1 /* Library which manipulates firewall rules. Version $Revision: 6665 $ */
3 /* Architecture of firewall rules is as follows:
5 * Chains go INPUT, FORWARD, OUTPUT then user chains.
6 * Each user chain starts with an ERROR node.
7 * Every chain ends with an unconditional jump: a RETURN for user chains,
8 * and a POLICY for built-ins.
11 /* (C) 1999 Paul ``Rusty'' Russell - Placed under the GNU GPL (See
12 * COPYING for details).
13 * (C) 2000-2004 by the Netfilter Core Team <coreteam@netfilter.org>
15 * 2003-Jun-20: Harald Welte <laforge@netfilter.org>:
16 * - Reimplementation of chain cache to use offsets instead of entries
17 * 2003-Jun-23: Harald Welte <laforge@netfilter.org>:
18 * - performance optimization, sponsored by Astaro AG (http://www.astaro.com/)
19 * don't rebuild the chain cache after every operation, instead fix it
20 * up after a ruleset change.
21 * 2004-Aug-18: Harald Welte <laforge@netfilter.org>:
22 * - futher performance work: total reimplementation of libiptc.
23 * - libiptc now has a real internal (linked-list) represntation of the
24 * ruleset and a parser/compiler from/to this internal representation
25 * - again sponsored by Astaro AG (http://www.astaro.com/)
27 #include <sys/types.h>
28 #include <sys/socket.h>
30 #include "linux_list.h"
32 //#define IPTC_DEBUG2 1
36 #define DEBUGP(x, args...) fprintf(stderr, "%s: " x, __FUNCTION__, ## args)
37 #define DEBUGP_C(x, args...) fprintf(stderr, x, ## args)
39 #define DEBUGP(x, args...)
40 #define DEBUGP_C(x, args...)
44 #define IPT_LIB_DIR "/usr/local/lib/iptables"
47 static int sockfd = -1;
48 static int sockfd_use = 0;
49 static void *iptc_fn = NULL;
51 static const char *hooknames[]
52 = { [HOOK_PRE_ROUTING] "PREROUTING",
53 [HOOK_LOCAL_IN] "INPUT",
54 [HOOK_FORWARD] "FORWARD",
55 [HOOK_LOCAL_OUT] "OUTPUT",
56 [HOOK_POST_ROUTING] "POSTROUTING",
58 [HOOK_DROPPING] "DROPPING"
62 /* Convenience structures */
63 struct ipt_error_target
65 STRUCT_ENTRY_TARGET t;
66 char error[TABLE_MAXNAMELEN];
76 COUNTER_MAP_NORMAL_MAP,
83 enum iptcc_rule_type {
84 IPTCC_R_STANDARD, /* standard target (ACCEPT, ...) */
85 IPTCC_R_MODULE, /* extension module (SNAT, ...) */
86 IPTCC_R_FALLTHROUGH, /* fallthrough rule */
87 IPTCC_R_JUMP, /* jump to other chain */
92 struct list_head list;
93 struct chain_head *chain;
94 struct counter_map counter_map;
96 unsigned int index; /* index (needed for counter_map) */
97 unsigned int offset; /* offset in rule blob */
99 enum iptcc_rule_type type;
100 struct chain_head *jump; /* jump target, if IPTCC_R_JUMP */
102 unsigned int size; /* size of entry data */
103 STRUCT_ENTRY entry[0];
108 struct list_head list;
109 char name[TABLE_MAXNAMELEN];
110 unsigned int hooknum; /* hook number+1 if builtin */
111 unsigned int references; /* how many jumps reference us */
112 int verdict; /* verdict if builtin */
114 STRUCT_COUNTERS counters; /* per-chain counters */
115 struct counter_map counter_map;
117 unsigned int num_rules; /* number of rules in list */
118 struct list_head rules; /* list of rules */
120 unsigned int index; /* index (needed for jump resolval) */
121 unsigned int head_offset; /* offset in rule blob */
122 unsigned int foot_index; /* index (needed for counter_map) */
123 unsigned int foot_offset; /* offset in rule blob */
128 int changed; /* Have changes been made? */
130 struct list_head chains;
132 struct chain_head *chain_iterator_cur;
133 struct rule_head *rule_iterator_cur;
136 STRUCT_GET_ENTRIES *entries;
139 /* allocate a new chain head for the cache */
140 static struct chain_head *iptcc_alloc_chain_head(const char *name, int hooknum)
142 struct chain_head *c = malloc(sizeof(*c));
145 memset(c, 0, sizeof(*c));
147 strncpy(c->name, name, TABLE_MAXNAMELEN);
148 c->hooknum = hooknum;
149 INIT_LIST_HEAD(&c->rules);
154 /* allocate and initialize a new rule for the cache */
155 static struct rule_head *iptcc_alloc_rule(struct chain_head *c, unsigned int size)
157 struct rule_head *r = malloc(sizeof(*r)+size);
160 memset(r, 0, sizeof(*r));
168 /* notify us that the ruleset has been modified by the user */
170 set_changed(TC_HANDLE_T h)
176 static void do_check(TC_HANDLE_T h, unsigned int line);
177 #define CHECK(h) do { if (!getenv("IPTC_NO_CHECK")) do_check((h), __LINE__); } while(0)
183 /**********************************************************************
184 * iptc blob utility functions (iptcb_*)
185 **********************************************************************/
188 iptcb_get_number(const STRUCT_ENTRY *i,
189 const STRUCT_ENTRY *seek,
199 iptcb_get_entry_n(STRUCT_ENTRY *i,
204 if (*pos == number) {
212 static inline STRUCT_ENTRY *
213 iptcb_get_entry(TC_HANDLE_T h, unsigned int offset)
215 return (STRUCT_ENTRY *)((char *)h->entries->entrytable + offset);
219 iptcb_entry2index(const TC_HANDLE_T h, const STRUCT_ENTRY *seek)
221 unsigned int pos = 0;
223 if (ENTRY_ITERATE(h->entries->entrytable, h->entries->size,
224 iptcb_get_number, seek, &pos) == 0) {
225 fprintf(stderr, "ERROR: offset %u not an entry!\n",
226 (unsigned int)((char *)seek - (char *)h->entries->entrytable));
232 static inline STRUCT_ENTRY *
233 iptcb_offset2entry(TC_HANDLE_T h, unsigned int offset)
235 return (STRUCT_ENTRY *) ((void *)h->entries->entrytable+offset);
239 static inline unsigned long
240 iptcb_entry2offset(const TC_HANDLE_T h, const STRUCT_ENTRY *e)
242 return (void *)e - (void *)h->entries->entrytable;
245 static inline unsigned int
246 iptcb_offset2index(const TC_HANDLE_T h, unsigned int offset)
248 return iptcb_entry2index(h, iptcb_offset2entry(h, offset));
251 /* Returns 0 if not hook entry, else hooknumber + 1 */
252 static inline unsigned int
253 iptcb_ent_is_hook_entry(STRUCT_ENTRY *e, TC_HANDLE_T h)
257 for (i = 0; i < NUMHOOKS; i++) {
258 if ((h->info.valid_hooks & (1 << i))
259 && iptcb_get_entry(h, h->info.hook_entry[i]) == e)
266 /**********************************************************************
267 * iptc cache utility functions (iptcc_*)
268 **********************************************************************/
270 /* Is the given chain builtin (1) or user-defined (0) */
271 static unsigned int iptcc_is_builtin(struct chain_head *c)
273 return (c->hooknum ? 1 : 0);
276 /* Get a specific rule within a chain */
277 static struct rule_head *iptcc_get_rule_num(struct chain_head *c,
278 unsigned int rulenum)
281 unsigned int num = 0;
283 list_for_each_entry(r, &c->rules, list) {
291 /* Get a specific rule within a chain backwards */
292 static struct rule_head *iptcc_get_rule_num_reverse(struct chain_head *c,
293 unsigned int rulenum)
296 unsigned int num = 0;
298 list_for_each_entry_reverse(r, &c->rules, list) {
306 /* Returns chain head if found, otherwise NULL. */
307 static struct chain_head *
308 iptcc_find_chain_by_offset(TC_HANDLE_T handle, unsigned int offset)
310 struct list_head *pos;
312 if (list_empty(&handle->chains))
315 list_for_each(pos, &handle->chains) {
316 struct chain_head *c = list_entry(pos, struct chain_head, list);
317 if (offset >= c->head_offset && offset <= c->foot_offset)
323 /* Returns chain head if found, otherwise NULL. */
324 static struct chain_head *
325 iptcc_find_label(const char *name, TC_HANDLE_T handle)
327 struct list_head *pos;
329 if (list_empty(&handle->chains))
332 list_for_each(pos, &handle->chains) {
333 struct chain_head *c = list_entry(pos, struct chain_head, list);
334 if (!strcmp(c->name, name))
341 /* called when rule is to be removed from cache */
342 static void iptcc_delete_rule(struct rule_head *r)
344 DEBUGP("deleting rule %p (offset %u)\n", r, r->offset);
345 /* clean up reference count of called chain */
346 if (r->type == IPTCC_R_JUMP
348 r->jump->references--;
355 /**********************************************************************
356 * RULESET PARSER (blob -> cache)
357 **********************************************************************/
359 /* Delete policy rule of previous chain, since cache doesn't contain
360 * chain policy rules.
