ip6tables.c

   1 /* Code to take an ip6tables-style command line and do it. */
   2
   3 /*
   4  * Author: Paul.Russell@rustcorp.com.au and mneuling@radlogic.com.au
   5  *
   6  * (C) 2000-2002 by the netfilter coreteam <coreteam@netfilter.org>:
   7  *                  Paul 'Rusty' Russell <rusty@rustcorp.com.au>
   8  *                  Marc Boucher <marc+nf@mbsi.ca>
   9  *                  James Morris <jmorris@intercode.com.au>
  10  *                  Harald Welte <laforge@gnumonks.org>
  11  *                  Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
  12  *
  13  *      This program is free software; you can redistribute it and/or modify
  14  *      it under the terms of the GNU General Public License as published by
  15  *      the Free Software Foundation; either version 2 of the License, or
  16  *      (at your option) any later version.
  17  *
  18  *      This program is distributed in the hope that it will be useful,
  19  *      but WITHOUT ANY WARRANTY; without even the implied warranty of
  20  *      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  21  *      GNU General Public License for more details.
  22  *
  23  *      You should have received a copy of the GNU General Public License
  24  *      along with this program; if not, write to the Free Software
  25  *      Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  26  */
  27
  28 #include <getopt.h>
  29 #include <string.h>
  30 #include <netdb.h>
  31 #include <errno.h>
  32 #include <stdio.h>
  33 #include <stdlib.h>
  34 #include <ctype.h>
  35 #include <stdarg.h>
  36 #include <stdbool.h>
  37 #include <limits.h>
  38 #include <ip6tables.h>
  39 #include <xtables.h>
  40 #include <arpa/inet.h>
  41 #include <unistd.h>
  42 #include <fcntl.h>
  43 #include <sys/types.h>
  44 #include <sys/socket.h>
  45 #include "ip6tables-multi.h"
  46 #include "xshared.h"
  47
  48 #ifndef TRUE
  49 #define TRUE 1
  50 #endif
  51 #ifndef FALSE
  52 #define FALSE 0
  53 #endif
  54
  55 #define FMT_NUMERIC     0x0001
  56 #define FMT_NOCOUNTS    0x0002
  57 #define FMT_KILOMEGAGIGA 0x0004
  58 #define FMT_OPTIONS     0x0008
  59 #define FMT_NOTABLE     0x0010
  60 #define FMT_NOTARGET    0x0020
  61 #define FMT_VIA         0x0040
  62 #define FMT_NONEWLINE   0x0080
  63 #define FMT_LINENUMBERS 0x0100
  64
  65 #define FMT_PRINT_RULE (FMT_NOCOUNTS | FMT_OPTIONS | FMT_VIA \
  66                         | FMT_NUMERIC | FMT_NOTABLE)
  67 #define FMT(tab,notab) ((format) & FMT_NOTABLE ? (notab) : (tab))
  68
  69
  70 #define CMD_NONE                0x0000U
  71 #define CMD_INSERT              0x0001U
  72 #define CMD_DELETE              0x0002U
  73 #define CMD_DELETE_NUM          0x0004U
  74 #define CMD_REPLACE             0x0008U
  75 #define CMD_APPEND              0x0010U
  76 #define CMD_LIST                0x0020U
  77 #define CMD_FLUSH               0x0040U
  78 #define CMD_ZERO                0x0080U
  79 #define CMD_NEW_CHAIN           0x0100U
  80 #define CMD_DELETE_CHAIN        0x0200U
  81 #define CMD_SET_POLICY          0x0400U
  82 #define CMD_RENAME_CHAIN        0x0800U
  83 #define CMD_LIST_RULES          0x1000U
  84 #define CMD_ZERO_NUM            0x2000U
  85 #define NUMBER_OF_CMD   15
  86 static const char cmdflags[] = { 'I', 'D', 'D', 'R', 'A', 'L', 'F', 'Z',
  87                                  'Z', 'N', 'X', 'P', 'E', 'S' };
  88
  89 #define OPT_NONE        0x00000U
  90 #define OPT_NUMERIC     0x00001U
  91 #define OPT_SOURCE      0x00002U
  92 #define OPT_DESTINATION 0x00004U
  93 #define OPT_PROTOCOL    0x00008U
  94 #define OPT_JUMP        0x00010U
  95 #define OPT_VERBOSE     0x00020U
  96 #define OPT_EXPANDED    0x00040U
  97 #define OPT_VIANAMEIN   0x00080U
  98 #define OPT_VIANAMEOUT  0x00100U
  99 #define OPT_LINENUMBERS 0x00200U
 100 #define OPT_COUNTERS    0x00400U
 101 #define NUMBER_OF_OPT   11
 102 static const char optflags[NUMBER_OF_OPT]
 103 = { 'n', 's', 'd', 'p', 'j', 'v', 'x', 'i', 'o', '0', 'c'};
 104
 105 static struct option original_opts[] = {
 106         {.name = "append",        .has_arg = 1, .val = 'A'},
 107         {.name = "delete",        .has_arg = 1, .val = 'D'},
 108         {.name = "insert",        .has_arg = 1, .val = 'I'},
 109         {.name = "replace",       .has_arg = 1, .val = 'R'},
 110         {.name = "list",          .has_arg = 2, .val = 'L'},
 111         {.name = "list-rules",    .has_arg = 2, .val = 'S'},
 112         {.name = "flush",         .has_arg = 2, .val = 'F'},
 113         {.name = "zero",          .has_arg = 2, .val = 'Z'},
 114         {.name = "new-chain",     .has_arg = 1, .val = 'N'},
 115         {.name = "delete-chain",  .has_arg = 2, .val = 'X'},
 116         {.name = "rename-chain",  .has_arg = 1, .val = 'E'},
 117         {.name = "policy",        .has_arg = 1, .val = 'P'},
 118         {.name = "source",        .has_arg = 1, .val = 's'},
 119         {.name = "destination",   .has_arg = 1, .val = 'd'},
 120         {.name = "src",           .has_arg = 1, .val = 's'}, /* synonym */
 121         {.name = "dst",           .has_arg = 1, .val = 'd'}, /* synonym */
 122         {.name = "protocol",      .has_arg = 1, .val = 'p'},
 123         {.name = "in-interface",  .has_arg = 1, .val = 'i'},
 124         {.name = "jump",          .has_arg = 1, .val = 'j'},
 125         {.name = "table",         .has_arg = 1, .val = 't'},
 126         {.name = "match",         .has_arg = 1, .val = 'm'},
 127         {.name = "numeric",       .has_arg = 0, .val = 'n'},
 128         {.name = "out-interface", .has_arg = 1, .val = 'o'},
 129         {.name = "verbose",       .has_arg = 0, .val = 'v'},
 130         {.name = "exact",         .has_arg = 0, .val = 'x'},
 131         {.name = "version",       .has_arg = 0, .val = 'V'},
 132         {.name = "help",          .has_arg = 2, .val = 'h'},
 133         {.name = "line-numbers",  .has_arg = 0, .val = '0'},
 134         {.name = "modprobe",      .has_arg = 1, .val = 'M'},
 135         {.name = "set-counters",  .has_arg = 1, .val = 'c'},
 136         {.name = "goto",          .has_arg = 1, .val = 'g'},
 137         {NULL},
 138 };
 139
 140 /* we need this for ip6tables-restore. ip6tables-restore.c sets line to the
 141  * current line of the input file, in order to give a more precise error
 142  * message. ip6tables itself doesn't need this, so it is initialized to the
 143  * magic number of -1 */
 144 int line = -1;
 145
 146 void ip6tables_exit_error(enum xtables_exittype status, const char *msg, ...) __attribute__((noreturn, format(printf,2,3)));
 147 struct xtables_globals ip6tables_globals = {
 148         .option_offset = 0,
 149         .program_version = IPTABLES_VERSION,
 150         .opts = original_opts,
 151         .orig_opts = original_opts,
 152         .exit_err = ip6tables_exit_error,
 153 };
 154
 155 /* Table of legal combinations of commands and options.  If any of the
 156  * given commands make an option legal, that option is legal (applies to
 157  * CMD_LIST and CMD_ZERO only).
