src/owniptc/libip4tc.c

   1 /**
   2  * This file was imported from the iptables sources.
   3  * Copyright (C) 1999-2008 Netfilter Core Team
   4  *
   5  * This program is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License as published by the
   7  * Free Software Foundation; only version 2 of the License is applicable.
   8  *
   9  * This program is distributed in the hope that it will be useful, but
  10  * WITHOUT ANY WARRANTY; without even the implied warranty of
  11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  12  * General Public License for more details.
  13  *
  14  * You should have received a copy of the GNU General Public License along
  15  * with this program; if not, write to the Free Software Foundation, Inc.,
  16  * 51 Franklin St, Fifth Floor, Boston, MA  02110-1301 USA
  17  */
  18
  19 /* Library which manipulates firewall rules.  Version 0.1. */
  20
  21 /* Architecture of firewall rules is as follows:
  22  *
  23  * Chains go INPUT, FORWARD, OUTPUT then user chains.
  24  * Each user chain starts with an ERROR node.
  25  * Every chain ends with an unconditional jump: a RETURN for user chains,
  26  * and a POLICY for built-ins.
  27  */
  28
  29 /* (C)1999 Paul ``Rusty'' Russell - Placed under the GNU GPL (See
  30    COPYING for details). */
  31
  32 #include <assert.h>
  33 #include <string.h>
  34 #include <errno.h>
  35 #include <stdlib.h>
  36 #include <stdio.h>
  37 #include <unistd.h>
  38
  39 #ifdef DEBUG_CONNTRACK
  40 #define inline
  41 #endif
  42
  43 #if !defined(__GLIBC__) || (__GLIBC__ < 2)
  44 typedef unsigned int socklen_t;
  45 #endif
  46
  47 #include "libiptc.h"
  48
  49 #define IP_VERSION      4
  50 #define IP_OFFSET       0x1FFF
  51
  52 #define HOOK_PRE_ROUTING        NF_IP_PRE_ROUTING
  53 #define HOOK_LOCAL_IN           NF_IP_LOCAL_IN
  54 #define HOOK_FORWARD            NF_IP_FORWARD
  55 #define HOOK_LOCAL_OUT          NF_IP_LOCAL_OUT
  56 #define HOOK_POST_ROUTING       NF_IP_POST_ROUTING
  57 #ifdef NF_IP_DROPPING
  58 #define HOOK_DROPPING           NF_IP_DROPPING
  59 #endif
  60
  61 #define STRUCT_ENTRY_TARGET     struct ipt_entry_target
  62 #define STRUCT_ENTRY            struct ipt_entry
  63 #define STRUCT_ENTRY_MATCH      struct ipt_entry_match
  64 #define STRUCT_GETINFO          struct ipt_getinfo
  65 #define STRUCT_GET_ENTRIES      struct ipt_get_entries
  66 #define STRUCT_COUNTERS         struct ipt_counters
  67 #define STRUCT_COUNTERS_INFO    struct ipt_counters_info
  68 #define STRUCT_STANDARD_TARGET  struct ipt_standard_target
  69 #define STRUCT_REPLACE          struct ipt_replace
  70
  71 #define STRUCT_TC_HANDLE        struct iptc_handle
  72 #define TC_HANDLE_T             iptc_handle_t
  73
  74 #define ENTRY_ITERATE           IPT_ENTRY_ITERATE
  75 #define TABLE_MAXNAMELEN        IPT_TABLE_MAXNAMELEN
  76 #define FUNCTION_MAXNAMELEN     IPT_FUNCTION_MAXNAMELEN
  77
  78 #define GET_TARGET              ipt_get_target
  79
  80 #define ERROR_TARGET            IPT_ERROR_TARGET
  81 #define NUMHOOKS                NF_IP_NUMHOOKS
  82
  83 #define IPT_CHAINLABEL          ipt_chainlabel
  84
  85 #define TC_DUMP_ENTRIES         dump_entries
  86 #define TC_IS_CHAIN             iptc_is_chain
  87 #define TC_FIRST_CHAIN          iptc_first_chain
  88 #define TC_NEXT_CHAIN           iptc_next_chain
  89 #define TC_FIRST_RULE           iptc_first_rule
  90 #define TC_NEXT_RULE            iptc_next_rule
  91 #define TC_GET_TARGET           iptc_get_target
  92 #define TC_BUILTIN              iptc_builtin
  93 #define TC_GET_POLICY           iptc_get_policy
  94 #define TC_INSERT_ENTRY         iptc_insert_entry
  95 #define TC_REPLACE_ENTRY        iptc_replace_entry
