libiptc/libip4tc.c

   1 /* Library which manipulates firewall rules.  Version 0.1. */
   2
   3 /* Architecture of firewall rules is as follows:
   4  *
   5  * Chains go INPUT, FORWARD, OUTPUT then user chains.
   6  * Each user chain starts with an ERROR node.
   7  * Every chain ends with an unconditional jump: a RETURN for user chains,
   8  * and a POLICY for built-ins.
   9  */
  10
  11 /* (C)1999 Paul ``Rusty'' Russell - Placed under the GNU GPL (See
  12    COPYING for details). */
  13
  14 #include <assert.h>
  15 #include <string.h>
  16 #include <errno.h>
  17 #include <stdlib.h>
  18 #include <stdio.h>
  19 #include <unistd.h>
  20
  21 #ifdef DEBUG_CONNTRACK
  22 #define inline
  23 #endif
  24
  25 #if !defined(__GLIBC__) || (__GLIBC__ < 2)
  26 typedef unsigned int socklen_t;
  27 #endif
  28
  29 #include "libiptc/libiptc.h"
  30
  31 #define IP_VERSION      4
  32 #define IP_OFFSET       0x1FFF
  33
  34 #define HOOK_PRE_ROUTING        NF_IP_PRE_ROUTING
  35 #define HOOK_LOCAL_IN           NF_IP_LOCAL_IN
  36 #define HOOK_FORWARD            NF_IP_FORWARD
  37 #define HOOK_LOCAL_OUT          NF_IP_LOCAL_OUT
  38 #define HOOK_POST_ROUTING       NF_IP_POST_ROUTING
  39
  40 #define STRUCT_ENTRY_TARGET     struct xt_entry_target
  41 #define STRUCT_ENTRY            struct ipt_entry
  42 #define STRUCT_ENTRY_MATCH      struct xt_entry_match
  43 #define STRUCT_GETINFO          struct ipt_getinfo
  44 #define STRUCT_GET_ENTRIES      struct ipt_get_entries
  45 #define STRUCT_COUNTERS         struct xt_counters
  46 #define STRUCT_COUNTERS_INFO    struct xt_counters_info
  47 #define STRUCT_STANDARD_TARGET  struct xt_standard_target
  48 #define STRUCT_REPLACE          struct ipt_replace
  49
  50 #define ENTRY_ITERATE           IPT_ENTRY_ITERATE
  51 #define TABLE_MAXNAMELEN        XT_TABLE_MAXNAMELEN
  52 #define FUNCTION_MAXNAMELEN     XT_FUNCTION_MAXNAMELEN
  53
  54 #define GET_TARGET              ipt_get_target
  55
  56 #define ERROR_TARGET            XT_ERROR_TARGET
  57 #define NUMHOOKS                NF_IP_NUMHOOKS
  58
  59 #define IPT_CHAINLABEL          xt_chainlabel
  60
  61 #define TC_DUMP_ENTRIES         dump_entries
  62 #define TC_IS_CHAIN             iptc_is_chain
  63 #define TC_FIRST_CHAIN          iptc_first_chain
  64 #define TC_NEXT_CHAIN           iptc_next_chain
  65 #define TC_FIRST_RULE           iptc_first_rule
  66 #define TC_NEXT_RULE            iptc_next_rule
  67 #define TC_GET_TARGET           iptc_get_target
  68 #define TC_BUILTIN              iptc_builtin
  69 #define TC_GET_POLICY           iptc_get_policy
  70 #define TC_INSERT_ENTRY         iptc_insert_entry
  71 #define TC_REPLACE_ENTRY        iptc_replace_entry
  72 #define TC_APPEND_ENTRY         iptc_append_entry
  73 #define TC_CHECK_ENTRY          iptc_check_entry
  74 #define TC_DELETE_ENTRY         iptc_delete_entry
  75 #define TC_DELETE_NUM_ENTRY     iptc_delete_num_entry
  76 #define TC_FLUSH_ENTRIES        iptc_flush_entries
  77 #define TC_ZERO_ENTRIES         iptc_zero_entries
  78 #define TC_READ_COUNTER         iptc_read_counter
  79 #define TC_ZERO_COUNTER         iptc_zero_counter
  80 #define TC_SET_COUNTER          iptc_set_counter
  81 #define TC_CREATE_CHAIN         iptc_create_chain
  82 #define TC_GET_REFERENCES       iptc_get_references
  83 #define TC_DELETE_CHAIN         iptc_delete_chain
  84 #define TC_RENAME_CHAIN         iptc_rename_chain
  85 #define TC_SET_POLICY           iptc_set_policy
  86 #define TC_GET_RAW_SOCKET       iptc_get_raw_socket
