1 /* Code to take an ip6tables-style command line and do it. */
2
3 /*
4 * Author: [email protected] and [email protected]
5 *
6 * (C) 2000-2002 by the netfilter coreteam <[email protected]>:
7 * Paul 'Rusty' Russell <[email protected]>
8 * Marc Boucher <[email protected]>
9 * James Morris <[email protected]>
10 * Harald Welte <[email protected]>
11 * Jozsef Kadlecsik <[email protected]>
12 *
13 * This program is free software; you can redistribute it and/or modify
14 * it under the terms of the GNU General Public License as published by
15 * the Free Software Foundation; either version 2 of the License, or
16 * (at your option) any later version.
17 *
18 * This program is distributed in the hope that it will be useful,
19 * but WITHOUT ANY WARRANTY; without even the implied warranty of
20 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
21 * GNU General Public License for more details.
22 *
23 * You should have received a copy of the GNU General Public License
24 * along with this program; if not, write to the Free Software
25 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
26 */
27 #include "config.h"
28 #include <getopt.h>
29 #include <string.h>
30 #include <netdb.h>
31 #include <errno.h>
32 #include <stdio.h>
33 #include <stdlib.h>
34 #include <ctype.h>
35 #include <stdarg.h>
36 #include <stdbool.h>
37 #include <limits.h>
38 #include <ip6tables.h>
39 #include <xtables.h>
40 #include <arpa/inet.h>
41 #include <unistd.h>
42 #include <fcntl.h>
43 #include <sys/types.h>
44 #include <sys/socket.h>
45 #include "ip6tables-multi.h"
46 #include "xshared.h"
47
48 static const char unsupported_rev[] = " [unsupported revision]";
49
50 static struct option original_opts[] = {
51 {.name = "append", .has_arg = 1, .val = 'A'},
52 {.name = "delete", .has_arg = 1, .val = 'D'},
53 {.name = "check" , .has_arg = 1, .val = 'C'},
54 {.name = "insert", .has_arg = 1, .val = 'I'},
55 {.name = "replace", .has_arg = 1, .val = 'R'},
56 {.name = "list", .has_arg = 2, .val = 'L'},
57 {.name = "list-rules", .has_arg = 2, .val = 'S'},
58 {.name = "flush", .has_arg = 2, .val = 'F'},
59 {.name = "zero", .has_arg = 2, .val = 'Z'},
60 {.name = "new-chain", .has_arg = 1, .val = 'N'},
61 {.name = "delete-chain", .has_arg = 2, .val = 'X'},
62 {.name = "rename-chain", .has_arg = 1, .val = 'E'},
63 {.name = "policy", .has_arg = 1, .val = 'P'},
64 {.name = "source", .has_arg = 1, .val = 's'},
65 {.name = "destination", .has_arg = 1, .val = 'd'},
66 {.name = "src", .has_arg = 1, .val = 's'}, /* synonym */
67 {.name = "dst", .has_arg = 1, .val = 'd'}, /* synonym */
68 {.name = "protocol", .has_arg = 1, .val = 'p'},
69 {.name = "in-interface", .has_arg = 1, .val = 'i'},
70 {.name = "jump", .has_arg = 1, .val = 'j'},
71 {.name = "table", .has_arg = 1, .val = 't'},
72 {.name = "match", .has_arg = 1, .val = 'm'},
73 {.name = "numeric", .has_arg = 0, .val = 'n'},
74 {.name = "out-interface", .has_arg = 1, .val = 'o'},
75 {.name = "verbose", .has_arg = 0, .val = 'v'},
76 {.name = "wait", .has_arg = 2, .val = 'w'},
77 {.name = "wait-interval", .has_arg = 2, .val = 'W'},
78 {.name = "exact", .has_arg = 0, .val = 'x'},
79 {.name = "version", .has_arg = 0, .val = 'V'},
80 {.name = "help", .has_arg = 2, .val = 'h'},
81 {.name = "line-numbers", .has_arg = 0, .val = '0'},
82 {.name = "modprobe", .has_arg = 1, .val = 'M'},
83 {.name = "set-counters", .has_arg = 1, .val = 'c'},
84 {.name = "goto", .has_arg = 1, .val = 'g'},
85 {.name = "ipv4", .has_arg = 0, .val = '4'},
86 {.name = "ipv6", .has_arg = 0, .val = '6'},
87 {NULL},
88 };
89
90 struct xtables_globals ip6tables_globals = {
91 .option_offset = 0,
92 .program_version = PACKAGE_VERSION " (legacy)",
93 .orig_opts = original_opts,
94 .compat_rev = xtables_compatible_revision,
95 };
96
97 /*
98 * All functions starting with "parse" should succeed, otherwise
99 * the program fails.