  96 #define TC_APPEND_ENTRY         iptc_append_entry
  97 #define TC_DELETE_ENTRY         iptc_delete_entry
  98 #define TC_DELETE_NUM_ENTRY     iptc_delete_num_entry
  99 #define TC_CHECK_PACKET         iptc_check_packet
 100 #define TC_FLUSH_ENTRIES        iptc_flush_entries
 101 #define TC_ZERO_ENTRIES         iptc_zero_entries
 102 #define TC_READ_COUNTER         iptc_read_counter
 103 #define TC_ZERO_COUNTER         iptc_zero_counter
 104 #define TC_SET_COUNTER          iptc_set_counter
 105 #define TC_CREATE_CHAIN         iptc_create_chain
 106 #define TC_GET_REFERENCES       iptc_get_references
 107 #define TC_DELETE_CHAIN         iptc_delete_chain
 108 #define TC_RENAME_CHAIN         iptc_rename_chain
 109 #define TC_SET_POLICY           iptc_set_policy
 110 #define TC_GET_RAW_SOCKET       iptc_get_raw_socket
 111 #define TC_INIT                 iptc_init
 112 #define TC_FREE                 iptc_free
 113 #define TC_COMMIT               iptc_commit
 114 #define TC_STRERROR             iptc_strerror
 115 #define TC_NUM_RULES            iptc_num_rules
 116 #define TC_GET_RULE             iptc_get_rule
 117
 118 #define TC_AF                   AF_INET
 119 #define TC_IPPROTO              IPPROTO_IP
 120
 121 #define SO_SET_REPLACE          IPT_SO_SET_REPLACE
 122 #define SO_SET_ADD_COUNTERS     IPT_SO_SET_ADD_COUNTERS
 123 #define SO_GET_INFO             IPT_SO_GET_INFO
 124 #define SO_GET_ENTRIES          IPT_SO_GET_ENTRIES
 125 #define SO_GET_VERSION          IPT_SO_GET_VERSION
 126
 127 #define STANDARD_TARGET         IPT_STANDARD_TARGET
 128 #define LABEL_RETURN            IPTC_LABEL_RETURN
 129 #define LABEL_ACCEPT            IPTC_LABEL_ACCEPT
 130 #define LABEL_DROP              IPTC_LABEL_DROP
 131 #define LABEL_QUEUE             IPTC_LABEL_QUEUE
 132
 133 #define ALIGN                   IPT_ALIGN
 134 #define RETURN                  IPT_RETURN
 135
 136 #include "libiptc.c"
 137
 138 #define IP_PARTS_NATIVE(n)                      \
 139 (unsigned int)((n)>>24)&0xFF,                   \
 140 (unsigned int)((n)>>16)&0xFF,                   \
 141 (unsigned int)((n)>>8)&0xFF,                    \
 142 (unsigned int)((n)&0xFF)
 143
 144 #define IP_PARTS(n) IP_PARTS_NATIVE(ntohl(n))
 145
 146 int
 147 dump_entry(STRUCT_ENTRY *e, const TC_HANDLE_T handle)
 148 {
 149         size_t i;
 150         STRUCT_ENTRY_TARGET *t;
 151
 152         printf("Entry %u (%lu):\n", iptcb_entry2index(handle, e),
 153                iptcb_entry2offset(handle, e));
 154         printf("SRC IP: %u.%u.%u.%u/%u.%u.%u.%u\n",
 155                IP_PARTS(e->ip.src.s_addr),IP_PARTS(e->ip.smsk.s_addr));
 156         printf("DST IP: %u.%u.%u.%u/%u.%u.%u.%u\n",
 157                IP_PARTS(e->ip.dst.s_addr),IP_PARTS(e->ip.dmsk.s_addr));
 158         printf("Interface: `%s'/", e->ip.iniface);
 159         for (i = 0; i < IFNAMSIZ; i++)
 160                 printf("%c", e->ip.iniface_mask[i] ? 'X' : '.');
 161         printf("to `%s'/", e->ip.outiface);
 162         for (i = 0; i < IFNAMSIZ; i++)
 163                 printf("%c", e->ip.outiface_mask[i] ? 'X' : '.');
 164         printf("\nProtocol: %u\n", e->ip.proto);
 165         printf("Flags: %02X\n", e->ip.flags);
 166         printf("Invflags: %02X\n", e->ip.invflags);
 167         printf("Counters: %llu packets, %llu bytes\n",
 168                (unsigned long long)e->counters.pcnt, (unsigned long long)e->counters.bcnt);
 169         printf("Cache: %08X\n", e->nfcache);
 170
 171         IPT_MATCH_ITERATE(e, print_match);
 172
 173         t = GET_TARGET(e);
 174         printf("Target name: `%s' [%u]\n", t->u.user.name, t->u.target_size);
 175         if (strcmp(t->u.user.name, STANDARD_TARGET) == 0) {
