tools/iptables-test.c

   1 /*
   2  *  Connection Manager
   3  *
   4  *  Copyright (C) 2007-2010  Intel Corporation. All rights reserved.
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License version 2 as
   8  *  published by the Free Software Foundation.
   9  *
  10  *  This program is distributed in the hope that it will be useful,
  11  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13  *  GNU General Public License for more details.
  14  *
  15  *  You should have received a copy of the GNU General Public License
  16  *  along with this program; if not, write to the Free Software
  17  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  18  *
  19  */
  20
  21 #include <getopt.h>
  22 #include <stdlib.h>
  23 #include <stdio.h>
  24 #include <string.h>
  25 #include <unistd.h>
  26 #include <sys/errno.h>
  27 #include <sys/socket.h>
  28 #include <xtables.h>
  29
  30 #include <linux/netfilter_ipv4/ip_tables.h>
  31
  32 #include <glib.h>
  33
  34 static const char *hooknames[] = {
  35         [NF_IP_PRE_ROUTING]     = "PREROUTING",
  36         [NF_IP_LOCAL_IN]        = "INPUT",
  37         [NF_IP_FORWARD]         = "FORWARD",
  38         [NF_IP_LOCAL_OUT]       = "OUTPUT",
  39         [NF_IP_POST_ROUTING]    = "POSTROUTING",
  40 };
  41
  42 #define LABEL_ACCEPT  "ACCEPT"
  43 #define LABEL_DROP    "DROP"
  44 #define LABEL_QUEUE   "QUEUE"
  45 #define LABEL_RETURN  "RETURN"
  46
  47 /* fn returns 0 to continue iteration */
  48 #define _XT_ENTRY_ITERATE_CONTINUE(type, entries, size, n, fn, args...) \
  49 ({                                                              \
  50         unsigned int __i;                                       \
  51         int __n;                                                \
  52         int __ret = 0;                                          \
  53         type *__entry;                                          \
  54                                                                 \
  55         for (__i = 0, __n = 0; __i < (size);                    \
  56              __i += __entry->next_offset, __n++) {              \
  57                 __entry = (void *)(entries) + __i;              \
  58                 if (__n < n)                                    \
  59                         continue;                               \
  60                                                                 \
  61                 __ret = fn(__entry,  ## args);                  \
  62                 if (__ret != 0)                                 \
  63                         break;                                  \
  64         }                                                       \
  65         __ret;                                                  \
  66 })
  67
  68 /* fn returns 0 to continue iteration */
  69 #define _XT_ENTRY_ITERATE(type, entries, size, fn, args...) \
  70         _XT_ENTRY_ITERATE_CONTINUE(type, entries, size, 0, fn, args)
  71
  72 #define ENTRY_ITERATE(entries, size, fn, args...) \
  73         _XT_ENTRY_ITERATE(struct ipt_entry, entries, size, fn, ## args)
  74
  75 #define MIN_ALIGN (__alignof__(struct ipt_entry))
  76
  77 #define ALIGN(s) (((s) + ((MIN_ALIGN)-1)) & ~((MIN_ALIGN)-1))
  78
  79 struct error_target {
  80         struct xt_entry_target t;
  81         char error[IPT_TABLE_MAXNAMELEN];
  82 };
  83
  84 struct connman_iptables_entry {
  85         int offset;
  86         int builtin;
  87
  88         struct ipt_entry *entry;
  89 };
  90
  91 struct connman_iptables {
  92         int ipt_sock;
  93
  94         struct ipt_getinfo *info;
  95         struct ipt_get_entries *blob_entries;
  96
  97         unsigned int num_entries;
  98         unsigned int old_entries;
  99         unsigned int size;
 100
 101         unsigned int underflow[NF_INET_NUMHOOKS];
 102         unsigned int hook_entry[NF_INET_NUMHOOKS];
 103
 104         GList *entries;
 105 };
 106
 107
 108 static struct ipt_entry *get_entry(struct connman_iptables *table,
 109                                         unsigned int offset)
 110 {
 111         return (struct ipt_entry *)((char *)table->blob_entries->entrytable +
 112                                                                         offset);
 113 }
 114
 115 static int is_hook_entry(struct connman_iptables *table,
 116                                 struct ipt_entry *entry)
 117 {
 118         unsigned int i;
 119
 120         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
 121                 if ((table->info->valid_hooks & (1 << i))
 122                 && get_entry(table, table->info->hook_entry[i]) == entry)
 123                         return i;
 124         }
 125
 126         return -1;
 127 }
 128
 129 static unsigned long entry_to_offset(struct connman_iptables *table,
 130                                         struct ipt_entry *entry)
 131 {
 132         return (void *)entry - (void *)table->blob_entries->entrytable;
 133 }
 134
 135 static int target_to_verdict(char *target_name)
 136 {
 137         if (!strcmp(target_name, LABEL_ACCEPT))
 138                 return -NF_ACCEPT - 1;
 139
 140         if (!strcmp(target_name, LABEL_DROP))
 141                 return -NF_DROP - 1;
 142
 143         if (!strcmp(target_name, LABEL_QUEUE))
 144                 return -NF_QUEUE - 1;
 145
 146         if (!strcmp(target_name, LABEL_RETURN))