 158  * Key:
 159  *  +  compulsory
 160  *  x  illegal
 161  *     optional
 162  */
 163
 164 static char commands_v_options[NUMBER_OF_CMD][NUMBER_OF_OPT] =
 165 /* Well, it's better than "Re: Linux vs FreeBSD" */
 166 {
 167         /*     -n  -s  -d  -p  -j  -v  -x  -i  -o --line -c */
 168 /*INSERT*/    {'x',' ',' ',' ',' ',' ','x',' ',' ','x',' '},
 169 /*DELETE*/    {'x',' ',' ',' ',' ',' ','x',' ',' ','x','x'},
 170 /*DELETE_NUM*/{'x','x','x','x','x',' ','x','x','x','x','x'},
 171 /*REPLACE*/   {'x',' ',' ',' ',' ',' ','x',' ',' ','x',' '},
 172 /*APPEND*/    {'x',' ',' ',' ',' ',' ','x',' ',' ','x',' '},
 173 /*LIST*/      {' ','x','x','x','x',' ',' ','x','x',' ','x'},
 174 /*FLUSH*/     {'x','x','x','x','x',' ','x','x','x','x','x'},
 175 /*ZERO*/      {'x','x','x','x','x',' ','x','x','x','x','x'},
 176 /*ZERO_NUM*/  {'x','x','x','x','x',' ','x','x','x','x','x'},
 177 /*NEW_CHAIN*/ {'x','x','x','x','x',' ','x','x','x','x','x'},
 178 /*DEL_CHAIN*/ {'x','x','x','x','x',' ','x','x','x','x','x'},
 179 /*SET_POLICY*/{'x','x','x','x','x',' ','x','x','x','x',' '},
 180 /*RENAME*/    {'x','x','x','x','x',' ','x','x','x','x','x'},
 181 /*LIST_RULES*/{'x','x','x','x','x',' ','x','x','x','x','x'}
 182 };
 183
 184 static int inverse_for_options[NUMBER_OF_OPT] =
 185 {
 186 /* -n */ 0,
 187 /* -s */ IP6T_INV_SRCIP,
 188 /* -d */ IP6T_INV_DSTIP,
 189 /* -p */ IP6T_INV_PROTO,
 190 /* -j */ 0,
 191 /* -v */ 0,
 192 /* -x */ 0,
 193 /* -i */ IP6T_INV_VIA_IN,
 194 /* -o */ IP6T_INV_VIA_OUT,
 195 /*--line*/ 0,
 196 /* -c */ 0,
 197 };
 198
 199 #define opts ip6tables_globals.opts
 200 #define prog_name ip6tables_globals.program_name
 201 #define prog_vers ip6tables_globals.program_version
 202 /* A few hardcoded protocols for 'all' and in case the user has no
 203    /etc/protocols */
 204 struct pprot {
 205         char *name;
 206         u_int8_t num;
 207 };
 208
 209 static const char *
 210 proto_to_name(u_int8_t proto, int nolookup)
 211 {
 212         unsigned int i;
 213
 214         if (proto && !nolookup) {
 215                 struct protoent *pent = getprotobynumber(proto);
 216                 if (pent)
 217                         return pent->p_name;
 218         }
 219
 220         for (i = 0; xtables_chain_protos[i].name != NULL; ++i)
 221                 if (xtables_chain_protos[i].num == proto)
 222                         return xtables_chain_protos[i].name;
 223
 224         return NULL;
 225 }
 226
 227 static void __attribute__((noreturn))
 228 exit_tryhelp(int status)
 229 {
 230         if (line != -1)
 231                 fprintf(stderr, "Error occurred at line: %d\n", line);
 232         fprintf(stderr, "Try `%s -h' or '%s --help' for more information.\n",
 233                         prog_name, prog_name);
 234         xtables_free_opts(1);
 235         exit(status);
 236 }
 237
 238 static void
 239 exit_printhelp(struct xtables_rule_match *matches)
 240 {
 241         printf("%s v%s\n\n"
 242 "Usage: %s -[AD] chain rule-specification [options]\n"
 243 "       %s -I chain [rulenum] rule-specification [options]\n"
 244 "       %s -R chain rulenum rule-specification [options]\n"
 245 "       %s -D chain rulenum [options]\n"
 246 "       %s -[LS] [chain [rulenum]] [options]\n"
 247 "       %s -[FZ] [chain] [options]\n"
 248 "       %s -[NX] chain\n"
 249 "       %s -E old-chain-name new-chain-name\n"
 250 "       %s -P chain target [options]\n"
 251 "       %s -h (print this help information)\n\n",
 252                prog_name, prog_vers, prog_name, prog_name,
 253                prog_name, prog_name, prog_name, prog_name,
 254                prog_name, prog_name, prog_name, prog_name);
 255
 256         printf(
 257 "Commands:\n"
 258 "Either long or short options are allowed.\n"
 259 "  --append  -A chain           Append to chain\n"
 260 "  --delete  -D chain           Delete matching rule from chain\n"
 261 "  --delete  -D chain rulenum\n"
 262 "                               Delete rule rulenum (1 = first) from chain\n"
 263 "  --insert  -I chain [rulenum]\n"
 264 "                               Insert in chain as rulenum (default 1=first)\n"
 265 "  --replace -R chain rulenum\n"
 266 "                               Replace rule rulenum (1 = first) in chain\n"
 267 "  --list    -L [chain [rulenum]]\n"
 268 "                               List the rules in a chain or all chains\n"
 269 "  --list-rules -S [chain [rulenum]]\n"
 270 "                               Print the rules in a chain or all chains\n"
 271 "  --flush   -F [chain]         Delete all rules in  chain or all chains\n"
 272 "  --zero    -Z [chain [rulenum]]\n"
 273 "                               Zero counters in chain or all chains\n"
 274 "  --new     -N chain           Create a new user-defined chain\n"
 275 "  --delete-chain\n"
 276 "            -X [chain]         Delete a user-defined chain\n"
 277 "  --policy  -P chain target\n"
 278 "                               Change policy on chain to target\n"
 279 "  --rename-chain\n"
 280 "            -E old-chain new-chain\n"
 281 "                               Change chain name, (moving any references)\n"
 282
 283 "Options:\n"
 284 "[!] --proto    -p proto        protocol: by number or name, eg. `tcp'\n"
 285 "[!] --source   -s address[/mask][,...]\n"
 286 "                               source specification\n"
 287 "[!] --destination -d address[/mask][,...]\n"
 288 "                               destination specification\n"
 289 "[!] --in-interface -i input name[+]\n"
 290 "                               network interface name ([+] for wildcard)\n"
 291 "  --jump       -j target\n"
 292 "                               target for rule (may load target extension)\n"
 293 #ifdef IP6T_F_GOTO
 294 "  --goto       -g chain\n"
 295 "                               jump to chain with no return\n"
 296 #endif
 297 "  --match      -m match\n"
 298 "                               extended match (may load extension)\n"
 299 "  --numeric    -n              numeric output of addresses and ports\n"
 300 "[!] --out-interface -o output name[+]\n"
 301 "                               network interface name ([+] for wildcard)\n"
 302 "  --table      -t table        table to manipulate (default: `filter')\n"
 303 "  --verbose    -v              verbose mode\n"
 304 "  --line-numbers               print line numbers when listing\n"
 305 "  --exact      -x              expand numbers (display exact values)\n"
 306 /*"[!] --fragment       -f              match second or further fragments only\n"*/
 307 "  --modprobe=<command>         try to insert modules using this command\n"
 308 "  --set-counters PKTS BYTES    set the counter during insert/append\n"
 309 "[!] --version  -V              print package version.\n");
 310
 311         print_extension_helps(xtables_targets, matches);
 312         exit(0);
 313 }
 314
 315 void
 316 ip6tables_exit_error(enum xtables_exittype status, const char *msg, ...)
 317 {
 318         va_list args;
 319
 320         va_start(args, msg);
 321         fprintf(stderr, "%s v%s: ", prog_name, prog_vers);
 322         vfprintf(stderr, msg, args);
 323         va_end(args);
 324         fprintf(stderr, "\n");
 325         if (status == PARAMETER_PROBLEM)
 326                 exit_tryhelp(status);
 327         if (status == VERSION_PROBLEM)
 328                 fprintf(stderr,
 329                         "Perhaps ip6tables or your kernel needs to be upgraded.\n");
 330         /* On error paths, make sure that we don't leak memory */
 331         xtables_free_opts(1);
 332         exit(status);
 333 }
 334
 335 static void
 336 generic_opt_check(int command, int options)
 337 {
 338         int i, j, legal = 0;
 339
 340         /* Check that commands are valid with options.  Complicated by the
 341          * fact that if an option is legal with *any* command given, it is
 342          * legal overall (ie. -z and -l).
 343          */
 344         for (i = 0; i < NUMBER_OF_OPT; i++) {
 345                 legal = 0; /* -1 => illegal, 1 => legal, 0 => undecided. */
 346
 347                 for (j = 0; j < NUMBER_OF_CMD; j++) {
 348                         if (!(command & (1<<j)))
 349                                 continue;
 350
 351                         if (!(options & (1<<i))) {
 352                                 if (commands_v_options[j][i] == '+')
 353                                         xtables_error(PARAMETER_PROBLEM,
 354                                                    "You need to supply the `-%c' "
 355                                                    "option for this command\n",
 356                                                    optflags[i]);
 357                         } else {
 358                                 if (commands_v_options[j][i] != 'x')
 359                                         legal = 1;
 360                                 else if (legal == 0)
 361                                         legal = -1;
 362                         }
 363                 }
 364                 if (legal == -1)
 365                         xtables_error(PARAMETER_PROBLEM,
 366                                    "Illegal option `-%c' with this command\n",
 367                                    optflags[i]);
 368         }
 369 }
 370
 371 static char
 372 opt2char(int option)
 373 {
 374         const char *ptr;
 375         for (ptr = optflags; option > 1; option >>= 1, ptr++);
 376
 377         return *ptr;
 378 }
 379
 380 static char
 381 cmd2char(int option)
 382 {
 383         const char *ptr;
 384         for (ptr = cmdflags; option > 1; option >>= 1, ptr++);
 385
 386         return *ptr;
 387 }
 388
 389 static void
 390 add_command(unsigned int *cmd, const int newcmd, const int othercmds,
 391             int invert)
 392 {
 393         if (invert)
 394                 xtables_error(PARAMETER_PROBLEM, "unexpected '!' flag");
 395         if (*cmd & (~othercmds))
 396                 xtables_error(PARAMETER_PROBLEM, "Cannot use -%c with -%c\n",
 397                            cmd2char(newcmd), cmd2char(*cmd & (~othercmds)));
 398         *cmd |= newcmd;
 399 }
 400
 401 /*
 402  *      All functions starting with "parse" should succeed, otherwise
 403  *      the program fails.
 404  *      Most routines return pointers to static data that may change
 405  *      between calls to the same or other routines with a few exceptions:
 406  *      "host_to_addr", "parse_hostnetwork", and "parse_hostnetworkmask"
 407  *      return global static data.
