
336
337 if (id >= 0)
338 {
339 if (fw3_pr_debug)
340 debug(h, "-D %s %u\n", chain, num + 1);
341
342 iptc_delete_num_entry(chain, num, h->handle);
343 found = true;
344 break;
345 }
346 }
347 } while (found);
348 }
349 }
350
351 void
352 fw3_ipt_create_chain(struct fw3_ipt_handle *h, const char *fmt, ...)
353 {
354 char buf[32];
355 va_list ap;
356
357 va_start(ap, fmt);
358 vsnprintf(buf, sizeof(buf) - 1, fmt, ap);
359 va_end(ap);
360
361 if (fw3_pr_debug)
362 debug(h, "-N %s\n", buf);
363
364 iptc_create_chain(buf, h->handle);
365 }
366
367 void
368 fw3_ipt_flush(struct fw3_ipt_handle *h)
369 {
370 const char *chain;
371
372 #ifndef DISABLE_IPV6
373 if (h->family == FW3_FAMILY_V6)
374 {
375 for (chain = ip6tc_first_chain(h->handle);
376 chain != NULL;
377 chain = ip6tc_next_chain(h->handle))
378 {
379 ip6tc_flush_entries(chain, h->handle);
380 }
381
382 for (chain = ip6tc_first_chain(h->handle);
383 chain != NULL;
384 chain = ip6tc_next_chain(h->handle))
385 {
386 ip6tc_delete_chain(chain, h->handle);
387 }
388 }
389 else
390 #endif
391 {
392 for (chain = iptc_first_chain(h->handle);
393 chain != NULL;
394 chain = iptc_next_chain(h->handle))
395 {
396 iptc_flush_entries(chain, h->handle);
397 }
398
399 for (chain = iptc_first_chain(h->handle);
400 chain != NULL;
401 chain = iptc_next_chain(h->handle))
402 {
403 iptc_delete_chain(chain, h->handle);
404 }
405 }
406 }
407
408 static bool
409 chain_is_empty(struct fw3_ipt_handle *h, const char *chain)
410 {
411 #ifndef DISABLE_IPV6
412 if (h->family == FW3_FAMILY_V6)
413 return (!ip6tc_builtin(chain, h->handle) &&
414 !ip6tc_first_rule(chain, h->handle));
415 #endif
416
417 return (!iptc_builtin(chain, h->handle) &&
418 !iptc_first_rule(chain, h->handle));
419 }
420
421 void
422 fw3_ipt_gc(struct fw3_ipt_handle *h)
423 {
424 const char *chain;
425 bool found;
426
427 #ifndef DISABLE_IPV6
428 if (h->family == FW3_FAMILY_V6)
429 {
430 do {
431 found = false;
432
433 for (chain = ip6tc_first_chain(h->handle);
434 chain != NULL;
435 chain = ip6tc_next_chain(h->handle))
436 {
437 if (!chain_is_empty(h, chain))
438 continue;
439
440 fw3_ipt_delete_chain(h, chain);
441 found = true;
442 break;
443 }
444 } while(found);
445 }
446 else
447 #endif
448 {
449 do {
450 found = false;
451
452 for (chain = iptc_first_chain(h->handle);
453 chain != NULL;
454 chain = iptc_next_chain(h->handle))
455 {
456 warn("C=%s\n", chain);
457
458 if (!chain_is_empty(h, chain))
459 continue;
460
461 warn("D=%s\n", chain);
462
463 fw3_ipt_delete_chain(h, chain);
464 found = true;
465 break;
466 }
467 } while (found);
468 }
469 }
470
471 void
472 fw3_ipt_commit(struct fw3_ipt_handle *h)
473 {
474 int rv;
475
476 #ifndef DISABLE_IPV6
477 if (h->family == FW3_FAMILY_V6)
478 {
479 rv = ip6tc_commit(h->handle);
480 if (!rv)
481 warn("ip6tc_commit(): %s", ip6tc_strerror(errno));
482 }
483 else
484 #endif
485 {
486 rv = iptc_commit(h->handle);
487 if (!rv)
488 warn("iptc_commit(): %s", iptc_strerror(errno));
489 }
490 }
491
492 void
493 fw3_ipt_close(struct fw3_ipt_handle *h)
494 {
495 free(h);
496 }
497
498 struct fw3_ipt_rule *
499 fw3_ipt_rule_new(struct fw3_ipt_handle *h)
500 {
501 struct fw3_ipt_rule *r;
502
503 r = fw3_alloc(sizeof(*r));
504
505 r->h = h;
506 r->id = 0;
507 r->argv = fw3_alloc(sizeof(char *));
508 r->argv[r->argc++] = "fw3";
509
510 return r;
511 }
512
513
514 static bool
515 is_chain(struct fw3_ipt_handle *h, const char *name)
516 {
517 #ifndef DISABLE_IPV6
518 if (h->family == FW3_FAMILY_V6)
519 return ip6tc_is_chain(name, h->handle);
520 else
521 #endif
522 return iptc_is_chain(name, h->handle);
523 }
524
525 static char *
526 get_protoname(struct fw3_ipt_rule *r)
527 {
528 const struct xtables_pprot *pp;
529
530 if (r->protocol)
531 for (pp = xtables_chain_protos; pp->name; pp++)
532 if (pp->num == r->protocol)
533 return (char *)pp->name;
534
535 return NULL;
536 }
537
538 static struct xtables_match *
539 find_match(struct fw3_ipt_rule *r, const char *name)