 176                 const unsigned char *data = t->data;
 177                 int pos = *(const int *)data;
 178                 if (pos < 0)
 179                         printf("verdict=%s\n",
 180                                pos == -NF_ACCEPT-1 ? "NF_ACCEPT"
 181                                : pos == -NF_DROP-1 ? "NF_DROP"
 182                                : pos == -NF_QUEUE-1 ? "NF_QUEUE"
 183                                : pos == RETURN ? "RETURN"
 184                                : "UNKNOWN");
 185                 else
 186                         printf("verdict=%u\n", pos);
 187         } else if (strcmp(t->u.user.name, IPT_ERROR_TARGET) == 0)
 188                 printf("error=`%s'\n", t->data);
 189
 190         printf("\n");
 191         return 0;
 192 }
 193
 194 static unsigned char *
 195 is_same(const STRUCT_ENTRY *a, const STRUCT_ENTRY *b, unsigned char *matchmask)
 196 {
 197         unsigned int i;
 198         unsigned char *mptr;
 199
 200         /* Always compare head structures: ignore mask here. */
 201         if (a->ip.src.s_addr != b->ip.src.s_addr
 202             || a->ip.dst.s_addr != b->ip.dst.s_addr
 203             || a->ip.smsk.s_addr != b->ip.smsk.s_addr
 204             || a->ip.dmsk.s_addr != b->ip.dmsk.s_addr
 205             || a->ip.proto != b->ip.proto
 206             || a->ip.flags != b->ip.flags
 207             || a->ip.invflags != b->ip.invflags)
 208                 return NULL;
 209
 210         for (i = 0; i < IFNAMSIZ; i++) {
 211                 if (a->ip.iniface_mask[i] != b->ip.iniface_mask[i])
 212                         return NULL;
 213                 if ((a->ip.iniface[i] & a->ip.iniface_mask[i])
 214                     != (b->ip.iniface[i] & b->ip.iniface_mask[i]))
 215                         return NULL;
 216                 if (a->ip.outiface_mask[i] != b->ip.outiface_mask[i])
 217                         return NULL;
 218                 if ((a->ip.outiface[i] & a->ip.outiface_mask[i])
 219                     != (b->ip.outiface[i] & b->ip.outiface_mask[i]))
 220                         return NULL;
 221         }
 222
 223         if (a->target_offset != b->target_offset
 224             || a->next_offset != b->next_offset)
 225                 return NULL;
 226
 227         mptr = matchmask + sizeof(STRUCT_ENTRY);
 228         if (IPT_MATCH_ITERATE(a, match_different, a->elems, b->elems, &mptr))
 229                 return NULL;
 230         mptr += IPT_ALIGN(sizeof(struct ipt_entry_target));
 231
 232         return mptr;
 233 }
 234
 235 #if 0
 236 /***************************** DEBUGGING ********************************/
 237 static inline int
 238 unconditional(const struct ipt_ip *ip)
 239 {
 240         unsigned int i;
 241
 242         for (i = 0; i < sizeof(*ip)/sizeof(u_int32_t); i++)
 243                 if (((u_int32_t *)ip)[i])
 244                         return 0;
 245
 246         return 1;
 247 }
 248
 249 static inline int
 250 check_match(const STRUCT_ENTRY_MATCH *m, unsigned int *off)
 251 {
 252         assert(m->u.match_size >= sizeof(STRUCT_ENTRY_MATCH));
 253         assert(ALIGN(m->u.match_size) == m->u.match_size);
 254
 255         (*off) += m->u.match_size;
 256         return 0;
 257 }
 258
 259 static inline int
 260 check_entry(const STRUCT_ENTRY *e, unsigned int *i, unsigned int *off,
 261             unsigned int user_offset, int *was_return,
 262             TC_HANDLE_T h)
 263 {
 264         unsigned int toff;
 265         STRUCT_STANDARD_TARGET *t;
 266
 267         assert(e->target_offset >= sizeof(STRUCT_ENTRY));
 268         assert(e->next_offset >= e->target_offset
 269                + sizeof(STRUCT_ENTRY_TARGET));
 270         toff = sizeof(STRUCT_ENTRY);
