ip6tables.c

   1 /* Code to take an ip6tables-style command line and do it. */
   2
   3 /*
   4  * Author: Paul.Russell@rustcorp.com.au and mneuling@radlogic.com.au
   5  *
   6  * (C) 2000-2002 by the netfilter coreteam <coreteam@netfilter.org>:
   7  *                  Paul 'Rusty' Russell <rusty@rustcorp.com.au>
   8  *                  Marc Boucher <marc+nf@mbsi.ca>
   9  *                  James Morris <jmorris@intercode.com.au>
  10  *                  Harald Welte <laforge@gnumonks.org>
  11  *                  Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
  12  *
  13  *      This program is free software; you can redistribute it and/or modify
  14  *      it under the terms of the GNU General Public License as published by
  15  *      the Free Software Foundation; either version 2 of the License, or
  16  *      (at your option) any later version.
  17  *
  18  *      This program is distributed in the hope that it will be useful,
  19  *      but WITHOUT ANY WARRANTY; without even the implied warranty of
  20  *      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  21  *      GNU General Public License for more details.
  22  *
  23  *      You should have received a copy of the GNU General Public License
  24  *      along with this program; if not, write to the Free Software
  25  *      Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  26  */
  27
  28 #include <getopt.h>
  29 #include <string.h>
  30 #include <netdb.h>
  31 #include <errno.h>
  32 #include <stdio.h>
  33 #include <stdlib.h>
  34 #include <dlfcn.h>
  35 #include <ctype.h>
  36 #include <stdarg.h>
  37 #include <limits.h>
  38 #include <ip6tables.h>
  39 #include <arpa/inet.h>
  40 #include <unistd.h>
  41 #include <fcntl.h>
  42 #include <sys/wait.h>
  43 #include <sys/types.h>
  44 #include <sys/socket.h>
  45
  46 #ifndef TRUE
  47 #define TRUE 1
  48 #endif
  49 #ifndef FALSE
  50 #define FALSE 0
  51 #endif
  52
  53 #ifndef PROC_SYS_MODPROBE
  54 #define PROC_SYS_MODPROBE "/proc/sys/kernel/modprobe"
  55 #endif
  56
  57 #define FMT_NUMERIC     0x0001
  58 #define FMT_NOCOUNTS    0x0002
  59 #define FMT_KILOMEGAGIGA 0x0004
  60 #define FMT_OPTIONS     0x0008
  61 #define FMT_NOTABLE     0x0010
  62 #define FMT_NOTARGET    0x0020
  63 #define FMT_VIA         0x0040
  64 #define FMT_NONEWLINE   0x0080
  65 #define FMT_LINENUMBERS 0x0100
  66
  67 #define FMT_PRINT_RULE (FMT_NOCOUNTS | FMT_OPTIONS | FMT_VIA \
  68                         | FMT_NUMERIC | FMT_NOTABLE)
  69 #define FMT(tab,notab) ((format) & FMT_NOTABLE ? (notab) : (tab))
  70
  71
  72 #define CMD_NONE                0x0000U
  73 #define CMD_INSERT              0x0001U
  74 #define CMD_DELETE              0x0002U
  75 #define CMD_DELETE_NUM          0x0004U
  76 #define CMD_REPLACE             0x0008U
  77 #define CMD_APPEND              0x0010U
  78 #define CMD_LIST                0x0020U
  79 #define CMD_FLUSH               0x0040U
  80 #define CMD_ZERO                0x0080U
  81 #define CMD_NEW_CHAIN           0x0100U
  82 #define CMD_DELETE_CHAIN        0x0200U
  83 #define CMD_SET_POLICY          0x0400U
  84 #define CMD_CHECK               0x0800U
  85 #define CMD_RENAME_CHAIN        0x1000U
  86 #define NUMBER_OF_CMD   13
  87 static const char cmdflags[] = { 'I', 'D', 'D', 'R', 'A', 'L', 'F', 'Z',
  88                                  'N', 'X', 'P', 'E' };
  89
  90 #define OPTION_OFFSET 256
  91
  92 #define OPT_NONE        0x00000U
  93 #define OPT_NUMERIC     0x00001U
  94 #define OPT_SOURCE      0x00002U
  95 #define OPT_DESTINATION 0x00004U
  96 #define OPT_PROTOCOL    0x00008U
  97 #define OPT_JUMP        0x00010U
  98 #define OPT_VERBOSE     0x00020U
  99 #define OPT_EXPANDED    0x00040U
 100 #define OPT_VIANAMEIN   0x00080U
 101 #define OPT_VIANAMEOUT  0x00100U
 102 #define OPT_LINENUMBERS 0x00200U
 103 #define OPT_COUNTERS    0x00400U
 104 #define NUMBER_OF_OPT   11
 105 static const char optflags[NUMBER_OF_OPT]
 106 = { 'n', 's', 'd', 'p', 'j', 'v', 'x', 'i', 'o', '0', 'c'};
 107
 108 static struct option original_opts[] = {
 109         { "append", 1, 0, 'A' },
 110         { "delete", 1, 0,  'D' },
 111         { "insert", 1, 0,  'I' },
 112         { "replace", 1, 0,  'R' },
 113         { "list", 2, 0,  'L' },
 114         { "flush", 2, 0,  'F' },
 115         { "zero", 2, 0,  'Z' },
 116         { "new-chain", 1, 0,  'N' },
 117         { "delete-chain", 2, 0,  'X' },
 118         { "rename-chain", 1, 0,  'E' },
 119         { "policy", 1, 0,  'P' },
 120         { "source", 1, 0, 's' },
 121         { "destination", 1, 0,  'd' },
 122         { "src", 1, 0,  's' }, /* synonym */
 123         { "dst", 1, 0,  'd' }, /* synonym */
 124         { "protocol", 1, 0,  'p' },
 125         { "in-interface", 1, 0, 'i' },
 126         { "jump", 1, 0, 'j' },
 127         { "table", 1, 0, 't' },
 128         { "match", 1, 0, 'm' },
 129         { "numeric", 0, 0, 'n' },
 130         { "out-interface", 1, 0, 'o' },
 131         { "verbose", 0, 0, 'v' },
 132         { "exact", 0, 0, 'x' },
 133         { "version", 0, 0, 'V' },
 134         { "help", 2, 0, 'h' },
 135         { "line-numbers", 0, 0, '0' },
 136         { "modprobe", 1, 0, 'M' },
 137         { "set-counters", 1, 0, 'c' },
 138         { 0 }
 139 };
 140
 141 /* we need this for ip6tables-restore. ip6tables-restore.c sets line to the
 142  * current line of the input file, in order to give a more precise error
 143  * message. ip6tables itself doesn't need this, so it is initialized to the
 144  * magic number of -1 */
 145 int line = -1;
 146
 147 static struct option *opts = original_opts;
 148 static unsigned int global_option_offset = 0;
 149
 150 /* Table of legal combinations of commands and options.  If any of the
 151  * given commands make an option legal, that option is legal (applies to
 152  * CMD_LIST and CMD_ZERO only).
 153  * Key:
 154  *  +  compulsory
 155  *  x  illegal
 156  *     optional
 157  */
 158
 159 static char commands_v_options[NUMBER_OF_CMD][NUMBER_OF_OPT] =
 160 /* Well, it's better than "Re: Linux vs FreeBSD" */
 161 {
 162         /*     -n  -s  -d  -p  -j  -v  -x  -i  -o  --line */
 163 /*INSERT*/    {'x',' ',' ',' ',' ',' ','x',' ',' ','x'},
 164 /*DELETE*/    {'x',' ',' ',' ',' ',' ','x',' ',' ','x'},
 165 /*DELETE_NUM*/{'x','x','x','x','x',' ','x','x','x','x'},
 166 /*REPLACE*/   {'x',' ',' ',' ',' ',' ','x',' ',' ','x'},
 167 /*APPEND*/    {'x',' ',' ',' ',' ',' ','x',' ',' ','x'},
 168 /*LIST*/      {' ','x','x','x','x',' ',' ','x','x',' '},
 169 /*FLUSH*/     {'x','x','x','x','x',' ','x','x','x','x'},
 170 /*ZERO*/      {'x','x','x','x','x',' ','x','x','x','x'},
 171 /*NEW_CHAIN*/ {'x','x','x','x','x',' ','x','x','x','x'},
 172 /*DEL_CHAIN*/ {'x','x','x','x','x',' ','x','x','x','x'},
 173 /*SET_POLICY*/{'x','x','x','x','x',' ','x','x','x','x'},
 174 /*CHECK*/     {'x','+','+','+','x',' ','x',' ',' ','x'},
 175 /*RENAME*/    {'x','x','x','x','x',' ','x','x','x','x'}
 176 };
 177
 178 static int inverse_for_options[NUMBER_OF_OPT] =
 179 {
 180 /* -n */ 0,
 181 /* -s */ IP6T_INV_SRCIP,
 182 /* -d */ IP6T_INV_DSTIP,
 183 /* -p */ IP6T_INV_PROTO,
 184 /* -j */ 0,
 185 /* -v */ 0,
 186 /* -x */ 0,
 187 /* -i */ IP6T_INV_VIA_IN,
 188 /* -o */ IP6T_INV_VIA_OUT,
 189 /*--line*/ 0
 190 };
 191
 192 const char *program_version;
 193 const char *program_name;
 194 char *lib_dir;
 195
 196 /* Keeping track of external matches and targets: linked lists.  */
 197 struct ip6tables_match *ip6tables_matches = NULL;
 198 struct ip6tables_target *ip6tables_targets = NULL;
 199
 200 /* Extra debugging from libiptc */
 201 extern void dump_entries6(const ip6tc_handle_t handle);
 202
 203 /* A few hardcoded protocols for 'all' and in case the user has no
 204    /etc/protocols */
 205 struct pprot {
 206         char *name;
 207         u_int8_t num;
 208 };
 209
 210 /* Primitive headers... */
 211 /* defined in netinet/in.h */
 212 #if 0
 213 #ifndef IPPROTO_ESP
 214 #define IPPROTO_ESP 50
 215 #endif
 216 #ifndef IPPROTO_AH
 217 #define IPPROTO_AH 51
 218 #endif
 219 #endif
 220
 221 static const struct pprot chain_protos[] = {
 222         { "tcp", IPPROTO_TCP },
 223         { "udp", IPPROTO_UDP },
 224         { "icmpv6", IPPROTO_ICMPV6 },
 225         { "esp", IPPROTO_ESP },
 226         { "ah", IPPROTO_AH },
 227         { "all", 0 },
 228 };
 229
 230 static char *
 231 proto_to_name(u_int8_t proto, int nolookup)
 232 {
 233         unsigned int i;
 234
 235         if (proto && !nolookup) {
 236                 struct protoent *pent = getprotobynumber(proto);
 237                 if (pent)
 238                         return pent->p_name;
 239         }
 240
 241         for (i = 0; i < sizeof(chain_protos)/sizeof(struct pprot); i++)
 242                 if (chain_protos[i].num == proto)
 243                         return chain_protos[i].name;
 244
 245         return NULL;
 246 }
 247
 248 static void
 249 in6addrcpy(struct in6_addr *dst, struct in6_addr *src)
 250 {
 251         memcpy(dst, src, sizeof(struct in6_addr));
 252         /* dst->s6_addr = src->s6_addr; */
 253 }
 254
 255 static void free_opts(int reset_offset)
 256 {
 257         if (opts != original_opts) {
 258                 free(opts);
 259                 opts = original_opts;
 260                 if (reset_offset)
 261                         global_option_offset = 0;
 262         }
 263 }
 264
 265 void
 266 exit_error(enum exittype status, char *msg, ...)