540 {
541 struct xtables_match *m;
542
543 xext.retain = true;
544 m = xtables_find_match(name, XTF_TRY_LOAD, &r->matches);
545 xext.retain = false;
546
547 return m;
548 }
549
550 static void
551 init_match(struct fw3_ipt_rule *r, struct xtables_match *m, bool no_clone)
552 {
553 size_t s;
554 struct xtables_globals *g;
555
556 if (!m)
557 return;
558
559 s = XT_ALIGN(sizeof(struct xt_entry_match)) + m->size;
560
561 m->m = fw3_alloc(s);
562
563 fw3_xt_set_match_name(m);
564
565 m->m->u.user.revision = m->revision;
566 m->m->u.match_size = s;
567
568 /* free previous userspace data */
569 fw3_xt_free_match_udata(m);
570
571 if (m->init)
572 m->init(m->m);
573
574 /* don't merge options if no_clone is set and this match is a clone */
575 if (no_clone && (m == m->next))
576 return;
577
578 /* merge option table */
579 g = (r->h->family == FW3_FAMILY_V6) ? &xtg6 : &xtg;
580 fw3_xt_merge_match_options(g, m);
581 }
582
583 static bool
584 need_protomatch(struct fw3_ipt_rule *r, const char *pname)
585 {
586 if (!pname)
587 return false;
588
589 if (!xtables_find_match(pname, XTF_DONT_LOAD, NULL))
590 return true;
591
592 return !r->protocol_loaded;
593 }
594
595 static struct xtables_match *
596 load_protomatch(struct fw3_ipt_rule *r)
597 {
598 const char *pname = get_protoname(r);
599
600 if (!need_protomatch(r, pname))
601 return NULL;
602
603 return find_match(r, pname);
604 }
605
606 static struct xtables_target *
607 find_target(struct fw3_ipt_rule *r, const char *name)
608 {
609 struct xtables_target *t;
610
611 xext.retain = true;
612
613 if (is_chain(r->h, name))
614 t = xtables_find_target(XT_STANDARD_TARGET, XTF_TRY_LOAD);
615 else
616 t = xtables_find_target(name, XTF_TRY_LOAD);
617
618 xext.retain = false;
619
620 return t;
621 }
622
623 static struct xtables_target *
624 get_target(struct fw3_ipt_rule *r, const char *name)
625 {
626 size_t s;
627 struct xtables_target *t;
628 struct xtables_globals *g;
629
630 t = find_target(r, name);
631
632 if (!t)
633 return NULL;
634
635 s = XT_ALIGN(sizeof(struct xt_entry_target)) + t->size;
636 t->t = fw3_alloc(s);
637
638 fw3_xt_set_target_name(t, name);
639
640 t->t->u.user.revision = t->revision;
641 t->t->u.target_size = s;
642
643 /* free previous userspace data */
644 fw3_xt_free_target_udata(t);
645
646 if (t->init)
647 t->init(t->t);
648
649 /* merge option table */
650 g = (r->h->family == FW3_FAMILY_V6) ? &xtg6 : &xtg;
651 fw3_xt_merge_target_options(g, t);
652
653 r->target = t;
654
655 return t;
656 }
657
658 void
659 fw3_ipt_rule_proto(struct fw3_ipt_rule *r, struct fw3_protocol *proto)
660 {
661 uint32_t pr;
662
663 if (!proto || proto->any)
664 return;
665
666 pr = proto->protocol;
667
668 #ifndef DISABLE_IPV6
669 if (r->h->family == FW3_FAMILY_V6)
670 {
671 if (pr == 1)
672 pr = 58;
673
674 r->e6.ipv6.proto = pr;
675 r->e6.ipv6.flags |= IP6T_F_PROTO;
676
677 if (proto->invert)
678 r->e6.ipv6.invflags |= XT_INV_PROTO;
679 }
680 else
681 #endif
682 {
683 r->e.ip.proto = pr;
684
685 if (proto->invert)
686 r->e.ip.invflags |= XT_INV_PROTO;
687 }
688
689 r->protocol = pr;
690 }
691
692 void
693 fw3_ipt_rule_in_out(struct fw3_ipt_rule *r,
694 struct fw3_device *in, struct fw3_device *out)
695 {
696 #ifndef DISABLE_IPV6
697 if (r->h->family == FW3_FAMILY_V6)
698 {
699 if (in && !in->any)
700 {
701 xtables_parse_interface(in->name, r->e6.ipv6.iniface,
702 r->e6.ipv6.iniface_mask);
703
704 if (in->invert)
705 r->e6.ipv6.invflags |= IP6T_INV_VIA_IN;
706 }
707
708 if (out && !out->any)
709 {
710 xtables_parse_interface(out->name, r->e6.ipv6.outiface,
711 r->e6.ipv6.outiface_mask);
712
713 if (out->invert)
714 r->e6.ipv6.invflags |= IP6T_INV_VIA_OUT;
715 }
716 }
717 else
718 #endif
719 {
720 if (in && !in->any)
721 {
722 xtables_parse_interface(in->name, r->e.ip.iniface,
723 r->e.ip.iniface_mask);
724
725 if (in->invert)
726 r->e.ip.invflags |= IPT_INV_VIA_IN;
727 }
728
729 if (out && !out->any)
730 {