 408 */
 409
 410 /* Christophe Burki wants `-p 6' to imply `-m tcp'.  */
 411 static struct xtables_match *
 412 find_proto(const char *pname, enum xtables_tryload tryload,
 413            int nolookup, struct xtables_rule_match **matches)
 414 {
 415         unsigned int proto;
 416
 417         if (xtables_strtoui(pname, NULL, &proto, 0, UINT8_MAX)) {
 418                 const char *protoname = proto_to_name(proto, nolookup);
 419
 420                 if (protoname)
 421                         return xtables_find_match(protoname, tryload, matches);
 422         } else
 423                 return xtables_find_match(pname, tryload, matches);
 424
 425         return NULL;
 426 }
 427
 428 /* These are invalid numbers as upper layer protocol */
 429 static int is_exthdr(u_int16_t proto)
 430 {
 431         return (proto == IPPROTO_ROUTING ||
 432                 proto == IPPROTO_FRAGMENT ||
 433                 proto == IPPROTO_AH ||
 434                 proto == IPPROTO_DSTOPTS);
 435 }
 436
 437 /* Can't be zero. */
 438 static int
 439 parse_rulenumber(const char *rule)
 440 {
 441         unsigned int rulenum;
 442
 443         if (!xtables_strtoui(rule, NULL, &rulenum, 1, INT_MAX))
 444                 xtables_error(PARAMETER_PROBLEM,
 445                            "Invalid rule number `%s'", rule);
 446
 447         return rulenum;
 448 }
 449
 450 static const char *
 451 parse_target(const char *targetname)
 452 {
 453         const char *ptr;
 454
 455         if (strlen(targetname) < 1)
 456                 xtables_error(PARAMETER_PROBLEM,
 457                            "Invalid target name (too short)");
 458
 459         if (strlen(targetname) >= XT_EXTENSION_MAXNAMELEN)
 460                 xtables_error(PARAMETER_PROBLEM,
 461                            "Invalid target name `%s' (%u chars max)",
 462                            targetname, XT_EXTENSION_MAXNAMELEN - 1);
 463
 464         for (ptr = targetname; *ptr; ptr++)
 465                 if (isspace(*ptr))
 466                         xtables_error(PARAMETER_PROBLEM,
 467                                    "Invalid target name `%s'", targetname);
 468         return targetname;
 469 }
 470
 471 static void
 472 set_option(unsigned int *options, unsigned int option, u_int8_t *invflg,
 473            int invert)
 474 {
 475         if (*options & option)
 476                 xtables_error(PARAMETER_PROBLEM, "multiple -%c flags not allowed",
 477                            opt2char(option));
 478         *options |= option;
 479
 480         if (invert) {
 481                 unsigned int i;
 482                 for (i = 0; 1 << i != option; i++);
 483
 484                 if (!inverse_for_options[i])
 485                         xtables_error(PARAMETER_PROBLEM,
 486                                    "cannot have ! before -%c",
 487                                    opt2char(option));
 488                 *invflg |= inverse_for_options[i];
 489         }
 490 }
 491
 492 static void
 493 print_num(u_int64_t number, unsigned int format)
 494 {
 495         if (format & FMT_KILOMEGAGIGA) {
 496                 if (number > 99999) {
 497                         number = (number + 500) / 1000;
 498                         if (number > 9999) {
 499                                 number = (number + 500) / 1000;
 500                                 if (number > 9999) {
 501                                         number = (number + 500) / 1000;
 502                                         if (number > 9999) {
 503                                                 number = (number + 500) / 1000;
 504                                                 printf(FMT("%4lluT ","%lluT "), (unsigned long long)number);
 505                                         }
 506                                         else printf(FMT("%4lluG ","%lluG "), (unsigned long long)number);
 507                                 }
 508                                 else printf(FMT("%4lluM ","%lluM "), (unsigned long long)number);
 509                         } else
 510                                 printf(FMT("%4lluK ","%lluK "), (unsigned long long)number);
 511                 } else
 512                         printf(FMT("%5llu ","%llu "), (unsigned long long)number);
 513         } else
 514                 printf(FMT("%8llu ","%llu "), (unsigned long long)number);
 515 }
 516
 517
 518 static void
 519 print_header(unsigned int format, const char *chain, struct ip6tc_handle *handle)
 520 {
 521         struct ip6t_counters counters;
 522         const char *pol = ip6tc_get_policy(chain, &counters, handle);
 523         printf("Chain %s", chain);
 524         if (pol) {
 525                 printf(" (policy %s", pol);
 526                 if (!(format & FMT_NOCOUNTS)) {
 527                         fputc(' ', stdout);
 528                         print_num(counters.pcnt, (format|FMT_NOTABLE));
 529                         fputs("packets, ", stdout);
 530                         print_num(counters.bcnt, (format|FMT_NOTABLE));
 531                         fputs("bytes", stdout);
 532                 }
 533                 printf(")\n");
 534         } else {
 535                 unsigned int refs;
 536                 if (!ip6tc_get_references(&refs, chain, handle))
 537                         printf(" (ERROR obtaining refs)\n");
 538                 else
 539                         printf(" (%u references)\n", refs);
 540         }
 541
 542         if (format & FMT_LINENUMBERS)
 543                 printf(FMT("%-4s ", "%s "), "num");
 544         if (!(format & FMT_NOCOUNTS)) {
 545                 if (format & FMT_KILOMEGAGIGA) {
 546                         printf(FMT("%5s ","%s "), "pkts");
 547                         printf(FMT("%5s ","%s "), "bytes");
 548                 } else {
 549                         printf(FMT("%8s ","%s "), "pkts");
 550                         printf(FMT("%10s ","%s "), "bytes");
 551                 }
 552         }
 553         if (!(format & FMT_NOTARGET))
 554                 printf(FMT("%-9s ","%s "), "target");
 555         fputs(" prot ", stdout);
 556         if (format & FMT_OPTIONS)
 557                 fputs("opt", stdout);
 558         if (format & FMT_VIA) {
 559                 printf(FMT(" %-6s ","%s "), "in");
 560                 printf(FMT("%-6s ","%s "), "out");
 561         }
 562         printf(FMT(" %-19s ","%s "), "source");
 563         printf(FMT(" %-19s "," %s "), "destination");
 564         printf("\n");
 565 }
 566
 567
 568 static int
 569 print_match(const struct ip6t_entry_match *m,
 570             const struct ip6t_ip6 *ip,
 571             int numeric)
 572 {
 573         struct xtables_match *match =
 574                 xtables_find_match(m->u.user.name, XTF_TRY_LOAD, NULL);
 575
 576         if (match) {
 577                 if (match->print)
 578                         match->print(ip, m, numeric);
 579                 else
 580                         printf("%s ", match->name);
 581         } else {
 582                 if (m->u.user.name[0])
 583                         printf("UNKNOWN match `%s' ", m->u.user.name);
 584         }
 585         /* Don't stop iterating. */
 586         return 0;
 587 }
 588
 589 /* e is called `fw' here for historical reasons */
 590 static void
 591 print_firewall(const struct ip6t_entry *fw,
 592                const char *targname,
 593                unsigned int num,
 594                unsigned int format,
 595                struct ip6tc_handle *const handle)
 596 {
 597         struct xtables_target *target = NULL;
 598         const struct ip6t_entry_target *t;
 599         u_int8_t flags;
 600         char buf[BUFSIZ];
 601
 602         if (!ip6tc_is_chain(targname, handle))
 603                 target = xtables_find_target(targname, XTF_TRY_LOAD);
 604         else
 605                 target = xtables_find_target(IP6T_STANDARD_TARGET,
 606                          XTF_LOAD_MUST_SUCCEED);
 607
 608         t = ip6t_get_target((struct ip6t_entry *)fw);
 609         flags = fw->ipv6.flags;
 610
 611         if (format & FMT_LINENUMBERS)
 612                 printf(FMT("%-4u ", "%u "), num);
 613
 614         if (!(format & FMT_NOCOUNTS)) {
 615                 print_num(fw->counters.pcnt, format);
 616                 print_num(fw->counters.bcnt, format);
 617         }
 618
 619         if (!(format & FMT_NOTARGET))
 620                 printf(FMT("%-9s ", "%s "), targname);
 621
 622         fputc(fw->ipv6.invflags & IP6T_INV_PROTO ? '!' : ' ', stdout);
 623         {
 624                 const char *pname = proto_to_name(fw->ipv6.proto, format&FMT_NUMERIC);
 625                 if (pname)
 626                         printf(FMT("%-5s", "%s "), pname);
 627                 else
 628                         printf(FMT("%-5hu", "%hu "), fw->ipv6.proto);
 629         }
 630
 631         if (format & FMT_OPTIONS) {
 632                 if (format & FMT_NOTABLE)
 633                         fputs("opt ", stdout);
 634                 fputc(' ', stdout); /* Invert flag of FRAG */
 635                 fputc(' ', stdout); /* -f */
 636                 fputc(' ', stdout);
 637         }
 638
 639         if (format & FMT_VIA) {
 640                 char iface[IFNAMSIZ+2];
 641
 642                 if (fw->ipv6.invflags & IP6T_INV_VIA_IN) {
 643                         iface[0] = '!';
 644                         iface[1] = '\0';
 645                 }
 646                 else iface[0] = '\0';
 647
 648                 if (fw->ipv6.iniface[0] != '\0') {
 649                         strcat(iface, fw->ipv6.iniface);
 650                 }
 651                 else if (format & FMT_NUMERIC) strcat(iface, "*");
 652                 else strcat(iface, "any");
 653                 printf(FMT(" %-6s ","in %s "), iface);
 654
 655                 if (fw->ipv6.invflags & IP6T_INV_VIA_OUT) {
 656                         iface[0] = '!';
 657                         iface[1] = '\0';
 658                 }
 659                 else iface[0] = '\0';
 660
 661                 if (fw->ipv6.outiface[0] != '\0') {
 662                         strcat(iface, fw->ipv6.outiface);
 663                 }
 664                 else if (format & FMT_NUMERIC) strcat(iface, "*");
 665                 else strcat(iface, "any");
 666                 printf(FMT("%-6s ","out %s "), iface);
 667         }
 668
 669         fputc(fw->ipv6.invflags & IP6T_INV_SRCIP ? '!' : ' ', stdout);
 670         if (!memcmp(&fw->ipv6.smsk, &in6addr_any, sizeof in6addr_any)
 671             && !(format & FMT_NUMERIC))
 672                 printf(FMT("%-19s ","%s "), "anywhere");
 673         else {
 674                 if (format & FMT_NUMERIC)
 675                         strcpy(buf, xtables_ip6addr_to_numeric(&fw->ipv6.src));