 267 {
 268         va_list args;
 269
 270         va_start(args, msg);
 271         fprintf(stderr, "%s v%s: ", program_name, program_version);
 272         vfprintf(stderr, msg, args);
 273         va_end(args);
 274         fprintf(stderr, "\n");
 275         if (status == PARAMETER_PROBLEM)
 276                 exit_tryhelp(status);
 277         if (status == VERSION_PROBLEM)
 278                 fprintf(stderr,
 279                         "Perhaps ip6tables or your kernel needs to be upgraded.\n");
 280         /* On error paths, make sure that we don't leak memory */
 281         free_opts(1);
 282         exit(status);
 283 }
 284
 285 void
 286 exit_tryhelp(int status)
 287 {
 288         if (line != -1)
 289                 fprintf(stderr, "Error occurred at line: %d\n", line);
 290         fprintf(stderr, "Try `%s -h' or '%s --help' for more information.\n",
 291                         program_name, program_name );
 292         free_opts(1);
 293         exit(status);
 294 }
 295
 296 void
 297 exit_printhelp(struct ip6tables_rule_match *matches)
 298 {
 299         struct ip6tables_rule_match *matchp = NULL;
 300         struct ip6tables_target *t = NULL;
 301
 302         printf("%s v%s\n\n"
 303 "Usage: %s -[AD] chain rule-specification [options]\n"
 304 "       %s -[RI] chain rulenum rule-specification [options]\n"
 305 "       %s -D chain rulenum [options]\n"
 306 "       %s -[LFZ] [chain] [options]\n"
 307 "       %s -[NX] chain\n"
 308 "       %s -E old-chain-name new-chain-name\n"
 309 "       %s -P chain target [options]\n"
 310 "       %s -h (print this help information)\n\n",
 311                program_name, program_version, program_name, program_name,
 312                program_name, program_name, program_name, program_name,
 313                program_name, program_name);
 314
 315         printf(
 316 "Commands:\n"
 317 "Either long or short options are allowed.\n"
 318 "  --append  -A chain           Append to chain\n"
 319 "  --delete  -D chain           Delete matching rule from chain\n"
 320 "  --delete  -D chain rulenum\n"
 321 "                               Delete rule rulenum (1 = first) from chain\n"
 322 "  --insert  -I chain [rulenum]\n"
 323 "                               Insert in chain as rulenum (default 1=first)\n"
 324 "  --replace -R chain rulenum\n"
 325 "                               Replace rule rulenum (1 = first) in chain\n"
 326 "  --list    -L [chain]         List the rules in a chain or all chains\n"
 327 "  --flush   -F [chain]         Delete all rules in  chain or all chains\n"
 328 "  --zero    -Z [chain]         Zero counters in chain or all chains\n"
 329 "  --new     -N chain           Create a new user-defined chain\n"
 330 "  --delete-chain\n"
 331 "            -X [chain]         Delete a user-defined chain\n"
 332 "  --policy  -P chain target\n"
 333 "                               Change policy on chain to target\n"
 334 "  --rename-chain\n"
 335 "            -E old-chain new-chain\n"
 336 "                               Change chain name, (moving any references)\n"
 337
 338 "Options:\n"
 339 "  --proto      -p [!] proto    protocol: by number or name, eg. `tcp'\n"
 340 "  --source     -s [!] address[/mask]\n"
 341 "                               source specification\n"
 342 "  --destination -d [!] address[/mask]\n"
 343 "                               destination specification\n"
 344 "  --in-interface -i [!] input name[+]\n"
 345 "                               network interface name ([+] for wildcard)\n"
 346 "  --jump       -j target\n"
 347 "                               target for rule (may load target extension)\n"
 348 "  --match      -m match\n"
 349 "                               extended match (may load extension)\n"
 350 "  --numeric    -n              numeric output of addresses and ports\n"
 351 "  --out-interface -o [!] output name[+]\n"
 352 "                               network interface name ([+] for wildcard)\n"
 353 "  --table      -t table        table to manipulate (default: `filter')\n"
 354 "  --verbose    -v              verbose mode\n"
 355 "  --line-numbers               print line numbers when listing\n"
 356 "  --exact      -x              expand numbers (display exact values)\n"
 357 /*"[!] --fragment       -f              match second or further fragments only\n"*/
 358 "  --modprobe=<command>         try to insert modules using this command\n"
 359 "  --set-counters PKTS BYTES    set the counter during insert/append\n"
 360 "[!] --version  -V              print package version.\n");
 361
 362         /* Print out any special helps. A user might like to be able to add a --help
 363            to the commandline, and see expected results. So we call help for all
 364            specified matches & targets */
 365         for (t = ip6tables_targets; t; t = t->next) {
 366                 if (t->used) {
 367                         printf("\n");
 368                         t->help();
 369                 }
 370         }
 371         for (matchp = matches; matchp; matchp = matchp->next) {
 372                 printf("\n");
 373                 matchp->match->help();
 374         }
 375         exit(0);
 376 }
 377
 378 static void
 379 generic_opt_check(int command, int options)
 380 {
 381         int i, j, legal = 0;
 382
 383         /* Check that commands are valid with options.  Complicated by the
 384          * fact that if an option is legal with *any* command given, it is
 385          * legal overall (ie. -z and -l).
 386          */
 387         for (i = 0; i < NUMBER_OF_OPT; i++) {
 388                 legal = 0; /* -1 => illegal, 1 => legal, 0 => undecided. */
 389
 390                 for (j = 0; j < NUMBER_OF_CMD; j++) {
 391                         if (!(command & (1<<j)))
 392                                 continue;
 393
 394                         if (!(options & (1<<i))) {
 395                                 if (commands_v_options[j][i] == '+')
 396                                         exit_error(PARAMETER_PROBLEM,
 397                                                    "You need to supply the `-%c' "
 398                                                    "option for this command\n",
 399                                                    optflags[i]);
 400                         } else {
 401                                 if (commands_v_options[j][i] != 'x')
 402                                         legal = 1;
 403                                 else if (legal == 0)
 404                                         legal = -1;
 405                         }
 406                 }
 407                 if (legal == -1)
 408                         exit_error(PARAMETER_PROBLEM,
 409                                    "Illegal option `-%c' with this command\n",
 410                                    optflags[i]);
 411         }
 412 }
 413
 414 static char
 415 opt2char(int option)
 416 {
 417         const char *ptr;
 418         for (ptr = optflags; option > 1; option >>= 1, ptr++);
 419
 420         return *ptr;
 421 }
 422
 423 static char
 424 cmd2char(int option)
 425 {
 426         const char *ptr;
 427         for (ptr = cmdflags; option > 1; option >>= 1, ptr++);
 428
 429         return *ptr;
 430 }
 431
 432 static void
 433 add_command(int *cmd, const int newcmd, const int othercmds, int invert)
 434 {
 435         if (invert)
 436                 exit_error(PARAMETER_PROBLEM, "unexpected ! flag");
 437         if (*cmd & (~othercmds))
 438                 exit_error(PARAMETER_PROBLEM, "Can't use -%c with -%c\n",
 439                            cmd2char(newcmd), cmd2char(*cmd & (~othercmds)));
 440         *cmd |= newcmd;
 441 }
 442
 443 int
 444 check_inverse(const char option[], int *invert, int *optind, int argc)
 445 {
 446         if (option && strcmp(option, "!") == 0) {
 447                 if (*invert)
 448                         exit_error(PARAMETER_PROBLEM,
 449                                    "Multiple `!' flags not allowed");
 450                 *invert = TRUE;
 451                 if (optind) {
 452                         *optind = *optind+1;
 453                         if (argc && *optind > argc)
 454                                 exit_error(PARAMETER_PROBLEM,
 455                                            "no argument following `!'");
 456                 }
 457
 458                 return TRUE;
 459         }
 460         return FALSE;
 461 }
 462
 463 static void *
 464 fw_calloc(size_t count, size_t size)
 465 {
 466         void *p;
 467
 468         if ((p = calloc(count, size)) == NULL) {
 469                 perror("ip6tables: calloc failed");
 470                 exit(1);
 471         }
 472         return p;
 473 }
 474
 475 static void *
 476 fw_malloc(size_t size)
 477 {
 478         void *p;
 479
 480         if ((p = malloc(size)) == NULL) {
 481                 perror("ip6tables: malloc failed");
 482                 exit(1);
 483         }
 484         return p;
 485 }
 486
 487 static char *
 488 addr_to_numeric(const struct in6_addr *addrp)
 489 {
 490         /* 0000:0000:0000:0000:0000:000.000.000.000
 491          * 0000:0000:0000:0000:0000:0000:0000:0000 */
 492         static char buf[50+1];
 493         return (char *)inet_ntop(AF_INET6, addrp, buf, sizeof(buf));
 494 }
 495
 496 static struct in6_addr *
 497 numeric_to_addr(const char *num)
 498 {
 499         static struct in6_addr ap;
 500         int err;
 501         if ((err=inet_pton(AF_INET6, num, &ap)) == 1)
 502                 return &ap;
 503 #ifdef DEBUG
 504         fprintf(stderr, "\nnumeric2addr: %d\n", err);
 505 #endif
 506         return (struct in6_addr *)NULL;
 507 }
 508
 509
 510 static struct in6_addr *
 511 host_to_addr(const char *name, unsigned int *naddr)
 512 {
 513         struct addrinfo hints;
 514         struct addrinfo *res;
 515         static struct in6_addr *addr;
 516         int err;
 517
 518         memset(&hints, 0, sizeof(hints));
 519         hints.ai_flags=AI_CANONNAME;
 520         hints.ai_family=AF_INET6;
 521         hints.ai_socktype=SOCK_RAW;
 522         hints.ai_protocol=41;
 523         hints.ai_next=NULL;
 524
 525         *naddr = 0;
 526         if ( (err=getaddrinfo(name, NULL, &hints, &res)) != 0 ){
 527 #ifdef DEBUG
 528                 fprintf(stderr,"Name2IP: %s\n",gai_strerror(err));
 529 #endif
 530                 return (struct in6_addr *) NULL;
 531         } else {
 532                 if (res->ai_family != AF_INET6 ||
 533                     res->ai_addrlen != sizeof(struct sockaddr_in6))
 534                         return (struct in6_addr *) NULL;
 535
 536 #ifdef DEBUG
 537                 fprintf(stderr, "resolved: len=%d  %s ", res->ai_addrlen,
 538                     addr_to_numeric(&(((struct sockaddr_in6 *)res->ai_addr)->sin6_addr)));
 539 #endif
 540                 /* Get the first element of the address-chain */
 541                 addr = fw_calloc(1, sizeof(struct in6_addr));
 542                 in6addrcpy(addr, (struct in6_addr *)
 543                         &((struct sockaddr_in6 *)res->ai_addr)->sin6_addr);
 544                 freeaddrinfo(res);
 545                 *naddr = 1;
 546                 return addr;
 547         }
 548
 549         return (struct in6_addr *) NULL;
 550 }
 551
 552 static char *
 553 addr_to_host(const struct in6_addr *addr)
 554 {
 555         struct sockaddr_in6 saddr;
 556         int err;
 557         static char hostname[NI_MAXHOST];
 558
 559         memset(&saddr, 0, sizeof(struct sockaddr_in6));
 560         in6addrcpy(&(saddr.sin6_addr),(struct in6_addr *)addr);
 561         saddr.sin6_family = AF_INET6;
 562
 563         if ( (err=getnameinfo((struct sockaddr *)&saddr,
 564                                sizeof(struct sockaddr_in6),
 565                                hostname, sizeof(hostname)-1,
 566                                NULL, 0, 0)) != 0 ){
 567 #ifdef DEBUG
 568                 fprintf(stderr,"IP2Name: %s\n",gai_strerror(err));
 569 #endif
 570                 return (char *) NULL;
 571         } else {
 572 #ifdef DEBUG
 573                 fprintf (stderr, "\naddr2host: %s\n", hostname);
 574 #endif
 575
 576                 return hostname;
 577         }
 578
 579         return (char *) NULL;
 580 }
 581
 582 static char *
 583 mask_to_numeric(const struct in6_addr *addrp)
 584 {
 585         static char buf[50+2];
 586         int l = ipv6_prefix_length(addrp);
 587         if (l == -1) {
 588                 strcpy(buf, "/");
 589                 strcat(buf, addr_to_numeric(addrp));
 590                 return buf;
 591         }
 592         sprintf(buf, "/%d", l);
 593         return buf;
 594 }
 595
 596 static struct in6_addr *
 597 network_to_addr(const char *name)
 598 {
 599         /*      abort();*/
 600         /* TODO: not implemented yet, but the exception breaks the
 601          *       name resolvation */
 602         return (struct in6_addr *)NULL;
 603 }
 604
 605 static char *
 606 addr_to_anyname(const struct in6_addr *addr)
 607 {
 608         char *name;
 609
 610         if ((name = addr_to_host(addr)) != NULL)
 611                 return name;
 612
 613         return addr_to_numeric(addr);
 614 }
 615
 616 /*
 617  *      All functions starting with "parse" should succeed, otherwise
 618  *      the program fails.
