1 /* Code to save the xtables state, in human readable-form. */
2 /* (C) 1999 by Paul 'Rusty' Russell <[email protected]> and
3 * (C) 2000-2002 by Harald Welte <[email protected]>
4 * (C) 2012 by Pablo Neira Ayuso <[email protected]>
5 *
6 * This code is distributed under the terms of GNU GPL v2
7 *
8 */
9 #include "config.h"
10 #include <getopt.h>
11 #include <errno.h>
12 #include <libgen.h>
13 #include <stdio.h>
14 #include <fcntl.h>
15 #include <stdlib.h>
16 #include <string.h>
17 #include <time.h>
18 #include <netdb.h>
19 #include <unistd.h>
20 #include "libiptc/libiptc.h"
21 #include "iptables.h"
22 #include "xtables-multi.h"
23 #include "nft.h"
24 #include "nft-cache.h"
25
26 #include <libnftnl/chain.h>
27
28 #ifndef NO_SHARED_LIBS
29 #include <dlfcn.h>
30 #endif
31
32 #define prog_name xtables_globals.program_name
33 #define prog_vers xtables_globals.program_version
34
35 static const char *ipt_save_optstring = "bcdt:M:f:V";
36 static const struct option ipt_save_options[] = {
37 {.name = "counters", .has_arg = false, .val = 'c'},
38 {.name = "version", .has_arg = false, .val = 'V'},
39 {.name = "dump", .has_arg = false, .val = 'd'},
40 {.name = "table", .has_arg = true, .val = 't'},
41 {.name = "modprobe", .has_arg = true, .val = 'M'},
42 {.name = "file", .has_arg = true, .val = 'f'},
43 {NULL},
44 };
45
46 static const char *arp_save_optstring = "cM:V";
47 static const struct option arp_save_options[] = {
48 {.name = "counters", .has_arg = false, .val = 'c'},
49 {.name = "version", .has_arg = false, .val = 'V'},
50 {.name = "modprobe", .has_arg = true, .val = 'M'},
51 {NULL},
52 };
53
54 static const char *ebt_save_optstring = "ct:M:V";
55 static const struct option ebt_save_options[] = {
56 {.name = "counters", .has_arg = false, .val = 'c'},
57 {.name = "version", .has_arg = false, .val = 'V'},
58 {.name = "table", .has_arg = true, .val = 't'},
59 {.name = "modprobe", .has_arg = true, .val = 'M'},
60 {NULL},
61 };
62
63 struct do_output_data {
64 unsigned int format;
65 bool commit;
66 };
67
68 static int
__do_output(struct nft_handle * h,const char * tablename,void * data)69 __do_output(struct nft_handle *h, const char *tablename, void *data)
70 {
71 struct do_output_data *d = data;
72 time_t now;
73
74 if (!nft_table_builtin_find(h, tablename))
75 return 0;
76
77 if (!nft_is_table_compatible(h, tablename, NULL)) {
78 printf("# Table `%s' is incompatible, use 'nft' tool.\n",
79 tablename);
80 return 0;
81 } else if (nft_is_table_tainted(h, tablename)) {
82 printf("# Table `%s' contains incompatible base-chains, use 'nft' tool to list them.\n",
83 tablename);
84 }
85
86 now = time(NULL);
87 printf("# Generated by %s v%s on %s", prog_name,
88 prog_vers, ctime(&now));
89
90 printf("*%s\n", tablename);
91 /* Dump out chain names first,
92 * thereby preventing dependency conflicts */
93 nft_cache_sort_chains(h, tablename);
94 nft_chain_foreach(h, tablename, nft_chain_save, h);
95 nft_rule_save(h, tablename, d->format);
96 if (d->commit)
97 printf("COMMIT\n");
98
99 now = time(NULL);
100 printf("# Completed on %s", ctime(&now));
101 return 0;
102 }
103
104 static int
do_output(struct nft_handle * h,const char * tablename,struct do_output_data * d)105 do_output(struct nft_handle *h, const char *tablename, struct do_output_data *d)
106 {
107 int ret;
108
109 if (!tablename) {
110 ret = nft_for_each_table(h, __do_output, d);
111 nft_check_xt_legacy(h->family, true);
112 return !!ret;
113 }
114
115 if (!nft_table_find(h, tablename) &&
116 !nft_table_builtin_find(h, tablename)) {
117 fprintf(stderr, "Table `%s' does not exist\n", tablename);
118 return 1;
119 }
120
121 ret = __do_output(h, tablename, d);
122 nft_check_xt_legacy(h->family, true);
123 return ret;
124 }
125
126 /* Format:
127 * :Chain name POLICY packets bytes
128 * rule
129 */
130 static int