361 * WARNING: This function has ugly design and relies on a lot of context, only
362 * to be called from specific places within the parser */
363 static int __iptcc_p_del_policy(TC_HANDLE_T h, unsigned int num)
365 if (h->chain_iterator_cur) {
366 /* policy rule is last rule */
367 struct rule_head *pr = (struct rule_head *)
368 h->chain_iterator_cur->rules.prev;
371 h->chain_iterator_cur->verdict =
372 *(int *)GET_TARGET(pr->entry)->data;
374 /* save counter and counter_map information */
375 h->chain_iterator_cur->counter_map.maptype =
376 COUNTER_MAP_NORMAL_MAP;
377 h->chain_iterator_cur->counter_map.mappos = num-1;
378 memcpy(&h->chain_iterator_cur->counters, &pr->entry->counters,
379 sizeof(h->chain_iterator_cur->counters));
381 /* foot_offset points to verdict rule */
382 h->chain_iterator_cur->foot_index = num;
383 h->chain_iterator_cur->foot_offset = pr->offset;
385 /* delete rule from cache */
386 iptcc_delete_rule(pr);
387 h->chain_iterator_cur->num_rules--;
394 /* alphabetically insert a chain into the list */
395 static inline void iptc_insert_chain(TC_HANDLE_T h, struct chain_head *c)
397 struct chain_head *tmp;
399 /* sort only user defined chains */
401 list_for_each_entry(tmp, &h->chains, list) {
402 if (!tmp->hooknum && strcmp(c->name, tmp->name) <= 0) {
403 list_add(&c->list, tmp->list.prev);
409 /* survived till end of list: add at tail */
410 list_add_tail(&c->list, &h->chains);
413 /* Another ugly helper function split out of cache_add_entry to make it less
415 static void __iptcc_p_add_chain(TC_HANDLE_T h, struct chain_head *c,
416 unsigned int offset, unsigned int *num)
418 __iptcc_p_del_policy(h, *num);
420 c->head_offset = offset;
423 iptc_insert_chain(h, c);
425 h->chain_iterator_cur = c;
428 /* main parser function: add an entry from the blob to the cache */
429 static int cache_add_entry(STRUCT_ENTRY *e,
434 unsigned int builtin;
435 unsigned int offset = (char *)e - (char *)h->entries->entrytable;
437 DEBUGP("entering...");
439 /* Last entry ("policy rule"). End it.*/
440 if (iptcb_entry2offset(h,e) + e->next_offset == h->entries->size) {
441 /* This is the ERROR node at the end of the chain */
442 DEBUGP_C("%u:%u: end of table:\n", *num, offset);
444 __iptcc_p_del_policy(h, *num);
446 h->chain_iterator_cur = NULL;
450 /* We know this is the start of a new chain if it's an ERROR
451 * target, or a hook entry point */
453 if (strcmp(GET_TARGET(e)->u.user.name, ERROR_TARGET) == 0) {
454 struct chain_head *c =
455 iptcc_alloc_chain_head((const char *)GET_TARGET(e)->data, 0);
456 DEBUGP_C("%u:%u:new userdefined chain %s: %p\n", *num, offset,
463 __iptcc_p_add_chain(h, c, offset, num);
465 } else if ((builtin = iptcb_ent_is_hook_entry(e, h)) != 0) {
466 struct chain_head *c =
467 iptcc_alloc_chain_head((char *)hooknames[builtin-1],
469 DEBUGP_C("%u:%u new builtin chain: %p (rules=%p)\n",
470 *num, offset, c, &c->rules);
476 c->hooknum = builtin;
478 __iptcc_p_add_chain(h, c, offset, num);
480 /* FIXME: this is ugly. */
483 /* has to be normal rule */
487 if (!(r = iptcc_alloc_rule(h->chain_iterator_cur,
492 DEBUGP_C("%u:%u normal rule: %p: ", *num, offset, r);
496 memcpy(r->entry, e, e->next_offset);
497 r->counter_map.maptype = COUNTER_MAP_NORMAL_MAP;
498 r->counter_map.mappos = r->index;
500 /* handling of jumps, etc. */
501 if (!strcmp(GET_TARGET(e)->u.user.name, STANDARD_TARGET)) {
502 STRUCT_STANDARD_TARGET *t;
504 t = (STRUCT_STANDARD_TARGET *)GET_TARGET(e);
505 if (t->target.u.target_size
506 != ALIGN(sizeof(STRUCT_STANDARD_TARGET))) {
511 if (t->verdict < 0) {
512 DEBUGP_C("standard, verdict=%d\n", t->verdict);
513 r->type = IPTCC_R_STANDARD;
514 } else if (t->verdict == r->offset+e->next_offset) {
515 DEBUGP_C("fallthrough\n");
516 r->type = IPTCC_R_FALLTHROUGH;
518 DEBUGP_C("jump, target=%u\n", t->verdict);
519 r->type = IPTCC_R_JUMP;
520 /* Jump target fixup has to be deferred
521 * until second pass, since we migh not
522 * yet have parsed the target */
525 DEBUGP_C("module, target=%s\n", GET_TARGET(e)->u.user.name);
526 r->type = IPTCC_R_MODULE;
529 list_add_tail(&r->list, &h->chain_iterator_cur->rules);
530 h->chain_iterator_cur->num_rules++;
538 /* parse an iptables blob into it's pieces */
539 static int parse_table(TC_HANDLE_T h)
542 unsigned int num = 0;
543 struct chain_head *c;
545 /* First pass: over ruleset blob */
546 ENTRY_ITERATE(h->entries->entrytable, h->entries->size,
547 cache_add_entry, h, &prev, &num);
549 /* Second pass: fixup parsed data from first pass */
550 list_for_each_entry(c, &h->chains, list) {
552 list_for_each_entry(r, &c->rules, list) {
553 struct chain_head *c;
554 STRUCT_STANDARD_TARGET *t;
556 if (r->type != IPTCC_R_JUMP)
559 t = (STRUCT_STANDARD_TARGET *)GET_TARGET(r->entry);
560 c = iptcc_find_chain_by_offset(h, t->verdict);
568 /* FIXME: sort chains */
574 /**********************************************************************
575 * RULESET COMPILATION (cache -> blob)
576 **********************************************************************/
578 /* Convenience structures */
579 struct iptcb_chain_start{
581 struct ipt_error_target name;
583 #define IPTCB_CHAIN_START_SIZE (sizeof(STRUCT_ENTRY) + \
584 ALIGN(sizeof(struct ipt_error_target)))
586 struct iptcb_chain_foot {
588 STRUCT_STANDARD_TARGET target;
590 #define IPTCB_CHAIN_FOOT_SIZE (sizeof(STRUCT_ENTRY) + \
591 ALIGN(sizeof(STRUCT_STANDARD_TARGET)))
593 struct iptcb_chain_error {
595 struct ipt_error_target target;
597 #define IPTCB_CHAIN_ERROR_SIZE (sizeof(STRUCT_ENTRY) + \
