X-Git-Url: http://review.tizen.org/git/?a=blobdiff_plain;f=src%2Fiptables.c;h=2ee9485ac879339d46906e58dacf050cf061de88;hb=a424f79696a666ac27812d23af170552e760309d;hp=3ae8417800d0bd46f5534fcfa46246bbdac33842;hpb=a235ce6ae6276cf69932b4f5f9994617f08baa1f;p=platform%2Fupstream%2Fconnman.git diff --git a/src/iptables.c b/src/iptables.c old mode 100644 new mode 100755 index 3ae8417..2ee9485 --- a/src/iptables.c +++ b/src/iptables.c @@ -2,7 +2,7 @@ * * Connection Manager * - * Copyright (C) 2007-2012 Intel Corporation. All rights reserved. + * Copyright (C) 2007-2013 Intel Corporation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 as @@ -28,15 +28,17 @@ #include #include #include -#include +#include #include #include +#include +#include #include +#include #include "connman.h" - -void flush_table(const char *name); +#include "src/shared/util.h" /* * Some comments on how the iptables API works (some of them from the @@ -60,7 +62,7 @@ void flush_table(const char *name); * - ipt_entry->target_offset = Size of ipt_entry + matches * - ipt_entry->next_offset = Size of ipt_entry + matches + target * - IPT_SO_SET_REPLACE is used to write a table (contains the complete - * - hook_entry and overflow mark the begining and the end of a chain, e.g + * - hook_entry and overflow mark the beginning and the end of a chain, e.g * entry hook: pre/in/fwd/out/post -1/0/352/504/-1 * underflow: pre/in/fwd/out/post -1/200/352/904/-1 * means that INPUT starts at offset 0 and ends at 200 (the start offset to @@ -128,6 +130,10 @@ void flush_table(const char *name); * End of CHAIN */ +/* + * Values for the index values used here are defined as equal for both IPv4 + * and IPv6 (NF_IP_* and NF_IP6_*) in Netfilter headers. + */ static const char *hooknames[] = { [NF_IP_PRE_ROUTING] = "PREROUTING", [NF_IP_LOCAL_IN] = "INPUT", @@ -143,27 +149,25 @@ static const char *hooknames[] = { #define XT_OPTION_OFFSET_SCALE 256 -#define MIN_ALIGN (__alignof__(struct ipt_entry)) - -#define ALIGN(s) (((s) + ((MIN_ALIGN)-1)) & ~((MIN_ALIGN)-1)) - -struct error_target { - struct xt_entry_target t; - char error[IPT_TABLE_MAXNAMELEN]; -}; - struct connman_iptables_entry { - int offset; + int type; + unsigned int offset; int builtin; + int counter_idx; struct ipt_entry *entry; + struct ip6t_entry *entry6; }; struct connman_iptables { + int type; + char *name; int ipt_sock; struct ipt_getinfo *info; struct ipt_get_entries *blob_entries; + struct ip6t_getinfo *info6; + struct ip6t_get_entries *blob_entries6; unsigned int num_entries; unsigned int old_entries; @@ -176,11 +180,307 @@ struct connman_iptables { }; static GHashTable *table_hash = NULL; -static gboolean debug_enabled = FALSE; +static GHashTable *table_hash_ipv6 = NULL; +static bool debug_enabled = false; + +struct iptables_ip { + int type; + struct ipt_ip *ip; + struct ip6t_ip6 *ip6; +}; + +struct iptables_replace { + int type; + struct ipt_replace *r; + struct ip6t_replace *r6; +}; + +static jmp_buf env_state; +static bool jmp_set = false; + +static void enable_jmp() +{ + jmp_set = true; +} + +static void disable_jmp() +{ + jmp_set = false; +} + +static bool can_jmp() +{ + DBG("%s", jmp_set ? "true" : "false"); + return jmp_set; +} + +typedef int (*iterate_entries_cb_t)(struct connman_iptables_entry *entry, + int builtin, unsigned int hook, + size_t size, unsigned int offset, + void *user_data); + +static u_int16_t iptables_entry_get_next_offset( + struct connman_iptables_entry *entry) +{ + if (!entry) + return 0; + + switch (entry->type) { + case AF_INET: + return entry->entry ? entry->entry->next_offset : 0; + case AF_INET6: + return entry->entry6 ? entry->entry6->next_offset : 0; + } + + return 0; +} + +static u_int16_t iptables_entry_get_target_offset( + struct connman_iptables_entry *entry) +{ + if (!entry) + return 0; + + switch (entry->type) { + case AF_INET: + return entry->entry ? entry->entry->target_offset : 0; + case AF_INET6: + return entry->entry6 ? entry->entry6->target_offset : 0; + } + + return 0; +} + +static unsigned char *iptables_entry_get_elems( + struct connman_iptables_entry *entry) +{ + if (!entry) + return NULL; + + switch (entry->type) { + case AF_INET: + return entry->entry ? entry->entry->elems : NULL; + case AF_INET6: + return entry->entry6 ? entry->entry6->elems : NULL; + } + + return NULL; +} + +static struct xt_entry_target *iptables_entry_get_target( + struct connman_iptables_entry *entry) +{ + if (!entry) + return NULL; + + switch (entry->type) { + case AF_INET: + return entry->entry ? ipt_get_target(entry->entry) : NULL; + case AF_INET6: + return entry->entry6 ? ip6t_get_target(entry->entry6) : NULL; + } + + return NULL; +} + +static struct xt_counters *iptables_entry_get_counters( + struct connman_iptables_entry *entry) +{ + if (!entry) + return NULL; + + switch (entry->type) { + case AF_INET: + return entry->entry ? &entry->entry->counters : NULL; + case AF_INET6: + return entry->entry6 ? &entry->entry6->counters : NULL; + } + + return NULL; +} + +static void iptables_entry_free(struct connman_iptables_entry *entry) +{ + if (!entry) + return; + + g_free(entry->entry); + g_free(entry->entry6); + g_free(entry); +} + +static const char *iptables_table_get_info_name(struct connman_iptables* table) +{ + if (!table) + return NULL; + + switch (table->type) { + case AF_INET: + return table->info->name; + case AF_INET6: + return table->info6->name; + } + + return NULL; +} + +static unsigned int iptables_table_get_info_num_entries( + struct connman_iptables* table) +{ + if (!table) + return 0; + + switch (table->type) { + case AF_INET: + return table->info->num_entries; + case AF_INET6: + return table->info6->num_entries; + } + + return 0; +} + +static unsigned int iptables_table_get_info_size(struct connman_iptables* table) +{ + if (!table) + return 0; + + switch (table->type) { + case AF_INET: + return table->info->size; + case AF_INET6: + return table->info6->size; + } + + return 0; +} + +static unsigned int iptables_table_get_info_valid_hooks( + struct connman_iptables* table) +{ + if (!table) + return 0; + + switch (table->type) { + case AF_INET: + return table->info->valid_hooks; + case AF_INET6: + return table->info6->valid_hooks; + } + + return 0; +} + +static unsigned int *iptables_table_get_info_hook_entry( + struct connman_iptables* table) +{ + if (!table) + return NULL; + + switch (table->type) { + case AF_INET: + return table->info->hook_entry; + case AF_INET6: + return table->info6->hook_entry; + } + + return NULL; +} + +static unsigned int *iptables_table_get_info_underflow( + struct connman_iptables* table) +{ + if (!table) + return NULL; + + switch (table->type) { + case AF_INET: + return table->info->underflow; + case AF_INET6: + return table->info6->underflow; + } + + return NULL; +} + +static unsigned int iptables_table_get_entries_size( + struct connman_iptables* table) +{ + if (!table) + return 0; + + switch (table->type) { + case AF_INET: + return table->blob_entries->size; + case AF_INET6: + return table->blob_entries6->size; + } + + return 0; +} + +static const char *get_error_target(int type) +{ + switch (type) { + case AF_INET: + return IPT_ERROR_TARGET; + case AF_INET6: + return IP6T_ERROR_TARGET; + default: + return XT_ERROR_TARGET; + } +} + +static const char *get_standard_target(int type) +{ + switch (type) { + case AF_INET: + return IPT_STANDARD_TARGET; + case AF_INET6: + return IP6T_STANDARD_TARGET; + default: + return XT_STANDARD_TARGET; + } +} + +static struct connman_iptables *hash_table_lookup(int type, + const char *table_name) { + + switch (type) { + case AF_INET: + return g_hash_table_lookup(table_hash, table_name); + case AF_INET6: + return g_hash_table_lookup(table_hash_ipv6, table_name); + } + + return NULL; +} + +static bool hash_table_replace(int type, + char *table_name, + struct connman_iptables *table) { -typedef int (*iterate_entries_cb_t)(struct ipt_entry *entry, int builtin, - unsigned int hook,size_t size, - unsigned int offset, void *user_data); + switch (type) { + case AF_INET: + return g_hash_table_replace(table_hash, table_name, table); + case AF_INET6: + return g_hash_table_replace(table_hash_ipv6, table_name, table); + } + + return false; +} + +static bool hash_table_remove(int type, const char *table_name) +{ + switch (type) { + case AF_INET: + return g_hash_table_remove(table_hash, table_name); + case AF_INET6: + return g_hash_table_remove(table_hash_ipv6, table_name); + } + + return false; +} static unsigned int next_hook_entry_index(unsigned int *valid_hooks) { @@ -195,7 +495,7 @@ static unsigned int next_hook_entry_index(unsigned int *valid_hooks) return h; } -static int iterate_entries(struct ipt_entry *entries, +static int iterate_entries(struct connman_iptables_entry *entries, unsigned int valid_hooks, unsigned int *hook_entry, unsigned int *underflow, @@ -204,15 +504,45 @@ static int iterate_entries(struct ipt_entry *entries, { unsigned int offset, h, hook; int builtin, err; - struct ipt_entry *entry; + struct connman_iptables_entry entry; + + if (!entries) + return -EINVAL; + + switch (entries->type) { + case AF_INET: + if (!entries->entry) + return -EINVAL; + + break; + case AF_INET6: + if (!entries->entry6) + return -EINVAL; + + break; + default: + return -EINVAL; + } h = next_hook_entry_index(&valid_hooks); hook = h; - for (offset = 0, entry = entries; offset < size; - offset += entry->next_offset) { + entry.type = entries->type; + entry.entry = entries->entry; + entry.entry6 = entries->entry6; + + for (offset = 0; offset < size; + offset += iptables_entry_get_next_offset(&entry)) { builtin = -1; - entry = (void *)entries + offset; + + switch (entries->type) { + case AF_INET: + entry.entry = (void* )entries->entry + offset; + break; + case AF_INET6: + entry.entry6 = (void* )entries->entry6 + offset; + break; + } /* * Updating builtin, hook and h is very tricky. @@ -234,11 +564,10 @@ static int iterate_entries(struct ipt_entry *entries, if (h == NF_INET_NUMHOOKS) hook = h; - if (h < NF_INET_NUMHOOKS && underflow[h] <= offset) { + if (h < NF_INET_NUMHOOKS && underflow[h] <= offset) h = next_hook_entry_index(&valid_hooks); - } - err = cb(entry, builtin, hook, size, offset, user_data); + err = cb(&entry, builtin, hook, size, offset, user_data); if (err < 0) return err; } @@ -246,53 +575,62 @@ static int iterate_entries(struct ipt_entry *entries, return 0; } -static int print_entry(struct ipt_entry *entry, int builtin, unsigned int hook, - size_t size, unsigned int offset, - void *user_data) +static int print_entry(struct connman_iptables_entry *entry, int builtin, + unsigned int hook, size_t size, + unsigned int offset, void *user_data) { - iterate_entries_cb_t cb = user_data; + iterate_entries_cb_t cb; + struct xt_counters *counters; + + cb = user_data; + counters = iptables_entry_get_counters(entry); - DBG("entry %p hook %d offset %d size %d", entry, hook, - offset, entry->next_offset); + DBG("entry %p hook %u offset %u size %u packets %"PRIu64" " + "bytes %"PRIu64, entry, hook, offset, + iptables_entry_get_next_offset(entry), + (uint64_t) counters->pcnt, (uint64_t) counters->bcnt); return cb(entry, builtin, hook, size, offset, NULL); } static int target_to_verdict(const char *target_name) { - if (!strcmp(target_name, LABEL_ACCEPT)) + if (!g_strcmp0(target_name, LABEL_ACCEPT)) return -NF_ACCEPT - 1; - if (!strcmp(target_name, LABEL_DROP)) + if (!g_strcmp0(target_name, LABEL_DROP)) return -NF_DROP - 1; - if (!strcmp(target_name, LABEL_QUEUE)) + if (!g_strcmp0(target_name, LABEL_QUEUE)) return -NF_QUEUE - 1; - if (!strcmp(target_name, LABEL_RETURN)) + if (!g_strcmp0(target_name, LABEL_RETURN)) return XT_RETURN; return 0; } -static gboolean is_builtin_target(const char *target_name) +static bool is_builtin_target(const char *target_name) { - if (!strcmp(target_name, LABEL_ACCEPT) || - !strcmp(target_name, LABEL_DROP) || - !strcmp(target_name, LABEL_QUEUE) || - !strcmp(target_name, LABEL_RETURN)) - return TRUE; + if (!g_strcmp0(target_name, LABEL_ACCEPT) || + !g_strcmp0(target_name, LABEL_DROP) || + !g_strcmp0(target_name, LABEL_QUEUE) || + !g_strcmp0(target_name, LABEL_RETURN)) + return true; - return FALSE; + return false; } -static gboolean is_jump(struct connman_iptables_entry *e) +static bool is_jump(struct connman_iptables_entry *e) { struct xt_entry_target *target; - target = ipt_get_target(e->entry); + target = iptables_entry_get_target(e); + + if (!target) + return false; - if (!strcmp(target->u.user.name, IPT_STANDARD_TARGET)) { + if (!g_strcmp0(target->u.user.name, get_standard_target(e->type))) { struct xt_standard_target *t; t = (struct xt_standard_target *)target; @@ -313,12 +651,16 @@ static gboolean is_jump(struct connman_iptables_entry *e) return false; } -static gboolean is_fallthrough(struct connman_iptables_entry *e) +static bool