  87 #define TC_INIT                 iptc_init
  88 #define TC_FREE                 iptc_free
  89 #define TC_COMMIT               iptc_commit
  90 #define TC_STRERROR             iptc_strerror
  91 #define TC_NUM_RULES            iptc_num_rules
  92 #define TC_GET_RULE             iptc_get_rule
  93 #define TC_OPS                  iptc_ops
  94
  95 #define TC_AF                   AF_INET
  96 #define TC_IPPROTO              IPPROTO_IP
  97
  98 #define SO_SET_REPLACE          IPT_SO_SET_REPLACE
  99 #define SO_SET_ADD_COUNTERS     IPT_SO_SET_ADD_COUNTERS
 100 #define SO_GET_INFO             IPT_SO_GET_INFO
 101 #define SO_GET_ENTRIES          IPT_SO_GET_ENTRIES
 102 #define SO_GET_VERSION          IPT_SO_GET_VERSION
 103
 104 #define STANDARD_TARGET         XT_STANDARD_TARGET
 105 #define LABEL_RETURN            IPTC_LABEL_RETURN
 106 #define LABEL_ACCEPT            IPTC_LABEL_ACCEPT
 107 #define LABEL_DROP              IPTC_LABEL_DROP
 108 #define LABEL_QUEUE             IPTC_LABEL_QUEUE
 109
 110 #define ALIGN                   XT_ALIGN
 111 #define RETURN                  XT_RETURN
 112
 113 #include "libiptc.c"
 114
 115 #define IP_PARTS_NATIVE(n)                      \
 116 (unsigned int)((n)>>24)&0xFF,                   \
 117 (unsigned int)((n)>>16)&0xFF,                   \
 118 (unsigned int)((n)>>8)&0xFF,                    \
 119 (unsigned int)((n)&0xFF)
 120
 121 #define IP_PARTS(n) IP_PARTS_NATIVE(ntohl(n))
 122
 123 static int
 124 dump_entry(struct ipt_entry *e, struct xtc_handle *const handle)
 125 {
 126         size_t i;
 127         STRUCT_ENTRY_TARGET *t;
 128
 129         printf("Entry %u (%lu):\n", iptcb_entry2index(handle, e),
 130                iptcb_entry2offset(handle, e));
 131         printf("SRC IP: %u.%u.%u.%u/%u.%u.%u.%u\n",
 132                IP_PARTS(e->ip.src.s_addr),IP_PARTS(e->ip.smsk.s_addr));
 133         printf("DST IP: %u.%u.%u.%u/%u.%u.%u.%u\n",
 134                IP_PARTS(e->ip.dst.s_addr),IP_PARTS(e->ip.dmsk.s_addr));
 135         printf("Interface: `%s'/", e->ip.iniface);
 136         for (i = 0; i < IFNAMSIZ; i++)
 137                 printf("%c", e->ip.iniface_mask[i] ? 'X' : '.');
 138         printf("to `%s'/", e->ip.outiface);
 139         for (i = 0; i < IFNAMSIZ; i++)
 140                 printf("%c", e->ip.outiface_mask[i] ? 'X' : '.');
 141         printf("\nProtocol: %u\n", e->ip.proto);
 142         printf("Flags: %02X\n", e->ip.flags);
 143         printf("Invflags: %02X\n", e->ip.invflags);
 144         printf("Counters: %llu packets, %llu bytes\n",
 145                (unsigned long long)e->counters.pcnt, (unsigned long long)e->counters.bcnt);
 146         printf("Cache: %08X\n", e->nfcache);
 147
 148         IPT_MATCH_ITERATE(e, print_match);
 149
 150         t = GET_TARGET(e);
 151         printf("Target name: `%s' [%u]\n", t->u.user.name, t->u.target_size);
 152         if (strcmp(t->u.user.name, STANDARD_TARGET) == 0) {
 153                 const unsigned char *data = t->data;
 154                 int pos = *(const int *)data;
 155                 if (pos < 0)
 156                         printf("verdict=%s\n",
 157                                pos == -NF_ACCEPT-1 ? "NF_ACCEPT"
 158                                : pos == -NF_DROP-1 ? "NF_DROP"
 159                                : pos == -NF_QUEUE-1 ? "NF_QUEUE"
 160                                : pos == RETURN ? "RETURN"
 161                                : "UNKNOWN");
 162                 else
