#include "stc-manager-gdbus.h"
#include "helper-iptables.h"
-#define STC_IPTABLES_DBUS_SERVICE "net.stc.iptables"
-#define STC_IPTABLES_DBUS_RULE_INTERFACE STC_IPTABLES_DBUS_SERVICE ".rule"
-#define STC_IPTABLES_DBUS_CHAIN_INTERFACE STC_IPTABLES_DBUS_SERVICE ".chain"
-#define STC_IPTABLES_DBUS_RULE_PATH "/net/stc/iptables/rule"
-#define STC_IPTABLES_DBUS_CHAIN_PATH "/net/stc/iptables/chain"
-#define STC_IPTABLES_DBUS_METHOD_IPT_ADD_CHAIN "IptAddChain"
-#define STC_IPTABLES_DBUS_METHOD_IPT_REMOVE_CHAIN "IptRemoveChain"
+#define STC_IPTABLES_DBUS_SERVICE "net.stc.iptables"
+#define STC_IPTABLES_DBUS_RULE_INTERFACE STC_IPTABLES_DBUS_SERVICE ".rule"
+#define STC_IPTABLES_DBUS_CHAIN_INTERFACE STC_IPTABLES_DBUS_SERVICE ".chain"
+#define STC_IPTABLES_DBUS_RULE_PATH "/net/stc/iptables/rule"
+#define STC_IPTABLES_DBUS_CHAIN_PATH "/net/stc/iptables/chain"
+#define STC_IPTABLES_DBUS_METHOD_IPT_ADD_CHAIN "IptAddChain"
+#define STC_IPTABLES_DBUS_METHOD_IPT_REMOVE_CHAIN "IptRemoveChain"
+#define STC_IPTABLES_DBUS_METHOD_IPT_FLUSH_CHAIN "IptFlushChain"
#define STC_IPTABLES_DBUS_METHOD_IP6T_ADD_CHAIN "Ip6tAddChain"
#define STC_IPTABLES_DBUS_METHOD_IP6T_REMOVE_CHAIN "Ip6tRemoveChain"
-#define STC_IPTABLES_DBUS_METHOD_IPT_ADD_RULE "IptAddRule"
-#define STC_IPTABLES_DBUS_METHOD_IPT_REMOVE_RULE "IptRemoveRule"
+#define STC_IPTABLES_DBUS_METHOD_IP6T_FLUSH_CHAIN "Ip6tFlushChain"
+#define STC_IPTABLES_DBUS_METHOD_IPT_ADD_RULE "IptAddRule"
+#define STC_IPTABLES_DBUS_METHOD_IPT_REMOVE_RULE "IptRemoveRule"
#define STC_IPTABLES_DBUS_METHOD_IP6T_ADD_RULE "Ip6tAddRule"
#define STC_IPTABLES_DBUS_METHOD_IP6T_REMOVE_RULE "Ip6tRemoveRule"
return STC_ERROR_NONE;
}
+static int __iptables_add_chain(GDBusConnection *connection,
+ const char *chain)
+{
+ int result = 0;
+ GVariant *message = NULL;
+
+ message = stc_manager_gdbus_call_sync(connection,
+ STC_IPTABLES_DBUS_SERVICE,
+ STC_IPTABLES_DBUS_CHAIN_PATH,
+ STC_IPTABLES_DBUS_CHAIN_INTERFACE,
+ STC_IPTABLES_DBUS_METHOD_IPT_ADD_CHAIN,
+ g_variant_new("(s)", chain));
+
+ if (message == NULL) {
+ STC_LOGE("Failed to invoke dbus method");
+ return STC_ERROR_FAIL;
+ }
+
+ g_variant_get(message, "(i)", &result);
+ STC_LOGD("Successfully added ipv4 chain [%d]", result);
+ g_variant_unref(message);
+
+ return STC_ERROR_NONE;
+}
+
+static int __ip6tables_add_chain(GDBusConnection *connection,
+ const char *chain)
+{
+ int result = 0;
+ GVariant *message = NULL;
+
+ message = stc_manager_gdbus_call_sync(connection,
+ STC_IPTABLES_DBUS_SERVICE,
+ STC_IPTABLES_DBUS_CHAIN_PATH,
+ STC_IPTABLES_DBUS_CHAIN_INTERFACE,
+ STC_IPTABLES_DBUS_METHOD_IP6T_ADD_CHAIN,
+ g_variant_new("(s)", chain));
+
+ if (message == NULL) {
+ STC_LOGE("Failed to invoke dbus method");
+ return STC_ERROR_FAIL;
+ }
+
+ g_variant_get(message, "(i)", &result);
+ STC_LOGD("Successfully added ipv6 chain [%d]", result);
+ g_variant_unref(message);
+
+ return STC_ERROR_NONE;
+}
+
+static int __iptables_remove_chain(GDBusConnection *connection,
+ const char *chain)
+{
+ int result = 0;
+ GVariant *message = NULL;
+
+ message = stc_manager_gdbus_call_sync(connection,