 147                 return XT_RETURN;
 148
 149         return 0;
 150 }
 151
 152 static gboolean is_builtin_target(char *target_name)
 153 {
 154         if (!strcmp(target_name, LABEL_ACCEPT) ||
 155                 !strcmp(target_name, LABEL_DROP) ||
 156                 !strcmp(target_name, LABEL_QUEUE) ||
 157                 !strcmp(target_name, LABEL_RETURN))
 158                 return TRUE;
 159
 160         return FALSE;
 161 }
 162
 163 static gboolean is_jump(struct connman_iptables_entry *e)
 164 {
 165         struct xt_entry_target *target;
 166
 167         target = ipt_get_target(e->entry);
 168
 169         if (!strcmp(target->u.user.name, IPT_STANDARD_TARGET)) {
 170                 struct xt_standard_target *t;
 171
 172                 t = (struct xt_standard_target *)target;
 173
 174                 switch (t->verdict) {
 175                 case XT_RETURN:
 176                 case -NF_ACCEPT - 1:
 177                 case -NF_DROP - 1:
 178                 case -NF_QUEUE - 1:
 179                 case -NF_STOP - 1:
 180                         return false;
 181
 182                 default:
 183                         return true;
 184                 }
 185         }
 186
 187         return false;
 188 }
 189
 190 static gboolean is_chain(struct connman_iptables *table,
 191                                 struct connman_iptables_entry *e)
 192 {
 193         struct ipt_entry *entry;
 194         struct xt_entry_target *target;
 195
 196         entry = e->entry;
 197         if (e->builtin >= 0)
 198                 return TRUE;
 199
 200         target = ipt_get_target(entry);
 201         if (!strcmp(target->u.user.name, IPT_ERROR_TARGET))
 202                 return TRUE;
 203
 204         return FALSE;
 205 }
 206
 207 static GList *find_chain_head(struct connman_iptables *table,
 208                                 char *chain_name)
 209 {
 210         GList *list;
 211         struct connman_iptables_entry *head;
 212         struct ipt_entry *entry;
 213         struct xt_entry_target *target;
 214         int builtin;
 215
 216         for (list = table->entries; list; list = list->next) {
 217                 head = list->data;
 218                 entry = head->entry;
 219
 220                 /* Buit-in chain */
 221                 builtin = head->builtin;
 222                 if (builtin >= 0 && !strcmp(hooknames[builtin], chain_name))
 223                         break;
 224
 225                 /* User defined chain */
 226                 target = ipt_get_target(entry);
 227                 if (!strcmp(target->u.user.name, IPT_ERROR_TARGET) &&
 228                     !strcmp((char *)target->data, chain_name))
 229                         break;
 230         }
 231
 232         return list;
 233 }
 234
 235 static GList *find_chain_tail(struct connman_iptables *table,
 236                                 char *chain_name)
 237 {
 238         GList *chain_head, *list;
 239         struct connman_iptables_entry *tail;
 240
 241         chain_head = find_chain_head(table, chain_name);
 242         if (chain_head == NULL)
 243                 return NULL;
 244
 245         /* Then we look for the next chain */
 246         for (list = chain_head->next; list; list = list->next) {
 247                 tail = list->data;
 248
 249                 if (is_chain(table, tail))
 250                         return list;
 251         }
 252
 253         /* Nothing found, we return the table end */
 254         return g_list_last(table->entries);
 255 }
 256
 257 static void update_offsets(struct connman_iptables *table)
 258 {
 259         GList *list, *prev;
 260         struct connman_iptables_entry *entry, *prev_entry;
 261
 262         for (list = table->entries; list; list = list->next) {
 263                 entry = list->data;
 264
 265                 if (list == table->entries) {
 266                         entry->offset = 0;
 267
 268                         continue;
 269                 }
 270
 271                 prev = list->prev;
 272                 prev_entry = prev->data;
 273
 274                 entry->offset = prev_entry->offset +
 275                                         prev_entry->entry->next_offset;
 276         }
 277 }
 278
 279 static int connman_add_entry(struct connman_iptables *table,
 280                                 struct ipt_entry *entry, GList *before,
 281                                         int builtin)
 282 {
 283         GList *list;
 284         struct connman_iptables_entry *e, *tmp, *entry_before;
 285         struct xt_standard_target *t;
 286
 287         if (table == NULL)
 288                 return -1;
 289
 290         e = g_try_malloc0(sizeof(struct connman_iptables_entry));
 291         if (e == NULL)
 292                 return -1;
 293
 294         e->entry = entry;
 295         e->builtin = builtin;
 296
 297         table->entries = g_list_insert_before(table->entries, before, e);
 298         table->num_entries++;
 299         table->size += entry->next_offset;
 300
 301         if (before == NULL) {
 302                 e->offset = table->size - entry->next_offset;
 303
 304                 return 0;
 305         }
 306
 307         entry_before = before->data;
 308
 309         /*
 310          * We've just insterted a new entry. All references before it
 311          * should be bumped accordingly.