 619  *      Most routines return pointers to static data that may change
 620  *      between calls to the same or other routines with a few exceptions:
 621  *      "host_to_addr", "parse_hostnetwork", and "parse_hostnetworkmask"
 622  *      return global static data.
 623 */
 624
 625 static struct in6_addr *
 626 parse_hostnetwork(const char *name, unsigned int *naddrs)
 627 {
 628         struct in6_addr *addrp, *addrptmp;
 629
 630         if ((addrptmp = numeric_to_addr(name)) != NULL ||
 631             (addrptmp = network_to_addr(name)) != NULL) {
 632                 addrp = fw_malloc(sizeof(struct in6_addr));
 633                 in6addrcpy(addrp, addrptmp);
 634                 *naddrs = 1;
 635                 return addrp;
 636         }
 637         if ((addrp = host_to_addr(name, naddrs)) != NULL)
 638                 return addrp;
 639
 640         exit_error(PARAMETER_PROBLEM, "host/network `%s' not found", name);
 641 }
 642
 643 static struct in6_addr *
 644 parse_mask(char *mask)
 645 {
 646         static struct in6_addr maskaddr;
 647         struct in6_addr *addrp;
 648         unsigned int bits;
 649
 650         if (mask == NULL) {
 651                 /* no mask at all defaults to 128 bits */
 652                 memset(&maskaddr, 0xff, sizeof maskaddr);
 653                 return &maskaddr;
 654         }
 655         if ((addrp = numeric_to_addr(mask)) != NULL)
 656                 return addrp;
 657         if (string_to_number(mask, 0, 128, &bits) == -1)
 658                 exit_error(PARAMETER_PROBLEM,
 659                            "invalid mask `%s' specified", mask);
 660         if (bits != 0) {
 661                 char *p = (char *)&maskaddr;
 662                 memset(p, 0xff, bits / 8);
 663                 memset(p + (bits / 8) + 1, 0, (128 - bits) / 8);
 664                 p[bits / 8] = 0xff << (8 - (bits & 7));
 665                 return &maskaddr;
 666         }
 667
 668         memset(&maskaddr, 0, sizeof maskaddr);
 669         return &maskaddr;
 670 }
 671
 672 void
 673 parse_hostnetworkmask(const char *name, struct in6_addr **addrpp,
 674                       struct in6_addr *maskp, unsigned int *naddrs)
 675 {
 676         struct in6_addr *addrp;
 677         char buf[256];
 678         char *p;
 679         int i, j, n;
 680
 681         strncpy(buf, name, sizeof(buf) - 1);
 682         buf[sizeof(buf) - 1] = '\0';
 683         if ((p = strrchr(buf, '/')) != NULL) {
 684                 *p = '\0';
 685                 addrp = parse_mask(p + 1);
 686         } else
 687                 addrp = parse_mask(NULL);
 688         in6addrcpy(maskp, addrp);
 689
 690         /* if a null mask is given, the name is ignored, like in "any/0" */
 691         if (!memcmp(maskp, &in6addr_any, sizeof(in6addr_any)))
 692                 strcpy(buf, "::");
 693
 694         addrp = *addrpp = parse_hostnetwork(buf, naddrs);
 695         n = *naddrs;
 696         for (i = 0, j = 0; i < n; i++) {
 697                 int k;
 698                 for (k = 0; k < 4; k++)
 699                         addrp[j].in6_u.u6_addr32[k] &= maskp->in6_u.u6_addr32[k];
 700                 j++;
 701                 for (k = 0; k < j - 1; k++) {
 702                         if (IN6_ARE_ADDR_EQUAL(&addrp[k], &addrp[j - 1])) {
 703                                 (*naddrs)--;
 704                                 j--;
 705                                 break;
 706                         }
 707                 }
 708         }
 709 }
 710
 711 struct ip6tables_match *
 712 find_match(const char *name, enum ip6t_tryload tryload, struct ip6tables_rule_match **matches)
 713 {
 714         struct ip6tables_match *ptr;
 715         int icmphack = 0;
 716
 717         /* This is ugly as hell. Nonetheless, there is no way of changing
 718          * this without hurting backwards compatibility */
 719         if ( (strcmp(name,"icmpv6") == 0) ||
 720              (strcmp(name,"ipv6-icmp") == 0) ||
 721              (strcmp(name,"icmp6") == 0) ) icmphack = 1;
 722
 723         if (!icmphack) {
 724                 for (ptr = ip6tables_matches; ptr; ptr = ptr->next) {
 725                         if (strcmp(name, ptr->name) == 0)
 726                                 break;
 727                 }
 728         } else {
 729                 for (ptr = ip6tables_matches; ptr; ptr = ptr->next) {
 730                         if (strcmp("icmp6", ptr->name) == 0)
 731                                 break;
 732                 }
 733         }
 734
 735 #ifndef NO_SHARED_LIBS
 736         if (!ptr && tryload != DONT_LOAD) {
 737                 char path[strlen(lib_dir) + sizeof("/libip6t_.so")
 738                          + strlen(name)];
 739                 if (!icmphack)
 740                         sprintf(path, "%s/libip6t_%s.so", lib_dir, name);
 741                 else
 742                         sprintf(path, "%s/libip6t_%s.so", lib_dir, "icmpv6");
 743                 if (dlopen(path, RTLD_NOW)) {
 744                         /* Found library.  If it didn't register itself,
 745                            maybe they specified target as match. */
 746                         ptr = find_match(name, DONT_LOAD, NULL);
 747
 748                         if (!ptr)
 749                                 exit_error(PARAMETER_PROBLEM,
 750                                            "Couldn't load match `%s'\n",
 751                                            name);
 752                 } else if (tryload == LOAD_MUST_SUCCEED)
 753                         exit_error(PARAMETER_PROBLEM,
 754                                    "Couldn't load match `%s':%s\n",
 755                                    name, dlerror());
 756         }
 757 #else
 758         if (ptr && !ptr->loaded) {
 759                 if (tryload != DONT_LOAD)
 760                         ptr->loaded = 1;
 761                 else
 762                         ptr = NULL;
 763         }
 764         if(!ptr && (tryload == LOAD_MUST_SUCCEED)) {
 765                 exit_error(PARAMETER_PROBLEM,
 766                            "Couldn't find match `%s'\n", name);
 767         }
 768 #endif
 769
 770         if (ptr && matches) {
 771                 struct ip6tables_rule_match **i;
 772                 struct ip6tables_rule_match *newentry;
 773
 774                 newentry = fw_malloc(sizeof(struct ip6tables_rule_match));
 775
 776                 for (i = matches; *i; i = &(*i)->next);
 777                 newentry->match = ptr;
 778                 newentry->next = NULL;
 779                 *i = newentry;
 780         }
 781
 782         return ptr;
 783 }
 784
 785 /* Christophe Burki wants `-p 6' to imply `-m tcp'.  */
 786 static struct ip6tables_match *
 787 find_proto(const char *pname, enum ip6t_tryload tryload, int nolookup, struct ip6tables_rule_match **matches)
 788 {
 789         unsigned int proto;
 790
 791         if (string_to_number(pname, 0, 255, &proto) != -1) {
 792                 char *protoname = proto_to_name(proto, nolookup);
 793
 794                 if (protoname)
 795                         return find_match(protoname, tryload, matches);
 796         } else
 797                 return find_match(pname, tryload, matches);
 798
 799         return NULL;
 800 }
 801
 802 u_int16_t
 803 parse_protocol(const char *s)
 804 {
 805         unsigned int proto;
 806
 807         if (string_to_number(s, 0, 255, &proto) == -1) {
 808                 struct protoent *pent;
 809
 810                 if ((pent = getprotobyname(s)))
 811                         proto = pent->p_proto;
 812                 else {
 813                         unsigned int i;
 814                         for (i = 0;
 815                              i < sizeof(chain_protos)/sizeof(struct pprot);
 816                              i++) {
 817                                 if (strcmp(s, chain_protos[i].name) == 0) {
 818                                         proto = chain_protos[i].num;
 819                                         break;
 820                                 }
 821                         }
 822                         if (i == sizeof(chain_protos)/sizeof(struct pprot))
 823                                 exit_error(PARAMETER_PROBLEM,
 824                                            "unknown protocol `%s' specified",
 825                                            s);
 826                 }
 827         }
 828
 829         return (u_int16_t)proto;
 830 }
 831
 832 void parse_interface(const char *arg, char *vianame, unsigned char *mask)
 833 {
 834         int vialen = strlen(arg);
 835         unsigned int i;
 836
 837         memset(mask, 0, IFNAMSIZ);
 838         memset(vianame, 0, IFNAMSIZ);
 839
 840         if (vialen + 1 > IFNAMSIZ)
 841                 exit_error(PARAMETER_PROBLEM,
 842                            "interface name `%s' must be shorter than IFNAMSIZ"
 843                            " (%i)", arg, IFNAMSIZ-1);
 844
 845         strcpy(vianame, arg);
 846         if ((vialen == 0) || (vialen == 1 && vianame[0] == '+'))
 847                 memset(mask, 0, IFNAMSIZ);
 848         else if (vianame[vialen - 1] == '+') {
 849                 memset(mask, 0xFF, vialen - 1);
 850                 memset(mask + vialen - 1, 0, IFNAMSIZ - vialen + 1);
 851                 /* Don't remove `+' here! -HW */
 852         } else {
 853                 /* Include nul-terminator in match */
 854                 memset(mask, 0xFF, vialen + 1);
 855                 memset(mask + vialen + 1, 0, IFNAMSIZ - vialen - 1);
 856                 for (i = 0; vianame[i]; i++) {
 857                         if (!isalnum(vianame[i])
 858                             && vianame[i] != '_'
 859                             && vianame[i] != '.') {
 860                                 printf("Warning: wierd character in interface"
 861                                        " `%s' (No aliases, :, ! or *).\n",
 862                                        vianame);
 863                                 break;
 864                         }
 865                 }
 866         }
 867 }
 868
 869 /* Can't be zero. */
 870 static int
 871 parse_rulenumber(const char *rule)
 872 {
 873         unsigned int rulenum;
 874
 875         if (string_to_number(rule, 1, INT_MAX, &rulenum) == -1)
 876                 exit_error(PARAMETER_PROBLEM,
 877                            "Invalid rule number `%s'", rule);
 878
 879         return rulenum;
 880 }
 881
 882 static const char *
 883 parse_target(const char *targetname)
 884 {
 885         const char *ptr;
 886
 887         if (strlen(targetname) < 1)
 888                 exit_error(PARAMETER_PROBLEM,
 889                            "Invalid target name (too short)");
 890
 891         if (strlen(targetname)+1 > sizeof(ip6t_chainlabel))
 892                 exit_error(PARAMETER_PROBLEM,
 893                            "Invalid target name `%s' (%u chars max)",
 894                            targetname, (unsigned int)sizeof(ip6t_chainlabel)-1);
 895
