1 /**
2 * This file was imported from the iptables sources.
3 * Copyright (C) 1999-2008 Netfilter Core Team
4 *
5 * This program is free software; you can redistribute it and/or modify it
6 * under the terms of the GNU General Public License as published by the
7 * Free Software Foundation; only version 2 of the License is applicable.
8 *
9 * This program is distributed in the hope that it will be useful, but
10 * WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
12 * General Public License for more details.
13 *
14 * You should have received a copy of the GNU General Public License along
15 * with this program; if not, write to the Free Software Foundation, Inc.,
16 * 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
17 */
19 /* Library which manipulates firewall rules. Version $Revision: 7138 $ */
21 /* Architecture of firewall rules is as follows:
22 *
23 * Chains go INPUT, FORWARD, OUTPUT then user chains.
24 * Each user chain starts with an ERROR node.
25 * Every chain ends with an unconditional jump: a RETURN for user chains,
26 * and a POLICY for built-ins.
27 */
29 /* (C) 1999 Paul ``Rusty'' Russell - Placed under the GNU GPL (See
30 * COPYING for details).
31 * (C) 2000-2004 by the Netfilter Core Team <coreteam@netfilter.org>
32 *
33 * 2003-Jun-20: Harald Welte <laforge@netfilter.org>:
34 * - Reimplementation of chain cache to use offsets instead of entries
35 * 2003-Jun-23: Harald Welte <laforge@netfilter.org>:
36 * - performance optimization, sponsored by Astaro AG (http://www.astaro.com/)
37 * don't rebuild the chain cache after every operation, instead fix it
38 * up after a ruleset change.
39 * 2004-Aug-18: Harald Welte <laforge@netfilter.org>:
40 * - futher performance work: total reimplementation of libiptc.
41 * - libiptc now has a real internal (linked-list) represntation of the
42 * ruleset and a parser/compiler from/to this internal representation
43 * - again sponsored by Astaro AG (http://www.astaro.com/)
44 */
45 #include <sys/types.h>
46 #include <sys/socket.h>
47 #include "xtables.h"
49 #include "linux_list.h"
51 //#define IPTC_DEBUG2 1
53 #ifdef IPTC_DEBUG2
54 #include <fcntl.h>
55 #define DEBUGP(x, args...) fprintf(stderr, "%s: " x, __FUNCTION__, ## args)
56 #define DEBUGP_C(x, args...) fprintf(stderr, x, ## args)
57 #else
58 #define DEBUGP(x, args...)
59 #define DEBUGP_C(x, args...)
60 #endif
62 #ifdef DEBUG
63 #define debug(x, args...) fprintf(stderr, x, ## args)
64 #else
65 #define debug(x, args...)
66 #endif
68 static int sockfd = -1;
69 static int sockfd_use = 0;
70 static void *iptc_fn = NULL;
72 static const char *hooknames[] = {
73 [HOOK_PRE_ROUTING] = "PREROUTING",
74 [HOOK_LOCAL_IN] = "INPUT",
75 [HOOK_FORWARD] = "FORWARD",
76 [HOOK_LOCAL_OUT] = "OUTPUT",
77 [HOOK_POST_ROUTING] = "POSTROUTING",
78 #ifdef HOOK_DROPPING
79 [HOOK_DROPPING] = "DROPPING"
80 #endif
81 };
83 /* Convenience structures */
84 struct ipt_error_target
85 {
86 STRUCT_ENTRY_TARGET t;
87 char error[TABLE_MAXNAMELEN];
88 };
90 struct chain_head;
91 struct rule_head;
93 struct counter_map
94 {
95 enum {
96 COUNTER_MAP_NOMAP,
97 COUNTER_MAP_NORMAL_MAP,
98 COUNTER_MAP_ZEROED,
99 COUNTER_MAP_SET
100 } maptype;
101 unsigned int mappos;
102 };
104 enum iptcc_rule_type {
105 IPTCC_R_STANDARD, /* standard target (ACCEPT, ...) */
106 IPTCC_R_MODULE, /* extension module (SNAT, ...) */
107 IPTCC_R_FALLTHROUGH, /* fallthrough rule */
108 IPTCC_R_JUMP, /* jump to other chain */
109 };
111 struct rule_head
112 {
113 struct list_head list;
114 struct chain_head *chain;
115 struct counter_map counter_map;
117 unsigned int index; /* index (needed for counter_map) */
118 unsigned int offset; /* offset in rule blob */
120 enum iptcc_rule_type type;
121 struct chain_head *jump; /* jump target, if IPTCC_R_JUMP */
123 unsigned int size; /* size of entry data */
124 STRUCT_ENTRY entry[0];
125 };
127 struct chain_head
128 {
129 struct list_head list;
130 char name[TABLE_MAXNAMELEN];
131 unsigned int hooknum; /* hook number+1 if builtin */
132 unsigned int references; /* how many jumps reference us */
133 int verdict; /* verdict if builtin */
135 STRUCT_COUNTERS counters; /* per-chain counters */
136 struct counter_map counter_map;
138 unsigned int num_rules; /* number of rules in list */
139 struct list_head rules; /* list of rules */
141 unsigned int index; /* index (needed for jump resolval) */
142 unsigned int head_offset; /* offset in rule blob */
143 unsigned int foot_index; /* index (needed for counter_map) */
144 unsigned int foot_offset; /* offset in rule blob */
145 };
147 STRUCT_TC_HANDLE
148 {
149 int changed; /* Have changes been made? */
151 struct list_head chains;
153 struct chain_head *chain_iterator_cur;
154 struct rule_head *rule_iterator_cur;
156 unsigned int num_chains; /* number of user defined chains */
158 struct chain_head **chain_index; /* array for fast chain list access*/
159 unsigned int chain_index_sz;/* size of chain index array */
161 STRUCT_GETINFO info;
162 STRUCT_GET_ENTRIES *entries;
163 };
165 /* allocate a new chain head for the cache */
166 static struct chain_head *iptcc_alloc_chain_head(const char *name, int hooknum)
167 {
168 struct chain_head *c = malloc(sizeof(*c));
169 if (!c)
170 return NULL;
171 memset(c, 0, sizeof(*c));
173 strncpy(c->name, name, TABLE_MAXNAMELEN);
174 c->hooknum = hooknum;
175 INIT_LIST_HEAD(&c->rules);
177 return c;
178 }
180 /* allocate and initialize a new rule for the cache */
181 static struct rule_head *iptcc_alloc_rule(struct chain_head *c, unsigned int size)
182 {
183 struct rule_head *r = malloc(sizeof(*r)+size);
184 if (!r)
185 return NULL;
186 memset(r, 0, sizeof(*r));
188 r->chain = c;
189 r->size = size;
191 return r;
192 }
194 /* notify us that the ruleset has been modified by the user */
195 static inline void
196 set_changed(TC_HANDLE_T h)
197 {
198 h->changed = 1;
199 }
201 #ifdef IPTC_DEBUG
202 static void do_check(TC_HANDLE_T h, unsigned int line);
203 #define CHECK(h) do { if (!getenv("IPTC_NO_CHECK")) do_check((h), __LINE__); } while(0)
204 #else
205 #define CHECK(h)
206 #endif
209 /**********************************************************************
210 * iptc blob utility functions (iptcb_*)
211 **********************************************************************/
213 static inline int
214 iptcb_get_number(const STRUCT_ENTRY *i,
215 const STRUCT_ENTRY *seek,
216 unsigned int *pos)
217 {
218 if (i == seek)
219 return 1;
220 (*pos)++;
221 return 0;
222 }
224 static inline int
225 iptcb_get_entry_n(STRUCT_ENTRY *i,
226 unsigned int number,
227 unsigned int *pos,
228 STRUCT_ENTRY **pe)
229 {
230 if (*pos == number) {
231 *pe = i;
232 return 1;
233 }
234 (*pos)++;
235 return 0;
236 }
238 static inline STRUCT_ENTRY *
239 iptcb_get_entry(TC_HANDLE_T h, unsigned int offset)
240 {
241 return (STRUCT_ENTRY *)((char *)h->entries->entrytable + offset);
242 }
244 static unsigned int
245 iptcb_entry2index(const TC_HANDLE_T h, const STRUCT_ENTRY *seek)
246 {
247 unsigned int pos = 0;
249 if (ENTRY_ITERATE(h->entries->entrytable, h->entries->size,
250 iptcb_get_number, seek, &pos) == 0) {
251 fprintf(stderr, "ERROR: offset %u not an entry!\n",
252 (unsigned int)((char *)seek - (char *)h->entries->entrytable));
253 abort();
254 }
255 return pos;
256 }
258 static inline STRUCT_ENTRY *
259 iptcb_offset2entry(TC_HANDLE_T h, unsigned int offset)
260 {
261 return (STRUCT_ENTRY *) ((void *)h->entries->entrytable+offset);
262 }
265 static inline unsigned long
266 iptcb_entry2offset(const TC_HANDLE_T h, const STRUCT_ENTRY *e)
267 {
268 return (void *)e - (void *)h->entries->entrytable;
269 }
271 static inline unsigned int
272 iptcb_offset2index(const TC_HANDLE_T h, unsigned int offset)
273 {
274 return iptcb_entry2index(h, iptcb_offset2entry(h, offset));
275 }
277 /* Returns 0 if not hook entry, else hooknumber + 1 */
278 static inline unsigned int
279 iptcb_ent_is_hook_entry(STRUCT_ENTRY *e, TC_HANDLE_T h)
280 {
281 unsigned int i;
283 for (i = 0; i < NUMHOOKS; i++) {
284 if ((h->info.valid_hooks & (1 << i))
285 && iptcb_get_entry(h, h->info.hook_entry[i]) == e)
286 return i+1;
287 }
288 return 0;
289 }
292 /**********************************************************************
293 * Chain index (cache utility) functions
294 **********************************************************************
295 * The chain index is an array with pointers into the chain list, with
296 * CHAIN_INDEX_BUCKET_LEN spacing. This facilitates the ability to
297 * speedup chain list searching, by find a more optimal starting
298 * points when searching the linked list.
299 *
300 * The starting point can be found fast by using a binary search of
301 * the chain index. Thus, reducing the previous search complexity of
302 * O(n) to O(log(n/k) + k) where k is CHAIN_INDEX_BUCKET_LEN.
303 *
304 * A nice property of the chain index, is that the "bucket" list
305 * length is max CHAIN_INDEX_BUCKET_LEN (when just build, inserts will
306 * change this). Oppose to hashing, where the "bucket" list length can
307 * vary a lot.
308 */
309 #ifndef CHAIN_INDEX_BUCKET_LEN
310 #define CHAIN_INDEX_BUCKET_LEN 40
311 #endif
313 /* Another nice property of the chain index is that inserting/creating
314 * chains in chain list don't change the correctness of the chain
315 * index, it only causes longer lists in the buckets.
316 *
317 * To mitigate the performance penalty of longer bucket lists and the
318 * penalty of rebuilding, the chain index is rebuild only when
319 * CHAIN_INDEX_INSERT_MAX chains has been added.
320 */
321 #ifndef CHAIN_INDEX_INSERT_MAX
322 #define CHAIN_INDEX_INSERT_MAX 355
323 #endif
325 static inline unsigned int iptcc_is_builtin(struct chain_head *c);
328 /* Use binary search in the chain index array, to find a chain_head
329 * pointer closest to the place of the searched name element.
330 *
331 * Notes that, binary search (obviously) requires that the chain list
332 * is sorted by name.