 312          */
 313         for (list = table->entries; list != before; list = list->next) {
 314                 tmp = list->data;
 315
 316                 if (!is_jump(tmp))
 317                         continue;
 318
 319                 t = (struct xt_standard_target *)ipt_get_target(tmp->entry);
 320
 321                 if (t->verdict >= entry_before->offset)
 322                         t->verdict += entry->next_offset;
 323         }
 324
 325         update_offsets(table);
 326
 327         return 0;
 328 }
 329
 330 static int remove_table_entry(struct connman_iptables *table,
 331                                         struct connman_iptables_entry *entry)
 332 {
 333         int removed = 0;
 334
 335         table->num_entries--;
 336         table->size -= entry->entry->next_offset;
 337         removed = entry->entry->next_offset;
 338
 339         g_free(entry->entry);
 340
 341         table->entries = g_list_remove(table->entries, entry);
 342
 343         return removed;
 344 }
 345
 346 static int connman_iptables_flush_chain(struct connman_iptables *table,
 347                                                 char *name)
 348 {
 349         GList *chain_head, *chain_tail, *list, *next;
 350         struct connman_iptables_entry *entry;
 351         int builtin, removed = 0;
 352
 353         chain_head = find_chain_head(table, name);
 354         if (chain_head == NULL)
 355                 return -EINVAL;
 356
 357         chain_tail = find_chain_tail(table, name);
 358         if (chain_tail == NULL)
 359                 return -EINVAL;
 360
 361         entry = chain_head->data;
 362         builtin = entry->builtin;
 363
 364         if (builtin >= 0)
 365                 list = chain_head;
 366         else
 367                 list = chain_head->next;
 368
 369         if (list == chain_tail->prev)
 370                 return 0;
 371
 372         while (list != chain_tail->prev) {
 373                 entry = list->data;
 374                 next = g_list_next(list);
 375
 376                 removed += remove_table_entry(table, entry);
 377
 378                 list = next;
 379         }
 380
 381         if (builtin >= 0) {
 382                 struct connman_iptables_entry *e;
 383
 384                 entry = list->data;
 385
 386                 entry->builtin = builtin;
 387
 388                 table->underflow[builtin] -= removed;
 389
 390                 for (list = chain_tail; list; list = list->next) {
 391                         e = list->data;
 392
 393                         builtin = e->builtin;
 394                         if (builtin < 0)
 395                                 continue;
 396
 397                         table->hook_entry[builtin] -= removed;
 398                         table->underflow[builtin] -= removed;
 399                 }
 400         }
 401
 402         update_offsets(table);
 403
 404         return 0;
 405 }
 406
 407 static int connman_iptables_delete_chain(struct connman_iptables *table,
 408                                                 char *name)
 409 {
 410         GList *chain_head, *chain_tail, *list, *next;
 411         struct connman_iptables_entry *entry;
 412
 413         chain_head = find_chain_head(table, name);
 414         if (chain_head == NULL)
 415                 return -EINVAL;
 416
 417         chain_tail = find_chain_tail(table, name);
 418         if (chain_tail == NULL)
 419                 return -EINVAL;
 420
 421         list = chain_head;
 422
 423         while (list != chain_tail) {
 424                 entry = list->data;
 425                 next = g_list_next(list);
 426
 427                 table->num_entries--;
 428                 table->size -= entry->entry->next_offset;
 429
 430                 table->entries = g_list_remove(table->entries, list->data);
 431
 432                 list = next;
 433         }
 434
 435         update_offsets(table);
 436
 437         return 0;
 438 }
 439
 440 static int connman_iptables_add_chain(struct connman_iptables *table,
 441                                         char *name)
 442 {
 443         GList *last;
 444         struct ipt_entry *entry_head;
 445         struct ipt_entry *entry_return;
 446         struct error_target *error;
 447         struct ipt_standard_target *standard;
 448         u_int16_t entry_head_size, entry_return_size;
 449
 450         last = g_list_last(table->entries);
 451
 452         /*
 453          * An empty chain is composed of:
 454          * - A head entry, with no match and an error target.
 455          *   The error target data is the chain name.
 456          * - A tail entry, with no match and a standard target.
 457          *   The standard target verdict is XT_RETURN (return to the
 458          *   caller).