 896         for (ptr = targetname; *ptr; ptr++)
 897                 if (isspace(*ptr))
 898                         exit_error(PARAMETER_PROBLEM,
 899                                    "Invalid target name `%s'", targetname);
 900         return targetname;
 901 }
 902
 903 int
 904 string_to_number_ll(const char *s, unsigned long long min, unsigned long long max,
 905                  unsigned long long *ret)
 906 {
 907         unsigned long long number;
 908         char *end;
 909
 910         /* Handle hex, octal, etc. */
 911         errno = 0;
 912         number = strtoull(s, &end, 0);
 913         if (*end == '\0' && end != s) {
 914                 /* we parsed a number, let's see if we want this */
 915                 if (errno != ERANGE && min <= number && (!max || number <= max)) {
 916                         *ret = number;
 917                         return 0;
 918                 }
 919         }
 920         return -1;
 921 }
 922
 923 int
 924 string_to_number_l(const char *s, unsigned long min, unsigned long max,
 925                  unsigned long *ret)
 926 {
 927         int result;
 928         unsigned long long number;
 929
 930         result = string_to_number_ll(s, min, max, &number);
 931         *ret = (unsigned long)number;
 932
 933         return result;
 934 }
 935
 936 int string_to_number(const char *s, unsigned int min, unsigned int max,
 937                 unsigned int *ret)
 938 {
 939         int result;
 940         unsigned long number;
 941
 942         result = string_to_number_l(s, min, max, &number);
 943         *ret = (unsigned int)number;
 944
 945         return result;
 946 }
 947
 948 static void
 949 set_option(unsigned int *options, unsigned int option, u_int8_t *invflg,
 950            int invert)
 951 {
 952         if (*options & option)
 953                 exit_error(PARAMETER_PROBLEM, "multiple -%c flags not allowed",
 954                            opt2char(option));
 955         *options |= option;
 956
 957         if (invert) {
 958                 unsigned int i;
 959                 for (i = 0; 1 << i != option; i++);
 960
 961                 if (!inverse_for_options[i])
 962                         exit_error(PARAMETER_PROBLEM,
 963                                    "cannot have ! before -%c",
 964                                    opt2char(option));
 965                 *invflg |= inverse_for_options[i];
 966         }
 967 }
 968
 969 struct ip6tables_target *
 970 find_target(const char *name, enum ip6t_tryload tryload)
 971 {
 972         struct ip6tables_target *ptr;
 973
 974         /* Standard target? */
 975         if (strcmp(name, "") == 0
 976             || strcmp(name, IP6TC_LABEL_ACCEPT) == 0
 977             || strcmp(name, IP6TC_LABEL_DROP) == 0
 978             || strcmp(name, IP6TC_LABEL_QUEUE) == 0
 979             || strcmp(name, IP6TC_LABEL_RETURN) == 0)
 980                 name = "standard";
 981
 982         for (ptr = ip6tables_targets; ptr; ptr = ptr->next) {
 983                 if (strcmp(name, ptr->name) == 0)
 984                         break;
 985         }
 986
 987 #ifndef NO_SHARED_LIBS
 988         if (!ptr && tryload != DONT_LOAD) {
 989                 char path[strlen(lib_dir) + sizeof("/libip6t_.so")
 990                          + strlen(name)];
 991                 sprintf(path, "%s/libip6t_%s.so", lib_dir, name);
 992                 if (dlopen(path, RTLD_NOW)) {
 993                         /* Found library.  If it didn't register itself,
 994                            maybe they specified match as a target. */
 995                         ptr = find_target(name, DONT_LOAD);
 996                         if (!ptr)
 997                                 exit_error(PARAMETER_PROBLEM,
 998                                            "Couldn't load target `%s'\n",
 999                                            name);
1000                 } else if (tryload == LOAD_MUST_SUCCEED)
1001                         exit_error(PARAMETER_PROBLEM,
1002                                    "Couldn't load target `%s':%s\n",
1003                                    name, dlerror());
1004         }
1005 #else
1006         if (ptr && !ptr->loaded) {
1007                 if (tryload != DONT_LOAD)
1008                         ptr->loaded = 1;
1009                 else
1010                         ptr = NULL;
1011         }
1012         if(!ptr && (tryload == LOAD_MUST_SUCCEED)) {
1013                 exit_error(PARAMETER_PROBLEM,
1014                            "Couldn't find target `%s'\n", name);
1015         }
1016 #endif
1017
1018         if (ptr)
1019                 ptr->used = 1;
1020
1021         return ptr;
1022 }
1023
1024 static struct option *
1025 merge_options(struct option *oldopts, const struct option *newopts,
1026               unsigned int *option_offset)
1027 {
1028         unsigned int num_old, num_new, i;
1029         struct option *merge;
1030
1031         /* Release previous options merged if any */
1032         free_opts(0);
1033
1034         for (num_old = 0; oldopts[num_old].name; num_old++);
1035         for (num_new = 0; newopts[num_new].name; num_new++);
1036
1037         global_option_offset += OPTION_OFFSET;
1038         *option_offset = global_option_offset;
1039
1040         merge = malloc(sizeof(struct option) * (num_new + num_old + 1));
1041         memcpy(merge, oldopts, num_old * sizeof(struct option));
1042         for (i = 0; i < num_new; i++) {
1043                 merge[num_old + i] = newopts[i];
1044                 merge[num_old + i].val += *option_offset;
1045         }
1046         memset(merge + num_old + num_new, 0, sizeof(struct option));
1047
1048         return merge;
1049 }
1050
1051 void
1052 register_match6(struct ip6tables_match *me)
1053 {
1054         struct ip6tables_match **i;
1055
1056         if (strcmp(me->version, program_version) != 0) {
1057                 fprintf(stderr, "%s: match `%s' v%s (I'm v%s).\n",
1058                         program_name, me->name, me->version, program_version);
1059                 exit(1);
1060         }
1061
1062         if (find_match(me->name, DONT_LOAD, NULL)) {
1063                 fprintf(stderr, "%s: match `%s' already registered.\n",
1064                         program_name, me->name);
1065                 exit(1);
1066         }
1067
1068         if (me->size != IP6T_ALIGN(me->size)) {
1069                 fprintf(stderr, "%s: match `%s' has invalid size %u.\n",
1070                         program_name, me->name, (unsigned int)me->size);
1071                 exit(1);
1072         }
1073
1074         /* Append to list. */
1075         for (i = &ip6tables_matches; *i; i = &(*i)->next);
1076         me->next = NULL;
1077         *i = me;
1078
1079         me->m = NULL;
1080         me->mflags = 0;
1081 }
1082
1083 void
1084 register_target6(struct ip6tables_target *me)
1085 {
1086         if (strcmp(me->version, program_version) != 0) {
1087                 fprintf(stderr, "%s: target `%s' v%s (I'm v%s).\n",
1088                         program_name, me->name, me->version, program_version);
1089                 exit(1);
1090         }
1091
1092         if (find_target(me->name, DONT_LOAD)) {
1093                 fprintf(stderr, "%s: target `%s' already registered.\n",
1094                         program_name, me->name);
1095                 exit(1);
1096         }
1097
1098         if (me->size != IP6T_ALIGN(me->size)) {
1099                 fprintf(stderr, "%s: target `%s' has invalid size %u.\n",
1100                         program_name, me->name, (unsigned int)me->size);
1101                 exit(1);
1102         }
1103
1104         /* Prepend to list. */
1105         me->next = ip6tables_targets;
1106         ip6tables_targets = me;
1107         me->t = NULL;
1108         me->tflags = 0;
1109 }
1110
1111 static void
1112 print_num(u_int64_t number, unsigned int format)
1113 {
1114         if (format & FMT_KILOMEGAGIGA) {
1115                 if (number > 99999) {
1116                         number = (number + 500) / 1000;
1117                         if (number > 9999) {
1118                                 number = (number + 500) / 1000;
1119                                 if (number > 9999) {
1120                                         number = (number + 500) / 1000;
1121                                         if (number > 9999) {
1122                                                 number = (number + 500) / 1000;
1123                                                 printf(FMT("%4lluT ","%lluT "), (unsigned long long)number);
1124                                         }
1125                                         else printf(FMT("%4lluG ","%lluG "), (unsigned long long)number);
1126                                 }
1127                                 else printf(FMT("%4lluM ","%lluM "), (unsigned long long)number);
1128                         } else
1129                                 printf(FMT("%4lluK ","%lluK "), (unsigned long long)number);
1130                 } else
1131                         printf(FMT("%5llu ","%llu "), (unsigned long long)number);
1132         } else
1133                 printf(FMT("%8llu ","%llu "), (unsigned long long)number);
1134 }
1135
1136
1137 static void
1138 print_header(unsigned int format, const char *chain, ip6tc_handle_t *handle)
1139 {
1140         struct ip6t_counters counters;
1141         const char *pol = ip6tc_get_policy(chain, &counters, handle);
1142         printf("Chain %s", chain);
1143         if (pol) {
1144                 printf(" (policy %s", pol);
1145                 if (!(format & FMT_NOCOUNTS)) {
1146                         fputc(' ', stdout);
1147                         print_num(counters.pcnt, (format|FMT_NOTABLE));
1148                         fputs("packets, ", stdout);
1149                         print_num(counters.bcnt, (format|FMT_NOTABLE));
1150                         fputs("bytes", stdout);
1151                 }
1152                 printf(")\n");
1153         } else {
1154                 unsigned int refs;
1155                 if (!ip6tc_get_references(&refs, chain, handle))
1156                         printf(" (ERROR obtaining refs)\n");
1157                 else
1158                         printf(" (%u references)\n", refs);
1159         }
1160
1161         if (format & FMT_LINENUMBERS)
1162                 printf(FMT("%-4s ", "%s "), "num");
1163         if (!(format & FMT_NOCOUNTS)) {
1164                 if (format & FMT_KILOMEGAGIGA) {
1165                         printf(FMT("%5s ","%s "), "pkts");
1166                         printf(FMT("%5s ","%s "), "bytes");
1167                 } else {
1168                         printf(FMT("%8s ","%s "), "pkts");
1169                         printf(FMT("%10s ","%s "), "bytes");
1170                 }
1171         }
1172         if (!(format & FMT_NOTARGET))
1173                 printf(FMT("%-9s ","%s "), "target");
1174         fputs(" prot ", stdout);
1175         if (format & FMT_OPTIONS)
1176                 fputs("opt", stdout);