100 * Most routines return pointers to static data that may change
101 * between calls to the same or other routines with a few exceptions:
102 * "host_to_addr", "parse_hostnetwork", and "parse_hostnetworkmask"
103 * return global static data.
104 */
105
106 static int
print_match(const struct xt_entry_match * m,const struct ip6t_ip6 * ip,int numeric)107 print_match(const struct xt_entry_match *m,
108 const struct ip6t_ip6 *ip,
109 int numeric)
110 {
111 const char *name = m->u.user.name;
112 const int revision = m->u.user.revision;
113 struct xtables_match *match, *mt;
114
115 match = xtables_find_match(name, XTF_TRY_LOAD, NULL);
116 if (match) {
117 mt = xtables_find_match_revision(name, XTF_TRY_LOAD,
118 match, revision);
119 if (mt && mt->print)
120 mt->print(ip, m, numeric);
121 else if (match->print)
122 printf("%s%s ", match->name, unsupported_rev);
123 else
124 printf("%s ", match->name);
125
126 if (match->next == match)
127 free(match);
128 } else {
129 if (name[0])
130 printf("UNKNOWN match `%s' ", name);
131 }
132 /* Don't stop iterating. */
133 return 0;
134 }
135
136 /* e is called `fw' here for historical reasons */
137 static void
print_firewall(const struct ip6t_entry * fw,const char * targname,unsigned int num,unsigned int format,struct xtc_handle * const handle)138 print_firewall(const struct ip6t_entry *fw,
139 const char *targname,
140 unsigned int num,
141 unsigned int format,
142 struct xtc_handle *const handle)
143 {
144 struct xtables_target *target, *tg;
145 const struct xt_entry_target *t;
146
147 if (!ip6tc_is_chain(targname, handle))
148 target = xtables_find_target(targname, XTF_TRY_LOAD);
149 else
150 target = xtables_find_target(XT_STANDARD_TARGET,
151 XTF_LOAD_MUST_SUCCEED);
152
153 t = ip6t_get_target((struct ip6t_entry *)fw);
154
155 print_rule_details(num, &fw->counters, targname, fw->ipv6.proto,
156 fw->ipv6.flags, fw->ipv6.invflags, format);
157
158 print_fragment(fw->ipv6.flags, fw->ipv6.invflags, format, true);
159
160 print_ifaces(fw->ipv6.iniface, fw->ipv6.outiface,
161 fw->ipv6.invflags, format);
162
163 print_ipv6_addresses(fw, format);
164
165 if (format & FMT_NOTABLE)
166 fputs(" ", stdout);
167
168 #ifdef IP6T_F_GOTO
169 if(fw->ipv6.flags & IP6T_F_GOTO)
170 printf("[goto] ");
171 #endif
172
173 IP6T_MATCH_ITERATE(fw, print_match, &fw->ipv6, format & FMT_NUMERIC);
174
175 if (target) {
176 const int revision = t->u.user.revision;
177
178 tg = xtables_find_target_revision(targname, XTF_TRY_LOAD,
179 target, revision);
180 if (tg && tg->print)
181 /* Print the target information. */
182 tg->print(&fw->ipv6, t, format & FMT_NUMERIC);
183 else if (target->print)
184 printf(" %s%s", target->name, unsupported_rev);
185
186 if (target->next == target)
187 free(target);
188 } else if (t->u.target_size != sizeof(*t))
189 printf("[%u bytes of unknown target data] ",
190 (unsigned int)(t->u.target_size - sizeof(*t)));
191
192 if (!(format & FMT_NONEWLINE))
193 fputc('\n', stdout);
194 }
195
196 static void
print_firewall_line(const struct ip6t_entry * fw,struct xtc_handle * const h)197 print_firewall_line(const struct ip6t_entry *fw,
198 struct xtc_handle *const h)
199 {
200 struct xt_entry_target *t;
201
202 t = ip6t_get_target((struct ip6t_entry *)fw);
203 print_firewall(fw, t->u.user.name, 0, FMT_PRINT_RULE, h);
204 }
205
206 static int