333 */
334 static struct list_head *
335 iptcc_bsearch_chain_index(const char *name, unsigned int *idx, TC_HANDLE_T handle)
336 {
337 unsigned int pos, end;
338 int res;
340 struct list_head *list_pos;
341 list_pos=&handle->chains;
343 /* Check for empty array, e.g. no user defined chains */
344 if (handle->chain_index_sz == 0) {
345 debug("WARNING: handle->chain_index_sz == 0\n");
346 return list_pos;
347 }
349 /* Init */
350 end = handle->chain_index_sz;
351 pos = end / 2;
353 debug("bsearch Find chain:%s (pos:%d end:%d)\n", name, pos, end);
355 /* Loop */
356 loop:
357 if (!handle->chain_index[pos]) {
358 fprintf(stderr, "ERROR: NULL pointer chain_index[%d]\n", pos);
359 return &handle->chains; /* Be safe, return orig start pos */
360 }
362 res = strcmp(name, handle->chain_index[pos]->name);
363 list_pos = &handle->chain_index[pos]->list;
364 *idx = pos;
366 debug("bsearch Index[%d] name:%s res:%d ",
367 pos, handle->chain_index[pos]->name, res);
369 if (res == 0) { /* Found element, by direct hit */
370 debug("[found] Direct hit pos:%d end:%d\n", pos, end);
371 return list_pos;
372 } else if (res < 0) { /* Too far, jump back */
373 end = pos;
374 pos = pos / 2;
376 /* Exit case: First element of array */
377 if (end == 0) {
378 debug("[found] Reached first array elem (end%d)\n",end);
379 return list_pos;
380 }
381 debug("jump back to pos:%d (end:%d)\n", pos, end);
382 goto loop;
383 } else if (res > 0 ){ /* Not far enough, jump forward */
385 /* Exit case: Last element of array */
386 if (pos == handle->chain_index_sz-1) {
387 debug("[found] Last array elem (end:%d)\n", end);
388 return list_pos;
389 }
391 /* Exit case: Next index less, thus elem in this list section */
392 res = strcmp(name, handle->chain_index[pos+1]->name);
393 if (res < 0) {
394 debug("[found] closest list (end:%d)\n", end);
395 return list_pos;
396 }
398 pos = (pos+end)/2;
399 debug("jump forward to pos:%d (end:%d)\n", pos, end);
400 goto loop;
401 }
403 return list_pos;
404 }
406 #ifdef DEBUG
407 /* Trivial linear search of chain index. Function used for verifying
408 the output of bsearch function */
409 static struct list_head *
410 iptcc_linearly_search_chain_index(const char *name, TC_HANDLE_T handle)
411 {
412 unsigned int i=0;
413 int res=0;
415 struct list_head *list_pos;
416 list_pos = &handle->chains;
418 if (handle->chain_index_sz)
419 list_pos = &handle->chain_index[0]->list;
421 /* Linearly walk of chain index array */
423 for (i=0; i < handle->chain_index_sz; i++) {
424 if (handle->chain_index[i]) {
425 res = strcmp(handle->chain_index[i]->name, name);
426 if (res > 0)
427 break; // One step too far
428 list_pos = &handle->chain_index[i]->list;
429 if (res == 0)
430 break; // Direct hit
431 }
432 }
434 return list_pos;
435 }
436 #endif
438 static int iptcc_chain_index_alloc(TC_HANDLE_T h)
439 {
440 unsigned int list_length = CHAIN_INDEX_BUCKET_LEN;
441 unsigned int array_elems;
442 unsigned int array_mem;
444 /* Allocate memory for the chain index array */
445 array_elems = (h->num_chains / list_length) +
446 (h->num_chains % list_length ? 1 : 0);
447 array_mem = sizeof(h->chain_index) * array_elems;
449 debug("Alloc Chain index, elems:%d mem:%d bytes\n",
450 array_elems, array_mem);
452 h->chain_index = malloc(array_mem);
453 if (!h->chain_index) {
454 h->chain_index_sz = 0;
455 return -ENOMEM;
456 }
457 memset(h->chain_index, 0, array_mem);
458 h->chain_index_sz = array_elems;
460 return 1;
461 }
463 static void iptcc_chain_index_free(TC_HANDLE_T h)
464 {
465 h->chain_index_sz = 0;
466 free(h->chain_index);
467 }
470 #ifdef DEBUG
471 static void iptcc_chain_index_dump(TC_HANDLE_T h)
472 {
473 unsigned int i = 0;
475 /* Dump: contents of chain index array */
476 for (i=0; i < h->chain_index_sz; i++) {
477 if (h->chain_index[i]) {
478 fprintf(stderr, "Chain index[%d].name: %s\n",
479 i, h->chain_index[i]->name);
480 }
481 }
482 }
483 #endif
485 /* Build the chain index */
486 static int iptcc_chain_index_build(TC_HANDLE_T h)
487 {
488 unsigned int list_length = CHAIN_INDEX_BUCKET_LEN;
489 unsigned int chains = 0;
490 unsigned int cindex = 0;
491 struct chain_head *c;
493 /* Build up the chain index array here */
494 debug("Building chain index\n");
496 debug("Number of user defined chains:%d bucket_sz:%d array_sz:%d\n",
497 h->num_chains, list_length, h->chain_index_sz);
499 if (h->chain_index_sz == 0)
500 return 0;
502 list_for_each_entry(c, &h->chains, list) {
504 /* Issue: The index array needs to start after the
505 * builtin chains, as they are not sorted */
506 if (!iptcc_is_builtin(c)) {
507 cindex=chains / list_length;
509 /* Safe guard, break out on array limit, this
510 * is useful if chains are added and array is
511 * rebuild, without realloc of memory. */
512 if (cindex >= h->chain_index_sz)
513 break;
515 if ((chains % list_length)== 0) {
516 debug("\nIndex[%d] Chains:", cindex);
517 h->chain_index[cindex] = c;
518 }
519 chains++;
520 }
521 debug("%s, ", c->name);
522 }
523 debug("\n");
525 return 1;
526 }
528 static int iptcc_chain_index_rebuild(TC_HANDLE_T h)
529 {
530 debug("REBUILD chain index array\n");
531 iptcc_chain_index_free(h);
532 if ((iptcc_chain_index_alloc(h)) < 0)
533 return -ENOMEM;
534 iptcc_chain_index_build(h);
535 return 1;
536 }
538 /* Delete chain (pointer) from index array. Removing an element from
539 * the chain list only affects the chain index array, if the chain
540 * index points-to/uses that list pointer.
541 *
542 * There are different strategies, the simple and safe is to rebuild
543 * the chain index every time. The more advanced is to update the
544 * array index to point to the next element, but that requires some
545 * house keeping and boundry checks. The advanced is implemented, as
546 * the simple approach behaves badly when all chains are deleted
547 * because list_for_each processing will always hit the first chain
548 * index, thus causing a rebuild for every chain.
549 */
550 static int iptcc_chain_index_delete_chain(struct chain_head *c, TC_HANDLE_T h)
551 {
552 struct list_head *index_ptr, *index_ptr2, *next;
553 struct chain_head *c2;
554 unsigned int idx, idx2;
556 index_ptr = iptcc_bsearch_chain_index(c->name, &idx, h);
558 debug("Del chain[%s] c->list:%p index_ptr:%p\n",
559 c->name, &c->list, index_ptr);
561 /* Save the next pointer */
562 next = c->list.next;
563 list_del(&c->list);
565 if (index_ptr == &c->list) { /* Chain used as index ptr */
567 /* See if its possible to avoid a rebuild, by shifting
568 * to next pointer. Its possible if the next pointer
569 * is located in the same index bucket.
570 */
571 c2 = list_entry(next, struct chain_head, list);
572 index_ptr2 = iptcc_bsearch_chain_index(c2->name, &idx2, h);
573 if (idx != idx2) {
574 /* Rebuild needed */
575 return iptcc_chain_index_rebuild(h);
576 } else {
577 /* Avoiding rebuild */
578 debug("Update cindex[%d] with next ptr name:[%s]\n",
579 idx, c2->name);
580 h->chain_index[idx]=c2;
581 return 0;
582 }
583 }
584 return 0;
585 }
588 /**********************************************************************
589 * iptc cache utility functions (iptcc_*)
590 **********************************************************************/
592 /* Is the given chain builtin (1) or user-defined (0) */
593 static inline unsigned int iptcc_is_builtin(struct chain_head *c)
594 {
595 return (c->hooknum ? 1 : 0);
596 }
598 /* Get a specific rule within a chain */
599 static struct rule_head *iptcc_get_rule_num(struct chain_head *c,
600 unsigned int rulenum)
601 {
602 struct rule_head *r;
603 unsigned int num = 0;
605 list_for_each_entry(r, &c->rules, list) {
606 num++;
607 if (num == rulenum)
608 return r;
609 }
610 return NULL;
611 }
613 /* Get a specific rule within a chain backwards */
614 static struct rule_head *iptcc_get_rule_num_reverse(struct chain_head *c,
615 unsigned int rulenum)
616 {
617 struct rule_head *r;
618 unsigned int num = 0;
620 list_for_each_entry_reverse(r, &c->rules, list) {
621 num++;
622 if (num == rulenum)
623 return r;
624 }
625 return NULL;
626 }
628 /* Returns chain head if found, otherwise NULL. */
629 static struct chain_head *
630 iptcc_find_chain_by_offset(TC_HANDLE_T handle, unsigned int offset)
631 {
632 struct list_head *pos;
634 if (list_empty(&handle->chains))
635 return NULL;
637 list_for_each(pos, &handle->chains) {
638 struct chain_head *c = list_entry(pos, struct chain_head, list);
639 if (offset >= c->head_offset && offset <= c->foot_offset)
640 return c;
641 }
643 return NULL;
644 }
646 /* Returns chain head if found, otherwise NULL. */
647 static struct chain_head *
648 iptcc_find_label(const char *name, TC_HANDLE_T handle)
649 {
650 struct list_head *pos;
651 struct list_head *list_start_pos;
652 unsigned int i=0;
653 int res;
655 if (list_empty(&handle->chains))
656 return NULL;
658 /* First look at builtin chains */
659 list_for_each(pos, &handle->chains) {
660 struct chain_head *c = list_entry(pos, struct chain_head, list);
661 if (!iptcc_is_builtin(c))
662 break;
663 if (!strcmp(c->name, name))
664 return c;
665 }
667 /* Find a smart place to start the search via chain index */
668 //list_start_pos = iptcc_linearly_search_chain_index(name, handle);
669 list_start_pos = iptcc_bsearch_chain_index(name, &i, handle);
671 /* Handel if bsearch bails out early */
672 if (list_start_pos == &handle->chains) {
673 list_start_pos = pos;
674 }
675 #ifdef DEBUG
676 else {
677 /* Verify result of bsearch against linearly index search */
678 struct list_head *test_pos;
679 struct chain_head *test_c, *tmp_c;
680 test_pos = iptcc_linearly_search_chain_index(name, handle);
681 if (list_start_pos != test_pos) {
682 debug("BUG in chain_index search\n");
683 test_c=list_entry(test_pos, struct chain_head,list);
684 tmp_c =list_entry(list_start_pos,struct chain_head,list);
685 debug("Verify search found:\n");
686 debug(" Chain:%s\n", test_c->name);
687 debug("BSearch found:\n");
688 debug(" Chain:%s\n", tmp_c->name);
689 exit(42);
690 }
691 }
692 #endif
694 /* Initial/special case, no user defined chains */
695 if (handle->num_chains == 0)
696 return NULL;
698 /* Start searching through the chain list */
699 list_for_each(pos, list_start_pos->prev) {
700 struct chain_head *c = list_entry(pos, struct chain_head, list);
701 res = strcmp(c->name, name);
702 debug("List search name:%s == %s res:%d\n", name, c->name, res);
703 if (res==0)
704 return c;
706 /* We can stop earlier as we know list is sorted */
707 if (res>0 && !iptcc_is_builtin(c)) { /* Walked too far*/
708 debug(" Not in list, walked too far, sorted list\n");
709 return NULL;
710 }
712 /* Stop on wrap around, if list head is reached */
713 if (pos == &handle->chains) {
714 debug("Stop, list head reached\n");
715 return NULL;
716 }
717 }
719 debug("List search NOT found name:%s\n", name);
720 return NULL;
721 }
723 /* called when rule is to be removed from cache */
724 static void iptcc_delete_rule(struct rule_head *r)
725 {
726 DEBUGP("deleting rule %p (offset %u)\n", r, r->offset);
727 /* clean up reference count of called chain */
728 if (r->type == IPTCC_R_JUMP
729 && r->jump)
730 r->jump->references--;
732 list_del(&r->list);
733 free(r);
734 }
737 /**********************************************************************
738 * RULESET PARSER (blob -> cache)
739 **********************************************************************/
741 /* Delete policy rule of previous chain, since cache doesn't contain
742 * chain policy rules.