1177         if (format & FMT_VIA) {
1178                 printf(FMT(" %-6s ","%s "), "in");
1179                 printf(FMT("%-6s ","%s "), "out");
1180         }
1181         printf(FMT(" %-19s ","%s "), "source");
1182         printf(FMT(" %-19s "," %s "), "destination");
1183         printf("\n");
1184 }
1185
1186
1187 static int
1188 print_match(const struct ip6t_entry_match *m,
1189             const struct ip6t_ip6 *ip,
1190             int numeric)
1191 {
1192         struct ip6tables_match *match = find_match(m->u.user.name, TRY_LOAD, NULL);
1193
1194         if (match) {
1195                 if (match->print)
1196                         match->print(ip, m, numeric);
1197                 else
1198                         printf("%s ", match->name);
1199         } else {
1200                 if (m->u.user.name[0])
1201                         printf("UNKNOWN match `%s' ", m->u.user.name);
1202         }
1203         /* Don't stop iterating. */
1204         return 0;
1205 }
1206
1207 /* e is called `fw' here for hysterical raisins */
1208 static void
1209 print_firewall(const struct ip6t_entry *fw,
1210                const char *targname,
1211                unsigned int num,
1212                unsigned int format,
1213                const ip6tc_handle_t handle)
1214 {
1215         struct ip6tables_target *target = NULL;
1216         const struct ip6t_entry_target *t;
1217         u_int8_t flags;
1218         char buf[BUFSIZ];
1219
1220         if (!ip6tc_is_chain(targname, handle))
1221                 target = find_target(targname, TRY_LOAD);
1222         else
1223                 target = find_target(IP6T_STANDARD_TARGET, LOAD_MUST_SUCCEED);
1224
1225         t = ip6t_get_target((struct ip6t_entry *)fw);
1226         flags = fw->ipv6.flags;
1227
1228         if (format & FMT_LINENUMBERS)
1229                 printf(FMT("%-4u ", "%u "), num+1);
1230
1231         if (!(format & FMT_NOCOUNTS)) {
1232                 print_num(fw->counters.pcnt, format);
1233                 print_num(fw->counters.bcnt, format);
1234         }
1235
1236         if (!(format & FMT_NOTARGET))
1237                 printf(FMT("%-9s ", "%s "), targname);
1238
1239         fputc(fw->ipv6.invflags & IP6T_INV_PROTO ? '!' : ' ', stdout);
1240         {
1241                 char *pname = proto_to_name(fw->ipv6.proto, format&FMT_NUMERIC);
1242                 if (pname)
1243                         printf(FMT("%-5s", "%s "), pname);
1244                 else
1245                         printf(FMT("%-5hu", "%hu "), fw->ipv6.proto);
1246         }
1247
1248         if (format & FMT_OPTIONS) {
1249                 if (format & FMT_NOTABLE)
1250                         fputs("opt ", stdout);
1251                 fputc(' ', stdout); /* Invert flag of FRAG */
1252                 fputc(' ', stdout); /* -f */
1253                 fputc(' ', stdout);
1254         }
1255
1256         if (format & FMT_VIA) {
1257                 char iface[IFNAMSIZ+2];
1258
1259                 if (fw->ipv6.invflags & IP6T_INV_VIA_IN) {
1260                         iface[0] = '!';
1261                         iface[1] = '\0';
1262                 }
1263                 else iface[0] = '\0';
1264
1265                 if (fw->ipv6.iniface[0] != '\0') {
1266                         strcat(iface, fw->ipv6.iniface);
1267                 }
1268                 else if (format & FMT_NUMERIC) strcat(iface, "*");
1269                 else strcat(iface, "any");
1270                 printf(FMT(" %-6s ","in %s "), iface);
1271
1272                 if (fw->ipv6.invflags & IP6T_INV_VIA_OUT) {
1273                         iface[0] = '!';
1274                         iface[1] = '\0';
1275                 }
1276                 else iface[0] = '\0';
1277
1278                 if (fw->ipv6.outiface[0] != '\0') {
1279                         strcat(iface, fw->ipv6.outiface);
1280                 }
1281                 else if (format & FMT_NUMERIC) strcat(iface, "*");
1282                 else strcat(iface, "any");
1283                 printf(FMT("%-6s ","out %s "), iface);
1284         }
1285
1286         fputc(fw->ipv6.invflags & IP6T_INV_SRCIP ? '!' : ' ', stdout);
1287         if (!memcmp(&fw->ipv6.smsk, &in6addr_any, sizeof in6addr_any)
1288             && !(format & FMT_NUMERIC))
1289                 printf(FMT("%-19s ","%s "), "anywhere");
1290         else {
1291                 if (format & FMT_NUMERIC)
1292                         sprintf(buf, "%s", addr_to_numeric(&(fw->ipv6.src)));
1293                 else
1294                         sprintf(buf, "%s", addr_to_anyname(&(fw->ipv6.src)));
1295                 strcat(buf, mask_to_numeric(&(fw->ipv6.smsk)));
1296                 printf(FMT("%-19s ","%s "), buf);
1297         }
1298
1299         fputc(fw->ipv6.invflags & IP6T_INV_DSTIP ? '!' : ' ', stdout);
1300         if (!memcmp(&fw->ipv6.dmsk, &in6addr_any, sizeof in6addr_any)
1301             && !(format & FMT_NUMERIC))
1302                 printf(FMT("%-19s","-> %s"), "anywhere");
1303         else {
1304                 if (format & FMT_NUMERIC)
1305                         sprintf(buf, "%s", addr_to_numeric(&(fw->ipv6.dst)));
1306                 else
1307                         sprintf(buf, "%s", addr_to_anyname(&(fw->ipv6.dst)));
1308                 strcat(buf, mask_to_numeric(&(fw->ipv6.dmsk)));
1309                 printf(FMT("%-19s","-> %s"), buf);
1310         }
1311
1312         if (format & FMT_NOTABLE)
1313                 fputs("  ", stdout);
1314
1315         IP6T_MATCH_ITERATE(fw, print_match, &fw->ipv6, format & FMT_NUMERIC);
1316
1317         if (target) {
1318                 if (target->print)
1319                         /* Print the target information. */
1320                         target->print(&fw->ipv6, t, format & FMT_NUMERIC);
1321         } else if (t->u.target_size != sizeof(*t))
1322                 printf("[%u bytes of unknown target data] ",
1323                        (unsigned int)(t->u.target_size - sizeof(*t)));
1324
1325         if (!(format & FMT_NONEWLINE))
1326                 fputc('\n', stdout);
1327 }
1328
1329 static void
1330 print_firewall_line(const struct ip6t_entry *fw,
1331                     const ip6tc_handle_t h)
1332 {
1333         struct ip6t_entry_target *t;
1334
1335         t = ip6t_get_target((struct ip6t_entry *)fw);
1336         print_firewall(fw, t->u.user.name, 0, FMT_PRINT_RULE, h);
1337 }
1338
1339 static int
1340 append_entry(const ip6t_chainlabel chain,
1341              struct ip6t_entry *fw,
1342              unsigned int nsaddrs,
1343              const struct in6_addr saddrs[],
1344              unsigned int ndaddrs,
1345              const struct in6_addr daddrs[],
1346              int verbose,
1347              ip6tc_handle_t *handle)
1348 {
1349         unsigned int i, j;
1350         int ret = 1;
1351
1352         for (i = 0; i < nsaddrs; i++) {
1353                 fw->ipv6.src = saddrs[i];
1354                 for (j = 0; j < ndaddrs; j++) {
1355                         fw->ipv6.dst = daddrs[j];
1356                         if (verbose)
1357                                 print_firewall_line(fw, *handle);
1358                         ret &= ip6tc_append_entry(chain, fw, handle);
1359                 }
1360         }
1361
1362         return ret;
1363 }
1364
1365 static int
1366 replace_entry(const ip6t_chainlabel chain,
1367               struct ip6t_entry *fw,
1368               unsigned int rulenum,
1369               const struct in6_addr *saddr,
1370               const struct in6_addr *daddr,
1371               int verbose,
1372               ip6tc_handle_t *handle)
1373 {
1374         fw->ipv6.src = *saddr;
1375         fw->ipv6.dst = *daddr;
1376
1377         if (verbose)
1378                 print_firewall_line(fw, *handle);
1379         return ip6tc_replace_entry(chain, fw, rulenum, handle);
1380 }
1381
1382 static int
1383 insert_entry(const ip6t_chainlabel chain,
1384              struct ip6t_entry *fw,
1385              unsigned int rulenum,
1386              unsigned int nsaddrs,
1387              const struct in6_addr saddrs[],
1388              unsigned int ndaddrs,
1389              const struct in6_addr daddrs[],
1390              int verbose,
1391              ip6tc_handle_t *handle)
1392 {
1393         unsigned int i, j;
1394         int ret = 1;
1395
1396         for (i = 0; i < nsaddrs; i++) {
1397                 fw->ipv6.src = saddrs[i];
1398                 for (j = 0; j < ndaddrs; j++) {
1399                         fw->ipv6.dst = daddrs[j];
1400                         if (verbose)
1401                                 print_firewall_line(fw, *handle);
1402                         ret &= ip6tc_insert_entry(chain, fw, rulenum, handle);
1403                 }
1404         }
1405
1406         return ret;
1407 }
1408
1409 static unsigned char *
1410 make_delete_mask(struct ip6t_entry *fw, struct ip6tables_rule_match *matches)
1411 {
1412         /* Establish mask for comparison */
1413         unsigned int size;
1414         struct ip6tables_rule_match *matchp;
1415         unsigned char *mask, *mptr;
1416
1417         size = sizeof(struct ip6t_entry);
1418         for (matchp = matches; matchp; matchp = matchp->next)
1419                 size += IP6T_ALIGN(sizeof(struct ip6t_entry_match)) + matchp->match->size;
1420
1421         mask = fw_calloc(1, size
1422                          + IP6T_ALIGN(sizeof(struct ip6t_entry_target))
1423                          + ip6tables_targets->size);
1424
1425         memset(mask, 0xFF, sizeof(struct ip6t_entry));
1426         mptr = mask + sizeof(struct ip6t_entry);
1427
1428         for (matchp = matches; matchp; matchp = matchp->next) {
1429                 memset(mptr, 0xFF,
1430                        IP6T_ALIGN(sizeof(struct ip6t_entry_match))
1431                        + matchp->match->userspacesize);
1432                 mptr += IP6T_ALIGN(sizeof(struct ip6t_entry_match)) + matchp->match->size;
1433         }
1434
1435         memset(mptr, 0xFF,
1436                IP6T_ALIGN(sizeof(struct ip6t_entry_target))
1437                + ip6tables_targets->userspacesize);
1438
1439         return mask;
1440 }
1441
1442 static int
1443 delete_entry(const ip6t_chainlabel chain,
1444              struct ip6t_entry *fw,
1445              unsigned int nsaddrs,
1446              const struct in6_addr saddrs[],
1447              unsigned int ndaddrs,
1448              const struct in6_addr daddrs[],
1449              int verbose,
1450              ip6tc_handle_t *handle,
1451              struct ip6tables_rule_match *matches)
1452 {
1453         unsigned int i, j;
1454         int ret = 1;
1455         unsigned char *mask;
1456
1457         mask = make_delete_mask(fw, matches);
1458         for (i = 0; i < nsaddrs; i++) {
1459                 fw->ipv6.src = saddrs[i];
1460                 for (j = 0; j < ndaddrs; j++) {
1461                         fw->ipv6.dst = daddrs[j];
1462                         if (verbose)
1463                                 print_firewall_line(fw, *handle);