+ STC_IPTABLES_DBUS_SERVICE,
+ STC_IPTABLES_DBUS_CHAIN_PATH,
+ STC_IPTABLES_DBUS_CHAIN_INTERFACE,
+ STC_IPTABLES_DBUS_METHOD_IPT_REMOVE_CHAIN,
+ g_variant_new("(s)", chain));
+
+ if (message == NULL) {
+ STC_LOGE("Failed to invoke dbus method");
+ return STC_ERROR_FAIL;
+ }
+
+ g_variant_get(message, "(i)", &result);
+ STC_LOGD("Successfully removed ipv4 chain [%d]", result);
+ g_variant_unref(message);
+
+ return STC_ERROR_NONE;
+}
+
+static int __ip6tables_remove_chain(GDBusConnection *connection,
+ const char *chain)
+{
+ int result = 0;
+ GVariant *message = NULL;
+
+ message = stc_manager_gdbus_call_sync(connection,
+ STC_IPTABLES_DBUS_SERVICE,
+ STC_IPTABLES_DBUS_CHAIN_PATH,
+ STC_IPTABLES_DBUS_CHAIN_INTERFACE,
+ STC_IPTABLES_DBUS_METHOD_IP6T_REMOVE_CHAIN,
+ g_variant_new("(s)", chain));
+
+ if (message == NULL) {
+ STC_LOGE("Failed to invoke dbus method");
+ return STC_ERROR_FAIL;
+ }
+
+ g_variant_get(message, "(i)", &result);
+ STC_LOGD("Successfully removed ipv6 chain [%d]", result);
+ g_variant_unref(message);
+
+ return STC_ERROR_NONE;
+}
+
+static int __iptables_flush_chain(GDBusConnection *connection,
+ const char *chain)
+{
+ int result = 0;
+ GVariant *message = NULL;
+
+ message = stc_manager_gdbus_call_sync(connection,
+ STC_IPTABLES_DBUS_SERVICE,
+ STC_IPTABLES_DBUS_CHAIN_PATH,
+ STC_IPTABLES_DBUS_CHAIN_INTERFACE,
+ STC_IPTABLES_DBUS_METHOD_IPT_FLUSH_CHAIN,
+ g_variant_new("(s)", chain));
+
+ if (message == NULL) {
+ STC_LOGE("Failed to invoke dbus method");
+ return STC_ERROR_FAIL;
+ }
+
+ g_variant_get(message, "(i)", &result);
+ STC_LOGD("Successfully flushed ipv4 chain [%d]", result);
+ g_variant_unref(message);
+
+ return STC_ERROR_NONE;
+}
+
+static int __ip6tables_flush_chain(GDBusConnection *connection,
+ const char *chain)
+{
+ int result = 0;
+ GVariant *message = NULL;
+
+ message = stc_manager_gdbus_call_sync(connection,
+ STC_IPTABLES_DBUS_SERVICE,
+ STC_IPTABLES_DBUS_CHAIN_PATH,
+ STC_IPTABLES_DBUS_CHAIN_INTERFACE,
+ STC_IPTABLES_DBUS_METHOD_IP6T_FLUSH_CHAIN,
+ g_variant_new("(s)", chain));
+
+ if (message == NULL) {
+ STC_LOGE("Failed to invoke dbus method");
+ return STC_ERROR_FAIL;
+ }
+
+ g_variant_get(message, "(i)", &result);
+ STC_LOGD("Successfully flushed ipv6 chain [%d]", result);
+ g_variant_unref(message);
+
+ return STC_ERROR_NONE;
+}
+
+static int __iptables_add_chain_jump_rule(const char *chain,
+ const char *target)
+{
+ stc_error_e ret = STC_ERROR_NONE;
+ iptables_rule_s iptables_rule;
+ memset(&iptables_rule, 0, sizeof(iptables_rule_s));
+
+ iptables_rule.target = g_strdup(target);
+ iptables_rule.chain = g_strdup(chain);
+
+ ret = iptables_add(&iptables_rule);
+
+ g_free(iptables_rule.target);
+ g_free(iptables_rule.chain);
+
+ return ret;
+}
+
stc_error_e iptables_add(iptables_rule_s *rule)
{
stc_error_e ret = STC_ERROR_NONE;
done:
return ret;
}
+
+stc_error_e iptables_flush_chains(void)
+{
+ stc_error_e ret = STC_ERROR_NONE;
+ stc_s *stc = stc_get_manager();
+
+ if (!stc || !stc->connection)
+ return STC_ERROR_INVALID_PARAMETER;
+