743 * WARNING: This function has ugly design and relies on a lot of context, only
744 * to be called from specific places within the parser */
745 static int __iptcc_p_del_policy(TC_HANDLE_T h, unsigned int num)
746 {
747 const unsigned char *data;
749 if (h->chain_iterator_cur) {
750 /* policy rule is last rule */
751 struct rule_head *pr = (struct rule_head *)
752 h->chain_iterator_cur->rules.prev;
754 /* save verdict */
755 data = GET_TARGET(pr->entry)->data;
756 h->chain_iterator_cur->verdict = *(const int *)data;
758 /* save counter and counter_map information */
759 h->chain_iterator_cur->counter_map.maptype =
760 COUNTER_MAP_NORMAL_MAP;
761 h->chain_iterator_cur->counter_map.mappos = num-1;
762 memcpy(&h->chain_iterator_cur->counters, &pr->entry->counters,
763 sizeof(h->chain_iterator_cur->counters));
765 /* foot_offset points to verdict rule */
766 h->chain_iterator_cur->foot_index = num;
767 h->chain_iterator_cur->foot_offset = pr->offset;
769 /* delete rule from cache */
770 iptcc_delete_rule(pr);
771 h->chain_iterator_cur->num_rules--;
773 return 1;
774 }
775 return 0;
776 }
778 /* alphabetically insert a chain into the list */
779 static inline void iptc_insert_chain(TC_HANDLE_T h, struct chain_head *c)
780 {
781 struct chain_head *tmp;
782 struct list_head *list_start_pos;
783 unsigned int i=1;
785 /* Find a smart place to start the insert search */
786 list_start_pos = iptcc_bsearch_chain_index(c->name, &i, h);
788 /* Handle the case, where chain.name is smaller than index[0] */
789 if (i==0 && strcmp(c->name, h->chain_index[0]->name) <= 0) {
790 h->chain_index[0] = c; /* Update chain index head */
791 list_start_pos = h->chains.next;
792 debug("Update chain_index[0] with %s\n", c->name);
793 }
795 /* Handel if bsearch bails out early */
796 if (list_start_pos == &h->chains) {
797 list_start_pos = h->chains.next;
798 }
800 /* sort only user defined chains */
801 if (!c->hooknum) {
802 list_for_each_entry(tmp, list_start_pos->prev, list) {
803 if (!tmp->hooknum && strcmp(c->name, tmp->name) <= 0) {
804 list_add(&c->list, tmp->list.prev);
805 return;
806 }
808 /* Stop if list head is reached */
809 if (&tmp->list == &h->chains) {
810 debug("Insert, list head reached add to tail\n");
811 break;
812 }
813 }
814 }
816 /* survived till end of list: add at tail */
817 list_add_tail(&c->list, &h->chains);
818 }
820 /* Another ugly helper function split out of cache_add_entry to make it less
821 * spaghetti code */
822 static void __iptcc_p_add_chain(TC_HANDLE_T h, struct chain_head *c,
823 unsigned int offset, unsigned int *num)
824 {
825 struct list_head *tail = h->chains.prev;
826 struct chain_head *ctail;
828 __iptcc_p_del_policy(h, *num);
830 c->head_offset = offset;
831 c->index = *num;
833 /* Chains from kernel are already sorted, as they are inserted
834 * sorted. But there exists an issue when shifting to 1.4.0
835 * from an older version, as old versions allow last created
836 * chain to be unsorted.
837 */
838 if (iptcc_is_builtin(c)) /* Only user defined chains are sorted*/
839 list_add_tail(&c->list, &h->chains);
840 else {
841 ctail = list_entry(tail, struct chain_head, list);
842 if (strcmp(c->name, ctail->name) > 0)
843 list_add_tail(&c->list, &h->chains);/* Already sorted*/
844 else
845 iptc_insert_chain(h, c);/* Was not sorted */
846 }
848 h->chain_iterator_cur = c;
849 }
851 /* main parser function: add an entry from the blob to the cache */
852 static int cache_add_entry(STRUCT_ENTRY *e,
853 TC_HANDLE_T h,
854 STRUCT_ENTRY **prev,
855 unsigned int *num)
856 {
857 unsigned int builtin;
858 unsigned int offset = (char *)e - (char *)h->entries->entrytable;
860 DEBUGP("entering...");
862 /* Last entry ("policy rule"). End it.*/
863 if (iptcb_entry2offset(h,e) + e->next_offset == h->entries->size) {
864 /* This is the ERROR node at the end of the chain */
865 DEBUGP_C("%u:%u: end of table:\n", *num, offset);
867 __iptcc_p_del_policy(h, *num);
869 h->chain_iterator_cur = NULL;
870 goto out_inc;
871 }
873 /* We know this is the start of a new chain if it's an ERROR
874 * target, or a hook entry point */
876 if (strcmp(GET_TARGET(e)->u.user.name, ERROR_TARGET) == 0) {
877 struct chain_head *c =
878 iptcc_alloc_chain_head((const char *)GET_TARGET(e)->data, 0);
879 DEBUGP_C("%u:%u:new userdefined chain %s: %p\n", *num, offset,
880 (char *)c->name, c);
881 if (!c) {
882 errno = -ENOMEM;
883 return -1;
884 }
885 h->num_chains++; /* New user defined chain */
887 __iptcc_p_add_chain(h, c, offset, num);
889 } else if ((builtin = iptcb_ent_is_hook_entry(e, h)) != 0) {
890 struct chain_head *c =
891 iptcc_alloc_chain_head((char *)hooknames[builtin-1],
892 builtin);
893 DEBUGP_C("%u:%u new builtin chain: %p (rules=%p)\n",
894 *num, offset, c, &c->rules);
895 if (!c) {
896 errno = -ENOMEM;
897 return -1;
898 }
900 c->hooknum = builtin;
902 __iptcc_p_add_chain(h, c, offset, num);
904 /* FIXME: this is ugly. */
905 goto new_rule;
906 } else {
907 /* has to be normal rule */
908 struct rule_head *r;
909 new_rule:
911 if (!(r = iptcc_alloc_rule(h->chain_iterator_cur,
912 e->next_offset))) {
913 errno = ENOMEM;
914 return -1;
915 }
916 DEBUGP_C("%u:%u normal rule: %p: ", *num, offset, r);
918 r->index = *num;
919 r->offset = offset;
920 memcpy(r->entry, e, e->next_offset);
921 r->counter_map.maptype = COUNTER_MAP_NORMAL_MAP;
922 r->counter_map.mappos = r->index;
924 /* handling of jumps, etc. */
925 if (!strcmp(GET_TARGET(e)->u.user.name, STANDARD_TARGET)) {
926 STRUCT_STANDARD_TARGET *t;
928 t = (STRUCT_STANDARD_TARGET *)GET_TARGET(e);
929 if (t->target.u.target_size
930 != ALIGN(sizeof(STRUCT_STANDARD_TARGET))) {
931 errno = EINVAL;
932 return -1;
933 }
935 if (t->verdict < 0) {
936 DEBUGP_C("standard, verdict=%d\n", t->verdict);
937 r->type = IPTCC_R_STANDARD;
938 } else if (t->verdict == r->offset+e->next_offset) {
939 DEBUGP_C("fallthrough\n");
940 r->type = IPTCC_R_FALLTHROUGH;
941 } else {
942 DEBUGP_C("jump, target=%u\n", t->verdict);
943 r->type = IPTCC_R_JUMP;
944 /* Jump target fixup has to be deferred
945 * until second pass, since we migh not
946 * yet have parsed the target */
947 }
948 } else {
949 DEBUGP_C("module, target=%s\n", GET_TARGET(e)->u.user.name);
950 r->type = IPTCC_R_MODULE;
951 }
953 list_add_tail(&r->list, &h->chain_iterator_cur->rules);
954 h->chain_iterator_cur->num_rules++;
955 }
956 out_inc:
957 (*num)++;
958 return 0;
959 }
962 /* parse an iptables blob into it's pieces */
963 static int parse_table(TC_HANDLE_T h)
964 {
965 STRUCT_ENTRY *prev;
966 unsigned int num = 0;
967 struct chain_head *c;
969 /* First pass: over ruleset blob */
970 ENTRY_ITERATE(h->entries->entrytable, h->entries->size,
971 cache_add_entry, h, &prev, &num);
973 /* Build the chain index, used for chain list search speedup */
974 if ((iptcc_chain_index_alloc(h)) < 0)
975 return -ENOMEM;
976 iptcc_chain_index_build(h);
978 /* Second pass: fixup parsed data from first pass */
979 list_for_each_entry(c, &h->chains, list) {
980 struct rule_head *r;
981 list_for_each_entry(r, &c->rules, list) {
982 struct chain_head *lc;
983 STRUCT_STANDARD_TARGET *t;
985 if (r->type != IPTCC_R_JUMP)
986 continue;
988 t = (STRUCT_STANDARD_TARGET *)GET_TARGET(r->entry);
989 lc = iptcc_find_chain_by_offset(h, t->verdict);
990 if (!lc)
991 return -1;
992 r->jump = lc;
993 lc->references++;
994 }
995 }
997 /* FIXME: sort chains */
999 return 1;
1000 }
1003 /**********************************************************************
1004 * RULESET COMPILATION (cache -> blob)
1005 **********************************************************************/
1007 /* Convenience structures */
1008 struct iptcb_chain_start{
1009 STRUCT_ENTRY e;
1010 struct ipt_error_target name;
1011 };
1012 #define IPTCB_CHAIN_START_SIZE (sizeof(STRUCT_ENTRY) + \
1013 ALIGN(sizeof(struct ipt_error_target)))
1015 struct iptcb_chain_foot {
1016 STRUCT_ENTRY e;
1017 STRUCT_STANDARD_TARGET target;
1018 };
1019 #define IPTCB_CHAIN_FOOT_SIZE (sizeof(STRUCT_ENTRY) + \