 271         IPT_MATCH_ITERATE(e, check_match, &toff);
 272
 273         assert(toff == e->target_offset);
 274
 275         t = (STRUCT_STANDARD_TARGET *)
 276                 GET_TARGET((STRUCT_ENTRY *)e);
 277         /* next_offset will have to be multiple of entry alignment. */
 278         assert(e->next_offset == ALIGN(e->next_offset));
 279         assert(e->target_offset == ALIGN(e->target_offset));
 280         assert(t->target.u.target_size == ALIGN(t->target.u.target_size));
 281         assert(!TC_IS_CHAIN(t->target.u.user.name, h));
 282
 283         if (strcmp(t->target.u.user.name, STANDARD_TARGET) == 0) {
 284                 assert(t->target.u.target_size
 285                        == ALIGN(sizeof(STRUCT_STANDARD_TARGET)));
 286
 287                 assert(t->verdict == -NF_DROP-1
 288                        || t->verdict == -NF_ACCEPT-1
 289                        || t->verdict == RETURN
 290                        || t->verdict < (int)h->entries->size);
 291
 292                 if (t->verdict >= 0) {
 293                         STRUCT_ENTRY *te = get_entry(h, t->verdict);
 294                         int idx;
 295
 296                         idx = iptcb_entry2index(h, te);
 297                         assert(strcmp(GET_TARGET(te)->u.user.name,
 298                                       IPT_ERROR_TARGET)
 299                                != 0);
 300                         assert(te != e);
 301
 302                         /* Prior node must be error node, or this node. */
 303                         assert(t->verdict == iptcb_entry2offset(h, e)+e->next_offset
 304                                || strcmp(GET_TARGET(index2entry(h, idx-1))
 305                                          ->u.user.name, IPT_ERROR_TARGET)
 306                                == 0);
 307                 }
 308
 309                 if (t->verdict == RETURN
 310                     && unconditional(&e->ip)
 311                     && e->target_offset == sizeof(*e))
 312                         *was_return = 1;
 313                 else
 314                         *was_return = 0;
 315         } else if (strcmp(t->target.u.user.name, IPT_ERROR_TARGET) == 0) {
 316                 assert(t->target.u.target_size
 317                        == ALIGN(sizeof(struct ipt_error_target)));
 318
 319                 /* If this is in user area, previous must have been return */
 320                 if (*off > user_offset)
 321                         assert(*was_return);
 322
 323                 *was_return = 0;
 324         }
 325         else *was_return = 0;
 326
 327         if (*off == user_offset)
 328                 assert(strcmp(t->target.u.user.name, IPT_ERROR_TARGET) == 0);
 329
 330         (*off) += e->next_offset;
 331         (*i)++;
 332         return 0;
 333 }
 334
 335 #ifdef IPTC_DEBUG
 336 /* Do every conceivable sanity check on the handle */
 337 static void
 338 do_check(TC_HANDLE_T h, unsigned int line)
 339 {
 340         unsigned int i, n;
 341         unsigned int user_offset; /* Offset of first user chain */
 342         int was_return;
 343
 344         assert(h->changed == 0 || h->changed == 1);
 345         if (strcmp(h->info.name, "filter") == 0) {
 346                 assert(h->info.valid_hooks
 347                        == (1 << NF_IP_LOCAL_IN
 348                            | 1 << NF_IP_FORWARD
 349                            | 1 << NF_IP_LOCAL_OUT));
 350
 351                 /* Hooks should be first three */
 352                 assert(h->info.hook_entry[NF_IP_LOCAL_IN] == 0);
 353
 354                 n = get_chain_end(h, 0);
 355                 n += get_entry(h, n)->next_offset;
 356                 assert(h->info.hook_entry[NF_IP_FORWARD] == n);