 459          */
 460
 461         /* head entry */
 462         entry_head_size = sizeof(struct ipt_entry) +
 463                                 sizeof(struct error_target);
 464         entry_head = g_try_malloc0(entry_head_size);
 465         if (entry_head == NULL)
 466                 goto err_head;
 467
 468         memset(entry_head, 0, entry_head_size);
 469
 470         entry_head->target_offset = sizeof(struct ipt_entry);
 471         entry_head->next_offset = entry_head_size;
 472
 473         error = (struct error_target *) entry_head->elems;
 474         strcpy(error->t.u.user.name, IPT_ERROR_TARGET);
 475         error->t.u.user.target_size = ALIGN(sizeof(struct error_target));
 476         strcpy(error->error, name);
 477
 478         if (connman_add_entry(table, entry_head, last, -1) < 0)
 479                 goto err_head;
 480
 481         /* tail entry */
 482         entry_return_size = sizeof(struct ipt_entry) +
 483                                 sizeof(struct ipt_standard_target);
 484         entry_return = g_try_malloc0(entry_return_size);
 485         if (entry_return == NULL)
 486                 goto err;
 487
 488         memset(entry_return, 0, entry_return_size);
 489
 490         entry_return->target_offset = sizeof(struct ipt_entry);
 491         entry_return->next_offset = entry_return_size;
 492
 493         standard = (struct ipt_standard_target *) entry_return->elems;
 494         standard->target.u.user.target_size =
 495                                 ALIGN(sizeof(struct ipt_standard_target));
 496         standard->verdict = XT_RETURN;
 497
 498         if (connman_add_entry(table, entry_return, last, -1) < 0)
 499                 goto err;
 500
 501         return 0;
 502
 503 err:
 504         g_free(entry_return);
 505 err_head:
 506         g_free(entry_head);
 507
 508         return -ENOMEM;
 509 }
 510
 511 static struct ipt_entry *
 512 new_rule(struct connman_iptables *table,
 513                 char *target_name, struct xtables_target *xt_t,
 514                 char *match_name, struct xtables_match *xt_m)
 515 {
 516         struct ipt_entry *new_entry;
 517         size_t match_size, target_size;
 518         int is_builtin = is_builtin_target(target_name);
 519
 520         if (xt_m)
 521                 match_size = xt_m->m->u.match_size;
 522         else
 523                 match_size = 0;
 524
 525         if (xt_t)
 526                 target_size = ALIGN(xt_t->t->u.target_size);
 527         else
 528                 target_size = ALIGN(sizeof(struct xt_standard_target));
 529
 530         new_entry = g_try_malloc0(sizeof(struct ipt_entry) + target_size +
 531                                                                 match_size);
 532         if (new_entry == NULL)
 533                 return NULL;
 534
 535         new_entry->target_offset = sizeof(struct ipt_entry) + match_size;
 536         new_entry->next_offset = sizeof(struct ipt_entry) + target_size +
 537                                                                 match_size;
 538         if (xt_m) {
 539                 struct xt_entry_match *entry_match;
 540
 541                 entry_match = (struct xt_entry_match *)new_entry->elems;
 542                 memcpy(entry_match, xt_m->m, match_size);
 543         }
 544
 545         if (xt_t) {
 546                 struct xt_entry_target *entry_target;
 547
 548                 if (is_builtin) {
 549                         struct xt_standard_target *target;
 550
 551                         target = (struct xt_standard_target *)(xt_t->t);
 552                         strcpy(target->target.u.user.name, IPT_STANDARD_TARGET);
 553                         target->verdict = target_to_verdict(target_name);
 554                 }
 555
 556                 entry_target = ipt_get_target(new_entry);
 557                 memcpy(entry_target, xt_t->t, target_size);
 558         } else {
 559                 struct connman_iptables_entry *target_rule;
 560                 struct xt_standard_target *target;
 561                 GList *chain_head;
 562
 563                 /*
 564                  * This is a user defined target, i.e. a chain jump.
 565                  * We search for the chain head, and the target verdict
 566                  * is the first rule's offset on this chain.
 567                  * The offset is from the beginning of the table.
 568                  */
 569
 570                 chain_head = find_chain_head(table, target_name);
 571                 if (chain_head == NULL || chain_head->next == NULL) {
 572                         g_free(new_entry);
 573                         return NULL;
 574                 }
 575
 576                 target_rule = chain_head->next->data;
 577
 578                 target = (struct xt_standard_target *)ipt_get_target(new_entry);
 579                 strcpy(target->target.u.user.name, IPT_STANDARD_TARGET);
 580                 target->target.u.user.target_size = target_size;
 581                 target->verdict = target_rule->offset;
 582         }
 583
 584         return new_entry;
 585 }
 586
 587 static void update_hooks(struct connman_iptables *table, GList *chain_head, struct ipt_entry *entry)
 588 {
 589         GList *list;
 590         struct connman_iptables_entry *head, *e;
 591         int builtin;
 592
 593         if (chain_head == NULL)
 594                 return;
 595
 596         head = chain_head->data;
 597
 598         builtin = head->builtin;
 599         if (builtin < 0)
 600                 return;
 601
 602         table->underflow[builtin] += entry->next_offset;
 603
 604         for (list = chain_head->next; list; list = list->next) {
 605                 e = list->data;
 606
 607                 builtin = e->builtin;
 608                 if (builtin < 0)
 609                         continue;
 610
 611                 table->hook_entry[builtin] += entry->next_offset;
 612                 table->underflow[builtin] += entry->next_offset;
 613         }
 614 }
 615
 616 static int
 617 connman_iptables_add_rule(struct connman_iptables *table, char *chain_name,
 618                                 char *target_name, struct xtables_target *xt_t,
 619                                 char *match_name, struct xtables_match *xt_m)
 620 {
 621         GList *chain_tail, *chain_head;
 622         struct ipt_entry *new_entry;
 623         struct connman_iptables_entry *head;
 624         int builtin = -1;
 625
 626         chain_head = find_chain_head(table, chain_name);
 627         if (chain_head == NULL)
 628                 return -EINVAL;
 629
 630         chain_tail = find_chain_tail(table, chain_name);
 631         if (chain_tail == NULL)
 632                 return -EINVAL;
 633
 634         new_entry = new_rule(table,
 635                                 target_name, xt_t,
 636                                 match_name, xt_m);
 637         if (new_entry == NULL)
 638                 return -EINVAL;
 639
 640         update_hooks(table, chain_head, new_entry);
 641
 642         /*
 643          * If the chain is builtin, and does not have any rule,
 644          * then the one that we're inserting is becoming the head
 645          * and thus needs the builtin flag.