 676                 else
 677                         strcpy(buf, xtables_ip6addr_to_anyname(&fw->ipv6.src));
 678                 strcat(buf, xtables_ip6mask_to_numeric(&fw->ipv6.smsk));
 679                 printf(FMT("%-19s ","%s "), buf);
 680         }
 681
 682         fputc(fw->ipv6.invflags & IP6T_INV_DSTIP ? '!' : ' ', stdout);
 683         if (!memcmp(&fw->ipv6.dmsk, &in6addr_any, sizeof in6addr_any)
 684             && !(format & FMT_NUMERIC))
 685                 printf(FMT("%-19s ","-> %s"), "anywhere");
 686         else {
 687                 if (format & FMT_NUMERIC)
 688                         strcpy(buf, xtables_ip6addr_to_numeric(&fw->ipv6.dst));
 689                 else
 690                         strcpy(buf, xtables_ip6addr_to_anyname(&fw->ipv6.dst));
 691                 strcat(buf, xtables_ip6mask_to_numeric(&fw->ipv6.dmsk));
 692                 printf(FMT("%-19s ","-> %s"), buf);
 693         }
 694
 695         if (format & FMT_NOTABLE)
 696                 fputs("  ", stdout);
 697
 698 #ifdef IP6T_F_GOTO
 699         if(fw->ipv6.flags & IP6T_F_GOTO)
 700                 printf("[goto] ");
 701 #endif
 702
 703         IP6T_MATCH_ITERATE(fw, print_match, &fw->ipv6, format & FMT_NUMERIC);
 704
 705         if (target) {
 706                 if (target->print)
 707                         /* Print the target information. */
 708                         target->print(&fw->ipv6, t, format & FMT_NUMERIC);
 709         } else if (t->u.target_size != sizeof(*t))
 710                 printf("[%u bytes of unknown target data] ",
 711                        (unsigned int)(t->u.target_size - sizeof(*t)));
 712
 713         if (!(format & FMT_NONEWLINE))
 714                 fputc('\n', stdout);
 715 }
 716
 717 static void
 718 print_firewall_line(const struct ip6t_entry *fw,
 719                     struct ip6tc_handle *const h)
 720 {
 721         struct ip6t_entry_target *t;
 722
 723         t = ip6t_get_target((struct ip6t_entry *)fw);
 724         print_firewall(fw, t->u.user.name, 0, FMT_PRINT_RULE, h);
 725 }
 726
 727 static int
 728 append_entry(const ip6t_chainlabel chain,
 729              struct ip6t_entry *fw,
 730              unsigned int nsaddrs,
 731              const struct in6_addr saddrs[],
 732              const struct in6_addr smasks[],
 733              unsigned int ndaddrs,
 734              const struct in6_addr daddrs[],
 735              const struct in6_addr dmasks[],
 736              int verbose,
 737              struct ip6tc_handle *handle)
 738 {
 739         unsigned int i, j;
 740         int ret = 1;
 741
 742         for (i = 0; i < nsaddrs; i++) {
 743                 fw->ipv6.src = saddrs[i];
 744                 fw->ipv6.smsk = smasks[i];
 745                 for (j = 0; j < ndaddrs; j++) {
 746                         fw->ipv6.dst = daddrs[j];
 747                         fw->ipv6.dmsk = dmasks[j];
 748                         if (verbose)
 749                                 print_firewall_line(fw, handle);
 750                         ret &= ip6tc_append_entry(chain, fw, handle);
 751                 }
 752         }
 753
 754         return ret;
 755 }
 756
 757 static int
 758 replace_entry(const ip6t_chainlabel chain,
 759               struct ip6t_entry *fw,
 760               unsigned int rulenum,
 761               const struct in6_addr *saddr, const struct in6_addr *smask,
 762               const struct in6_addr *daddr, const struct in6_addr *dmask,
 763               int verbose,
 764               struct ip6tc_handle *handle)
 765 {
 766         fw->ipv6.src = *saddr;
 767         fw->ipv6.dst = *daddr;
 768         fw->ipv6.smsk = *smask;
 769         fw->ipv6.dmsk = *dmask;
 770
 771         if (verbose)
 772                 print_firewall_line(fw, handle);
 773         return ip6tc_replace_entry(chain, fw, rulenum, handle);
 774 }
 775
 776 static int
 777 insert_entry(const ip6t_chainlabel chain,
 778              struct ip6t_entry *fw,
 779              unsigned int rulenum,
 780              unsigned int nsaddrs,
 781              const struct in6_addr saddrs[],
 782              const struct in6_addr smasks[],
 783              unsigned int ndaddrs,
 784              const struct in6_addr daddrs[],
 785              const struct in6_addr dmasks[],
 786              int verbose,
 787              struct ip6tc_handle *handle)
 788 {
 789         unsigned int i, j;
 790         int ret = 1;
 791
 792         for (i = 0; i < nsaddrs; i++) {
 793                 fw->ipv6.src = saddrs[i];
 794                 fw->ipv6.smsk = smasks[i];
 795                 for (j = 0; j < ndaddrs; j++) {
 796                         fw->ipv6.dst = daddrs[j];
 797                         fw->ipv6.dmsk = dmasks[j];
 798                         if (verbose)
 799                                 print_firewall_line(fw, handle);
 800                         ret &= ip6tc_insert_entry(chain, fw, rulenum, handle);
 801                 }
 802         }
 803
 804         return ret;
 805 }
 806
 807 static unsigned char *
 808 make_delete_mask(struct xtables_rule_match *matches,
 809                  const struct xtables_target *target)
 810 {
 811         /* Establish mask for comparison */
 812         unsigned int size;
 813         struct xtables_rule_match *matchp;
 814         unsigned char *mask, *mptr;
 815
 816         size = sizeof(struct ip6t_entry);
 817         for (matchp = matches; matchp; matchp = matchp->next)
 818                 size += IP6T_ALIGN(sizeof(struct ip6t_entry_match)) + matchp->match->size;
 819
 820         mask = xtables_calloc(1, size
 821                          + IP6T_ALIGN(sizeof(struct ip6t_entry_target))
 822                          + target->size);
 823
 824         memset(mask, 0xFF, sizeof(struct ip6t_entry));
 825         mptr = mask + sizeof(struct ip6t_entry);
 826
 827         for (matchp = matches; matchp; matchp = matchp->next) {
 828                 memset(mptr, 0xFF,
 829                        IP6T_ALIGN(sizeof(struct ip6t_entry_match))
 830                        + matchp->match->userspacesize);
 831                 mptr += IP6T_ALIGN(sizeof(struct ip6t_entry_match)) + matchp->match->size;
 832         }
 833
 834         memset(mptr, 0xFF,
 835                IP6T_ALIGN(sizeof(struct ip6t_entry_target))
 836                + target->userspacesize);
 837
 838         return mask;
 839 }
 840
 841 static int
 842 delete_entry(const ip6t_chainlabel chain,
 843              struct ip6t_entry *fw,
 844              unsigned int nsaddrs,
 845              const struct in6_addr saddrs[],
 846              const struct in6_addr smasks[],
 847              unsigned int ndaddrs,
 848              const struct in6_addr daddrs[],
 849              const struct in6_addr dmasks[],
 850              int verbose,
 851              struct ip6tc_handle *handle,
 852              struct xtables_rule_match *matches,
 853              const struct xtables_target *target)
 854 {
 855         unsigned int i, j;
 856         int ret = 1;
 857         unsigned char *mask;
 858
 859         mask = make_delete_mask(matches, target);
 860         for (i = 0; i < nsaddrs; i++) {
 861                 fw->ipv6.src = saddrs[i];
 862                 fw->ipv6.smsk = smasks[i];
 863                 for (j = 0; j < ndaddrs; j++) {
 864                         fw->ipv6.dst = daddrs[j];
 865                         fw->ipv6.dmsk = dmasks[j];
 866                         if (verbose)
 867                                 print_firewall_line(fw, handle);
 868                         ret &= ip6tc_delete_entry(chain, fw, mask, handle);
 869                 }
 870         }
 871         free(mask);
 872
 873         return ret;
 874 }
 875
 876 int
 877 for_each_chain(int (*fn)(const ip6t_chainlabel, int, struct ip6tc_handle *),
 878                int verbose, int builtinstoo, struct ip6tc_handle *handle)
 879 {
 880         int ret = 1;
 881         const char *chain;
 882         char *chains;
 883         unsigned int i, chaincount = 0;
 884
 885         chain = ip6tc_first_chain(handle);
 886         while (chain) {
 887                 chaincount++;
 888                 chain = ip6tc_next_chain(handle);
 889         }
 890
 891         chains = xtables_malloc(sizeof(ip6t_chainlabel) * chaincount);
 892         i = 0;
 893         chain = ip6tc_first_chain(handle);
 894         while (chain) {
 895                 strcpy(chains + i*sizeof(ip6t_chainlabel), chain);
 896                 i++;
 897                 chain = ip6tc_next_chain(handle);
 898         }
 899
 900         for (i = 0; i < chaincount; i++) {
 901                 if (!builtinstoo
 902                     && ip6tc_builtin(chains + i*sizeof(ip6t_chainlabel),
 903                                     handle) == 1)
 904                         continue;
 905                 ret &= fn(chains + i*sizeof(ip6t_chainlabel), verbose, handle);
 906         }
 907
 908         free(chains);
 909         return ret;
 910 }
 911
 912 int
 913 flush_entries(const ip6t_chainlabel chain, int verbose,
 914               struct ip6tc_handle *handle)
 915 {
 916         if (!chain)
 917                 return for_each_chain(flush_entries, verbose, 1, handle);
 918
 919         if (verbose)
 920                 fprintf(stdout, "Flushing chain `%s'\n", chain);
 921         return ip6tc_flush_entries(chain, handle);
 922 }
 923
 924 static int
 925 zero_entries(const ip6t_chainlabel chain, int verbose,
 926              struct ip6tc_handle *handle)
 927 {
 928         if (!chain)
 929                 return for_each_chain(zero_entries, verbose, 1, handle);
 930
 931         if (verbose)
 932                 fprintf(stdout, "Zeroing chain `%s'\n", chain);
 933         return ip6tc_zero_entries(chain, handle);
 934 }
 935
 936 int
 937 delete_chain(const ip6t_chainlabel chain, int verbose,
 938              struct ip6tc_handle *handle)
 939 {
 940         if (!chain)
 941                 return for_each_chain(delete_chain, verbose, 0, handle);
 942
 943         if (verbose)
 944                 fprintf(stdout, "Deleting chain `%s'\n", chain);
 945         return ip6tc_delete_chain(chain, handle);
 946 }
 947
 948 static int
 949 list_entries(const ip6t_chainlabel chain, int rulenum, int verbose, int numeric,
 950              int expanded, int linenumbers, struct ip6tc_handle *handle)
 951 {
 952         int found = 0;
 953         unsigned int format;
 954         const char *this;
 955
 956         format = FMT_OPTIONS;
 957         if (!verbose)
 958                 format |= FMT_NOCOUNTS;
 959         else
 960                 format |= FMT_VIA;
 961
 962         if (numeric)
 963                 format |= FMT_NUMERIC;
 964
 965         if (!expanded)
 966                 format |= FMT_KILOMEGAGIGA;