 163                         printf("verdict=%u\n", pos);
 164         } else if (strcmp(t->u.user.name, XT_ERROR_TARGET) == 0)
 165                 printf("error=`%s'\n", t->data);
 166
 167         printf("\n");
 168         return 0;
 169 }
 170
 171 static unsigned char *
 172 is_same(const STRUCT_ENTRY *a, const STRUCT_ENTRY *b, unsigned char *matchmask)
 173 {
 174         unsigned int i;
 175         unsigned char *mptr;
 176
 177         /* Always compare head structures: ignore mask here. */
 178         if (a->ip.src.s_addr != b->ip.src.s_addr
 179             || a->ip.dst.s_addr != b->ip.dst.s_addr
 180             || a->ip.smsk.s_addr != b->ip.smsk.s_addr
 181             || a->ip.dmsk.s_addr != b->ip.dmsk.s_addr
 182             || a->ip.proto != b->ip.proto
 183             || a->ip.flags != b->ip.flags
 184             || a->ip.invflags != b->ip.invflags)
 185                 return NULL;
 186
 187         for (i = 0; i < IFNAMSIZ; i++) {
 188                 if (a->ip.iniface_mask[i] != b->ip.iniface_mask[i])
 189                         return NULL;
 190                 if ((a->ip.iniface[i] & a->ip.iniface_mask[i])
 191                     != (b->ip.iniface[i] & b->ip.iniface_mask[i]))
 192                         return NULL;
 193                 if (a->ip.outiface_mask[i] != b->ip.outiface_mask[i])
 194                         return NULL;
 195                 if ((a->ip.outiface[i] & a->ip.outiface_mask[i])
 196                     != (b->ip.outiface[i] & b->ip.outiface_mask[i]))
 197                         return NULL;
 198         }
 199
 200         if (a->target_offset != b->target_offset
 201             || a->next_offset != b->next_offset)
 202                 return NULL;
 203
 204         mptr = matchmask + sizeof(STRUCT_ENTRY);
 205         if (IPT_MATCH_ITERATE(a, match_different, a->elems, b->elems, &mptr))
 206                 return NULL;
 207         mptr += XT_ALIGN(sizeof(struct xt_entry_target));
 208
 209         return mptr;
 210 }
 211
 212 #if 0
 213 /***************************** DEBUGGING ********************************/
 214 static inline int
 215 unconditional(const struct ipt_ip *ip)
 216 {
 217         unsigned int i;
 218
 219         for (i = 0; i < sizeof(*ip)/sizeof(uint32_t); i++)
 220                 if (((uint32_t *)ip)[i])
 221                         return 0;
 222
 223         return 1;
 224 }
 225
 226 static inline int
 227 check_match(const STRUCT_ENTRY_MATCH *m, unsigned int *off)
 228 {
 229         assert(m->u.match_size >= sizeof(STRUCT_ENTRY_MATCH));
 230         assert(ALIGN(m->u.match_size) == m->u.match_size);
 231
 232         (*off) += m->u.match_size;
 233         return 0;
 234 }
 235
 236 static inline int
 237 check_entry(const STRUCT_ENTRY *e, unsigned int *i, unsigned int *off,
 238             unsigned int user_offset, int *was_return,
 239             struct xtc_handle *h)
 240 {
 241         unsigned int toff;
 242         STRUCT_STANDARD_TARGET *t;
 243
 244         assert(e->target_offset >= sizeof(STRUCT_ENTRY));
 245         assert(e->next_offset >= e->target_offset
 246                + sizeof(STRUCT_ENTRY_TARGET));
 247         toff = sizeof(STRUCT_ENTRY);
 248         IPT_MATCH_ITERATE(e, check_match, &toff);
 249
 250         assert(toff == e->target_offset);
 251
 252         t = (STRUCT_STANDARD_TARGET *)
 253                 GET_TARGET((STRUCT_ENTRY *)e);
 254         /* next_offset will have to be multiple of entry alignment. */
 255         assert(e->next_offset == ALIGN(e->next_offset));