 646          */
 647         head = chain_head->data;
 648         if (head->builtin < 0)
 649                 builtin = -1;
 650         else if (chain_head == chain_tail->prev) {
 651                 builtin = head->builtin;
 652                 head->builtin = -1;
 653         }
 654
 655         return connman_add_entry(table, new_entry, chain_tail->prev, builtin);
 656 }
 657
 658 static struct ipt_replace *
 659 connman_iptables_blob(struct connman_iptables *table)
 660 {
 661         struct ipt_replace *r;
 662         GList *list;
 663         struct connman_iptables_entry *e;
 664         unsigned char *entry_index;
 665
 666         r = g_try_malloc0(sizeof(struct ipt_replace) + table->size);
 667         if (r == NULL)
 668                 return NULL;
 669
 670         memset(r, 0, sizeof(*r) + table->size);
 671
 672         r->counters = g_try_malloc0(sizeof(struct xt_counters)
 673                                 * table->old_entries);
 674         if (r->counters == NULL) {
 675                 g_free(r);
 676                 return NULL;
 677         }
 678
 679         strcpy(r->name, table->info->name);
 680         r->num_entries = table->num_entries;
 681         r->size = table->size;
 682
 683         r->num_counters = table->old_entries;
 684         r->valid_hooks  = table->info->valid_hooks;
 685
 686         memcpy(r->hook_entry, table->hook_entry, sizeof(table->hook_entry));
 687         memcpy(r->underflow, table->underflow, sizeof(table->underflow));
 688
 689         entry_index = (unsigned char *)r->entries;
 690         for (list = table->entries; list; list = list->next) {
 691                 e = list->data;
 692
 693                 memcpy(entry_index, e->entry, e->entry->next_offset);
 694                 entry_index += e->entry->next_offset;
 695         }
 696
 697         return r;
 698 }
 699
 700 static void dump_target(struct connman_iptables *table,
 701                                 struct ipt_entry *entry)
 702
 703 {
 704         struct xtables_target *xt_t;
 705         struct xt_entry_target *target;
 706
 707         target = ipt_get_target(entry);
 708
 709         if (!strcmp(target->u.user.name, IPT_STANDARD_TARGET)) {
 710                 struct xt_standard_target *t;
 711
 712                 t = (struct xt_standard_target *)target;
 713
 714                 switch (t->verdict) {
 715                 case XT_RETURN:
 716                         printf("\ttarget RETURN\n");
 717                         break;
 718
 719                 case -NF_ACCEPT - 1:
 720                         printf("\ttarget ACCEPT\n");
 721                         break;
 722
 723                 case -NF_DROP - 1:
 724                         printf("\ttarget DROP\n");
 725                         break;
 726
 727                 case -NF_QUEUE - 1:
 728                         printf("\ttarget QUEUE\n");
 729                         break;
 730
 731                 case -NF_STOP - 1:
 732                         printf("\ttarget STOP\n");
 733                         break;
 734
 735                 default:
 736                         printf("\tJUMP @%p (0x%x)\n",
 737                                 (char*)table->blob_entries->entrytable +
 738                                 t->verdict, t->verdict);
 739                         break;
 740                 }
 741
 742                 xt_t = xtables_find_target(IPT_STANDARD_TARGET,
 743                                                 XTF_LOAD_MUST_SUCCEED);
 744
 745                 if(xt_t->print != NULL)
 746                         xt_t->print(NULL, target, 1);
 747         } else {
 748                 xt_t = xtables_find_target(target->u.user.name, XTF_TRY_LOAD);
 749                 if (xt_t == NULL) {
 750                         printf("\ttarget %s\n", target->u.user.name);
 751                         return;
 752                 }
 753
 754                 if(xt_t->print != NULL) {
 755                         printf("\ttarget ");
 756                         xt_t->print(NULL, target, 1);
 757                         printf("\n");
 758                 }
 759         }
 760 }
 761
 762 static void dump_match(struct connman_iptables *table, struct ipt_entry *entry)
 763 {
 764         struct xtables_match *xt_m;
 765         struct xt_entry_match *match;
 766
 767         if (entry->elems == (unsigned char *)entry + entry->target_offset)
 768                 return;
 769
 770         match = (struct xt_entry_match *) entry->elems;
 771
 772         if (!strlen(match->u.user.name))
 773                 return;
 774
 775         xt_m = xtables_find_match(match->u.user.name, XTF_TRY_LOAD, NULL);
 776         if (xt_m == NULL)
 777                 goto out;
 778
 779         if(xt_m->print != NULL) {
 780                 printf("\tmatch ");
 781                 xt_m->print(NULL, match, 1);
 782                 printf("\n");
 783
 784                 return;
 785         }
 786
 787 out:
 788         printf("\tmatch %s\n", match->u.user.name);
 789
 790 }
 791
 792 static int connman_iptables_dump_entry(struct ipt_entry *entry,
 793                                         struct connman_iptables *table)
 794 {
 795         struct xt_entry_target *target;
 796         unsigned int offset;