append_entry(const xt_chainlabel chain,struct ip6t_entry * fw,unsigned int nsaddrs,const struct in6_addr saddrs[],const struct in6_addr smasks[],unsigned int ndaddrs,const struct in6_addr daddrs[],const struct in6_addr dmasks[],int verbose,struct xtc_handle * handle)207 append_entry(const xt_chainlabel chain,
208 struct ip6t_entry *fw,
209 unsigned int nsaddrs,
210 const struct in6_addr saddrs[],
211 const struct in6_addr smasks[],
212 unsigned int ndaddrs,
213 const struct in6_addr daddrs[],
214 const struct in6_addr dmasks[],
215 int verbose,
216 struct xtc_handle *handle)
217 {
218 unsigned int i, j;
219 int ret = 1;
220
221 for (i = 0; i < nsaddrs; i++) {
222 fw->ipv6.src = saddrs[i];
223 fw->ipv6.smsk = smasks[i];
224 for (j = 0; j < ndaddrs; j++) {
225 fw->ipv6.dst = daddrs[j];
226 fw->ipv6.dmsk = dmasks[j];
227 if (verbose)
228 print_firewall_line(fw, handle);
229 ret &= ip6tc_append_entry(chain, fw, handle);
230 }
231 }
232
233 return ret;
234 }
235
236 static int
replace_entry(const xt_chainlabel chain,struct ip6t_entry * fw,unsigned int rulenum,const struct in6_addr * saddr,const struct in6_addr * smask,const struct in6_addr * daddr,const struct in6_addr * dmask,int verbose,struct xtc_handle * handle)237 replace_entry(const xt_chainlabel chain,
238 struct ip6t_entry *fw,
239 unsigned int rulenum,
240 const struct in6_addr *saddr, const struct in6_addr *smask,
241 const struct in6_addr *daddr, const struct in6_addr *dmask,
242 int verbose,
243 struct xtc_handle *handle)
244 {
245 fw->ipv6.src = *saddr;
246 fw->ipv6.dst = *daddr;
247 fw->ipv6.smsk = *smask;
248 fw->ipv6.dmsk = *dmask;
249
250 if (verbose)
251 print_firewall_line(fw, handle);
252 return ip6tc_replace_entry(chain, fw, rulenum, handle);
253 }
254
255 static int
insert_entry(const xt_chainlabel chain,struct ip6t_entry * fw,unsigned int rulenum,unsigned int nsaddrs,const struct in6_addr saddrs[],const struct in6_addr smasks[],unsigned int ndaddrs,const struct in6_addr daddrs[],const struct in6_addr dmasks[],int verbose,struct xtc_handle * handle)256 insert_entry(const xt_chainlabel chain,
257 struct ip6t_entry *fw,
258 unsigned int rulenum,
259 unsigned int nsaddrs,
260 const struct in6_addr saddrs[],
261 const struct in6_addr smasks[],
262 unsigned int ndaddrs,
263 const struct in6_addr daddrs[],
264 const struct in6_addr dmasks[],
265 int verbose,
266 struct xtc_handle *handle)
267 {
268 unsigned int i, j;
269 int ret = 1;
270
271 for (i = 0; i < nsaddrs; i++) {
272 fw->ipv6.src = saddrs[i];
273 fw->ipv6.smsk = smasks[i];
274 for (j = 0; j < ndaddrs; j++) {
275 fw->ipv6.dst = daddrs[j];
276 fw->ipv6.dmsk = dmasks[j];
277 if (verbose)
278 print_firewall_line(fw, handle);
279 ret &= ip6tc_insert_entry(chain, fw, rulenum, handle);
280 }
281 }
282
283 return ret;
284 }
285
286 static int
delete_entry(const xt_chainlabel chain,struct ip6t_entry * fw,unsigned int nsaddrs,const struct in6_addr saddrs[],const struct in6_addr smasks[],unsigned int ndaddrs,const struct in6_addr daddrs[],const struct in6_addr dmasks[],int verbose,struct xtc_handle * handle,struct xtables_rule_match * matches,const struct xtables_target * target)287 delete_entry(const xt_chainlabel chain,
288 struct ip6t_entry *fw,
289 unsigned int nsaddrs,
290 const struct in6_addr saddrs[],
291 const struct in6_addr smasks[],
292 unsigned int ndaddrs,
293 const struct in6_addr daddrs[],
294 const struct in6_addr dmasks[],
295 int verbose,
296 struct xtc_handle *handle,
297 struct xtables_rule_match *matches,
298 const struct xtables_target *target)
299 {
