X-Git-Url: http://review.tizen.org/git/?a=blobdiff_plain;f=src%2Fiptables.c;h=47ea1c2d975c438e1c62c54d53d3a9b50d43f432;hb=dd3cccc5e67548dcc2dd6c6254ed6c97859085d5;hp=3e3c68327316238ae274aff9f8298e0e24a26698;hpb=142d8fef7d5531653aa8767e7ce32b683b9e128b;p=platform%2Fupstream%2Fconnman.git diff --git a/src/iptables.c b/src/iptables.c index 3e3c683..47ea1c2 100644 --- a/src/iptables.c +++ b/src/iptables.c @@ -2,7 +2,7 @@ * * Connection Manager * - * Copyright (C) 2007-2012 Intel Corporation. All rights reserved. + * Copyright (C) 2007-2013 Intel Corporation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 as @@ -28,14 +28,17 @@ #include #include #include -#include +#include #include #include +#include +#include #include +#include #include "connman.h" - +#include "src/shared/util.h" /* * Some comments on how the iptables API works (some of them from the @@ -59,7 +62,7 @@ * - ipt_entry->target_offset = Size of ipt_entry + matches * - ipt_entry->next_offset = Size of ipt_entry + matches + target * - IPT_SO_SET_REPLACE is used to write a table (contains the complete - * - hook_entry and overflow mark the begining and the end of a chain, e.g + * - hook_entry and overflow mark the beginning and the end of a chain, e.g * entry hook: pre/in/fwd/out/post -1/0/352/504/-1 * underflow: pre/in/fwd/out/post -1/200/352/904/-1 * means that INPUT starts at offset 0 and ends at 200 (the start offset to @@ -127,6 +130,10 @@ * End of CHAIN */ +/* + * Values for the index values used here are defined as equal for both IPv4 + * and IPv6 (NF_IP_* and NF_IP6_*) in Netfilter headers. + */ static const char *hooknames[] = { [NF_IP_PRE_ROUTING] = "PREROUTING", [NF_IP_LOCAL_IN] = "INPUT", @@ -142,27 +149,25 @@ static const char *hooknames[] = { #define XT_OPTION_OFFSET_SCALE 256 -#define MIN_ALIGN (__alignof__(struct ipt_entry)) - -#define ALIGN(s) (((s) + ((MIN_ALIGN)-1)) & ~((MIN_ALIGN)-1)) - -struct error_target { - struct xt_entry_target t; - char error[IPT_TABLE_MAXNAMELEN]; -}; - struct connman_iptables_entry { - int offset; + int type; + unsigned int offset; int builtin; + int counter_idx; struct ipt_entry *entry; + struct ip6t_entry *entry6; }; struct connman_iptables { + int type; + char *name; int ipt_sock; struct ipt_getinfo *info; struct ipt_get_entries *blob_entries; + struct ip6t_getinfo *info6; + struct ip6t_get_entries *blob_entries6; unsigned int num_entries; unsigned int old_entries; @@ -175,106 +180,457 @@ struct connman_iptables { }; static GHashTable *table_hash = NULL; -static gboolean debug_enabled = FALSE; +static GHashTable *table_hash_ipv6 = NULL; +static bool debug_enabled = false; + +struct iptables_ip { + int type; + struct ipt_ip *ip; + struct ip6t_ip6 *ip6; +}; + +struct iptables_replace { + int type; + struct ipt_replace *r; + struct ip6t_replace *r6; +}; + +static jmp_buf env_state; +static bool jmp_set = false; + +static void enable_jmp() +{ + jmp_set = true; +} + +static void disable_jmp() +{ + jmp_set = false; +} + +static bool can_jmp() +{ + DBG("%s", jmp_set ? "true" : "false"); + return jmp_set; +} + +typedef int (*iterate_entries_cb_t)(struct connman_iptables_entry *entry, + int builtin, unsigned int hook, + size_t size, unsigned int offset, + void *user_data); + +static u_int16_t iptables_entry_get_next_offset( + struct connman_iptables_entry *entry) +{ + if (!entry) + return 0; + + switch (entry->type) { + case AF_INET: + return entry->entry ? entry->entry->next_offset : 0; + case AF_INET6: + return entry->entry6 ? entry->entry6->next_offset : 0; + } + + return 0; +} + +static u_int16_t iptables_entry_get_target_offset( + struct connman_iptables_entry *entry) +{ + if (!entry) + return 0; + + switch (entry->type) { + case AF_INET: + return entry->entry ? entry->entry->target_offset : 0; + case AF_INET6: + return entry->entry6 ? entry->entry6->target_offset : 0; + } + + return 0; +} + +static unsigned char *iptables_entry_get_elems( + struct connman_iptables_entry *entry) +{ + if (!entry) + return NULL; + + switch (entry->type) { + case AF_INET: + return entry->entry ? entry->entry->elems : NULL; + case AF_INET6: + return entry->entry6 ? entry->entry6->elems : NULL; + } + + return NULL; +} + +static struct xt_entry_target *iptables_entry_get_target( + struct connman_iptables_entry *entry) +{ + if (!entry) + return NULL; + + switch (entry->type) { + case AF_INET: + return entry->entry ? ipt_get_target(entry->entry) : NULL; + case AF_INET6: + return entry->entry6 ? ip6t_get_target(entry->entry6) : NULL; + } + + return NULL; +} + +static struct xt_counters *iptables_entry_get_counters( + struct connman_iptables_entry *entry) +{ + if (!entry) + return NULL; + + switch (entry->type) { + case AF_INET: + return entry->entry ? &entry->entry->counters : NULL; + case AF_INET6: + return entry->entry6 ? &entry->entry6->counters : NULL; + } + + return NULL; +} + +static void iptables_entry_free(struct connman_iptables_entry *entry) +{ + if (!entry) + return; + + g_free(entry->entry); + g_free(entry->entry6); + g_free(entry); +} + +static const char *iptables_table_get_info_name(struct connman_iptables* table) +{ + if (!table) + return NULL; + + switch (table->type) { + case AF_INET: + return table->info->name; + case AF_INET6: + return table->info6->name; + } + + return NULL; +} + +static unsigned int iptables_table_get_info_num_entries( + struct connman_iptables* table) +{ + if (!table) + return 0; + + switch (table->type) { + case AF_INET: + return table->info->num_entries; + case AF_INET6: + return table->info6->num_entries; + } + + return 0; +} + +static unsigned int iptables_table_get_info_size(struct connman_iptables* table) +{ + if (!table) + return 0; + + switch (table->type) { + case AF_INET: + return table->info->size; + case AF_INET6: + return table->info6->size; + } + + return 0; +} + +static unsigned int iptables_table_get_info_valid_hooks( + struct connman_iptables* table) +{ + if (!table) + return 0; + + switch (table->type) { + case AF_INET: + return table->info->valid_hooks; + case AF_INET6: + return table->info6->valid_hooks; + } + + return 0; +} + +static unsigned int *iptables_table_get_info_hook_entry( + struct connman_iptables* table) +{ + if (!table) + return NULL; + + switch (table->type) { + case AF_INET: + return table->info->hook_entry; + case AF_INET6: + return table->info6->hook_entry; + } + + return NULL; +} + +static unsigned int *iptables_table_get_info_underflow( + struct connman_iptables* table) +{ + if (!table) + return NULL; + + switch (table->type) { + case AF_INET: + return table->info->underflow; + case AF_INET6: + return table->info6->underflow; + } + + return NULL; +} + +static unsigned int iptables_table_get_entries_size( + struct connman_iptables* table) +{ + if (!table) + return 0; + + switch (table->type) { + case AF_INET: + return table->blob_entries->size; + case AF_INET6: + return table->blob_entries6->size; + } + + return 0; +} + +static const char *get_error_target(int type) +{ + switch (type) { + case AF_INET: + return IPT_ERROR_TARGET; + case AF_INET6: + return IP6T_ERROR_TARGET; + default: + return XT_ERROR_TARGET; + } +} + +static const char *get_standard_target(int type) +{ + switch (type) { + case AF_INET: + return IPT_STANDARD_TARGET; + case AF_INET6: + return IP6T_STANDARD_TARGET; + default: + return XT_STANDARD_TARGET; + } +} + +static struct connman_iptables *hash_table_lookup(int type, + const char *table_name) { + + switch (type) { + case AF_INET: + return g_hash_table_lookup(table_hash, table_name); + case AF_INET6: + return g_hash_table_lookup(table_hash_ipv6, table_name); + } + + return NULL; +} + +static bool hash_table_replace(int type, + char *table_name, + struct connman_iptables *table) { + + switch (type) { + case AF_INET: + return g_hash_table_replace(table_hash, table_name, table); + case AF_INET6: + return g_hash_table_replace(table_hash_ipv6, table_name, table); + } + + return false; +} -typedef int (*iterate_entries_cb_t)(struct ipt_entry *entry, int builtin, - unsigned int hook,size_t size, - unsigned int offset, void *user_data); +static bool hash_table_remove(int type, const char *table_name) +{ + switch (type) { + case AF_INET: + return g_hash_table_remove(table_hash, table_name); + case AF_INET6: + return g_hash_table_remove(table_hash_ipv6, table_name); + } + + return false; +} + +static unsigned int next_hook_entry_index(unsigned int *valid_hooks) +{ + unsigned int h; + + if (*valid_hooks == 0) + return NF_INET_NUMHOOKS; + + h = __builtin_ffs(*valid_hooks) - 1; + *valid_hooks ^= (1 << h); -static int iterate_entries(struct ipt_entry *entries, + return h; +} + +static int iterate_entries(struct connman_iptables_entry *entries, unsigned int valid_hooks, unsigned int *hook_entry, + unsigned int *underflow, size_t size, iterate_entries_cb_t cb, void *user_data) { - unsigned int i, h; + unsigned int offset, h, hook; int builtin, err; - struct ipt_entry *entry; + struct connman_iptables_entry entry; - if (valid_hooks != 0) - h = __builtin_ffs(valid_hooks) - 1; - else - h = NF_INET_NUMHOOKS; + if (!entries) + return -EINVAL; + + switch (entries->type) { + case AF_INET: + if (!entries->entry) + return -EINVAL; + + break; + case AF_INET6: + if (!entries->entry6) + return -EINVAL; - for (i = 0, entry = entries; i < size; - i += entry->next_offset) { + break; + default: + return -EINVAL; + } + + h = next_hook_entry_index(&valid_hooks); + hook = h; + + entry.type = entries->type; + entry.entry = entries->entry; + entry.entry6 = entries->entry6; + + for (offset = 0; offset < size; + offset += iptables_entry_get_next_offset(&entry)) { builtin = -1; - entry = (void *)entries + i; + + switch (entries->type) { + case AF_INET: + entry.entry = (void* )entries->entry + offset; + break; + case AF_INET6: + entry.entry6 = (void* )entries->entry6 + offset; + break; + } /* - * Find next valid hook which offset is higher - * or equal with the current offset. + * Updating builtin, hook and h is very tricky. + * The rules are: + * - builtin is only set to the current hook number + * if the current entry is the hook entry (aka chain + * head). And only for builtin chains, never for + * the user chains. + * - hook is the current hook number. If we + * look at user chains it needs to be NF_INET_NETNUMHOOKS. + * - h is the next hook entry. Thous we need to be carefully + * not to access the table when h is NF_INET_NETNUMHOOKS. */ - if (h < NF_INET_NUMHOOKS) { - if (hook_entry[h] < i) { - valid_hooks ^= (1 << h); - - if (valid_hooks != 0) - h = __builtin_ffs(valid_hooks) - 1; - else - h = NF_INET_NUMHOOKS; - } - - if (hook_entry[h] == i) - builtin = h; + if (h < NF_INET_NUMHOOKS && hook_entry[h] == offset) { + builtin = h; + hook = h; } - err = cb(entry, builtin, h, size, i, user_data); + if (h == NF_INET_NUMHOOKS) + hook = h; + + if (h < NF_INET_NUMHOOKS && underflow[h] <= offset) + h = next_hook_entry_index(&valid_hooks); + + err = cb(&entry, builtin, hook, size, offset, user_data); if (err < 0) return err; - } return 0; } -static int print_entry(struct ipt_entry *entry, int builtin, unsigned int hook, - size_t size, unsigned int offset, - void *user_data) +static int print_entry(struct connman_iptables_entry *entry, int builtin, + unsigned int hook, size_t size, + unsigned int offset, void *user_data) { - iterate_entries_cb_t cb = user_data; + iterate_entries_cb_t cb; + struct xt_counters *counters; + + cb = user_data; + counters = iptables_entry_get_counters(entry); - DBG("entry %p hook %d offset %d size %d", entry, hook, - offset, entry->next_offset); + DBG("entry %p hook %u offset %u size %u packets %"PRIu64" " + "bytes %"PRIu64, entry, hook, offset, + iptables_entry_get_next_offset(entry), + (uint64_t) counters->pcnt, (uint64_t) counters->bcnt); return cb(entry, builtin, hook, size, offset, NULL); } static int target_to_verdict(const char *target_name) { - if (!strcmp(target_name, LABEL_ACCEPT)) + if (!g_strcmp0(target_name, LABEL_ACCEPT)) return -NF_ACCEPT - 1; - if (!strcmp(target_name, LABEL_DROP)) + if (!g_strcmp0(target_name, LABEL_DROP)) return -NF_DROP - 1; - if (!strcmp(target_name, LABEL_QUEUE)) + if (!g_strcmp0(target_name, LABEL_QUEUE)) return -NF_QUEUE - 1; - if (!strcmp(target_name, LABEL_RETURN)) + if (!g_strcmp0(target_name, LABEL_RETURN)) return XT_RETURN; return 0; } -static gboolean is_builtin_target(const char *target_name) +static bool is_builtin_target(const char *target_name) { - if (!strcmp(target_name, LABEL_ACCEPT) || - !strcmp(target_name, LABEL_DROP) || - !strcmp(target_name, LABEL_QUEUE) || - !strcmp(target_name, LABEL_RETURN)) - return TRUE; + if (!g_strcmp0(target_name, LABEL_ACCEPT) || + !g_strcmp0(target_name, LABEL_DROP) || + !g_strcmp0(target_name, LABEL_QUEUE) || + !g_strcmp0(target_name, LABEL_RETURN)) + return true; - return FALSE; + return false; } -static gboolean is_jump(struct connman_iptables_entry *e) +static bool is_jump(struct connman_iptables_entry *e) { struct xt_entry_target *target; - target = ipt_get_target(e->entry); + target = iptables_entry_get_target(e); + + if (!target) + return false; - if (!strcmp(target->u.user.name, IPT_STANDARD_TARGET)) { + if (!g_strcmp0(target->u.user.name, get_standard_target(e->type))) { struct xt_standard_target *t; t = (struct xt_standard_target *)target; @@ -295,21 +651,45 @@ static gboolean is_jump(struct connman_iptables_entry *e) return