598 ALIGN(sizeof(struct ipt_error_target)))
602 /* compile rule from cache into blob */
603 static inline int iptcc_compile_rule (TC_HANDLE_T h, STRUCT_REPLACE *repl, struct rule_head *r)
606 if (r->type == IPTCC_R_JUMP) {
607 STRUCT_STANDARD_TARGET *t;
608 t = (STRUCT_STANDARD_TARGET *)GET_TARGET(r->entry);
609 /* memset for memcmp convenience on delete/replace */
610 memset(t->target.u.user.name, 0, FUNCTION_MAXNAMELEN);
611 strcpy(t->target.u.user.name, STANDARD_TARGET);
612 /* Jumps can only happen to builtin chains, so we
613 * can safely assume that they always have a header */
614 t->verdict = r->jump->head_offset + IPTCB_CHAIN_START_SIZE;
615 } else if (r->type == IPTCC_R_FALLTHROUGH) {
616 STRUCT_STANDARD_TARGET *t;
617 t = (STRUCT_STANDARD_TARGET *)GET_TARGET(r->entry);
618 t->verdict = r->offset + r->size;
621 /* copy entry from cache to blob */
622 memcpy((char *)repl->entries+r->offset, r->entry, r->size);
627 /* compile chain from cache into blob */
628 static int iptcc_compile_chain(TC_HANDLE_T h, STRUCT_REPLACE *repl, struct chain_head *c)
632 struct iptcb_chain_start *head;
633 struct iptcb_chain_foot *foot;
635 /* only user-defined chains have heaer */
636 if (!iptcc_is_builtin(c)) {
637 /* put chain header in place */
638 head = (void *)repl->entries + c->head_offset;
639 head->e.target_offset = sizeof(STRUCT_ENTRY);
640 head->e.next_offset = IPTCB_CHAIN_START_SIZE;
641 strcpy(head->name.t.u.user.name, ERROR_TARGET);
642 head->name.t.u.target_size =
643 ALIGN(sizeof(struct ipt_error_target));
644 strcpy(head->name.error, c->name);
646 repl->hook_entry[c->hooknum-1] = c->head_offset;
647 repl->underflow[c->hooknum-1] = c->foot_offset;
650 /* iterate over rules */
651 list_for_each_entry(r, &c->rules, list) {
652 ret = iptcc_compile_rule(h, repl, r);
657 /* put chain footer in place */
658 foot = (void *)repl->entries + c->foot_offset;
659 foot->e.target_offset = sizeof(STRUCT_ENTRY);
660 foot->e.next_offset = IPTCB_CHAIN_FOOT_SIZE;
661 strcpy(foot->target.target.u.user.name, STANDARD_TARGET);
662 foot->target.target.u.target_size =
663 ALIGN(sizeof(STRUCT_STANDARD_TARGET));
664 /* builtin targets have verdict, others return */
665 if (iptcc_is_builtin(c))
666 foot->target.verdict = c->verdict;
668 foot->target.verdict = RETURN;
669 /* set policy-counters */
670 memcpy(&foot->e.counters, &c->counters, sizeof(STRUCT_COUNTERS));
675 /* calculate offset and number for every rule in the cache */
676 static int iptcc_compile_chain_offsets(TC_HANDLE_T h, struct chain_head *c,
677 unsigned int *offset, unsigned int *num)
681 c->head_offset = *offset;
682 DEBUGP("%s: chain_head %u, offset=%u\n", c->name, *num, *offset);
684 if (!iptcc_is_builtin(c)) {
685 /* Chain has header */
686 *offset += sizeof(STRUCT_ENTRY)
687 + ALIGN(sizeof(struct ipt_error_target));
691 list_for_each_entry(r, &c->rules, list) {
692 DEBUGP("rule %u, offset=%u, index=%u\n", *num, *offset, *num);
699 DEBUGP("%s; chain_foot %u, offset=%u, index=%u\n", c->name, *num,
701 c->foot_offset = *offset;
702 c->foot_index = *num;
703 *offset += sizeof(STRUCT_ENTRY)
704 + ALIGN(sizeof(STRUCT_STANDARD_TARGET));
710 /* put the pieces back together again */
711 static int iptcc_compile_table_prep(TC_HANDLE_T h, unsigned int *size)
713 struct chain_head *c;
714 unsigned int offset = 0, num = 0;
717 /* First pass: calculate offset for every rule */
718 list_for_each_entry(c, &h->chains, list) {
719 ret = iptcc_compile_chain_offsets(h, c, &offset, &num);
724 /* Append one error rule at end of chain */
726 offset += sizeof(STRUCT_ENTRY)
727 + ALIGN(sizeof(struct ipt_error_target));
729 /* ruleset size is now in offset */
734 static int iptcc_compile_table(TC_HANDLE_T h, STRUCT_REPLACE *repl)
736 struct chain_head *c;
737 struct iptcb_chain_error *error;
739 /* Second pass: copy from cache to offsets, fill in jumps */
740 list_for_each_entry(c, &h->chains, list) {
741 int ret = iptcc_compile_chain(h, repl, c);
746 /* Append error rule at end of chain */
747 error = (void *)repl->entries + repl->size - IPTCB_CHAIN_ERROR_SIZE;
748 error->entry.target_offset = sizeof(STRUCT_ENTRY);
749 error->entry.next_offset = IPTCB_CHAIN_ERROR_SIZE;
750 error->target.t.u.user.target_size =
751 ALIGN(sizeof(struct ipt_error_target));
752 strcpy((char *)&error->target.t.u.user.name, ERROR_TARGET);
753 strcpy((char *)&error->target.error, "ERROR");
758 /**********************************************************************
759 * EXTERNAL API (operates on cache only)
760 **********************************************************************/
762 /* Allocate handle of given size */
764 alloc_handle(const char *tablename, unsigned int size, unsigned int num_rules)
769 len = sizeof(STRUCT_TC_HANDLE) + size;
771 h = malloc(sizeof(STRUCT_TC_HANDLE));
776 memset(h, 0, sizeof(*h));
777 INIT_LIST_HEAD(&h->chains);
778 strcpy(h->info.name, tablename);
780 h->entries = malloc(sizeof(STRUCT_GET_ENTRIES) + size);
782 goto out_free_handle;
784 strcpy(h->entries->name, tablename);
785 h->entries->size = size;
797 TC_INIT(const char *tablename)
806 if (strlen(tablename) >= TABLE_MAXNAMELEN) {
811 if (sockfd_use == 0) {
812 sockfd = socket(TC_AF, SOCK_RAW, IPPROTO_RAW);
820 strcpy(info.name, tablename);
821 if (getsockopt(sockfd, TC_IPPROTO, SO_GET_INFO, &info, &s) < 0) {
822 if (--sockfd_use == 0) {
829 DEBUGP("valid_hooks=0x%08x, num_entries=%u, size=%u\n",
830 info.valid_hooks, info.num_entries, info.size);
832 if ((h = alloc_handle(info.name, info.size, info.num_entries))