731 xtables_parse_interface(out->name, r->e.ip.outiface,
732 r->e.ip.outiface_mask);
733
734 if (out->invert)
735 r->e.ip.invflags |= IPT_INV_VIA_OUT;
736 }
737 }
738 }
739
740
741 void
742 fw3_ipt_rule_src_dest(struct fw3_ipt_rule *r,
743 struct fw3_address *src, struct fw3_address *dest)
744 {
745 if ((src && src->range) || (dest && dest->range))
746 {
747 fw3_ipt_rule_addarg(r, false, "-m", "iprange");
748 }
749
750 if (src && src->set)
751 {
752 if (src->range)
753 {
754 fw3_ipt_rule_addarg(r, src->invert, "--src-range",
755 fw3_address_to_string(src, false, false));
756 }
757 #ifndef DISABLE_IPV6
758 else if (r->h->family == FW3_FAMILY_V6)
759 {
760 r->e6.ipv6.src = src->address.v6;
761 r->e6.ipv6.smsk = src->mask.v6;
762
763 int i;
764 for (i = 0; i < 4; i++)
765 r->e6.ipv6.src.s6_addr32[i] &= r->e6.ipv6.smsk.s6_addr32[i];
766
767 if (src->invert)
768 r->e6.ipv6.invflags |= IP6T_INV_SRCIP;
769 }
770 #endif
771 else
772 {
773 r->e.ip.src = src->address.v4;
774 r->e.ip.smsk = src->mask.v4;
775
776 r->e.ip.src.s_addr &= r->e.ip.smsk.s_addr;
777
778 if (src->invert)
779 r->e.ip.invflags |= IPT_INV_SRCIP;
780 }
781 }
782
783 if (dest && dest->set)
784 {
785 if (dest->range)
786 {
787 fw3_ipt_rule_addarg(r, dest->invert, "--dst-range",
788 fw3_address_to_string(dest, false, false));
789 }
790 #ifndef DISABLE_IPV6
791 else if (r->h->family == FW3_FAMILY_V6)
792 {
793 r->e6.ipv6.dst = dest->address.v6;
794 r->e6.ipv6.dmsk = dest->mask.v6;
795
796 int i;
797 for (i = 0; i < 4; i++)
798 r->e6.ipv6.dst.s6_addr32[i] &= r->e6.ipv6.dmsk.s6_addr32[i];
799
800 if (dest->invert)
801 r->e6.ipv6.invflags |= IP6T_INV_DSTIP;
802 }
803 #endif
804 else
805 {
806 r->e.ip.dst = dest->address.v4;
807 r->e.ip.dmsk = dest->mask.v4;
808
809 r->e.ip.dst.s_addr &= r->e.ip.dmsk.s_addr;
810
811 if (dest->invert)
812 r->e.ip.invflags |= IPT_INV_DSTIP;
813 }
814 }
815 }
816
817 void
818 fw3_ipt_rule_sport_dport(struct fw3_ipt_rule *r,
819 struct fw3_port *sp, struct fw3_port *dp)
820 {
821 char buf[sizeof("65535:65535\0")];
822
823 if ((!sp || !sp->set) && (!dp || !dp->set))
824 return;
825
826 if (!get_protoname(r))
827 return;
828
829 if (sp && sp->set)
830 {
831 if (sp->port_min == sp->port_max)
832 sprintf(buf, "%u", sp->port_min);
833 else
834 sprintf(buf, "%u:%u", sp->port_min, sp->port_max);
835
836 fw3_ipt_rule_addarg(r, sp->invert, "--sport", buf);
837 }
838
839 if (dp && dp->set)
840 {
841 if (dp->port_min == dp->port_max)
842 sprintf(buf, "%u", dp->port_min);
843 else
844 sprintf(buf, "%u:%u", dp->port_min, dp->port_max);
845
846 fw3_ipt_rule_addarg(r, dp->invert, "--dport", buf);
847 }
848 }
849
850 void
851 fw3_ipt_rule_device(struct fw3_ipt_rule *r, const char *device, bool out)
852 {
853 if (device) {
854 struct fw3_device dev = { .any = false };
855 strncpy(dev.name, device, sizeof(dev.name) - 1);
856 fw3_ipt_rule_in_out(r, (out) ? NULL : &dev, (out) ? &dev : NULL);
857 }
858 }
859
860 void
861 fw3_ipt_rule_mac(struct fw3_ipt_rule *r, struct fw3_mac *mac)
862 {
863 char buf[sizeof("ff:ff:ff:ff:ff:ff\0")];
864 uint8_t *addr = mac->mac.ether_addr_octet;
865
866 if (!mac)
867 return;
868
869 sprintf(buf, "%02x:%02x:%02x:%02x:%02x:%02x",
870 addr[0], addr[1], addr[2], addr[3], addr[4], addr[5]);
871
872 fw3_ipt_rule_addarg(r, false, "-m", "mac");
873 fw3_ipt_rule_addarg(r, mac->invert, "--mac-source", buf);
874 }
875
876 void
877 fw3_ipt_rule_icmptype(struct fw3_ipt_rule *r, struct fw3_icmptype *icmp)
878 {
879 char buf[sizeof("255/255\0")];
880
881 if (!icmp)
882 return;
883
884 #ifndef DISABLE_IPV6
885 if (r->h->family == FW3_FAMILY_V6)
886 {
887 if (icmp->code6_min == 0 && icmp->code6_max == 0xFF)
888 sprintf(buf, "%u", icmp->type6);
889 else
890 sprintf(buf, "%u/%u", icmp->type6, icmp->code6_min);
891
892 fw3_ipt_rule_addarg(r, icmp->invert, "--icmpv6-type", buf);
893 }
894 else
895 #endif
896 {
897 if (icmp->code_min == 0 && icmp->code_max == 0xFF)
898 sprintf(buf, "%u", icmp->type);
899 else