1020 ALIGN(sizeof(STRUCT_STANDARD_TARGET)))
1022 struct iptcb_chain_error {
1023 STRUCT_ENTRY entry;
1024 struct ipt_error_target target;
1025 };
1026 #define IPTCB_CHAIN_ERROR_SIZE (sizeof(STRUCT_ENTRY) + \
1027 ALIGN(sizeof(struct ipt_error_target)))
1031 /* compile rule from cache into blob */
1032 static inline int iptcc_compile_rule (TC_HANDLE_T h, STRUCT_REPLACE *repl, struct rule_head *r)
1033 {
1034 /* handle jumps */
1035 if (r->type == IPTCC_R_JUMP) {
1036 STRUCT_STANDARD_TARGET *t;
1037 t = (STRUCT_STANDARD_TARGET *)GET_TARGET(r->entry);
1038 /* memset for memcmp convenience on delete/replace */
1039 memset(t->target.u.user.name, 0, FUNCTION_MAXNAMELEN);
1040 strcpy(t->target.u.user.name, STANDARD_TARGET);
1041 /* Jumps can only happen to builtin chains, so we
1042 * can safely assume that they always have a header */
1043 t->verdict = r->jump->head_offset + IPTCB_CHAIN_START_SIZE;
1044 } else if (r->type == IPTCC_R_FALLTHROUGH) {
1045 STRUCT_STANDARD_TARGET *t;
1046 t = (STRUCT_STANDARD_TARGET *)GET_TARGET(r->entry);
1047 t->verdict = r->offset + r->size;
1048 }
1050 /* copy entry from cache to blob */
1051 memcpy((char *)repl->entries+r->offset, r->entry, r->size);
1053 return 1;
1054 }
1056 /* compile chain from cache into blob */
1057 static int iptcc_compile_chain(TC_HANDLE_T h, STRUCT_REPLACE *repl, struct chain_head *c)
1058 {
1059 int ret;
1060 struct rule_head *r;
1061 struct iptcb_chain_start *head;
1062 struct iptcb_chain_foot *foot;
1064 /* only user-defined chains have heaer */
1065 if (!iptcc_is_builtin(c)) {
1066 /* put chain header in place */
1067 head = (void *)repl->entries + c->head_offset;
1068 head->e.target_offset = sizeof(STRUCT_ENTRY);
1069 head->e.next_offset = IPTCB_CHAIN_START_SIZE;
1070 strcpy(head->name.t.u.user.name, ERROR_TARGET);
1071 head->name.t.u.target_size =
1072 ALIGN(sizeof(struct ipt_error_target));
1073 strcpy(head->name.error, c->name);
1074 } else {
1075 repl->hook_entry[c->hooknum-1] = c->head_offset;
1076 repl->underflow[c->hooknum-1] = c->foot_offset;
1077 }
1079 /* iterate over rules */
1080 list_for_each_entry(r, &c->rules, list) {
1081 ret = iptcc_compile_rule(h, repl, r);
1082 if (ret < 0)
1083 return ret;
1084 }
1086 /* put chain footer in place */
1087 foot = (void *)repl->entries + c->foot_offset;
1088 foot->e.target_offset = sizeof(STRUCT_ENTRY);
1089 foot->e.next_offset = IPTCB_CHAIN_FOOT_SIZE;
1090 strcpy(foot->target.target.u.user.name, STANDARD_TARGET);
1091 foot->target.target.u.target_size =
1092 ALIGN(sizeof(STRUCT_STANDARD_TARGET));
1093 /* builtin targets have verdict, others return */
1094 if (iptcc_is_builtin(c))
1095 foot->target.verdict = c->verdict;
1096 else
1097 foot->target.verdict = RETURN;
1098 /* set policy-counters */
1099 memcpy(&foot->e.counters, &c->counters, sizeof(STRUCT_COUNTERS));
1101 return 0;
1102 }
1104 /* calculate offset and number for every rule in the cache */
1105 static int iptcc_compile_chain_offsets(TC_HANDLE_T h, struct chain_head *c,
1106 unsigned int *offset, unsigned int *num)
1107 {
1108 struct rule_head *r;
1110 c->head_offset = *offset;
1111 DEBUGP("%s: chain_head %u, offset=%u\n", c->name, *num, *offset);
1113 if (!iptcc_is_builtin(c)) {
1114 /* Chain has header */
1115 *offset += sizeof(STRUCT_ENTRY)
1116 + ALIGN(sizeof(struct ipt_error_target));
1117 (*num)++;
1118 }
1120 list_for_each_entry(r, &c->rules, list) {
1121 DEBUGP("rule %u, offset=%u, index=%u\n", *num, *offset, *num);
1122 r->offset = *offset;
1123 r->index = *num;
1124 *offset += r->size;
1125 (*num)++;
1126 }
1128 DEBUGP("%s; chain_foot %u, offset=%u, index=%u\n", c->name, *num,
1129 *offset, *num);
1130 c->foot_offset = *offset;
1131 c->foot_index = *num;
1132 *offset += sizeof(STRUCT_ENTRY)
1133 + ALIGN(sizeof(STRUCT_STANDARD_TARGET));
1134 (*num)++;
1136 return 1;
1137 }
1139 /* put the pieces back together again */
1140 static int iptcc_compile_table_prep(TC_HANDLE_T h, unsigned int *size)
1141 {
1142 struct chain_head *c;
1143 unsigned int offset = 0, num = 0;
1144 int ret = 0;
1146 /* First pass: calculate offset for every rule */
1147 list_for_each_entry(c, &h->chains, list) {
1148 ret = iptcc_compile_chain_offsets(h, c, &offset, &num);
1149 if (ret < 0)
1150 return ret;
1151 }
1153 /* Append one error rule at end of chain */
1154 num++;
1155 offset += sizeof(STRUCT_ENTRY)
1156 + ALIGN(sizeof(struct ipt_error_target));
1158 /* ruleset size is now in offset */
1159 *size = offset;
1160 return num;
1161 }
1163 static int iptcc_compile_table(TC_HANDLE_T h, STRUCT_REPLACE *repl)
1164 {
1165 struct chain_head *c;
1166 struct iptcb_chain_error *error;
1168 /* Second pass: copy from cache to offsets, fill in jumps */
1169 list_for_each_entry(c, &h->chains, list) {
1170 int ret = iptcc_compile_chain(h, repl, c);
1171 if (ret < 0)
1172 return ret;
1173 }
1175 /* Append error rule at end of chain */
1176 error = (void *)repl->entries + repl->size - IPTCB_CHAIN_ERROR_SIZE;
1177 error->entry.target_offset = sizeof(STRUCT_ENTRY);
1178 error->entry.next_offset = IPTCB_CHAIN_ERROR_SIZE;
1179 error->target.t.u.user.target_size =
1180 ALIGN(sizeof(struct ipt_error_target));
1181 strcpy((char *)&error->target.t.u.user.name, ERROR_TARGET);
1182 strcpy((char *)&error->target.error, "ERROR");
1184 return 1;
1185 }
1187 /**********************************************************************
1188 * EXTERNAL API (operates on cache only)
1189 **********************************************************************/
1191 /* Allocate handle of given size */
1192 static TC_HANDLE_T
1193 alloc_handle(const char *tablename, unsigned int size, unsigned int num_rules)
1194 {
1195 size_t len;
1196 TC_HANDLE_T h;
1198 len = sizeof(STRUCT_TC_HANDLE) + size;
1200 h = malloc(sizeof(STRUCT_TC_HANDLE));
1201 if (!h) {
1202 errno = ENOMEM;
1203 return NULL;
1204 }
1205 memset(h, 0, sizeof(*h));
1206 INIT_LIST_HEAD(&h->chains);
1207 strcpy(h->info.name, tablename);
1209 h->entries = malloc(sizeof(STRUCT_GET_ENTRIES) + size);
1210 if (!h->entries)
1211 goto out_free_handle;
1213 strcpy(h->entries->name, tablename);
1214 h->entries->size = size;
1216 return h;
1218 out_free_handle:
1219 free(h);
1221 return NULL;
1222 }
1225 TC_HANDLE_T
1226 TC_INIT(const char *tablename)
1227 {
1228 TC_HANDLE_T h;
1229 STRUCT_GETINFO info;
1230 unsigned int tmp;
1231 socklen_t s;
1233 iptc_fn = TC_INIT;
1235 if (strlen(tablename) >= TABLE_MAXNAMELEN) {
1236 errno = EINVAL;
1237 return NULL;
1238 }
1240 if (sockfd_use == 0) {
1241 sockfd = socket(TC_AF, SOCK_RAW, IPPROTO_RAW);
1242 if (sockfd < 0)
1243 return NULL;
1244 }
1245 sockfd_use++;
1246 retry:
1247 s = sizeof(info);
1249 strcpy(info.name, tablename);
1250 if (getsockopt(sockfd, TC_IPPROTO, SO_GET_INFO, &info, &s) < 0) {
1251 if (--sockfd_use == 0) {
1252 close(sockfd);
1253 sockfd = -1;
1254 }
1255 return NULL;
1256 }
1258 DEBUGP("valid_hooks=0x%08x, num_entries=%u, size=%u\n",
1259 info.valid_hooks, info.num_entries, info.size);
1261 if ((h = alloc_handle(info.name, info.size, info.num_entries))
1262 == NULL) {
1263 if (--sockfd_use == 0) {
1264 close(sockfd);
1265 sockfd = -1;
1266 }
1267 return NULL;
1268 }
1270 /* Initialize current state */
1271 h->info = info;
1273 h->entries->size = h->info.size;
1275 tmp = sizeof(STRUCT_GET_ENTRIES) + h->info.size;
1277 if (getsockopt(sockfd, TC_IPPROTO, SO_GET_ENTRIES, h->entries,
1278 &tmp) < 0)
1279 goto error;
1281 #ifdef IPTC_DEBUG2
1282 {
1283 int fd = open("/tmp/libiptc-so_get_entries.blob",
1284 O_CREAT|O_WRONLY);
1285 if (fd >= 0) {
1286 write(fd, h->entries, tmp);
1287 close(fd);
1288 }
1289 }
1290 #endif
1292 if (parse_table(h) < 0)
1293 goto error;
1295 CHECK(h);
1296 return h;
1297 error:
1298 TC_FREE(&h);
1299 /* A different process changed the ruleset size, retry */
1300 if (errno == EAGAIN)
1301 goto retry;
1302 return NULL;
1303 }
1305 void
1306 TC_FREE(TC_HANDLE_T *h)
1307 {
1308 struct chain_head *c, *tmp;
1310 iptc_fn = TC_FREE;
1311 if (--sockfd_use == 0) {
1312 close(sockfd);
1313 sockfd = -1;