834 if (--sockfd_use == 0) {
841 /* Initialize current state */
844 h->entries->size = h->info.size;
846 tmp = sizeof(STRUCT_GET_ENTRIES) + h->info.size;
848 if (getsockopt(sockfd, TC_IPPROTO, SO_GET_ENTRIES, h->entries,
854 int fd = open("/tmp/libiptc-so_get_entries.blob",
857 write(fd, h->entries, tmp);
863 if (parse_table(h) < 0)
869 if (--sockfd_use == 0) {
878 TC_FREE(TC_HANDLE_T *h)
880 struct chain_head *c, *tmp;
883 if (--sockfd_use == 0) {
888 list_for_each_entry_safe(c, tmp, &(*h)->chains, list) {
889 struct rule_head *r, *rtmp;
891 list_for_each_entry_safe(r, rtmp, &c->rules, list) {
905 print_match(const STRUCT_ENTRY_MATCH *m)
907 printf("Match name: `%s'\n", m->u.user.name);
911 static int dump_entry(STRUCT_ENTRY *e, const TC_HANDLE_T handle);
914 TC_DUMP_ENTRIES(const TC_HANDLE_T handle)
916 iptc_fn = TC_DUMP_ENTRIES;
919 printf("libiptc v%s. %u bytes.\n",
920 IPTABLES_VERSION, handle->entries->size);
921 printf("Table `%s'\n", handle->info.name);
922 printf("Hooks: pre/in/fwd/out/post = %u/%u/%u/%u/%u\n",
923 handle->info.hook_entry[HOOK_PRE_ROUTING],
924 handle->info.hook_entry[HOOK_LOCAL_IN],
925 handle->info.hook_entry[HOOK_FORWARD],
926 handle->info.hook_entry[HOOK_LOCAL_OUT],
927 handle->info.hook_entry[HOOK_POST_ROUTING]);
928 printf("Underflows: pre/in/fwd/out/post = %u/%u/%u/%u/%u\n",
929 handle->info.underflow[HOOK_PRE_ROUTING],
930 handle->info.underflow[HOOK_LOCAL_IN],
931 handle->info.underflow[HOOK_FORWARD],
932 handle->info.underflow[HOOK_LOCAL_OUT],
933 handle->info.underflow[HOOK_POST_ROUTING]);
935 ENTRY_ITERATE(handle->entries->entrytable, handle->entries->size,
940 /* Does this chain exist? */
941 int TC_IS_CHAIN(const char *chain, const TC_HANDLE_T handle)
943 iptc_fn = TC_IS_CHAIN;
944 return iptcc_find_label(chain, handle) != NULL;
947 static void iptcc_chain_iterator_advance(TC_HANDLE_T handle)
949 struct chain_head *c = handle->chain_iterator_cur;
951 if (c->list.next == &handle->chains)
952 handle->chain_iterator_cur = NULL;
954 handle->chain_iterator_cur =
955 list_entry(c->list.next, struct chain_head, list);
958 /* Iterator functions to run through the chains. */
960 TC_FIRST_CHAIN(TC_HANDLE_T *handle)
962 struct chain_head *c = list_entry((*handle)->chains.next,
963 struct chain_head, list);
965 iptc_fn = TC_FIRST_CHAIN;
968 if (list_empty(&(*handle)->chains)) {
969 DEBUGP(": no chains\n");
973 (*handle)->chain_iterator_cur = c;
974 iptcc_chain_iterator_advance(*handle);
976 DEBUGP(": returning `%s'\n", c->name);
980 /* Iterator functions to run through the chains. Returns NULL at end. */
982 TC_NEXT_CHAIN(TC_HANDLE_T *handle)
984 struct chain_head *c = (*handle)->chain_iterator_cur;
986 iptc_fn = TC_NEXT_CHAIN;
989 DEBUGP(": no more chains\n");
993 iptcc_chain_iterator_advance(*handle);
995 DEBUGP(": returning `%s'\n", c->name);
999 /* Get first rule in the given chain: NULL for empty chain. */
1000 const STRUCT_ENTRY *
1001 TC_FIRST_RULE(const char *chain, TC_HANDLE_T *handle)
1003 struct chain_head *c;
1004 struct rule_head *r;
1006 iptc_fn = TC_FIRST_RULE;
1008 DEBUGP("first rule(%s): ", chain);
1010 c = iptcc_find_label(chain, *handle);
1016 /* Empty chain: single return/policy rule */
1017 if (list_empty(&c->rules)) {
1018 DEBUGP_C("no rules, returning NULL\n");
1022 r = list_entry(c->rules.next, struct rule_head, list);
1023 (*handle)->rule_iterator_cur = r;
1024 DEBUGP_C("%p\n", r);
1029 /* Returns NULL when rules run out. */
1030 const STRUCT_ENTRY *
1031 TC_NEXT_RULE(const STRUCT_ENTRY *prev, TC_HANDLE_T *handle)
1033 struct rule_head *r;
1035 iptc_fn = TC_NEXT_RULE;
1036 DEBUGP("rule_iterator_cur=%p...", (*handle)->rule_iterator_cur);
1038 if (!(*handle)->rule_iterator_cur) {
1039 DEBUGP_C("returning NULL\n");
1043 r = list_entry((*handle)->rule_iterator_cur->list.next,
1044 struct rule_head, list);
1046 iptc_fn = TC_NEXT_RULE;
1048 DEBUGP_C("next=%p, head=%p...", &r->list,
1049 &(*handle)->rule_iterator_cur->chain->rules);
1051 if (&r->list == &(*handle)->rule_iterator_cur->chain->rules) {
1052 (*handle)->rule_iterator_cur = NULL;
1053 DEBUGP_C("finished, returning NULL\n");
1057 (*handle)->rule_iterator_cur = r;
1059 /* NOTE: prev is without any influence ! */
1060 DEBUGP_C("returning rule %p\n", r);
1064 /* How many rules in this chain? */
1066 TC_NUM_RULES(const char *chain, TC_HANDLE_T *handle)
1068 struct chain_head *c;
1069 iptc_fn = TC_NUM_RULES;
1072 c = iptcc_find_label(chain, *handle);
1075 return (unsigned int)-1;
1078 return c->num_rules;
1081 const STRUCT_ENTRY *TC_GET_RULE(const char *chain,
1083 TC_HANDLE_T *handle)
1085 struct chain_head *c;
1086 struct rule_head *r;
1088 iptc_fn = TC_GET_RULE;
1092 c = iptcc_find_label(chain, *handle);
1098 r = iptcc_get_rule_num(c, n);
1104 /* Returns a pointer to the target name of this position. */
1105 const char *standard_target_map(int verdict)
1109 return LABEL_RETURN;
1112 return LABEL_ACCEPT;
1121 fprintf(stderr, "ERROR: %d not a valid target)\n",
1130 /* Returns a pointer to the target name of this position. */
1131 const char *TC_GET_TARGET(const STRUCT_ENTRY *ce,
1132 TC_HANDLE_T *handle)
1134 STRUCT_ENTRY *e = (STRUCT_ENTRY *)ce;
1135 struct rule_head *r = container_of(e, struct rule_head, entry[0]);
1137 iptc_fn = TC_GET_TARGET;
1141 case IPTCC_R_FALLTHROUGH:
1145 DEBUGP("r=%p, jump=%p, name=`%s'\n", r, r->jump, r->jump->name);
1146 return r->jump->name;
1148 case IPTCC_R_STANDARD:
1149 spos = *(int *)GET_TARGET(e)->data;