false; } -static gboolean is_chain(struct connman_iptables *table, +static bool is_fallthrough(struct connman_iptables_entry *e) +{ + struct xt_entry_target *target; + + target = iptables_entry_get_target(e); + + if (!target) + return false; + + if (!g_strcmp0(target->u.user.name, get_standard_target(e->type))) { + struct xt_standard_target *t; + + t = (struct xt_standard_target *)target; + if (t->verdict == 0) + return true; + } + return false; +} + +static bool is_chain(struct connman_iptables *table, struct connman_iptables_entry *e) { - struct ipt_entry *entry; struct xt_entry_target *target; - entry = e->entry; + if (!e) + return false; + if (e->builtin >= 0) - return TRUE; + return true; + + target = iptables_entry_get_target(e); + + if (!target) + return false; - target = ipt_get_target(entry); - if (!strcmp(target->u.user.name, IPT_ERROR_TARGET)) - return TRUE; + if (!g_strcmp0(target->u.user.name, get_error_target(e->type))) + return true; - return FALSE; + return false; } static GList *find_chain_head(struct connman_iptables *table, @@ -317,23 +697,35 @@ static GList *find_chain_head(struct connman_iptables *table, { GList *list; struct connman_iptables_entry *head; - struct ipt_entry *entry; struct xt_entry_target *target; int builtin; + + switch (table->type) { + case AF_INET: + case AF_INET6: + break; + default: + return NULL; + } for (list = table->entries; list; list = list->next) { head = list->data; - entry = head->entry; /* Buit-in chain */ builtin = head->builtin; - if (builtin >= 0 && !strcmp(hooknames[builtin], chain_name)) + + if (builtin >= 0 && !g_strcmp0(hooknames[builtin], chain_name)) break; /* User defined chain */ - target = ipt_get_target(entry); - if (!strcmp(target->u.user.name, IPT_ERROR_TARGET) && - !strcmp((char *)target->data, chain_name)) + target = iptables_entry_get_target(head); + + if (!target) + continue; + + if (!g_strcmp0(target->u.user.name, + get_error_target(table->type)) && + !g_strcmp0((char *)target->data, chain_name)) break; } @@ -347,7 +739,7 @@ static GList *find_chain_tail(struct connman_iptables *table, GList *chain_head, *list; chain_head = find_chain_head(table, chain_name); - if (chain_head == NULL) + if (!chain_head) return NULL; /* Then we look for the next chain */ @@ -362,7 +754,6 @@ static GList *find_chain_tail(struct connman_iptables *table, return g_list_last(table->entries); } - static void update_offsets(struct connman_iptables *table) { GList *list, *prev; @@ -381,21 +772,22 @@ static void update_offsets(struct connman_iptables *table) prev_entry = prev->data; entry->offset = prev_entry->offset + - prev_entry->entry->next_offset; + iptables_entry_get_next_offset( + prev_entry); } } static void update_targets_reference(struct connman_iptables *table, struct connman_iptables_entry *entry_before, struct connman_iptables_entry *modified_entry, - gboolean is_removing) + bool is_removing) { struct connman_iptables_entry *tmp; struct xt_standard_target *t; GList *list; - int offset; + unsigned int offset; - offset = modified_entry->entry->next_offset; + offset = iptables_entry_get_next_offset(modified_entry); for (list = table->entries; list; list = list->next) { tmp = list->data; @@ -403,9 +795,13 @@ static void update_targets_reference(struct connman_iptables *table, if (!is_jump(tmp)) continue; - t = (struct xt_standard_target *)ipt_get_target(tmp->entry); + t = (struct xt_standard_target *) + iptables_entry_get_target(tmp); + + if (!t) + continue; - if (is_removing == TRUE) { + if (is_removing) { if (t->verdict >= entry_before->offset) t->verdict -= offset; } else { @@ -413,41 +809,69 @@ static void update_targets_reference(struct connman_iptables *table, t->verdict += offset; } } + + if (is_fallthrough(modified_entry)) { + t = (struct xt_standard_target *) + iptables_entry_get_target(modified_entry); + + if (!t) + return; + + t->verdict = entry_before->offset + + iptables_entry_get_target_offset(modified_entry) + + XT_ALIGN(sizeof(struct xt_standard_target)); + t->target.u.target_size = + XT_ALIGN(sizeof(struct xt_standard_target)); + } } static int iptables_add_entry(struct connman_iptables *table, - struct ipt_entry *entry, GList *before, - int builtin) + struct connman_iptables_entry *entry, + GList *before, int builtin, int counter_idx) { struct connman_iptables_entry *e, *entry_before; - if (table == NULL) - return -1; + if (!table) { + return -EINVAL; + } e = g_try_malloc0(sizeof(struct connman_iptables_entry)); - if (e == NULL) - return -1; + if (!e) + return -ENOMEM; + + switch (table->type) { + case AF_INET: + e->entry = entry->entry; + break; + case AF_INET6: + e->entry6 = entry->entry6; + break; + default: + g_free(e); + return -EINVAL; + } - e->entry = entry; + e->type = entry->type; e->builtin = builtin; + e->counter_idx = counter_idx; table->entries = g_list_insert_before(table->entries, before, e); table->num_entries++; - table->size += entry->next_offset; - - if (before == NULL) { - e->offset = table->size - entry->next_offset; + table->size += iptables_entry_get_next_offset(e); + if (!before) { + e->offset = table->size - + iptables_entry_get_next_offset(e); return 0; } entry_before = before->data; /* - * We've just appended/insterted a new entry. All references + * We've just appended/inserted a new entry. All references * should be bumped accordingly. */ - update_targets_reference(table, entry_before, e, FALSE); + update_targets_reference(table, entry_before, e, false); update_offsets(table); @@ -458,18 +882,44 @@ static int remove_table_entry(struct connman_iptables *table, struct connman_iptables_entry *entry) { int removed = 0; + u_int16_t next_offset; + next_offset = iptables_entry_get_next_offset(entry); table->num_entries--; - table->size -= entry->entry->next_offset; - removed = entry->entry->next_offset; - g_free(entry->entry); + table->size -= next_offset; + removed = next_offset; table->entries = g_list_remove(table->entries, entry); + iptables_entry_free(entry); + return removed; } +static void delete_update_hooks(struct connman_iptables *table, + int builtin, GList *chain_head, + int removed) +{ + struct connman_iptables_entry *e; + GList *list; + + e = chain_head->data; + e->builtin = builtin; + + table->underflow[builtin] -= removed; + + for (list = chain_head->next; list; list = list->next) { + e = list->data; + + if (e->builtin < 0) + continue; + + table->hook_entry[e->builtin] -= removed; + table->underflow[e->builtin] -= removed; + } +} + static int iptables_flush_chain(struct connman_iptables *table, const char *name) { @@ -477,12 +927,14 @@ static int iptables_flush_chain(struct connman_iptables *table, struct connman_iptables_entry *entry; int builtin, removed = 0; + DBG("table %s chain %s", table->name, name); + chain_head = find_chain_head(table, name); - if (chain_head == NULL) + if (!chain_head) return -EINVAL; chain_tail = find_chain_tail(table, name); - if (chain_tail == NULL) + if (!chain_tail) return -EINVAL; entry = chain_head->data; @@ -505,26 +957,8 @@ static int iptables_flush_chain(struct connman_iptables *table, list = next; } - if (builtin >= 0) { - struct connman_iptables_entry *e; - - entry = list->data; - - entry->builtin = builtin; - - table->underflow[builtin] -= removed; - - for (list = chain_tail; list; list = list->next) { - e = list->data; - - builtin = e->builtin; - if (builtin < 0) - continue; - - table->hook_entry[builtin] -= removed; - table->underflow[builtin] -= removed; - } - } + if (builtin >= 0) + delete_update_hooks(table, builtin, chain_tail->prev, removed); update_offsets(table); @@ -535,14 +969,30 @@ static int iptables_add_chain(struct connman_iptables *table, const char *name) { GList *last; - struct ipt_entry *entry_head; - struct ipt_entry *entry_return; - struct error_target *error; - struct ipt_standard_target *standard; + struct ipt_entry *entry_head = NULL; + struct ipt_entry *entry_return = NULL; + struct ip6t_entry *entry6_head = NULL; + struct ip6t_entry *entry6_return = NULL; + struct connman_iptables_entry entry = { 0 }; + struct xt_error_target *error = NULL; + struct ipt_standard_target *standard = NULL; u_int16_t entry_head_size, entry_return_size; + size_t entry_struct_size = 0; + size_t xt_error_target_size = 0; + size_t standard_target_size = 0; + + DBG("table %s chain %s", table->name, name); + + entry.type = table->type; + + /* Do not allow to add duplicate chains */ + if (find_chain_head(table, name)) + return -EEXIST; last = g_list_last(table->entries); + xt_error_target_size = XT_ALIGN(sizeof(struct xt_error_target)); + /* * An empty chain is composed of: * - A head entry, with no match and an error target. @@ -553,51 +1003,93 @@ static int iptables_add_chain(struct connman_iptables *table, */ /* head entry */ - entry_head_size = sizeof(struct ipt_entry) + - sizeof(struct error_target); - entry_head = g_try_malloc0(entry_head_size); - if (entry_head == NULL) - goto err_head; + switch (entry.type) { + case AF_INET: + entry_struct_size = XT_ALIGN(sizeof(struct ipt_entry)); + entry_head_size = entry_struct_size + xt_error_target_size; - memset(entry_head, 0, entry_head_size); + entry_head = g_try_malloc0(entry_head_size); + if (!entry_head) + goto err_head; - entry_head->target_offset = sizeof(struct ipt_entry); - entry_head->next_offset = entry_head_size; + entry_head->target_offset = entry_struct_size; + entry_head->next_offset = entry_head_size; - error = (struct error_target *) entry_head->elems; - strcpy(error->t.u.user.name, IPT_ERROR_TARGET); - error->t.u.user.target_size = ALIGN(sizeof(struct error_target)); - strcpy(error->error, name); + error = (struct xt_error_target *) entry_head->elems; - if (iptables_add_entry(table, entry_head, last, -1) < 0) - goto err_head; + entry.entry = entry_head; + break; + case AF_INET6: + entry_struct_size = XT_ALIGN(sizeof(struct ip6t_entry)); + entry_head_size = entry_struct_size + xt_error_target_size; + + entry6_head = g_try_malloc0(entry_head_size); + if (!entry6_head) + goto err_head; + + entry6_head->target_offset = entry_struct_size; + entry6_head->next_offset = entry_head_size; + + error = (struct xt_error_target *) entry6_head->elems; + + entry.entry6 = entry6_head; + break; + default: + return -EINVAL; + } + + g_stpcpy(error->target.u.user.name, get_error_target(entry.type)); + error->target.u.user.target_size = xt_error_target_size; + g_stpcpy(error->errorname, name); + + if (iptables_add_entry(table, &entry, last, -1, -1) < 0) + goto err_head; + + standard_target_size = XT_ALIGN(sizeof(struct ipt_standard_target)); + entry_return_size = entry_struct_size + standard_target_size; /* tail entry */ - entry_return_size = sizeof(struct ipt_entry) + - sizeof(struct ipt_standard_target); - entry_return = g_try_malloc0(entry_return_size); - if (entry_return == NULL) - goto err; + switch (entry.type) { + case AF_INET: + entry_return = g_try_malloc0(entry_return_size); + if (!entry_return) + goto err; + + entry_return->target_offset = entry_struct_size; + entry_return->next_offset = entry_return_size; + + standard = (struct ipt_standard_target *) entry_return->elems; + + entry.entry = entry_return; + break; + case AF_INET6: + entry6_return = g_try_malloc0(entry_return_size); + if (!entry6_return) + goto err; + + entry6_return->target_offset = entry_struct_size; + entry6_return->next_offset = entry_return_size; - memset(entry_return, 0, entry_return_size); + standard = (struct ipt_standard_target *) entry6_return->elems; - entry_return->target_offset = sizeof(struct ipt_entry); - entry_return->next_offset = entry_return_size; + entry.entry6 = entry6_return; + break; + } - standard = (struct ipt_standard_target *) entry_return->elems; - standard->target.u.user.target_size = - ALIGN(sizeof(struct ipt_standard_target)); + standard->target.u.user.target_size = standard_target_size; standard->verdict = XT_RETURN; - if (iptables_add_entry(table, entry_return, last, -1) < 0) + if (iptables_add_entry(table, &entry, last, -1, -1) < 0) goto err; return 0; err: g_free(entry_return); + g_free(entry6_return); err_head: g_free(entry_head); + g_free(entry6_head); return -ENOMEM; } @@ -608,8 +1100,10 @@ static int iptables_delete_chain(struct connman_iptables *table, struct connman_iptables_entry *entry; GList *chain_head, *chain_tail; + DBG("table %s chain %s", table->name, name); + chain_head = find_chain_head(table, name); - if (chain_head == NULL) + if (!chain_head) return -EINVAL; entry = chain_head->data; @@ -619,7 +1113,7 @@ static int iptables_delete_chain(struct connman_iptables *table, return -EINVAL; chain_tail = find_chain_tail(table, name); - if (chain_tail == NULL) + if (!chain_tail) return -EINVAL; /* Chain must be flushed */ @@ -636,60 +1130,111 @@ static int iptables_delete_chain(struct connman_iptables *table, return 0; } -static struct ipt_entry *new_rule(struct ipt_ip *ip, +static struct connman_iptables_entry *new_rule(struct iptables_ip *ip, const char *target_name, struct xtables_target *xt_t, struct xtables_rule_match *xt_rm) { struct xtables_rule_match *tmp_xt_rm; - struct ipt_entry *new_entry; + struct connman_iptables_entry *new_entry; size_t match_size, target_size; + new_entry = g_try_malloc0(sizeof(struct connman_iptables_entry)); + + if (!new_entry) + return NULL; + + new_entry->type = ip->type; + match_size = 0; - for (tmp_xt_rm = xt_rm; tmp_xt_rm != NULL; tmp_xt_rm = tmp_xt_rm->next) + for (tmp_xt_rm = xt_rm; tmp_xt_rm; tmp_xt_rm = tmp_xt_rm->next) match_size += tmp_xt_rm->match->m->u.match_size; if (xt_t) - target_size = ALIGN(xt_t->t->u.target_size); + target_size = xt_t->t->u.target_size; else - target_size = ALIGN(sizeof(struct xt_standard_target)); - - new_entry = g_try_malloc0(sizeof(struct ipt_entry) + target_size + - match_size); - if (new_entry == NULL) - return NULL; - - memcpy(&new_entry->ip, ip, sizeof(struct ipt_ip)); - - new_entry->target_offset = sizeof(struct ipt_entry) + match_size; - new_entry->next_offset = sizeof(struct ipt_entry) + target_size + - match_size; + target_size = XT_ALIGN(sizeof(struct xt_standard_target)); + + switch (ip->type) { + case AF_INET: + new_entry->entry = g_try_malloc0( + XT_ALIGN(sizeof(struct ipt_entry)) + + target_size + match_size); + if (!new_entry->entry) + goto err; + + memcpy(&new_entry->entry->ip, ip->ip, sizeof(struct ipt_ip)); + + new_entry->entry->target_offset = + XT_ALIGN(sizeof(struct ipt_entry)) + + match_size; + new_entry->entry->next_offset = + XT_ALIGN(sizeof(struct ipt_entry)) + + target_size + match_size; + break; + case AF_INET6: + new_entry->entry6 = g_try_malloc0( + XT_ALIGN(sizeof(struct ip6t_entry)) + + target_size + match_size); + if (!new_entry->entry6) + goto err; + + memcpy(&new_entry->entry6->ipv6, ip->ip6, + sizeof(struct ip6t_ip6)); + + new_entry->entry6->target_offset = + XT_ALIGN(sizeof(struct ip6t_entry)) + + match_size; + new_entry->entry6->next_offset = + XT_ALIGN(sizeof(struct ip6t_entry)) + + target_size + match_size; + break; + default: + goto err; + } match_size = 0; - for (tmp_xt_rm = xt_rm; tmp_xt_rm != NULL; + for (tmp_xt_rm = xt_rm; tmp_xt_rm; tmp_xt_rm = tmp_xt_rm->next) { - memcpy(new_entry->elems + match_size, tmp_xt_rm->match->m, + + switch (new_entry->type) { + case AF_INET: + memcpy(new_entry->entry->elems + match_size, + tmp_xt_rm->match->m, + tmp_xt_rm->match->m->u.match_size); + break; + case AF_INET6: + memcpy(new_entry->entry6->elems + match_size, + tmp_xt_rm->match->m, tmp_xt_rm->match->m->u.match_size); + break; + } match_size += tmp_xt_rm->match->m->u.match_size; } if (xt_t) { struct xt_entry_target *entry_target; - entry_target = ipt_get_target(new_entry); + entry_target = iptables_entry_get_target(new_entry); memcpy(entry_target, xt_t->t, target_size); } return new_entry; + +err: + g_free(new_entry); + + return NULL; } static void update_hooks(struct connman_iptables *table, GList *chain_head, - struct ipt_entry *entry) + struct connman_iptables_entry *entry) { GList *list; struct connman_iptables_entry *head, *e; int builtin; + u_int16_t next_offset; - if (chain_head == NULL) + if (!table || !chain_head) return; head = chain_head->data; @@ -698,7 +1243,9 @@ static void update_hooks(struct connman_iptables *table, GList *chain_head, if (builtin < 0) return; - table->underflow[builtin] += entry->next_offset; + next_offset = iptables_entry_get_next_offset(entry); + + table->underflow[builtin] += next_offset; for (list = chain_head->next; list; list = list->next) { e = list->data; @@ -707,32 +1254,45 @@ static void update_hooks(struct connman_iptables *table, GList *chain_head, if (builtin < 0) continue; - table->hook_entry[builtin] += entry->next_offset; - table->underflow[builtin] += entry->next_offset; + table->hook_entry[builtin] += next_offset; + table->underflow[builtin] += next_offset; } } -static struct ipt_entry *prepare_rule_inclusion(struct connman_iptables *table, - struct ipt_ip *ip, const char *chain_name, +static struct connman_iptables_entry *prepare_rule_inclusion( + struct connman_iptables *table, + struct iptables_ip *ip, + const char *chain_name, const char *target_name, struct xtables_target *xt_t, - int *builtin, struct xtables_rule_match *xt_rm) + int *builtin, + struct xtables_rule_match *xt_rm, + bool insert) { GList *chain_tail, *chain_head; - struct ipt_entry *new_entry; struct connman_iptables_entry *head; + struct connman_iptables_entry *new_entry; chain_head = find_chain_head(table, chain_name); - if (chain_head == NULL) + if (!chain_head) return NULL; chain_tail = find_chain_tail(table, chain_name); - if (chain_tail == NULL) + if (!chain_tail) return NULL; new_entry = new_rule(ip, target_name, xt_t, xt_rm); - if (new_entry == NULL) - return NULL; + + switch (new_entry->type) { + case AF_INET: + if (new_entry->entry) + break; + case AF_INET6: + if (new_entry->entry6) + break; + default: + goto err; + } update_hooks(table, chain_head, new_entry); @@ -744,92 +1304,194 @@ static struct ipt_entry *prepare_rule_inclusion(struct connman_iptables *table, head = chain_head->data; if (head->builtin < 0) *builtin = -1; - else if (chain_head == chain_tail->prev) { + else if (insert || chain_head == chain_tail->prev) { *builtin = head->builtin; head->builtin = -1; } return new_entry; + +err: + g_free(new_entry); + + return NULL; } static int iptables_append_rule(struct connman_iptables *table, - struct ipt_ip *ip, char *chain_name, - char *target_name, struct xtables_target *xt_t, + struct iptables_ip *ip, + const char *chain_name, + const char *target_name, + struct xtables_target *xt_t, struct xtables_rule_match *xt_rm) { - GList *chain_tail; - struct ipt_entry *new_entry; + struct connman_iptables_entry *new_entry; int builtin = -1, ret; + GList *chain_tail; - DBG(""); + DBG("table %s chain %s", table->name, chain_name); chain_tail = find_chain_tail(table, chain_name); - if (chain_tail == NULL) + if (!chain_tail) return -EINVAL; - new_entry = prepare_rule_inclusion(table, ip, chain_name, - target_name, xt_t, &builtin, xt_rm); - if (new_entry == NULL) + new_entry = prepare_rule_inclusion(table, ip, chain_name, target_name, + xt_t, &builtin, xt_rm, false); + + if (!new_entry) return -EINVAL; - ret = iptables_add_entry(table, new_entry, chain_tail->prev, builtin); + switch (new_entry->type) { + case AF_INET: + if (new_entry->entry) + break; + case AF_INET6: + if (new_entry->entry6) + break; + default: + ret = -EINVAL; + goto err; + } + + ret = iptables_add_entry(table, new_entry, chain_tail->prev, + builtin, -1); if (ret < 0) - g_free(new_entry); + goto err; + + /* + * Free only the container, not the content iptables_add_entry() + * allocates new containers for entries. + */ + g_free(new_entry); + + return ret; + +err: + iptables_entry_free(new_entry); return ret; } static int iptables_insert_rule(struct connman_iptables *table, - struct ipt_ip *ip, const char *chain_name, + struct iptables_ip *ip, + const char *chain_name, const char *target_name, struct xtables_target *xt_t, struct xtables_rule_match *xt_rm) { - struct ipt_entry *new_entry; + struct connman_iptables_entry *new_entry; int builtin = -1, ret; GList *chain_head; + DBG("table %s chain %s", table->name, chain_name); + chain_head = find_chain_head(table, chain_name); - if (chain_head == NULL) + if (!chain_head) return -EINVAL; - new_entry = prepare_rule_inclusion(table, ip, chain_name, - target_name, xt_t, &builtin, xt_rm); - if (new_entry == NULL) + new_entry = prepare_rule_inclusion(table, ip, chain_name, target_name, + xt_t, &builtin, xt_rm, true); + + if (!new_entry) return -EINVAL; + switch (new_entry->type) { + case AF_INET: + if (new_entry->entry) + break; + case AF_INET6: + if (new_entry->entry6) + break; + default: + ret = -EINVAL; + goto err; + } + if (builtin == -1) chain_head = chain_head->next; - ret = iptables_add_entry(table, new_entry, chain_head, builtin); + ret = iptables_add_entry(table, new_entry, chain_head, builtin, -1); if (ret < 0) - g_free(new_entry); + goto err; + + /* + * Free only the container, not the content iptables_add_entry() + * allocates new containers for entries. + */ + g_free(new_entry); + + return ret; + +err: + iptables_entry_free(new_entry); return ret; } -static gboolean is_same_ipt_entry(struct ipt_entry *i_e1, +static bool is_same_ipt_entry(struct ipt_entry *i_e1, struct ipt_entry *i_e2) { if (memcmp(&i_e1->ip, &i_e2->ip, sizeof(struct ipt_ip)) != 0) - return FALSE; + return false; + + if (i_e1->target_offset != i_e2->target_offset) + return false; + + if (i_e1->next_offset != i_e2->next_offset) + return false; + + return true; +} + +/* A copy of is_same_ipt_entry with IPv6 structures */ +static bool is_same_ip6t_entry(struct ip6t_entry *i_e1, + struct ip6t_entry *i_e2) +{ + if (memcmp(&i_e1->ipv6, &i_e2->ipv6, sizeof(struct ip6t_ip6)) != 0) + return false; if (i_e1->target_offset != i_e2->target_offset) - return FALSE; + return false; if (i_e1->next_offset != i_e2->next_offset) - return FALSE; + return false; + + return true; +} - return TRUE; +static bool is_same_iptables_entry(struct connman_iptables_entry *e1, + struct connman_iptables_entry *e2) +{ + if (e1->type != e2->type) + return false; + + switch (e1->type) { + case AF_INET: + return is_same_ipt_entry(e1->entry, e2->entry); + case AF_INET6: + return is_same_ip6t_entry(e1->entry6, e2->entry6); + } + + return false; } -static gboolean is_same_target(struct xt_entry_target *xt_e_t1, +static bool is_same_target(struct xt_entry_target *xt_e_t1, struct xt_entry_target *xt_e_t2) { - if (xt_e_t1 == NULL || xt_e_t2 == NULL) - return FALSE; + unsigned int i; - if (strcmp(xt_e_t1->u.user.name, IPT_STANDARD_TARGET) == 0) { + if (!xt_e_t1 || !xt_e_t2) + return false; + + if (g_strcmp0(xt_e_t1->u.user.name, "") == 0 && + g_strcmp0(xt_e_t2->u.user.name, "") == 0) { + /* fallthrough */ + return true; + + /* + * IPT_STANDARD_TARGET and IP6T_STANDARD_TARGET are defined by + * XT_STANDARD_TARGET + */ + } else if (g_strcmp0(xt_e_t1->u.user.name, XT_STANDARD_TARGET) == 0) { struct xt_standard_target *xt_s_t1; struct xt_standard_target *xt_s_t2; @@ -837,69 +1499,96 @@ static gboolean is_same_target(struct xt_entry_target *xt_e_t1, xt_s_t2 = (struct xt_standard_target *) xt_e_t2; if (xt_s_t1->verdict != xt_s_t2->verdict) - return FALSE; + return false; } else { if (xt_e_t1->u.target_size != xt_e_t2->u.target_size) - return FALSE; + return false; + + if (g_strcmp0(xt_e_t1->u.user.name, xt_e_t2->u.user.name) != 0) + return false; - if (strcmp(xt_e_t1->u.user.name, xt_e_t2->u.user.name) != 0) - return FALSE; + for (i = 0; i < xt_e_t1->u.target_size - + sizeof(struct xt_standard_target); i++) { + if ((xt_e_t1->data[i] ^ xt_e_t2->data[i]) != 0) + return false; + } } - return TRUE; + return true; } -static gboolean is_same_match(struct xt_entry_match *xt_e_m1, +static bool is_same_match(struct xt_entry_match *xt_e_m1, struct xt_entry_match *xt_e_m2) { - if (xt_e_m1 == NULL || xt_e_m2 == NULL) - return FALSE; + unsigned int i; + + if (!xt_e_m1 || !xt_e_m2) + return false; if (xt_e_m1->u.match_size != xt_e_m2->u.match_size) - return FALSE; + return false; if (xt_e_m1->u.user.revision != xt_e_m2->u.user.revision) - return FALSE; + return false; - if (strcmp(xt_e_m1->u.user.name, xt_e_m2->u.user.name) != 0) - return FALSE; + if (g_strcmp0(xt_e_m1->u.user.name, xt_e_m2->u.user.name) != 0) + return false; + + for (i = 0; i < xt_e_m1->u.match_size - sizeof(struct xt_entry_match); + i++) { + if ((xt_e_m1->data[i] ^ xt_e_m2->data[i]) != 0) + return false; + } - return TRUE; + return true; } static GList *find_existing_rule(struct connman_iptables *table, - struct ipt_ip *ip, const char *chain_name, + struct iptables_ip *ip, + const char *chain_name, const char *target_name, struct xtables_target *xt_t, - struct xtables_match *xt_m, + GList *matches, struct xtables_rule_match *xt_rm) { GList *chain_tail, *chain_head, *list; struct xt_entry_target *xt_e_t = NULL; struct xt_entry_match *xt_e_m = NULL; struct connman_iptables_entry *entry; - struct ipt_entry *entry_test; + struct connman_iptables_entry *entry_test; int builtin; chain_head = find_chain_head(table, chain_name); - if (chain_head == NULL) + if (!chain_head) return NULL; chain_tail = find_chain_tail(table, chain_name); - if (chain_tail == NULL) + if (!chain_tail) return NULL; - if (!xt_t && !xt_m) + if (!xt_t && !matches) return NULL; entry_test = new_rule(ip, target_name, xt_t, xt_rm); - if (entry_test == NULL) + + switch (entry_test->type) { + case AF_INET: + if (!entry_test->entry) + return NULL; + break; + case AF_INET6: + if (!entry_test->entry6) + return NULL; + break; + default: return NULL; + } - if (xt_t != NULL) - xt_e_t = ipt_get_target(entry_test); - if (xt_m != NULL) - xt_e_m = (struct xt_entry_match *)entry_test->elems; + if (xt_t) + xt_e_t = iptables_entry_get_target(entry_test); + if (matches) + xt_e_m = (struct xt_entry_match *) + iptables_entry_get_elems(entry_test); entry = chain_head->data; builtin = entry->builtin; @@ -911,27 +1600,26 @@ static GList *find_existing_rule(struct connman_iptables *table, for (; list != chain_tail->prev; list = list->next) { struct connman_iptables_entry *tmp; - struct ipt_entry *tmp_e; tmp = list->data; - tmp_e = tmp->entry; - if (is_same_ipt_entry(entry_test, tmp_e) == FALSE) + if (!is_same_iptables_entry(entry_test, tmp)) continue; - if (xt_t != NULL) { - struct xt_entry_target *tmp_xt_e_t; + if (xt_t) { + struct xt_entry_target *tmp_xt_e_t = NULL; - tmp_xt_e_t = ipt_get_target(tmp_e); + tmp_xt_e_t = iptables_entry_get_target(tmp); if (!is_same_target(tmp_xt_e_t, xt_e_t)) continue; } - if (xt_m != NULL) { + if (matches) { struct xt_entry_match *tmp_xt_e_m; - tmp_xt_e_m = (struct xt_entry_match *)tmp_e->elems; + tmp_xt_e_m = (struct xt_entry_match *) + iptables_entry_get_elems(tmp); if (!is_same_match(tmp_xt_e_m, xt_e_m)) continue; @@ -940,7 +1628,7 @@ static GList *find_existing_rule(struct connman_iptables *table, break; } - g_free(entry_test); + iptables_entry_free(entry_test); if (list != chain_tail->prev) return list; @@ -949,113 +1637,116 @@ static GList *find_existing_rule(struct connman_iptables *table, } static int iptables_delete_rule(struct connman_iptables *table, - struct ipt_ip *ip, const char *chain_name, + struct iptables_ip *ip, + const char *chain_name, const char *target_name, struct xtables_target *xt_t, - struct xtables_match *xt_m, + GList *matches, struct xtables_rule_match *xt_rm) { struct connman_iptables_entry *entry; - GList *chain_tail, *list; + GList *chain_head, *chain_tail, *list; int builtin, removed; + DBG("table %s chain %s", table->name, chain_name); + removed = 0; + chain_head = find_chain_head(table, chain_name); + if (!chain_head) + return -EINVAL; + chain_tail = find_chain_tail(table, chain_name); - if (chain_tail == NULL) + if (!chain_tail) return -EINVAL; list = find_existing_rule(table, ip, chain_name, target_name, - xt_t, xt_m, xt_rm); - if (list == NULL) - return -EINVAL; + xt_t, matches, xt_rm); - entry = list->data; - if (entry == NULL) + if (!list) return -EINVAL; + entry = chain_head->data; builtin = entry->builtin; + if (builtin >= 0 && list == chain_head) { + /* + * We are about to remove the first rule in the + * chain. In this case we need to store the builtin + * value to the new chain_head. + * + * Note, for builtin chains, chain_head->next is + * always valid. A builtin chain has always a policy + * rule at the end. + */ + chain_head = chain_head->next; + + entry = chain_head->data; + entry->builtin = builtin; + } + + entry = list->data; + if (!entry) + return -EINVAL; + /* We have deleted a rule, * all references should be bumped accordingly */ - if (list->next != NULL) + if (list->next) update_targets_reference(table, list->next->data, - list->data, TRUE); + list->data, true); removed += remove_table_entry(table, entry); - if (builtin >= 0) { - list = list->next; - if (list) { - entry = list->data; - entry->builtin = builtin; - } - - table->underflow[builtin] -= removed; - for (list = chain_tail; list; list = list->next) { - entry = list->data; - - builtin = entry->builtin; - if (builtin < 0) - continue; - - table->hook_entry[builtin] -= removed; - table->underflow[builtin] -= removed; - } - } + if (builtin >= 0) + delete_update_hooks(table, builtin, chain_head, removed); update_offsets(table); return 0; } -static int iptables_compare_rule(struct connman_iptables *table, - struct ipt_ip *ip, const char *chain_name, - const char *target_name, - struct xtables_target *xt_t, - struct xtables_match *xt_m, - struct xtables_rule_match *xt_rm) -{ - struct connman_iptables_entry *entry; - GList *found; - - found = find_existing_rule(table, ip, chain_name, target_name, - xt_t, xt_m, xt_rm); - if (found == NULL) - return -EINVAL; - - entry = found->data; - if (entry == NULL) - return -EINVAL; - - return 0; -} - - static int iptables_change_policy(struct connman_iptables *table, const char *chain_name, const char *policy) { - GList *chain_head; + GList *chain_head, *chain_tail; struct connman_iptables_entry *entry; struct xt_entry_target *target; struct xt_standard_target *t; int verdict; + DBG("table %s chain %s policy %s", table->name, chain_name, policy); + verdict = target_to_verdict(policy); - if (verdict == 0) + switch (verdict) { + case -NF_ACCEPT - 1: + case -NF_DROP - 1: + break; + default: return -EINVAL; + } chain_head = find_chain_head(table, chain_name); - if (chain_head == NULL) + if (!chain_head) return -EINVAL; entry = chain_head->data; if (entry->builtin < 0) return -EINVAL; - target = ipt_get_target(entry->entry); + chain_tail = find_chain_tail(table, chain_name); + if (!chain_tail) + return -EINVAL; + + entry = chain_tail->prev->data; + + target = iptables_entry_get_target(entry); + + if (!target) + return -EINVAL; t = (struct xt_standard_target *)target; + if (t->verdict != verdict) + entry->counter_idx = -1; t->verdict = verdict; return 0; @@ -1069,19 +1760,19 @@ static struct ipt_replace *iptables_blob(struct connman_iptables *table) unsigned char *entry_index; r = g_try_malloc0(sizeof(struct ipt_replace) + table->size); - if (r == NULL) + if (!r) return NULL; memset(r, 0, sizeof(*r) + table->size); r->counters = g_try_malloc0(sizeof(struct xt_counters) * table->old_entries); - if (r->counters == NULL) { + if (!r->counters) { g_free(r); return NULL; } - strcpy(r->name, table->info->name); + g_stpcpy(r->name, table->info->name); r->num_entries = table->num_entries; r->size = table->size; @@ -1102,38 +1793,114 @@ static struct ipt_replace *iptables_blob(struct connman_iptables *table) return r; } -static void dump_ip(struct ipt_entry *entry) +/* A copy of iptables_blob() with IPv6 structures */ +static struct ip6t_replace *ip6tables_blob(struct connman_iptables *table) +{ + struct ip6t_replace *r; + GList *list; + struct connman_iptables_entry *e; + unsigned char *entry_index; + + r = g_try_malloc0(sizeof(struct ip6t_replace) + table->size); + if (!r) + return NULL; + + memset(r, 0, sizeof(*r) + table->size); + + r->counters = g_try_malloc0(sizeof(struct xt_counters) + * table->old_entries); + if (!r->counters) { + g_free(r); + return NULL; + } + + g_stpcpy(r->name, table->info6->name); + r->num_entries = table->num_entries; + r->size = table->size; + + r->num_counters = table->old_entries; + r->valid_hooks = table->info6->valid_hooks; + + memcpy(r->hook_entry, table->hook_entry, sizeof(table->hook_entry)); + memcpy(r->underflow, table->underflow, sizeof(table->underflow)); + + entry_index = (unsigned char *)r->entries; + for (list = table->entries; list; list = list->next) { + e = list->data; + + memcpy(entry_index, e->entry6, e->entry6->next_offset); + entry_index += e->entry6->next_offset; + } + + return r; +} + +static void dump_ip(struct connman_iptables_entry *entry) { - struct ipt_ip *ip = &entry->ip; + char *iniface, *outiface; char ip_string[INET6_ADDRSTRLEN]; char ip_mask[INET6_ADDRSTRLEN]; - if (strlen(ip->iniface)) - DBG("\tin %s", ip->iniface); + switch (entry->type) { + case AF_INET: + iniface = entry->entry->ip.iniface; + outiface = entry->entry->ip.outiface; + break; + case AF_INET6: + iniface = entry->entry6->ipv6.iniface; + outiface = entry->entry6->ipv6.outiface; + break; + default: + return; + } + + if (strlen(iniface)) + DBG("\tin %s", iniface); - if (strlen(ip->outiface)) - DBG("\tout %s", ip->outiface); + if (strlen(outiface)) + DBG("\tout %s", outiface); - if (inet_ntop(AF_INET, &ip->src, ip_string, INET6_ADDRSTRLEN) != NULL && - inet_ntop(AF_INET, &ip->smsk, - ip_mask, INET6_ADDRSTRLEN) != NULL) - DBG("\tsrc %s/%s", ip_string, ip_mask); + if (entry->type == AF_INET) { + if (inet_ntop(entry->type, &entry->entry->ip.src, ip_string, + INET6_ADDRSTRLEN) && inet_ntop(entry->type, + &entry->entry->ip.smsk, ip_mask, + INET6_ADDRSTRLEN)) + DBG("\tsrc %s/%s", ip_string, ip_mask); - if (inet_ntop(AF_INET, &ip->dst, ip_string, INET6_ADDRSTRLEN) != NULL && - inet_ntop(AF_INET, &ip->dmsk, - ip_mask, INET6_ADDRSTRLEN) != NULL) - DBG("\tdst %s/%s", ip_string, ip_mask); -} + if (inet_ntop(entry->type, &entry->entry->ip.dst, ip_string, + INET6_ADDRSTRLEN) && inet_ntop(entry->type, + &entry->entry->ip.dmsk, ip_mask, + INET6_ADDRSTRLEN)) + DBG("\tdst %s/%s", ip_string, ip_mask); + } -static void dump_target(struct ipt_entry *entry) + if (entry->type == AF_INET6) { + if (inet_ntop(entry->type, &entry->entry6->ipv6.src, ip_string, + INET6_ADDRSTRLEN) && inet_ntop(entry->type, + &entry->entry6->ipv6.smsk, ip_mask, + INET6_ADDRSTRLEN)) + DBG("\tsrc %s/%s", ip_string, ip_mask); + + if (inet_ntop(entry->type, &entry->entry6->ipv6.dst, ip_string, + INET6_ADDRSTRLEN) && inet_ntop(entry->type, + &entry->entry6->ipv6.dmsk, ip_mask, + INET6_ADDRSTRLEN)) + DBG("\tdst %s/%s", ip_string, ip_mask); + } +} +static void dump_target(struct connman_iptables_entry *entry) { struct xtables_target *xt_t; struct xt_entry_target *target; + int err; + + target = iptables_entry_get_target(entry); - target = ipt_get_target(entry); + if (!target) + return; - if (!strcmp(target->u.user.name, IPT_STANDARD_TARGET)) { + if (!g_strcmp0(target->u.user.name, get_standard_target(entry->type))) { struct xt_standard_target *t; t = (struct xt_standard_target *)target; @@ -1164,81 +1931,149 @@ static void dump_target(struct ipt_entry *entry) break; } - xt_t = xtables_find_target(IPT_STANDARD_TARGET, + enable_jmp(); + + if ((err = setjmp(env_state)) != 0) { + DBG("setjmp() called by longjmp() with value %d", err); + disable_jmp(); + return; + } + + xt_t = xtables_find_target(get_standard_target(entry->type), XTF_LOAD_MUST_SUCCEED); - if(xt_t->print != NULL) + disable_jmp(); + + if (xt_t->print) xt_t->print(NULL, target, 1); } else { + enable_jmp(); + + if ((err = setjmp(env_state)) != 0) { + DBG("setjmp() called by longjmp() with value %d", err); + disable_jmp(); + return; + } + xt_t = xtables_find_target(target->u.user.name, XTF_TRY_LOAD); - if (xt_t == NULL) { + + disable_jmp(); + + if (!xt_t) { DBG("\ttarget %s", target->u.user.name); return; } - if(xt_t->print != NULL) { + if (xt_t->print) { DBG("\ttarget "); xt_t->print(NULL, target, 1); } } + + if (xt_t == xt_t->next) + free(xt_t); } -static void dump_match(struct ipt_entry *entry) +static void dump_match(struct connman_iptables_entry *entry) { struct xtables_match *xt_m; struct xt_entry_match *match; + u_int16_t target_offset; + int err; - if (entry->elems == (unsigned char *)entry + entry->target_offset) + target_offset = iptables_entry_get_target_offset(entry); + + switch (entry->type) { + case AF_INET: + if (entry->entry->elems == (unsigned char *)entry->entry + + target_offset) + return; + break; + case AF_INET6: + if (entry->entry6->elems == (unsigned char *)entry->entry6 + + target_offset) + return; + break; + default: return; + } - match = (struct xt_entry_match *) entry->elems; + match = (struct xt_entry_match *) iptables_entry_get_elems(entry); if (!strlen(match->u.user.name)) return; + enable_jmp(); + + if ((err = setjmp(env_state)) != 0) { + DBG("setjmp() called by longjmp() with value %d", err); + disable_jmp(); + return; + } + xt_m = xtables_find_match(match->u.user.name, XTF_TRY_LOAD, NULL); - if (xt_m == NULL) + + disable_jmp(); + + if (!xt_m) goto out; - if(xt_m->print != NULL) { + if (xt_m->print) { DBG("\tmatch "); xt_m->print(NULL, match, 1); return; } + if (xt_m == xt_m->next) + free(xt_m); out: DBG("\tmatch %s", match->u.user.name); } -static int dump_entry(struct ipt_entry *entry, int builtin, +static int dump_entry(struct connman_iptables_entry *entry, int builtin, unsigned int hook, size_t size, unsigned int offset, void *user_data) { struct xt_entry_target *target; + char *char_entry; + + target = iptables_entry_get_target(entry); - target = ipt_get_target(entry); + if (!target) + return -EINVAL; - if (offset + entry->next_offset == size) { + if (offset + iptables_entry_get_next_offset(entry) == size) { DBG("\tEnd of CHAIN"); return 0; } - if (!strcmp(target->u.user.name, IPT_ERROR_TARGET)) { + switch (entry->type) { + case AF_INET: + char_entry = (char *)entry->entry; + break; + case AF_INET6: + char_entry = (char *)entry->entry6; + break; + default: + return 0; + } + + if (!g_strcmp0(target->u.user.name, IPT_ERROR_TARGET)) { DBG("\tUSER CHAIN (%s) match %p target %p", - target->data, entry->elems, - (char *)entry + entry->target_offset); + target->data, iptables_entry_get_elems(entry), + char_entry + iptables_entry_get_target_offset(entry)); return 0; } else if (builtin >= 0) { DBG("\tCHAIN (%s) match %p target %p", - hooknames[builtin], entry->elems, - (char *)entry + entry->target_offset); + hooknames[builtin], iptables_entry_get_elems(entry), + char_entry + iptables_entry_get_target_offset(entry)); } else { DBG("\tRULE match %p target %p", - entry->elems, - (char *)entry + entry->target_offset); + iptables_entry_get_elems(entry), + char_entry + iptables_entry_get_target_offset(entry)); } dump_match(entry); @@ -1250,84 +2085,318 @@ static int dump_entry(struct ipt_entry *entry, int builtin, static void dump_table(struct connman_iptables *table) { + struct connman_iptables_entry entry = { 0 }; + unsigned int *hook_entry; + unsigned int *underflow; + unsigned int valid_hooks; + unsigned int size; + + hook_entry = iptables_table_get_info_hook_entry(table); + underflow = iptables_table_get_info_underflow(table); + valid_hooks = iptables_table_get_info_valid_hooks(table); + size = iptables_table_get_info_size(table); + DBG("%s valid_hooks=0x%08x, num_entries=%u, size=%u", - table->info->name, - table->info->valid_hooks, table->info->num_entries, - table->info->size); + iptables_table_get_info_name(table), + valid_hooks, + iptables_table_get_info_num_entries(table), + size); DBG("entry hook: pre/in/fwd/out/post %d/%d/%d/%d/%d", - table->info->hook_entry[NF_IP_PRE_ROUTING], - table->info->hook_entry[NF_IP_LOCAL_IN], - table->info->hook_entry[NF_IP_FORWARD], - table->info->hook_entry[NF_IP_LOCAL_OUT], - table->info->hook_entry[NF_IP_POST_ROUTING]); + hook_entry[NF_IP_PRE_ROUTING], + hook_entry[NF_IP_LOCAL_IN], + hook_entry[NF_IP_FORWARD], + hook_entry[NF_IP_LOCAL_OUT], + hook_entry[NF_IP_POST_ROUTING]); DBG("underflow: pre/in/fwd/out/post %d/%d/%d/%d/%d", - table->info->underflow[NF_IP_PRE_ROUTING], - table->info->underflow[NF_IP_LOCAL_IN], - table->info->underflow[NF_IP_FORWARD], - table->info->underflow[NF_IP_LOCAL_OUT], - table->info->underflow[NF_IP_POST_ROUTING]); + underflow[NF_IP_PRE_ROUTING], + underflow[NF_IP_LOCAL_IN], + underflow[NF_IP_FORWARD], + underflow[NF_IP_LOCAL_OUT], + underflow[NF_IP_POST_ROUTING]); + + entry.type = table->type; + + switch (table->type) { + case AF_INET: + entry.entry = table->blob_entries->entrytable; + break; + case AF_INET6: + entry.entry6 = table->blob_entries6->entrytable; + } - iterate_entries(table->blob_entries->entrytable, - table->info->valid_hooks, - table->info->hook_entry, - table->blob_entries->size, - print_entry, dump_entry); + iterate_entries(&entry, + valid_hooks, + hook_entry, + underflow, + size, + print_entry, dump_entry); } -static void dump_ipt_replace(struct ipt_replace *repl) +static const char *iptables_replace_get_name(struct iptables_replace *replace) { + if (!replace) + return NULL; + + switch (replace->type) { + case AF_INET: + return replace->r->name; + case AF_INET6: + return replace->r6->name; + } + + return NULL; +} + +static unsigned int iptables_replace_get_valid_hooks( + struct iptables_replace *replace) +{ + if (!replace) + return 0; + + switch (replace->type) { + case AF_INET: + return replace->r->valid_hooks; + case AF_INET6: + return replace->r6->valid_hooks; + } + + return 0; +} + +static unsigned int iptables_replace_get_num_entries( + struct iptables_replace *replace) +{ + if (!replace) + return 0; + + switch (replace->type) { + case AF_INET: + return replace->r->num_entries; + case AF_INET6: + return replace->r6->num_entries; + } + + return 0; +} + +static unsigned int *iptables_replace_get_hook_entry( + struct iptables_replace *replace) +{ + if (!replace) + return NULL; + + switch (replace->type) { + case AF_INET: + return replace->r->hook_entry; + case AF_INET6: + return replace->r6->hook_entry; + } + + return NULL; +} + +static unsigned int *iptables_replace_get_underflow( + struct iptables_replace *replace) +{ + if (!replace) + return NULL; + + switch (replace->type) { + case AF_INET: + return replace->r->underflow; + case AF_INET6: + return replace->r6->underflow; + } + + return NULL; +} + +static unsigned int iptables_replace_get_size(struct iptables_replace *replace) +{ + if (!replace) + return 0; + + switch (replace->type) { + case AF_INET: + return replace->r->size; + case AF_INET6: + return replace->r6->size; + } + + return 0; +} + +static void dump_replace(struct iptables_replace *repl) +{ + struct connman_iptables_entry entry = { 0 }; + unsigned int *hook_entry; + unsigned int *underflow; + unsigned int valid_hooks; + unsigned int size; + + hook_entry = iptables_replace_get_hook_entry(repl); + underflow = iptables_replace_get_underflow(repl); + valid_hooks = iptables_replace_get_valid_hooks(repl); + size = iptables_replace_get_size(repl); + + switch (repl->type) { + case AF_INET: + entry.entry = repl->r->entries; + break; + case AF_INET6: + entry.entry6 = repl->r6->entries; + break; + default: + return; + } + DBG("%s valid_hooks 0x%08x num_entries %u size %u", - repl->name, repl->valid_hooks, repl->num_entries, - repl->size); + iptables_replace_get_name(repl), + valid_hooks, + iptables_replace_get_num_entries(repl), size); DBG("entry hook: pre/in/fwd/out/post %d/%d/%d/%d/%d", - repl->hook_entry[NF_IP_PRE_ROUTING], - repl->hook_entry[NF_IP_LOCAL_IN], - repl->hook_entry[NF_IP_FORWARD], - repl->hook_entry[NF_IP_LOCAL_OUT], - repl->hook_entry[NF_IP_POST_ROUTING]); + hook_entry[NF_IP_PRE_ROUTING], + hook_entry[NF_IP_LOCAL_IN], + hook_entry[NF_IP_FORWARD], + hook_entry[NF_IP_LOCAL_OUT], + hook_entry[NF_IP_POST_ROUTING]); DBG("underflow: pre/in/fwd/out/post %d/%d/%d/%d/%d", - repl->underflow[NF_IP_PRE_ROUTING], - repl->underflow[NF_IP_LOCAL_IN], - repl->underflow[NF_IP_FORWARD], - repl->underflow[NF_IP_LOCAL_OUT], - repl->underflow[NF_IP_POST_ROUTING]); - - iterate_entries(repl->entries, repl->valid_hooks, - repl->hook_entry, repl->size, print_entry, dump_entry); + underflow[NF_IP_PRE_ROUTING], + underflow[NF_IP_LOCAL_IN], + underflow[NF_IP_FORWARD], + underflow[NF_IP_LOCAL_OUT], + underflow[NF_IP_POST_ROUTING]); + + iterate_entries(&entry, valid_hooks, hook_entry, underflow, + size, print_entry, dump_entry); } static int iptables_get_entries(struct connman_iptables *table) { socklen_t entry_size; + int err; - entry_size = sizeof(struct ipt_get_entries) + table->info->size; + switch (table->type) { + case AF_INET: + entry_size = sizeof(struct ipt_get_entries) + table->info->size; + + err = getsockopt(table->ipt_sock, IPPROTO_IP, + IPT_SO_GET_ENTRIES, table->blob_entries, + &entry_size); + break; + case AF_INET6: + entry_size = sizeof(struct ip6t_get_entries) + + table->info6->size; + + err = getsockopt(table->ipt_sock, IPPROTO_IPV6, + IP6T_SO_GET_ENTRIES, table->blob_entries6, + &entry_size); + break; + default: + return -EINVAL; + } + + if (err < 0) + return -errno; - return getsockopt(table->ipt_sock, IPPROTO_IP, IPT_SO_GET_ENTRIES, - table->blob_entries, &entry_size); + return 0; } static int iptables_replace(struct connman_iptables *table, - struct ipt_replace *r) + struct iptables_replace *r) { - return setsockopt(table->ipt_sock, IPPROTO_IP, IPT_SO_SET_REPLACE, r, - sizeof(*r) + r->size); + int err; + + switch (r->type) { + case AF_INET: + if (!r->r) + return -EINVAL; + + err = setsockopt(table->ipt_sock, IPPROTO_IP, + IPT_SO_SET_REPLACE, r->r, + sizeof(*r->r) + r->r->size); + break; + case AF_INET6: + if (!r->r6) + return -EINVAL; + + err = setsockopt(table->ipt_sock, IPPROTO_IPV6, + IP6T_SO_SET_REPLACE, r->r6, + sizeof(*r->r6) + r->r6->size); + break; + default: + return -EINVAL; + } + + if (err < 0) + return -errno; + + return 0; } -static int add_entry(struct ipt_entry *entry, int builtin, unsigned int hook, - size_t size, unsigned offset, void *user_data) +static int iptables_add_counters(struct connman_iptables *table, + struct xt_counters_info *c) { - struct connman_iptables *table = user_data; - struct ipt_entry *new_entry; + int err; + int level; + int optname; - new_entry = g_try_malloc0(entry->next_offset); - if (new_entry == NULL) - return -ENOMEM; + switch (table->type) { + case AF_INET: + level = IPPROTO_IP; + optname = IPT_SO_SET_ADD_COUNTERS; + break; + case AF_INET6: + level = IPPROTO_IPV6; + optname = IP6T_SO_SET_ADD_COUNTERS; + break; + default: + return -EINVAL; + } + + err = setsockopt(table->ipt_sock, level, optname, c, + sizeof(*c) + sizeof(struct xt_counters) * c->num_counters); + + if (err < 0) + return -errno; + + return 0; +} - memcpy(new_entry, entry, entry->next_offset); +static int add_entry(struct connman_iptables_entry *entry, int builtin, + unsigned int hook, size_t size, unsigned offset, + void *user_data) +{ + struct connman_iptables *table = user_data; + struct connman_iptables_entry new_entry = { 0 }; + u_int16_t next_offset; + + new_entry.type = entry->type; + next_offset = iptables_entry_get_next_offset(entry); + + switch (entry->type) { + case AF_INET: + new_entry.entry = g_try_malloc0(next_offset); + if (!new_entry.entry) + return -ENOMEM; + + memcpy(new_entry.entry, entry->entry, next_offset); + break; + case AF_INET6: + new_entry.entry6 = g_try_malloc0(next_offset); + if (!new_entry.entry6) + return -ENOMEM; - return iptables_add_entry(table, new_entry, NULL, builtin); + memcpy(new_entry.entry6, entry->entry6, next_offset); + break; + default: + return -EINVAL; + } + + return iptables_add_entry(table, &new_entry, NULL, builtin, + table->num_entries); } static void table_cleanup(struct connman_iptables *table) @@ -1335,7 +2404,7 @@ static void table_cleanup(struct connman_iptables *table) GList *list; struct connman_iptables_entry *entry; - if (table == NULL) + if (!table) return; if (table->ipt_sock >= 0) @@ -1344,97 +2413,175 @@ static void table_cleanup(struct connman_iptables *table) for (list = table->entries; list; list = list->next) { entry = list->data; - g_free(entry->entry); - g_free(entry); + iptables_entry_free(entry); } g_list_free(table->entries); - g_free(table->info); - g_free(table->blob_entries); + g_free(table->name); + + if (table->type == AF_INET) { + g_free(table->info); + g_free(table->blob_entries); + } + + if (table->type == AF_INET6) { + g_free(table->info6); + g_free(table->blob_entries6); + } + g_free(table); } -static struct connman_iptables *iptables_init(const char *table_name) +static int setup_xtables(int type); +static void reset_xtables(); + +static struct connman_iptables *iptables_init(int type, const char *table_name) { struct connman_iptables *table = NULL; + struct connman_iptables_entry entry = { 0 }; + char *iptables_mod = NULL; char *module = NULL; socklen_t s; - if (table_name == NULL) - table_name = "filter"; - - DBG("%s", table_name); + switch(type) { + case AF_INET: + iptables_mod = g_strdup("ip_tables"); + module = g_strconcat("iptable_", table_name, NULL); + break; + case AF_INET6: + iptables_mod = g_strdup("ip6_tables"); + module = g_strconcat("ip6table_", table_name, NULL); + break; + default: + return NULL; + } - if (xtables_insmod("ip_tables", NULL, TRUE) != 0) - DBG("ip_tables module loading gives error but trying anyway"); + DBG("%d %s", type, table_name); - module = g_strconcat("iptable_", table_name, NULL); - if (module == NULL) + if (setup_xtables(type)) return NULL; + if (xtables_insmod(iptables_mod, NULL, TRUE) != 0) + DBG("%s module loading gives error but trying anyway", + iptables_mod); + + g_free(iptables_mod); + if (xtables_insmod(module, NULL, TRUE) != 0) DBG("%s module loading gives error but trying anyway", module); g_free(module); - table = g_hash_table_lookup(table_hash, table_name); - if (table != NULL) - return table; - table = g_try_new0(struct connman_iptables, 1); - if (table == NULL) + if (!table) return NULL; - table->info = g_try_new0(struct ipt_getinfo, 1); - if (table->info == NULL) - goto err; + table->type = entry.type = type; - table->ipt_sock = socket(AF_INET, SOCK_RAW | SOCK_CLOEXEC, IPPROTO_RAW); + table->ipt_sock = socket(type, SOCK_RAW | SOCK_CLOEXEC, IPPROTO_RAW); if (table->ipt_sock < 0) goto err; - s = sizeof(*table->info); - strcpy(table->info->name, table_name); - if (getsockopt(table->ipt_sock, IPPROTO_IP, IPT_SO_GET_INFO, - table->info, &s) < 0) { - connman_error("iptables support missing error %d (%s)", errno, - strerror(errno)); - goto err; - } + switch (type) { + case AF_INET: + table->info = g_try_new0(struct ipt_getinfo, 1); + if (!table->info) + goto err; - table->blob_entries = g_try_malloc0(sizeof(struct ipt_get_entries) + - table->info->size); - if (table->blob_entries == NULL) - goto err; + s = sizeof(*table->info); + g_stpcpy(table->info->name, table_name); + + if (getsockopt(table->ipt_sock, IPPROTO_IP, IPT_SO_GET_INFO, + table->info, &s) < 0) { + connman_error("iptables support missing error %d (%s)", + errno, strerror(errno)); + goto err; + } + + table->blob_entries = g_try_malloc0( + sizeof(struct ipt_get_entries) + + table->info->size); + if (!table->blob_entries) + goto err; + + g_stpcpy(table->blob_entries->name, table_name); + table->blob_entries->size = table->info->size; - strcpy(table->blob_entries->name, table_name); - table->blob_entries->size = table->info->size; + break; + case AF_INET6: + table->info6 = g_try_new0(struct ip6t_getinfo, 1); + if (!table->info6) + goto err; + + s = sizeof(*table->info6); + g_stpcpy(table->info6->name, table_name); + + if (getsockopt(table->ipt_sock, IPPROTO_IPV6, IP6T_SO_GET_INFO, + table->info6, &s) < 0) { + connman_error("ip6tables support missing error %d (%s)", + errno, strerror(errno)); + goto err; + } + + table->blob_entries6 = g_try_malloc0( + sizeof(struct ip6t_get_entries) + + table->info6->size); + if (!table->blob_entries6) + goto err; + + g_stpcpy(table->blob_entries6->name, table_name); + table->blob_entries6->size = table->info6->size; + + break; + } if (iptables_get_entries(table) < 0) goto err; table->num_entries = 0; - table->old_entries = table->info->num_entries; table->size = 0; - memcpy(table->underflow, table->info->underflow, - sizeof(table->info->underflow)); - memcpy(table->hook_entry, table->info->hook_entry, - sizeof(table->info->hook_entry)); + switch (type) { + case AF_INET: + table->old_entries = table->info->num_entries; + + memcpy(table->underflow, table->info->underflow, + sizeof(table->info->underflow)); + memcpy(table->hook_entry, table->info->hook_entry, + sizeof(table->info->hook_entry)); - iterate_entries(table->blob_entries->entrytable, - table->info->valid_hooks, table->info->hook_entry, - table->blob_entries->size, add_entry, table); + entry.entry = table->blob_entries->entrytable; + break; + case AF_INET6: + table->old_entries = table->info6->num_entries; + + memcpy(table->underflow, table->info6->underflow, + sizeof(table->info6->underflow)); + memcpy(table->hook_entry, table->info6->hook_entry, + sizeof(table->info6->hook_entry)); + + entry.entry6 = table->blob_entries6->entrytable; + break; + } - g_hash_table_insert(table_hash, g_strdup(table_name), table); + iterate_entries(&entry, + iptables_table_get_info_valid_hooks(table), + iptables_table_get_info_hook_entry(table), + iptables_table_get_info_underflow(table), + iptables_table_get_entries_size(table), + add_entry, + table); - if (debug_enabled == TRUE) + if (debug_enabled) dump_table(table); + reset_xtables(); + return table; err: table_cleanup(table); + reset_xtables(); return NULL; } @@ -1456,47 +2603,141 @@ static struct option iptables_opts[] = { {.name = "out-interface", .has_arg = 1, .val = 'o'}, {.name = "source", .has_arg = 1, .val = 's'}, {.name = "table", .has_arg = 1, .val = 't'}, + {.name = "protocol", .has_arg = 1, .val = 'p'}, {NULL}, }; +void iptables_exit(enum xtables_exittype status, const char *msg, ...) + __attribute__((noreturn, format(printf,2,3))); + +void iptables_exit(enum xtables_exittype status, const char *msg, ...) +{ + va_list args; + gchar str[256] = { 0 }; + + switch (status) { + case OTHER_PROBLEM: + DBG("OTHER_PROBLEM"); + break; + case PARAMETER_PROBLEM: + DBG("PARAMETER_PROBLEM"); + break; + case VERSION_PROBLEM: + DBG("VERSION_PROBLEM"); + break; + case RESOURCE_PROBLEM: + DBG("RESOURCE_PROBLEM"); + break; + case XTF_ONLY_ONCE: + DBG("XTF_ONLY_ONCE"); + break; + case XTF_NO_INVERT: + DBG("XTF_NO_INVERT"); + break; + case XTF_BAD_VALUE: + DBG("XTF_BAD_VALUE"); + break; + case XTF_ONE_ACTION: + DBG("XTF_ONE_ACTION"); + break; + } + + va_start(args, msg); + vsnprintf(str, 256, msg, args); + va_end(args); + + connman_error("iptables rule error: %s", str); + + if (can_jmp()) { + DBG("calling longjmp()"); + /* enum xtables_exittype begins from 1 */ + longjmp(env_state, status); + } + + connman_error("exit because of iptables error"); + + exit(status); +} + struct xtables_globals iptables_globals = { .option_offset = 0, .opts = iptables_opts, .orig_opts = iptables_opts, + .exit_err = iptables_exit, +#if XTABLES_VERSION_CODE > 10 + .compat_rev = xtables_compatible_revision, +#endif +}; + +struct xtables_globals ip6tables_globals = { + .option_offset = 0, + .opts = iptables_opts, + .orig_opts = iptables_opts, + .exit_err = iptables_exit, +#if XTABLES_VERSION_CODE > 10 + .compat_rev = xtables_compatible_revision, +#endif }; static struct xtables_target *prepare_target(struct connman_iptables *table, const char *target_name) { struct xtables_target *xt_t = NULL; - gboolean is_builtin, is_user_defined; + bool is_builtin, is_user_defined; GList *chain_head = NULL; size_t target_size; + int err; - is_builtin = FALSE; - is_user_defined = FALSE; + is_builtin = false; + is_user_defined = false; + + DBG("target %s", target_name); + + if (!table) + return NULL; if (is_builtin_target(target_name)) - is_builtin = TRUE; + is_builtin = true; else { chain_head = find_chain_head(table, target_name); - if (chain_head != NULL && chain_head->next != NULL) - is_user_defined = TRUE; + if (chain_head && chain_head->next) + is_user_defined = true; + } + + enable_jmp(); + + if ((err = setjmp(env_state)) != 0) { + DBG("setjmp() called by longjmp() with value %d", err); + disable_jmp(); + return NULL; } if (is_builtin || is_user_defined) - xt_t = xtables_find_target(IPT_STANDARD_TARGET, + xt_t = xtables_find_target(get_standard_target(table->type), XTF_LOAD_MUST_SUCCEED); - else + else xt_t = xtables_find_target(target_name, XTF_TRY_LOAD); - if (xt_t == NULL) + disable_jmp(); + + if (!xt_t) return NULL; - target_size = ALIGN(sizeof(struct ipt_entry_target)) + xt_t->size; + switch (table->type) { + case AF_INET: + target_size = XT_ALIGN(sizeof(struct ipt_entry_target)) + + xt_t->size; + break; + case AF_INET6: + target_size = XT_ALIGN(sizeof(struct ip6t_entry_target)) + + xt_t->size; + break; + default: + return NULL; + } xt_t->t = g_try_malloc0(target_size); - if (xt_t->t == NULL) + if (!xt_t->t) return NULL; xt_t->t->u.target_size = target_size; @@ -1505,50 +2746,69 @@ static struct xtables_target *prepare_target(struct connman_iptables *table, struct xt_standard_target *target; target = (struct xt_standard_target *)(xt_t->t); - strcpy(target->target.u.user.name, IPT_STANDARD_TARGET); + g_stpcpy(target->target.u.user.name, + get_standard_target(table->type)); - if (is_builtin == TRUE) + if (is_builtin) target->verdict = target_to_verdict(target_name); - else if (is_user_defined == TRUE) { + else if (is_user_defined) { struct connman_iptables_entry *target_rule; - if (chain_head == NULL) { - g_free(xt_t->t); - return NULL; - } - target_rule = chain_head->next->data; target->verdict = target_rule->offset; } } else { - strcpy(xt_t->t->u.user.name, target_name); + g_stpcpy(xt_t->t->u.user.name, target_name); xt_t->t->u.user.revision = xt_t->revision; - if (xt_t->init != NULL) + if (xt_t->init) xt_t->init(xt_t->t); } -#if XTABLES_VERSION_CODE > 5 - if (xt_t->x6_options != NULL) - iptables_globals.opts = - xtables_options_xfrm( - iptables_globals.orig_opts, - iptables_globals.opts, - xt_t->x6_options, - &xt_t->option_offset); - else -#endif - iptables_globals.opts = - xtables_merge_options( -#if XTABLES_VERSION_CODE > 5 - iptables_globals.orig_opts, -#endif - iptables_globals.opts, - xt_t->extra_opts, - &xt_t->option_offset); + switch (table->type) { + case AF_INET: + if (xt_t->x6_options) + iptables_globals.opts = + xtables_options_xfrm( + iptables_globals.orig_opts, + iptables_globals.opts, + xt_t->x6_options, + &xt_t->option_offset); + else + iptables_globals.opts = + xtables_merge_options( + iptables_globals.orig_opts, + iptables_globals.opts, + xt_t->extra_opts, + &xt_t->option_offset); + + if (!iptables_globals.opts) { + g_free(xt_t->t); + xt_t = NULL; + } + + break; + case AF_INET6: + if (xt_t->x6_options) + ip6tables_globals.opts = + xtables_options_xfrm( + ip6tables_globals.orig_opts, + ip6tables_globals.opts, + xt_t->x6_options, + &xt_t->option_offset); + else + ip6tables_globals.opts = + xtables_merge_options( + ip6tables_globals.orig_opts, + ip6tables_globals.opts, + xt_t->extra_opts, + &xt_t->option_offset); + + if (!ip6tables_globals.opts) { + g_free(xt_t->t); + xt_t = NULL; + } - if (iptables_globals.opts == NULL) { - g_free(xt_t->t); - xt_t = NULL; + break; } return xt_t; @@ -1560,56 +2820,107 @@ static struct xtables_match *prepare_matches(struct connman_iptables *table, { struct xtables_match *xt_m; size_t match_size; + int err; - if (match_name == NULL) + if (!table || !match_name) return NULL; + enable_jmp(); + + if ((err = setjmp(env_state)) != 0) { + DBG("setjmp() called by longjmp() with value %d", err); + disable_jmp(); + return NULL; + } + xt_m = xtables_find_match(match_name, XTF_LOAD_MUST_SUCCEED, xt_rm); - match_size = ALIGN(sizeof(struct ipt_entry_match)) + xt_m->size; + + disable_jmp(); + + switch (table->type) { + case AF_INET: + match_size = XT_ALIGN(sizeof(struct ipt_entry_match)) + + xt_m->size; + break; + case AF_INET6: + match_size = XT_ALIGN(sizeof(struct ip6t_entry_match)) + + xt_m->size; + break; + default: + return NULL; + } xt_m->m = g_try_malloc0(match_size); - if (xt_m->m == NULL) + if (!xt_m->m) return NULL; xt_m->m->u.match_size = match_size; - strcpy(xt_m->m->u.user.name, xt_m->name); + g_stpcpy(xt_m->m->u.user.name, xt_m->name); xt_m->m->u.user.revision = xt_m->revision; - if (xt_m->init != NULL) + if (xt_m->init) xt_m->init(xt_m->m); - if (xt_m == xt_m->next) - goto done; - -#if XTABLES_VERSION_CODE > 5 - if (xt_m->x6_options != NULL) - iptables_globals.opts = - xtables_options_xfrm( - iptables_globals.orig_opts, - iptables_globals.opts, - xt_m->x6_options, - &xt_m->option_offset); - else -#endif + switch (table->type) { + case AF_INET: + if (xt_m->x6_options) iptables_globals.opts = - xtables_merge_options( -#if XTABLES_VERSION_CODE > 5 - iptables_globals.orig_opts, -#endif - iptables_globals.opts, - xt_m->extra_opts, - &xt_m->option_offset); + xtables_options_xfrm( + iptables_globals.orig_opts, + iptables_globals.opts, + xt_m->x6_options, + &xt_m->option_offset); + else + iptables_globals.opts = + xtables_merge_options( + iptables_globals.orig_opts, + iptables_globals.opts, + xt_m->extra_opts, + &xt_m->option_offset); - if (iptables_globals.opts == NULL) { - g_free(xt_m->m); - xt_m = NULL; + if (!iptables_globals.opts) { + g_free(xt_m->m); + + if (xt_m == xt_m->next) + free(xt_m); + + xt_m = NULL; + } + + break; + case AF_INET6: + if (xt_m->x6_options) + ip6tables_globals.opts = + xtables_options_xfrm( + ip6tables_globals.orig_opts, + ip6tables_globals.opts, + xt_m->x6_options, + &xt_m->option_offset); + else + ip6tables_globals.opts = + xtables_merge_options( + ip6tables_globals.orig_opts, + ip6tables_globals.opts, + xt_m->extra_opts, + &xt_m->option_offset); + + if (!ip6tables_globals.opts) { + g_free(xt_m->m); + + if (xt_m == xt_m->next) + free(xt_m); + + xt_m = NULL; + } + + break; } -done: return xt_m; } -static int parse_ip_and_mask(const char *str, struct in_addr *ip, struct in_addr *mask) +static int parse_ip_and_mask(const char *str, struct in_addr *ip, + struct in_addr *mask) { char **tokens; uint32_t prefixlength; @@ -1617,7 +2928,7 @@ static int parse_ip_and_mask(const char *str, struct in_addr *ip, struct in_addr int err; tokens = g_strsplit(str, "/", 2); - if (tokens == NULL) + if (!tokens) return -1; if (!inet_pton(AF_INET, tokens[0], ip)) { @@ -1625,14 +2936,16 @@ static int parse_ip_and_mask(const char *str, struct in_addr *ip, struct in_addr goto out; } - if (tokens[1] != NULL) { + if (tokens[1]) { prefixlength = strtol(tokens[1], NULL, 10); - if (prefixlength > 31) { + if (prefixlength > 32) { err = -1; goto out; + } else if (prefixlength == 32) { + tmp = 0xffffffff; + } else { + tmp = ~(0xffffffff >> prefixlength); } - - tmp = ~(0xffffffff >> prefixlength); } else { tmp = 0xffffffff; } @@ -1646,474 +2959,1042 @@ out: return err; } -static struct connman_iptables *pre_load_table(const char *table_name, - struct connman_iptables *table) +static int parse_ipv6_and_mask(const char *str, struct in6_addr *ip, + struct in6_addr *mask) { - if (table != NULL) - return table; + char **tokens; + uint32_t prefixlength; + struct in6_addr in6; + int i, j; + int err; - return iptables_init(table_name); -} + tokens = g_strsplit(str, "/", 2); + if (!tokens) + return -1; -static void clear_tables_flags(void) -{ - struct xtables_match *xt_m; - struct xtables_target *xt_t; + if (!inet_pton(AF_INET6, tokens[0], ip)) { + err = -1; + goto out; + } + + if (tokens[1]) { + prefixlength = strtol(tokens[1], NULL, 10); + if (prefixlength > 128) { + err = -1; + goto out; + } + } else { + prefixlength = 128; + } /* - * Clear all flags because the flags are only valid - * for one rule. + * This part was adapted from (no need to re-invent the wheel): + * https://gitlab.com/ipcalc/ipcalc/blob/master/ipcalc.c#L733 */ - for (xt_m = xtables_matches; xt_m != NULL; xt_m = xt_m->next) - xt_m->mflags = 0; + memset(&in6, 0, sizeof(struct in6_addr)); - for (xt_t = xtables_targets; xt_t != NULL; xt_t = xt_t->next) { - xt_t->tflags = 0; - xt_t->used = 0; + for (i = prefixlength, j = 0; i > 0; i -= 8, j++) { + if (i >= 8) + in6.s6_addr[j] = 0xff; + else + in6.s6_addr[j] = (unsigned long)(0xffU << (8 - i)); } + + memcpy(mask, &in6, sizeof(struct in6_addr)); + + for (i = 0; i < 16 ; i++) + ip->s6_addr[i] = ip->s6_addr[i] & mask->s6_addr[i]; + + err = 0; +out: + g_strfreev(tokens); + + return err; } -static int iptables_command(int argc, char *argv[]) +static struct connman_iptables *get_table(int type, const char *table_name) { - struct connman_iptables *table; - struct xtables_rule_match *xt_rm, *tmp_xt_rm; - struct xtables_match *xt_m, *xt_m_t; - struct xtables_target *xt_t; - struct ipt_ip ip; - char *table_name, *chain, *new_chain, *match_name, *target_name; - char *flush_chain, *delete_chain, *policy; - int c, ret, in_len, out_len; - gboolean dump, invert, insert, delete, compare; + struct connman_iptables *table = NULL; - if (argc == 0) - return -EINVAL; + if (!table_name) + table_name = "filter"; - dump = FALSE; - invert = FALSE; - insert = FALSE; - delete = FALSE; - compare = FALSE; - chain = new_chain = match_name = target_name = NULL; - flush_chain = delete_chain = policy = table_name = NULL; - memset(&ip, 0, sizeof(struct ipt_ip)); - table = NULL; - xt_rm = NULL; - xt_m = NULL; - xt_t = NULL; - /* Default code for options parsing */ - ret = -EINVAL; - - clear_tables_flags(); - - /* extension's options will generate false-positives errors */ - opterr = 0; + table = hash_table_lookup(type, table_name); - optind = 0; + if (table) + return table; - while ((c = getopt_long(argc, argv, - "-A:C:D:F:I:L::N:P:X:d:j:i:m:o:s:t:", - iptables_globals.opts, NULL)) != -1) { - switch (c) { - case 'A': - /* It is either -A, -C, -D or -I at once */ - if (chain) - goto out; + table = iptables_init(type, table_name); - chain = optarg; - break; + if (!table) + return NULL; - case 'C': - /* It is either -A, -C, -D or -I at once */ - if (chain) - goto out; + if (table->name) + g_free(table->name); - chain = optarg; - compare = TRUE; - break; + table->name = g_strdup(table_name); + + hash_table_replace(type, table->name, table); - case 'D': - /* It is either -A, -C, -D or -I at once */ - if (chain) - goto out; + return table; +} - chain = optarg; - delete = TRUE; - break; +struct parse_context { + int type; + int argc; + char **argv; + struct ipt_ip *ip; + struct ip6t_ip6 *ipv6; + struct xtables_target *xt_t; + GList *xt_m; + struct xtables_rule_match *xt_rm; + uint16_t proto; +}; - case 'F': - flush_chain = optarg; - break; +static int prepare_getopt_args(const char *str, struct parse_context *ctx) +{ + char **tokens; + int i; - case 'I': - /* It is either -A, -C, -D