 967
 968         if (linenumbers)
 969                 format |= FMT_LINENUMBERS;
 970
 971         for (this = ip6tc_first_chain(handle);
 972              this;
 973              this = ip6tc_next_chain(handle)) {
 974                 const struct ip6t_entry *i;
 975                 unsigned int num;
 976
 977                 if (chain && strcmp(chain, this) != 0)
 978                         continue;
 979
 980                 if (found) printf("\n");
 981
 982                 if (!rulenum)
 983                     print_header(format, this, handle);
 984                 i = ip6tc_first_rule(this, handle);
 985
 986                 num = 0;
 987                 while (i) {
 988                         num++;
 989                         if (!rulenum || num == rulenum)
 990                                 print_firewall(i,
 991                                                ip6tc_get_target(i, handle),
 992                                                num,
 993                                                format,
 994                                                handle);
 995                         i = ip6tc_next_rule(i, handle);
 996                 }
 997                 found = 1;
 998         }
 999
1000         errno = ENOENT;
1001         return found;
1002 }
1003
1004 /* This assumes that mask is contiguous, and byte-bounded. */
1005 static void
1006 print_iface(char letter, const char *iface, const unsigned char *mask,
1007             int invert)
1008 {
1009         unsigned int i;
1010
1011         if (mask[0] == 0)
1012                 return;
1013
1014         printf("%s-%c ", invert ? "! " : "", letter);
1015
1016         for (i = 0; i < IFNAMSIZ; i++) {
1017                 if (mask[i] != 0) {
1018                         if (iface[i] != '\0')
1019                                 printf("%c", iface[i]);
1020                 } else {
1021                         /* we can access iface[i-1] here, because
1022                          * a few lines above we make sure that mask[0] != 0 */
1023                         if (iface[i-1] != '\0')
1024                                 printf("+");
1025                         break;
1026                 }
1027         }
1028
1029         printf(" ");
1030 }
1031
1032 /* The ip6tables looks up the /etc/protocols. */
1033 static void print_proto(u_int16_t proto, int invert)
1034 {
1035         if (proto) {
1036                 unsigned int i;
1037                 const char *invertstr = invert ? "! " : "";
1038
1039                 struct protoent *pent = getprotobynumber(proto);
1040                 if (pent) {
1041                         printf("%s-p %s ",
1042                                invertstr, pent->p_name);
1043                         return;
1044                 }
1045
1046                 for (i = 0; xtables_chain_protos[i].name != NULL; ++i)
1047                         if (xtables_chain_protos[i].num == proto) {
1048                                 printf("%s-p %s ",
1049                                        invertstr, xtables_chain_protos[i].name);
1050                                 return;
1051                         }
1052
1053                 printf("%s-p %u ", invertstr, proto);
1054         }
1055 }
1056
1057 static int print_match_save(const struct ip6t_entry_match *e,
1058                         const struct ip6t_ip6 *ip)
1059 {
1060         struct xtables_match *match =
1061                 xtables_find_match(e->u.user.name, XTF_TRY_LOAD, NULL);
1062
1063         if (match) {
1064                 printf("-m %s ", e->u.user.name);
1065
1066                 /* some matches don't provide a save function */
1067                 if (match->save)
1068                         match->save(ip, e);
1069         } else {
1070                 if (e->u.match_size) {
1071                         fprintf(stderr,
1072                                 "Can't find library for match `%s'\n",
1073                                 e->u.user.name);
1074                         exit(1);
1075                 }
1076         }
1077         return 0;
1078 }
1079
1080 /* print a given ip including mask if neccessary */
1081 static void print_ip(char *prefix, const struct in6_addr *ip, const struct in6_addr *mask, int invert)
1082 {
1083         char buf[51];
1084         int l = ipv6_prefix_length(mask);
1085
1086         if (l == 0 && !invert)
1087                 return;
1088
1089         printf("%s%s %s",
1090                 invert ? "! " : "",
1091                 prefix,
1092                 inet_ntop(AF_INET6, ip, buf, sizeof buf));
1093
1094         if (l == -1)
1095                 printf("/%s ", inet_ntop(AF_INET6, mask, buf, sizeof buf));
1096         else
1097                 printf("/%d ", l);
1098 }
1099
1100 /* We want this to be readable, so only print out neccessary fields.
1101  * Because that's the kind of world I want to live in.  */
1102 void print_rule(const struct ip6t_entry *e,
1103                        struct ip6tc_handle *h, const char *chain, int counters)
1104 {
1105         struct ip6t_entry_target *t;
1106         const char *target_name;
1107
1108         /* print counters for iptables-save */
1109         if (counters > 0)
1110                 printf("[%llu:%llu] ", (unsigned long long)e->counters.pcnt, (unsigned long long)e->counters.bcnt);
1111
1112         /* print chain name */
1113         printf("-A %s ", chain);
1114
1115         /* Print IP part. */
1116         print_ip("-s", &(e->ipv6.src), &(e->ipv6.smsk),
1117                         e->ipv6.invflags & IP6T_INV_SRCIP);
1118
1119         print_ip("-d", &(e->ipv6.dst), &(e->ipv6.dmsk),
1120                         e->ipv6.invflags & IP6T_INV_DSTIP);
1121
1122         print_iface('i', e->ipv6.iniface, e->ipv6.iniface_mask,
1123                     e->ipv6.invflags & IP6T_INV_VIA_IN);
1124
1125         print_iface('o', e->ipv6.outiface, e->ipv6.outiface_mask,
1126                     e->ipv6.invflags & IP6T_INV_VIA_OUT);
1127
1128         print_proto(e->ipv6.proto, e->ipv6.invflags & IP6T_INV_PROTO);
1129
1130 #if 0
1131         /* not definied in ipv6
1132          * FIXME: linux/netfilter_ipv6/ip6_tables: IP6T_INV_FRAG why definied? */
1133         if (e->ipv6.flags & IPT_F_FRAG)
1134                 printf("%s-f ",
1135                        e->ipv6.invflags & IP6T_INV_FRAG ? "! " : "");
1136 #endif
1137
1138         if (e->ipv6.flags & IP6T_F_TOS)
1139                 printf("%s-? %d ",
1140                        e->ipv6.invflags & IP6T_INV_TOS ? "! " : "",
1141                        e->ipv6.tos);
1142
1143         /* Print matchinfo part */
1144         if (e->target_offset) {
1145                 IP6T_MATCH_ITERATE(e, print_match_save, &e->ipv6);
1146         }
1147
1148         /* print counters for iptables -R */
1149         if (counters < 0)
1150                 printf("-c %llu %llu ", (unsigned long long)e->counters.pcnt, (unsigned long long)e->counters.bcnt);
1151
1152         /* Print target name */
1153         target_name = ip6tc_get_target(e, h);
1154         if (target_name && (*target_name != '\0'))
1155 #ifdef IP6T_F_GOTO
1156                 printf("-%c %s ", e->ipv6.flags & IP6T_F_GOTO ? 'g' : 'j', target_name);
1157 #else
1158                 printf("-j %s ", target_name);
1159 #endif
1160
1161         /* Print targinfo part */
1162         t = ip6t_get_target((struct ip6t_entry *)e);
1163         if (t->u.user.name[0]) {
1164                 struct xtables_target *target =
1165                         xtables_find_target(t->u.user.name, XTF_TRY_LOAD);
1166
1167                 if (!target) {
1168                         fprintf(stderr, "Can't find library for target `%s'\n",
1169                                 t->u.user.name);
1170                         exit(1);
1171                 }
1172
1173                 if (target->save)
1174                         target->save(&e->ipv6, t);
1175                 else {
1176                         /* If the target size is greater than ip6t_entry_target
1177                          * there is something to be saved, we just don't know
1178                          * how to print it */
1179                         if (t->u.target_size !=
1180                             sizeof(struct ip6t_entry_target)) {
1181                                 fprintf(stderr, "Target `%s' is missing "
1182                                                 "save function\n",
1183                                         t->u.user.name);
1184                                 exit(1);
1185                         }
1186                 }
1187         }
1188         printf("\n");
1189 }
1190
1191 static int
1192 list_rules(const ip6t_chainlabel chain, int rulenum, int counters,
1193              struct ip6tc_handle *handle)
1194 {
1195         const char *this = NULL;
1196         int found = 0;
1197
1198         if (counters)
1199             counters = -1;              /* iptables -c format */
1200
1201         /* Dump out chain names first,
1202          * thereby preventing dependency conflicts */
1203         if (!rulenum) for (this = ip6tc_first_chain(handle);
1204              this;
1205              this = ip6tc_next_chain(handle)) {
1206                 if (chain && strcmp(this, chain) != 0)
1207                         continue;
1208
1209                 if (ip6tc_builtin(this, handle)) {
1210                         struct ip6t_counters count;
1211                         printf("-P %s %s", this, ip6tc_get_policy(this, &count, handle));
1212                         if (counters)
1213                             printf(" -c %llu %llu", (unsigned long long)count.pcnt, (unsigned long long)count.bcnt);
1214                         printf("\n");
1215                 } else {
1216                         printf("-N %s\n", this);
1217                 }
1218         }
1219
1220         for (this = ip6tc_first_chain(handle);
1221              this;
1222              this = ip6tc_next_chain(handle)) {
1223                 const struct ip6t_entry *e;
1224                 int num = 0;
1225
1226                 if (chain && strcmp(this, chain) != 0)
1227                         continue;
1228
1229                 /* Dump out rules */
1230                 e = ip6tc_first_rule(this, handle);
1231                 while(e) {
1232                         num++;
1233                         if (!rulenum || num == rulenum)
1234                             print_rule(e, handle, this, counters);
1235                         e = ip6tc_next_rule(e, handle);
1236                 }
1237                 found = 1;
1238         }
1239
1240         errno = ENOENT;
1241         return found;
1242 }
1243
1244 static struct ip6t_entry *
1245 generate_entry(const struct ip6t_entry *fw,
1246                struct xtables_rule_match *matches,