900 sprintf(buf, "%u/%u", icmp->type, icmp->code_min);
901
902 fw3_ipt_rule_addarg(r, icmp->invert, "--icmp-type", buf);
903 }
904 }
905
906 void
907 fw3_ipt_rule_limit(struct fw3_ipt_rule *r, struct fw3_limit *limit)
908 {
909 char buf[sizeof("-4294967296/second\0")];
910
911 if (!limit || limit->rate <= 0)
912 return;
913
914 fw3_ipt_rule_addarg(r, false, "-m", "limit");
915
916 sprintf(buf, "%u/%s", limit->rate, fw3_limit_units[limit->unit]);
917 fw3_ipt_rule_addarg(r, limit->invert, "--limit", buf);
918
919 if (limit->burst > 0)
920 {
921 sprintf(buf, "%u", limit->burst);
922 fw3_ipt_rule_addarg(r, limit->invert, "--limit-burst", buf);
923 }
924 }
925
926 void
927 fw3_ipt_rule_ipset(struct fw3_ipt_rule *r, struct fw3_setmatch *match)
928 {
929 char buf[sizeof("dst,dst,dst\0")];
930 char *p = buf;
931 int i = 0;
932
933 struct fw3_ipset *set;
934 struct fw3_ipset_datatype *type;
935
936 if (!match || !match->set || !match->ptr)
937 return;
938
939 set = match->ptr;
940 list_for_each_entry(type, &set->datatypes, list)
941 {
942 if (i >= 3)
943 break;
944
945 if (p > buf)
946 *p++ = ',';
947
948 p += sprintf(p, "%s", match->dir[i] ? match->dir[i] : type->dir);
949 i++;
950 }
951
952 fw3_ipt_rule_addarg(r, false, "-m", "set");
953
954 fw3_ipt_rule_addarg(r, match->invert, "--match-set",
955 set->external ? set->external : set->name);
956
957 fw3_ipt_rule_addarg(r, false, buf, NULL);
958 }
959
960 void
961 fw3_ipt_rule_time(struct fw3_ipt_rule *r, struct fw3_time *time)
962 {
963 int i;
964 struct tm empty = { 0 };
965
966 char buf[84]; /* sizeof("1,2,3,...,30,31\0") */
967 char *p;
968
969 bool d1 = memcmp(&time->datestart, &empty, sizeof(empty));
970 bool d2 = memcmp(&time->datestop, &empty, sizeof(empty));
971
972 if (!d1 && !d2 && !time->timestart && !time->timestop &&
973 !(time->monthdays & 0xFFFFFFFE) && !(time->weekdays & 0xFE))
974 {
975 return;
976 }
977
978 fw3_ipt_rule_addarg(r, false, "-m", "time");
979
980 if (time->utc)
981 fw3_ipt_rule_addarg(r, false, "--utc", NULL);
982
983 if (d1)
984 {
985 strftime(buf, sizeof(buf), "%Y-%m-%dT%H:%M:%S", &time->datestart);
986 fw3_ipt_rule_addarg(r, false, "--datestart", buf);
987 }
988
989 if (d2)
990 {
991 strftime(buf, sizeof(buf), "%Y-%m-%dT%H:%M:%S", &time->datestop);
992 fw3_ipt_rule_addarg(r, false, "--datestop", buf);
993 }
994
995 if (time->timestart)
996 {
997 sprintf(buf, "%02d:%02d:%02d",
998 time->timestart / 3600,
999 time->timestart % 3600 / 60,
1000 time->timestart % 60);
1001
1002 fw3_ipt_rule_addarg(r, false, "--timestart", buf);
1003 }
1004
1005 if (time->timestop)
1006 {
1007 sprintf(buf, "%02d:%02d:%02d",
1008 time->timestop / 3600,
1009 time->timestop % 3600 / 60,
1010 time->timestop % 60);
1011
1012 fw3_ipt_rule_addarg(r, false, "--timestop", buf);
1013 }
1014
1015 if (time->monthdays & 0xFFFFFFFE)
1016 {
1017 for (i = 1, p = buf; i < 32; i++)
1018 {
1019 if (fw3_hasbit(time->monthdays, i))
1020 {
1021 if (p > buf)
1022 *p++ = ',';
1023
1024 p += sprintf(p, "%u", i);
1025 }
1026 }
1027
1028 fw3_ipt_rule_addarg(r, fw3_hasbit(time->monthdays, 0), "--monthdays", buf);
1029 }
1030
1031 if (time->weekdays & 0xFE)
1032 {
1033 for (i = 1, p = buf; i < 8; i++)
1034 {
1035 if (fw3_hasbit(time->weekdays, i))
1036 {
1037 if (p > buf)
1038 *p++ = ',';
1039
1040 p += sprintf(p, "%u", i);
1041 }
1042 }
1043
1044 fw3_ipt_rule_addarg(r, fw3_hasbit(time->weekdays, 0), "--weekdays", buf);
1045 }
1046 }
1047
1048 void
1049 fw3_ipt_rule_mark(struct fw3_ipt_rule *r, struct fw3_mark *mark)
1050 {
1051 char buf[sizeof("0xFFFFFFFF/0xFFFFFFFF\0")];
1052
1053 if (!mark || !mark->set)
1054 return;
1055
1056 if (mark->mask < 0xFFFFFFFF)
1057 sprintf(buf, "0x%x/0x%x", mark->mark, mark->mask);
1058 else
1059 sprintf(buf, "0x%x", mark->mark);
1060
1061 fw3_ipt_rule_addarg(r, false, "-m", "mark");
1062 fw3_ipt_rule_addarg(r, mark->invert, "--mark", buf);
1063 }
1064
1065 void
1066 fw3_ipt_rule_comment(struct fw3_ipt_rule *r, const char *fmt, ...)