is_fallthrough(struct connman_iptables_entry *e) { struct xt_entry_target *target; - target = ipt_get_target(e->entry); - if (!g_strcmp0(target->u.user.name, IPT_STANDARD_TARGET)) { + target = iptables_entry_get_target(e); + + if (!target) + return false; + + if (!g_strcmp0(target->u.user.name, get_standard_target(e->type))) { struct xt_standard_target *t; t = (struct xt_standard_target *)target; @@ -328,21 +670,26 @@ static gboolean is_fallthrough(struct connman_iptables_entry *e) return false; } -static gboolean is_chain(struct connman_iptables *table, +static bool is_chain(struct connman_iptables *table, struct connman_iptables_entry *e) { - struct ipt_entry *entry; struct xt_entry_target *target; - entry = e->entry; + if (!e) + return false; + if (e->builtin >= 0) - return TRUE; + return true; + + target = iptables_entry_get_target(e); + + if (!target) + return false; - target = ipt_get_target(entry); - if (!strcmp(target->u.user.name, IPT_ERROR_TARGET)) - return TRUE; + if (!g_strcmp0(target->u.user.name, get_error_target(e->type))) + return true; - return FALSE; + return false; } static GList *find_chain_head(struct connman_iptables *table, @@ -350,23 +697,35 @@ static GList *find_chain_head(struct connman_iptables *table, { GList *list; struct connman_iptables_entry *head; - struct ipt_entry *entry; struct xt_entry_target *target; int builtin; + switch (table->type) { + case AF_INET: + case AF_INET6: + break; + default: + return NULL; + } + for (list = table->entries; list; list = list->next) { head = list->data; - entry = head->entry; /* Buit-in chain */ builtin = head->builtin; - if (builtin >= 0 && !strcmp(hooknames[builtin], chain_name)) + + if (builtin >= 0 && !g_strcmp0(hooknames[builtin], chain_name)) break; /* User defined chain */ - target = ipt_get_target(entry); - if (!strcmp(target->u.user.name, IPT_ERROR_TARGET) && - !strcmp((char *)target->data, chain_name)) + target = iptables_entry_get_target(head); + + if (!target) + continue; + + if (!g_strcmp0(target->u.user.name, + get_error_target(table->type)) && + !g_strcmp0((char *)target->data, chain_name)) break; } @@ -380,7 +739,7 @@ static GList *find_chain_tail(struct connman_iptables *table, GList *chain_head, *list; chain_head = find_chain_head(table, chain_name); - if (chain_head == NULL) + if (!chain_head) return NULL; /* Then we look for the next chain */ @@ -395,7 +754,6 @@ static GList *find_chain_tail(struct connman_iptables *table, return g_list_last(table->entries); } - static void update_offsets(struct connman_iptables *table) { GList *list, *prev; @@ -414,21 +772,22 @@ static void update_offsets(struct connman_iptables *table) prev_entry = prev->data; entry->offset = prev_entry->offset + - prev_entry->entry->next_offset; + iptables_entry_get_next_offset( + prev_entry); } } static void update_targets_reference(struct connman_iptables *table, struct connman_iptables_entry *entry_before, struct connman_iptables_entry *modified_entry, - gboolean is_removing) + bool is_removing) { struct connman_iptables_entry *tmp; struct xt_standard_target *t; GList *list; - int offset; + unsigned int offset; - offset = modified_entry->entry->next_offset; + offset = iptables_entry_get_next_offset(modified_entry); for (list = table->entries; list; list = list->next) { tmp = list->data; @@ -436,9 +795,13 @@ static void update_targets_reference(struct connman_iptables *table, if (!is_jump(tmp)) continue; - t = (struct xt_standard_target *)ipt_get_target(tmp->entry); + t = (struct xt_standard_target *) + iptables_entry_get_target(tmp); + + if (!t) + continue; - if (is_removing == TRUE) { + if (is_removing) { if (t->verdict >= entry_before->offset) t->verdict -= offset; } else { @@ -448,49 +811,67 @@ static void update_targets_reference(struct connman_iptables *table, } if (is_fallthrough(modified_entry)) { - t = (struct xt_standard_target *) ipt_get_target(modified_entry->entry); + t = (struct xt_standard_target *) + iptables_entry_get_target(modified_entry); + + if (!t) + return; t->verdict = entry_before->offset + - modified_entry->entry->target_offset + - ALIGN(sizeof(struct xt_standard_target)); + iptables_entry_get_target_offset(modified_entry) + + XT_ALIGN(sizeof(struct xt_standard_target)); t->target.u.target_size = - ALIGN(sizeof(struct xt_standard_target)); + XT_ALIGN(sizeof(struct xt_standard_target)); } } static int iptables_add_entry(struct connman_iptables *table, - struct ipt_entry *entry, GList *before, - int builtin) + struct connman_iptables_entry *entry, + GList *before, int builtin, int counter_idx) { struct connman_iptables_entry *e, *entry_before; - if (table == NULL) - return -1; + if (!table) { + return -EINVAL; + } e = g_try_malloc0(sizeof(struct connman_iptables_entry)); - if (e == NULL) - return -1; + if (!e) + return -ENOMEM; - e->entry = entry; + switch (table->type) { + case AF_INET: + e->entry = entry->entry; + break; + case AF_INET6: + e->entry6 = entry->entry6; + break; + default: + g_free(e); + return -EINVAL; + } + + e->type = entry->type; e->builtin = builtin; + e->counter_idx = counter_idx; table->entries = g_list_insert_before(table->entries, before, e); table->num_entries++; - table->size += entry->next_offset; - - if (before == NULL) { - e->offset = table->size - entry->next_offset; + table->size += iptables_entry_get_next_offset(e); + if (!before) { + e->offset = table->size - + iptables_entry_get_next_offset(e); return 0; } entry_before = before->data; /* - * We've just appended/insterted a new entry. All references + * We've just appended/inserted a new entry. All references * should be bumped accordingly. */ - update_targets_reference(table, entry_before, e, FALSE); + update_targets_reference(table, entry_before, e, false); update_offsets(table); @@ -501,19 +882,44 @@ static int remove_table_entry(struct connman_iptables *table, struct connman_iptables_entry *entry) { int removed = 0; + u_int16_t next_offset; + next_offset = iptables_entry_get_next_offset(entry); table->num_entries--; - table->size -= entry->entry->next_offset; - removed = entry->entry->next_offset; + + table->size -= next_offset; + removed = next_offset; table->entries = g_list_remove(table->entries, entry); - g_free(entry->entry); - g_free(entry); + iptables_entry_free(entry); return removed; } +static void delete_update_hooks(struct connman_iptables *table, + int builtin, GList *chain_head, + int removed) +{ + struct connman_iptables_entry *e; + GList *list; + + e = chain_head->data; + e->builtin = builtin; + + table->underflow[builtin] -= removed; + + for (list = chain_head->next; list; list = list->next) { + e = list->data; + + if (e->builtin < 0) + continue; + + table->hook_entry[e->builtin] -= removed; + table->underflow[e->builtin] -= removed; + } +} + static int iptables_flush_chain(struct connman_iptables *table, const char *name) { @@ -521,12 +927,14 @@ static int iptables_flush_chain(struct connman_iptables *table, struct connman_iptables_entry *entry; int builtin, removed = 0; + DBG("table %s chain %s", table->name, name); + chain_head = find_chain_head(table, name); - if (chain_head == NULL) + if (!chain_head) return -EINVAL; chain_tail = find_chain_tail(table, name); - if (chain_tail == NULL) + if (!chain_tail) return -EINVAL; entry = chain_head->data; @@ -549,26 +957,8 @@ static int iptables_flush_chain(struct connman_iptables *table, list = next; } - if (builtin >= 0) { - struct connman_iptables_entry *e; - - entry = list->data; - - entry->builtin = builtin; - - table->underflow[builtin] -= removed; - - for (list = chain_tail; list; list = list->next) { - e = list->data; - - builtin = e->builtin; - if (builtin < 0) - continue; - - table->hook_entry[builtin] -= removed; - table->underflow[builtin] -= removed; - } - } + if (builtin >= 0) + delete_update_hooks(table, builtin, chain_tail->prev, removed); update_offsets(table); @@ -579,14 +969,30 @@ static int iptables_add_chain(struct connman_iptables *table, const char *name) { GList *last; - struct ipt_entry *entry_head; - struct ipt_entry *entry_return; - struct error_target *error; - struct ipt_standard_target *standard; + struct ipt_entry *entry_head = NULL; + struct ipt_entry *entry_return = NULL; + struct ip6t_entry *entry6_head = NULL; + struct ip6t_entry *entry6_return = NULL; + struct connman_iptables_entry entry = { 0 }; + struct xt_error_target *error = NULL; + struct ipt_standard_target *standard = NULL; u_int16_t entry_head_size, entry_return_size; + size_t entry_struct_size = 0; + size_t xt_error_target_size = 0; + size_t standard_target_size = 0; + + DBG("table %s chain %s", table->name, name); + + entry.type = table->type; + + /* Do not allow to add duplicate chains */ + if (find_chain_head(table, name)) + return -EEXIST; last = g_list_last(table->entries); + xt_error_target_size = XT_ALIGN(sizeof(struct xt_error_target)); + /* * An empty chain is composed of: * - A head entry, with no match and an error target. @@ -597,51 +1003,93 @@ static int iptables_add_chain(struct connman_iptables *table, */ /* head entry */ - entry_head_size = sizeof(struct ipt_entry) + - sizeof(struct error_target); - entry_head = g_try_malloc0(entry_head_size); - if (entry_head == NULL) - goto err_head; + switch (entry.type) { + case AF_INET: + entry_struct_size = XT_ALIGN(sizeof(struct ipt_entry)); + entry_head_size = entry_struct_size + xt_error_target_size; - memset(entry_head, 0, entry_head_size); + entry_head = g_try_malloc0(entry_head_size); + if (!entry_head) + goto err_head; - entry_head->target_offset = sizeof(struct ipt_entry); - entry_head->next_offset = entry_head_size; + entry_head->target_offset = entry_struct_size; + entry_head->next_offset = entry_head_size; - error = (struct error_target *) entry_head->elems; - strcpy(error->t.u.user.name, IPT_ERROR_TARGET); - error->t.u.user.target_size = ALIGN(sizeof(struct error_target)); - strcpy(error->error, name); + error = (struct xt_error_target *) entry_head->elems; - if (iptables_add_entry(table, entry_head, last, -1) < 0) - goto err_head; + entry.entry = entry_head; + break; + case AF_INET6: + entry_struct_size = XT_ALIGN(sizeof(struct ip6t_entry)); + entry_head_size = entry_struct_size + xt_error_target_size; - /* tail entry */ - entry_return_size = sizeof(struct ipt_entry) + - sizeof(struct ipt_standard_target); - entry_return = g_try_malloc0(entry_return_size); - if (entry_return == NULL) - goto err; + entry6_head = g_try_malloc0(entry_head_size); + if (!entry6_head) + goto err_head; - memset(entry_return, 0, entry_return_size); + entry6_head->target_offset = entry_struct_size; + entry6_head->next_offset = entry_head_size; - entry_return->target_offset = sizeof(struct ipt_entry); - entry_return->next_offset = entry_return_size; + error = (struct xt_error_target *) entry6_head->elems; - standard = (struct ipt_standard_target *) entry_return->elems; - standard->target.u.user.target_size = - ALIGN(sizeof(struct ipt_standard_target)); - standard->verdict = XT_RETURN; + entry.entry6 = entry6_head; + break; + default: + return -EINVAL; + } - if (iptables_add_entry(table, entry_return, last, -1) < 0) - goto err; + g_stpcpy(error->target.u.user.name, get_error_target(entry.type)); + error->target.u.user.target_size = xt_error_target_size; + g_stpcpy(error->errorname, name); - return 0; + if (iptables_add_entry(table, &entry, last, -1, -1) < 0) + goto err_head; -err: - g_free(entry_return); -err_head: + standard_target_size = XT_ALIGN(sizeof(struct ipt_standard_target)); + entry_return_size = entry_struct_size + standard_target_size; + + /* tail entry */ + switch (entry.type) { + case AF_INET: + entry_return = g_try_malloc0(entry_return_size); + if (!entry_return) + goto err; + + entry_return->target_offset = entry_struct_size; + entry_return->next_offset = entry_return_size; + + standard = (struct ipt_standard_target *) entry_return->elems; + + entry.entry = entry_return; + break; + case AF_INET6: + entry6_return = g_try_malloc0(entry_return_size); + if (!entry6_return) + goto err; + + entry6_return->target_offset = entry_struct_size; + entry6_return->next_offset = entry_return_size; + + standard = (struct ipt_standard_target *) entry6_return->elems; + + entry.entry6 = entry6_return; + break; + } + + standard->target.u.user.target_size = standard_target_size; + standard->verdict = XT_RETURN; + + if (iptables_add_entry(table, &entry, last, -1, -1) < 0) + goto err; + + return 0; + +err: + g_free(entry_return); + g_free(entry6_return); +err_head: g_free(entry_head); + g_free(entry6_head); return -ENOMEM; } @@ -652,8 +1100,10 @@ static int iptables_delete_chain(struct connman_iptables *table, struct connman_iptables_entry *entry; GList *chain_head, *chain_tail; + DBG("table %s chain %s", table->name, name); + chain_head = find_chain_head(table, name); - if (chain_head == NULL) + if (!chain_head) return -EINVAL; entry = chain_head->data; @@ -663,7 +1113,7 @@ static int iptables_delete_chain(struct connman_iptables *table, return -EINVAL; chain_tail = find_chain_tail(table, name); - if (chain_tail == NULL) + if (!chain_tail) return -EINVAL; /* Chain must be flushed */ @@ -680,60 +1130,111 @@ static int iptables_delete_chain(struct connman_iptables *table, return 0; } -static struct ipt_entry *new_rule(struct ipt_ip *ip, +static struct connman_iptables_entry *new_rule(struct iptables_ip *ip, const char *target_name, struct xtables_target *xt_t, struct xtables_rule_match *xt_rm) { struct xtables_rule_match *tmp_xt_rm; - struct ipt_entry *new_entry; + struct connman_iptables_entry *new_entry; size_t match_size, target_size; + new_entry = g_try_malloc0(sizeof(struct connman_iptables_entry)); + + if (!new_entry) + return NULL; + + new_entry->type = ip->type; + match_size = 0; - for (tmp_xt_rm = xt_rm; tmp_xt_rm != NULL; tmp_xt_rm = tmp_xt_rm->next) + for (tmp_xt_rm = xt_rm; tmp_xt_rm; tmp_xt_rm = tmp_xt_rm->next) match_size += tmp_xt_rm->match->m->u.match_size; if (xt_t) - target_size = ALIGN(xt_t->t->u.target_size); + target_size = xt_t->t->u.target_size; else - target_size = ALIGN(sizeof(struct xt_standard_target)); - - new_entry = g_try_malloc0(sizeof(struct ipt_entry) + target_size + - match_size); - if (new_entry == NULL) - return NULL; - - memcpy(&new_entry->ip, ip, sizeof(struct ipt_ip)); - - new_entry->target_offset = sizeof(struct ipt_entry) + match_size; - new_entry->next_offset = sizeof(struct ipt_entry) + target_size + - match_size; + target_size = XT_ALIGN(sizeof(struct xt_standard_target)); + + switch (ip->type) { + case AF_INET: + new_entry->entry = g_try_malloc0( + XT_ALIGN(sizeof(struct ipt_entry)) + + target_size + match_size); + if (!new_entry->entry) + goto err; + + memcpy(&new_entry->entry->ip, ip->ip, sizeof(struct ipt_ip)); + + new_entry->entry->target_offset = + XT_ALIGN(sizeof(struct ipt_entry)) + + match_size; + new_entry->entry->next_offset = + XT_ALIGN(sizeof(struct ipt_entry)) + + target_size + match_size; + break; + case AF_INET6: + new_entry->entry6 = g_try_malloc0( + XT_ALIGN(sizeof(struct ip6t_entry)) + + target_size + match_size); + if (!new_entry->entry6) + goto err; + + memcpy(&new_entry->entry6->ipv6, ip->ip6, + sizeof(struct ip6t_ip6)); + + new_entry->entry6->target_offset = + XT_ALIGN(sizeof(struct ip6t_entry)) + + match_size; + new_entry->entry6->next_offset = + XT_ALIGN(sizeof(struct ip6t_entry)) + + target_size + match_size; + break; + default: + goto err; + } match_size = 0; - for (tmp_xt_rm = xt_rm; tmp_xt_rm != NULL; + for (tmp_xt_rm = xt_rm; tmp_xt_rm; tmp_xt_rm = tmp_xt_rm->next) { - memcpy(new_entry->elems + match_size, tmp_xt_rm->match->m, + + switch (new_entry->type) { + case AF_INET: + memcpy(new_entry->entry->elems + match_size, + tmp_xt_rm->match->m, + tmp_xt_rm->match->m->u.match_size); + break; + case AF_INET6: + memcpy(new_entry->entry6->elems + match_size, + tmp_xt_rm->match->m, tmp_xt_rm->match->m->u.match_size); + break; + } match_size += tmp_xt_rm->match->m->u.match_size; } if (xt_t) { struct xt_entry_target *entry_target; - entry_target = ipt_get_target(new_entry); + entry_target = iptables_entry_get_target(new_entry); memcpy(entry_target, xt_t->t, target_size); } return new_entry; + +err: + g_free(new_entry); + + return NULL; } static void update_hooks(struct connman_iptables *table, GList *chain_head, - struct ipt_entry *entry) + struct connman_iptables_entry *entry) { GList *list; struct connman_iptables_entry *head, *e; int builtin; + u_int16_t next_offset; - if (chain_head == NULL) + if (!table || !chain_head) return; head = chain_head->data; @@ -742,7 +1243,9 @@ static void update_hooks(struct connman_iptables *table, GList *chain_head, if (builtin < 0) return; - table->underflow[builtin] += entry->next_offset; + next_offset = iptables_entry_get_next_offset(entry); + + table->underflow[builtin] += next_offset; for (list = chain_head->next; list; list = list->next) { e = list->data; @@ -751,32 +1254,45 @@ static void update_hooks(struct connman_iptables *table, GList *chain_head, if (builtin < 0) continue; - table->hook_entry[builtin] += entry->next_offset; - table->underflow[builtin] += entry->next_offset; + table->hook_entry[builtin] += next_offset; + table->underflow[builtin] += next_offset; } } -static struct ipt_entry *prepare_rule_inclusion(struct connman_iptables *table, - struct ipt_ip *ip, const char *chain_name, +static struct connman_iptables_entry *prepare_rule_inclusion( + struct connman_iptables *table, + struct iptables_ip *ip, + const char *chain_name, const char *target_name, struct xtables_target *xt_t, - int *builtin, struct xtables_rule_match *xt_rm) + int *builtin, + struct xtables_rule_match *xt_rm, + bool insert) { GList *chain_tail, *chain_head; - struct ipt_entry *new_entry; struct connman_iptables_entry *head; + struct connman_iptables_entry *new_entry; chain_head = find_chain_head(table, chain_name); - if (chain_head == NULL) + if (!chain_head) return NULL; chain_tail = find_chain_tail(table, chain_name); - if (chain_tail == NULL) + if (!chain_tail) return NULL; new_entry = new_rule(ip, target_name, xt_t, xt_rm); - if (new_entry == NULL) - return NULL; + + switch (new_entry->type) { + case AF_INET: + if (new_entry->entry) + break; + case AF_INET6: + if (new_entry->entry6) + break; + default: + goto err; + } update_hooks(table, chain_head, new_entry); @@ -788,71 +1304,194 @@ static struct ipt_entry *prepare_rule_inclusion(struct connman_iptables *table, head = chain_head->data; if (head->builtin < 0) *builtin = -1; - else if (chain_head == chain_tail->prev) { + else if (insert || chain_head == chain_tail->prev) { *builtin = head->builtin; head->builtin = -1; } return new_entry; + +err: + g_free(new_entry); + + return NULL; +} + +static int iptables_append_rule(struct connman_iptables *table, + struct iptables_ip *ip, + const char *chain_name, + const char *target_name, + struct xtables_target *xt_t, + struct xtables_rule_match *xt_rm) +{ + struct connman_iptables_entry *new_entry; + int builtin = -1, ret; + GList *chain_tail; + + DBG("table %s chain %s", table->name, chain_name); + + chain_tail = find_chain_tail(table, chain_name); + if (!chain_tail) + return -EINVAL; + + new_entry = prepare_rule_inclusion(table, ip, chain_name, target_name, + xt_t, &builtin, xt_rm, false); + + if (!new_entry) + return -EINVAL; + + switch (new_entry->type) { + case AF_INET: + if (new_entry->entry) + break; + case AF_INET6: + if (new_entry->entry6) + break; + default: + ret = -EINVAL; + goto err; + } + + ret = iptables_add_entry(table, new_entry, chain_tail->prev, + builtin, -1); + if (ret < 0) + goto err; + + /* + * Free only the container, not the content iptables_add_entry() + * allocates new containers for entries. + */ + g_free(new_entry); + + return ret; + +err: + iptables_entry_free(new_entry); + + return ret; } static int iptables_insert_rule(struct connman_iptables *table, - struct ipt_ip *ip, const char *chain_name, + struct iptables_ip *ip, + const char *chain_name, const char *target_name, struct xtables_target *xt_t, struct xtables_rule_match *xt_rm) { - struct ipt_entry *new_entry; + struct connman_iptables_entry *new_entry; int builtin = -1, ret; GList *chain_head; + DBG("table %s chain %s", table->name, chain_name); + chain_head = find_chain_head(table, chain_name); - if (chain_head == NULL) + if (!chain_head) return -EINVAL; - new_entry = prepare_rule_inclusion(table, ip, chain_name, - target_name, xt_t, &builtin, xt_rm); - if (new_entry == NULL) + new_entry = prepare_rule_inclusion(table, ip, chain_name, target_name, + xt_t, &builtin, xt_rm, true); + + if (!new_entry) return -EINVAL; + switch (new_entry->type) { + case AF_INET: + if (new_entry->entry) + break; + case AF_INET6: + if (new_entry->entry6) + break; + default: + ret = -EINVAL; + goto err; + } + if (builtin == -1) chain_head = chain_head->next; - ret = iptables_add_entry(table, new_entry, chain_head, builtin); + ret = iptables_add_entry(table, new_entry, chain_head, builtin, -1); if (ret < 0) - g_free(new_entry); + goto err; + + /* + * Free only the container, not the content iptables_add_entry() + * allocates new containers for entries. + */ + g_free(new_entry); + + return ret; + +err: + iptables_entry_free(new_entry); return ret; } -static gboolean is_same_ipt_entry(struct ipt_entry *i_e1, +static bool is_same_ipt_entry(struct ipt_entry *i_e1, struct ipt_entry *i_e2) { if (memcmp(&i_e1->ip, &i_e2->ip, sizeof(struct ipt_ip)) != 0) - return FALSE; + return false; + + if (i_e1->target_offset != i_e2->target_offset) + return false; + + if (i_e1->next_offset != i_e2->next_offset) + return false; + + return true; +} + +/* A copy of is_same_ipt_entry with IPv6 structures */ +static bool is_same_ip6t_entry(struct ip6t_entry *i_e1, + struct ip6t_entry *i_e2) +{ + if (memcmp(&i_e1->ipv6, &i_e2->ipv6, sizeof(struct ip6t_ip6)) != 0) + return false; if (i_e1->target_offset != i_e2->target_offset) - return FALSE; + return false; if (i_e1->next_offset != i_e2->next_offset) - return FALSE; + return false; + + return true; +} + +static bool is_same_iptables_entry(struct connman_iptables_entry *e1, + struct connman_iptables_entry *e2) +{ + if (e1->type != e2->type) + return false; + + switch (e1->type) { + case AF_INET: + return is_same_ipt_entry(e1->entry, e2->entry); + case AF_INET6: + return is_same_ip6t_entry(e1->entry6, e2->entry6); + } - return TRUE; + return false; } -static gboolean is_same_target(struct xt_entry_target *xt_e_t1, +static bool is_same_target(struct xt_entry_target *xt_e_t1, struct xt_entry_target *xt_e_t2) { unsigned int i; - if (xt_e_t1 == NULL || xt_e_t2 == NULL) - return FALSE; + if (!xt_e_t1 || !xt_e_t2) + return false; - if (strcmp(xt_e_t1->u.user.name, "") == 0 && - strcmp(xt_e_t2->u.user.name, "") == 0) { + if (g_strcmp0(xt_e_t1->u.user.name, "") == 0 && + g_strcmp0(xt_e_t2->u.user.name, "") == 0) { /* fallthrough */ - return TRUE; - } else if (strcmp(xt_e_t1->u.user.name, IPT_STANDARD_TARGET) == 0) { + return true; + + /* + * IPT_STANDARD_TARGET and IP6T_STANDARD_TARGET are defined by + * XT_STANDARD_TARGET + */ + } else if (g_strcmp0(xt_e_t1->u.user.name, XT_STANDARD_TARGET) == 0) { struct xt_standard_target *xt_s_t1; struct xt_standard_target *xt_s_t2; @@ -860,83 +1499,107 @@ static gboolean is_same_target(struct xt_entry_target *xt_e_t1, xt_s_t2 = (struct xt_standard_target *) xt_e_t2; if (xt_s_t1->verdict != xt_s_t2->verdict) - return FALSE; + return false; } else { if (xt_e_t1->u.target_size != xt_e_t2->u.target_size) - return FALSE; + return false; - if (strcmp(xt_e_t1->u.user.name, xt_e_t2->u.user.name) != 0) - return FALSE; + if (g_strcmp0(xt_e_t1->u.user.name, xt_e_t2->u.user.name) != 0) + return false; for (i = 0; i < xt_e_t1->u.target_size - sizeof(struct xt_standard_target); i++) { if ((xt_e_t1->data[i] ^ xt_e_t2->data[i]) != 0) - return FALSE; + return false; } } - return TRUE; + return true; } -static gboolean is_same_match(struct xt_entry_match *xt_e_m1, +static bool is_same_match(struct xt_entry_match *xt_e_m1, struct xt_entry_match *xt_e_m2) { unsigned int i; - if (xt_e_m1 == NULL || xt_e_m2 == NULL) - return FALSE; + if (!xt_e_m1 || !xt_e_m2) + return false; if (xt_e_m1->u.match_size != xt_e_m2->u.match_size) - return FALSE; + return false; if (xt_e_m1->u.user.revision != xt_e_m2->u.user.revision) - return FALSE; + return false; - if (strcmp(xt_e_m1->u.user.name, xt_e_m2->u.user.name) != 0) - return FALSE; + if (g_strcmp0(xt_e_m1->u.user.name, xt_e_m2->u.user.name) != 0) + return false; for (i = 0; i < xt_e_m1->u.match_size - sizeof(struct xt_entry_match); i++) { if ((xt_e_m1->data[i] ^ xt_e_m2->data[i]) != 0) - return FALSE; + return false; } - return TRUE; + return true; } static GList *find_existing_rule(struct connman_iptables *table, - struct ipt_ip *ip, const char *chain_name, + struct iptables_ip *ip, + const char *chain_name, const char *target_name, struct xtables_target *xt_t, - struct xtables_match *xt_m, + GList *matches, struct xtables_rule_match *xt_rm) { GList *chain_tail, *chain_head, *list; struct xt_entry_target *xt_e_t = NULL; struct xt_entry_match *xt_e_m = NULL; struct connman_iptables_entry *entry; - struct ipt_entry *entry_test; + struct connman_iptables_entry *entry_test; int builtin; chain_head = find_chain_head(table, chain_name); - if (chain_head == NULL) + if (!chain_head) return NULL; chain_tail = find_chain_tail(table, chain_name); - if (chain_tail == NULL) + if (!chain_tail) return NULL; - if (!xt_t && !xt_m) + if (!xt_t && !matches) return NULL; entry_test = new_rule(ip, target_name, xt_t, xt_rm); - if (entry_test == NULL) + + switch (entry_test->type) { + case AF_INET: + if (!entry_test->entry) { +#if defined TIZEN_EXT + iptables_entry_free(entry_test); +#endif + return NULL; + } + break; + case AF_INET6: + if (!entry_test->entry6) { +#if defined TIZEN_EXT + iptables_entry_free(entry_test); +#endif + return NULL; + } + break; + default: +#if defined TIZEN_EXT + iptables_entry_free(entry_test); +#endif return NULL; + } - if (xt_t != NULL) - xt_e_t = ipt_get_target(entry_test); - if (xt_m != NULL) - xt_e_m = (struct xt_entry_match *)entry_test->elems; + if (xt_t) + xt_e_t = iptables_entry_get_target(entry_test); + if (matches) + xt_e_m = (struct xt_entry_match *) + iptables_entry_get_elems(entry_test); entry = chain_head->data; builtin = entry->builtin; @@ -948,27 +1611,26 @@ static GList *find_existing_rule(struct connman_iptables *table, for (; list != chain_tail->prev; list = list->next) { struct connman_iptables_entry *tmp; - struct ipt_entry *tmp_e; tmp = list->data; - tmp_e = tmp->entry; - if (is_same_ipt_entry(entry_test, tmp_e) == FALSE) + if (!is_same_iptables_entry(entry_test, tmp)) continue; - if (xt_t != NULL) { - struct xt_entry_target *tmp_xt_e_t; + if (xt_t) { + struct xt_entry_target *tmp_xt_e_t = NULL; - tmp_xt_e_t = ipt_get_target(tmp_e); + tmp_xt_e_t = iptables_entry_get_target(tmp); if (!is_same_target(tmp_xt_e_t, xt_e_t)) continue; } - if (xt_m != NULL) { + if (matches) { struct xt_entry_match *tmp_xt_e_m; - tmp_xt_e_m = (struct xt_entry_match *)tmp_e->elems; + tmp_xt_e_m = (struct xt_entry_match *) + iptables_entry_get_elems(tmp); if (!is_same_match(tmp_xt_e_m, xt_e_m)) continue; @@ -977,7 +1639,7 @@ static GList *find_existing_rule(struct connman_iptables *table, break; } - g_free(entry_test); + iptables_entry_free(entry_test); if (list != chain_tail->prev) return list; @@ -986,65 +1648,68 @@ static GList *find_existing_rule(struct connman_iptables *table, } static int iptables_delete_rule(struct connman_iptables *table, - struct ipt_ip *ip, const char *chain_name, + struct iptables_ip *ip, + const char *chain_name, const char *target_name, struct xtables_target *xt_t, - struct xtables_match *xt_m, + GList *matches, struct xtables_rule_match *xt_rm) { struct connman_iptables_entry *entry; GList *chain_head, *chain_tail, *list; int builtin, removed; + DBG("table %s chain %s", table->name, chain_name); + removed = 0; chain_head = find_chain_head(table, chain_name); - if (chain_head == NULL) + if (!chain_head) return -EINVAL; chain_tail = find_chain_tail(table, chain_name); - if (chain_tail == NULL) + if (!chain_tail) return -EINVAL; list = find_existing_rule(table, ip, chain_name, target_name, - xt_t, xt_m, xt_rm); - if (list == NULL) + xt_t, matches, xt_rm); + + if (!list) return -EINVAL; entry = chain_head->data; builtin = entry->builtin; + if (builtin >= 0 && list == chain_head) { + /* + * We are about to remove the first rule in the + * chain. In this case we need to store the builtin + * value to the new chain_head. + * + * Note, for builtin chains, chain_head->next is + * always valid. A builtin chain has always a policy + * rule at the end. + */ + chain_head = chain_head->next; + + entry = chain_head->data; + entry->builtin = builtin; + } + entry = list->data; - if (entry == NULL) + if (!entry) return -EINVAL; /* We have deleted a rule, * all references should be bumped accordingly */ - if (list->next != NULL) + if (list->next) update_targets_reference(table, list->next->data, - list->data, TRUE); + list->data, true); removed += remove_table_entry(table, entry); - if (builtin >= 0) { - list = list->next; - if (list) { - entry = list->data; - entry->builtin = builtin; - } - - table->underflow[builtin] -= removed; - for (list = chain_tail; list; list = list->next) { - entry = list->data; - - builtin = entry->builtin; - if (builtin < 0) - continue; - - table->hook_entry[builtin] -= removed; - table->underflow[builtin] -= removed; - } - } + if (builtin >= 0) + delete_update_hooks(table, builtin, chain_head, removed); update_offsets(table); @@ -1054,27 +1719,45 @@ static int iptables_delete_rule(struct connman_iptables *table, static int iptables_change_policy(struct connman_iptables *table, const char *chain_name, const char *policy) { - GList *chain_head; + GList *chain_head, *chain_tail; struct connman_iptables_entry *entry; struct xt_entry_target *target; struct xt_standard_target *t; int verdict; + DBG("table %s chain %s policy %s", table->name, chain_name, policy); + verdict = target_to_verdict(policy); - if (verdict == 0) + switch (verdict) { + case -NF_ACCEPT - 1: + case -NF_DROP - 1: + break; + default: return -EINVAL; + } chain_head = find_chain_head(table, chain_name); - if (chain_head == NULL) + if (!chain_head) return -EINVAL; entry = chain_head->data; if (entry->builtin < 0) return -EINVAL; - target = ipt_get_target(entry->entry); + chain_tail = find_chain_tail(table, chain_name); + if (!chain_tail) + return -EINVAL; + + entry = chain_tail->prev->data; + + target = iptables_entry_get_target(entry); + + if (!target) + return -EINVAL; t = (struct xt_standard_target *)target; + if (t->verdict != verdict) + entry->counter_idx = -1; t->verdict = verdict; return 0; @@ -1088,19 +1771,19 @@ static struct ipt_replace *iptables_blob(struct connman_iptables *table) unsigned char *entry_index; r = g_try_malloc0(sizeof(struct ipt_replace) + table->size); - if (r == NULL) + if (!r) return NULL; memset(r, 0, sizeof(*r) + table->size); r->counters = g_try_malloc0(sizeof(struct xt_counters) * table->old_entries); - if (r->counters == NULL) { + if (!r->counters) { g_free(r); return NULL; } - strcpy(r->name, table->info->name); + g_stpcpy(r->name, table->info->name); r->num_entries = table->num_entries; r->size = table->size; @@ -1121,38 +1804,114 @@ static struct ipt_replace *iptables_blob(struct connman_iptables *table) return r; } -static void dump_ip(struct ipt_entry *entry) +/* A copy of iptables_blob() with IPv6 structures */ +static struct ip6t_replace *ip6tables_blob(struct connman_iptables *table) +{ + struct ip6t_replace *r; + GList *list; + struct connman_iptables_entry *e; + unsigned char *entry_index; + + r = g_try_malloc0(sizeof(struct ip6t_replace) + table->size); + if (!r) + return NULL; + + memset(r, 0, sizeof(*r) + table->size); + + r->counters = g_try_malloc0(sizeof(struct xt_counters) + * table->old_entries); + if (!r->counters) { + g_free(r); + return NULL; + } + + g_stpcpy(r->name, table->info6->name); + r->num_entries = table->num_entries; + r->size = table->size; + + r->num_counters = table->old_entries; + r->valid_hooks = table->info6->valid_hooks; + + memcpy(r->hook_entry, table->hook_entry, sizeof(table->hook_entry)); + memcpy(r->underflow, table->underflow, sizeof(table->underflow)); + + entry_index = (unsigned char *)r->entries; + for (list = table->entries; list; list = list->next) { + e = list->data; + + memcpy(entry_index, e->entry6, e->entry6->next_offset); + entry_index += e->entry6->next_offset; + } + + return r; +} + +static void dump_ip(struct connman_iptables_entry *entry) { - struct ipt_ip *ip = &entry->ip; + char *iniface, *outiface; char ip_string[INET6_ADDRSTRLEN]; char ip_mask[INET6_ADDRSTRLEN]; - if (strlen(ip->iniface)) - DBG("\tin %s", ip->iniface); + switch (entry->type) { + case AF_INET: + iniface = entry->entry->ip.iniface; + outiface = entry->entry->ip.outiface; + break; + case AF_INET6: + iniface = entry->entry6->ipv6.iniface; + outiface = entry->entry6->ipv6.outiface; + break; + default: + return; + } + + if (strlen(iniface)) + DBG("\tin %s", iniface); - if (strlen(ip->outiface)) - DBG("\tout %s", ip->outiface); + if (strlen(outiface)) + DBG("\tout %s", outiface); - if (inet_ntop(AF_INET, &ip->src, ip_string, INET6_ADDRSTRLEN) != NULL && - inet_ntop(AF_INET, &ip->smsk, - ip_mask, INET6_ADDRSTRLEN) != NULL) - DBG("\tsrc %s/%s", ip_string, ip_mask); + if (entry->type == AF_INET) { + if (inet_ntop(entry->type, &entry->entry->ip.src, ip_string, + INET6_ADDRSTRLEN) && inet_ntop(entry->type, + &entry->entry->ip.smsk, ip_mask, + INET6_ADDRSTRLEN)) + DBG("\tsrc %s/%s", ip_string, ip_mask); - if (inet_ntop(AF_INET, &ip->dst, ip_string, INET6_ADDRSTRLEN) != NULL && - inet_ntop(AF_INET, &ip->dmsk, - ip_mask, INET6_ADDRSTRLEN) != NULL) - DBG("\tdst %s/%s", ip_string, ip_mask); -} + if (inet_ntop(entry->type, &entry->entry->ip.dst, ip_string, + INET6_ADDRSTRLEN) && inet_ntop(entry->type, + &entry->entry->ip.dmsk, ip_mask, + INET6_ADDRSTRLEN)) + DBG("\tdst %s/%s", ip_string, ip_mask); + } -static void dump_target(struct ipt_entry *entry) + if (entry->type == AF_INET6) { + if (inet_ntop(entry->type, &entry->entry6->ipv6.src, ip_string, + INET6_ADDRSTRLEN) && inet_ntop(entry->type, + &entry->entry6->ipv6.smsk, ip_mask, + INET6_ADDRSTRLEN)) + DBG("\tsrc %s/%s", ip_string, ip_mask); + + if (inet_ntop(entry->type, &entry->entry6->ipv6.dst, ip_string, + INET6_ADDRSTRLEN) && inet_ntop(entry->type, + &entry->entry6->ipv6.dmsk, ip_mask, + INET6_ADDRSTRLEN)) + DBG("\tdst %s/%s", ip_string, ip_mask); + } +} +static void dump_target(struct connman_iptables_entry *entry) { struct xtables_target *xt_t; struct xt_entry_target *target; + int err; + + target = iptables_entry_get_target(entry); - target = ipt_get_target(entry); + if (!target) + return; - if (!strcmp(target->u.user.name, IPT_STANDARD_TARGET)) { + if (!g_strcmp0(target->u.user.name, get_standard_target(entry->type))) { struct xt_standard_target *t; t = (struct xt_standard_target *)target; @@ -1183,81 +1942,149 @@ static void dump_target(struct ipt_entry *entry) break; } - xt_t = xtables_find_target(IPT_STANDARD_TARGET, + enable_jmp(); + + if ((err = setjmp(env_state)) != 0) { + DBG("setjmp() called by longjmp() with value %d", err); + disable_jmp(); + return; + } + + xt_t = xtables_find_target(get_standard_target(entry->type), XTF_LOAD_MUST_SUCCEED); - if(xt_t->print != NULL) + disable_jmp(); + + if (xt_t->print) xt_t->print(NULL, target, 1); } else { + enable_jmp(); + + if ((err = setjmp(env_state)) != 0) { + DBG("setjmp() called by longjmp() with value %d", err); + disable_jmp(); + return; + } + xt_t = xtables_find_target(target->u.user.name, XTF_TRY_LOAD); - if (xt_t == NULL) { + + disable_jmp(); + + if (!xt_t) { DBG("\ttarget %s", target->u.user.name); return; } - if(xt_t->print != NULL) { + if (xt_t->print) { DBG("\ttarget "); xt_t->print(NULL, target, 1); } } + + if (xt_t == xt_t->next) + free(xt_t); } -static void dump_match(struct ipt_entry *entry) +static void dump_match(struct connman_iptables_entry *entry) { struct xtables_match *xt_m; struct xt_entry_match *match; + u_int16_t target_offset; + int err; - if (entry->elems == (unsigned char *)entry + entry->target_offset) + target_offset = iptables_entry_get_target_offset(entry); + + switch (entry->type) { + case AF_INET: + if (entry->entry->elems == (unsigned char *)entry->entry + + target_offset) + return; + break; + case AF_INET6: + if (entry->entry6->elems == (unsigned char *)entry->entry6 + + target_offset) + return; + break; + default: return; + } - match = (struct xt_entry_match *) entry->elems; + match = (struct xt_entry_match *) iptables_entry_get_elems(entry); if (!strlen(match->u.user.name)) return; + enable_jmp(); + + if ((err = setjmp(env_state)) != 0) { + DBG("setjmp() called by longjmp() with value %d", err); + disable_jmp(); + return; + } + xt_m = xtables_find_match(match->u.user.name, XTF_TRY_LOAD, NULL); - if (xt_m == NULL) + + disable_jmp(); + + if (!xt_m) goto out; - if(xt_m->print != NULL) { + if (xt_m->print) { DBG("\tmatch "); xt_m->print(NULL, match, 1); return; } + if (xt_m == xt_m->next) + free(xt_m); out: DBG("\tmatch %s", match->u.user.name); } -static int dump_entry(struct ipt_entry *entry, int builtin, +static int dump_entry(struct connman_iptables_entry *entry, int builtin, unsigned int hook, size_t size, unsigned int offset, void *user_data) { struct xt_entry_target *target; + char *char_entry; + + target = iptables_entry_get_target(entry); - target = ipt_get_target(entry); + if (!target) + return -EINVAL; - if (offset + entry->next_offset == size) { + if (offset + iptables_entry_get_next_offset(entry) == size) { DBG("\tEnd of CHAIN"); return 0; } - if (!strcmp(target->u.user.name, IPT_ERROR_TARGET)) { + switch (entry->type) { + case AF_INET: + char_entry = (char *)entry->entry; + break; + case AF_INET6: + char_entry = (char *)entry->entry6; + break; + default: + return 0; + } + + if (!g_strcmp0(target->u.user.name, IPT_ERROR_TARGET)) { DBG("\tUSER CHAIN (%s) match %p target %p", - target->data, entry->elems, - (char *)entry + entry->target_offset); + target->data, iptables_entry_get_elems(entry), + char_entry + iptables_entry_get_target_offset(entry)); return 0; } else if (builtin >= 0) { DBG("\tCHAIN (%s) match %p target %p", - hooknames[builtin], entry->elems, - (char *)entry + entry->target_offset); + hooknames[builtin], iptables_entry_get_elems(entry), + char_entry + iptables_entry_get_target_offset(entry)); } else { DBG("\tRULE match %p target %p", - entry->elems, - (char *)entry + entry->target_offset); + iptables_entry_get_elems(entry), + char_entry + iptables_entry_get_target_offset(entry)); } dump_match(entry); @@ -1269,86 +2096,318 @@ static int dump_entry(struct ipt_entry *entry, int builtin, static void dump_table(struct connman_iptables *table) { + struct connman_iptables_entry entry = { 0 }; + unsigned int *hook_entry; + unsigned int *underflow; + unsigned int valid_hooks; + unsigned int size; + + hook_entry = iptables_table_get_info_hook_entry(table); + underflow = iptables_table_get_info_underflow(table); + valid_hooks = iptables_table_get_info_valid_hooks(table); + size = iptables_table_get_info_size(table); + DBG("%s valid_hooks=0x%08x, num_entries=%u, size=%u", - table->info->name, - table->info->valid_hooks, table->info->num_entries, - table->info->size); + iptables_table_get_info_name(table), + valid_hooks, + iptables_table_get_info_num_entries(table), + size); DBG("entry hook: pre/in/fwd/out/post %d/%d/%d/%d/%d", - table->info->hook_entry[NF_IP_PRE_ROUTING], - table->info->hook_entry[NF_IP_LOCAL_IN], - table->info->hook_entry[NF_IP_FORWARD], - table->info->hook_entry[NF_IP_LOCAL_OUT], - table->info->hook_entry[NF_IP_POST_ROUTING]); + hook_entry[NF_IP_PRE_ROUTING], + hook_entry[NF_IP_LOCAL_IN], + hook_entry[NF_IP_FORWARD], + hook_entry[NF_IP_LOCAL_OUT], + hook_entry[NF_IP_POST_ROUTING]); DBG("underflow: pre/in/fwd/out/post %d/%d/%d/%d/%d", - table->info->underflow[NF_IP_PRE_ROUTING], - table->info->underflow[NF_IP_LOCAL_IN], - table->info->underflow[NF_IP_FORWARD], - table->info->underflow[NF_IP_LOCAL_OUT], - table->info->underflow[NF_IP_POST_ROUTING]); + underflow[NF_IP_PRE_ROUTING], + underflow[NF_IP_LOCAL_IN], + underflow[NF_IP_FORWARD], + underflow[NF_IP_LOCAL_OUT], + underflow[NF_IP_POST_ROUTING]); + + entry.type = table->type; + + switch (table->type) { + case AF_INET: + entry.entry = table->blob_entries->entrytable; + break; + case AF_INET6: + entry.entry6 = table->blob_entries6->entrytable; + } - iterate_entries(table->blob_entries->entrytable, - table->info->valid_hooks, - table->info->hook_entry, - table->info->underflow, - table->blob_entries->size, - print_entry, dump_entry); + iterate_entries(&entry, + valid_hooks, + hook_entry, + underflow, + size, + print_entry, dump_entry); } -static void dump_ipt_replace(struct ipt_replace *repl) +static const char *iptables_replace_get_name(struct iptables_replace *replace) { - DBG("%s valid_hooks 0x%08x num_entries %u size %u", - repl->name, repl->valid_hooks, repl->num_entries, - repl->size); + if (!replace) + return NULL; - DBG("entry hook: pre/in/fwd/out/post %d/%d/%d/%d/%d", - repl->hook_entry[NF_IP_PRE_ROUTING], - repl->hook_entry[NF_IP_LOCAL_IN], - repl->hook_entry[NF_IP_FORWARD], - repl->hook_entry[NF_IP_LOCAL_OUT], - repl->hook_entry[NF_IP_POST_ROUTING]); - DBG("underflow: pre/in/fwd/out/post %d/%d/%d/%d/%d", - repl->underflow[NF_IP_PRE_ROUTING], - repl->underflow[NF_IP_LOCAL_IN], - repl->underflow[NF_IP_FORWARD], - repl->underflow[NF_IP_LOCAL_OUT], - repl->underflow[NF_IP_POST_ROUTING]); + switch (replace->type) { + case AF_INET: + return replace->r->name; + case AF_INET6: + return replace->r6->name; + } - iterate_entries(repl->entries, repl->valid_hooks, - repl->hook_entry, repl->underflow, - repl->size, print_entry, dump_entry); + return NULL; } -static int iptables_get_entries(struct connman_iptables *table) +static unsigned int iptables_replace_get_valid_hooks( + struct iptables_replace *replace) { - socklen_t entry_size; + if (!replace) + return 0; - entry_size = sizeof(struct ipt_get_entries) + table->info->size; + switch (replace->type) { + case AF_INET: + return replace->r->valid_hooks; + case AF_INET6: + return replace->r6->valid_hooks; + } - return getsockopt(table->ipt_sock, IPPROTO_IP, IPT_SO_GET_ENTRIES, - table->blob_entries, &entry_size); + return 0; +} + +static unsigned int iptables_replace_get_num_entries( + struct iptables_replace *replace) +{ + if (!replace) + return 0; + + switch (replace->type) { + case AF_INET: + return replace->r->num_entries; + case AF_INET6: + return replace->r6->num_entries; + } + + return 0; +} + +static unsigned int *iptables_replace_get_hook_entry( + struct iptables_replace *replace) +{ + if (!replace) + return NULL; + + switch (replace->type) { + case AF_INET: + return replace->r->hook_entry; + case AF_INET6: + return replace->r6->hook_entry; + } + + return NULL; +} + +static unsigned int *iptables_replace_get_underflow( + struct iptables_replace *replace) +{ + if (!replace) + return NULL; + + switch (replace->type) { + case AF_INET: + return replace->r->underflow; + case AF_INET6: + return replace->r6->underflow; + } + + return NULL; +} + +static unsigned int iptables_replace_get_size(struct iptables_replace *replace) +{ + if (!replace) + return 0; + + switch (replace->type) { + case AF_INET: + return replace->r->size; + case AF_INET6: + return replace->r6->size; + } + + return 0; +} + +static void dump_replace(struct iptables_replace *repl) +{ + struct connman_iptables_entry entry = { 0 }; + unsigned int *hook_entry; + unsigned int *underflow; + unsigned int valid_hooks; + unsigned int size; + + hook_entry = iptables_replace_get_hook_entry(repl); + underflow = iptables_replace_get_underflow(repl); + valid_hooks = iptables_replace_get_valid_hooks(repl); + size = iptables_replace_get_size(repl); + + switch (repl->type) { + case AF_INET: + entry.entry = repl->r->entries; + break; + case AF_INET6: + entry.entry6 = repl->r6->entries; + break; + default: + return; + } + + DBG("%s valid_hooks 0x%08x num_entries %u size %u", + iptables_replace_get_name(repl), + valid_hooks, + iptables_replace_get_num_entries(repl), size); + + DBG("entry hook: pre/in/fwd/out/post %d/%d/%d/%d/%d", + hook_entry[NF_IP_PRE_ROUTING], + hook_entry[NF_IP_LOCAL_IN], + hook_entry[NF_IP_FORWARD], + hook_entry[NF_IP_LOCAL_OUT], + hook_entry[NF_IP_POST_ROUTING]); + DBG("underflow: pre/in/fwd/out/post %d/%d/%d/%d/%d", + underflow[NF_IP_PRE_ROUTING], + underflow[NF_IP_LOCAL_IN], + underflow[NF_IP_FORWARD], + underflow[NF_IP_LOCAL_OUT], + underflow[NF_IP_POST_ROUTING]); + + iterate_entries(&entry, valid_hooks, hook_entry, underflow, + size, print_entry, dump_entry); +} + +static int iptables_get_entries(struct connman_iptables *table) +{ + socklen_t entry_size; + int err; + + switch (table->type) { + case AF_INET: + entry_size = sizeof(struct ipt_get_entries) + table->info->size; + + err = getsockopt(table->ipt_sock, IPPROTO_IP, + IPT_SO_GET_ENTRIES, table->blob_entries, + &entry_size); + break; + case AF_INET6: + entry_size = sizeof(struct ip6t_get_entries) + + table->info6->size; + + err = getsockopt(table->ipt_sock, IPPROTO_IPV6, + IP6T_SO_GET_ENTRIES, table->blob_entries6, + &entry_size); + break; + default: + return -EINVAL; + } + + if (err < 0) + return -errno; + + return 0; } static int iptables_replace(struct connman_iptables *table, - struct ipt_replace *r) + struct iptables_replace *r) { - return setsockopt(table->ipt_sock, IPPROTO_IP, IPT_SO_SET_REPLACE, r, - sizeof(*r) + r->size); + int err; + + switch (r->type) { + case AF_INET: + if (!r->r) + return -EINVAL; + + err = setsockopt(table->ipt_sock, IPPROTO_IP, + IPT_SO_SET_REPLACE, r->r, + sizeof(*r->r) + r->r->size); + break; + case AF_INET6: + if (!r->r6) + return -EINVAL; + + err = setsockopt(table->ipt_sock, IPPROTO_IPV6, + IP6T_SO_SET_REPLACE, r->r6, + sizeof(*r->r6) + r->r6->size); + break; + default: + return -EINVAL; + } + + if (err < 0) + return -errno; + + return 0; } -static int add_entry(struct ipt_entry *entry, int builtin, unsigned int hook, - size_t size, unsigned offset, void *user_data) +static int iptables_add_counters(struct connman_iptables *table, + struct xt_counters_info *c) +{ + int err; + int level; + int optname; + + switch (table->type) { + case AF_INET: + level = IPPROTO_IP; + optname = IPT_SO_SET_ADD_COUNTERS; + break; + case AF_INET6: + level = IPPROTO_IPV6; + optname = IP6T_SO_SET_ADD_COUNTERS; + break; + default: + return -EINVAL; + } + + err = setsockopt(table->ipt_sock, level, optname, c, + sizeof(*c) + sizeof(struct xt_counters) * c->num_counters); + + if (err < 0) + return -errno; + + return 0; +} + +static int add_entry(struct connman_iptables_entry *entry, int builtin, + unsigned int hook, size_t size, unsigned offset, + void *user_data) { struct connman_iptables *table = user_data; - struct ipt_entry *new_entry; + struct connman_iptables_entry new_entry = { 0 }; + u_int16_t next_offset; - new_entry = g_try_malloc0(entry->next_offset); - if (new_entry == NULL) - return -ENOMEM; + new_entry.type = entry->type; + next_offset = iptables_entry_get_next_offset(entry); - memcpy(new_entry, entry, entry->next_offset); + switch (entry->type) { + case AF_INET: + new_entry.entry = g_try_malloc0(next_offset); + if (!new_entry.entry) + return -ENOMEM; - return iptables_add_entry(table, new_entry, NULL, builtin); + memcpy(new_entry.entry, entry->entry, next_offset); + break; + case AF_INET6: + new_entry.entry6 = g_try_malloc0(next_offset); + if (!new_entry.entry6) + return -ENOMEM; + + memcpy(new_entry.entry6, entry->entry6, next_offset); + break; + default: + return -EINVAL; + } + + return iptables_add_entry(table, &new_entry, NULL, builtin, + table->num_entries); } static void table_cleanup(struct connman_iptables *table) @@ -1356,7 +2415,7 @@ static void table_cleanup(struct connman_iptables *table) GList *list; struct connman_iptables_entry *entry; - if (table == NULL) + if (!table) return; if (table->ipt_sock >= 0) @@ -1365,98 +2424,180 @@ static void table_cleanup(struct connman_iptables *table) for (list = table->entries; list; list = list->next) { entry = list->data; - g_free(entry->entry); - g_free(entry); + iptables_entry_free(entry); } g_list_free(table->entries); - g_free(table->info); - g_free(table->blob_entries); + g_free(table->name); + + if (table->type == AF_INET) { + g_free(table->info); + g_free(table->blob_entries); + } + + if (table->type == AF_INET6) { + g_free(table->info6); + g_free(table->blob_entries6); + } + g_free(table); } -static struct connman_iptables *iptables_init(const char *table_name) +static int setup_xtables(int type); +static void reset_xtables(); + +static struct connman_iptables *iptables_init(int type, const char *table_name) { struct connman_iptables *table = NULL; + struct connman_iptables_entry entry = { 0 }; + char *iptables_mod = NULL; char *module = NULL; socklen_t s; - if (table_name == NULL) - table_name = "filter"; - - DBG("%s", table_name); + switch(type) { + case AF_INET: + iptables_mod = g_strdup("ip_tables"); + module = g_strconcat("iptable_", table_name, NULL); + break; + case AF_INET6: + iptables_mod = g_strdup("ip6_tables"); + module = g_strconcat("ip6table_", table_name, NULL); + break; + default: + return NULL; + } - if (xtables_insmod("ip_tables", NULL, TRUE) != 0) - DBG("ip_tables module loading gives error but trying anyway"); + DBG("%d %s", type, table_name); - module = g_strconcat("iptable_", table_name, NULL); - if (module == NULL) + if (setup_xtables(type)) { +#if defined TIZEN_EXT + g_free(iptables_mod); + g_free(module); +#endif return NULL; + } + + if (xtables_insmod(iptables_mod, NULL, TRUE) != 0) + DBG("%s module loading gives error but trying anyway", + iptables_mod); + + g_free(iptables_mod); if (xtables_insmod(module, NULL, TRUE) != 0) DBG("%s module loading gives error but trying anyway", module); g_free(module); - table = g_hash_table_lookup(table_hash, table_name); - if (table != NULL) - return table; - table = g_try_new0(struct connman_iptables, 1); - if (table == NULL) + if (!table) return NULL; - table->info = g_try_new0(struct ipt_getinfo, 1); - if (table->info == NULL) - goto err; + table->type = entry.type = type; - table->ipt_sock = socket(AF_INET, SOCK_RAW | SOCK_CLOEXEC, IPPROTO_RAW); + table->ipt_sock = socket(type, SOCK_RAW | SOCK_CLOEXEC, IPPROTO_RAW); if (table->ipt_sock < 0) goto err; - s = sizeof(*table->info); - strcpy(table->info->name, table_name); - if (getsockopt(table->ipt_sock, IPPROTO_IP, IPT_SO_GET_INFO, - table->info, &s) < 0) { - connman_error("iptables support missing error %d (%s)", errno, - strerror(errno)); - goto err; - } + switch (type) { + case AF_INET: + table->info = g_try_new0(struct ipt_getinfo, 1); + if (!table->info) + goto err; - table->blob_entries = g_try_malloc0(sizeof(struct ipt_get_entries) + - table->info->size); - if (table->blob_entries == NULL) - goto err; + s = sizeof(*table->info); + g_stpcpy(table->info->name, table_name); + + if (getsockopt(table->ipt_sock, IPPROTO_IP, IPT_SO_GET_INFO, + table->info, &s) < 0) { + connman_error("iptables support missing error %d (%s)", + errno, strerror(errno)); + goto err; + } + + table->blob_entries = g_try_malloc0( + sizeof(struct ipt_get_entries) + + table->info->size); + if (!table->blob_entries) + goto err; + + g_stpcpy(table->blob_entries->name, table_name); + table->blob_entries->size = table->info->size; + + break; + case AF_INET6: + table->info6 = g_try_new0(struct ip6t_getinfo, 1); + if (!table->info6) + goto err; + + s = sizeof(*table->info6); + g_stpcpy(table->info6->name, table_name); + + if (getsockopt(table->ipt_sock, IPPROTO_IPV6, IP6T_SO_GET_INFO, + table->info6, &s) < 0) { + connman_error("ip6tables support missing error %d (%s)", + errno, strerror(errno)); + goto err; + } + + table->blob_entries6 = g_try_malloc0( + sizeof(struct ip6t_get_entries) + + table->info6->size); + if (!table->blob_entries6) + goto err; + + g_stpcpy(table->blob_entries6->name, table_name); + table->blob_entries6->size = table->info6->size; - strcpy(table->blob_entries->name, table_name); - table->blob_entries->size = table->info->size; + break; + } if (iptables_get_entries(table) < 0) goto err; table->num_entries = 0; - table->old_entries = table->info->num_entries; table->size = 0; - memcpy(table->underflow, table->info->underflow, - sizeof(table->info->underflow)); - memcpy(table->hook_entry, table->info->hook_entry, - sizeof(table->info->hook_entry)); + switch (type) { + case AF_INET: + table->old_entries = table->info->num_entries; - iterate_entries(table->blob_entries->entrytable, - table->info->valid_hooks, table->info->hook_entry, - table->info->underflow, table->blob_entries->size, - add_entry, table); + memcpy(table->underflow, table->info->underflow, + sizeof(table->info->underflow)); + memcpy(table->hook_entry, table->info->hook_entry, + sizeof(table->info->hook_entry)); + + entry.entry = table->blob_entries->entrytable; + break; + case AF_INET6: + table->old_entries = table->info6->num_entries; - g_hash_table_insert(table_hash, g_strdup(table_name), table); + memcpy(table->underflow, table->info6->underflow, + sizeof(table->info6->underflow)); + memcpy(table->hook_entry, table->info6->hook_entry, + sizeof(table->info6->hook_entry)); - if (debug_enabled == TRUE) + entry.entry6 = table->blob_entries6->entrytable; + break; + } + + iterate_entries(&entry, + iptables_table_get_info_valid_hooks(table), + iptables_table_get_info_hook_entry(table), + iptables_table_get_info_underflow(table), + iptables_table_get_entries_size(table), + add_entry, + table); + + if (debug_enabled) dump_table(table); + reset_xtables(); + return table; err: table_cleanup(table); + reset_xtables(); return NULL; } @@ -1478,47 +2619,141 @@ static struct option iptables_opts[] = { {.name = "out-interface", .has_arg = 1, .val = 'o'}, {.name = "source", .has_arg = 1, .val = 's'}, {.name = "table", .has_arg = 1, .val = 't'}, + {.name = "protocol", .has_arg = 1, .val = 'p'}, {NULL}, }; +void iptables_exit(enum xtables_exittype status, const char *msg, ...) + __attribute__((noreturn, format(printf,2,3))); + +void iptables_exit(enum xtables_exittype status, const char *msg, ...) +{ + va_list args; + gchar str[256] = { 0 }; + + switch (status) { + case OTHER_PROBLEM: + DBG("OTHER_PROBLEM"); + break; + case PARAMETER_PROBLEM: + DBG("PARAMETER_PROBLEM"); + break; + case VERSION_PROBLEM: + DBG("VERSION_PROBLEM"); + break; + case RESOURCE_PROBLEM: + DBG("RESOURCE_PROBLEM"); + break; + case XTF_ONLY_ONCE: + DBG("XTF_ONLY_ONCE"); + break; + case XTF_NO_INVERT: + DBG("XTF_NO_INVERT"); + break; + case XTF_BAD_VALUE: + DBG("XTF_BAD_VALUE"); + break; + case XTF_ONE_ACTION: + DBG("XTF_ONE_ACTION"); + break; + } + + va_start(args, msg); + vsnprintf(str, 256, msg, args); + va_end(args); + + connman_error("iptables rule error: %s", str); + + if (can_jmp()) { + DBG("calling longjmp()"); + /* enum xtables_exittype begins from 1 */ + longjmp(env_state, status); + } + + connman_error("exit because of iptables error"); + + exit(status); +} + struct xtables_globals iptables_globals = { .option_offset = 0, .opts = iptables_opts, .orig_opts = iptables_opts, + .exit_err = iptables_exit, +#if XTABLES_VERSION_CODE > 10 + .compat_rev = xtables_compatible_revision, +#endif +}; + +struct xtables_globals ip6tables_globals = { + .option_offset = 0, + .opts = iptables_opts, + .orig_opts = iptables_opts, + .exit_err = iptables_exit, +#if XTABLES_VERSION_CODE > 10 + .compat_rev = xtables_compatible_revision, +#endif }; static struct xtables_target *prepare_target(struct connman_iptables *table, const char *target_name) { struct xtables_target *xt_t = NULL; - gboolean is_builtin, is_user_defined; + bool is_builtin, is_user_defined; GList *chain_head = NULL; size_t target_size; + int err; + + is_builtin = false; + is_user_defined = false; - is_builtin = FALSE; - is_user_defined = FALSE; + DBG("target %s", target_name); + + if (!table) + return NULL; if (is_builtin_target(target_name)) - is_builtin = TRUE; + is_builtin = true; else { chain_head = find_chain_head(table, target_name); - if (chain_head != NULL && chain_head->next != NULL) - is_user_defined = TRUE; + if (chain_head && chain_head->next) + is_user_defined = true; + } + + enable_jmp(); + + if ((err = setjmp(env_state)) != 0) { + DBG("setjmp() called by longjmp() with value %d", err); + disable_jmp(); + return NULL; } if (is_builtin || is_user_defined) - xt_t = xtables_find_target(IPT_STANDARD_TARGET, + xt_t = xtables_find_target(get_standard_target(table->type), XTF_LOAD_MUST_SUCCEED); else xt_t = xtables_find_target(target_name, XTF_TRY_LOAD); - if (xt_t == NULL) + disable_jmp(); + + if (!xt_t) return NULL; - target_size = ALIGN(sizeof(struct ipt_entry_target)) + xt_t->size; + switch (table->type) { + case AF_INET: + target_size = XT_ALIGN(sizeof(struct ipt_entry_target)) + + xt_t->size; + break; + case AF_INET6: + target_size = XT_ALIGN(sizeof(struct ip6t_entry_target)) + + xt_t->size; + break; + default: + return NULL; + } xt_t->t = g_try_malloc0(target_size); - if (xt_t->t == NULL) + if (!xt_t->t) return NULL; xt_t->t->u.target_size = target_size; @@ -1527,50 +2762,69 @@ static struct xtables_target *prepare_target(struct connman_iptables *table, struct xt_standard_target *target; target = (struct xt_standard_target *)(xt_t->t); - strcpy(target->target.u.user.name, IPT_STANDARD_TARGET); + g_stpcpy(target->target.u.user.name, + get_standard_target(table->type)); - if (is_builtin == TRUE) + if (is_builtin) target->verdict = target_to_verdict(target_name); - else if (is_user_defined == TRUE) { + else if (is_user_defined) { struct connman_iptables_entry *target_rule; - if (chain_head == NULL) { - g_free(xt_t->t); - return NULL; - } - target_rule = chain_head->next->data; target->verdict = target_rule->offset; } } else { - strcpy(xt_t->t->u.user.name, target_name); + g_stpcpy(xt_t->t->u.user.name, target_name); xt_t->t->u.user.revision = xt_t->revision; - if (xt_t->init != NULL) + if (xt_t->init) xt_t->init(xt_t->t); } -#if XTABLES_VERSION_CODE > 5 - if (xt_t->x6_options != NULL) - iptables_globals.opts = - xtables_options_xfrm( - iptables_globals.orig_opts, - iptables_globals.opts, - xt_t->x6_options, - &xt_t->option_offset); - else -#endif - iptables_globals.opts = - xtables_merge_options( -#if XTABLES_VERSION_CODE > 5 - iptables_globals.orig_opts, -#endif - iptables_globals.opts, - xt_t->extra_opts, - &xt_t->option_offset); + switch (table->type) { + case AF_INET: + if (xt_t->x6_options) + iptables_globals.opts = + xtables_options_xfrm( + iptables_globals.orig_opts, + iptables_globals.opts, + xt_t->x6_options, + &xt_t->option_offset); + else + iptables_globals.opts = + xtables_merge_options( + iptables_globals.orig_opts, + iptables_globals.opts, + xt_t->extra_opts, + &xt_t->option_offset); + + if (!iptables_globals.opts) { + g_free(xt_t->t); + xt_t = NULL; + } + + break; + case AF_INET6: + if (xt_t->x6_options) + ip6tables_globals.opts = + xtables_options_xfrm( + ip6tables_globals.orig_opts, + ip6tables_globals.opts, + xt_t->x6_options, + &xt_t->option_offset); + else + ip6tables_globals.opts = + xtables_merge_options( + ip6tables_globals.orig_opts, + ip6tables_globals.opts, + xt_t->extra_opts, + &xt_t->option_offset); + + if (!ip6tables_globals.opts) { + g_free(xt_t->t); + xt_t = NULL; + } - if (iptables_globals.opts == NULL) { - g_free(xt_t->t); - xt_t = NULL; + break; } return xt_t; @@ -1582,56 +2836,107 @@ static struct xtables_match *prepare_matches(struct connman_iptables *table, { struct xtables_match *xt_m; size_t match_size; + int err; + + if (!table || !match_name) + return NULL; - if (match_name == NULL) + enable_jmp(); + + if ((err = setjmp(env_state)) != 0) { + DBG("setjmp() called by longjmp() with value %d", err); + disable_jmp(); return NULL; + } xt_m = xtables_find_match(match_name, XTF_LOAD_MUST_SUCCEED, xt_rm); - match_size = ALIGN(sizeof(struct ipt_entry_match)) + xt_m->size; + + disable_jmp(); + + switch (table->type) { + case AF_INET: + match_size = XT_ALIGN(sizeof(struct ipt_entry_match)) + + xt_m->size; + break; + case AF_INET6: + match_size = XT_ALIGN(sizeof(struct ip6t_entry_match)) + + xt_m->size; + break; + default: + return NULL; + } xt_m->m = g_try_malloc0(match_size); - if (xt_m->m == NULL) + if (!xt_m->m) return NULL; xt_m->m->u.match_size = match_size; - strcpy(xt_m->m->u.user.name, xt_m->name); + g_stpcpy(xt_m->m->u.user.name, xt_m->name); xt_m->m->u.user.revision = xt_m->revision; - if (xt_m->init != NULL) + if (xt_m->init) xt_m->init(xt_m->m); - if (xt_m == xt_m->next) - goto done; - -#if XTABLES_VERSION_CODE > 5 - if (xt_m->x6_options != NULL) - iptables_globals.opts = - xtables_options_xfrm( - iptables_globals.orig_opts, - iptables_globals.opts, - xt_m->x6_options, - &xt_m->option_offset); - else -#endif + switch (table->type) { + case AF_INET: + if (xt_m->x6_options) iptables_globals.opts = - xtables_merge_options( -#if XTABLES_VERSION_CODE > 5 - iptables_globals.orig_opts, -#endif - iptables_globals.opts, - xt_m->extra_opts, - &xt_m->option_offset); + xtables_options_xfrm( + iptables_globals.orig_opts, + iptables_globals.opts, + xt_m->x6_options, + &xt_m->option_offset); + else + iptables_globals.opts = + xtables_merge_options( + iptables_globals.orig_opts, + iptables_globals.opts, + xt_m->extra_opts, + &xt_m->option_offset); - if (iptables_globals.opts == NULL) { - g_free(xt_m->m); - xt_m = NULL; + if (!iptables_globals.opts) { + g_free(xt_m->m); + + if (xt_m == xt_m->next) + free(xt_m); + + xt_m = NULL; + } + + break; + case AF_INET6: + if (xt_m->x6_options) + ip6tables_globals.opts = + xtables_options_xfrm( + ip6tables_globals.orig_opts, + ip6tables_globals.opts, + xt_m->x6_options, + &xt_m->option_offset); + else + ip6tables_globals.opts = + xtables_merge_options( + ip6tables_globals.orig_opts, + ip6tables_globals.opts, + xt_m->extra_opts, + &xt_m->option_offset); + + if (!ip6tables_globals.opts) { + g_free(xt_m->m); + + if (xt_m == xt_m->next) + free(xt_m); + + xt_m = NULL; + } + + break; } -done: return xt_m; } -static int parse_ip_and_mask(const char *str, struct in_addr *ip, struct in_addr *mask) +static int parse_ip_and_mask(const char *str, struct in_addr *ip, + struct in_addr *mask) { char **tokens; uint32_t prefixlength; @@ -1639,7 +2944,7 @@ static int parse_ip_and_mask(const char *str, struct in_addr *ip, struct in_addr int err; tokens = g_strsplit(str, "/", 2); - if (tokens == NULL) + if (!tokens) return -1; if (!inet_pton(AF_INET, tokens[0], ip)) { @@ -1647,14 +2952,16 @@ static int parse_ip_and_mask(const char *str, struct in_addr *ip, struct in_addr goto out; } - if (tokens[1] != NULL) { + if (tokens[1]) { prefixlength = strtol(tokens[1], NULL, 10); - if (prefixlength > 31) { + if (prefixlength > 32) { err = -1; goto out; + } else if (prefixlength == 32) { + tmp = 0xffffffff; + } else { + tmp = ~(0xffffffff >> prefixlength); } - - tmp = ~(0xffffffff >> prefixlength); } else { tmp = 0xffffffff; } @@ -1668,22 +2975,96 @@ out: return err; } -static struct connman_iptables *pre_load_table(const char *table_name, - struct connman_iptables *table) +static int parse_ipv6_and_mask(const char *str, struct in6_addr *ip, + struct in6_addr *mask) +{ + char **tokens; + uint32_t prefixlength; + struct in6_addr in6; + int i, j; + int err; + + tokens = g_strsplit(str, "/", 2); + if (!tokens) + return -1; + + if (!inet_pton(AF_INET6, tokens[0], ip)) { + err = -1; + goto out; + } + + if (tokens[1]) { + prefixlength = strtol(tokens[1], NULL, 10); + if (prefixlength > 128) { + err = -1; + goto out; + } + } else { + prefixlength = 128; + } + + /* + * This part was adapted from (no need to re-invent the wheel): + * https://gitlab.com/ipcalc/ipcalc/blob/master/ipcalc.c#L733 + */ + memset(&in6, 0, sizeof(struct in6_addr)); + + for (i = prefixlength, j = 0; i > 0; i -= 8, j++) { + if (i >= 8) + in6.s6_addr[j] = 0xff; + else + in6.s6_addr[j] = (unsigned long)(0xffU << (8 - i)); + } + + memcpy(mask, &in6, sizeof(struct in6_addr)); + + for (i = 