1314 }
1316 list_for_each_entry_safe(c, tmp, &(*h)->chains, list) {
1317 struct rule_head *r, *rtmp;
1319 list_for_each_entry_safe(r, rtmp, &c->rules, list) {
1320 free(r);
1321 }
1323 free(c);
1324 }
1326 iptcc_chain_index_free(*h);
1328 free((*h)->entries);
1329 free(*h);
1331 *h = NULL;
1332 }
1334 static inline int
1335 print_match(const STRUCT_ENTRY_MATCH *m)
1336 {
1337 printf("Match name: `%s'\n", m->u.user.name);
1338 return 0;
1339 }
1341 static int dump_entry(STRUCT_ENTRY *e, const TC_HANDLE_T handle);
1343 void
1344 TC_DUMP_ENTRIES(const TC_HANDLE_T handle)
1345 {
1346 iptc_fn = TC_DUMP_ENTRIES;
1347 CHECK(handle);
1349 printf("libiptc v%s. %u bytes.\n",
1350 XTABLES_VERSION, handle->entries->size);
1351 printf("Table `%s'\n", handle->info.name);
1352 printf("Hooks: pre/in/fwd/out/post = %u/%u/%u/%u/%u\n",
1353 handle->info.hook_entry[HOOK_PRE_ROUTING],
1354 handle->info.hook_entry[HOOK_LOCAL_IN],
1355 handle->info.hook_entry[HOOK_FORWARD],
1356 handle->info.hook_entry[HOOK_LOCAL_OUT],
1357 handle->info.hook_entry[HOOK_POST_ROUTING]);
1358 printf("Underflows: pre/in/fwd/out/post = %u/%u/%u/%u/%u\n",
1359 handle->info.underflow[HOOK_PRE_ROUTING],
1360 handle->info.underflow[HOOK_LOCAL_IN],
1361 handle->info.underflow[HOOK_FORWARD],
1362 handle->info.underflow[HOOK_LOCAL_OUT],
1363 handle->info.underflow[HOOK_POST_ROUTING]);
1365 ENTRY_ITERATE(handle->entries->entrytable, handle->entries->size,
1366 dump_entry, handle);
1367 }
1369 /* Does this chain exist? */
1370 int TC_IS_CHAIN(const char *chain, const TC_HANDLE_T handle)
1371 {
1372 iptc_fn = TC_IS_CHAIN;
1373 return iptcc_find_label(chain, handle) != NULL;
1374 }
1376 static void iptcc_chain_iterator_advance(TC_HANDLE_T handle)
1377 {
1378 struct chain_head *c = handle->chain_iterator_cur;
1380 if (c->list.next == &handle->chains)
1381 handle->chain_iterator_cur = NULL;
1382 else
1383 handle->chain_iterator_cur =
1384 list_entry(c->list.next, struct chain_head, list);
1385 }
1387 /* Iterator functions to run through the chains. */
1388 const char *
1389 TC_FIRST_CHAIN(TC_HANDLE_T *handle)
1390 {
1391 struct chain_head *c = list_entry((*handle)->chains.next,
1392 struct chain_head, list);
1394 iptc_fn = TC_FIRST_CHAIN;
1397 if (list_empty(&(*handle)->chains)) {
1398 DEBUGP(": no chains\n");
1399 return NULL;
1400 }
1402 (*handle)->chain_iterator_cur = c;
1403 iptcc_chain_iterator_advance(*handle);
1405 DEBUGP(": returning `%s'\n", c->name);
1406 return c->name;
1407 }
1409 /* Iterator functions to run through the chains. Returns NULL at end. */
1410 const char *
1411 TC_NEXT_CHAIN(TC_HANDLE_T *handle)
1412 {
1413 struct chain_head *c = (*handle)->chain_iterator_cur;
1415 iptc_fn = TC_NEXT_CHAIN;
1417 if (!c) {
1418 DEBUGP(": no more chains\n");
1419 return NULL;
1420 }
1422 iptcc_chain_iterator_advance(*handle);
1424 DEBUGP(": returning `%s'\n", c->name);
1425 return c->name;
1426 }
1428 /* Get first rule in the given chain: NULL for empty chain. */
1429 const STRUCT_ENTRY *
1430 TC_FIRST_RULE(const char *chain, TC_HANDLE_T *handle)
1431 {
1432 struct chain_head *c;
1433 struct rule_head *r;
1435 iptc_fn = TC_FIRST_RULE;
1437 DEBUGP("first rule(%s): ", chain);
1439 c = iptcc_find_label(chain, *handle);
1440 if (!c) {
1441 errno = ENOENT;
1442 return NULL;
1443 }
1445 /* Empty chain: single return/policy rule */
1446 if (list_empty(&c->rules)) {
1447 DEBUGP_C("no rules, returning NULL\n");
1448 return NULL;
1449 }
1451 r = list_entry(c->rules.next, struct rule_head, list);
1452 (*handle)->rule_iterator_cur = r;
1453 DEBUGP_C("%p\n", r);
1455 return r->entry;
1456 }
1458 /* Returns NULL when rules run out. */
1459 const STRUCT_ENTRY *
1460 TC_NEXT_RULE(const STRUCT_ENTRY *prev, TC_HANDLE_T *handle)
1461 {
1462 struct rule_head *r;
1464 iptc_fn = TC_NEXT_RULE;
1465 DEBUGP("rule_iterator_cur=%p...", (*handle)->rule_iterator_cur);
1467 if (!(*handle)->rule_iterator_cur) {
1468 DEBUGP_C("returning NULL\n");
1469 return NULL;
1470 }
1472 r = list_entry((*handle)->rule_iterator_cur->list.next,
1473 struct rule_head, list);
1475 iptc_fn = TC_NEXT_RULE;
1477 DEBUGP_C("next=%p, head=%p...", &r->list,
1478 &(*handle)->rule_iterator_cur->chain->rules);
1480 if (&r->list == &(*handle)->rule_iterator_cur->chain->rules) {
1481 (*handle)->rule_iterator_cur = NULL;
1482 DEBUGP_C("finished, returning NULL\n");
1483 return NULL;
1484 }
1486 (*handle)->rule_iterator_cur = r;
1488 /* NOTE: prev is without any influence ! */
1489 DEBUGP_C("returning rule %p\n", r);
1490 return r->entry;
1491 }
1493 /* How many rules in this chain? */
1494 #if 0
1495 static unsigned int
1496 TC_NUM_RULES(const char *chain, TC_HANDLE_T *handle)
1497 {
1498 struct chain_head *c;
1499 iptc_fn = TC_NUM_RULES;
1500 CHECK(*handle);
1502 c = iptcc_find_label(chain, *handle);
1503 if (!c) {
1504 errno = ENOENT;
1505 return (unsigned int)-1;
1506 }
1508 return c->num_rules;
1509 }
1510 #endif
1512 #if 0
1513 static const STRUCT_ENTRY *
1514 TC_GET_RULE(const char *chain, unsigned int n, TC_HANDLE_T *handle)
1515 {
1516 struct chain_head *c;
1517 struct rule_head *r;
1519 iptc_fn = TC_GET_RULE;
1521 CHECK(*handle);
1523 c = iptcc_find_label(chain, *handle);
1524 if (!c) {
1525 errno = ENOENT;
1526 return NULL;
1527 }
1529 r = iptcc_get_rule_num(c, n);
1530 if (!r)
1531 return NULL;
1532 return r->entry;
1533 }
1534 #endif
1536 /* Returns a pointer to the target name of this position. */
1537 static const char *standard_target_map(int verdict)
1538 {
1539 switch (verdict) {
1540 case RETURN:
1541 return LABEL_RETURN;
1542 break;
1543 case -NF_ACCEPT-1:
1544 return LABEL_ACCEPT;
1545 break;
1546 case -NF_DROP-1:
1547 return LABEL_DROP;
1548 break;
1549 case -NF_QUEUE-1:
1550 return LABEL_QUEUE;
1551 break;
1552 default:
1553 fprintf(stderr, "ERROR: %d not a valid target)\n",
1554 verdict);
1555 abort();
1556 break;
1557 }
1558 /* not reached */
1559 return NULL;
1560 }
1562 /* Returns a pointer to the target name of this position. */
1563 const char *TC_GET_TARGET(const STRUCT_ENTRY *ce,
1564 TC_HANDLE_T *handle)
1565 {
1566 STRUCT_ENTRY *e = (STRUCT_ENTRY *)ce;
1567 struct rule_head *r = container_of(e, struct rule_head, entry[0]);
1568 const unsigned char *data;
1570 iptc_fn = TC_GET_TARGET;
1572 switch(r->type) {
1573 int spos;
1574 case IPTCC_R_FALLTHROUGH:
1575 return "";
1576 break;
1577 case IPTCC_R_JUMP:
1578 DEBUGP("r=%p, jump=%p, name=`%s'\n", r, r->jump, r->jump->name);
1579 return r->jump->name;
1580 break;
1581 case IPTCC_R_STANDARD:
1582 data = GET_TARGET(e)->data;
1583 spos = *(const int *)data;
1584 DEBUGP("r=%p, spos=%d'\n", r, spos);
1585 return standard_target_map(spos);
1586 break;
1587 case IPTCC_R_MODULE:
1588 return GET_TARGET(e)->u.user.name;
1589 break;
1590 }
1591 return NULL;
1592 }
1593 /* Is this a built-in chain? Actually returns hook + 1. */
1594 int
1595 TC_BUILTIN(const char *chain, const TC_HANDLE_T handle)
1596 {
1597 struct chain_head *c;
1599 iptc_fn = TC_BUILTIN;
1601 c = iptcc_find_label(chain, handle);
1602 if (!c) {
1603 errno = ENOENT;
1604 return 0;
1605 }
1607 return iptcc_is_builtin(c);
1608 }
1610 /* Get the policy of a given built-in chain */
1611 const char *
1612 TC_GET_POLICY(const char *chain,
1613 STRUCT_COUNTERS *counters,
1614 TC_HANDLE_T *handle)
1615 {
1616 struct chain_head *c;
1618 iptc_fn = TC_GET_POLICY;
1620 DEBUGP("called for chain %s\n", chain);
1622 c = iptcc_find_label(chain, *handle);
1623 if (!c) {
1624 errno = ENOENT;
1625 return NULL;
1626 }
1628 if (!iptcc_is_builtin(c))
1629 return NULL;
1631 *counters = c->counters;
1633 return standard_target_map(c->verdict);
1634 }
1636 static int
1637 iptcc_standard_map(struct rule_head *r, int verdict)
1638 {
1639 STRUCT_ENTRY *e = r->entry;
1640 STRUCT_STANDARD_TARGET *t;
1642 t = (STRUCT_STANDARD_TARGET *)GET_TARGET(e);
1644 if (t->target.u.target_size
1645 != ALIGN(sizeof(STRUCT_STANDARD_TARGET))) {
1646 errno = EINVAL;
1647 return 0;
1648 }
1649 /* memset for memcmp convenience on delete/replace */