1067 {
1068 va_list ap;
1069 char buf[256];
1070
1071 if (!fmt || !*fmt)
1072 return;
1073
1074 va_start(ap, fmt);
1075 vsnprintf(buf, sizeof(buf) - 1, fmt, ap);
1076 va_end(ap);
1077
1078 fw3_ipt_rule_addarg(r, false, "-m", "comment");
1079 fw3_ipt_rule_addarg(r, false, "--comment", buf);
1080 }
1081
1082 void
1083 fw3_ipt_rule_extra(struct fw3_ipt_rule *r, const char *extra)
1084 {
1085 char *p, **tmp, *s;
1086
1087 if (!extra || !*extra)
1088 return;
1089
1090 s = fw3_strdup(extra);
1091
1092 for (p = strtok(s, " \t"); p; p = strtok(NULL, " \t"))
1093 {
1094 tmp = realloc(r->argv, (r->argc + 1) * sizeof(*r->argv));
1095
1096 if (!tmp)
1097 break;
1098
1099 r->argv = tmp;
1100 r->argv[r->argc++] = fw3_strdup(p);
1101 }
1102
1103 free(s);
1104 }
1105
1106 #ifndef DISABLE_IPV6
1107 static void
1108 rule_print6(struct ip6t_entry *e)
1109 {
1110 char buf1[INET6_ADDRSTRLEN], buf2[INET6_ADDRSTRLEN];
1111 char *pname;
1112
1113 if (e->ipv6.flags & IP6T_F_PROTO)
1114 {
1115 if (e->ipv6.invflags & XT_INV_PROTO)
1116 printf(" !");
1117
1118 pname = get_protoname(container_of(e, struct fw3_ipt_rule, e6));
1119
1120 if (pname)
1121 printf(" -p %s", pname);
1122 else
1123 printf(" -p %u", e->ipv6.proto);
1124 }
1125
1126 if (e->ipv6.iniface[0])
1127 {
1128 if (e->ipv6.invflags & IP6T_INV_VIA_IN)
1129 printf(" !");
1130
1131 printf(" -i %s", e->ipv6.iniface);
1132 }
1133
1134 if (e->ipv6.outiface[0])
1135 {
1136 if (e->ipv6.invflags & IP6T_INV_VIA_OUT)
1137 printf(" !");
1138
1139 printf(" -o %s", e->ipv6.outiface);
1140 }
1141
1142 if (memcmp(&e->ipv6.src, &in6addr_any, sizeof(struct in6_addr)))
1143 {
1144 if (e->ipv6.invflags & IP6T_INV_SRCIP)
1145 printf(" !");
1146
1147 printf(" -s %s/%s",
1148 inet_ntop(AF_INET6, &e->ipv6.src, buf1, sizeof(buf1)),
1149 inet_ntop(AF_INET6, &e->ipv6.smsk, buf2, sizeof(buf2)));
1150 }
1151
1152 if (memcmp(&e->ipv6.dst, &in6addr_any, sizeof(struct in6_addr)))
1153 {
1154 if (e->ipv6.invflags & IP6T_INV_DSTIP)
1155 printf(" !");
1156
1157 printf(" -d %s/%s",
1158 inet_ntop(AF_INET6, &e->ipv6.dst, buf1, sizeof(buf1)),
1159 inet_ntop(AF_INET6, &e->ipv6.dmsk, buf2, sizeof(buf2)));
1160 }
1161 }
1162 #endif
1163
1164 static void
1165 rule_print4(struct ipt_entry *e)
1166 {
1167 struct in_addr in_zero = { 0 };
1168 char buf1[sizeof("255.255.255.255\0")], buf2[sizeof("255.255.255.255\0")];
1169 char *pname;
1170
1171 if (e->ip.proto)
1172 {
1173 if (e->ip.invflags & XT_INV_PROTO)
1174 printf(" !");
1175
1176 pname = get_protoname(container_of(e, struct fw3_ipt_rule, e));
1177
1178 if (pname)
1179 printf(" -p %s", pname);
1180 else
1181 printf(" -p %u", e->ip.proto);
1182 }
1183
1184 if (e->ip.iniface[0])
1185 {
1186 if (e->ip.invflags & IPT_INV_VIA_IN)
1187 printf(" !");
1188
1189 printf(" -i %s", e->ip.iniface);
1190 }
1191
1192 if (e->ip.outiface[0])
1193 {
1194 if (e->ip.invflags & IPT_INV_VIA_OUT)
1195 printf(" !");
1196
1197 printf(" -o %s", e->ip.outiface);
1198 }
1199
1200 if (memcmp(&e->ip.src, &in_zero, sizeof(struct in_addr)))
1201 {
1202 if (e->ip.invflags & IPT_INV_SRCIP)
1203 printf(" !");
1204
1205 printf(" -s %s/%s",
1206 inet_ntop(AF_INET, &e->ip.src, buf1, sizeof(buf1)),
1207 inet_ntop(AF_INET, &e->ip.smsk, buf2, sizeof(buf2)));
1208 }
1209
1210 if (memcmp(&e->ip.dst, &in_zero, sizeof(struct in_addr)))
1211 {
1212 if (e->ip.invflags & IPT_INV_DSTIP)
1213 printf(" !");
1214
1215 printf(" -d %s/%s",
1216 inet_ntop(AF_INET, &e->ip.dst, buf1, sizeof(buf1)),
1217 inet_ntop(AF_INET, &e->ip.dmsk, buf2, sizeof(buf2)));