+ ret = __iptables_flush_chain(stc->connection, STC_IN_CHAIN);
+ if (ret != STC_ERROR_NONE)
+ goto done;
+
+ ret = __iptables_flush_chain(stc->connection, STC_OUT_CHAIN);
+ if (ret != STC_ERROR_NONE)
+ goto done;
+
+ ret = __iptables_flush_chain(stc->connection, STC_FRWD_CHAIN);
+ if (ret != STC_ERROR_NONE)
+ goto done;
+
+ ret = __ip6tables_flush_chain(stc->connection, STC_IN_CHAIN);
+ if (ret != STC_ERROR_NONE)
+ goto done;
+
+ ret = __ip6tables_flush_chain(stc->connection, STC_OUT_CHAIN);
+ if (ret != STC_ERROR_NONE)
+ goto done;
+
+ ret = __ip6tables_flush_chain(stc->connection, STC_FRWD_CHAIN);
+done:
+ return ret;
+}
+
+stc_error_e iptables_init(void)
+{
+ __STC_LOG_FUNC_ENTER__;
+
+ stc_error_e ret = STC_ERROR_NONE;
+ stc_s *stc = stc_get_manager();
+
+ if (!stc || !stc->connection) {
+ __STC_LOG_FUNC_EXIT__;
+ return STC_ERROR_INVALID_PARAMETER;
+ }
+
+ ret = __iptables_add_chain(stc->connection, STC_IN_CHAIN);
+ if (ret != STC_ERROR_NONE) {
+ __STC_LOG_FUNC_EXIT__;
+ goto done;
+ }
+
+ ret = __iptables_add_chain(stc->connection, STC_OUT_CHAIN);
+ if (ret != STC_ERROR_NONE) {
+ __STC_LOG_FUNC_EXIT__;
+ goto done;
+ }
+
+ ret = __iptables_add_chain(stc->connection, STC_FRWD_CHAIN);
+ if (ret != STC_ERROR_NONE) {
+ __STC_LOG_FUNC_EXIT__;
+ goto done;
+ }
+
+ ret = __ip6tables_add_chain(stc->connection, STC_IN_CHAIN);
+ if (ret != STC_ERROR_NONE) {
+ __STC_LOG_FUNC_EXIT__;
+ goto done;
+ }
+
+ ret = __ip6tables_add_chain(stc->connection, STC_OUT_CHAIN);
+ if (ret != STC_ERROR_NONE) {
+ __STC_LOG_FUNC_EXIT__;
+ goto done;
+ }
+
+ ret = __ip6tables_add_chain(stc->connection, STC_FRWD_CHAIN);
+ if (ret != STC_ERROR_NONE) {
+ __STC_LOG_FUNC_EXIT__;
+ goto done;
+ }
+
+ ret = __iptables_add_chain_jump_rule("INPUT", STC_IN_CHAIN);
+ if (ret != STC_ERROR_NONE) {
+ __STC_LOG_FUNC_EXIT__;
+ goto done;
+ }
+
+ ret = __iptables_add_chain_jump_rule("OUTPUT", STC_OUT_CHAIN);
+ if (ret != STC_ERROR_NONE) {
+ __STC_LOG_FUNC_EXIT__;
+ goto done;
+ }
+
+ ret = __iptables_add_chain_jump_rule("FORWARD", STC_FRWD_CHAIN);
+done:
+ return ret;
+}
+
+stc_error_e iptables_deinit(void)
+{
+ __STC_LOG_FUNC_ENTER__;
+
+ stc_error_e ret = STC_ERROR_NONE;
+ stc_s *stc = stc_get_manager();
+
+ if (!stc || !stc->connection) {
+ __STC_LOG_FUNC_EXIT__;
+ return STC_ERROR_INVALID_PARAMETER;
+ }
+
+ ret = __iptables_remove_chain(stc->connection, STC_IN_CHAIN);
+ if (ret != STC_ERROR_NONE) {
+ __STC_LOG_FUNC_EXIT__;
+ goto done;
+ }
+
+ ret = __iptables_remove_chain(stc->connection, STC_OUT_CHAIN);
+ if (ret != STC_ERROR_NONE) {
+ __STC_LOG_FUNC_EXIT__;
+ goto done;
+ }
+
+ ret = __iptables_remove_chain(stc->connection, STC_FRWD_CHAIN);
+ if (ret != STC_ERROR_NONE) {
+ __STC_LOG_FUNC_EXIT__;
+ goto done;
+ }
+
+ ret = __ip6tables_remove_chain(stc->connection, STC_IN_CHAIN);
+ if (ret != STC_ERROR_NONE) {
+ __STC_LOG_FUNC_EXIT__;
+ goto done;
+ }
+
+ ret = __ip6tables_remove_chain(stc->connection, STC_OUT_CHAIN);
+ if (ret != STC_ERROR_NONE) {
+ __STC_LOG_FUNC_EXIT__;
+ goto done;
+ }
+
+ ret = __ip6tables_remove_chain(stc->connection, STC_FRWD_CHAIN);
+done:
+ return ret;
+}