 797         int builtin;
 798
 799         offset = (char *)entry - (char *)table->blob_entries->entrytable;
 800         target = ipt_get_target(entry);
 801         builtin = is_hook_entry(table, entry);
 802
 803         if (entry_to_offset(table, entry) + entry->next_offset ==
 804                                         table->blob_entries->size) {
 805                 printf("End of CHAIN 0x%x\n", offset);
 806                 return 0;
 807         }
 808
 809         if (!strcmp(target->u.user.name, IPT_ERROR_TARGET)) {
 810                 printf("USER CHAIN (%s) %p  match %p  target %p  size %d\n",
 811                         target->data, entry, entry->elems,
 812                         (char *)entry + entry->target_offset,
 813                                 entry->next_offset);
 814
 815                 return 0;
 816         } else if (builtin >= 0) {
 817                 printf("CHAIN (%s) %p  match %p  target %p  size %d\n",
 818                         hooknames[builtin], entry, entry->elems,
 819                         (char *)entry + entry->target_offset,
 820                                 entry->next_offset);
 821         } else {
 822                 printf("RULE %p  match %p  target %p  size %d\n", entry,
 823                         entry->elems,
 824                         (char *)entry + entry->target_offset,
 825                                 entry->next_offset);
 826         }
 827
 828         dump_match(table, entry);
 829         dump_target(table, entry);
 830
 831         return 0;
 832 }
 833
 834 static void connman_iptables_dump_hook(struct connman_iptables *table)
 835 {
 836         int i;
 837         printf("hooks: \n");
 838         for (i = 0; i < NF_INET_NUMHOOKS; i++) {
 839                 if ((table->info->valid_hooks & (1 << i)))
 840                         printf("%s entry %p underflow %p (%#x)\n",
 841                                 hooknames[i],
 842                                 table->blob_entries->entrytable +
 843                                                 table->info->hook_entry[i],
 844                                 table->blob_entries->entrytable +
 845                                                 table->info->underflow[i],
 846                                         table->info->underflow[i]);
 847         }
 848 }
 849
 850 static void connman_iptables_dump(struct connman_iptables *table)
 851 {
 852         printf("%s valid_hooks=0x%08x, num_entries=%u, size=%u\n",
 853                 table->info->name,
 854                 table->info->valid_hooks, table->info->num_entries,
 855                 table->info->size);
 856
 857         connman_iptables_dump_hook(table);
 858
 859         ENTRY_ITERATE(table->blob_entries->entrytable,
 860                         table->blob_entries->size,
 861                         connman_iptables_dump_entry, table);
 862
 863 }
 864
 865 static int connman_iptables_get_entries(struct connman_iptables *table)
 866 {
 867         socklen_t entry_size;
 868
 869         entry_size = sizeof(struct ipt_get_entries) + table->info->size;
 870
 871         return getsockopt(table->ipt_sock, IPPROTO_IP, IPT_SO_GET_ENTRIES,
 872                                 table->blob_entries, &entry_size);
 873 }
 874
 875 static int connman_iptables_replace(struct connman_iptables *table,
 876                                         struct ipt_replace *r)
 877 {
 878         return setsockopt(table->ipt_sock, IPPROTO_IP, IPT_SO_SET_REPLACE, r,
 879                          sizeof(*r) + r->size);
 880 }
 881
 882 static void connman_iptables_cleanup(struct connman_iptables *table)
 883 {
 884         GList *list;
 885         struct connman_iptables_entry *entry;
 886
 887         close(table->ipt_sock);
 888
 889         for (list = table->entries; list; list = list->next) {
 890                 entry = list->data;
 891
 892                 g_free(entry->entry);
 893         }
 894
 895         g_free(table->info);
 896         g_free(table->blob_entries);
 897         g_free(table);
 898
 899         xtables_free_opts(1);
 900 }
 901
 902 static int connman_iptables_commit(struct connman_iptables *table)
 903 {
 904         struct ipt_replace *repl;
 905
 906         repl = connman_iptables_blob(table);
 907
 908         return connman_iptables_replace(table, repl);
 909 }
 910
 911 static int add_entry(struct ipt_entry *entry, struct connman_iptables *table)
 912 {
 913         struct ipt_entry *new_entry;
 914         int builtin;
 915
 916         new_entry = g_try_malloc0(entry->next_offset);
 917         if (new_entry == NULL)
 918                 return -ENOMEM;
 919
 920         memcpy(new_entry, entry, entry->next_offset);
 921
 922         builtin = is_hook_entry(table, entry);
 923
 924         return connman_add_entry(table, new_entry, NULL, builtin);
 925 }
 926
 927 static struct connman_iptables *connman_iptables_init(const char *table_name)
 928 {
 929         struct connman_iptables *table;
 930         socklen_t s;
 931
 932         table =  g_try_new0(struct connman_iptables, 1);
 933         if (table == NULL)
 934                 return NULL;
 935
 936         table->info =  g_try_new0(struct ipt_getinfo, 1);
 937         if (table->info == NULL)