1218 }
1219 }
1220
1221 static void
1222 rule_print(struct fw3_ipt_rule *r, const char *prefix, const char *chain)
1223 {
1224 debug(r->h, "%s %s", prefix, chain);
1225
1226 #ifndef DISABLE_IPV6
1227 if (r->h->family == FW3_FAMILY_V6)
1228 rule_print6(&r->e6);
1229 else
1230 #endif
1231 rule_print4(&r->e);
1232
1233 fw3_xt_print_matches(&r->e.ip, r->matches);
1234 fw3_xt_print_target(&r->e.ip, r->target);
1235
1236 printf("\n");
1237 }
1238
1239 static bool
1240 parse_option(struct fw3_ipt_rule *r, int optc, bool inv)
1241 {
1242 struct xtables_rule_match *m;
1243 struct xtables_match *em;
1244
1245 /* is a target option */
1246 if (r->target && fw3_xt_has_target_parse(r->target) &&
1247 optc >= r->target->option_offset &&
1248 optc < (r->target->option_offset + 256))
1249 {
1250 xtables_option_tpcall(optc, r->argv, inv, r->target, &r->e);
1251 return false;
1252 }
1253
1254 /* try to dispatch argument to one of the match parsers */
1255 for (m = r->matches; m; m = m->next)
1256 {
1257 em = m->match;
1258
1259 if (m->completed || !fw3_xt_has_match_parse(em))
1260 continue;
1261
1262 if (optc < em->option_offset ||
1263 optc >= (em->option_offset + 256))
1264 continue;
1265
1266 xtables_option_mpcall(optc, r->argv, inv, em, &r->e);
1267 return false;
1268 }
1269
1270 /* unhandled option, might belong to a protocol match */
1271 if ((em = load_protomatch(r)) != NULL)
1272 {
1273 init_match(r, em, false);
1274
1275 r->protocol_loaded = true;
1276 optind--;
1277
1278 return true;
1279 }
1280
1281 if (optc == ':')
1282 warn("parse_option(): option '%s' needs argument", r->argv[optind-1]);
1283
1284 if (optc == '?')
1285 warn("parse_option(): unknown option '%s'", r->argv[optind-1]);
1286
1287 return false;
1288 }
1289
1290 void
1291 fw3_ipt_rule_addarg(struct fw3_ipt_rule *r, bool inv,
1292 const char *k, const char *v)
1293 {
1294 int n;
1295 char **tmp;
1296
1297 if (!k)
1298 return;
1299
1300 n = inv + !!k + !!v;
1301 tmp = realloc(r->argv, (r->argc + n) * sizeof(*tmp));
1302
1303 if (!tmp)
1304 return;
1305
1306 r->argv = tmp;
1307
1308 if (inv)
1309 r->argv[r->argc++] = fw3_strdup("!");
1310
1311 r->argv[r->argc++] = fw3_strdup(k);
1312
1313 if (v)
1314 r->argv[r->argc++] = fw3_strdup(v);
1315 }
1316
1317 static unsigned char *
1318 rule_mask(struct fw3_ipt_rule *r)
1319 {
1320 size_t s;
1321 unsigned char *p, *mask = NULL;
1322 struct xtables_rule_match *m;
1323
1324 #define SZ(x) XT_ALIGN(sizeof(struct x))
1325
1326 #ifndef DISABLE_IPV6
1327 if (r->h->family == FW3_FAMILY_V6)
1328 {
1329 s = SZ(ip6t_entry);
1330
1331 for (m = r->matches; m; m = m->next)
1332 s += SZ(ip6t_entry_match) + m->match->size;
1333
1334 s += SZ(ip6t_entry_target);
1335 if (r->target)
1336 s += r->target->size;
1337
1338 mask = fw3_alloc(s);
1339 memset(mask, 0xFF, SZ(ip6t_entry));
1340 p = mask + SZ(ip6t_entry);
1341
1342 for (m = r->matches; m; m = m->next)
1343 {
1344 memset(p, 0xFF, SZ(ip6t_entry_match) + m->match->userspacesize);
1345 p += SZ(ip6t_entry_match) + m->match->size;
1346 }
1347
1348 memset(p, 0xFF, SZ(ip6t_entry_target) + (r->target) ? r->target->userspacesize : 0);
1349 }
1350 else
1351 #endif
1352 {
1353 s = SZ(ipt_entry);
1354
1355 for (m = r->matches; m; m = m->next)
1356 s += SZ(ipt_entry_match) + m->match->size;
1357
1358 s += SZ(ipt_entry_target);
1359 if (r->target)
1360 s += r->target->size;
1361
1362 mask = fw3_alloc(s);
1363 memset(mask, 0xFF, SZ(ipt_entry));
1364 p = mask + SZ(ipt_entry);
1365