1247                struct ip6t_entry_target *target)
1248 {
1249         unsigned int size;
1250         struct xtables_rule_match *matchp;
1251         struct ip6t_entry *e;
1252
1253         size = sizeof(struct ip6t_entry);
1254         for (matchp = matches; matchp; matchp = matchp->next)
1255                 size += matchp->match->m->u.match_size;
1256
1257         e = xtables_malloc(size + target->u.target_size);
1258         *e = *fw;
1259         e->target_offset = size;
1260         e->next_offset = size + target->u.target_size;
1261
1262         size = 0;
1263         for (matchp = matches; matchp; matchp = matchp->next) {
1264                 memcpy(e->elems + size, matchp->match->m, matchp->match->m->u.match_size);
1265                 size += matchp->match->m->u.match_size;
1266         }
1267         memcpy(e->elems + size, target, target->u.target_size);
1268
1269         return e;
1270 }
1271
1272 static void clear_rule_matches(struct xtables_rule_match **matches)
1273 {
1274         struct xtables_rule_match *matchp, *tmp;
1275
1276         for (matchp = *matches; matchp;) {
1277                 tmp = matchp->next;
1278                 if (matchp->match->m) {
1279                         free(matchp->match->m);
1280                         matchp->match->m = NULL;
1281                 }
1282                 if (matchp->match == matchp->match->next) {
1283                         free(matchp->match);
1284                         matchp->match = NULL;
1285                 }
1286                 free(matchp);
1287                 matchp = tmp;
1288         }
1289
1290         *matches = NULL;
1291 }
1292
1293 int do_command6(int argc, char *argv[], char **table, struct ip6tc_handle **handle)
1294 {
1295         struct ip6t_entry fw, *e = NULL;
1296         int invert = 0;
1297         unsigned int nsaddrs = 0, ndaddrs = 0;
1298         struct in6_addr *saddrs = NULL, *daddrs = NULL;
1299         struct in6_addr *smasks = NULL, *dmasks = NULL;
1300
1301         int c, verbose = 0;
1302         const char *chain = NULL;
1303         const char *shostnetworkmask = NULL, *dhostnetworkmask = NULL;
1304         const char *policy = NULL, *newname = NULL;
1305         unsigned int rulenum = 0, options = 0, command = 0;
1306         const char *pcnt = NULL, *bcnt = NULL;
1307         int ret = 1;
1308         struct xtables_match *m;
1309         struct xtables_rule_match *matches = NULL;
1310         struct xtables_rule_match *matchp;
1311         struct xtables_target *target = NULL;
1312         struct xtables_target *t;
1313         const char *jumpto = "";
1314         char *protocol = NULL;
1315         int proto_used = 0;
1316         unsigned long long cnt;
1317
1318         memset(&fw, 0, sizeof(fw));
1319
1320         /* re-set optind to 0 in case do_command gets called
1321          * a second time */
1322         optind = 0;
1323
1324         /* clear mflags in case do_command gets called a second time
1325          * (we clear the global list of all matches for security)*/
1326         for (m = xtables_matches; m; m = m->next)
1327                 m->mflags = 0;
1328
1329         for (t = xtables_targets; t; t = t->next) {
1330                 t->tflags = 0;
1331                 t->used = 0;
1332         }
1333
1334         /* Suppress error messages: we may add new options if we
1335            demand-load a protocol. */
1336         opterr = 0;
1337
1338         while ((c = getopt_long(argc, argv,
1339            "-A:D:R:I:L::S::M:F::Z::N:X::E:P:Vh::o:p:s:d:j:i:bvnt:m:xc:g:",
1340                                            opts, NULL)) != -1) {
1341                 switch (c) {
1342                         /*
1343                          * Command selection
1344                          */
1345                 case 'A':
1346                         add_command(&command, CMD_APPEND, CMD_NONE,
1347                                     invert);
1348                         chain = optarg;
1349                         break;
1350
1351                 case 'D':
1352                         add_command(&command, CMD_DELETE, CMD_NONE,
1353                                     invert);
1354                         chain = optarg;
1355                         if (optind < argc && argv[optind][0] != '-'
1356                             && argv[optind][0] != '!') {
1357                                 rulenum = parse_rulenumber(argv[optind++]);
1358                                 command = CMD_DELETE_NUM;
1359                         }
1360                         break;
1361
1362                 case 'R':
1363                         add_command(&command, CMD_REPLACE, CMD_NONE,
1364                                     invert);
1365                         chain = optarg;
1366                         if (optind < argc && argv[optind][0] != '-'
1367                             && argv[optind][0] != '!')
1368                                 rulenum = parse_rulenumber(argv[optind++]);
1369                         else
1370                                 xtables_error(PARAMETER_PROBLEM,
1371                                            "-%c requires a rule number",
1372                                            cmd2char(CMD_REPLACE));
1373                         break;
1374
1375                 case 'I':
1376                         add_command(&command, CMD_INSERT, CMD_NONE,
1377                                     invert);
1378                         chain = optarg;
1379                         if (optind < argc && argv[optind][0] != '-'
1380                             && argv[optind][0] != '!')
1381                                 rulenum = parse_rulenumber(argv[optind++]);
1382                         else rulenum = 1;
1383                         break;
1384
1385                 case 'L':
1386                         add_command(&command, CMD_LIST,
1387                                     CMD_ZERO | CMD_ZERO_NUM, invert);
1388                         if (optarg) chain = optarg;
1389                         else if (optind < argc && argv[optind][0] != '-'
1390                                  && argv[optind][0] != '!')
1391                                 chain = argv[optind++];
1392                         if (optind < argc && argv[optind][0] != '-'
1393                             && argv[optind][0] != '!')
1394                                 rulenum = parse_rulenumber(argv[optind++]);
1395                         break;
1396
1397                 case 'S':
1398                         add_command(&command, CMD_LIST_RULES,
1399                                     CMD_ZERO | CMD_ZERO_NUM, invert);
1400                         if (optarg) chain = optarg;
1401                         else if (optind < argc && argv[optind][0] != '-'
1402                                  && argv[optind][0] != '!')
1403                                 chain = argv[optind++];
1404                         if (optind < argc && argv[optind][0] != '-'
1405                             && argv[optind][0] != '!')
1406                                 rulenum = parse_rulenumber(argv[optind++]);
1407                         break;
1408
1409                 case 'F':
1410                         add_command(&command, CMD_FLUSH, CMD_NONE,
1411                                     invert);
1412                         if (optarg) chain = optarg;
1413                         else if (optind < argc && argv[optind][0] != '-'
1414                                  && argv[optind][0] != '!')
1415                                 chain = argv[optind++];
1416                         break;
1417
1418                 case 'Z':
1419                         add_command(&command, CMD_ZERO, CMD_LIST|CMD_LIST_RULES,
1420                                     invert);
1421                         if (optarg) chain = optarg;
1422                         else if (optind < argc && argv[optind][0] != '-'
1423                                 && argv[optind][0] != '!')
1424                                 chain = argv[optind++];
1425                         if (optind < argc && argv[optind][0] != '-'
1426                                 && argv[optind][0] != '!') {
1427                                 rulenum = parse_rulenumber(argv[optind++]);
1428                                 command = CMD_ZERO_NUM;
1429                         }
1430                         break;
1431
1432                 case 'N':
1433                         if (optarg && (*optarg == '-' || *optarg == '!'))
1434                                 xtables_error(PARAMETER_PROBLEM,
1435                                            "chain name not allowed to start "
1436                                            "with `%c'\n", *optarg);
1437                         if (xtables_find_target(optarg, XTF_TRY_LOAD))
1438                                 xtables_error(PARAMETER_PROBLEM,
1439                                            "chain name may not clash "
1440                                            "with target name\n");
1441                         add_command(&command, CMD_NEW_CHAIN, CMD_NONE,
1442                                     invert);
1443                         chain = optarg;
1444                         break;
1445
1446                 case 'X':
1447                         add_command(&command, CMD_DELETE_CHAIN, CMD_NONE,
1448                                     invert);
1449                         if (optarg) chain = optarg;
1450                         else if (optind < argc && argv[optind][0] != '-'
1451                                  && argv[optind][0] != '!')
1452                                 chain = argv[optind++];
1453                         break;
1454
1455                 case 'E':
1456                         add_command(&command, CMD_RENAME_CHAIN, CMD_NONE,
1457                                     invert);
1458                         chain = optarg;
1459                         if (optind < argc && argv[optind][0] != '-'
1460                             && argv[optind][0] != '!')
1461                                 newname = argv[optind++];
1462                         else
1463                                 xtables_error(PARAMETER_PROBLEM,
1464                                            "-%c requires old-chain-name and "
1465                                            "new-chain-name",
1466                                             cmd2char(CMD_RENAME_CHAIN));
1467                         break;
1468
1469                 case 'P':
1470                         add_command(&command, CMD_SET_POLICY, CMD_NONE,
1471                                     invert);
1472                         chain = optarg;
1473                         if (optind < argc && argv[optind][0] != '-'
1474                             && argv[optind][0] != '!')