300 unsigned int i, j;
301 int ret = 1;
302 unsigned char *mask;
303
304 mask = make_delete_mask(matches, target, sizeof(*fw));
305 for (i = 0; i < nsaddrs; i++) {
306 fw->ipv6.src = saddrs[i];
307 fw->ipv6.smsk = smasks[i];
308 for (j = 0; j < ndaddrs; j++) {
309 fw->ipv6.dst = daddrs[j];
310 fw->ipv6.dmsk = dmasks[j];
311 if (verbose)
312 print_firewall_line(fw, handle);
313 ret &= ip6tc_delete_entry(chain, fw, mask, handle);
314 }
315 }
316 free(mask);
317
318 return ret;
319 }
320
321 static int
check_entry(const xt_chainlabel chain,struct ip6t_entry * fw,unsigned int nsaddrs,const struct in6_addr * saddrs,const struct in6_addr * smasks,unsigned int ndaddrs,const struct in6_addr * daddrs,const struct in6_addr * dmasks,bool verbose,struct xtc_handle * handle,struct xtables_rule_match * matches,const struct xtables_target * target)322 check_entry(const xt_chainlabel chain, struct ip6t_entry *fw,
323 unsigned int nsaddrs, const struct in6_addr *saddrs,
324 const struct in6_addr *smasks, unsigned int ndaddrs,
325 const struct in6_addr *daddrs, const struct in6_addr *dmasks,
326 bool verbose, struct xtc_handle *handle,
327 struct xtables_rule_match *matches,
328 const struct xtables_target *target)
329 {
330 unsigned int i, j;
331 int ret = 1;
332 unsigned char *mask;
333
334 mask = make_delete_mask(matches, target, sizeof(*fw));
335 for (i = 0; i < nsaddrs; i++) {
336 fw->ipv6.src = saddrs[i];
337 fw->ipv6.smsk = smasks[i];
338 for (j = 0; j < ndaddrs; j++) {
339 fw->ipv6.dst = daddrs[j];
340 fw->ipv6.dmsk = dmasks[j];
341 if (verbose)
342 print_firewall_line(fw, handle);
343 ret &= ip6tc_check_entry(chain, fw, mask, handle);
344 }
345 }
346
347 free(mask);
348 return ret;
349 }
350
351 int
for_each_chain6(int (* fn)(const xt_chainlabel,int,struct xtc_handle *),int verbose,int builtinstoo,struct xtc_handle * handle)352 for_each_chain6(int (*fn)(const xt_chainlabel, int, struct xtc_handle *),
353 int verbose, int builtinstoo, struct xtc_handle *handle)
354 {
355 int ret = 1;
356 const char *chain;
357 char *chains;
358 unsigned int i, chaincount = 0;
359
360 chain = ip6tc_first_chain(handle);
361 while (chain) {
362 chaincount++;
363 chain = ip6tc_next_chain(handle);
364 }
365
366 chains = xtables_malloc(sizeof(xt_chainlabel) * chaincount);
367 i = 0;
368 chain = ip6tc_first_chain(handle);
369 while (chain) {
370 strcpy(chains + i*sizeof(xt_chainlabel), chain);
371 i++;
372 chain = ip6tc_next_chain(handle);
373 }
374
375 for (i = 0; i < chaincount; i++) {
376 if (!builtinstoo
377 && ip6tc_builtin(chains + i*sizeof(xt_chainlabel),
378 handle) == 1)
379 continue;
380 ret &= fn(chains + i*sizeof(xt_chainlabel), verbose, handle);
381 }
382
383 free(chains);
384 return ret;
385 }
386
387 int
flush_entries6(const xt_chainlabel chain,int verbose,struct xtc_handle * handle)388 flush_entries6(const xt_chainlabel chain, int verbose,
389 struct xtc_handle *handle)
390 {
391 if (!chain)
392 return for_each_chain6(flush_entries6, verbose, 1, handle);
393
394 if (verbose)
395 fprintf(stdout, "Flushing chain `%s'\n", chain);
396 return ip6tc_flush_entries(chain, handle);
397 }
398
399 static int
zero_entries(const xt_chainlabel chain,int verbose,struct xtc_handle * handle)400 zero_entries(const xt_chainlabel chain, int verbose,
401 struct xtc_handle *handle)
402 {
403 if (!chain)
404 return for_each_chain6(zero_entries, verbose, 1, handle);
405
406 if (verbose)
407 fprintf(stdout, "Zeroing chain `%s'\n", chain);