1366 for (m = r->matches; m; m = m->next)
1367 {
1368 memset(p, 0xFF, SZ(ipt_entry_match) + m->match->userspacesize);
1369 p += SZ(ipt_entry_match) + m->match->size;
1370 }
1371
1372 memset(p, 0xFF, SZ(ipt_entry_target) + (r->target) ? r->target->userspacesize : 0);
1373 }
1374
1375 return mask;
1376 }
1377
1378 static void *
1379 rule_build(struct fw3_ipt_rule *r)
1380 {
1381 size_t s, target_size = (r->target) ? r->target->t->u.target_size : 0;
1382 struct xtables_rule_match *m;
1383
1384 #ifndef DISABLE_IPV6
1385 if (r->h->family == FW3_FAMILY_V6)
1386 {
1387 struct ip6t_entry *e6;
1388
1389 s = XT_ALIGN(sizeof(struct ip6t_entry));
1390
1391 for (m = r->matches; m; m = m->next)
1392 s += m->match->m->u.match_size;
1393
1394 e6 = fw3_alloc(s + target_size);
1395
1396 memcpy(e6, &r->e6, sizeof(struct ip6t_entry));
1397
1398 e6->target_offset = s;
1399 e6->next_offset = s + target_size;
1400
1401 s = 0;
1402
1403 for (m = r->matches; m; m = m->next)
1404 {
1405 memcpy(e6->elems + s, m->match->m, m->match->m->u.match_size);
1406 s += m->match->m->u.match_size;
1407 }
1408
1409 if (target_size)
1410 memcpy(e6->elems + s, r->target->t, target_size);
1411
1412 return e6;
1413 }
1414 else
1415 #endif
1416 {
1417 struct ipt_entry *e;
1418
1419 s = XT_ALIGN(sizeof(struct ipt_entry));
1420
1421 for (m = r->matches; m; m = m->next)
1422 s += m->match->m->u.match_size;
1423
1424 e = fw3_alloc(s + target_size);
1425
1426 memcpy(e, &r->e, sizeof(struct ipt_entry));
1427
1428 e->target_offset = s;
1429 e->next_offset = s + target_size;
1430
1431 s = 0;
1432
1433 for (m = r->matches; m; m = m->next)
1434 {
1435 memcpy(e->elems + s, m->match->m, m->match->m->u.match_size);
1436 s += m->match->m->u.match_size;
1437 }
1438
1439 if (target_size)
1440 memcpy(e->elems + s, r->target->t, target_size);
1441
1442 return e;
1443 }
1444 }
1445
1446 void
1447 __fw3_ipt_rule_append(struct fw3_ipt_rule *r, bool repl, const char *fmt, ...)
1448 {
1449 void *rule;
1450 unsigned char *mask;
1451
1452 struct xtables_rule_match *m;
1453 struct xtables_match *em;
1454 struct xtables_target *et;
1455 struct xtables_globals *g;
1456
1457 int i, optc;
1458 uint32_t id;
1459 bool inv = false;
1460 char buf[32];
1461 va_list ap;
1462
1463 va_start(ap, fmt);
1464 vsnprintf(buf, sizeof(buf) - 1, fmt, ap);
1465 va_end(ap);
1466
1467 g = (r->h->family == FW3_FAMILY_V6) ? &xtg6 : &xtg;
1468 g->opts = g->orig_opts;
1469
1470 optind = 0;
1471 opterr = 0;
1472
1473 if (r->id >= 0)
1474 {
1475 em = find_match(r, "id");
1476
1477 if (!em)
1478 {
1479 warn("fw3_ipt_rule_append(): Can't find match '%s'", "id");
1480 goto free;
1481 }
1482
1483 init_match(r, em, true);
1484
1485 id = FW3_ID_MAGIC | (r->id & ~FW3_ID_MASK);
1486 memcpy(em->m->data, &id, sizeof(id));
1487
1488 em->mflags = 1;
1489 }
1490
1491 while ((optc = getopt_long(r->argc, r->argv, "-:m:j:", g->opts,
1492 NULL)) != -1)
1493 {
1494 switch (optc)
1495 {
1496 case 'm':
1497 em = find_match(r, optarg);
1498
1499 if (!em)
1500 {
1501 warn("fw3_ipt_rule_append(): Can't find match '%s'", optarg);
1502 goto free;
1503 }
1504
1505 init_match(r, em, true);
1506 break;
1507
1508 case 'j':
1509 et = get_target(r, optarg);
1510
1511 if (!et)
1512 {
1513 warn("fw3_ipt_rule_append(): Can't find target '%s'", optarg);
1514 goto free;
1515 }
1516
1517 break;
1518
1519 case 1:
1520 if ((optarg[0] == '!') && (optarg[1] == '\0'))
1521 {
1522 optarg[0] = '\0';
1523 inv = true;
1524 continue;
1525 }
1526