1475                                 policy = argv[optind++];
1476                         else
1477                                 xtables_error(PARAMETER_PROBLEM,
1478                                            "-%c requires a chain and a policy",
1479                                            cmd2char(CMD_SET_POLICY));
1480                         break;
1481
1482                 case 'h':
1483                         if (!optarg)
1484                                 optarg = argv[optind];
1485
1486                         /* ip6tables -p icmp -h */
1487                         if (!matches && protocol)
1488                                 xtables_find_match(protocol, XTF_TRY_LOAD,
1489                                         &matches);
1490
1491                         exit_printhelp(matches);
1492
1493                         /*
1494                          * Option selection
1495                          */
1496                 case 'p':
1497                         xtables_check_inverse(optarg, &invert, &optind, argc, argv);
1498                         set_option(&options, OPT_PROTOCOL, &fw.ipv6.invflags,
1499                                    invert);
1500
1501                         /* Canonicalize into lower case */
1502                         for (protocol = optarg; *protocol; protocol++)
1503                                 *protocol = tolower(*protocol);
1504
1505                         protocol = optarg;
1506                         fw.ipv6.proto = xtables_parse_protocol(protocol);
1507                         fw.ipv6.flags |= IP6T_F_PROTO;
1508
1509                         if (fw.ipv6.proto == 0
1510                             && (fw.ipv6.invflags & IP6T_INV_PROTO))
1511                                 xtables_error(PARAMETER_PROBLEM,
1512                                            "rule would never match protocol");
1513
1514                         if (is_exthdr(fw.ipv6.proto)
1515                             && (fw.ipv6.invflags & IP6T_INV_PROTO) == 0)
1516                                 fprintf(stderr,
1517                                         "Warning: never matched protocol: %s. "
1518                                         "use extension match instead.\n",
1519                                         protocol);
1520                         break;
1521
1522                 case 's':
1523                         xtables_check_inverse(optarg, &invert, &optind, argc, argv);
1524                         set_option(&options, OPT_SOURCE, &fw.ipv6.invflags,
1525                                    invert);
1526                         shostnetworkmask = optarg;
1527                         break;
1528
1529                 case 'd':
1530                         xtables_check_inverse(optarg, &invert, &optind, argc, argv);
1531                         set_option(&options, OPT_DESTINATION, &fw.ipv6.invflags,
1532                                    invert);
1533                         dhostnetworkmask = optarg;
1534                         break;
1535
1536 #ifdef IP6T_F_GOTO
1537                 case 'g':
1538                         set_option(&options, OPT_JUMP, &fw.ipv6.invflags,
1539                                         invert);
1540                         fw.ipv6.flags |= IP6T_F_GOTO;
1541                         jumpto = parse_target(optarg);
1542                         break;
1543 #endif
1544
1545                 case 'j':
1546                         set_option(&options, OPT_JUMP, &fw.ipv6.invflags,
1547                                    invert);
1548                         jumpto = parse_target(optarg);
1549                         /* TRY_LOAD (may be chain name) */
1550                         target = xtables_find_target(jumpto, XTF_TRY_LOAD);
1551
1552                         if (target) {
1553                                 size_t size;
1554
1555                                 size = IP6T_ALIGN(sizeof(struct ip6t_entry_target))
1556                                         + target->size;
1557
1558                                 target->t = xtables_calloc(1, size);
1559                                 target->t->u.target_size = size;
1560                                 strcpy(target->t->u.user.name, jumpto);
1561                                 target->t->u.user.revision = target->revision;
1562                                 if (target->init != NULL)
1563                                         target->init(target->t);
1564                                 opts = xtables_merge_options(opts,
1565                                                      target->extra_opts,
1566                                                      &target->option_offset);
1567                                 if (opts == NULL)
1568                                         xtables_error(OTHER_PROBLEM,
1569                                                    "can't alloc memory!");
1570                         }
1571                         break;
1572
1573
1574                 case 'i':
1575                         xtables_check_inverse(optarg, &invert, &optind, argc, argv);
1576                         set_option(&options, OPT_VIANAMEIN, &fw.ipv6.invflags,
1577                                    invert);
1578                         xtables_parse_interface(optarg,
1579                                         fw.ipv6.iniface,
1580                                         fw.ipv6.iniface_mask);
1581                         break;
1582
1583                 case 'o':
1584                         xtables_check_inverse(optarg, &invert, &optind, argc, argv);
1585                         set_option(&options, OPT_VIANAMEOUT, &fw.ipv6.invflags,
1586                                    invert);
1587                         xtables_parse_interface(optarg,
1588                                         fw.ipv6.outiface,
1589                                         fw.ipv6.outiface_mask);
1590                         break;
1591
1592                 case 'v':
1593                         if (!verbose)
1594                                 set_option(&options, OPT_VERBOSE,
1595                                            &fw.ipv6.invflags, invert);
1596                         verbose++;
1597                         break;
1598
1599                 case 'm': {
1600                         size_t size;
1601
1602                         if (invert)
1603                                 xtables_error(PARAMETER_PROBLEM,
1604                                            "unexpected ! flag before --match");
1605
1606                         m = xtables_find_match(optarg, XTF_LOAD_MUST_SUCCEED,
1607                             &matches);
1608                         size = IP6T_ALIGN(sizeof(struct ip6t_entry_match))
1609                                          + m->size;
1610                         m->m = xtables_calloc(1, size);
1611                         m->m->u.match_size = size;
1612                         strcpy(m->m->u.user.name, m->name);
1613                         m->m->u.user.revision = m->revision;
1614                         if (m->init != NULL)
1615                                 m->init(m->m);
1616                         if (m != m->next)
1617                                 /* Merge options for non-cloned matches */
1618                                 opts = xtables_merge_options(opts, m->extra_opts, &m->option_offset);
1619                 }
1620                 break;
1621
1622                 case 'n':
1623                         set_option(&options, OPT_NUMERIC, &fw.ipv6.invflags,
1624                                    invert);
1625                         break;
1626
1627                 case 't':
1628                         if (invert)
1629                                 xtables_error(PARAMETER_PROBLEM,
1630                                            "unexpected ! flag before --table");
1631                         *table = optarg;
1632                         break;
1633
1634                 case 'x':
1635                         set_option(&options, OPT_EXPANDED, &fw.ipv6.invflags,
1636                                    invert);
1637                         break;
1638
1639                 case 'V':
1640                         if (invert)
1641                                 printf("Not %s ;-)\n", prog_vers);
1642                         else
1643                                 printf("%s v%s\n",
1644                                        prog_name, prog_vers);
1645                         exit(0);
1646
1647                 case '0':
1648                         set_option(&options, OPT_LINENUMBERS, &fw.ipv6.invflags,
1649                                    invert);
1650                         break;
1651
1652                 case 'M':
1653                         xtables_modprobe_program = optarg;
1654                         break;
1655
1656                 case 'c':
1657
1658                         set_option(&options, OPT_COUNTERS, &fw.ipv6.invflags,
1659                                    invert);
1660                         pcnt = optarg;
1661                         bcnt = strchr(pcnt + 1, ',');
1662                         if (bcnt)
1663                             bcnt++;
1664                         if (!bcnt && optind < argc && argv[optind][0] != '-'
1665                             && argv[optind][0] != '!')
1666                                 bcnt = argv[optind++];
1667                         if (!bcnt)
1668                                 xtables_error(PARAMETER_PROBLEM,
1669                                         "-%c requires packet and byte counter",
1670                                         opt2char(OPT_COUNTERS));
1671
1672                         if (sscanf(pcnt, "%llu", &cnt) != 1)
1673                                 xtables_error(PARAMETER_PROBLEM,
1674                                         "-%c packet counter not numeric",
1675                                         opt2char(OPT_COUNTERS));
1676                         fw.counters.pcnt = cnt;
1677
1678                         if (sscanf(bcnt, "%llu", &cnt) != 1)
1679                                 xtables_error(PARAMETER_PROBLEM,
1680                                         "-%c byte counter not numeric",
1681                                         opt2char(OPT_COUNTERS));
1682                         fw.counters.bcnt = cnt;
1683                         break;
1684
1685                 case 1: /* non option */
1686                         if (optarg[0] == '!' && optarg[1] == '\0') {
1687                                 if (invert)
1688                                         xtables_error(PARAMETER_PROBLEM,
1689                                                    "multiple consecutive ! not"
1690                                                    " allowed");
1691                                 invert = TRUE;
1692                                 optarg[0] = '\0';
1693                                 continue;
1694                         }
1695                         fprintf(stderr, "Bad argument `%s'\n", optarg);
1696                         exit_tryhelp(2);
1697
1698                 default:
1699                         if (target == NULL || target->parse == NULL ||
1700                             !target->parse(c - target->option_offset,
1701                                                argv, invert,
1702                                                &target->tflags,
1703                                                &fw, &target->t)) {
1704                                 for (matchp = matches; matchp; matchp = matchp->next) {
1705                                         if (matchp->completed ||
1706                                             matchp->match->parse == NULL)
1707                                                 continue;
1708                                         if (matchp->match->parse(c - matchp->match->option_offset,
1709                                                      argv, invert,
1710                                                      &matchp->match->mflags,
1711                                                      &fw,
1712                                                      &matchp->match->m))
1713                                                 break;
1714                                 }
1715                                 m = matchp ? matchp->match : NULL;
1716
1717                                 /* If you listen carefully, you can
1718                                    actually hear this code suck. */
1719
1720                                 /* some explanations (after four different bugs
1721                                  * in 3 different releases): If we encounter a
1722                                  * parameter, that has not been parsed yet,
1723                                  * it's not an option of an explicitly loaded
1724                                  * match or a target.  However, we support
1725                                  * implicit loading of the protocol match
1726                                  * extension.  '-p tcp' means 'l4 proto 6' and
1727                                  * at the same time 'load tcp protocol match on
1728                                  * demand if we specify --dport'.
1729                                  *
1730                                  * To make this work, we need to make sure:
1731                                  * - the parameter has not been parsed by
1732                                  *   a match (m above)
1733                                  * - a protocol has been specified
1734                                  * - the protocol extension has not been
1735                                  *   loaded yet, or is loaded and unused
1736                                  *   [think of ip6tables-restore!]