1464                         ret &= ip6tc_delete_entry(chain, fw, mask, handle);
1465                 }
1466         }
1467         free(mask);
1468
1469         return ret;
1470 }
1471
1472 int
1473 for_each_chain(int (*fn)(const ip6t_chainlabel, int, ip6tc_handle_t *),
1474                int verbose, int builtinstoo, ip6tc_handle_t *handle)
1475 {
1476         int ret = 1;
1477         const char *chain;
1478         char *chains;
1479         unsigned int i, chaincount = 0;
1480
1481         chain = ip6tc_first_chain(handle);
1482         while (chain) {
1483                 chaincount++;
1484                 chain = ip6tc_next_chain(handle);
1485         }
1486
1487         chains = fw_malloc(sizeof(ip6t_chainlabel) * chaincount);
1488         i = 0;
1489         chain = ip6tc_first_chain(handle);
1490         while (chain) {
1491                 strcpy(chains + i*sizeof(ip6t_chainlabel), chain);
1492                 i++;
1493                 chain = ip6tc_next_chain(handle);
1494         }
1495
1496         for (i = 0; i < chaincount; i++) {
1497                 if (!builtinstoo
1498                     && ip6tc_builtin(chains + i*sizeof(ip6t_chainlabel),
1499                                     *handle) == 1)
1500                         continue;
1501                 ret &= fn(chains + i*sizeof(ip6t_chainlabel), verbose, handle);
1502         }
1503
1504         free(chains);
1505         return ret;
1506 }
1507
1508 int
1509 flush_entries(const ip6t_chainlabel chain, int verbose,
1510               ip6tc_handle_t *handle)
1511 {
1512         if (!chain)
1513                 return for_each_chain(flush_entries, verbose, 1, handle);
1514
1515         if (verbose)
1516                 fprintf(stdout, "Flushing chain `%s'\n", chain);
1517         return ip6tc_flush_entries(chain, handle);
1518 }
1519
1520 static int
1521 zero_entries(const ip6t_chainlabel chain, int verbose,
1522              ip6tc_handle_t *handle)
1523 {
1524         if (!chain)
1525                 return for_each_chain(zero_entries, verbose, 1, handle);
1526
1527         if (verbose)
1528                 fprintf(stdout, "Zeroing chain `%s'\n", chain);
1529         return ip6tc_zero_entries(chain, handle);
1530 }
1531
1532 int
1533 delete_chain(const ip6t_chainlabel chain, int verbose,
1534              ip6tc_handle_t *handle)
1535 {
1536         if (!chain)
1537                 return for_each_chain(delete_chain, verbose, 0, handle);
1538
1539         if (verbose)
1540                 fprintf(stdout, "Deleting chain `%s'\n", chain);
1541         return ip6tc_delete_chain(chain, handle);
1542 }
1543
1544 static int
1545 list_entries(const ip6t_chainlabel chain, int verbose, int numeric,
1546              int expanded, int linenumbers, ip6tc_handle_t *handle)
1547 {
1548         int found = 0;
1549         unsigned int format;
1550         const char *this;
1551
1552         format = FMT_OPTIONS;
1553         if (!verbose)
1554                 format |= FMT_NOCOUNTS;
1555         else
1556                 format |= FMT_VIA;
1557
1558         if (numeric)
1559                 format |= FMT_NUMERIC;
1560
1561         if (!expanded)
1562                 format |= FMT_KILOMEGAGIGA;
1563
1564         if (linenumbers)
1565                 format |= FMT_LINENUMBERS;
1566
1567         for (this = ip6tc_first_chain(handle);
1568              this;
1569              this = ip6tc_next_chain(handle)) {
1570                 const struct ip6t_entry *i;
1571                 unsigned int num;
1572
1573                 if (chain && strcmp(chain, this) != 0)
1574                         continue;
1575
1576                 if (found) printf("\n");
1577
1578                 print_header(format, this, handle);
1579                 i = ip6tc_first_rule(this, handle);
1580
1581                 num = 0;
1582                 while (i) {
1583                         print_firewall(i,
1584                                        ip6tc_get_target(i, handle),
1585                                        num++,
1586                                        format,
1587                                        *handle);
1588                         i = ip6tc_next_rule(i, handle);
1589                 }
1590                 found = 1;
1591         }
1592
1593         errno = ENOENT;
1594         return found;
1595 }
1596
1597 static char *get_modprobe(void)
1598 {
1599         int procfile;
1600         char *ret;
1601
1602 #define PROCFILE_BUFSIZ 1024
1603         procfile = open(PROC_SYS_MODPROBE, O_RDONLY);
1604         if (procfile < 0)
1605                 return NULL;
1606
1607         ret = malloc(PROCFILE_BUFSIZ);
1608         if (ret) {
1609                 memset(ret, 0, PROCFILE_BUFSIZ);
1610                 switch (read(procfile, ret, PROCFILE_BUFSIZ)) {
1611                 case -1: goto fail;
1612                 case PROCFILE_BUFSIZ: goto fail; /* Partial read.  Wierd */
1613                 }
1614                 if (ret[strlen(ret)-1]=='\n')
1615                         ret[strlen(ret)-1]=0;
1616                 close(procfile);
1617                 return ret;
1618         }
1619  fail:
1620         free(ret);
1621         close(procfile);
1622         return NULL;
1623 }
1624
1625 int ip6tables_insmod(const char *modname, const char *modprobe)
1626 {
1627         char *buf = NULL;
1628         char *argv[3];
1629         int status;
1630
1631         /* If they don't explicitly set it, read out of kernel */
1632         if (!modprobe) {
1633                 buf = get_modprobe();
1634                 if (!buf)
1635                         return -1;
1636                 modprobe = buf;
1637         }
1638
1639         switch (fork()) {
1640         case 0:
1641                 argv[0] = (char *)modprobe;
1642                 argv[1] = (char *)modname;
1643                 argv[2] = NULL;
1644                 execv(argv[0], argv);
1645
1646                 /* not usually reached */
1647                 exit(1);
1648         case -1:
1649                 return -1;
1650
1651         default: /* parent */
1652                 wait(&status);
1653         }
1654
1655         free(buf);
1656         if (WIFEXITED(status) && WEXITSTATUS(status) == 0)
1657                 return 0;
1658         return -1;
1659 }
1660
1661 static struct ip6t_entry *
1662 generate_entry(const struct ip6t_entry *fw,
1663                struct ip6tables_rule_match *matches,
1664                struct ip6t_entry_target *target)
1665 {
1666         unsigned int size;
1667         struct ip6tables_rule_match *matchp;
1668         struct ip6t_entry *e;
1669
1670         size = sizeof(struct ip6t_entry);
1671         for (matchp = matches; matchp; matchp = matchp->next)
1672                 size += matchp->match->m->u.match_size;
1673
1674         e = fw_malloc(size + target->u.target_size);
1675         *e = *fw;
1676         e->target_offset = size;
1677         e->next_offset = size + target->u.target_size;
1678
1679         size = 0;
1680         for (matchp = matches; matchp; matchp = matchp->next) {
1681                 memcpy(e->elems + size, matchp->match->m, matchp->match->m->u.match_size);
1682                 size += matchp->match->m->u.match_size;
1683         }
1684         memcpy(e->elems + size, target, target->u.target_size);
1685
1686         return e;
1687 }
1688
1689 void clear_rule_matches(struct ip6tables_rule_match **matches)
1690 {
1691         struct ip6tables_rule_match *matchp, *tmp;
1692
1693         for (matchp = *matches; matchp;) {
1694                 tmp = matchp->next;
1695                 if (matchp->match->m)
1696                         free(matchp->match->m);
1697                 free(matchp);
1698                 matchp = tmp;
1699         }
1700
1701         *matches = NULL;
1702 }
1703
1704 int do_command6(int argc, char *argv[], char **table, ip6tc_handle_t *handle)
1705 {
1706         struct ip6t_entry fw, *e = NULL;
1707         int invert = 0;
1708         unsigned int nsaddrs = 0, ndaddrs = 0;
1709         struct in6_addr *saddrs = NULL, *daddrs = NULL;
1710
1711         int c, verbose = 0;
1712         const char *chain = NULL;
1713         const char *shostnetworkmask = NULL, *dhostnetworkmask = NULL;
1714         const char *policy = NULL, *newname = NULL;
1715         unsigned int rulenum = 0, options = 0, command = 0;
1716         const char *pcnt = NULL, *bcnt = NULL;
1717         int ret = 1;
1718         struct ip6tables_match *m;
1719         struct ip6tables_rule_match *matches = NULL;
1720         struct ip6tables_rule_match *matchp;
1721         struct ip6tables_target *target = NULL;
1722         struct ip6tables_target *t;
1723         const char *jumpto = "";
1724         char *protocol = NULL;
1725         const char *modprobe = NULL;
1726         int proto_used = 0;
1727         char icmp6p[] = "icmpv6";
1728
1729         memset(&fw, 0, sizeof(fw));
1730
1731         /* re-set optind to 0 in case do_command gets called
1732          * a second time */
1733         optind = 0;
1734
1735         /* clear mflags in case do_command gets called a second time
1736          * (we clear the global list of all matches for security)*/
1737         for (m = ip6tables_matches; m; m = m->next)
1738                 m->mflags = 0;
1739
1740         for (t = ip6tables_targets; t; t = t->next) {
1741                 t->tflags = 0;
1742                 t->used = 0;
1743         }
1744
1745         /* Suppress error messages: we may add new options if we
1746            demand-load a protocol. */
1747         opterr = 0;
1748
1749         while ((c = getopt_long(argc, argv,
1750            "-A:D:R:I:L::M:F::Z::N:X::E:P:Vh::o:p:s:d:j:i:bvnt:m:xc:",
1751                                            opts, NULL)) != -1) {
1752                 switch (c) {
1753                         /*
1754                          * Command selection
1755                          */
1756                 case 'A':
1757                         add_command(&command, CMD_APPEND, CMD_NONE,
1758                                     invert);
1759                         chain = optarg;
1760                         break;
1761
1762                 case 'D':
1763                         add_command(&command, CMD_DELETE, CMD_NONE,
1764                                     invert);
1765                         chain = optarg;
1766                         if (optind < argc && argv[optind][0] != '-'
1767                             && argv[optind][0] != '!') {
1768                                 rulenum = parse_rulenumber(argv[optind++]);
1769                                 command = CMD_DELETE_NUM;
1770                         }
1771                         break;
1772
1773                 case 'R':
1774                         add_command(&command, CMD_REPLACE, CMD_NONE,
1775                                     invert);
1776                         chain = optarg;
1777                         if (optind < argc && argv[optind][0] != '-'
1778                             && argv[optind][0] != '!')