 256         assert(e->target_offset == ALIGN(e->target_offset));
 257         assert(t->target.u.target_size == ALIGN(t->target.u.target_size));
 258         assert(!TC_IS_CHAIN(t->target.u.user.name, h));
 259
 260         if (strcmp(t->target.u.user.name, STANDARD_TARGET) == 0) {
 261                 assert(t->target.u.target_size
 262                        == ALIGN(sizeof(STRUCT_STANDARD_TARGET)));
 263
 264                 assert(t->verdict == -NF_DROP-1
 265                        || t->verdict == -NF_ACCEPT-1
 266                        || t->verdict == RETURN
 267                        || t->verdict < (int)h->entries->size);
 268
 269                 if (t->verdict >= 0) {
 270                         STRUCT_ENTRY *te = get_entry(h, t->verdict);
 271                         int idx;
 272
 273                         idx = iptcb_entry2index(h, te);
 274                         assert(strcmp(GET_TARGET(te)->u.user.name,
 275                                       XT_ERROR_TARGET)
 276                                != 0);
 277                         assert(te != e);
 278
 279                         /* Prior node must be error node, or this node. */
 280                         assert(t->verdict == iptcb_entry2offset(h, e)+e->next_offset
 281                                || strcmp(GET_TARGET(index2entry(h, idx-1))
 282                                          ->u.user.name, XT_ERROR_TARGET)
 283                                == 0);
 284                 }
 285
 286                 if (t->verdict == RETURN
 287                     && unconditional(&e->ip)
 288                     && e->target_offset == sizeof(*e))
 289                         *was_return = 1;
 290                 else
 291                         *was_return = 0;
 292         } else if (strcmp(t->target.u.user.name, XT_ERROR_TARGET) == 0) {
 293                 assert(t->target.u.target_size
 294                        == ALIGN(sizeof(struct ipt_error_target)));
 295
 296                 /* If this is in user area, previous must have been return */
 297                 if (*off > user_offset)
 298                         assert(*was_return);
 299
 300                 *was_return = 0;
 301         }
 302         else *was_return = 0;
 303
 304         if (*off == user_offset)
 305                 assert(strcmp(t->target.u.user.name, XT_ERROR_TARGET) == 0);
 306
 307         (*off) += e->next_offset;
 308         (*i)++;
 309         return 0;
 310 }
 311
 312 #ifdef IPTC_DEBUG
 313 /* Do every conceivable sanity check on the handle */
 314 static void
 315 do_check(struct xtc_handle *h, unsigned int line)
 316 {
 317         unsigned int i, n;
 318         unsigned int user_offset; /* Offset of first user chain */
 319         int was_return;
 320
 321         assert(h->changed == 0 || h->changed == 1);
 322         if (strcmp(h->info.name, "filter") == 0) {
 323                 assert(h->info.valid_hooks
 324                        == (1 << NF_IP_LOCAL_IN
 325                            | 1 << NF_IP_FORWARD
 326                            | 1 << NF_IP_LOCAL_OUT));
 327
 328                 /* Hooks should be first three */
 329                 assert(h->info.hook_entry[NF_IP_LOCAL_IN] == 0);
 330
 331                 n = get_chain_end(h, 0);
 332                 n += get_entry(h, n)->next_offset;
 333                 assert(h->info.hook_entry[NF_IP_FORWARD] == n);
 334
 335                 n = get_chain_end(h, n);
 336                 n += get_entry(h, n)->next_offset;