1737                                  * - the protocol extension can be successively
1738                                  *   loaded
1739                                  */
1740                                 if (m == NULL
1741                                     && protocol
1742                                     && (!find_proto(protocol, XTF_DONT_LOAD,
1743                                                    options&OPT_NUMERIC, NULL)
1744                                         || (find_proto(protocol, XTF_DONT_LOAD,
1745                                                         options&OPT_NUMERIC, NULL)
1746                                             && (proto_used == 0))
1747                                        )
1748                                     && (m = find_proto(protocol, XTF_TRY_LOAD,
1749                                                        options&OPT_NUMERIC, &matches))) {
1750                                         /* Try loading protocol */
1751                                         size_t size;
1752
1753                                         proto_used = 1;
1754
1755                                         size = IP6T_ALIGN(sizeof(struct ip6t_entry_match))
1756                                                          + m->size;
1757
1758                                         m->m = xtables_calloc(1, size);
1759                                         m->m->u.match_size = size;
1760                                         strcpy(m->m->u.user.name, m->name);
1761                                         m->m->u.user.revision = m->revision;
1762                                         if (m->init != NULL)
1763                                                 m->init(m->m);
1764
1765                                         opts = xtables_merge_options(opts,
1766                                             m->extra_opts, &m->option_offset);
1767
1768                                         optind--;
1769                                         continue;
1770                                 }
1771
1772                                 if (!m) {
1773                                         if (c == '?') {
1774                                                 if (optopt) {
1775                                                         xtables_error(
1776                                                            PARAMETER_PROBLEM,
1777                                                            "option `%s' "
1778                                                            "requires an "
1779                                                            "argument",
1780                                                            argv[optind-1]);
1781                                                 } else {
1782                                                         xtables_error(
1783                                                            PARAMETER_PROBLEM,
1784                                                            "unknown option "
1785                                                            "`%s'",
1786                                                            argv[optind-1]);
1787                                                 }
1788                                         }
1789                                         xtables_error(PARAMETER_PROBLEM,
1790                                                    "Unknown arg `%s'", optarg);
1791                                 }
1792                         }
1793                 }
1794                 invert = FALSE;
1795         }
1796
1797         for (matchp = matches; matchp; matchp = matchp->next)
1798                 if (matchp->match->final_check != NULL)
1799                         matchp->match->final_check(matchp->match->mflags);
1800
1801         if (target != NULL && target->final_check != NULL)
1802                 target->final_check(target->tflags);
1803
1804         /* Fix me: must put inverse options checking here --MN */
1805
1806         if (optind < argc)
1807                 xtables_error(PARAMETER_PROBLEM,
1808                            "unknown arguments found on commandline");
1809         if (!command)
1810                 xtables_error(PARAMETER_PROBLEM, "no command specified");
1811         if (invert)
1812                 xtables_error(PARAMETER_PROBLEM,
1813                            "nothing appropriate following !");
1814
1815         if (command & (CMD_REPLACE | CMD_INSERT | CMD_DELETE | CMD_APPEND)) {
1816                 if (!(options & OPT_DESTINATION))
1817                         dhostnetworkmask = "::0/0";
1818                 if (!(options & OPT_SOURCE))
1819                         shostnetworkmask = "::0/0";
1820         }
1821
1822         if (shostnetworkmask)
1823                 xtables_ip6parse_multiple(shostnetworkmask, &saddrs,
1824                                           &smasks, &nsaddrs);
1825
1826         if (dhostnetworkmask)
1827                 xtables_ip6parse_multiple(dhostnetworkmask, &daddrs,
1828                                           &dmasks, &ndaddrs);
1829
1830         if ((nsaddrs > 1 || ndaddrs > 1) &&
1831             (fw.ipv6.invflags & (IP6T_INV_SRCIP | IP6T_INV_DSTIP)))
1832                 xtables_error(PARAMETER_PROBLEM, "! not allowed with multiple"
1833                            " source or destination IP addresses");
1834
1835         if (command == CMD_REPLACE && (nsaddrs != 1 || ndaddrs != 1))
1836                 xtables_error(PARAMETER_PROBLEM, "Replacement rule does not "
1837                            "specify a unique address");
1838
1839         generic_opt_check(command, options);
1840
1841         if (chain && strlen(chain) > IP6T_FUNCTION_MAXNAMELEN)
1842                 xtables_error(PARAMETER_PROBLEM,
1843                            "chain name `%s' too long (must be under %i chars)",
1844                            chain, IP6T_FUNCTION_MAXNAMELEN);
1845
1846         /* only allocate handle if we weren't called with a handle */
1847         if (!*handle)
1848                 *handle = ip6tc_init(*table);
1849
1850         /* try to insmod the module if iptc_init failed */
1851         if (!*handle && xtables_load_ko(xtables_modprobe_program, false) != -1)
1852                 *handle = ip6tc_init(*table);
1853
1854         if (!*handle)
1855                 xtables_error(VERSION_PROBLEM,
1856                         "can't initialize ip6tables table `%s': %s",
1857                         *table, ip6tc_strerror(errno));
1858
1859         if (command == CMD_APPEND
1860             || command == CMD_DELETE
1861             || command == CMD_INSERT
1862             || command == CMD_REPLACE) {
1863                 if (strcmp(chain, "PREROUTING") == 0
1864                     || strcmp(chain, "INPUT") == 0) {
1865                         /* -o not valid with incoming packets. */
1866                         if (options & OPT_VIANAMEOUT)
1867                                 xtables_error(PARAMETER_PROBLEM,
1868                                            "Can't use -%c with %s\n",
1869                                            opt2char(OPT_VIANAMEOUT),
1870                                            chain);
1871                 }
1872
1873                 if (strcmp(chain, "POSTROUTING") == 0
1874                     || strcmp(chain, "OUTPUT") == 0) {
1875                         /* -i not valid with outgoing packets */
1876                         if (options & OPT_VIANAMEIN)
1877                                 xtables_error(PARAMETER_PROBLEM,
1878                                            "Can't use -%c with %s\n",
1879                                            opt2char(OPT_VIANAMEIN),
1880                                            chain);
1881                 }
1882
1883                 if (target && ip6tc_is_chain(jumpto, *handle)) {
1884                         fprintf(stderr,
1885                                 "Warning: using chain %s, not extension\n",
1886                                 jumpto);
1887
1888                         if (target->t)
1889                                 free(target->t);
1890
1891                         target = NULL;
1892                 }
1893
1894                 /* If they didn't specify a target, or it's a chain
1895                    name, use standard. */
1896                 if (!target
1897                     && (strlen(jumpto) == 0
1898                         || ip6tc_is_chain(jumpto, *handle))) {
1899                         size_t size;
1900
1901                         target = xtables_find_target(IP6T_STANDARD_TARGET,
1902                                         XTF_LOAD_MUST_SUCCEED);
1903
1904                         size = sizeof(struct ip6t_entry_target)
1905                                 + target->size;
1906                         target->t = xtables_calloc(1, size);
1907                         target->t->u.target_size = size;
1908                         strcpy(target->t->u.user.name, jumpto);
1909                         if (target->init != NULL)
1910                                 target->init(target->t);
1911                 }
1912
1913                 if (!target) {
1914                         /* it is no chain, and we can't load a plugin.
1915                          * We cannot know if the plugin is corrupt, non
1916                          * existant OR if the user just misspelled a
1917                          * chain. */
1918 #ifdef IP6T_F_GOTO
1919                         if (fw.ipv6.flags & IP6T_F_GOTO)
1920                                 xtables_error(PARAMETER_PROBLEM,
1921                                                 "goto '%s' is not a chain\n", jumpto);
1922 #endif
1923                         xtables_find_target(jumpto, XTF_LOAD_MUST_SUCCEED);
1924                 } else {
1925                         e = generate_entry(&fw, matches, target->t);
1926                         free(target->t);
1927                 }
1928         }
1929
1930         switch (command) {
1931         case CMD_APPEND:
1932                 ret = append_entry(chain, e,
1933                                    nsaddrs, saddrs, smasks,
1934                                    ndaddrs, daddrs, dmasks,
1935                                    options&OPT_VERBOSE,
1936                                    *handle);
1937                 break;
1938         case CMD_DELETE:
1939                 ret = delete_entry(chain, e,
1940                                    nsaddrs, saddrs, smasks,
1941                                    ndaddrs, daddrs, dmasks,
1942                                    options&OPT_VERBOSE,
1943                                    *handle, matches, target);
1944                 break;
1945         case CMD_DELETE_NUM:
1946                 ret = ip6tc_delete_num_entry(chain, rulenum - 1, *handle);
1947                 break;
1948         case CMD_REPLACE:
1949                 ret = replace_entry(chain, e, rulenum - 1,
1950                                     saddrs, smasks, daddrs, dmasks,
1951                                     options&OPT_VERBOSE, *handle);
1952                 break;
1953         case CMD_INSERT:
1954                 ret = insert_entry(chain, e, rulenum - 1,
1955                                    nsaddrs, saddrs, smasks,
1956                                    ndaddrs, daddrs, dmasks,
1957                                    options&OPT_VERBOSE,
1958                                    *handle);
1959                 break;
1960         case CMD_FLUSH:
1961                 ret = flush_entries(chain, options&OPT_VERBOSE, *handle);
1962                 break;
1963         case CMD_ZERO:
1964                 ret = zero_entries(chain, options&OPT_VERBOSE, *handle);
1965                 break;
1966         case CMD_ZERO_NUM:
1967                 ret = ip6tc_zero_counter(chain, rulenum, *handle);
1968                 break;
1969         case CMD_LIST:
1970         case CMD_LIST|CMD_ZERO:
1971         case CMD_LIST|CMD_ZERO_NUM:
1972                 ret = list_entries(chain,
1973                                    rulenum,
1974                                    options&OPT_VERBOSE,
1975                                    options&OPT_NUMERIC,
1976                                    options&OPT_EXPANDED,
1977                                    options&OPT_LINENUMBERS,
1978                                    *handle);
1979                 if (ret && (command & CMD_ZERO))
1980                         ret = zero_entries(chain,
1981                                            options&OPT_VERBOSE, *handle);
1982                 if (ret && (command & CMD_ZERO_NUM))
1983                         ret = ip6tc_zero_counter(chain, rulenum, *handle);
1984                 break;
1985         case CMD_LIST_RULES:
1986         case CMD_LIST_RULES|CMD_ZERO:
1987         case CMD_LIST_RULES|CMD_ZERO_NUM:
1988                 ret = list_rules(chain,
1989                                    rulenum,
1990                                    options&OPT_VERBOSE,
1991                                    *handle);
1992                 if (ret && (command & CMD_ZERO))
1993                         ret = zero_entries(chain,
1994                                            options&OPT_VERBOSE, *handle);
1995                 if (ret && (command & CMD_ZERO_NUM))
1996                         ret = ip6tc_zero_counter(chain, rulenum, *handle);
1997                 break;
1998         case CMD_NEW_CHAIN:
1999                 ret = ip6tc_create_chain(chain, *handle);
2000                 break;
2001         case CMD_DELETE_CHAIN:
2002                 ret = delete_chain(chain, options&OPT_VERBOSE, *handle);
2003                 break;
2004         case CMD_RENAME_CHAIN:
2005                 ret = ip6tc_rename_chain(chain, newname,        *handle);
2006                 break;
2007         case CMD_SET_POLICY:
2008                 ret = ip6tc_set_policy(chain, policy, options&OPT_COUNTERS ? &fw.counters : NULL, *handle);
2009                 break;
2010         default:
2011                 /* We should never reach this... */
2012                 exit_tryhelp(2);
2013         }
2014
2015         if (verbose > 1)
2016                 dump_entries6(*handle);
2017
2018         clear_rule_matches(&matches);
2019
2020         if (e != NULL) {
2021                 free(e);
2022                 e = NULL;
2023         }
2024
2025         free(saddrs);
2026         free(smasks);
2027         free(daddrs);
2028         free(dmasks);
2029         xtables_free_opts(1);
2030
2031         return ret;
2032 }