408 return ip6tc_zero_entries(chain, handle);
409 }
410
411 int
delete_chain6(const xt_chainlabel chain,int verbose,struct xtc_handle * handle)412 delete_chain6(const xt_chainlabel chain, int verbose,
413 struct xtc_handle *handle)
414 {
415 if (!chain)
416 return for_each_chain6(delete_chain6, verbose, 0, handle);
417
418 if (verbose)
419 fprintf(stdout, "Deleting chain `%s'\n", chain);
420 return ip6tc_delete_chain(chain, handle);
421 }
422
423 static int
list_entries(const xt_chainlabel chain,int rulenum,int verbose,int numeric,int expanded,int linenumbers,struct xtc_handle * handle)424 list_entries(const xt_chainlabel chain, int rulenum, int verbose, int numeric,
425 int expanded, int linenumbers, struct xtc_handle *handle)
426 {
427 int found = 0;
428 unsigned int format;
429 const char *this;
430
431 format = FMT_OPTIONS;
432 if (!verbose)
433 format |= FMT_NOCOUNTS;
434 else
435 format |= FMT_VIA;
436
437 if (numeric)
438 format |= FMT_NUMERIC;
439
440 if (!expanded)
441 format |= FMT_KILOMEGAGIGA;
442
443 if (linenumbers)
444 format |= FMT_LINENUMBERS;
445
446 for (this = ip6tc_first_chain(handle);
447 this;
448 this = ip6tc_next_chain(handle)) {
449 const struct ip6t_entry *i;
450 unsigned int num;
451
452 if (chain && strcmp(chain, this) != 0)
453 continue;
454
455 if (found) printf("\n");
456
457 if (!rulenum) {
458 struct xt_counters counters;
459 unsigned int urefs;
460 const char *pol;
461 int refs = - 1;
462
463 pol = ip6tc_get_policy(this, &counters, handle);
464 if (!pol && ip6tc_get_references(&urefs, this, handle))
465 refs = urefs;
466
467 print_header(format, this, pol, &counters, refs, 0);
468 }
469 i = ip6tc_first_rule(this, handle);
470
471 num = 0;
472 while (i) {
473 num++;
474 if (!rulenum || num == rulenum)
475 print_firewall(i,
476 ip6tc_get_target(i, handle),
477 num,
478 format,
479 handle);
480 i = ip6tc_next_rule(i, handle);
481 }
482 found = 1;
483 }
484
485 errno = ENOENT;
486 return found;
487 }
488
489 /* We want this to be readable, so only print out necessary fields.
490 * Because that's the kind of world I want to live in.
491 */
print_rule6(const struct ip6t_entry * e,struct xtc_handle * h,const char * chain,int counters)492 void print_rule6(const struct ip6t_entry *e,
493 struct xtc_handle *h, const char *chain, int counters)
494 {
495 const struct xt_entry_target *t;
496 const char *target_name;
497
498 /* print counters for iptables-save */
499 if (counters > 0)
500 printf("[%llu:%llu] ", (unsigned long long)e->counters.pcnt, (unsigned long long)e->counters.bcnt);
501
502 /* print chain name */
503 printf("-A %s", chain);
504
505 /* Print IP part. */
506 save_ipv6_addr('s', &e->ipv6.src, &e->ipv6.smsk,
507 e->ipv6.invflags & IP6T_INV_SRCIP);
508
509 save_ipv6_addr('d', &e->ipv6.dst, &e->ipv6.dmsk,
510 e->ipv6.invflags & IP6T_INV_DSTIP);
511
512 save_rule_details(e->ipv6.iniface, e->ipv6.iniface_mask,
513 e->ipv6.outiface, e->ipv6.outiface_mask,
514 e->ipv6.proto, 0, e->ipv6.invflags);
515
516 #if 0
517 /* not definied in ipv6
518 * FIXME: linux/netfilter_ipv6/ip6_tables: IP6T_INV_FRAG why definied? */
519 if (e->ipv6.flags & IPT_F_FRAG)
520 printf("%s -f",
521 e->ipv6.invflags & IP6T_INV_FRAG ? " !" : "");
522 #endif
523
524 if (e->ipv6.flags & IP6T_F_TOS)
525 printf("%s -? %d",
526 e->ipv6.invflags & IP6T_INV_TOS ? " !" : "",
527 e->ipv6.tos);
528
529 /* Print matchinfo part */
530 if (e->target_offset) {