1779                                 rulenum = parse_rulenumber(argv[optind++]);
1780                         else
1781                                 exit_error(PARAMETER_PROBLEM,
1782                                            "-%c requires a rule number",
1783                                            cmd2char(CMD_REPLACE));
1784                         break;
1785
1786                 case 'I':
1787                         add_command(&command, CMD_INSERT, CMD_NONE,
1788                                     invert);
1789                         chain = optarg;
1790                         if (optind < argc && argv[optind][0] != '-'
1791                             && argv[optind][0] != '!')
1792                                 rulenum = parse_rulenumber(argv[optind++]);
1793                         else rulenum = 1;
1794                         break;
1795
1796                 case 'L':
1797                         add_command(&command, CMD_LIST, CMD_ZERO,
1798                                     invert);
1799                         if (optarg) chain = optarg;
1800                         else if (optind < argc && argv[optind][0] != '-'
1801                                  && argv[optind][0] != '!')
1802                                 chain = argv[optind++];
1803                         break;
1804
1805                 case 'F':
1806                         add_command(&command, CMD_FLUSH, CMD_NONE,
1807                                     invert);
1808                         if (optarg) chain = optarg;
1809                         else if (optind < argc && argv[optind][0] != '-'
1810                                  && argv[optind][0] != '!')
1811                                 chain = argv[optind++];
1812                         break;
1813
1814                 case 'Z':
1815                         add_command(&command, CMD_ZERO, CMD_LIST,
1816                                     invert);
1817                         if (optarg) chain = optarg;
1818                         else if (optind < argc && argv[optind][0] != '-'
1819                                 && argv[optind][0] != '!')
1820                                 chain = argv[optind++];
1821                         break;
1822
1823                 case 'N':
1824                         if (optarg && (*optarg == '-' || *optarg == '!'))
1825                                 exit_error(PARAMETER_PROBLEM,
1826                                            "chain name not allowed to start "
1827                                            "with `%c'\n", *optarg);
1828                         if (find_target(optarg, TRY_LOAD))
1829                                 exit_error(PARAMETER_PROBLEM,
1830                                            "chain name may not clash "
1831                                            "with target name\n");
1832                         add_command(&command, CMD_NEW_CHAIN, CMD_NONE,
1833                                     invert);
1834                         chain = optarg;
1835                         break;
1836
1837                 case 'X':
1838                         add_command(&command, CMD_DELETE_CHAIN, CMD_NONE,
1839                                     invert);
1840                         if (optarg) chain = optarg;
1841                         else if (optind < argc && argv[optind][0] != '-'
1842                                  && argv[optind][0] != '!')
1843                                 chain = argv[optind++];
1844                         break;
1845
1846                 case 'E':
1847                         add_command(&command, CMD_RENAME_CHAIN, CMD_NONE,
1848                                     invert);
1849                         chain = optarg;
1850                         if (optind < argc && argv[optind][0] != '-'
1851                             && argv[optind][0] != '!')
1852                                 newname = argv[optind++];
1853                         else
1854                                 exit_error(PARAMETER_PROBLEM,
1855                                            "-%c requires old-chain-name and "
1856                                            "new-chain-name",
1857                                             cmd2char(CMD_RENAME_CHAIN));
1858                         break;
1859
1860                 case 'P':
1861                         add_command(&command, CMD_SET_POLICY, CMD_NONE,
1862                                     invert);
1863                         chain = optarg;
1864                         if (optind < argc && argv[optind][0] != '-'
1865                             && argv[optind][0] != '!')
1866                                 policy = argv[optind++];
1867                         else
1868                                 exit_error(PARAMETER_PROBLEM,
1869                                            "-%c requires a chain and a policy",
1870                                            cmd2char(CMD_SET_POLICY));
1871                         break;
1872
1873                 case 'h':
1874                         if (!optarg)
1875                                 optarg = argv[optind];
1876
1877                         /* ip6tables -p icmp -h */
1878                         if (!matches && protocol)
1879                                 find_match(protocol, TRY_LOAD, &matches);
1880
1881                         exit_printhelp(matches);
1882
1883                         /*
1884                          * Option selection
1885                          */
1886                 case 'p':
1887                         check_inverse(optarg, &invert, &optind, argc);
1888                         set_option(&options, OPT_PROTOCOL, &fw.ipv6.invflags,
1889                                    invert);
1890
1891                         /* Canonicalize into lower case */
1892                         for (protocol = argv[optind-1]; *protocol; protocol++)
1893                                 *protocol = tolower(*protocol);
1894
1895                         protocol = argv[optind-1];
1896                         if ( strcmp(protocol,"ipv6-icmp") == 0)
1897                                 protocol = icmp6p;
1898                         fw.ipv6.proto = parse_protocol(protocol);
1899                         fw.ipv6.flags |= IP6T_F_PROTO;
1900
1901                         if (fw.ipv6.proto == 0
1902                             && (fw.ipv6.invflags & IP6T_INV_PROTO))
1903                                 exit_error(PARAMETER_PROBLEM,
1904                                            "rule would never match protocol");
1905                         break;
1906
1907                 case 's':
1908                         check_inverse(optarg, &invert, &optind, argc);
1909                         set_option(&options, OPT_SOURCE, &fw.ipv6.invflags,
1910                                    invert);
1911                         shostnetworkmask = argv[optind-1];
1912                         break;
1913
1914                 case 'd':
1915                         check_inverse(optarg, &invert, &optind, argc);
1916                         set_option(&options, OPT_DESTINATION, &fw.ipv6.invflags,
1917                                    invert);
1918                         dhostnetworkmask = argv[optind-1];
1919                         break;
1920
1921                 case 'j':
1922                         set_option(&options, OPT_JUMP, &fw.ipv6.invflags,
1923                                    invert);
1924                         jumpto = parse_target(optarg);
1925                         /* TRY_LOAD (may be chain name) */
1926                         target = find_target(jumpto, TRY_LOAD);
1927
1928                         if (target) {
1929                                 size_t size;
1930
1931                                 size = IP6T_ALIGN(sizeof(struct ip6t_entry_target))
1932                                         + target->size;
1933
1934                                 target->t = fw_calloc(1, size);
1935                                 target->t->u.target_size = size;
1936                                 strcpy(target->t->u.user.name, jumpto);
1937                                 if (target->init != NULL)
1938                                         target->init(target->t, &fw.nfcache);
1939                                 opts = merge_options(opts, target->extra_opts, &target->option_offset);
1940                         }
1941                         break;
1942
1943
1944                 case 'i':
1945                         check_inverse(optarg, &invert, &optind, argc);
1946                         set_option(&options, OPT_VIANAMEIN, &fw.ipv6.invflags,
1947                                    invert);
1948                         parse_interface(argv[optind-1],
1949                                         fw.ipv6.iniface,
1950                                         fw.ipv6.iniface_mask);
1951                         break;
1952
1953                 case 'o':
1954                         check_inverse(optarg, &invert, &optind, argc);
1955                         set_option(&options, OPT_VIANAMEOUT, &fw.ipv6.invflags,
1956                                    invert);
1957                         parse_interface(argv[optind-1],
1958                                         fw.ipv6.outiface,
1959                                         fw.ipv6.outiface_mask);
1960                         break;
1961
1962                 case 'v':
1963                         if (!verbose)
1964                                 set_option(&options, OPT_VERBOSE,
1965                                            &fw.ipv6.invflags, invert);
1966                         verbose++;
1967                         break;
1968
1969                 case 'm': {
1970                         size_t size;
1971
1972                         if (invert)
1973                                 exit_error(PARAMETER_PROBLEM,
1974                                            "unexpected ! flag before --match");
1975
1976                         m = find_match(optarg, LOAD_MUST_SUCCEED, &matches);
1977                         size = IP6T_ALIGN(sizeof(struct ip6t_entry_match))
1978                                          + m->size;
1979                         m->m = fw_calloc(1, size);
1980                         m->m->u.match_size = size;
1981                         strcpy(m->m->u.user.name, m->name);
1982                         if (m->init != NULL)
1983                                 m->init(m->m, &fw.nfcache);
1984                         opts = merge_options(opts, m->extra_opts, &m->option_offset);
1985                 }
1986                 break;
1987
1988                 case 'n':
1989                         set_option(&options, OPT_NUMERIC, &fw.ipv6.invflags,
1990                                    invert);
1991                         break;
1992
1993                 case 't':
1994                         if (invert)
1995                                 exit_error(PARAMETER_PROBLEM,
1996                                            "unexpected ! flag before --table");
1997                         *table = argv[optind-1];
1998                         break;
1999
2000                 case 'x':
2001                         set_option(&options, OPT_EXPANDED, &fw.ipv6.invflags,
2002                                    invert);
2003                         break;
2004
2005                 case 'V':
2006                         if (invert)
2007                                 printf("Not %s ;-)\n", program_version);
2008                         else
2009                                 printf("%s v%s\n",
2010                                        program_name, program_version);
2011                         exit(0);
2012
2013                 case '0':
2014                         set_option(&options, OPT_LINENUMBERS, &fw.ipv6.invflags,
2015                                    invert);
2016                         break;
2017
2018                 case 'M':
2019                         modprobe = optarg;
2020                         break;
2021
2022                 case 'c':
2023
2024                         set_option(&options, OPT_COUNTERS, &fw.ipv6.invflags,
2025                                    invert);
2026                         pcnt = optarg;
2027                         if (optind < argc && argv[optind][0] != '-'
2028                             && argv[optind][0] != '!')
2029                                 bcnt = argv[optind++];
2030                         else
2031                                 exit_error(PARAMETER_PROBLEM,
2032                                         "-%c requires packet and byte counter",
2033                                         opt2char(OPT_COUNTERS));
2034
2035                         if (sscanf(pcnt, "%llu", (unsigned long long *)&fw.counters.pcnt) != 1)
2036                                 exit_error(PARAMETER_PROBLEM,
2037                                         "-%c packet counter not numeric",
2038                                         opt2char(OPT_COUNTERS));
2039
2040                         if (sscanf(bcnt, "%llu", (unsigned long long *)&fw.counters.bcnt) != 1)
2041                                 exit_error(PARAMETER_PROBLEM,
2042                                         "-%c byte counter not numeric",
2043                                         opt2char(OPT_COUNTERS));
2044
2045                         break;
2046
2047
2048                 case 1: /* non option */
2049                         if (optarg[0] == '!' && optarg[1] == '\0') {
2050                                 if (invert)
2051                                         exit_error(PARAMETER_PROBLEM,
2052                                                    "multiple consecutive ! not"
2053                                                    " allowed");
2054                                 invert = TRUE;
2055                                 optarg[0] = '\0';
2056                                 continue;
2057                         }
2058                         printf("Bad argument `%s'\n", optarg);
2059                         exit_tryhelp(2);
2060
2061                 default:
2062                         /* FIXME: This scheme doesn't allow two of the same
2063                            matches --RR */
2064                         if (!target
2065                             || !(target->parse(c - target->option_offset,
2066                                                argv, invert,
2067                                                &target->tflags,
2068                                                &fw, &target->t))) {
2069                                 for (matchp = matches; matchp; matchp = matchp->next) {
2070                                         if (matchp->match->parse(c - matchp->match->option_offset,
2071                                                      argv, invert,
2072                                                      &matchp->match->mflags,
2073                                                      &fw,
2074                                                      &fw.nfcache,
2075                                                      &matchp->match->m))
2076                                                 break;
2077                                 }
2078                                 m = matchp ? matchp->match : NULL;
2079
2080                                 /* If you listen carefully, you can
2081                                    actually hear this code suck. */
2082
2083                                 /* some explanations (after four different bugs
2084                                  * in 3 different releases): If we encountere a
2085                                  * parameter, that has not been parsed yet,
2086                                  * it's not an option of an explicitly loaded
2087                                  * match or a target.  However, we support
2088                                  * implicit loading of the protocol match
2089                                  * extension.  '-p tcp' means 'l4 proto 6' and
2090                                  * at the same time 'load tcp protocol match on
2091                                  * demand if we specify --dport'.