1150 DEBUGP("r=%p, spos=%d'\n", r, spos);
1151 return standard_target_map(spos);
1153 case IPTCC_R_MODULE:
1154 return GET_TARGET(e)->u.user.name;
1159 /* Is this a built-in chain? Actually returns hook + 1. */
1161 TC_BUILTIN(const char *chain, const TC_HANDLE_T handle)
1163 struct chain_head *c;
1165 iptc_fn = TC_BUILTIN;
1167 c = iptcc_find_label(chain, handle);
1173 return iptcc_is_builtin(c);
1176 /* Get the policy of a given built-in chain */
1178 TC_GET_POLICY(const char *chain,
1179 STRUCT_COUNTERS *counters,
1180 TC_HANDLE_T *handle)
1182 struct chain_head *c;
1184 iptc_fn = TC_GET_POLICY;
1186 DEBUGP("called for chain %s\n", chain);
1188 c = iptcc_find_label(chain, *handle);
1194 if (!iptcc_is_builtin(c))
1197 *counters = c->counters;
1199 return standard_target_map(c->verdict);
1203 iptcc_standard_map(struct rule_head *r, int verdict)
1205 STRUCT_ENTRY *e = r->entry;
1206 STRUCT_STANDARD_TARGET *t;
1208 t = (STRUCT_STANDARD_TARGET *)GET_TARGET(e);
1210 if (t->target.u.target_size
1211 != ALIGN(sizeof(STRUCT_STANDARD_TARGET))) {
1215 /* memset for memcmp convenience on delete/replace */
1216 memset(t->target.u.user.name, 0, FUNCTION_MAXNAMELEN);
1217 strcpy(t->target.u.user.name, STANDARD_TARGET);
1218 t->verdict = verdict;
1220 r->type = IPTCC_R_STANDARD;
1226 iptcc_map_target(const TC_HANDLE_T handle,
1227 struct rule_head *r)
1229 STRUCT_ENTRY *e = r->entry;
1230 STRUCT_ENTRY_TARGET *t = GET_TARGET(e);
1232 /* Maybe it's empty (=> fall through) */
1233 if (strcmp(t->u.user.name, "") == 0) {
1234 r->type = IPTCC_R_FALLTHROUGH;
1237 /* Maybe it's a standard target name... */
1238 else if (strcmp(t->u.user.name, LABEL_ACCEPT) == 0)
1239 return iptcc_standard_map(r, -NF_ACCEPT - 1);
1240 else if (strcmp(t->u.user.name, LABEL_DROP) == 0)
1241 return iptcc_standard_map(r, -NF_DROP - 1);
1242 else if (strcmp(t->u.user.name, LABEL_QUEUE) == 0)
1243 return iptcc_standard_map(r, -NF_QUEUE - 1);
1244 else if (strcmp(t->u.user.name, LABEL_RETURN) == 0)
1245 return iptcc_standard_map(r, RETURN);
1246 else if (TC_BUILTIN(t->u.user.name, handle)) {
1247 /* Can't jump to builtins. */
1251 /* Maybe it's an existing chain name. */
1252 struct chain_head *c;
1253 DEBUGP("trying to find chain `%s': ", t->u.user.name);
1255 c = iptcc_find_label(t->u.user.name, handle);
1257 DEBUGP_C("found!\n");
1258 r->type = IPTCC_R_JUMP;
1263 DEBUGP_C("not found :(\n");
1266 /* Must be a module? If not, kernel will reject... */
1267 /* memset to all 0 for your memcmp convenience: don't clear version */
1268 memset(t->u.user.name + strlen(t->u.user.name),
1270 FUNCTION_MAXNAMELEN - 1 - strlen(t->u.user.name));
1271 r->type = IPTCC_R_MODULE;
1272 set_changed(handle);
1276 /* Insert the entry `fw' in chain `chain' into position `rulenum'. */
1278 TC_INSERT_ENTRY(const IPT_CHAINLABEL chain,
1279 const STRUCT_ENTRY *e,
1280 unsigned int rulenum,
1281 TC_HANDLE_T *handle)
1283 struct chain_head *c;
1284 struct rule_head *r;
1285 struct list_head *prev;
1287 iptc_fn = TC_INSERT_ENTRY;
1289 if (!(c = iptcc_find_label(chain, *handle))) {
1294 /* first rulenum index = 0
1295 first c->num_rules index = 1 */
1296 if (rulenum > c->num_rules) {
1301 /* If we are inserting at the end just take advantage of the
1302 double linked list, insert will happen before the entry
1304 if (rulenum == c->num_rules) {
1306 } else if (rulenum + 1 <= c->num_rules/2) {
1307 r = iptcc_get_rule_num(c, rulenum + 1);
1310 r = iptcc_get_rule_num_reverse(c, c->num_rules - rulenum);
1314 if (!(r = iptcc_alloc_rule(c, e->next_offset))) {
1319 memcpy(r->entry, e, e->next_offset);
1320 r->counter_map.maptype = COUNTER_MAP_SET;
1322 if (!iptcc_map_target(*handle, r)) {
1327 list_add_tail(&r->list, prev);
1330 set_changed(*handle);
1335 /* Atomically replace rule `rulenum' in `chain' with `fw'. */
1337 TC_REPLACE_ENTRY(const IPT_CHAINLABEL chain,
1338 const STRUCT_ENTRY *e,
1339 unsigned int rulenum,
1340 TC_HANDLE_T *handle)
1342 struct chain_head *c;
1343 struct rule_head *r, *old;
1345 iptc_fn = TC_REPLACE_ENTRY;
1347 if (!(c = iptcc_find_label(chain, *handle))) {
1352 if (rulenum >= c->num_rules) {
1357 /* Take advantage of the double linked list if possible. */
1358 if (rulenum + 1 <= c->num_rules/2) {
1359 old = iptcc_get_rule_num(c, rulenum + 1);
1361 old = iptcc_get_rule_num_reverse(c, c->num_rules - rulenum);
1364 if (!(r = iptcc_alloc_rule(c, e->next_offset))) {
1369 memcpy(r->entry, e, e->next_offset);
1370 r->counter_map.maptype = COUNTER_MAP_SET;
1372 if (!iptcc_map_target(*handle, r)) {
1377 list_add(&r->list, &old->list);
1378 iptcc_delete_rule(old);
1380 set_changed(*handle);
1385 /* Append entry `fw' to chain `chain'. Equivalent to insert with
1386 rulenum = length of chain. */
1388 TC_APPEND_ENTRY(const IPT_CHAINLABEL chain,
1389 const STRUCT_ENTRY *e,
1390 TC_HANDLE_T *handle)
1392 struct chain_head *c;
1393 struct rule_head *r;
1395 iptc_fn = TC_APPEND_ENTRY;
1396 if (!(c = iptcc_find_label(chain, *handle))) {
1397 DEBUGP("unable to find chain `%s'\n", chain);
1402 if (!(r = iptcc_alloc_rule(c, e->next_offset))) {
1403 DEBUGP("unable to allocate rule for chain `%s'\n", chain);
1408 memcpy(r->entry, e, e->next_offset);
1409 r->counter_map.maptype = COUNTER_MAP_SET;
1411 if (!iptcc_map_target(*handle, r)) {
1412 DEBUGP("unable to map target of rule for chain `%s'\n", chain);
1417 list_add_tail(&r->list, &c->rules);
1420 set_changed(*handle);
1426 match_different(const STRUCT_ENTRY_MATCH *a,
1427 const unsigned char *a_elems,
1428 const unsigned char *b_elems,