531 IP6T_MATCH_ITERATE(e, print_match_save, &e->ipv6);
532 }
533
534 /* print counters for iptables -R */
535 if (counters < 0)
536 printf(" -c %llu %llu", (unsigned long long)e->counters.pcnt, (unsigned long long)e->counters.bcnt);
537
538 /* Print target name and targinfo part */
539 target_name = ip6tc_get_target(e, h);
540 t = ip6t_get_target((struct ip6t_entry *)e);
541 if (t->u.user.name[0]) {
542 const char *name = t->u.user.name;
543 const int revision = t->u.user.revision;
544 struct xtables_target *target, *tg, *tg2;
545
546 target = xtables_find_target(name, XTF_TRY_LOAD);
547 if (!target) {
548 fprintf(stderr, "Can't find library for target `%s'\n",
549 name);
550 exit(1);
551 }
552
553 tg = tg2 = xtables_find_target_revision(name, XTF_TRY_LOAD,
554 target, revision);
555 if (!tg2)
556 tg2 = target;
557 printf(" -j %s", tg2->alias ? tg2->alias(t) : target_name);
558
559 if (tg && tg->save)
560 tg->save(&e->ipv6, t);
561 else if (target->save)
562 printf(unsupported_rev);
563 else {
564 /* If the target size is greater than xt_entry_target
565 * there is something to be saved, we just don't know
566 * how to print it */
567 if (t->u.target_size !=
568 sizeof(struct xt_entry_target)) {
569 fprintf(stderr, "Target `%s' is missing "
570 "save function\n",
571 name);
572 exit(1);
573 }
574 }
575 } else if (target_name && (*target_name != '\0'))
576 #ifdef IP6T_F_GOTO
577 printf(" -%c %s", e->ipv6.flags & IP6T_F_GOTO ? 'g' : 'j', target_name);
578 #else
579 printf(" -j %s", target_name);
580 #endif
581
582 printf("\n");
583 }
584
585 static int
list_rules(const xt_chainlabel chain,int rulenum,int counters,struct xtc_handle * handle)586 list_rules(const xt_chainlabel chain, int rulenum, int counters,
587 struct xtc_handle *handle)
588 {
589 const char *this = NULL;
590 int found = 0;
591
592 if (counters)
593 counters = -1; /* iptables -c format */
594
595 /* Dump out chain names first,
596 * thereby preventing dependency conflicts */
597 if (!rulenum) for (this = ip6tc_first_chain(handle);
598 this;
599 this = ip6tc_next_chain(handle)) {
600 if (chain && strcmp(this, chain) != 0)
601 continue;
602
603 if (ip6tc_builtin(this, handle)) {
604 struct xt_counters count;
605 printf("-P %s %s", this, ip6tc_get_policy(this, &count, handle));
606 if (counters)
607 printf(" -c %llu %llu", (unsigned long long)count.pcnt, (unsigned long long)count.bcnt);
608 printf("\n");
609 } else {
610 printf("-N %s\n", this);
611 }
612 }
613
614 for (this = ip6tc_first_chain(handle);
615 this;
616 this = ip6tc_next_chain(handle)) {
617 const struct ip6t_entry *e;
618 int num = 0;
619
620 if (chain && strcmp(this, chain) != 0)
621 continue;
622
623 /* Dump out rules */
624 e = ip6tc_first_rule(this, handle);
625 while(e) {
626 num++;
627 if (!rulenum || num == rulenum)
628 print_rule6(e, handle, this, counters);
629 e = ip6tc_next_rule(e, handle);
630 }
631 found = 1;
632 }
633
634 errno = ENOENT;
635 return found;
636 }
637
638 static struct ip6t_entry *
generate_entry(const struct ip6t_entry * fw,struct xtables_rule_match * matches,struct xt_entry_target * target)639 generate_entry(const struct ip6t_entry *fw,
640 struct xtables_rule_match *matches,
641 struct xt_entry_target *target)
642 {
643 unsigned int size;
644 struct xtables_rule_match *matchp;
645 struct ip6t_entry *e;
646
647 size = sizeof(struct ip6t_entry);
648 for (matchp = matches; matchp; matchp = matchp->next)
649 size += matchp->match->m->u.match_size;
650