or -I at once */ - if (chain) - goto out; + tokens = g_strsplit_set(str, " ", -1); - chain = optarg; - insert = TRUE; - break; + i = g_strv_length(tokens); - case 'L': - dump = TRUE; - break; + /* Add space for the argv[0] value */ + ctx->argc = i + 1; - case 'N': - new_chain = optarg; - break; + /* Don't forget the last NULL entry */ + ctx->argv = g_try_malloc0((ctx->argc + 1) * sizeof(char *)); + if (!ctx->argv) { + g_strfreev(tokens); + return -ENOMEM; + } - case 'P': - chain = optarg; - if (optind < argc) - policy = argv[optind++]; - else - goto out; + /* + * getopt_long() jumps over the first token; we need to add some + * random argv[0] entry. + */ + ctx->argv[0] = g_strdup("argh"); + for (i = 1; i < ctx->argc; i++) + ctx->argv[i] = tokens[i - 1]; - break; + g_free(tokens); - case 'X': - delete_chain = optarg; - break; + return 0; +} - case 'd': - if (!parse_ip_and_mask(optarg, &ip.dst, &ip.dmsk)) - break; +static int parse_xt_modules(int c, bool invert, + struct parse_context *ctx) +{ + struct xtables_match *m; + struct xtables_rule_match *rm; + struct ipt_entry fw; + struct ip6t_entry fw6; + int err; - if (invert) - ip.invflags |= IPT_INV_DSTIP; + switch (ctx->type) { + case AF_INET: + memset(&fw, 0, sizeof(fw)); - break; + /* The SNAT parser wants to know the protocol. */ + if (ctx->proto == 0) + ctx->proto = IPPROTO_IP; - case 'i': - in_len = strlen(optarg); + fw.ip.proto = ctx->proto; + break; + case AF_INET6: + memset(&fw6, 0, sizeof(fw6)); - if (in_len + 1 > IFNAMSIZ) - break; + if (ctx->proto == 0) + ctx->proto = IPPROTO_IPV6; - strcpy(ip.iniface, optarg); - memset(ip.iniface_mask, 0xff, in_len + 1); + fw6.ipv6.proto = ctx->proto; - if (invert) - ip.invflags |= IPT_INV_VIA_IN; + /* Flags must be set for IPv6 if protocol is set. */ + fw6.ipv6.flags |= IP6T_F_PROTO; - break; + break; + default: + return 0; + } - case 'j': - target_name = optarg; + for (rm = ctx->xt_rm; rm; rm = rm->next) { + if (rm->completed != 0) + continue; - table = pre_load_table(table_name, table); - if (table == NULL) - goto out; + m = rm->match; - xt_t = prepare_target(table, target_name); - if (xt_t == NULL) - goto out; + if (!m->x6_parse && !m->parse) + continue; + + if (c < (int) m->option_offset || + c >= (int) m->option_offset + + XT_OPTION_OFFSET_SCALE) + continue; + + enable_jmp(); + + if ((err = setjmp(env_state)) != 0) { + DBG("setjmp() called by longjmp() with value %d", err); + disable_jmp(); + return -EINVAL; + } + switch (ctx->type) { + case AF_INET: + xtables_option_mpcall(c, ctx->argv, invert, m, &fw); + break; + case AF_INET6: + xtables_option_mpcall(c, ctx->argv, invert, m, &fw6); break; + } - case 'm': - match_name = optarg; + disable_jmp(); + } - table = pre_load_table(table_name, table); - if (table == NULL) - goto out; + if (!ctx->xt_t) + return 0; - xt_m = prepare_matches(table, &xt_rm, match_name); - if (xt_m == NULL) - goto out; + if (!ctx->xt_t->x6_parse && !ctx->xt_t->parse) + return 0; + + if (c < (int) ctx->xt_t->option_offset || + c >= (int) ctx->xt_t->option_offset + + XT_OPTION_OFFSET_SCALE) + return 0; + + enable_jmp(); + + if ((err = setjmp(env_state)) != 0) { + DBG("setjmp() called by longjmp() with value %d", err); + disable_jmp(); + return -EINVAL; + } + + switch (ctx->type) { + case AF_INET: + xtables_option_tpcall(c, ctx->argv, invert, ctx->xt_t, &fw); + break; + case AF_INET6: + xtables_option_tpcall(c, ctx->argv, invert, ctx->xt_t, &fw6); + break; + } + + disable_jmp(); + + return 0; +} + +static int final_check_xt_modules(struct parse_context *ctx) +{ + struct xtables_rule_match *rm; + int err; + + for (rm = ctx->xt_rm; rm; rm = rm->next) { + enable_jmp(); + + if ((err = setjmp(env_state)) != 0) { + DBG("setjmp() called by longjmp() with value %d", err); + disable_jmp(); + return -EINVAL; + } + + xtables_option_mfcall(rm->match); + + disable_jmp(); + } + + enable_jmp(); + + if ((err = setjmp(env_state)) != 0) { + DBG("setjmp() called by longjmp() with value %d", err); + disable_jmp(); + return -EINVAL; + } + + if (ctx->xt_t) + xtables_option_tfcall(ctx->xt_t); + + disable_jmp(); + + return 0; +} + +static int parse_rule_spec(struct connman_iptables *table, + struct parse_context *ctx) +{ + /* + * How the parser works: + * + * - If getopt finds 's', 'd', 'i', 'o'. + * just extract the information. + * - if '!' is found, set the invert flag to true and + * removes the '!' from the optarg string and jumps + * back to getopt to reparse the current optarg string. + * After reparsing the invert flag is reset to false. + * - If 'm' or 'j' is found then call either + * prepare_matches() or prepare_target(). Those function + * will modify (extend) the longopts for getopt_long. + * That means getopt will change its matching context according + * the loaded target. + * + * Here an example with iptables-test + * + * argv[0] = ./tools/iptables-test + * argv[1] = -t + * argv[2] = filter + * argv[3] = -A + * argv[4] = INPUT + * argv[5] = -m + * argv[6] = mark + * argv[7] = --mark + * argv[8] = 999 + * argv[9] = -j + * argv[10] = LOG + * + * getopt found 'm' then the optarg is "mark" and optind 7 + * The longopts array containts before hitting the `case 'm'` + * + * val A has_arg 1 name append + * val C has_arg 1 name compare + * val D has_arg 1 name delete + * val F has_arg 1 name flush-chain + * val I has_arg 1 name insert + * val L has_arg 2 name list + * val N has_arg 1 name new-chain + * val P has_arg 1 name policy + * val X has_arg 1 name delete-chain + * val d has_arg 1 name destination + * val i has_arg 1 name in-interface + * val j has_arg 1 name jump + * val m has_arg 1 name match + * val o has_arg 1 name out-interface + * val s has_arg 1 name source + * val t has_arg 1 name table + * + * After executing the `case 'm'` block longopts is + * + * val A has_arg 1 name append + * val C has_arg 1 name compare + * val D has_arg 1 name delete + * val F has_arg 1 name flush-chain + * val I has_arg 1 name insert + * val L has_arg 2 name list + * val N has_arg 1 name new-chain + * val P has_arg 1 name policy + * val X has_arg 1 name delete-chain + * val d has_arg 1 name destination + * val i has_arg 1 name in-interface + * val j has_arg 1 name jump + * val m has_arg 1 name match + * val o has_arg 1 name out-interface + * val s has_arg 1 name source + * val t has_arg 1 name table + * val has_arg 1 name mark + * + * So the 'mark' matcher has added the 'mark' options + * and getopt will then return c '256' optarg "999" optind 9 + * And we will hit the 'default' statement which then + * will call the matchers parser (xt_m->parser() or + * xtables_option_mpcall() depending on which version + * of libxtables is found. + */ + struct xtables_match *xt_m; + bool invert = false; + int len, c, err; + + if (ctx->type != table->type) { + DBG("ctx->type %d does not match table->type %d", ctx->type, + table->type); + return -EINVAL; + } + + switch (ctx->type) { + case AF_INET: + ctx->ip = g_try_new0(struct ipt_ip, 1); + if (!ctx->ip) + return -ENOMEM; + + break; + case AF_INET6: + ctx->ipv6 = g_try_new0(struct ip6t_ip6, 1); + if (!ctx->ipv6) + return -ENOMEM; + + break; + default: + return -EINVAL; + } + + /* + * Tell getopt_long not to generate error messages for unknown + * options and also reset optind back to 0. + */ + opterr = 0; + optind = 0; + + while ((c = getopt_long(ctx->argc, ctx->argv, + "-:d:i:o:s:m:j:p:", + ctx->type == AF_INET ? + iptables_globals.opts : + ip6tables_globals.opts, + NULL)) != -1) { + switch (c) { + case 's': + if (ctx->type == AF_INET) { + /* Source specification */ + if (!parse_ip_and_mask(optarg, + &ctx->ip->src, + &ctx->ip->smsk)) + break; + + if (invert) + ctx->ip->invflags |= IPT_INV_SRCIP; + } + + if (ctx->type == AF_INET6) { + if (!parse_ipv6_and_mask(optarg, + &ctx->ipv6->src, + &ctx->ipv6->smsk)) + break; + + if (invert) + ctx->ipv6->invflags |= IP6T_INV_SRCIP; + } break; + case 'd': + if (ctx->type == AF_INET) { + /* Destination specification */ + if (!parse_ip_and_mask(optarg, + &ctx->ip->dst, + &ctx->ip->dmsk)) + break; + + if (invert) + ctx->ip->invflags |= IPT_INV_DSTIP; + } - case 'o': - out_len = strlen(optarg); + if (ctx->type == AF_INET6) { + /* Destination specification */ + if (!parse_ipv6_and_mask(optarg, + &ctx->ipv6->dst, + &ctx->ipv6->dmsk)) + break; - if (out_len + 1 > IFNAMSIZ) + if (invert) + ctx->ip->invflags |= IP6T_INV_DSTIP; + } + + break; + case 'i': + /* In interface specification */ + len = strlen(optarg); + + if (len + 1 > IFNAMSIZ) break; - strcpy(ip.outiface, optarg); - memset(ip.outiface_mask, 0xff, out_len + 1); + if (ctx->type == AF_INET) { + g_stpcpy(ctx->ip->iniface, optarg); + memset(ctx->ip->iniface_mask, 0xff, len + 1); + + if (invert) + ctx->ip->invflags |= IPT_INV_VIA_IN; + } + + if (ctx->type == AF_INET6) { + g_stpcpy(ctx->ipv6->iniface, optarg); + memset(ctx->ipv6->iniface_mask, 0xff, len + 1); - if (invert) - ip.invflags |= IPT_INV_VIA_OUT; + if (invert) + ctx->ipv6->invflags |= IP6T_INV_VIA_IN; + } break; + case 'o': + /* Out interface specification */ + len = strlen(optarg); - case 's': - if (!parse_ip_and_mask(optarg, &ip.src, &ip.smsk)) + if (len + 1 > IFNAMSIZ) break; - if (invert) - ip.invflags |= IPT_INV_SRCIP; + if (ctx->type == AF_INET) { + g_stpcpy(ctx->ip->outiface, optarg); + memset(ctx->ip->outiface_mask, 0xff, len + 1); - break; + if (invert) + ctx->ip->invflags |= IPT_INV_VIA_OUT; + } - case 't': - table_name = optarg; + if (ctx->type == AF_INET6) { + g_stpcpy(ctx->ipv6->outiface, optarg); + memset(ctx->ipv6->outiface_mask, 0xff, len + 1); - table = pre_load_table(table_name, table); - if (table == NULL) + if (invert) + ctx->ipv6->invflags |= IP6T_INV_VIA_OUT; + } + + break; + case 'm': + /* Matches */ + xt_m = prepare_matches(table, &ctx->xt_rm, optarg); + if (!xt_m) { + err = -EINVAL; goto out; + } + ctx->xt_m = g_list_append(ctx->xt_m, xt_m); break; + case 'p': + enable_jmp(); - case 1: - if (optarg[0] == '!' && optarg[1] == '\0') { - invert = TRUE; - optarg[0] = '\0'; - continue; + if ((err = setjmp(env_state)) != 0) { + DBG("setjmp() called by longjmp() with value " + "%d", err); + disable_jmp(); + + /* Errors from parse_rule_spec are negative */ + err = -EINVAL; + goto out; } - connman_error("Invalid option"); + ctx->proto = xtables_parse_protocol(optarg); - goto out; + disable_jmp(); - default: -#if XTABLES_VERSION_CODE > 5 - if (xt_t != NULL && (xt_t->x6_parse != NULL || - xt_t->parse != NULL) && - (c >= (int) xt_t->option_offset && - c < (int) xt_t->option_offset + - XT_OPTION_OFFSET_SCALE)) { - xtables_option_tpcall(c, argv, - invert, xt_t, NULL); + /* + * If protocol was set add it to ipt_ip. + * xtables_parse_protocol() returns 0 or + * UINT16_MAX (-1) on error + */ + if (ctx->proto > 0 && ctx->proto < UINT16_MAX) { + if (ctx->type == AF_INET) + ctx->ip->proto = ctx->proto; - break; + if (ctx->type == AF_INET6) { + ctx->ipv6->proto = ctx->proto; + + /* + * Flags must be set for IPv6 if + * protocol is set. + */ + ctx->ipv6->flags |= IP6T_F_PROTO; + } + } + break; + case 'j': + /* Target */ + ctx->xt_t = prepare_target(table, optarg); + if (!ctx->xt_t) { + err = -EINVAL; + goto out; } - for (tmp_xt_rm = xt_rm; tmp_xt_rm != NULL; - tmp_xt_rm = tmp_xt_rm->next) { - xt_m_t = tmp_xt_rm->match; + break; + case 1: + if (optarg[0] == '!' && optarg[1] == '\0') { + invert = true; - if (tmp_xt_rm->completed || - (xt_m_t->x6_parse == NULL && - xt_m_t->parse == NULL)) - continue; + /* Remove the '!' from the optarg */ + optarg[0] = '\0'; - if (c < (int) xt_m_t->option_offset || - c >= (int) xt_m_t->option_offset - + XT_OPTION_OFFSET_SCALE) - continue; + /* + * And recall getopt_long without resetting + * invert. + */ + continue; + } - xtables_option_mpcall(c, argv, - invert, xt_m_t, NULL); + break; + default: + err = parse_xt_modules(c, invert, ctx); + if (err == 1) + continue; + else if (err == -EINVAL) + goto out; - break; - } -#else - if (xt_t == NULL || xt_t->parse == NULL || - !xt_t->parse(c - xt_t->option_offset, - argv, invert, &xt_t->tflags, NULL, &xt_t->t)) { - - for (tmp_xt_rm = xt_rm; tmp_xt_rm != NULL; - tmp_xt_rm = tmp_xt_rm->next) { - xt_m_t = tmp_xt_rm->match; - - if (tmp_xt_rm->completed || - xt_m_t->parse == NULL) - continue; - - if (xt_m->parse(c - xt_m->option_offset, - argv, invert, &xt_m->mflags, - NULL, &xt_m->m)) - break; - } - } -#endif break; } - invert = FALSE; + invert = false; } -#if XTABLES_VERSION_CODE > 5 - for (tmp_xt_rm = xt_rm; tmp_xt_rm != NULL; - tmp_xt_rm = tmp_xt_rm->next) - xtables_option_mfcall(tmp_xt_rm->match); + err = final_check_xt_modules(ctx); - if (xt_t != NULL) - xtables_option_tfcall(xt_t); -#else - for (tmp_xt_rm = xt_rm; tmp_xt_rm != NULL; - tmp_xt_rm = tmp_xt_rm->next) - if (tmp_xt_rm->match->final_check != NULL) - tmp_xt_rm->match->final_check( - tmp_xt_rm->match->mflags); +out: + return err; +} - if (xt_t != NULL && xt_t->final_check != NULL) - xt_t->final_check(xt_t->tflags); -#endif +static int current_type = -1; - table = pre_load_table(table_name, table); - if (table == NULL) - goto out; +static int setup_xtables(int type) +{ + int err; - /* Option parsing went fine, falling back to succes code */ - ret = 0; + DBG("%d", type); - if (delete_chain != NULL) { - printf("Delete chain %s\n", delete_chain); + if (type == current_type) + return 0; - iptables_delete_chain(table, delete_chain); + if (current_type != -1) + reset_xtables(); - goto