1429 unsigned char **maskptr)
1431 const STRUCT_ENTRY_MATCH *b;
1434 /* Offset of b is the same as a. */
1435 b = (void *)b_elems + ((unsigned char *)a - a_elems);
1437 if (a->u.match_size != b->u.match_size)
1440 if (strcmp(a->u.user.name, b->u.user.name) != 0)
1443 *maskptr += ALIGN(sizeof(*a));
1445 for (i = 0; i < a->u.match_size - ALIGN(sizeof(*a)); i++)
1446 if (((a->data[i] ^ b->data[i]) & (*maskptr)[i]) != 0)
1453 target_same(struct rule_head *a, struct rule_head *b,const unsigned char *mask)
1456 STRUCT_ENTRY_TARGET *ta, *tb;
1458 if (a->type != b->type)
1461 ta = GET_TARGET(a->entry);
1462 tb = GET_TARGET(b->entry);
1465 case IPTCC_R_FALLTHROUGH:
1468 return a->jump == b->jump;
1469 case IPTCC_R_STANDARD:
1470 return ((STRUCT_STANDARD_TARGET *)ta)->verdict
1471 == ((STRUCT_STANDARD_TARGET *)tb)->verdict;
1472 case IPTCC_R_MODULE:
1473 if (ta->u.target_size != tb->u.target_size)
1475 if (strcmp(ta->u.user.name, tb->u.user.name) != 0)
1478 for (i = 0; i < ta->u.target_size - sizeof(*ta); i++)
1479 if (((ta->data[i] ^ tb->data[i]) & mask[i]) != 0)
1483 fprintf(stderr, "ERROR: bad type %i\n", a->type);
1488 static unsigned char *
1489 is_same(const STRUCT_ENTRY *a,
1490 const STRUCT_ENTRY *b,
1491 unsigned char *matchmask);
1493 /* Delete the first rule in `chain' which matches `fw'. */
1495 TC_DELETE_ENTRY(const IPT_CHAINLABEL chain,
1496 const STRUCT_ENTRY *origfw,
1497 unsigned char *matchmask,
1498 TC_HANDLE_T *handle)
1500 struct chain_head *c;
1501 struct rule_head *r, *i;
1503 iptc_fn = TC_DELETE_ENTRY;
1504 if (!(c = iptcc_find_label(chain, *handle))) {
1509 /* Create a rule_head from origfw. */
1510 r = iptcc_alloc_rule(c, origfw->next_offset);
1516 memcpy(r->entry, origfw, origfw->next_offset);
1517 r->counter_map.maptype = COUNTER_MAP_NOMAP;
1518 if (!iptcc_map_target(*handle, r)) {
1519 DEBUGP("unable to map target of rule for chain `%s'\n", chain);
1523 /* iptcc_map_target increment target chain references
1524 * since this is a fake rule only used for matching
1525 * the chain references count is decremented again.
1527 if (r->type == IPTCC_R_JUMP
1529 r->jump->references--;
1532 list_for_each_entry(i, &c->rules, list) {
1533 unsigned char *mask;
1535 mask = is_same(r->entry, i->entry, matchmask);
1539 if (!target_same(r, i, mask))
1542 /* If we are about to delete the rule that is the
1543 * current iterator, move rule iterator back. next
1544 * pointer will then point to real next node */
1545 if (i == (*handle)->rule_iterator_cur) {
1546 (*handle)->rule_iterator_cur =
1547 list_entry((*handle)->rule_iterator_cur->list.prev,
1548 struct rule_head, list);
1552 iptcc_delete_rule(i);
1554 set_changed(*handle);
1565 /* Delete the rule in position `rulenum' in `chain'. */
1567 TC_DELETE_NUM_ENTRY(const IPT_CHAINLABEL chain,
1568 unsigned int rulenum,
1569 TC_HANDLE_T *handle)
1571 struct chain_head *c;
1572 struct rule_head *r;
1574 iptc_fn = TC_DELETE_NUM_ENTRY;
1576 if (!(c = iptcc_find_label(chain, *handle))) {
1581 if (rulenum >= c->num_rules) {
1586 /* Take advantage of the double linked list if possible. */
1587 if (rulenum + 1 <= c->num_rules/2) {
1588 r = iptcc_get_rule_num(c, rulenum + 1);
1590 r = iptcc_get_rule_num_reverse(c, c->num_rules - rulenum);
1593 /* If we are about to delete the rule that is the current
1594 * iterator, move rule iterator back. next pointer will then
1595 * point to real next node */
1596 if (r == (*handle)->rule_iterator_cur) {
1597 (*handle)->rule_iterator_cur =
1598 list_entry((*handle)->rule_iterator_cur->list.prev,
1599 struct rule_head, list);
1603 iptcc_delete_rule(r);
1605 set_changed(*handle);
1610 /* Check the packet `fw' on chain `chain'. Returns the verdict, or
1611 NULL and sets errno. */
1613 TC_CHECK_PACKET(const IPT_CHAINLABEL chain,
1614 STRUCT_ENTRY *entry,
1615 TC_HANDLE_T *handle)
1617 iptc_fn = TC_CHECK_PACKET;
1622 /* Flushes the entries in the given chain (ie. empties chain). */
1624 TC_FLUSH_ENTRIES(const IPT_CHAINLABEL chain, TC_HANDLE_T *handle)
1626 struct chain_head *c;
1627 struct rule_head *r, *tmp;
1629 iptc_fn = TC_FLUSH_ENTRIES;
1630 if (!(c = iptcc_find_label(chain, *handle))) {
1635 list_for_each_entry_safe(r, tmp, &c->rules, list) {
1636 iptcc_delete_rule(r);
1641 set_changed(*handle);
1646 /* Zeroes the counters in a chain. */
1648 TC_ZERO_ENTRIES(const IPT_CHAINLABEL chain, TC_HANDLE_T *handle)
1650 struct chain_head *c;
1651 struct rule_head *r;
1653 iptc_fn = TC_ZERO_ENTRIES;
1654 if (!(c = iptcc_find_label(chain, *handle))) {
1659 if (c->counter_map.maptype == COUNTER_MAP_NORMAL_MAP)
1660 c->counter_map.maptype = COUNTER_MAP_ZEROED;
1662 list_for_each_entry(r, &c->rules, list) {
1663 if (r->counter_map.maptype == COUNTER_MAP_NORMAL_MAP)
1664 r->counter_map.maptype = COUNTER_MAP_ZEROED;
1667 set_changed(*handle);
1673 TC_READ_COUNTER(const IPT_CHAINLABEL chain,
1674 unsigned int rulenum,
1675 TC_HANDLE_T *handle)
1677 struct chain_head *c;
1678 struct rule_head *r;
1680 iptc_fn = TC_READ_COUNTER;
1683 if (!(c = iptcc_find_label(chain, *handle))) {
1688 if (!(r = iptcc_get_rule_num(c, rulenum))) {
1693 return &r->entry[0].counters;
1697 TC_ZERO_COUNTER(const IPT_CHAINLABEL chain,
1698 unsigned int rulenum,
1699 TC_HANDLE_T *handle)
1701 struct chain_head *c;
1702 struct rule_head *r;
1704 iptc_fn = TC_ZERO_COUNTER;
1707 if (!(c = iptcc_find_label(chain, *handle))) {
1712 if (!(r = iptcc_get_rule_num(c, rulenum))) {
1717 if (r->counter_map.maptype == COUNTER_MAP_NORMAL_MAP)