1650 memset(t->target.u.user.name, 0, FUNCTION_MAXNAMELEN);
1651 strcpy(t->target.u.user.name, STANDARD_TARGET);
1652 t->verdict = verdict;
1654 r->type = IPTCC_R_STANDARD;
1656 return 1;
1657 }
1659 static int
1660 iptcc_map_target(const TC_HANDLE_T handle,
1661 struct rule_head *r)
1662 {
1663 STRUCT_ENTRY *e = r->entry;
1664 STRUCT_ENTRY_TARGET *t = GET_TARGET(e);
1666 /* Maybe it's empty (=> fall through) */
1667 if (strcmp(t->u.user.name, "") == 0) {
1668 r->type = IPTCC_R_FALLTHROUGH;
1669 return 1;
1670 }
1671 /* Maybe it's a standard target name... */
1672 else if (strcmp(t->u.user.name, LABEL_ACCEPT) == 0)
1673 return iptcc_standard_map(r, -NF_ACCEPT - 1);
1674 else if (strcmp(t->u.user.name, LABEL_DROP) == 0)
1675 return iptcc_standard_map(r, -NF_DROP - 1);
1676 else if (strcmp(t->u.user.name, LABEL_QUEUE) == 0)
1677 return iptcc_standard_map(r, -NF_QUEUE - 1);
1678 else if (strcmp(t->u.user.name, LABEL_RETURN) == 0)
1679 return iptcc_standard_map(r, RETURN);
1680 else if (TC_BUILTIN(t->u.user.name, handle)) {
1681 /* Can't jump to builtins. */
1682 errno = EINVAL;
1683 return 0;
1684 } else {
1685 /* Maybe it's an existing chain name. */
1686 struct chain_head *c;
1687 DEBUGP("trying to find chain `%s': ", t->u.user.name);
1689 c = iptcc_find_label(t->u.user.name, handle);
1690 if (c) {
1691 DEBUGP_C("found!\n");
1692 r->type = IPTCC_R_JUMP;
1693 r->jump = c;
1694 c->references++;
1695 return 1;
1696 }
1697 DEBUGP_C("not found :(\n");
1698 }
1700 /* Must be a module? If not, kernel will reject... */
1701 /* memset to all 0 for your memcmp convenience: don't clear version */
1702 memset(t->u.user.name + strlen(t->u.user.name),
1703 0,
1704 FUNCTION_MAXNAMELEN - 1 - strlen(t->u.user.name));
1705 r->type = IPTCC_R_MODULE;
1706 set_changed(handle);
1707 return 1;
1708 }
1710 /* Insert the entry `fw' in chain `chain' into position `rulenum'. */
1711 int
1712 TC_INSERT_ENTRY(const IPT_CHAINLABEL chain,
1713 const STRUCT_ENTRY *e,
1714 unsigned int rulenum,
1715 TC_HANDLE_T *handle)
1716 {
1717 struct chain_head *c;
1718 struct rule_head *r;
1719 struct list_head *prev;
1721 iptc_fn = TC_INSERT_ENTRY;
1723 if (!(c = iptcc_find_label(chain, *handle))) {
1724 errno = ENOENT;
1725 return 0;
1726 }
1728 /* first rulenum index = 0
1729 first c->num_rules index = 1 */
1730 if (rulenum > c->num_rules) {
1731 errno = E2BIG;
1732 return 0;
1733 }
1735 /* If we are inserting at the end just take advantage of the
1736 double linked list, insert will happen before the entry
1737 prev points to. */
1738 if (rulenum == c->num_rules) {
1739 prev = &c->rules;
1740 } else if (rulenum + 1 <= c->num_rules/2) {
1741 r = iptcc_get_rule_num(c, rulenum + 1);
1742 prev = &r->list;
1743 } else {
1744 r = iptcc_get_rule_num_reverse(c, c->num_rules - rulenum);
1745 prev = &r->list;
1746 }
1748 if (!(r = iptcc_alloc_rule(c, e->next_offset))) {
1749 errno = ENOMEM;
1750 return 0;
1751 }
1753 memcpy(r->entry, e, e->next_offset);
1754 r->counter_map.maptype = COUNTER_MAP_SET;
1756 if (!iptcc_map_target(*handle, r)) {
1757 free(r);
1758 return 0;
1759 }
1761 list_add_tail(&r->list, prev);
1762 c->num_rules++;
1764 set_changed(*handle);
1766 return 1;
1767 }
1769 /* Atomically replace rule `rulenum' in `chain' with `fw'. */
1770 int
1771 TC_REPLACE_ENTRY(const IPT_CHAINLABEL chain,
1772 const STRUCT_ENTRY *e,
1773 unsigned int rulenum,
1774 TC_HANDLE_T *handle)
1775 {
1776 struct chain_head *c;
1777 struct rule_head *r, *old;
1779 iptc_fn = TC_REPLACE_ENTRY;
1781 if (!(c = iptcc_find_label(chain, *handle))) {
1782 errno = ENOENT;
1783 return 0;
1784 }
1786 if (rulenum >= c->num_rules) {
1787 errno = E2BIG;
1788 return 0;
1789 }
1791 /* Take advantage of the double linked list if possible. */
1792 if (rulenum + 1 <= c->num_rules/2) {
1793 old = iptcc_get_rule_num(c, rulenum + 1);
1794 } else {
1795 old = iptcc_get_rule_num_reverse(c, c->num_rules - rulenum);
1796 }
1798 if (!(r = iptcc_alloc_rule(c, e->next_offset))) {
1799 errno = ENOMEM;
1800 return 0;
1801 }
1803 memcpy(r->entry, e, e->next_offset);
1804 r->counter_map.maptype = COUNTER_MAP_SET;
1806 if (!iptcc_map_target(*handle, r)) {
1807 free(r);
1808 return 0;
1809 }
1811 list_add(&r->list, &old->list);
1812 iptcc_delete_rule(old);
1814 set_changed(*handle);
1816 return 1;
1817 }
1819 /* Append entry `fw' to chain `chain'. Equivalent to insert with
1820 rulenum = length of chain. */
1821 int
1822 TC_APPEND_ENTRY(const IPT_CHAINLABEL chain,
1823 const STRUCT_ENTRY *e,
1824 TC_HANDLE_T *handle)
1825 {
1826 struct chain_head *c;
1827 struct rule_head *r;
1829 iptc_fn = TC_APPEND_ENTRY;
1830 if (!(c = iptcc_find_label(chain, *handle))) {
1831 DEBUGP("unable to find chain `%s'\n", chain);
1832 errno = ENOENT;
1833 return 0;
1834 }
1836 if (!(r = iptcc_alloc_rule(c, e->next_offset))) {
1837 DEBUGP("unable to allocate rule for chain `%s'\n", chain);
1838 errno = ENOMEM;
1839 return 0;
1840 }
1842 memcpy(r->entry, e, e->next_offset);
1843 r->counter_map.maptype = COUNTER_MAP_SET;
1845 if (!iptcc_map_target(*handle, r)) {
1846 DEBUGP("unable to map target of rule for chain `%s'\n", chain);
1847 free(r);
1848 return 0;
1849 }
1851 list_add_tail(&r->list, &c->rules);
1852 c->num_rules++;
1854 set_changed(*handle);
1856 return 1;
1857 }
1859 static inline int
1860 match_different(const STRUCT_ENTRY_MATCH *a,
1861 const unsigned char *a_elems,
1862 const unsigned char *b_elems,
1863 unsigned char **maskptr)
1864 {
1865 const STRUCT_ENTRY_MATCH *b;
1866 unsigned int i;
1868 /* Offset of b is the same as a. */
1869 b = (void *)b_elems + ((unsigned char *)a - a_elems);
1871 if (a->u.match_size != b->u.match_size)
1872 return 1;
1874 if (strcmp(a->u.user.name, b->u.user.name) != 0)
1875 return 1;
1877 *maskptr += ALIGN(sizeof(*a));
1879 for (i = 0; i < a->u.match_size - ALIGN(sizeof(*a)); i++)
1880 if (((a->data[i] ^ b->data[i]) & (*maskptr)[i]) != 0)
1881 return 1;
1882 *maskptr += i;
1883 return 0;
1884 }
1886 static inline int
1887 target_same(struct rule_head *a, struct rule_head *b,const unsigned char *mask)
1888 {
1889 unsigned int i;
1890 STRUCT_ENTRY_TARGET *ta, *tb;
1892 if (a->type != b->type)
1893 return 0;
1895 ta = GET_TARGET(a->entry);
1896 tb = GET_TARGET(b->entry);
1898 switch (a->type) {
1899 case IPTCC_R_FALLTHROUGH:
1900 return 1;
1901 case IPTCC_R_JUMP:
1902 return a->jump == b->jump;
1903 case IPTCC_R_STANDARD:
1904 return ((STRUCT_STANDARD_TARGET *)ta)->verdict
1905 == ((STRUCT_STANDARD_TARGET *)tb)->verdict;
1906 case IPTCC_R_MODULE:
1907 if (ta->u.target_size != tb->u.target_size)
1908 return 0;
1909 if (strcmp(ta->u.user.name, tb->u.user.name) != 0)
1910 return 0;
1912 for (i = 0; i < ta->u.target_size - sizeof(*ta); i++)
1913 if (((ta->data[i] ^ tb->data[i]) & mask[i]) != 0)
1914 return 0;
1915 return 1;
1916 default:
1917 fprintf(stderr, "ERROR: bad type %i\n", a->type);
1918 abort();
1919 }
1920 }
1922 static unsigned char *
1923 is_same(const STRUCT_ENTRY *a,
1924 const STRUCT_ENTRY *b,
1925 unsigned char *matchmask);
1927 /* Delete the first rule in `chain' which matches `fw'. */
1928 int
1929 TC_DELETE_ENTRY(const IPT_CHAINLABEL chain,
1930 const STRUCT_ENTRY *origfw,
1931 unsigned char *matchmask,
1932 TC_HANDLE_T *handle)
1933 {
1934 struct chain_head *c;
1935 struct rule_head *r, *i;
1937 iptc_fn = TC_DELETE_ENTRY;
1938 if (!(c = iptcc_find_label(chain, *handle))) {
1939 errno = ENOENT;
1940 return 0;
1941 }
1943 /* Create a rule_head from origfw. */
1944 r = iptcc_alloc_rule(c, origfw->next_offset);
1945 if (!r) {
1946 errno = ENOMEM;
1947 return 0;
1948 }
1950 memcpy(r->entry, origfw, origfw->next_offset);
1951 r->counter_map.maptype = COUNTER_MAP_NOMAP;
1952 if (!iptcc_map_target(*handle, r)) {
1953 DEBUGP("unable to map target of rule for chain `%s'\n", chain);
1954 free(r);
1955 return 0;
1956 } else {
1957 /* iptcc_map_target increment target chain references
1958 * since this is a fake rule only used for matching
1959 * the chain references count is decremented again.