 938                 goto err;
 939
 940         table->ipt_sock = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
 941         if (table->ipt_sock < 0)
 942                 goto err;
 943
 944         s = sizeof(*table->info);
 945         strcpy(table->info->name, table_name);
 946         if (getsockopt(table->ipt_sock, IPPROTO_IP, IPT_SO_GET_INFO,
 947                                                 table->info, &s) < 0)
 948                 goto err;
 949
 950         table->blob_entries = g_try_malloc0(sizeof(struct ipt_get_entries) +
 951                                                 table->info->size);
 952         if (table->blob_entries == NULL)
 953                 goto err;
 954
 955         strcpy(table->blob_entries->name, table_name);
 956         table->blob_entries->size = table->info->size;
 957
 958         if (connman_iptables_get_entries(table) < 0)
 959                 goto err;
 960
 961         table->num_entries = 0;
 962         table->old_entries = table->info->num_entries;
 963         table->size = 0;
 964
 965         memcpy(table->underflow, table->info->underflow,
 966                                 sizeof(table->info->underflow));
 967         memcpy(table->hook_entry, table->info->hook_entry,
 968                                 sizeof(table->info->hook_entry));
 969
 970         ENTRY_ITERATE(table->blob_entries->entrytable,
 971                         table->blob_entries->size,
 972                                 add_entry, table);
 973
 974
 975         return table;
 976
 977 err:
 978
 979         connman_iptables_cleanup(table);
 980
 981         return NULL;
 982 }
 983
 984
 985 static struct option connman_iptables_opts[] = {
 986         {.name = "append",        .has_arg = 1, .val = 'A'},
 987         {.name = "flush-chain",   .has_arg = 1, .val = 'F'},
 988         {.name = "list",          .has_arg = 2, .val = 'L'},
 989         {.name = "new-chain",     .has_arg = 1, .val = 'N'},
 990         {.name = "delete-chain",  .has_arg = 1, .val = 'X'},
 991         {.name = "in-interface",  .has_arg = 1, .val = 'i'},
 992         {.name = "jump",          .has_arg = 1, .val = 'j'},
 993         {.name = "match",         .has_arg = 1, .val = 'm'},
 994         {.name = "out-interface", .has_arg = 1, .val = 'o'},
 995         {.name = "table",         .has_arg = 1, .val = 't'},
 996         {NULL},
 997 };
 998
 999 struct xtables_globals connman_iptables_globals = {
1000         .option_offset = 0,
1001         .opts = connman_iptables_opts,
1002         .orig_opts = connman_iptables_opts,
1003 };
1004
1005 int main(int argc, char *argv[])
1006 {
1007         struct connman_iptables *table;
1008         struct xtables_match *xt_m;
1009         struct xtables_target *xt_t;
1010         char *table_name, *chain, *new_chain, *match_name, *target_name;
1011         char *delete_chain, *flush_chain;
1012         int c;
1013         size_t size;
1014         gboolean dump, invert, delete;
1015
1016         xtables_init_all(&connman_iptables_globals, NFPROTO_IPV4);
1017
1018         dump = FALSE;
1019         invert = FALSE;
1020         delete = FALSE;
1021         table_name = chain = new_chain = match_name = target_name = NULL;
1022         delete_chain = flush_chain = NULL;
1023         table = NULL;
1024         xt_m = NULL;
1025         xt_t = NULL;
1026
1027         while ((c = getopt_long(argc, argv,
1028            "-A:F:L::N:X:j:i:m:o:t:", connman_iptables_globals.opts, NULL)) != -1) {
1029                 switch (c) {
1030                 case 'A':
1031                         chain = optarg;
1032                         break;
1033
1034                 case 'F':
1035                         flush_chain = optarg;
1036                         break;
1037
1038                 case 'L':
1039                         dump = true;
1040                         break;
1041
1042                 case 'N':
1043                         new_chain = optarg;
1044                         break;
1045
1046                 case 'X':
1047                         delete = true;
1048                         delete_chain = optarg;
1049                         break;
1050
1051                 case 'j':
1052                         target_name = optarg;
1053                         xt_t = xtables_find_target(target_name, XTF_TRY_LOAD);
1054
1055                         if (xt_t == NULL)
1056                                 break;
1057
1058                         size = ALIGN(sizeof(struct ipt_entry_target)) + xt_t->size;
1059
1060                         xt_t->t = g_try_malloc0(size);
1061                         if (xt_t->t == NULL)
1062                                 goto out;
1063                         xt_t->t->u.target_size = size;
1064                         strcpy(xt_t->t->u.user.name, target_name);
1065                         xt_t->t->u.user.revision = xt_t->revision;
1066                         if (xt_t->init != NULL)
1067                                 xt_t->init(xt_t->t);
1068                         connman_iptables_globals.opts =
1069                                 xtables_merge_options(
1070 #if XTABLES_VERSION_CODE > 5
1071                                                      connman_iptables_globals.orig_opts,
1072 #endif
