musl-compat: avoid kernel header conflicts

[project/firewall3.git] / iptables.c

diff --git a/iptables.c b/iptables.c
index 95fc0d45835d565217d8caad63dc4486a92c426b..ccfd29c4b8837257207352c03849fe312b33c061 100644 (file)
--- a/iptables.c
+++ b/iptables.c
@@ -258,10 +258,9 @@ fw3_ipt_delete_chain(struct fw3_ipt_handle *h, const char *chain)
                iptc_delete_chain(chain, h->handle);
 }
 
-static int
-get_rule_id(const void *base, unsigned int start, unsigned int end)
+static bool
+has_rule_tag(const void *base, unsigned int start, unsigned int end)
 {
-       uint32_t id;
        unsigned int i;
        const struct xt_entry_match *em;
 
@@ -269,18 +268,14 @@ get_rule_id(const void *base, unsigned int start, unsigned int end)
        {
                em = base + i;
 
-               if (strcmp(em->u.user.name, "id"))
-                       continue;
-
-               memcpy(&id, em->data, sizeof(id));
-
-               if ((id & FW3_ID_MASK) != FW3_ID_MAGIC)
+               if (strcmp(em->u.user.name, "comment"))
                        continue;
 
-               return (id & ~FW3_ID_MASK);
+               if (!memcmp(em->data, "!fw3", 4))
+                       return true;
        }
 
-       return -1;
+       return false;
 }
 
 void
@@ -289,7 +284,6 @@ fw3_ipt_delete_id_rules(struct fw3_ipt_handle *h, const char *chain)
        unsigned int num;
        const struct ipt_entry *e;
        bool found;
-       int id;
 
 #ifndef DISABLE_IPV6
        if (h->family == FW3_FAMILY_V6)
@@ -305,9 +299,7 @@ fw3_ipt_delete_id_rules(struct fw3_ipt_handle *h, const char *chain)
                                 e6 != NULL;
                                 num++, e6 = ip6tc_next_rule(e6, h->handle))
                        {
-                               id = get_rule_id(e6, sizeof(*e6), e6->target_offset);
-
-                               if (id >= 0)
+                               if (has_rule_tag(e6, sizeof(*e6), e6->target_offset))
                                {
                                        if (fw3_pr_debug)
                                                debug(h, "-D %s %u\n", chain, num + 1);
@@ -332,9 +324,7 @@ fw3_ipt_delete_id_rules(struct fw3_ipt_handle *h, const char *chain)
                                 e != NULL;
                                 num++, e = iptc_next_rule(e, h->handle))
                        {
-                               id = get_rule_id(e, sizeof(*e), e->target_offset);
-
-                               if (id >= 0)
+                               if (has_rule_tag(e, sizeof(*e), e->target_offset))
                                {
                                        if (fw3_pr_debug)
                                                debug(h, "-D %s %u\n", chain, num + 1);
@@ -503,7 +493,6 @@ fw3_ipt_rule_new(struct fw3_ipt_handle *h)
        r = fw3_alloc(sizeof(*r));
 
        r->h = h;
-       r->id = 0;
        r->argv = fw3_alloc(sizeof(char *));
        r->argv[r->argc++] = "fw3";
 
@@ -535,36 +524,14 @@ get_protoname(struct fw3_ipt_rule *r)
        return NULL;
 }
 
-static bool
-load_extension(struct fw3_ipt_handle *h, const char *name)
-{
-       char path[256];
-       void *lib;
-       const char *pfx = (h->family == FW3_FAMILY_V6) ? "libip6t" : "libipt";
-
-       xext.retain = true;
-
-       snprintf(path, sizeof(path), "/usr/lib/iptables/libxt_%s.so", name);
-       if (!(lib = dlopen(path, RTLD_NOW)))
-       {
-               snprintf(path, sizeof(path), "/usr/lib/iptables/%s_%s.so", pfx, name);
-               lib = dlopen(path, RTLD_NOW);
-       }
-
-       xext.retain = false;
-
-       return !!lib;
-}
-
 static struct xtables_match *
 find_match(struct fw3_ipt_rule *r, const char *name)
 {
        struct xtables_match *m;
 
-       m = xtables_find_match(name, XTF_DONT_LOAD, &r->matches);
-
-       if (!m && load_extension(r->h, name))
-               m = xtables_find_match(name, XTF_DONT_LOAD, &r->matches);
+       xext.retain = true;
+       m = xtables_find_match(name, XTF_TRY_LOAD, &r->matches);
+       xext.retain = false;
 
        return m;
 }
@@ -630,13 +597,14 @@ find_target(struct fw3_ipt_rule *r, const char *name)
 {
        struct xtables_target *t;
 
-       if (is_chain(r->h, name))
-               return xtables_find_target(XT_STANDARD_TARGET, XTF_LOAD_MUST_SUCCEED);
+       xext.retain = true;
 
-       t = xtables_find_target(name, XTF_DONT_LOAD);
+       if (is_chain(r->h, name))
+               t = xtables_find_target(XT_STANDARD_TARGET, XTF_TRY_LOAD);
+       else
+               t = xtables_find_target(name, XTF_TRY_LOAD);
 
-       if (!t && load_extension(r->h, name))
-               t = xtables_find_target(name, XTF_DONT_LOAD);
+       xext.retain = false;
 
        return t;
 }
@@ -1464,6 +1432,34 @@ rule_build(struct fw3_ipt_rule *r)
        }
 }
 
+static void
+set_rule_tag(struct fw3_ipt_rule *r)
+{
+       int i;
+       char *p, **tmp;
+       const char *tag = "!fw3";
+
+       for (i = 0; i < r->argc; i++)
+               if (!strcmp(r->argv[i], "--comment") && (i + 1) < r->argc)
+                       if (asprintf(&p, "%s: %s", tag, r->argv[i + 1]) > 0)
+                       {
+                               free(r->argv[i + 1]);
+                               r->argv[i + 1] = p;
+                               return;
+                       }
+
+       tmp = realloc(r->argv, (r->argc + 4) * sizeof(*r->argv));
+
+       if (tmp)
+       {
+               r->argv = tmp;
+               r->argv[r->argc++] = fw3_strdup("-m");
+               r->argv[r->argc++] = fw3_strdup("comment");
+               r->argv[r->argc++] = fw3_strdup("--comment");
+               r->argv[r->argc++] = fw3_strdup(tag);
+       }
+}
+
 void
 __fw3_ipt_rule_append(struct fw3_ipt_rule *r, bool repl, const char *fmt, ...)
 {
@@ -1476,7 +1472,6 @@ __fw3_ipt_rule_append(struct fw3_ipt_rule *r, bool repl, const char *fmt, ...)
        struct xtables_globals *g;
 
        int i, optc;
-       uint32_t id;
        bool inv = false;
        char buf[32];
        va_list ap;
@@ -1491,23 +1486,7 @@ __fw3_ipt_rule_append(struct fw3_ipt_rule *r, bool repl, const char *fmt, ...)
        optind = 0;
        opterr = 0;
 
-       if (r->id >= 0)
-       {
-               em = find_match(r, "id");
-
-               if (!em)
-               {
-                       warn("fw3_ipt_rule_append(): Can't find match '%s'", "id");
-                       goto free;
-               }
-
-               init_match(r, em, true);
-
-               id = FW3_ID_MAGIC | (r->id & ~FW3_ID_MASK);
-               memcpy(em->m->data, &id, sizeof(id));
-
-               em->mflags = 1;
-       }
+       set_rule_tag(r);
 
        while ((optc = getopt_long(r->argc, r->argv, "-:m:j:", g->opts,
                                   NULL)) != -1)