 337                 assert(h->info.hook_entry[NF_IP_LOCAL_OUT] == n);
 338
 339                 user_offset = h->info.hook_entry[NF_IP_LOCAL_OUT];
 340         } else if (strcmp(h->info.name, "nat") == 0) {
 341                 assert((h->info.valid_hooks
 342                         == (1 << NF_IP_PRE_ROUTING
 343                             | 1 << NF_IP_POST_ROUTING
 344                             | 1 << NF_IP_LOCAL_OUT)) ||
 345                        (h->info.valid_hooks
 346                         == (1 << NF_IP_PRE_ROUTING
 347                             | 1 << NF_IP_LOCAL_IN
 348                             | 1 << NF_IP_POST_ROUTING
 349                             | 1 << NF_IP_LOCAL_OUT)));
 350
 351                 assert(h->info.hook_entry[NF_IP_PRE_ROUTING] == 0);
 352
 353                 n = get_chain_end(h, 0);
 354
 355                 n += get_entry(h, n)->next_offset;
 356                 assert(h->info.hook_entry[NF_IP_POST_ROUTING] == n);
 357                 n = get_chain_end(h, n);
 358
 359                 n += get_entry(h, n)->next_offset;
 360                 assert(h->info.hook_entry[NF_IP_LOCAL_OUT] == n);
 361                 user_offset = h->info.hook_entry[NF_IP_LOCAL_OUT];
 362
 363                 if (h->info.valid_hooks & (1 << NF_IP_LOCAL_IN)) {
 364                         n = get_chain_end(h, n);
 365                         n += get_entry(h, n)->next_offset;
 366                         assert(h->info.hook_entry[NF_IP_LOCAL_IN] == n);
 367                         user_offset = h->info.hook_entry[NF_IP_LOCAL_IN];
 368                 }
 369
 370         } else if (strcmp(h->info.name, "mangle") == 0) {
 371                 /* This code is getting ugly because linux < 2.4.18-pre6 had
 372                  * two mangle hooks, linux >= 2.4.18-pre6 has five mangle hooks
 373                  * */
 374                 assert((h->info.valid_hooks
 375                         == (1 << NF_IP_PRE_ROUTING
 376                             | 1 << NF_IP_LOCAL_OUT)) ||
 377                        (h->info.valid_hooks
 378                         == (1 << NF_IP_PRE_ROUTING
 379                             | 1 << NF_IP_LOCAL_IN
 380                             | 1 << NF_IP_FORWARD
 381                             | 1 << NF_IP_LOCAL_OUT
 382                             | 1 << NF_IP_POST_ROUTING)));
 383
 384                 /* Hooks should be first five */
 385                 assert(h->info.hook_entry[NF_IP_PRE_ROUTING] == 0);
 386
 387                 n = get_chain_end(h, 0);
 388
 389                 if (h->info.valid_hooks & (1 << NF_IP_LOCAL_IN)) {
 390                         n += get_entry(h, n)->next_offset;
 391                         assert(h->info.hook_entry[NF_IP_LOCAL_IN] == n);
 392                         n = get_chain_end(h, n);
 393                 }
 394
 395                 if (h->info.valid_hooks & (1 << NF_IP_FORWARD)) {
 396                         n += get_entry(h, n)->next_offset;
 397                         assert(h->info.hook_entry[NF_IP_FORWARD] == n);
 398                         n = get_chain_end(h, n);
 399                 }
 400
 401                 n += get_entry(h, n)->next_offset;
 402                 assert(h->info.hook_entry[NF_IP_LOCAL_OUT] == n);
 403                 user_offset = h->info.hook_entry[NF_IP_LOCAL_OUT];
 404
 405                 if (h->info.valid_hooks & (1 << NF_IP_POST_ROUTING)) {
 406                         n = get_chain_end(h, n);