1718 r->counter_map.maptype = COUNTER_MAP_ZEROED;
1720 set_changed(*handle);
1726 TC_SET_COUNTER(const IPT_CHAINLABEL chain,
1727 unsigned int rulenum,
1728 STRUCT_COUNTERS *counters,
1729 TC_HANDLE_T *handle)
1731 struct chain_head *c;
1732 struct rule_head *r;
1735 iptc_fn = TC_SET_COUNTER;
1738 if (!(c = iptcc_find_label(chain, *handle))) {
1743 if (!(r = iptcc_get_rule_num(c, rulenum))) {
1749 r->counter_map.maptype = COUNTER_MAP_SET;
1751 memcpy(&e->counters, counters, sizeof(STRUCT_COUNTERS));
1753 set_changed(*handle);
1758 /* Creates a new chain. */
1759 /* To create a chain, create two rules: error node and unconditional
1762 TC_CREATE_CHAIN(const IPT_CHAINLABEL chain, TC_HANDLE_T *handle)
1764 static struct chain_head *c;
1766 iptc_fn = TC_CREATE_CHAIN;
1768 /* find_label doesn't cover built-in targets: DROP, ACCEPT,
1770 if (iptcc_find_label(chain, *handle)
1771 || strcmp(chain, LABEL_DROP) == 0
1772 || strcmp(chain, LABEL_ACCEPT) == 0
1773 || strcmp(chain, LABEL_QUEUE) == 0
1774 || strcmp(chain, LABEL_RETURN) == 0) {
1775 DEBUGP("Chain `%s' already exists\n", chain);
1780 if (strlen(chain)+1 > sizeof(IPT_CHAINLABEL)) {
1781 DEBUGP("Chain name `%s' too long\n", chain);
1786 c = iptcc_alloc_chain_head(chain, 0);
1788 DEBUGP("Cannot allocate memory for chain `%s'\n", chain);
1794 DEBUGP("Creating chain `%s'\n", chain);
1795 list_add_tail(&c->list, &(*handle)->chains);
1797 set_changed(*handle);
1802 /* Get the number of references to this chain. */
1804 TC_GET_REFERENCES(unsigned int *ref, const IPT_CHAINLABEL chain,
1805 TC_HANDLE_T *handle)
1807 struct chain_head *c;
1809 iptc_fn = TC_GET_REFERENCES;
1810 if (!(c = iptcc_find_label(chain, *handle))) {
1815 *ref = c->references;
1820 /* Deletes a chain. */
1822 TC_DELETE_CHAIN(const IPT_CHAINLABEL chain, TC_HANDLE_T *handle)
1824 unsigned int references;
1825 struct chain_head *c;
1827 iptc_fn = TC_DELETE_CHAIN;
1829 if (!(c = iptcc_find_label(chain, *handle))) {
1830 DEBUGP("cannot find chain `%s'\n", chain);
1835 if (TC_BUILTIN(chain, *handle)) {
1836 DEBUGP("cannot remove builtin chain `%s'\n", chain);
1841 if (!TC_GET_REFERENCES(&references, chain, handle)) {
1842 DEBUGP("cannot get references on chain `%s'\n", chain);
1846 if (references > 0) {
1847 DEBUGP("chain `%s' still has references\n", chain);
1853 DEBUGP("chain `%s' is not empty\n", chain);
1858 /* If we are about to delete the chain that is the current
1859 * iterator, move chain iterator firward. */
1860 if (c == (*handle)->chain_iterator_cur)
1861 iptcc_chain_iterator_advance(*handle);
1866 DEBUGP("chain `%s' deleted\n", chain);
1868 set_changed(*handle);
1873 /* Renames a chain. */
1874 int TC_RENAME_CHAIN(const IPT_CHAINLABEL oldname,
1875 const IPT_CHAINLABEL newname,
1876 TC_HANDLE_T *handle)
1878 struct chain_head *c;
1879 iptc_fn = TC_RENAME_CHAIN;
1881 /* find_label doesn't cover built-in targets: DROP, ACCEPT,
1883 if (iptcc_find_label(newname, *handle)
1884 || strcmp(newname, LABEL_DROP) == 0
1885 || strcmp(newname, LABEL_ACCEPT) == 0
1886 || strcmp(newname, LABEL_QUEUE) == 0
1887 || strcmp(newname, LABEL_RETURN) == 0) {
1892 if (!(c = iptcc_find_label(oldname, *handle))
1893 || TC_BUILTIN(oldname, *handle)) {
1898 if (strlen(newname)+1 > sizeof(IPT_CHAINLABEL)) {
1903 strncpy(c->name, newname, sizeof(IPT_CHAINLABEL));
1905 set_changed(*handle);
1910 /* Sets the policy on a built-in chain. */
1912 TC_SET_POLICY(const IPT_CHAINLABEL chain,
1913 const IPT_CHAINLABEL policy,
1914 STRUCT_COUNTERS *counters,
1915 TC_HANDLE_T *handle)
1917 struct chain_head *c;
1919 iptc_fn = TC_SET_POLICY;
1921 if (!(c = iptcc_find_label(chain, *handle))) {
1922 DEBUGP("cannot find chain `%s'\n", chain);
1927 if (!iptcc_is_builtin(c)) {
1928 DEBUGP("cannot set policy of userdefinedchain `%s'\n", chain);
1933 if (strcmp(policy, LABEL_ACCEPT) == 0)
1934 c->verdict = -NF_ACCEPT - 1;
1935 else if (strcmp(policy, LABEL_DROP) == 0)
1936 c->verdict = -NF_DROP - 1;
1943 /* set byte and packet counters */
1944 memcpy(&c->counters, counters, sizeof(STRUCT_COUNTERS));
1945 c->counter_map.maptype = COUNTER_MAP_SET;
1947 c->counter_map.maptype = COUNTER_MAP_NOMAP;
1950 set_changed(*handle);
1955 /* Without this, on gcc 2.7.2.3, we get:
1956 libiptc.c: In function `TC_COMMIT':
1957 libiptc.c:833: fixed or forbidden register was spilled.
1958 This may be due to a compiler bug or to impossible asm
1959 statements or clauses.
1962 subtract_counters(STRUCT_COUNTERS *answer,
1963 const STRUCT_COUNTERS *a,
1964 const STRUCT_COUNTERS *b)
1966 answer->pcnt = a->pcnt - b->pcnt;
1967 answer->bcnt = a->bcnt - b->bcnt;
1971 static void counters_nomap(STRUCT_COUNTERS_INFO *newcounters,
1974 newcounters->counters[index] = ((STRUCT_COUNTERS) { 0, 0});
1975 DEBUGP_C("NOMAP => zero\n");
1978 static void counters_normal_map(STRUCT_COUNTERS_INFO *newcounters,
1979 STRUCT_REPLACE *repl,
1981 unsigned int mappos)
1983 /* Original read: X.
1984 * Atomic read on replacement: X + Y.
1985 * Currently in kernel: Z.
1986 * Want in kernel: X + Y + Z.
1988 * => Add in replacement read.
1990 newcounters->counters[index] = repl->counters[mappos];
1991 DEBUGP_C("NORMAL_MAP => mappos %u \n", mappos);
1994 static void counters_map_zeroed(STRUCT_COUNTERS_INFO *newcounters,
1995 STRUCT_REPLACE *repl,
1997 unsigned int mappos,
1998 STRUCT_COUNTERS *counters)
2000 /* Original read: X.
2001 * Atomic read on replacement: X + Y.
2002 * Currently in kernel: Z.
2003 * Want in kernel: Y + Z.
2005 * => Add in (replacement read - original read).