0; i < 16 ; i++) + ip->s6_addr[i] = ip->s6_addr[i] & mask->s6_addr[i]; + + err = 0; +out: + g_strfreev(tokens); + + return err; +} + +static struct connman_iptables *get_table(int type, const char *table_name) { - if (table != NULL) + struct connman_iptables *table = NULL; + + if (!table_name) + table_name = "filter"; + + table = hash_table_lookup(type, table_name); + + if (table) return table; - return iptables_init(table_name); + table = iptables_init(type, table_name); + + if (!table) + return NULL; + + if (table->name) + g_free(table->name); + + table->name = g_strdup(table_name); + + hash_table_replace(type, table->name, table); + + return table; } struct parse_context { + int type; int argc; char **argv; struct ipt_ip *ip; + struct ip6t_ip6 *ipv6; struct xtables_target *xt_t; - struct xtables_match *xt_m; + GList *xt_m; struct xtables_rule_match *xt_rm; + uint16_t proto; }; static int prepare_getopt_args(const char *str, struct parse_context *ctx) @@ -1700,7 +3081,7 @@ static int prepare_getopt_args(const char *str, struct parse_context *ctx) /* Don't forget the last NULL entry */ ctx->argv = g_try_malloc0((ctx->argc + 1) * sizeof(char *)); - if (ctx->argv == NULL) { + if (!ctx->argv) { g_strfreev(tokens); return -ENOMEM; } @@ -1718,23 +3099,48 @@ static int prepare_getopt_args(const char *str, struct parse_context *ctx) return 0; } -#if XTABLES_VERSION_CODE > 5 - -static int parse_xt_modules(int c, connman_bool_t invert, +static int parse_xt_modules(int c, bool invert, struct parse_context *ctx) { struct xtables_match *m; struct xtables_rule_match *rm; + struct ipt_entry fw; + struct ip6t_entry fw6; + int err; + + switch (ctx->type) { + case AF_INET: + memset(&fw, 0, sizeof(fw)); + + /* The SNAT parser wants to know the protocol. */ + if (ctx->proto == 0) + ctx->proto = IPPROTO_IP; + + fw.ip.proto = ctx->proto; + break; + case AF_INET6: + memset(&fw6, 0, sizeof(fw6)); + + if (ctx->proto == 0) + ctx->proto = IPPROTO_IPV6; + + fw6.ipv6.proto = ctx->proto; - DBG("xtables version code > 5"); + /* Flags must be set for IPv6 if protocol is set. */ + fw6.ipv6.flags |= IP6T_F_PROTO; - for (rm = ctx->xt_rm; rm != NULL; rm = rm->next) { + break; + default: + return 0; + } + + for (rm = ctx->xt_rm; rm; rm = rm->next) { if (rm->completed != 0) continue; m = rm->match; - if (m->x6_parse == NULL && m->parse == NULL) + if (!m->x6_parse && !m->parse) continue; if (c < (int) m->option_offset || @@ -1742,13 +3148,30 @@ static int parse_xt_modules(int c, connman_bool_t invert, + XT_OPTION_OFFSET_SCALE) continue; - xtables_option_mpcall(c, ctx->argv, invert, m, NULL); + enable_jmp(); + + if ((err = setjmp(env_state)) != 0) { + DBG("setjmp() called by longjmp() with value %d", err); + disable_jmp(); + return -EINVAL; + } + + switch (ctx->type) { + case AF_INET: + xtables_option_mpcall(c, ctx->argv, invert, m, &fw); + break; + case AF_INET6: + xtables_option_mpcall(c, ctx->argv, invert, m, &fw6); + break; + } + + disable_jmp(); } - if (ctx->xt_t == NULL) + if (!ctx->xt_t) return 0; - if (ctx->xt_t->x6_parse == NULL && ctx->xt_t->parse == NULL) + if (!ctx->xt_t->x6_parse && !ctx->xt_t->parse) return 0; if (c < (int) ctx->xt_t->option_offset || @@ -1756,83 +3179,63 @@ static int parse_xt_modules(int c, connman_bool_t invert, + XT_OPTION_OFFSET_SCALE) return 0; - xtables_option_tpcall(c, ctx->argv, invert, ctx->xt_t, NULL); - - return 0; -} - -static int final_check_xt_modules(struct parse_context *ctx) -{ - struct xtables_rule_match *rm; + enable_jmp(); - DBG("xtables version code > 5"); + if ((err = setjmp(env_state)) != 0) { + DBG("setjmp() called by longjmp() with value %d", err); + disable_jmp(); + return -EINVAL; + } - for (rm = ctx->xt_rm; rm != NULL; rm = rm->next) - xtables_option_mfcall(rm->match); + switch (ctx->type) { + case AF_INET: + xtables_option_tpcall(c, ctx->argv, invert, ctx->xt_t, &fw); + break; + case AF_INET6: + xtables_option_tpcall(c, ctx->argv, invert, ctx->xt_t, &fw6); + break; + } - if (ctx->xt_t != NULL) - xtables_option_tfcall(ctx->xt_t); + disable_jmp(); return 0; } -#else - -static int parse_xt_modules(int c, connman_bool_t invert, - struct parse_context *ctx) +static int final_check_xt_modules(struct parse_context *ctx) { - struct xtables_match *m; struct xtables_rule_match *rm; int err; - DBG("xtables version code <= 5"); - - for (rm = ctx->xt_rm; rm != NULL; rm = rm->next) { - if (rm->completed == 1) - continue; + for (rm = ctx->xt_rm; rm; rm = rm->next) { + enable_jmp(); - m = rm->match; + if ((err = setjmp(env_state)) != 0) { + DBG("setjmp() called by longjmp() with value %d", err); + disable_jmp(); + return -EINVAL; + } - if (m->parse == NULL) - continue; + xtables_option_mfcall(rm->match); - err = m->parse(c - m->option_offset, - argv, invert, &m->mflags, - NULL, &m->m); - if (err > 0) - return -err; + disable_jmp(); } - if (ctx->xt_t == NULL) - return 0; - - if (ctx->xt_t->parse == NULL) - return 0; - - err = ctx->xt_m->parse(c - ctx->xt_m->option_offset, - ctx->argv, invert, &ctx->xt_m->mflags, - NULL, &ctx->xt_m->m); - return -err; -} - -static int final_check_xt_modules(struct parse_context *ctx) -{ - struct xtables_rule_match *rm; + enable_jmp(); - DBG("xtables version code <= 5"); + if ((err = setjmp(env_state)) != 0) { + DBG("setjmp() called by longjmp() with value %d", err); + disable_jmp(); + return -EINVAL; + } - for (rm = ctx->xt_rm; rm != NULL; rm = rm->next) - if (rm->match->final_check != NULL) - rm->match->final_check(rm->match->mflags); + if (ctx->xt_t) + xtables_option_tfcall(ctx->xt_t); - if (ctx->xt_t != NULL && ctx->xt_t->final_check != NULL) - ctx->xt_t->final_check(ctx->xt_t->tflags); + disable_jmp(); return 0; } -#endif - static int parse_rule_spec(struct connman_iptables *table, struct parse_context *ctx) { @@ -1844,7 +3247,7 @@ static int parse_rule_spec(struct connman_iptables *table, * - if '!' is found, set the invert flag to true and * removes the '!' from the optarg string and jumps * back to getopt to reparse the current optarg string. - * After reparsing the invert flag is reseted to false. + * After reparsing the invert flag is reset to false. * - If 'm' or 'j' is found then call either * prepare_matches() or prepare_target(). Those function * will modify (extend) the longopts for getopt_long. @@ -1912,14 +3315,32 @@ static int parse_rule_spec(struct connman_iptables *table, * xtables_option_mpcall() depending on which version * of libxtables is found. */ - connman_bool_t invert = FALSE; + struct xtables_match *xt_m; + bool invert = false; int len, c, err; - DBG(""); + if (ctx->type != table->type) { + DBG("ctx->type %d does not match table->type %d", ctx->type, + table->type); + return -EINVAL; + } - ctx->ip = g_try_new0(struct ipt_ip, 1); - if (ctx->ip == NULL) - return -ENOMEM; + switch (ctx->type) { + case AF_INET: + ctx->ip = g_try_new0(struct ipt_ip, 1); + if (!ctx->ip) + return -ENOMEM; + + break; + case AF_INET6: + ctx->ipv6 = g_try_new0(struct ip6t_ip6, 1); + if (!ctx->ipv6) + return -ENOMEM; + + break; + default: + return -EINVAL; + } /* * Tell getopt_long not to generate error messages for unknown @@ -1929,29 +3350,58 @@ static int parse_rule_spec(struct connman_iptables *table, optind = 0; while ((c = getopt_long(ctx->argc, ctx->argv, - "-:d:i:o:s:m:j:", - iptables_globals.opts, NULL)) != -1) { + "-:d:i:o:s:m:j:p:", + ctx->type == AF_INET ? + iptables_globals.opts : + ip6tables_globals.opts, + NULL)) != -1) { switch (c) { case 's': - /* Source specification */ - if (!parse_ip_and_mask(optarg, - &ctx->ip->src, - &ctx->ip->smsk)) - break; + if (ctx->type == AF_INET) { + /* Source specification */ + if (!parse_ip_and_mask(optarg, + &ctx->ip->src, + &ctx->ip->smsk)) + break; + + if (invert) + ctx->ip->invflags |= IPT_INV_SRCIP; + } + + if (ctx->type == AF_INET6) { + if (!parse_ipv6_and_mask(optarg, + &ctx->ipv6->src, + &ctx->ipv6->smsk)) + break; - if (invert) - ctx->ip->invflags |= IPT_INV_SRCIP; + if (invert) + ctx->ipv6->invflags |= IP6T_INV_SRCIP; + } break; case 'd': - /* Destination specification */ - if (!parse_ip_and_mask(optarg, - &ctx->ip->dst, - &ctx->ip->dmsk)) - break; + if (ctx->type == AF_INET) { + /* Destination specification */ + if (!parse_ip_and_mask(optarg, + &ctx->ip->dst, + &ctx->ip->dmsk)) + break; + + if (invert) + ctx->ip->invflags |= IPT_INV_DSTIP; + } + + if (ctx->type == AF_INET6) { + /* Destination specification */ + if (!parse_ipv6_and_mask(optarg, + &ctx->ipv6->dst, + &ctx->ipv6->dmsk)) + break; + + if (invert) + ctx->ip->invflags |= IP6T_INV_DSTIP; + } - if (invert) - ctx->ip->invflags |= IPT_INV_DSTIP; break; case 'i': /* In interface specification */ @@ -1960,11 +3410,21 @@ static int parse_rule_spec(struct connman_iptables *table, if (len + 1 > IFNAMSIZ) break; - strcpy(ctx->ip->iniface, optarg); - memset(ctx->ip->iniface_mask, 0xff, len + 1); + if (ctx->type == AF_INET) { + g_stpcpy(ctx->ip->iniface, optarg); + memset(ctx->ip->iniface_mask, 0xff, len + 1); + + if (invert) + ctx->ip->invflags |= IPT_INV_VIA_IN; + } + + if (ctx->type == AF_INET6) { + g_stpcpy(ctx->ipv6->iniface, optarg); + memset(ctx->ipv6->iniface_mask, 0xff, len + 1); - if (invert) - ctx->ip->invflags |= IPT_INV_VIA_IN; + if (invert) + ctx->ipv6->invflags |= IP6T_INV_VIA_IN; + } break; case 'o': @@ -1974,26 +3434,74 @@ static int parse_rule_spec(struct connman_iptables *table, if (len + 1 > IFNAMSIZ) break; - strcpy(ctx->ip->outiface, optarg); - memset(ctx->ip->outiface_mask, 0xff, len + 1); + if (ctx->type == AF_INET) { + g_stpcpy(ctx->ip->outiface, optarg); + memset(ctx->ip->outiface_mask, 0xff, len + 1); + + if (invert) + ctx->ip->invflags |= IPT_INV_VIA_OUT; + } + + if (ctx->type == AF_INET6) { + g_stpcpy(ctx->ipv6->outiface, optarg); + memset(ctx->ipv6->outiface_mask, 0xff, len + 1); - if (invert) - ctx->ip->invflags |= IPT_INV_VIA_OUT; + if (invert) + ctx->ipv6->invflags |= IP6T_INV_VIA_OUT; + } break; case 'm': /* Matches */ - ctx->xt_m = prepare_matches(table, &ctx->xt_rm, optarg); - if (ctx->xt_m == NULL) { + xt_m = prepare_matches(table, &ctx->xt_rm, optarg); + if (!xt_m) { + err = -EINVAL; + goto out; + } + ctx->xt_m = g_list_append(ctx->xt_m, xt_m); + + break; + case 'p': + enable_jmp(); + + if ((err = setjmp(env_state)) != 0) { + DBG("setjmp() called by longjmp() with value " + "%d", err); + disable_jmp(); + + /* Errors from parse_rule_spec are negative */ err = -EINVAL; goto out; } + ctx->proto = xtables_parse_protocol(optarg); + + disable_jmp(); + + /* + * If protocol was set add it to ipt_ip. + * xtables_parse_protocol() returns 0 or + * UINT16_MAX (-1) on error + */ + if (ctx->proto > 0 && ctx->proto < UINT16_MAX) { + if (ctx->type == AF_INET) + ctx->ip->proto = ctx->proto; + + if (ctx->type == AF_INET6) { + ctx->ipv6->proto = ctx->proto; + + /* + * Flags must be set for IPv6 if + * protocol is set. + */ + ctx->ipv6->flags |= IP6T_F_PROTO; + } + } break; case 'j': /* Target */ ctx->xt_t = prepare_target(table, optarg); - if (ctx->xt_t == NULL) { + if (!ctx->xt_t) { err = -EINVAL; goto out; } @@ -2001,13 +3509,13 @@ static int parse_rule_spec(struct connman_iptables *table, break; case 1: if (optarg[0] == '!' && optarg[1] == '\0') { - invert = TRUE; + invert = true; /* Remove the '!' from the optarg */ optarg[0] = '\0'; /* - * And recall getopt_long without reseting + * And recall getopt_long without resetting * invert. */ continue; @@ -2018,11 +3526,13 @@ static int parse_rule_spec(struct connman_iptables *table, err = parse_xt_modules(c, invert, ctx); if (err == 1) continue; + else if (err == -EINVAL) + goto out; break; } - invert = FALSE; + invert = false; } err = final_check_xt_modules(ctx); @@ -2031,6 +3541,42 @@ out: return err; } +static int current_type = -1; + +static int setup_xtables(int type) +{ + int err; + + DBG("%d", type); + + if (type == current_type) + return 0; + + if (current_type != -1) + reset_xtables(); + + switch (type) { + case AF_INET: + err = xtables_init_all(&iptables_globals, NFPROTO_IPV4); + break; + case AF_INET6: + err = xtables_init_all(&ip6tables_globals, NFPROTO_IPV6); + break; + default: + return -1; + } + + if (!err) { + current_type = type; + } else { + connman_error("error initializing xtables"); + current_type = -1; + reset_xtables(); + } + + return err; +} + static void reset_xtables(void) { struct xtables_match *xt_m; @@ -2044,10 +3590,10 @@ static void reset_xtables(void) * Clear all flags because the flags are only valid * for one rule. */ - for (xt_m = xtables_matches; xt_m != NULL; xt_m = xt_m->next) + for (xt_m = xtables_matches; xt_m; xt_m = xt_m->next) xt_m->mflags = 0; - for (xt_t = xtables_targets; xt_t != NULL; xt_t = xt_t->next) { + for (xt_t = xtables_targets; xt_t; xt_t = xt_t->next) { xt_t->tflags = 0; xt_t->used = 0; } @@ -2067,19 +3613,32 @@ static void reset_xtables(void) static void cleanup_parse_context(struct parse_context *ctx) { struct xtables_rule_match *rm, *tmp; + GList *list; g_strfreev(ctx->argv); + g_free(ctx->ip); - if (ctx->xt_t != NULL) { + g_free(ctx->ipv6); + + if (ctx->xt_t) { g_free(ctx->xt_t->t); ctx->xt_t->t = NULL; } - if (ctx->xt_m != NULL) { - g_free(ctx->xt_m->m); - ctx->xt_m->m = NULL; + + for (list = ctx->xt_m; list; list = list->next) { + struct xtables_match *xt_m = list->data; + + g_free(xt_m->m); + + if (xt_m != xt_m->next) + continue; + + g_free(xt_m); } - for (tmp = NULL, rm = ctx->xt_rm; rm != NULL; rm = rm->next) { - if (tmp != NULL) + g_list_free(ctx->xt_m); + + for (tmp = NULL, rm = ctx->xt_rm; rm; rm = rm->next) { + if (tmp) g_free(tmp); tmp = rm; } @@ -2088,84 +3647,201 @@ static void cleanup_parse_context(struct parse_context *ctx) g_free(ctx); } -int __connman_iptables_new_chain(const char *table_name, +int __connman_iptables_dump(int type, const char *table_name) +{ + struct connman_iptables *table; + + DBG("%d -t %s -L", type, table_name); + + table = get_table(type, table_name); + if (!table) + return -EINVAL; + + dump_table(table); + + return 0; +} + +int __connman_iptables_new_chain(int type, + const char *table_name, const char *chain) { struct connman_iptables *table; - DBG("-t %s -N %s", table_name, chain); + DBG("%d -t %s -N %s", type, table_name, chain); - table = pre_load_table(table_name, NULL); - if (table == NULL) + table = get_table(type, table_name); + if (!table) { return -EINVAL; + } + + switch (type) { + case AF_INET: + case AF_INET6: + return iptables_add_chain(table, chain); + } - return iptables_add_chain(table, chain); + return -EINVAL; } -int __connman_iptables_delete_chain(const char *table_name, +int __connman_iptables_delete_chain(int type, + const char *table_name, const char *chain) { struct connman_iptables *table; - DBG("-t %s -X %s", table_name, chain); + DBG("%d -t %s -X %s", type, table_name, chain); - table = pre_load_table(table_name, NULL); - if (table == NULL) + table = get_table(type, table_name); + if (!table) return -EINVAL; return iptables_delete_chain(table, chain); } -int __connman_iptables_flush_chain(const char *table_name, +int __connman_iptables_flush_chain(int type, + const char *table_name, const char *chain) { struct connman_iptables *table; - DBG("-t %s -F %s", table_name, chain); + DBG("%d -t %s -F %s", type, table_name, chain); - table = pre_load_table(table_name, NULL); - if (table == NULL) + table = get_table(type, table_name); + if (!table) return -EINVAL; return iptables_flush_chain(table, chain); } -int __connman_iptables_change_policy(const char *table_name, +int __connman_iptables_find_chain(int type, + const char *table_name, + const char *chain) +{ + struct connman_iptables *table; + + DBG("%d -t %s -F %s", type, table_name, chain); + + table = get_table(type, table_name); + if (!table) + return -EINVAL; + + if(!find_chain_head(table, chain)) + return -ENOENT; // Not Found + + return 0; // Found +} + +int __connman_iptables_change_policy(int type, + const char *table_name, const char *chain, const char *policy) { struct connman_iptables *table; - DBG("-t %s -F %s", table_name, chain); + DBG("%d -t %s -F %s", type, table_name, chain); - table = pre_load_table(table_name, NULL); - if (table == NULL) + table = get_table(type, table_name); + if (!table) return -EINVAL; return iptables_change_policy(table, chain, policy); } -int __connman_iptables_append(const char *table_name, +static void iptables_ip_setup(struct iptables_ip *ip, struct parse_context *ctx) +{ + if (!ip || !ctx) + return; + + ip->type = ctx->type; + ip->ip = ctx->ip; + ip->ip6 = ctx->ipv6; +} + +int __connman_iptables_append(int type, + const char *table_name, + const char *chain, + const char *rule_spec) +{ + struct connman_iptables *table; + struct parse_context *ctx; + struct iptables_ip ip = { 0 }; + const char *target_name; + int err; + + err = setup_xtables(type); + + if (err < 0) + return err; + + ctx = g_try_new0(struct parse_context, 1); + if (!ctx) + return -ENOMEM; + + ctx->type = type; + + DBG("%d -t %s -A %s %s", type, table_name, chain, rule_spec); + + err = prepare_getopt_args(rule_spec, ctx); + if (err < 0) + goto out; + + table = get_table(type, table_name); + if (!table) { + err = -EINVAL; + goto out; + } + + err = parse_rule_spec(table, ctx); + if (err < 0) + goto out; + + if (!ctx->xt_t) + target_name = NULL; + else + target_name = ctx->xt_t->name; + + iptables_ip_setup(&ip, ctx); + + err = iptables_append_rule(table, &ip, chain, target_name, ctx->xt_t, + ctx->xt_rm); +out: + cleanup_parse_context(ctx); + reset_xtables(); + + return err; +} + +int __connman_iptables_insert(int type, + const char *table_name, const char *chain, const char *rule_spec) { struct connman_iptables *table; struct parse_context *ctx; + struct iptables_ip ip = { 0 }; const char *target_name; int err; + err = setup_xtables(type); + + if (err < 0) + return err; + ctx = g_try_new0(struct parse_context, 1); - if (ctx == NULL) + if (!ctx) return -ENOMEM; - DBG("-t %s -A %s %s", table_name, chain, rule_spec); + ctx->type = type; + + DBG("%d -t %s -I %s %s", type, table_name, chain, rule_spec); err = prepare_getopt_args(rule_spec, ctx); if (err < 0) goto out; - table = pre_load_table(table_name, NULL); - if (table == NULL) { + table = get_table(type, table_name); + if (!table) { err = -EINVAL; goto out; } @@ -2174,13 +3850,15 @@ int __connman_iptables_append(const char *table_name, if (err < 0) goto out; - if (ctx->xt_t == NULL) + if (!ctx->xt_t) target_name = NULL; else target_name = ctx->xt_t->name; - err = iptables_insert_rule(table, ctx->ip, chain, - target_name, ctx->xt_t, ctx->xt_rm); + iptables_ip_setup(&ip, ctx); + + err = iptables_insert_rule(table, &ip, chain, target_name, ctx->xt_t, + ctx->xt_rm); out: cleanup_parse_context(ctx); reset_xtables(); @@ -2188,27 +3866,36 @@ out: return err; } -int __connman_iptables_delete(const char *table_name, +int __connman_iptables_delete(int type, + const char *table_name, const char *chain, const char *rule_spec) { struct connman_iptables *table; struct parse_context *ctx; + struct iptables_ip ip = { 0 }; const char *target_name; int err; + err = setup_xtables(type); + + if (err < 0) + return err; + ctx = g_try_new0(struct parse_context, 1); - if (ctx == NULL) + if (!ctx) return -ENOMEM; - DBG("-t %s -D %s %s", table_name, chain, rule_spec); + ctx->type = type; + + DBG("%d -t %s -D %s %s", type, table_name, chain, rule_spec); err = prepare_getopt_args(rule_spec, ctx); if (err < 0) goto out; - table = pre_load_table(table_name, NULL); - if (table == NULL) { + table = get_table(type, table_name); + if (!table) { err = -EINVAL; goto out; } @@ -2217,14 +3904,15 @@ int __connman_iptables_delete(const char *table_name, if (err < 0) goto out; - if (ctx->xt_t == NULL) + if (!ctx->xt_t) target_name = NULL; else target_name = ctx->xt_t->name; - err = iptables_delete_rule(table, ctx->ip, chain, - target_name, ctx->xt_t, ctx->xt_m, - ctx->xt_rm); + iptables_ip_setup(&ip, ctx); + + err = iptables_delete_rule(table, &ip, chain, target_name, ctx->xt_t, + ctx->xt_m, ctx->xt_rm); out: cleanup_parse_context(ctx); reset_xtables(); @@ -2232,34 +3920,97 @@ out: return err; } -int __connman_iptables_commit(const char *table_name) +int __connman_iptables_commit(int type, const char *table_name) { struct connman_iptables *table; - struct ipt_replace *repl; + struct iptables_replace repl = { 0 }; int err; + struct xt_counters_info *counters; + struct connman_iptables_entry *e; + GList *list; + unsigned int cnt; - DBG("%s", table_name); + err = setup_xtables(type); - table = g_hash_table_lookup(table_hash, table_name); - if (table == NULL) + if (err < 0) + return err; + + DBG("%d %s", type, table_name); + + repl.type = type; + + table = hash_table_lookup(type, table_name); + if (!table) return -EINVAL; - repl = iptables_blob(table); + switch (type) { + case AF_INET: + repl.r = iptables_blob(table); + if (!repl.r) + return -ENOMEM; - if (debug_enabled == TRUE) - dump_ipt_replace(repl); + break; + case AF_INET6: + repl.r6 = ip6tables_blob(table); + if (!repl.r6) + return -ENOMEM; + } - err = iptables_replace(table, repl); + if (debug_enabled) + dump_replace(&repl); - g_free(repl->counters); - g_free(repl); + err = iptables_replace(table, &repl); if (err < 0) - return err; + goto out_free; + + counters = g_try_malloc0(sizeof(*counters) + + sizeof(struct xt_counters) * table->num_entries); + if (!counters) { + err = -ENOMEM; + goto out_hash_remove; + } + g_stpcpy(counters->name, iptables_table_get_info_name(table)); + counters->num_counters = table->num_entries; + for (list = table->entries, cnt = 0; list; list = list->next, cnt++) { + e = list->data; + if (e->counter_idx >= 0) { - g_hash_table_remove(table_hash, table_name); + switch (type) { + case AF_INET: + counters->counters[cnt] = + repl.r->counters[e->counter_idx]; + break; + case AF_INET6: + counters->counters[cnt] = + repl.r6->counters[e->counter_idx]; + break; + } + } + } + err = iptables_add_counters(table, counters); + g_free(counters); - return 0; + if (err < 0) + goto out_hash_remove; + + err = 0; + +out_hash_remove: + hash_table_remove(type, table_name); +out_free: + if (type == AF_INET && repl.r) + g_free(repl.r->counters); + + if (type == AF_INET6 && repl.r6) + g_free(repl.r6->counters); + + g_free(repl.r); + g_free(repl.r6); + + reset_xtables(); + + return err; } static void remove_table(gpointer user_data) @@ -2269,64 +4020,74 @@ static void remove_table(gpointer user_data) table_cleanup(table); } -static int flush_table_cb(struct ipt_entry *entry, int builtin, +static int iterate_chains_cb(struct connman_iptables_entry *entry, int builtin, unsigned int hook, size_t size, unsigned int offset, void *user_data) { - GSList **chains = user_data; + struct cb_data *cbd = user_data; + connman_iptables_iterate_chains_cb_t cb = cbd->cb; struct xt_entry_target *target; - char *name; - if (offset + entry->next_offset == size) + if (offset + iptables_entry_get_next_offset(entry) == size) return 0; - target = ipt_get_target(entry); - - if (!strcmp(target->u.user.name, IPT_ERROR_TARGET)) - name = g_strdup((const char*)target->data); - else if (builtin >= 0) - name = g_strdup(hooknames[builtin]); - else - return 0; + target = iptables_entry_get_target(entry); - *chains = g_slist_prepend(*chains, name); + if (!g_strcmp0(target->u.user.name, get_error_target(entry->type))) { + (*cb)((const char *)target->data, cbd->user_data); + } else if (builtin >= 0) { + (*cb)(hooknames[builtin], cbd->user_data); + } return 0; } -void flush_table(const char *name) +int __connman_iptables_iterate_chains(int type, const char *table_name, + connman_iptables_iterate_chains_cb_t cb, + void *user_data) { - GSList *chains = NULL, *list; + struct cb_data *cbd = cb_data_new(cb, user_data); struct connman_iptables *table; + struct connman_iptables_entry entry = { 0 }; + int err; - table = pre_load_table(name, NULL); - if (table == NULL) - return; + err = setup_xtables(type); +#if defined TIZEN_EXT + if (err < 0) { + g_free(cbd); + return err; + } +#else + if (err < 0) + return err; +#endif + + table = get_table(type, table_name); + if (!table) { + g_free(cbd); + return -EINVAL; + } - iterate_entries(table->blob_entries->entrytable, - table->info->valid_hooks, - table->info->hook_entry, - table->info->underflow, - table->blob_entries->size, - flush_table_cb, &chains); + entry.type = type; + if (type == AF_INET) + entry.entry = table->blob_entries->entrytable; - /* - * The offset update code is fragile and it works - * only safe if we remove elements and move forwards - * in the table. - */ - chains = g_slist_reverse(chains); + if (type == AF_INET6) + entry.entry6 = table->blob_entries6->entrytable; - for (list = chains; list != NULL; list = list->next) { - char *chain = list->data; + iterate_entries(&entry, + iptables_table_get_info_valid_hooks(table), + iptables_table_get_info_hook_entry(table), + iptables_table_get_info_underflow(table), + iptables_table_get_entries_size(table), + iterate_chains_cb, cbd); - DBG("chain %s", chain); - iptables_flush_chain(table, chain); - } + g_free(cbd); - __connman_iptables_commit(name); - g_slist_free_full(chains, g_free); + reset_xtables(); + + return 0; } int __connman_iptables_init(void) @@ -2334,12 +4095,13 @@ int __connman_iptables_init(void) DBG(""); if (getenv("CONNMAN_IPTABLES_DEBUG")) - debug_enabled = TRUE; + debug_enabled = true; table_hash = g_hash_table_new_full(g_str_hash, g_str_equal, - g_free, remove_table); + NULL, remove_table); - xtables_init_all(&iptables_globals, NFPROTO_IPV4); + table_hash_ipv6 = g_hash_table_new_full(g_str_hash, g_str_equal, + NULL, remove_table); return 0; } @@ -2349,4 +4111,6 @@ void __connman_iptables_cleanup(void) DBG(""); g_hash_table_destroy(table_hash); + g_hash_table_destroy(table_hash_ipv6); } +