1960 */
1961 if (r->type == IPTCC_R_JUMP
1962 && r->jump)
1963 r->jump->references--;
1964 }
1966 list_for_each_entry(i, &c->rules, list) {
1967 unsigned char *mask;
1969 mask = is_same(r->entry, i->entry, matchmask);
1970 if (!mask)
1971 continue;
1973 if (!target_same(r, i, mask))
1974 continue;
1976 /* If we are about to delete the rule that is the
1977 * current iterator, move rule iterator back. next
1978 * pointer will then point to real next node */
1979 if (i == (*handle)->rule_iterator_cur) {
1980 (*handle)->rule_iterator_cur =
1981 list_entry((*handle)->rule_iterator_cur->list.prev,
1982 struct rule_head, list);
1983 }
1985 c->num_rules--;
1986 iptcc_delete_rule(i);
1988 set_changed(*handle);
1989 free(r);
1990 return 1;
1991 }
1993 free(r);
1994 errno = ENOENT;
1995 return 0;
1996 }
1999 /* Delete the rule in position `rulenum' in `chain'. */
2000 int
2001 TC_DELETE_NUM_ENTRY(const IPT_CHAINLABEL chain,
2002 unsigned int rulenum,
2003 TC_HANDLE_T *handle)
2004 {
2005 struct chain_head *c;
2006 struct rule_head *r;
2008 iptc_fn = TC_DELETE_NUM_ENTRY;
2010 if (!(c = iptcc_find_label(chain, *handle))) {
2011 errno = ENOENT;
2012 return 0;
2013 }
2015 if (rulenum >= c->num_rules) {
2016 errno = E2BIG;
2017 return 0;
2018 }
2020 /* Take advantage of the double linked list if possible. */
2021 if (rulenum + 1 <= c->num_rules/2) {
2022 r = iptcc_get_rule_num(c, rulenum + 1);
2023 } else {
2024 r = iptcc_get_rule_num_reverse(c, c->num_rules - rulenum);
2025 }
2027 /* If we are about to delete the rule that is the current
2028 * iterator, move rule iterator back. next pointer will then
2029 * point to real next node */
2030 if (r == (*handle)->rule_iterator_cur) {
2031 (*handle)->rule_iterator_cur =
2032 list_entry((*handle)->rule_iterator_cur->list.prev,
2033 struct rule_head, list);
2034 }
2036 c->num_rules--;
2037 iptcc_delete_rule(r);
2039 set_changed(*handle);
2041 return 1;
2042 }
2044 /* Check the packet `fw' on chain `chain'. Returns the verdict, or
2045 NULL and sets errno. */
2046 const char *
2047 TC_CHECK_PACKET(const IPT_CHAINLABEL chain,
2048 STRUCT_ENTRY *entry,
2049 TC_HANDLE_T *handle)
2050 {
2051 iptc_fn = TC_CHECK_PACKET;
2052 errno = ENOSYS;
2053 return NULL;
2054 }
2056 /* Flushes the entries in the given chain (ie. empties chain). */
2057 int
2058 TC_FLUSH_ENTRIES(const IPT_CHAINLABEL chain, TC_HANDLE_T *handle)
2059 {
2060 struct chain_head *c;
2061 struct rule_head *r, *tmp;
2063 iptc_fn = TC_FLUSH_ENTRIES;
2064 if (!(c = iptcc_find_label(chain, *handle))) {
2065 errno = ENOENT;
2066 return 0;
2067 }
2069 list_for_each_entry_safe(r, tmp, &c->rules, list) {
2070 iptcc_delete_rule(r);
2071 }
2073 c->num_rules = 0;
2075 set_changed(*handle);
2077 return 1;
2078 }
2080 /* Zeroes the counters in a chain. */
2081 int
2082 TC_ZERO_ENTRIES(const IPT_CHAINLABEL chain, TC_HANDLE_T *handle)
2083 {
2084 struct chain_head *c;
2085 struct rule_head *r;
2087 iptc_fn = TC_ZERO_ENTRIES;
2088 if (!(c = iptcc_find_label(chain, *handle))) {
2089 errno = ENOENT;
2090 return 0;
2091 }
2093 if (c->counter_map.maptype == COUNTER_MAP_NORMAL_MAP)
2094 c->counter_map.maptype = COUNTER_MAP_ZEROED;
2096 list_for_each_entry(r, &c->rules, list) {
2097 if (r->counter_map.maptype == COUNTER_MAP_NORMAL_MAP)
2098 r->counter_map.maptype = COUNTER_MAP_ZEROED;
2099 }
2101 set_changed(*handle);
2103 return 1;
2104 }
2106 STRUCT_COUNTERS *
2107 TC_READ_COUNTER(const IPT_CHAINLABEL chain,
2108 unsigned int rulenum,
2109 TC_HANDLE_T *handle)
2110 {
2111 struct chain_head *c;
2112 struct rule_head *r;
2114 iptc_fn = TC_READ_COUNTER;
2115 CHECK(*handle);
2117 if (!(c = iptcc_find_label(chain, *handle))) {
2118 errno = ENOENT;
2119 return NULL;
2120 }
2122 if (!(r = iptcc_get_rule_num(c, rulenum))) {
2123 errno = E2BIG;
2124 return NULL;
2125 }
2127 return &r->entry[0].counters;
2128 }
2130 int
2131 TC_ZERO_COUNTER(const IPT_CHAINLABEL chain,
2132 unsigned int rulenum,
2133 TC_HANDLE_T *handle)
2134 {
2135 struct chain_head *c;
2136 struct rule_head *r;
2138 iptc_fn = TC_ZERO_COUNTER;
2139 CHECK(*handle);
2141 if (!(c = iptcc_find_label(chain, *handle))) {
2142 errno = ENOENT;
2143 return 0;
2144 }
2146 if (!(r = iptcc_get_rule_num(c, rulenum))) {
2147 errno = E2BIG;
2148 return 0;
2149 }
2151 if (r->counter_map.maptype == COUNTER_MAP_NORMAL_MAP)
2152 r->counter_map.maptype = COUNTER_MAP_ZEROED;
2154 set_changed(*handle);
2156 return 1;
2157 }
2159 int
2160 TC_SET_COUNTER(const IPT_CHAINLABEL chain,
2161 unsigned int rulenum,
2162 STRUCT_COUNTERS *counters,
2163 TC_HANDLE_T *handle)
2164 {
2165 struct chain_head *c;
2166 struct rule_head *r;
2167 STRUCT_ENTRY *e;
2169 iptc_fn = TC_SET_COUNTER;
2170 CHECK(*handle);
2172 if (!(c = iptcc_find_label(chain, *handle))) {
2173 errno = ENOENT;
2174 return 0;
2175 }
2177 if (!(r = iptcc_get_rule_num(c, rulenum))) {
2178 errno = E2BIG;
2179 return 0;
2180 }
2182 e = r->entry;
2183 r->counter_map.maptype = COUNTER_MAP_SET;
2185 memcpy(&e->counters, counters, sizeof(STRUCT_COUNTERS));
2187 set_changed(*handle);
2189 return 1;
2190 }
2192 /* Creates a new chain. */
2193 /* To create a chain, create two rules: error node and unconditional
2194 * return. */
2195 int
2196 TC_CREATE_CHAIN(const IPT_CHAINLABEL chain, TC_HANDLE_T *handle)
2197 {
2198 static struct chain_head *c;
2199 int capacity;
2200 int exceeded;
2202 iptc_fn = TC_CREATE_CHAIN;
2204 /* find_label doesn't cover built-in targets: DROP, ACCEPT,
2205 QUEUE, RETURN. */
2206 if (iptcc_find_label(chain, *handle)
2207 || strcmp(chain, LABEL_DROP) == 0
2208 || strcmp(chain, LABEL_ACCEPT) == 0
2209 || strcmp(chain, LABEL_QUEUE) == 0
2210 || strcmp(chain, LABEL_RETURN) == 0) {
2211 DEBUGP("Chain `%s' already exists\n", chain);
2212 errno = EEXIST;
2213 return 0;
2214 }
2216 if (strlen(chain)+1 > sizeof(IPT_CHAINLABEL)) {
2217 DEBUGP("Chain name `%s' too long\n", chain);
2218 errno = EINVAL;
2219 return 0;
2220 }
2222 c = iptcc_alloc_chain_head(chain, 0);
2223 if (!c) {
2224 DEBUGP("Cannot allocate memory for chain `%s'\n", chain);
2225 errno = ENOMEM;
2226 return 0;
2228 }
2229 (*handle)->num_chains++; /* New user defined chain */
2231 DEBUGP("Creating chain `%s'\n", chain);
2232 iptc_insert_chain(*handle, c); /* Insert sorted */
2234 /* Inserting chains don't change the correctness of the chain
2235 * index (except if its smaller than index[0], but that
2236 * handled by iptc_insert_chain). It only causes longer lists
2237 * in the buckets. Thus, only rebuild chain index when the
2238 * capacity is exceed with CHAIN_INDEX_INSERT_MAX chains.
2239 */
2240 capacity = (*handle)->chain_index_sz * CHAIN_INDEX_BUCKET_LEN;
2241 exceeded = ((((*handle)->num_chains)-capacity));
2242 if (exceeded > CHAIN_INDEX_INSERT_MAX) {
2243 debug("Capacity(%d) exceeded(%d) rebuild (chains:%d)\n",
2244 capacity, exceeded, (*handle)->num_chains);
2245 iptcc_chain_index_rebuild(*handle);
2246 }
2248 set_changed(*handle);
2250 return 1;
2251 }
2253 /* Get the number of references to this chain. */
2254 int
2255 TC_GET_REFERENCES(unsigned int *ref, const IPT_CHAINLABEL chain,
2256 TC_HANDLE_T *handle)
2257 {
2258 struct chain_head *c;
2260 iptc_fn = TC_GET_REFERENCES;
2261 if (!(c = iptcc_find_label(chain, *handle))) {
2262 errno = ENOENT;
2263 return 0;
2264 }
2266 *ref = c->references;
2268 return 1;
2269 }
2271 /* Deletes a chain. */
2272 int
2273 TC_DELETE_CHAIN(const IPT_CHAINLABEL chain, TC_HANDLE_T *handle)
2274 {
2275 unsigned int references;
2276 struct chain_head *c;
2278 iptc_fn = TC_DELETE_CHAIN;
2280 if (!(c = iptcc_find_label(chain, *handle))) {
2281 DEBUGP("cannot find chain `%s'\n", chain);
2282 errno = ENOENT;
2283 return 0;
2284 }
2286 if (TC_BUILTIN(chain, *handle)) {
2287 DEBUGP("cannot remove builtin chain `%s'\n", chain);
2288 errno = EINVAL;
2289 return 0;
2290 }
2292 if (!TC_GET_REFERENCES(&references, chain, handle)) {
2293 DEBUGP("cannot get references on chain `%s'\n", chain);
2294 return 0;
2295 }
2297 if (references > 0) {
2298 DEBUGP("chain `%s' still has references\n", chain);
2299 errno = EMLINK;
2300 return 0;
2301 }
2303 if (c->num_rules) {
2304 DEBUGP("chain `%s' is not empty\n", chain);
2305 errno = ENOTEMPTY;
2306 return 0;
2307 }
2309 /* If we are about to delete the chain that is the current
2310 * iterator, move chain iterator forward. */
2311 if (c == (*handle)->chain_iterator_cur)
2312 iptcc_chain_iterator_advance(*handle);
2314 (*handle)->num_chains--; /* One user defined chain deleted */
2316 //list_del(&c->list); /* Done in iptcc_chain_index_delete_chain() */
2317 iptcc_chain_index_delete_chain(c, *handle);
2318 free(c);
2320 DEBUGP("chain `%s' deleted\n", chain);
2322 set_changed(*handle);
2324 return 1;
2325 }
2327 /* Renames a chain. */
2328 int TC_RENAME_CHAIN(const IPT_CHAINLABEL oldname,
2329 const IPT_CHAINLABEL newname,
2330 TC_HANDLE_T *handle)
2331 {
2332 struct chain_head *c;
2333 iptc_fn = TC_RENAME_CHAIN;
2335 /* find_label doesn't cover built-in targets: DROP, ACCEPT,
2336 QUEUE, RETURN. */
2337 if (iptcc_find_label(newname, *handle)
2338 || strcmp(newname, LABEL_DROP) == 0
2339 || strcmp(newname, LABEL_ACCEPT) == 0
2340 || strcmp(newname, LABEL_QUEUE) == 0
2341 || strcmp(newname, LABEL_RETURN) == 0) {
2342 errno = EEXIST;
2343 return 0;
2344 }
2346 if (!(c = iptcc_find_label(oldname, *handle))
2347 || TC_BUILTIN(oldname, *handle)) {
2348 errno = ENOENT;
2349 return 0;
2350 }
2352 if (strlen(newname)+1 > sizeof(IPT_CHAINLABEL)) {
2353 errno = EINVAL;
2354 return 0;
2355 }
2357 strncpy(c->name, newname, sizeof(IPT_CHAINLABEL));
2359 set_changed(*handle);
2361 return 1;
2362 }
2364 /* Sets the policy on a built-in chain. */
2365 int
2366 TC_SET_POLICY(const IPT_CHAINLABEL chain,
2367 const IPT_CHAINLABEL policy,
2368 STRUCT_COUNTERS *counters,
2369 TC_HANDLE_T *handle)
2370 {
2371 struct chain_head *c;
2373 iptc_fn = TC_SET_POLICY;
2375 if (!(c = iptcc_find_label(chain, *handle))) {
2376 DEBUGP("cannot find chain `%s'\n", chain);
2377 errno = ENOENT;
2378 return 0;
2379 }
2381 if (!iptcc_is_builtin(c)) {
2382 DEBUGP("cannot set policy of userdefinedchain `%s'\n", chain);
2383 errno = ENOENT;
2384 return 0;
2385 }
2387 if (strcmp(policy, LABEL_ACCEPT) == 0)
2388 c->verdict = -NF_ACCEPT - 1;
2389 else if (strcmp(policy, LABEL_DROP) == 0)
2390 c->verdict = -NF_DROP - 1;
2391 else {
2392 errno = EINVAL;
2393 return 0;
2394 }
2396 if (counters) {
2397 /* set byte and packet counters */
2398 memcpy(&c->counters, counters, sizeof(STRUCT_COUNTERS));
2399 c->counter_map.maptype = COUNTER_MAP_SET;
2400 } else {
2401 c->counter_map.maptype = COUNTER_MAP_NOMAP;
2402 }
2404 set_changed(*handle);
2406 return 1;
2407 }
2409 /* Without this, on gcc 2.7.2.3, we get:
2410 libiptc.c: In function `TC_COMMIT':
2411 libiptc.c:833: fixed or forbidden register was spilled.