 357
 358                 n = get_chain_end(h, n);
 359                 n += get_entry(h, n)->next_offset;
 360                 assert(h->info.hook_entry[NF_IP_LOCAL_OUT] == n);
 361
 362                 user_offset = h->info.hook_entry[NF_IP_LOCAL_OUT];
 363         } else if (strcmp(h->info.name, "nat") == 0) {
 364                 assert((h->info.valid_hooks
 365                         == (1 << NF_IP_PRE_ROUTING
 366                             | 1 << NF_IP_POST_ROUTING
 367                             | 1 << NF_IP_LOCAL_OUT)) ||
 368                        (h->info.valid_hooks
 369                         == (1 << NF_IP_PRE_ROUTING
 370                             | 1 << NF_IP_LOCAL_IN
 371                             | 1 << NF_IP_POST_ROUTING
 372                             | 1 << NF_IP_LOCAL_OUT)));
 373
 374                 assert(h->info.hook_entry[NF_IP_PRE_ROUTING] == 0);
 375
 376                 n = get_chain_end(h, 0);
 377
 378                 n += get_entry(h, n)->next_offset;
 379                 assert(h->info.hook_entry[NF_IP_POST_ROUTING] == n);
 380                 n = get_chain_end(h, n);
 381
 382                 n += get_entry(h, n)->next_offset;
 383                 assert(h->info.hook_entry[NF_IP_LOCAL_OUT] == n);
 384                 user_offset = h->info.hook_entry[NF_IP_LOCAL_OUT];
 385
 386                 if (h->info.valid_hooks & (1 << NF_IP_LOCAL_IN)) {
 387                         n = get_chain_end(h, n);
 388                         n += get_entry(h, n)->next_offset;
 389                         assert(h->info.hook_entry[NF_IP_LOCAL_IN] == n);
 390                         user_offset = h->info.hook_entry[NF_IP_LOCAL_IN];
 391                 }
 392
 393         } else if (strcmp(h->info.name, "mangle") == 0) {
 394                 /* This code is getting ugly because linux < 2.4.18-pre6 had
 395                  * two mangle hooks, linux >= 2.4.18-pre6 has five mangle hooks
 396                  * */
 397                 assert((h->info.valid_hooks
 398                         == (1 << NF_IP_PRE_ROUTING
 399                             | 1 << NF_IP_LOCAL_OUT)) ||
 400                        (h->info.valid_hooks
 401                         == (1 << NF_IP_PRE_ROUTING
 402                             | 1 << NF_IP_LOCAL_IN
 403                             | 1 << NF_IP_FORWARD
 404                             | 1 << NF_IP_LOCAL_OUT
 405                             | 1 << NF_IP_POST_ROUTING)));
 406
 407                 /* Hooks should be first five */
 408                 assert(h->info.hook_entry[NF_IP_PRE_ROUTING] == 0);
 409
 410                 n = get_chain_end(h, 0);
 411
 412                 if (h->info.valid_hooks & (1 << NF_IP_LOCAL_IN)) {
 413                         n += get_entry(h, n)->next_offset;
 414                         assert(h->info.hook_entry[NF_IP_LOCAL_IN] == n);
 415                         n = get_chain_end(h, n);
 416                 }
 417
 418                 if (h->info.valid_hooks & (1 << NF_IP_FORWARD)) {
 419                         n += get_entry(h, n)->next_offset;
 420                         assert(h->info.hook_entry[NF_IP_FORWARD] == n);
 421                         n = get_chain_end(h, n);
 422                 }
 423
 424                 n += get_entry(h, n)->next_offset;
 425                 assert(h->info.hook_entry[NF_IP_LOCAL_OUT] == n);
 426                 user_offset = h->info.hook_entry[NF_IP_LOCAL_OUT];
 427
 428                 if (h->info.valid_hooks & (1 << NF_IP_POST_ROUTING)) {
 429                         n = get_chain_end(h, n);
 430                         n += get_entry(h, n)->next_offset;
 431                         assert(h->info.hook_entry[NF_IP_POST_ROUTING] == n);