xtables_save_main(int family,int argc,char * argv[],const char * optstring,const struct option * longopts)131 xtables_save_main(int family, int argc, char *argv[],
132 const char *optstring, const struct option *longopts)
133 {
134 const char *tablename = NULL;
135 struct do_output_data d = {
136 .format = FMT_NOCOUNTS,
137 };
138 struct nft_handle h;
139 bool dump = false;
140 FILE *file = NULL;
141 int ret, c;
142
143 xtables_globals.program_name = basename(*argv);;
144 c = xtables_init_all(&xtables_globals, family);
145 if (c < 0) {
146 fprintf(stderr, "%s/%s Failed to initialize xtables\n",
147 xtables_globals.program_name,
148 xtables_globals.program_version);
149 exit(1);
150 }
151
152 while ((c = getopt_long(argc, argv, optstring, longopts, NULL)) != -1) {
153 switch (c) {
154 case 'b':
155 fprintf(stderr, "-b/--binary option is not implemented\n");
156 break;
157 case 'c':
158 d.format &= ~FMT_NOCOUNTS;
159 break;
160
161 case 't':
162 /* Select specific table. */
163 tablename = optarg;
164 break;
165 case 'M':
166 xtables_modprobe_program = optarg;
167 break;
168 case 'f':
169 file = fopen(optarg, "w");
170 if (file == NULL) {
171 fprintf(stderr, "Failed to open file, error: %s\n",
172 strerror(errno));
173 exit(1);
174 }
175 ret = dup2(fileno(file), STDOUT_FILENO);
176 if (ret == -1) {
177 fprintf(stderr, "Failed to redirect stdout, error: %s\n",
178 strerror(errno));
179 exit(1);
180 }
181 fclose(file);
182 break;
183 case 'd':
184 dump = true;
185 break;
186 case 'V':
187 printf("%s v%s\n", prog_name, prog_vers);
188 exit(0);
189 default:
190 fprintf(stderr,
191 "Look at manual page `%s.8' for more information.\n",
192 prog_name);
193 exit(1);
194 }
195 }
196
197 if (optind < argc) {
198 fprintf(stderr, "Unknown arguments found on commandline\n");
199 exit(1);
200 }
201
202 init_extensions();
203 switch (family) {
204 case NFPROTO_IPV4:
205 init_extensions4();
206 d.commit = true;
207 break;
208 case NFPROTO_IPV6:
209 init_extensions6();
210 d.commit = true;
211 break;
212 case NFPROTO_ARP:
213 init_extensionsa();
214 break;
215 case NFPROTO_BRIDGE: {
216 const char *ctr = getenv("EBTABLES_SAVE_COUNTER");
217
218 if (!(d.format & FMT_NOCOUNTS)) {
219 d.format |= FMT_EBT_SAVE;
220 } else if (ctr && !strcmp(ctr, "yes")) {
221 d.format &= ~FMT_NOCOUNTS;
222 d.format |= FMT_C_COUNTS | FMT_EBT_SAVE;
223 }
224 init_extensionsb();
225 break;
226 }
227 default:
228 fprintf(stderr, "Unknown family %d\n", family);
229 return 1;
230 }
231
232 if (nft_init(&h, family) < 0) {
233 fprintf(stderr, "%s/%s Failed to initialize nft: %s\n",
234 xtables_globals.program_name,
235 xtables_globals.program_version,
236 strerror(errno));
237 exit(EXIT_FAILURE);
238 }
239
240 nft_cache_level_set(&h, NFT_CL_RULES, NULL);
241 nft_cache_build(&h);
242 nft_xt_fake_builtin_chains(&h, tablename, NULL);
243
244 ret = do_output(&h, tablename, &d);
245 nft_fini(&h);
246 xtables_fini();
247 if (dump)
248 exit(0);
249
250 return ret;
251 }
252
xtables_ip4_save_main(int argc,char * argv[])253 int xtables_ip4_save_main(int argc, char *argv[])
254 {
255 return xtables_save_main(NFPROTO_IPV4, argc, argv,
256 ipt_save_optstring, ipt_save_options);
257 }
258
xtables_ip6_save_main(int argc,char * argv[])259 int xtables_ip6_save_main(int argc, char *argv[])
260 {
261 return xtables_save_main(NFPROTO_IPV6, argc, argv,
262 ipt_save_optstring, ipt_save_options);
263 }
264
xtables_eb_save_main(int argc,char * argv[])265 int xtables_eb_save_main(int argc, char *argv[])
266 {
267 return xtables_save_main(NFPROTO_BRIDGE, argc, argv,
268 ebt_save_optstring, ebt_save_options);
269 }
270
xtables_arp_save_main(int argc,char * argv[])271 int xtables_arp_save_main(int argc, char *argv[])
272 {
273 return xtables_save_main(NFPROTO_ARP, argc, argv,
274 arp_save_optstring, arp_save_options);
275 }
276