651 e = xtables_malloc(size + target->u.target_size);
652 *e = *fw;
653 e->target_offset = size;
654 e->next_offset = size + target->u.target_size;
655
656 size = 0;
657 for (matchp = matches; matchp; matchp = matchp->next) {
658 memcpy(e->elems + size, matchp->match->m, matchp->match->m->u.match_size);
659 size += matchp->match->m->u.match_size;
660 }
661 memcpy(e->elems + size, target, target->u.target_size);
662
663 return e;
664 }
665
do_command6(int argc,char * argv[],char ** table,struct xtc_handle ** handle,bool restore)666 int do_command6(int argc, char *argv[], char **table,
667 struct xtc_handle **handle, bool restore)
668 {
669 struct xt_cmd_parse_ops cmd_parse_ops = {
670 .proto_parse = ipv6_proto_parse,
671 .post_parse = ipv6_post_parse,
672 };
673 struct xt_cmd_parse p = {
674 .table = *table,
675 .restore = restore,
676 .line = line,
677 .ops = &cmd_parse_ops,
678 };
679 struct iptables_command_state cs = {
680 .jumpto = "",
681 .argv = argv,
682 };
683 struct xtables_args args = {
684 .family = AF_INET6,
685 };
686 struct ip6t_entry *e = NULL;
687 unsigned int nsaddrs = 0, ndaddrs = 0;
688 struct in6_addr *saddrs = NULL, *daddrs = NULL;
689 struct in6_addr *smasks = NULL, *dmasks = NULL;
690
691 int verbose = 0;
692 int wait = 0;
693 const char *chain = NULL;
694 const char *policy = NULL, *newname = NULL;
695 unsigned int rulenum = 0, command = 0;
696 int ret = 1;
697
698 do_parse(argc, argv, &p, &cs, &args);
699
700 command = p.command;
701 chain = p.chain;
702 *table = p.table;
703 rulenum = p.rulenum;
704 policy = p.policy;
705 newname = p.newname;
706 verbose = p.verbose;
707 wait = args.wait;
708 nsaddrs = args.s.naddrs;
709 ndaddrs = args.d.naddrs;
710 saddrs = args.s.addr.v6;
711 daddrs = args.d.addr.v6;
712 smasks = args.s.mask.v6;
713 dmasks = args.d.mask.v6;
714
715 /* Attempt to acquire the xtables lock */
716 if (!restore)
717 xtables_lock_or_exit(wait);
718
719 /* only allocate handle if we weren't called with a handle */
720 if (!*handle)
721 *handle = ip6tc_init(*table);
722
723 /* try to insmod the module if iptc_init failed */
724 if (!*handle && xtables_load_ko(xtables_modprobe_program, false) != -1)
725 *handle = ip6tc_init(*table);
726
727 if (!*handle)
728 xtables_error(VERSION_PROBLEM,
729 "can't initialize ip6tables table `%s': %s",
730 *table, ip6tc_strerror(errno));
731
732 if (command == CMD_APPEND
733 || command == CMD_DELETE
734 || command == CMD_CHECK
735 || command == CMD_INSERT
736 || command == CMD_REPLACE) {
737 if (cs.target && ip6tc_is_chain(cs.jumpto, *handle)) {
738 fprintf(stderr,
739 "Warning: using chain %s, not extension\n",
740 cs.jumpto);
741
742 if (cs.target->t)
743 free(cs.target->t);
744
745 cs.target = NULL;
746 }
747
748 /* If they didn't specify a target, or it's a chain
749 name, use standard. */
750 if (!cs.target
751 && (strlen(cs.jumpto) == 0
752 || ip6tc_is_chain(cs.jumpto, *handle))) {
753 size_t size;
754
755 cs.target = xtables_find_target(XT_STANDARD_TARGET,
756 XTF_LOAD_MUST_SUCCEED);
757
758 size = sizeof(struct xt_entry_target)
759 + cs.target->size;
760 cs.target->t = xtables_calloc(1, size);
761 cs.target->t->u.target_size = size;
762 strcpy(cs.target->t->u.user.name, cs.jumpto);
763 xs_init_target(cs.target);
764 }
765
766 if (!cs.target) {
767 /* It is no chain, and we can't load a plugin.
768 * We cannot know if the plugin is corrupt, non
769 * existent OR if the user just misspelled a
770 * chain.