1527 warn("fw3_ipt_rule_append(): Bad argument '%s'", optarg);
1528 goto free;
1529
1530 default:
1531 if (parse_option(r, optc, inv))
1532 continue;
1533 break;
1534 }
1535
1536 inv = false;
1537 }
1538
1539 for (m = r->matches; m; m = m->next)
1540 xtables_option_mfcall(m->match);
1541
1542 if (r->target)
1543 xtables_option_tfcall(r->target);
1544
1545 rule = rule_build(r);
1546
1547 #ifndef DISABLE_IPV6
1548 if (r->h->family == FW3_FAMILY_V6)
1549 {
1550 if (repl)
1551 {
1552 mask = rule_mask(r);
1553
1554 while (ip6tc_delete_entry(buf, rule, mask, r->h->handle))
1555 if (fw3_pr_debug)
1556 rule_print(r, "-D", buf);
1557
1558 free(mask);
1559 }
1560
1561 if (fw3_pr_debug)
1562 rule_print(r, "-A", buf);
1563
1564 if (!ip6tc_append_entry(buf, rule, r->h->handle))
1565 warn("ip6tc_append_entry(): %s", ip6tc_strerror(errno));
1566 }
1567 else
1568 #endif
1569 {
1570 if (repl)
1571 {
1572 mask = rule_mask(r);
1573
1574 while (iptc_delete_entry(buf, rule, mask, r->h->handle))
1575 if (fw3_pr_debug)
1576 rule_print(r, "-D", buf);
1577
1578 free(mask);
1579 }
1580
1581 if (fw3_pr_debug)
1582 rule_print(r, "-A", buf);
1583
1584 if (!iptc_append_entry(buf, rule, r->h->handle))
1585 warn("iptc_append_entry(): %s\n", iptc_strerror(errno));
1586 }
1587
1588 free(rule);
1589
1590 free:
1591 for (i = 1; i < r->argc; i++)
1592 free(r->argv[i]);
1593
1594 free(r->argv);
1595
1596 xtables_rule_matches_free(&r->matches);
1597
1598 if (r->target)
1599 free(r->target->t);
1600
1601 free(r);
1602
1603 /* reset all targets and matches */
1604 for (em = xtables_matches; em; em = em->next)
1605 em->mflags = 0;
1606
1607 for (et = xtables_targets; et; et = et->next)
1608 {
1609 et->tflags = 0;
1610 et->used = 0;
1611 }
1612
1613 xtables_free_opts(1);
1614 }
1615
1616 struct fw3_ipt_rule *
1617 fw3_ipt_rule_create(struct fw3_ipt_handle *handle, struct fw3_protocol *proto,
1618 struct fw3_device *in, struct fw3_device *out,
1619 struct fw3_address *src, struct fw3_address *dest)
1620 {
1621 struct fw3_ipt_rule *r;
1622
1623 r = fw3_ipt_rule_new(handle);
1624
1625 fw3_ipt_rule_proto(r, proto);
1626 fw3_ipt_rule_in_out(r, in, out);
1627 fw3_ipt_rule_src_dest(r, src, dest);
1628
1629 return r;
1630 }
1631
1632 void
1633 xtables_register_match(struct xtables_match *me)
1634 {
1635 int i;
1636 static struct xtables_match **tmp;
1637
1638 if (!xext.register_match)
1639 xext.register_match = dlsym(RTLD_NEXT, "xtables_register_match");
1640
1641 if (!xext.register_match)
1642 return;
1643
1644 xext.register_match(me);
1645
1646 if (xext.retain)
1647 {
1648 for (i = 0; i < xext.mcount; i++)
1649 if (xext.matches[i] == me)
1650 return;
1651
1652 tmp = realloc(xext.matches, sizeof(me) * (xext.mcount + 1));
1653
1654 if (!tmp)
1655 return;
1656
1657 xext.matches = tmp;
1658 xext.matches[xext.mcount++] = me;
1659 }
1660 }
1661
1662 void
1663 xtables_register_target(struct xtables_target *me)
1664 {
1665 int i;
1666 static struct xtables_target **tmp;
1667
1668 if (!xext.register_target)
1669 xext.register_target = dlsym(RTLD_NEXT, "xtables_register_target");
1670
1671 if (!xext.register_target)
1672 return;
1673
1674 xext.register_target(me);
1675
1676 if (xext.retain)
1677 {
1678 for (i = 0; i < xext.tcount; i++)
1679 if (xext.targets[i] == me)
1680 return;
1681
1682 tmp = realloc(xext.targets, sizeof(me) * (xext.tcount + 1));
1683
1684 if (!tmp)
1685 return;
1686
1687 xext.targets = tmp;
1688 xext.targets[xext.tcount++] = me;
1689 }
1690 }
OpenWrt firewall configuration utility