out; + switch (type) { + case AF_INET: + err = xtables_init_all(&iptables_globals, NFPROTO_IPV4); + break; + case AF_INET6: + err = xtables_init_all(&ip6tables_globals, NFPROTO_IPV6); + break; + default: + return -1; } - - if (dump) { - dump_table(table); - - goto out; + + if (!err) { + current_type = type; + } else { + connman_error("error initializing xtables"); + current_type = -1; + reset_xtables(); } - if (flush_chain) { - DBG("Flush chain %s", flush_chain); + return err; +} - iptables_flush_chain(table, flush_chain); +static void reset_xtables(void) +{ + struct xtables_match *xt_m; + struct xtables_target *xt_t; - goto out; + /* + * As side effect parsing a rule sets some global flags + * which will be evaluated/verified. Let's reset them + * to ensure we can parse more than one rule. + * + * Clear all flags because the flags are only valid + * for one rule. + */ + for (xt_m = xtables_matches; xt_m; xt_m = xt_m->next) + xt_m->mflags = 0; + + for (xt_t = xtables_targets; xt_t; xt_t = xt_t->next) { + xt_t->tflags = 0; + xt_t->used = 0; } - if (chain && new_chain) { - ret = -EINVAL; - goto out; + /* + * We need also to free the memory implicitly allocated + * during parsing (see xtables_options_xfrm()). + * Note xt_params is actually iptables_globals. + */ + if (xt_params->opts != xt_params->orig_opts) { + g_free(xt_params->opts); + xt_params->opts = xt_params->orig_opts; } + xt_params->option_offset = 0; +} + +static void cleanup_parse_context(struct parse_context *ctx) +{ + struct xtables_rule_match *rm, *tmp; + GList *list; - if (new_chain) { - DBG("New chain %s", new_chain); + g_strfreev(ctx->argv); - ret = iptables_add_chain(table, new_chain); - goto out; + g_free(ctx->ip); + g_free(ctx->ipv6); + + if (ctx->xt_t) { + g_free(ctx->xt_t->t); + ctx->xt_t->t = NULL; } - if (chain) { - if (policy != NULL) { - printf("Changing policy of %s to %s\n", chain, policy); + for (list = ctx->xt_m; list; list = list->next) { + struct xtables_match *xt_m = list->data; - iptables_change_policy(table, chain, policy); + g_free(xt_m->m); - goto out; - } + if (xt_m != xt_m->next) + continue; - if (xt_t == NULL) - goto out; + g_free(xt_m); + } + g_list_free(ctx->xt_m); - if (compare == TRUE) { - ret = iptables_compare_rule(table, &ip, chain, - target_name, xt_t, xt_m, xt_rm); - goto out; - } + for (tmp = NULL, rm = ctx->xt_rm; rm; rm = rm->next) { + if (tmp) + g_free(tmp); + tmp = rm; + } + g_free(tmp); - if (delete == TRUE) { - DBG("Deleting %s to %s (match %s)\n", - target_name, chain, match_name); + g_free(ctx); +} - ret = iptables_delete_rule(table, &ip, chain, - target_name, xt_t, xt_m, xt_rm); +int __connman_iptables_dump(int type, const char *table_name) +{ + struct connman_iptables *table; - goto out; - } + DBG("%d -t %s -L", type, table_name); - if (insert == TRUE) { - DBG("Inserting %s to %s (match %s)", - target_name, chain, match_name); + table = get_table(type, table_name); + if (!table) + return -EINVAL; - ret = iptables_insert_rule(table, &ip, chain, - target_name, xt_t, xt_rm); + dump_table(table); - goto out; - } else { - DBG("Adding %s to %s (match %s)", - target_name, chain, match_name); + return 0; +} + +int __connman_iptables_new_chain(int type, + const char *table_name, + const char *chain) +{ + struct connman_iptables *table; - ret = iptables_append_rule(table, &ip, chain, - target_name, xt_t, xt_rm); + DBG("%d -t %s -N %s", type, table_name, chain); - goto out; - } + table = get_table(type, table_name); + if (!table) { + return -EINVAL; } -out: - if (xt_t) - g_free(xt_t->t); + switch (type) { + case AF_INET: + case AF_INET6: + return iptables_add_chain(table, chain); + } - if (xt_m) - g_free(xt_m->m); + return -EINVAL; +} - return ret; +int __connman_iptables_delete_chain(int type, + const char *table_name, + const char *chain) +{ + struct connman_iptables *table; + + DBG("%d -t %s -X %s", type, table_name, chain); + + table = get_table(type, table_name); + if (!table) + return -EINVAL; + + return iptables_delete_chain(table, chain); } -int __connman_iptables_command(const char *format, ...) +int __connman_iptables_flush_chain(int type, + const char *table_name, + const char *chain) { - char **argv, **arguments, *command; - int argc, i, ret; - va_list args; + struct connman_iptables *table; + + DBG("%d -t %s -F %s", type, table_name, chain); - if (format == NULL) + table = get_table(type, table_name); + if (!table) return -EINVAL; - va_start(args, format); + return iptables_flush_chain(table, chain); +} - command = g_strdup_vprintf(format, args); +int __connman_iptables_find_chain(int type, + const char *table_name, + const char *chain) +{ + struct connman_iptables *table; - va_end(args); + DBG("%d -t %s -F %s", type, table_name, chain); + + table = get_table(type, table_name); + if (!table) + return -EINVAL; + + if(!find_chain_head(table, chain)) + return -ENOENT; // Not Found + + return 0; // Found +} + +int __connman_iptables_change_policy(int type, + const char *table_name, + const char *chain, + const char *policy) +{ + struct connman_iptables *table; + + DBG("%d -t %s -F %s", type, table_name, chain); + + table = get_table(type, table_name); + if (!table) + return -EINVAL; + + return iptables_change_policy(table, chain, policy); +} + +static void iptables_ip_setup(struct iptables_ip *ip, struct parse_context *ctx) +{ + if (!ip || !ctx) + return; + + ip->type = ctx->type; + ip->ip = ctx->ip; + ip->ip6 = ctx->ipv6; +} - if (command == NULL) +int __connman_iptables_append(int type, + const char *table_name, + const char *chain, + const char *rule_spec) +{ + struct connman_iptables *table; + struct parse_context *ctx; + struct iptables_ip ip = { 0 }; + const char *target_name; + int err; + + err = setup_xtables(type); + + if (err < 0) + return err; + + ctx = g_try_new0(struct parse_context, 1); + if (!ctx) return -ENOMEM; - arguments = g_strsplit_set(command, " ", -1); + ctx->type = type; + + DBG("%d -t %s -A %s %s", type, table_name, chain, rule_spec); + + err = prepare_getopt_args(rule_spec, ctx); + if (err < 0) + goto out; + + table = get_table(type, table_name); + if (!table) { + err = -EINVAL; + goto out; + } + + err = parse_rule_spec(table, ctx); + if (err < 0) + goto out; + + if (!ctx->xt_t) + target_name = NULL; + else + target_name = ctx->xt_t->name; + + iptables_ip_setup(&ip, ctx); - for (argc = 0; arguments[argc]; argc++); - ++argc; + err = iptables_append_rule(table, &ip, chain, target_name, ctx->xt_t, + ctx->xt_rm); +out: + cleanup_parse_context(ctx); + reset_xtables(); - DBG("command %s argc %d", command, argc); + return err; +} - argv = g_try_malloc0(argc * sizeof(char *)); - if (argv == NULL) { - g_free(command); - g_strfreev(arguments); +int __connman_iptables_insert(int type, + const char *table_name, + const char *chain, + const char *rule_spec) +{ + struct connman_iptables *table; + struct parse_context *ctx; + struct iptables_ip ip = { 0 }; + const char *target_name; + int err; + + err = setup_xtables(type); + + if (err < 0) + return err; + + ctx = g_try_new0(struct parse_context, 1); + if (!ctx) return -ENOMEM; + + ctx->type = type; + + DBG("%d -t %s -I %s %s", type, table_name, chain, rule_spec); + + err = prepare_getopt_args(rule_spec, ctx); + if (err < 0) + goto out; + + table = get_table(type, table_name); + if (!table) { + err = -EINVAL; + goto out; } - argv[0] = "iptables"; - for (i = 1; i < argc; i++) - argv[i] = arguments[i - 1]; + err = parse_rule_spec(table, ctx); + if (err < 0) + goto out; - ret = iptables_command(argc, argv); + if (!ctx->xt_t) + target_name = NULL; + else + target_name = ctx->xt_t->name; - g_free(command); - g_strfreev(arguments); - g_free(argv); + iptables_ip_setup(&ip, ctx); - return ret; + err = iptables_insert_rule(table, &ip, chain, target_name, ctx->xt_t, + ctx->xt_rm); +out: + cleanup_parse_context(ctx); + reset_xtables(); + + return err; } +int __connman_iptables_delete(int type, + const char *table_name, + const char *chain, + const char *rule_spec) +{ + struct connman_iptables *table; + struct parse_context *ctx; + struct iptables_ip ip = { 0 }; + const char *target_name; + int err; + + err = setup_xtables(type); + + if (err < 0) + return err; + + ctx = g_try_new0(struct parse_context, 1); + if (!ctx) + return -ENOMEM; + + ctx->type = type; + + DBG("%d -t %s -D %s %s", type, table_name, chain, rule_spec); -int __connman_iptables_commit(const char *table_name) + err = prepare_getopt_args(rule_spec, ctx); + if (err < 0) + goto out; + + table = get_table(type, table_name); + if (!table) { + err = -EINVAL; + goto out; + } + + err = parse_rule_spec(table, ctx); + if (err < 0) + goto out; + + if (!ctx->xt_t) + target_name = NULL; + else + target_name = ctx->xt_t->name; + + iptables_ip_setup(&ip, ctx); + + err = iptables_delete_rule(table, &ip, chain, target_name, ctx->xt_t, + ctx->xt_m, ctx->xt_rm); +out: + cleanup_parse_context(ctx); + reset_xtables(); + + return err; +} + +int __connman_iptables_commit(int type, const char *table_name) { struct connman_iptables *table; - struct ipt_replace *repl; + struct iptables_replace repl = { 0 }; int err; + struct xt_counters_info *counters; + struct connman_iptables_entry *e; + GList *list; + unsigned int cnt; + + err = setup_xtables(type); + + if (err < 0) + return err; - DBG("%s", table_name); + DBG("%d %s", type, table_name); - table = g_hash_table_lookup(table_hash, table_name); - if (table == NULL) + repl.type = type; + + table = hash_table_lookup(type, table_name); + if (!table) return -EINVAL; - repl = iptables_blob(table); + switch (type) { + case AF_INET: + repl.r = iptables_blob(table); + if (!repl.r) + return -ENOMEM; + + break; + case AF_INET6: + repl.r6 = ip6tables_blob(table); + if (!repl.r6) + return -ENOMEM; + } - if (debug_enabled == TRUE) - dump_ipt_replace(repl); + if (debug_enabled) + dump_replace(&repl); - err = iptables_replace(table, repl); + err = iptables_replace(table, &repl); - g_free(repl->counters); - g_free(repl); + if (err < 0) + goto out_free; + + counters = g_try_malloc0(sizeof(*counters) + + sizeof(struct xt_counters) * table->num_entries); + if (!counters) { + err = -ENOMEM; + goto out_hash_remove; + } + g_stpcpy(counters->name, iptables_table_get_info_name(table)); + counters->num_counters = table->num_entries; + for (list = table->entries, cnt = 0; list; list = list->next, cnt++) { + e = list->data; + if (e->counter_idx >= 0) { + + switch (type) { + case AF_INET: + counters->counters[cnt] = + repl.r->counters[e->counter_idx]; + break; + case AF_INET6: + counters->counters[cnt] = + repl.r6->counters[e->counter_idx]; + break; + } + } + } + err = iptables_add_counters(table, counters); + g_free(counters); if (err < 0) - return err; + goto out_hash_remove; - g_hash_table_remove(table_hash, table_name); + err = 0; - return 0; +out_hash_remove: + hash_table_remove(type, table_name); +out_free: + if (type == AF_INET && repl.r) + g_free(repl.r->counters); + + if (type == AF_INET6 && repl.r6) + g_free(repl.r6->counters); + + g_free(repl.r); + g_free(repl.r6); + + reset_xtables(); + + return err; } static void remove_table(gpointer user_data) @@ -2123,20 +4004,84 @@ static void remove_table(gpointer user_data) table_cleanup(table); } +static int iterate_chains_cb(struct connman_iptables_entry *entry, int builtin, + unsigned int hook, size_t size, + unsigned int offset, void *user_data) +{ + struct cb_data *cbd = user_data; + connman_iptables_iterate_chains_cb_t cb = cbd->cb; + struct xt_entry_target *target; + + if (offset + iptables_entry_get_next_offset(entry) == size) + return 0; + + target = iptables_entry_get_target(entry); + + if (!g_strcmp0(target->u.user.name, get_error_target(entry->type))) { + (*cb)((const char *)target->data, cbd->user_data); + } else if (builtin >= 0) { + (*cb)(hooknames[builtin], cbd->user_data); + } + + return 0; +} + +int __connman_iptables_iterate_chains(int type, const char *table_name, + connman_iptables_iterate_chains_cb_t cb, + void *user_data) +{ + struct cb_data *cbd = cb_data_new(cb, user_data); + struct connman_iptables *table; + struct connman_iptables_entry entry = { 0 }; + int err; + + err = setup_xtables(type); + + if (err < 0) + return err; + + table = get_table(type, table_name); + if (!table) { + g_free(cbd); + return -EINVAL; + } + + entry.type = type; + + if (type == AF_INET) + entry.entry = table->blob_entries->entrytable; + + if (type == AF_INET6) + entry.entry6 = table->blob_entries6->entrytable; + + iterate_entries(&entry, + iptables_table_get_info_valid_hooks(table), + iptables_table_get_info_hook_entry(table), + iptables_table_get_info_underflow(table), + iptables_table_get_entries_size(table), + iterate_chains_cb, cbd); + + g_free(cbd); + + reset_xtables(); + + return 0; +} + int __connman_iptables_init(void) { DBG(""); if (getenv("CONNMAN_IPTABLES_DEBUG")) - debug_enabled = TRUE; + debug_enabled = true; table_hash = g_hash_table_new_full(g_str_hash, g_str_equal, - g_free, remove_table); + NULL, remove_table); - xtables_init_all(&iptables_globals, NFPROTO_IPV4); + table_hash_ipv6 = g_hash_table_new_full(g_str_hash, g_str_equal, + NULL, remove_table); return 0; - } void __connman_iptables_cleanup(void) @@ -2144,6 +4089,6 @@ void __connman_iptables_cleanup(void) DBG(""); g_hash_table_destroy(table_hash); - - xtables_free_opts(1); + g_hash_table_destroy(table_hash_ipv6); } +