771 */
772 #ifdef IP6T_F_GOTO
773 if (cs.fw6.ipv6.flags & IP6T_F_GOTO)
774 xtables_error(PARAMETER_PROBLEM,
775 "goto '%s' is not a chain",
776 cs.jumpto);
777 #endif
778 xtables_find_target(cs.jumpto, XTF_LOAD_MUST_SUCCEED);
779 } else {
780 e = generate_entry(&cs.fw6, cs.matches, cs.target->t);
781 }
782 }
783
784 switch (command) {
785 case CMD_APPEND:
786 ret = append_entry(chain, e,
787 nsaddrs, saddrs, smasks,
788 ndaddrs, daddrs, dmasks,
789 cs.options&OPT_VERBOSE,
790 *handle);
791 break;
792 case CMD_DELETE:
793 ret = delete_entry(chain, e,
794 nsaddrs, saddrs, smasks,
795 ndaddrs, daddrs, dmasks,
796 cs.options&OPT_VERBOSE,
797 *handle, cs.matches, cs.target);
798 break;
799 case CMD_DELETE_NUM:
800 ret = ip6tc_delete_num_entry(chain, rulenum - 1, *handle);
801 break;
802 case CMD_CHECK:
803 ret = check_entry(chain, e,
804 nsaddrs, saddrs, smasks,
805 ndaddrs, daddrs, dmasks,
806 cs.options&OPT_VERBOSE,
807 *handle, cs.matches, cs.target);
808 break;
809 case CMD_REPLACE:
810 ret = replace_entry(chain, e, rulenum - 1,
811 saddrs, smasks, daddrs, dmasks,
812 cs.options&OPT_VERBOSE, *handle);
813 break;
814 case CMD_INSERT:
815 ret = insert_entry(chain, e, rulenum - 1,
816 nsaddrs, saddrs, smasks,
817 ndaddrs, daddrs, dmasks,
818 cs.options&OPT_VERBOSE,
819 *handle);
820 break;
821 case CMD_FLUSH:
822 ret = flush_entries6(chain, cs.options&OPT_VERBOSE, *handle);
823 break;
824 case CMD_ZERO:
825 ret = zero_entries(chain, cs.options&OPT_VERBOSE, *handle);
826 break;
827 case CMD_ZERO_NUM:
828 ret = ip6tc_zero_counter(chain, rulenum, *handle);
829 break;
830 case CMD_LIST:
831 case CMD_LIST|CMD_ZERO:
832 case CMD_LIST|CMD_ZERO_NUM:
833 ret = list_entries(chain,
834 rulenum,
835 cs.options&OPT_VERBOSE,
836 cs.options&OPT_NUMERIC,
837 cs.options&OPT_EXPANDED,
838 cs.options&OPT_LINENUMBERS,
839 *handle);
840 if (ret && (command & CMD_ZERO))
841 ret = zero_entries(chain,
842 cs.options&OPT_VERBOSE, *handle);
843 if (ret && (command & CMD_ZERO_NUM))
844 ret = ip6tc_zero_counter(chain, rulenum, *handle);
845 break;
846 case CMD_LIST_RULES:
847 case CMD_LIST_RULES|CMD_ZERO:
848 case CMD_LIST_RULES|CMD_ZERO_NUM:
849 ret = list_rules(chain,
850 rulenum,
851 cs.options&OPT_VERBOSE,
852 *handle);
853 if (ret && (command & CMD_ZERO))
854 ret = zero_entries(chain,
855 cs.options&OPT_VERBOSE, *handle);
856 if (ret && (command & CMD_ZERO_NUM))
857 ret = ip6tc_zero_counter(chain, rulenum, *handle);
858 break;
859 case CMD_NEW_CHAIN:
860 ret = ip6tc_create_chain(chain, *handle);
861 break;
862 case CMD_DELETE_CHAIN:
863 ret = delete_chain6(chain, cs.options&OPT_VERBOSE, *handle);
864 break;
865 case CMD_RENAME_CHAIN:
866 ret = ip6tc_rename_chain(chain, newname, *handle);
867 break;
868 case CMD_SET_POLICY:
869 ret = ip6tc_set_policy(chain, policy, cs.options&OPT_COUNTERS ? &cs.fw6.counters : NULL, *handle);
870 break;
871 case CMD_NONE:
872 /* do_parse ignored the line (eg: -4 with ip6tables-restore) */
873 break;
874 default:
875 /* We should never reach this... */
876 exit_tryhelp(2, line);
877 }
878
879 if (verbose > 1)
880 dump_entries6(*handle);
881
882 xtables_clear_iptables_command_state(&cs);
883
884 if (e != NULL) {
885 free(e);
886 e = NULL;
887 }
888
889 free(saddrs);
890 free(smasks);
891 free(daddrs);
892 free(dmasks);
893 xtables_free_opts(1);
894
895 return ret;
896 }
897