2412 This may be due to a compiler bug or to impossible asm
2413 statements or clauses.
2414 */
2415 static void
2416 subtract_counters(STRUCT_COUNTERS *answer,
2417 const STRUCT_COUNTERS *a,
2418 const STRUCT_COUNTERS *b)
2419 {
2420 answer->pcnt = a->pcnt - b->pcnt;
2421 answer->bcnt = a->bcnt - b->bcnt;
2422 }
2425 static void counters_nomap(STRUCT_COUNTERS_INFO *newcounters, unsigned int idx)
2426 {
2427 newcounters->counters[idx] = ((STRUCT_COUNTERS) { 0, 0});
2428 DEBUGP_C("NOMAP => zero\n");
2429 }
2431 static void counters_normal_map(STRUCT_COUNTERS_INFO *newcounters,
2432 STRUCT_REPLACE *repl, unsigned int idx,
2433 unsigned int mappos)
2434 {
2435 /* Original read: X.
2436 * Atomic read on replacement: X + Y.
2437 * Currently in kernel: Z.
2438 * Want in kernel: X + Y + Z.
2439 * => Add in X + Y
2440 * => Add in replacement read.
2441 */
2442 newcounters->counters[idx] = repl->counters[mappos];
2443 DEBUGP_C("NORMAL_MAP => mappos %u \n", mappos);
2444 }
2446 static void counters_map_zeroed(STRUCT_COUNTERS_INFO *newcounters,
2447 STRUCT_REPLACE *repl, unsigned int idx,
2448 unsigned int mappos, STRUCT_COUNTERS *counters)
2449 {
2450 /* Original read: X.
2451 * Atomic read on replacement: X + Y.
2452 * Currently in kernel: Z.
2453 * Want in kernel: Y + Z.
2454 * => Add in Y.
2455 * => Add in (replacement read - original read).
2456 */
2457 subtract_counters(&newcounters->counters[idx],
2458 &repl->counters[mappos],
2459 counters);
2460 DEBUGP_C("ZEROED => mappos %u\n", mappos);
2461 }
2463 static void counters_map_set(STRUCT_COUNTERS_INFO *newcounters,
2464 unsigned int idx, STRUCT_COUNTERS *counters)
2465 {
2466 /* Want to set counter (iptables-restore) */
2468 memcpy(&newcounters->counters[idx], counters,
2469 sizeof(STRUCT_COUNTERS));
2471 DEBUGP_C("SET\n");
2472 }
2475 int
2476 TC_COMMIT(TC_HANDLE_T *handle)
2477 {
2478 /* Replace, then map back the counters. */
2479 STRUCT_REPLACE *repl;
2480 STRUCT_COUNTERS_INFO *newcounters;
2481 struct chain_head *c;
2482 int ret;
2483 size_t counterlen;
2484 int new_number;
2485 unsigned int new_size;
2487 iptc_fn = TC_COMMIT;
2488 CHECK(*handle);
2490 /* Don't commit if nothing changed. */
2491 if (!(*handle)->changed)
2492 goto finished;
2494 new_number = iptcc_compile_table_prep(*handle, &new_size);
2495 if (new_number < 0) {
2496 errno = ENOMEM;
2497 goto out_zero;
2498 }
2500 repl = malloc(sizeof(*repl) + new_size);
2501 if (!repl) {
2502 errno = ENOMEM;
2503 goto out_zero;
2504 }
2505 memset(repl, 0, sizeof(*repl) + new_size);
2507 #if 0
2508 TC_DUMP_ENTRIES(*handle);
2509 #endif
2511 counterlen = sizeof(STRUCT_COUNTERS_INFO)
2512 + sizeof(STRUCT_COUNTERS) * new_number;
2514 /* These are the old counters we will get from kernel */
2515 repl->counters = malloc(sizeof(STRUCT_COUNTERS)
2516 * (*handle)->info.num_entries);
2517 if (!repl->counters) {
2518 errno = ENOMEM;
2519 goto out_free_repl;
2520 }
2521 /* These are the counters we're going to put back, later. */
2522 newcounters = malloc(counterlen);
2523 if (!newcounters) {
2524 errno = ENOMEM;
2525 goto out_free_repl_counters;
2526 }
2527 memset(newcounters, 0, counterlen);
2529 strcpy(repl->name, (*handle)->info.name);
2530 repl->num_entries = new_number;
2531 repl->size = new_size;
2533 repl->num_counters = (*handle)->info.num_entries;
2534 repl->valid_hooks = (*handle)->info.valid_hooks;
2536 DEBUGP("num_entries=%u, size=%u, num_counters=%u\n",
2537 repl->num_entries, repl->size, repl->num_counters);
2539 ret = iptcc_compile_table(*handle, repl);
2540 if (ret < 0) {
2541 errno = ret;
2542 goto out_free_newcounters;
2543 }
2546 #ifdef IPTC_DEBUG2
2547 {
2548 int fd = open("/tmp/libiptc-so_set_replace.blob",
2549 O_CREAT|O_WRONLY);
2550 if (fd >= 0) {
2551 write(fd, repl, sizeof(*repl) + repl->size);
2552 close(fd);
2553 }
2554 }
2555 #endif
2557 ret = setsockopt(sockfd, TC_IPPROTO, SO_SET_REPLACE, repl,
2558 sizeof(*repl) + repl->size);
2559 if (ret < 0)
2560 goto out_free_newcounters;
2562 /* Put counters back. */
2563 strcpy(newcounters->name, (*handle)->info.name);
2564 newcounters->num_counters = new_number;
2566 list_for_each_entry(c, &(*handle)->chains, list) {
2567 struct rule_head *r;
2569 /* Builtin chains have their own counters */
2570 if (iptcc_is_builtin(c)) {
2571 DEBUGP("counter for chain-index %u: ", c->foot_index);
2572 switch(c->counter_map.maptype) {
2573 case COUNTER_MAP_NOMAP:
2574 counters_nomap(newcounters, c->foot_index);
2575 break;
2576 case COUNTER_MAP_NORMAL_MAP:
2577 counters_normal_map(newcounters, repl,
2578 c->foot_index,
2579 c->counter_map.mappos);
2580 break;
2581 case COUNTER_MAP_ZEROED:
2582 counters_map_zeroed(newcounters, repl,
2583 c->foot_index,
2584 c->counter_map.mappos,
2585 &c->counters);
2586 break;
2587 case COUNTER_MAP_SET:
2588 counters_map_set(newcounters, c->foot_index,
2589 &c->counters);
2590 break;
2591 }
2592 }
2594 list_for_each_entry(r, &c->rules, list) {
2595 DEBUGP("counter for index %u: ", r->index);
2596 switch (r->counter_map.maptype) {
2597 case COUNTER_MAP_NOMAP:
2598 counters_nomap(newcounters, r->index);
2599 break;
2601 case COUNTER_MAP_NORMAL_MAP:
2602 counters_normal_map(newcounters, repl,
2603 r->index,
2604 r->counter_map.mappos);
2605 break;
2607 case COUNTER_MAP_ZEROED:
2608 counters_map_zeroed(newcounters, repl,
2609 r->index,
2610 r->counter_map.mappos,
2611 &r->entry->counters);
2612 break;
2614 case COUNTER_MAP_SET:
2615 counters_map_set(newcounters, r->index,
2616 &r->entry->counters);
2617 break;
2618 }
2619 }
2620 }
2622 #ifdef IPTC_DEBUG2
2623 {
2624 int fd = open("/tmp/libiptc-so_set_add_counters.blob",
2625 O_CREAT|O_WRONLY);
2626 if (fd >= 0) {
2627 write(fd, newcounters, counterlen);
2628 close(fd);
2629 }
2630 }
2631 #endif
2633 ret = setsockopt(sockfd, TC_IPPROTO, SO_SET_ADD_COUNTERS,
2634 newcounters, counterlen);
2635 if (ret < 0)
2636 goto out_free_newcounters;
2638 free(repl->counters);
2639 free(repl);
2640 free(newcounters);
2642 finished:
2643 TC_FREE(handle);
2644 return 1;
2646 out_free_newcounters:
2647 free(newcounters);
2648 out_free_repl_counters:
2649 free(repl->counters);
2650 out_free_repl:
2651 free(repl);
2652 out_zero:
2653 return 0;
2654 }
2656 /* Get raw socket. */
2657 int
2658 TC_GET_RAW_SOCKET(void)
2659 {
2660 return sockfd;
2661 }
2663 /* Translates errno numbers into more human-readable form than strerror. */
2664 const char *
2665 TC_STRERROR(int err)
2666 {
2667 unsigned int i;
2668 struct table_struct {
2669 void *fn;
2670 int err;
2671 const char *message;
2672 } table [] =
2673 { { TC_INIT, EPERM, "Permission denied (you must be root)" },
2674 { TC_INIT, EINVAL, "Module is wrong version" },
2675 { TC_INIT, ENOENT,
2676 "Table does not exist (do you need to insmod?)" },
2677 { TC_DELETE_CHAIN, ENOTEMPTY, "Chain is not empty" },
2678 { TC_DELETE_CHAIN, EINVAL, "Can't delete built-in chain" },
2679 { TC_DELETE_CHAIN, EMLINK,
2680 "Can't delete chain with references left" },
2681 { TC_CREATE_CHAIN, EEXIST, "Chain already exists" },
2682 { TC_INSERT_ENTRY, E2BIG, "Index of insertion too big" },
2683 { TC_REPLACE_ENTRY, E2BIG, "Index of replacement too big" },
2684 { TC_DELETE_NUM_ENTRY, E2BIG, "Index of deletion too big" },
2685 { TC_READ_COUNTER, E2BIG, "Index of counter too big" },
2686 { TC_ZERO_COUNTER, E2BIG, "Index of counter too big" },
2687 { TC_INSERT_ENTRY, ELOOP, "Loop found in table" },
2688 { TC_INSERT_ENTRY, EINVAL, "Target problem" },
2689 /* EINVAL for CHECK probably means bad interface. */
2690 { TC_CHECK_PACKET, EINVAL,
2691 "Bad arguments (does that interface exist?)" },
2692 { TC_CHECK_PACKET, ENOSYS,
2693 "Checking will most likely never get implemented" },
2694 /* ENOENT for DELETE probably means no matching rule */
2695 { TC_DELETE_ENTRY, ENOENT,
2696 "Bad rule (does a matching rule exist in that chain?)" },
2697 { TC_SET_POLICY, ENOENT,
2698 "Bad built-in chain name" },
2699 { TC_SET_POLICY, EINVAL,
2700 "Bad policy name" },
2702 { NULL, 0, "Incompatible with this kernel" },
2703 { NULL, ENOPROTOOPT, "iptables who? (do you need to insmod?)" },
2704 { NULL, ENOSYS, "Will be implemented real soon. I promise ;)" },
2705 { NULL, ENOMEM, "Memory allocation problem" },
2706 { NULL, ENOENT, "No chain/target/match by that name" },
2707 };
2709 for (i = 0; i < sizeof(table)/sizeof(struct table_struct); i++) {
2710 if ((!table[i].fn || table[i].fn == iptc_fn)
2711 && table[i].err == err)
2712 return table[i].message;
2713 }
2715 return strerror(err);
2716 }