1073                                                      connman_iptables_globals.opts,
1074                                                      xt_t->extra_opts,
1075                                                      &xt_t->option_offset);
1076                         if (connman_iptables_globals.opts == NULL)
1077                                 goto out;
1078
1079                         break;
1080
1081                 case 'i':
1082                         break;
1083
1084                 case 'm':
1085                         match_name = optarg;
1086
1087                         xt_m = xtables_find_match(optarg, XTF_LOAD_MUST_SUCCEED, NULL);
1088                         size = ALIGN(sizeof(struct ipt_entry_match)) + xt_m->size;
1089                         xt_m->m = g_try_malloc0(size);
1090                         if (xt_m == NULL)
1091                                 goto out;
1092                         xt_m->m->u.match_size = size;
1093                         strcpy(xt_m->m->u.user.name, xt_m->name);
1094                         xt_m->m->u.user.revision = xt_m->revision;
1095                         if (xt_m->init != NULL)
1096                                 xt_m->init(xt_m->m);
1097                         if (xt_m != xt_m->next) {
1098                                 connman_iptables_globals.opts =
1099                                         xtables_merge_options(
1100 #if XTABLES_VERSION_CODE > 5
1101                                                 connman_iptables_globals.orig_opts,
1102 #endif
1103                                                 connman_iptables_globals.opts,
1104                                                 xt_m->extra_opts,
1105                                                 &xt_m->option_offset);
1106                                 if (connman_iptables_globals.opts == NULL)
1107                                         goto out;
1108                         }
1109
1110                         break;
1111
1112                 case 'o':
1113                         break;
1114
1115                 case 't':
1116                         table_name = optarg;
1117                         break;
1118
1119                 case 1:
1120                         if (optarg[0] == '!' && optarg[1] == '\0') {
1121                                 if (invert)
1122                                         printf("Consecutive ! not allowed\n");
1123
1124                                 invert = TRUE;
1125                                 optarg[0] = '\0';
1126                                 continue;
1127                         }
1128
1129                         printf("Invalid option\n");
1130
1131                         return -1;
1132
1133                 default:
1134                         if (xt_t == NULL || xt_t->parse == NULL ||
1135                             !xt_t->parse(c - xt_t->option_offset, argv, invert,
1136                                         &xt_t->tflags, NULL, &xt_t->t)) {
1137                                 if (xt_m == NULL || xt_m->parse == NULL)
1138                                         break;
1139
1140                                 xt_m->parse(c - xt_m->option_offset, argv,
1141                                         invert, &xt_m->mflags, NULL, &xt_m->m);
1142                         }
1143
1144                         break;
1145                 }
1146         }
1147
1148         if (table_name == NULL)
1149                 table_name = "filter";
1150
1151         table = connman_iptables_init(table_name);
1152         if (table == NULL)
1153                 return -1;
1154
1155         if (delete) {
1156                 if (delete_chain == NULL)
1157                         goto out;
1158
1159                 printf("Delete chain %s\n", delete_chain);
1160
1161                 connman_iptables_delete_chain(table, delete_chain);
1162
1163                 goto commit;
1164         }
1165
1166         if (flush_chain) {
1167                 printf("Flush chain %s\n", flush_chain);
1168
1169                 connman_iptables_flush_chain(table, flush_chain);
1170
1171                 goto commit;
1172         }
1173
1174         if (dump) {
1175                 connman_iptables_dump(table);
1176
1177                 return 0;
1178         }
1179
1180         if (chain && new_chain)
1181                 return -1;
1182
1183         if (new_chain) {
1184                 printf("New chain %s\n", new_chain);
1185
1186                 connman_iptables_add_chain(table, new_chain);
1187
1188                 goto commit;
1189         }
1190
1191         if (chain) {
1192                 if (target_name == NULL)
1193                         return -1;
1194
1195                 printf("Adding %s to %s (match %s)\n", target_name, chain, match_name);
1196
1197                 connman_iptables_add_rule(table, chain, target_name, xt_t,
1198                                         match_name, xt_m);
1199
1200                 goto commit;
1201         }
1202
1203 commit:
1204
1205         connman_iptables_commit(table);
1206
1207 out:
1208         connman_iptables_cleanup(table);
1209
1210         if (xt_t)
1211                 g_free(xt_t->t);
1212
1213         if (xt_m)
1214                 g_free(xt_m->m);
1215
1216         return 0;
1217 }