2007 subtract_counters(&newcounters->counters[index],
2008 &repl->counters[mappos],
2010 DEBUGP_C("ZEROED => mappos %u\n", mappos);
2013 static void counters_map_set(STRUCT_COUNTERS_INFO *newcounters,
2015 STRUCT_COUNTERS *counters)
2017 /* Want to set counter (iptables-restore) */
2019 memcpy(&newcounters->counters[index], counters,
2020 sizeof(STRUCT_COUNTERS));
2027 TC_COMMIT(TC_HANDLE_T *handle)
2029 /* Replace, then map back the counters. */
2030 STRUCT_REPLACE *repl;
2031 STRUCT_COUNTERS_INFO *newcounters;
2032 struct chain_head *c;
2036 unsigned int new_size;
2038 iptc_fn = TC_COMMIT;
2041 /* Don't commit if nothing changed. */
2042 if (!(*handle)->changed)
2045 new_number = iptcc_compile_table_prep(*handle, &new_size);
2046 if (new_number < 0) {
2051 repl = malloc(sizeof(*repl) + new_size);
2056 memset(repl, 0, sizeof(*repl) + new_size);
2059 TC_DUMP_ENTRIES(*handle);
2062 counterlen = sizeof(STRUCT_COUNTERS_INFO)
2063 + sizeof(STRUCT_COUNTERS) * new_number;
2065 /* These are the old counters we will get from kernel */
2066 repl->counters = malloc(sizeof(STRUCT_COUNTERS)
2067 * (*handle)->info.num_entries);
2068 if (!repl->counters) {
2072 /* These are the counters we're going to put back, later. */
2073 newcounters = malloc(counterlen);
2076 goto out_free_repl_counters;
2078 memset(newcounters, 0, counterlen);
2080 strcpy(repl->name, (*handle)->info.name);
2081 repl->num_entries = new_number;
2082 repl->size = new_size;
2084 repl->num_counters = (*handle)->info.num_entries;
2085 repl->valid_hooks = (*handle)->info.valid_hooks;
2087 DEBUGP("num_entries=%u, size=%u, num_counters=%u\n",
2088 repl->num_entries, repl->size, repl->num_counters);
2090 ret = iptcc_compile_table(*handle, repl);
2093 goto out_free_newcounters;
2099 int fd = open("/tmp/libiptc-so_set_replace.blob",
2102 write(fd, repl, sizeof(*repl) + repl->size);
2108 ret = setsockopt(sockfd, TC_IPPROTO, SO_SET_REPLACE, repl,
2109 sizeof(*repl) + repl->size);
2111 goto out_free_newcounters;
2113 /* Put counters back. */
2114 strcpy(newcounters->name, (*handle)->info.name);
2115 newcounters->num_counters = new_number;
2117 list_for_each_entry(c, &(*handle)->chains, list) {
2118 struct rule_head *r;
2120 /* Builtin chains have their own counters */
2121 if (iptcc_is_builtin(c)) {
2122 DEBUGP("counter for chain-index %u: ", c->foot_index);
2123 switch(c->counter_map.maptype) {
2124 case COUNTER_MAP_NOMAP:
2125 counters_nomap(newcounters, c->foot_index);
2127 case COUNTER_MAP_NORMAL_MAP:
2128 counters_normal_map(newcounters, repl,
2130 c->counter_map.mappos);
2132 case COUNTER_MAP_ZEROED:
2133 counters_map_zeroed(newcounters, repl,
2135 c->counter_map.mappos,
2138 case COUNTER_MAP_SET:
2139 counters_map_set(newcounters, c->foot_index,
2145 list_for_each_entry(r, &c->rules, list) {
2146 DEBUGP("counter for index %u: ", r->index);
2147 switch (r->counter_map.maptype) {
2148 case COUNTER_MAP_NOMAP:
2149 counters_nomap(newcounters, r->index);
2152 case COUNTER_MAP_NORMAL_MAP:
2153 counters_normal_map(newcounters, repl,
2155 r->counter_map.mappos);
2158 case COUNTER_MAP_ZEROED:
2159 counters_map_zeroed(newcounters, repl,
2161 r->counter_map.mappos,
2162 &r->entry->counters);
2165 case COUNTER_MAP_SET:
2166 counters_map_set(newcounters, r->index,
2167 &r->entry->counters);
2174 #ifdef KERNEL_64_USERSPACE_32
2176 /* Kernel will think that pointer should be 64-bits, and get
2177 padding. So we accomodate here (assumption: alignment of
2178 `counters' is on 64-bit boundary). */
2179 u_int64_t *kernptr = (u_int64_t *)&newcounters->counters;
2180 if ((unsigned long)&newcounters->counters % 8 != 0) {
2182 "counters alignment incorrect! Mail rusty!\n");
2185 *kernptr = newcounters->counters;
2187 #endif /* KERNEL_64_USERSPACE_32 */
2191 int fd = open("/tmp/libiptc-so_set_add_counters.blob",
2194 write(fd, newcounters, counterlen);
2200 ret = setsockopt(sockfd, TC_IPPROTO, SO_SET_ADD_COUNTERS,
2201 newcounters, counterlen);
2203 goto out_free_newcounters;
2205 free(repl->counters);
2213 out_free_newcounters:
2215 out_free_repl_counters:
2216 free(repl->counters);
2223 /* Get raw socket. */
2230 /* Translates errno numbers into more human-readable form than strerror. */
2232 TC_STRERROR(int err)
2235 struct table_struct {
2238 const char *message;
2240 { { TC_INIT, EPERM, "Permission denied (you must be root)" },
2241 { TC_INIT, EINVAL, "Module is wrong version" },
2243 "Table does not exist (do you need to insmod?)" },
2244 { TC_DELETE_CHAIN, ENOTEMPTY, "Chain is not empty" },
2245 { TC_DELETE_CHAIN, EINVAL, "Can't delete built-in chain" },
2246 { TC_DELETE_CHAIN, EMLINK,
2247 "Can't delete chain with references left" },
2248 { TC_CREATE_CHAIN, EEXIST, "Chain already exists" },
2249 { TC_INSERT_ENTRY, E2BIG, "Index of insertion too big" },
2250 { TC_REPLACE_ENTRY, E2BIG, "Index of replacement too big" },
2251 { TC_DELETE_NUM_ENTRY, E2BIG, "Index of deletion too big" },
2252 { TC_READ_COUNTER, E2BIG, "Index of counter too big" },
2253 { TC_ZERO_COUNTER, E2BIG, "Index of counter too big" },
2254 { TC_INSERT_ENTRY, ELOOP, "Loop found in table" },
2255 { TC_INSERT_ENTRY, EINVAL, "Target problem" },
2256 /* EINVAL for CHECK probably means bad interface. */
2257 { TC_CHECK_PACKET, EINVAL,
2258 "Bad arguments (does that interface exist?)" },
2259 { TC_CHECK_PACKET, ENOSYS,
2260 "Checking will most likely never get implemented" },
2261 /* ENOENT for DELETE probably means no matching rule */
2262 { TC_DELETE_ENTRY, ENOENT,
2263 "Bad rule (does a matching rule exist in that chain?)" },
2264 { TC_SET_POLICY, ENOENT,
2265 "Bad built-in chain name" },
2266 { TC_SET_POLICY, EINVAL,
2267 "Bad policy name" },
2269 { NULL, 0, "Incompatible with this kernel" },
2270 { NULL, ENOPROTOOPT, "iptables who? (do you need to insmod?)" },
2271 { NULL, ENOSYS, "Will be implemented real soon. I promise ;)" },
2272 { NULL, ENOMEM, "Memory allocation problem" },
2273 { NULL, ENOENT, "No chain/target/match by that name" },
2276 for (i = 0; i < sizeof(table)/sizeof(struct table_struct); i++) {
2277 if ((!table[i].fn || table[i].fn == iptc_fn)
2278 && table[i].err == err)
2279 return table[i].message;
2282 return strerror(err);