 407                         n += get_entry(h, n)->next_offset;
 408                         assert(h->info.hook_entry[NF_IP_POST_ROUTING] == n);
 409                         user_offset = h->info.hook_entry[NF_IP_POST_ROUTING];
 410                 }
 411         } else if (strcmp(h->info.name, "raw") == 0) {
 412                 assert(h->info.valid_hooks
 413                        == (1 << NF_IP_PRE_ROUTING
 414                            | 1 << NF_IP_LOCAL_OUT));
 415
 416                 /* Hooks should be first three */
 417                 assert(h->info.hook_entry[NF_IP_PRE_ROUTING] == 0);
 418
 419                 n = get_chain_end(h, n);
 420                 n += get_entry(h, n)->next_offset;
 421                 assert(h->info.hook_entry[NF_IP_LOCAL_OUT] == n);
 422
 423                 user_offset = h->info.hook_entry[NF_IP_LOCAL_OUT];
 424         } else {
 425                 fprintf(stderr, "Unknown table `%s'\n", h->info.name);
 426                 abort();
 427         }
 428
 429         /* User chain == end of last builtin + policy entry */
 430         user_offset = get_chain_end(h, user_offset);
 431         user_offset += get_entry(h, user_offset)->next_offset;
 432
 433         /* Overflows should be end of entry chains, and unconditional
 434            policy nodes. */
 435         for (i = 0; i < NUMHOOKS; i++) {
 436                 STRUCT_ENTRY *e;
 437                 STRUCT_STANDARD_TARGET *t;
 438
 439                 if (!(h->info.valid_hooks & (1 << i)))
 440                         continue;
 441                 assert(h->info.underflow[i]
 442                        == get_chain_end(h, h->info.hook_entry[i]));
 443
 444                 e = get_entry(h, get_chain_end(h, h->info.hook_entry[i]));
 445                 assert(unconditional(&e->ip));
 446                 assert(e->target_offset == sizeof(*e));
 447                 t = (STRUCT_STANDARD_TARGET *)GET_TARGET(e);
 448                 assert(t->target.u.target_size == ALIGN(sizeof(*t)));
 449                 assert(e->next_offset == sizeof(*e) + ALIGN(sizeof(*t)));
 450
 451                 assert(strcmp(t->target.u.user.name, STANDARD_TARGET)==0);
 452                 assert(t->verdict == -NF_DROP-1 || t->verdict == -NF_ACCEPT-1);
 453
 454                 /* Hooks and underflows must be valid entries */
 455                 entry2index(h, get_entry(h, h->info.hook_entry[i]));
 456                 entry2index(h, get_entry(h, h->info.underflow[i]));
 457         }
 458
 459         assert(h->info.size
 460                >= h->info.num_entries * (sizeof(STRUCT_ENTRY)
 461                                          +sizeof(STRUCT_STANDARD_TARGET)));
 462
 463         assert(h->entries.size
 464                >= (h->new_number
 465                    * (sizeof(STRUCT_ENTRY)
 466                       + sizeof(STRUCT_STANDARD_TARGET))));
 467         assert(strcmp(h->info.name, h->entries.name) == 0);
 468
 469         i = 0; n = 0;
 470         was_return = 0;
 471         /* Check all the entries. */
 472         ENTRY_ITERATE(h->entries.entrytable, h->entries.size,
 473                       check_entry, &i, &n, user_offset, &was_return, h);
 474
 475         assert(i == h->new_number);
 476         assert(n == h->entries.size);
 477
 478         /* Final entry must be error node */
 479         assert(strcmp(GET_TARGET(index2entry(h, h->new_number-1))
 480                       ->u.user.name,
 481                       ERROR_TARGET) == 0);
 482 }
 483 #endif /*IPTC_DEBUG*/
 484
 485 #endif