2092                                  *
2093                                  * To make this work, we need to make sure:
2094                                  * - the parameter has not been parsed by
2095                                  *   a match (m above)
2096                                  * - a protocol has been specified
2097                                  * - the protocol extension has not been
2098                                  *   loaded yet, or is loaded and unused
2099                                  *   [think of ip6tables-restore!]
2100                                  * - the protocol extension can be successively
2101                                  *   loaded
2102                                  */
2103                                 if (m == NULL
2104                                     && protocol
2105                                     && (!find_proto(protocol, DONT_LOAD,
2106                                                    options&OPT_NUMERIC, NULL)
2107                                         || (find_proto(protocol, DONT_LOAD,
2108                                                         options&OPT_NUMERIC, NULL)
2109                                             && (proto_used == 0))
2110                                        )
2111                                     && (m = find_proto(protocol, TRY_LOAD,
2112                                                        options&OPT_NUMERIC, &matches))) {
2113                                         /* Try loading protocol */
2114                                         size_t size;
2115
2116                                         proto_used = 1;
2117
2118                                         size = IP6T_ALIGN(sizeof(struct ip6t_entry_match))
2119                                                          + m->size;
2120
2121                                         m->m = fw_calloc(1, size);
2122                                         m->m->u.match_size = size;
2123                                         strcpy(m->m->u.user.name, m->name);
2124                                         if (m->init != NULL)
2125                                                 m->init(m->m, &fw.nfcache);
2126
2127                                         opts = merge_options(opts,
2128                                             m->extra_opts, &m->option_offset);
2129
2130                                         optind--;
2131                                         continue;
2132                                 }
2133
2134                                 if (!m)
2135                                         exit_error(PARAMETER_PROBLEM,
2136                                                    "Unknown arg `%s'",
2137                                                    argv[optind-1]);
2138                         }
2139                 }
2140                 invert = FALSE;
2141         }
2142
2143         for (matchp = matches; matchp; matchp = matchp->next)
2144                 matchp->match->final_check(matchp->match->mflags);
2145
2146         if (target)
2147                 target->final_check(target->tflags);
2148
2149         /* Fix me: must put inverse options checking here --MN */
2150
2151         if (optind < argc)
2152                 exit_error(PARAMETER_PROBLEM,
2153                            "unknown arguments found on commandline");
2154         if (!command)
2155                 exit_error(PARAMETER_PROBLEM, "no command specified");
2156         if (invert)
2157                 exit_error(PARAMETER_PROBLEM,
2158                            "nothing appropriate following !");
2159
2160         if (command & (CMD_REPLACE | CMD_INSERT | CMD_DELETE | CMD_APPEND)) {
2161                 if (!(options & OPT_DESTINATION))
2162                         dhostnetworkmask = "::0/0";
2163                 if (!(options & OPT_SOURCE))
2164                         shostnetworkmask = "::0/0";
2165         }
2166
2167         if (shostnetworkmask)
2168                 parse_hostnetworkmask(shostnetworkmask, &saddrs,
2169                                       &(fw.ipv6.smsk), &nsaddrs);
2170
2171         if (dhostnetworkmask)
2172                 parse_hostnetworkmask(dhostnetworkmask, &daddrs,
2173                                       &(fw.ipv6.dmsk), &ndaddrs);
2174
2175         if ((nsaddrs > 1 || ndaddrs > 1) &&
2176             (fw.ipv6.invflags & (IP6T_INV_SRCIP | IP6T_INV_DSTIP)))
2177                 exit_error(PARAMETER_PROBLEM, "! not allowed with multiple"
2178                            " source or destination IP addresses");
2179
2180         if (command == CMD_REPLACE && (nsaddrs != 1 || ndaddrs != 1))
2181                 exit_error(PARAMETER_PROBLEM, "Replacement rule does not "
2182                            "specify a unique address");
2183
2184         generic_opt_check(command, options);
2185
2186         if (chain && strlen(chain) > IP6T_FUNCTION_MAXNAMELEN)
2187                 exit_error(PARAMETER_PROBLEM,
2188                            "chain name `%s' too long (must be under %i chars)",
2189                            chain, IP6T_FUNCTION_MAXNAMELEN);
2190
2191         /* only allocate handle if we weren't called with a handle */
2192         if (!*handle)
2193                 *handle = ip6tc_init(*table);
2194
2195         /* try to insmod the module if iptc_init failed */
2196         if (!*handle && ip6tables_insmod("ip6_tables", modprobe) != -1)
2197                 *handle = ip6tc_init(*table);
2198
2199         if (!*handle)
2200                 exit_error(VERSION_PROBLEM,
2201                         "can't initialize ip6tables table `%s': %s",
2202                         *table, ip6tc_strerror(errno));
2203
2204         if (command == CMD_APPEND
2205             || command == CMD_DELETE
2206             || command == CMD_INSERT
2207             || command == CMD_REPLACE) {
2208                 if (strcmp(chain, "PREROUTING") == 0
2209                     || strcmp(chain, "INPUT") == 0) {
2210                         /* -o not valid with incoming packets. */
2211                         if (options & OPT_VIANAMEOUT)
2212                                 exit_error(PARAMETER_PROBLEM,
2213                                            "Can't use -%c with %s\n",
2214                                            opt2char(OPT_VIANAMEOUT),
2215                                            chain);
2216                 }
2217
2218                 if (strcmp(chain, "POSTROUTING") == 0
2219                     || strcmp(chain, "OUTPUT") == 0) {
2220                         /* -i not valid with outgoing packets */
2221                         if (options & OPT_VIANAMEIN)
2222                                 exit_error(PARAMETER_PROBLEM,
2223                                            "Can't use -%c with %s\n",
2224                                            opt2char(OPT_VIANAMEIN),
2225                                            chain);
2226                 }
2227
2228                 if (target && ip6tc_is_chain(jumpto, *handle)) {
2229                         printf("Warning: using chain %s, not extension\n",
2230                                jumpto);
2231
2232                         if (target->t)
2233                                 free(target->t);
2234
2235                         target = NULL;
2236                 }
2237
2238                 /* If they didn't specify a target, or it's a chain
2239                    name, use standard. */
2240                 if (!target
2241                     && (strlen(jumpto) == 0
2242                         || ip6tc_is_chain(jumpto, *handle))) {
2243                         size_t size;
2244
2245                         target = find_target(IP6T_STANDARD_TARGET,
2246                                              LOAD_MUST_SUCCEED);
2247
2248                         size = sizeof(struct ip6t_entry_target)
2249                                 + target->size;
2250                         target->t = fw_calloc(1, size);
2251                         target->t->u.target_size = size;
2252                         strcpy(target->t->u.user.name, jumpto);
2253                         if (target->init != NULL)
2254                                 target->init(target->t, &fw.nfcache);
2255                 }
2256
2257                 if (!target) {
2258                         /* it is no chain, and we can't load a plugin.
2259                          * We cannot know if the plugin is corrupt, non
2260                          * existant OR if the user just misspelled a
2261                          * chain. */
2262                         find_target(jumpto, LOAD_MUST_SUCCEED);
2263                 } else {
2264                         e = generate_entry(&fw, matches, target->t);
2265                         free(target->t);
2266                 }
2267         }
2268
2269         switch (command) {
2270         case CMD_APPEND:
2271                 ret = append_entry(chain, e,
2272                                    nsaddrs, saddrs, ndaddrs, daddrs,
2273                                    options&OPT_VERBOSE,
2274                                    handle);
2275                 break;
2276         case CMD_DELETE:
2277                 ret = delete_entry(chain, e,
2278                                    nsaddrs, saddrs, ndaddrs, daddrs,
2279                                    options&OPT_VERBOSE,
2280                                    handle, matches);
2281                 break;
2282         case CMD_DELETE_NUM:
2283                 ret = ip6tc_delete_num_entry(chain, rulenum - 1, handle);
2284                 break;
2285         case CMD_REPLACE:
2286                 ret = replace_entry(chain, e, rulenum - 1,
2287                                     saddrs, daddrs, options&OPT_VERBOSE,
2288                                     handle);
2289                 break;
2290         case CMD_INSERT:
2291                 ret = insert_entry(chain, e, rulenum - 1,
2292                                    nsaddrs, saddrs, ndaddrs, daddrs,
2293                                    options&OPT_VERBOSE,
2294                                    handle);
2295                 break;
2296         case CMD_LIST:
2297                 ret = list_entries(chain,
2298                                    options&OPT_VERBOSE,
2299                                    options&OPT_NUMERIC,
2300                                    options&OPT_EXPANDED,
2301                                    options&OPT_LINENUMBERS,
2302                                    handle);
2303                 break;
2304         case CMD_FLUSH:
2305                 ret = flush_entries(chain, options&OPT_VERBOSE, handle);
2306                 break;
2307         case CMD_ZERO:
2308                 ret = zero_entries(chain, options&OPT_VERBOSE, handle);
2309                 break;
2310         case CMD_LIST|CMD_ZERO:
2311                 ret = list_entries(chain,
2312                                    options&OPT_VERBOSE,
2313                                    options&OPT_NUMERIC,
2314                                    options&OPT_EXPANDED,
2315                                    options&OPT_LINENUMBERS,
2316                                    handle);
2317                 if (ret)
2318                         ret = zero_entries(chain,
2319                                            options&OPT_VERBOSE, handle);
2320                 break;
2321         case CMD_NEW_CHAIN:
2322                 ret = ip6tc_create_chain(chain, handle);
2323                 break;
2324         case CMD_DELETE_CHAIN:
2325                 ret = delete_chain(chain, options&OPT_VERBOSE, handle);
2326                 break;
2327         case CMD_RENAME_CHAIN:
2328                 ret = ip6tc_rename_chain(chain, newname,        handle);
2329                 break;
2330         case CMD_SET_POLICY:
2331                 ret = ip6tc_set_policy(chain, policy, NULL, handle);
2332                 break;
2333         default:
2334                 /* We should never reach this... */
2335                 exit_tryhelp(2);
2336         }
2337
2338         if (verbose > 1)
2339                 dump_entries6(*handle);
2340
2341         clear_rule_matches(&matches);
2342
2343         if (e != NULL) {
2344                 free(e);
2345                 e = NULL;
2346         }
2347
2348         for (c = 0; c < nsaddrs; c++)
2349                 free(&saddrs[c]);
2350
2351         for (c = 0; c < ndaddrs; c++)
2352                 free(&daddrs[c]);
2353
2354         free_opts(1);
2355
2356         return ret;
2357 }