 432                         user_offset = h->info.hook_entry[NF_IP_POST_ROUTING];
 433                 }
 434         } else if (strcmp(h->info.name, "raw") == 0) {
 435                 assert(h->info.valid_hooks
 436                        == (1 << NF_IP_PRE_ROUTING
 437                            | 1 << NF_IP_LOCAL_OUT));
 438
 439                 /* Hooks should be first three */
 440                 assert(h->info.hook_entry[NF_IP_PRE_ROUTING] == 0);
 441
 442                 n = get_chain_end(h, n);
 443                 n += get_entry(h, n)->next_offset;
 444                 assert(h->info.hook_entry[NF_IP_LOCAL_OUT] == n);
 445
 446                 user_offset = h->info.hook_entry[NF_IP_LOCAL_OUT];
 447
 448 #ifdef NF_IP_DROPPING
 449         } else if (strcmp(h->info.name, "drop") == 0) {
 450                 assert(h->info.valid_hooks == (1 << NF_IP_DROPPING));
 451
 452                 /* Hook should be first */
 453                 assert(h->info.hook_entry[NF_IP_DROPPING] == 0);
 454                 user_offset = 0;
 455 #endif
 456         } else {
 457                 fprintf(stderr, "Unknown table `%s'\n", h->info.name);
 458                 abort();
 459         }
 460
 461         /* User chain == end of last builtin + policy entry */
 462         user_offset = get_chain_end(h, user_offset);
 463         user_offset += get_entry(h, user_offset)->next_offset;
 464
 465         /* Overflows should be end of entry chains, and unconditional
 466            policy nodes. */
 467         for (i = 0; i < NUMHOOKS; i++) {
 468                 STRUCT_ENTRY *e;
 469                 STRUCT_STANDARD_TARGET *t;
 470
 471                 if (!(h->info.valid_hooks & (1 << i)))
 472                         continue;
 473                 assert(h->info.underflow[i]
 474                        == get_chain_end(h, h->info.hook_entry[i]));
 475
 476                 e = get_entry(h, get_chain_end(h, h->info.hook_entry[i]));
 477                 assert(unconditional(&e->ip));
 478                 assert(e->target_offset == sizeof(*e));
 479                 t = (STRUCT_STANDARD_TARGET *)GET_TARGET(e);
 480                 assert(t->target.u.target_size == ALIGN(sizeof(*t)));
 481                 assert(e->next_offset == sizeof(*e) + ALIGN(sizeof(*t)));
 482
 483                 assert(strcmp(t->target.u.user.name, STANDARD_TARGET)==0);
 484                 assert(t->verdict == -NF_DROP-1 || t->verdict == -NF_ACCEPT-1);
 485
 486                 /* Hooks and underflows must be valid entries */
 487                 entry2index(h, get_entry(h, h->info.hook_entry[i]));
 488                 entry2index(h, get_entry(h, h->info.underflow[i]));
 489         }
 490
 491         assert(h->info.size
 492                >= h->info.num_entries * (sizeof(STRUCT_ENTRY)
 493                                          +sizeof(STRUCT_STANDARD_TARGET)));
 494
 495         assert(h->entries.size
 496                >= (h->new_number
 497                    * (sizeof(STRUCT_ENTRY)
 498                       + sizeof(STRUCT_STANDARD_TARGET))));
 499         assert(strcmp(h->info.name, h->entries.name) == 0);
 500
 501         i = 0; n = 0;
 502         was_return = 0;
 503         /* Check all the entries. */
 504         ENTRY_ITERATE(h->entries.entrytable, h->entries.size,
 505                       check_entry, &i, &n, user_offset, &was_return, h);
 506
 507         assert(i == h->new_number);
 508         assert(n == h->entries.size);
 509
 510         /* Final entry must be error node */
 511         assert(strcmp(GET_TARGET(index2entry(h, h->new_number-1))
 512                       ->u.user.name,
 513                       ERROR_TARGET) == 0);
 514 }
 515 #endif /*IPTC_DEBUG*/
 516
 517 #endif