1 /* Code to save the iptables state, in human readable-form. */
2 /* (C) 1999 by Paul 'Rusty' Russell <rusty@rustcorp.com.au> and
3 * (C) 2000-2002 by Harald Welte <laforge@gnumonks.org>
5 * This code is distributed under the terms of GNU GPL v2
17 #include "libiptc/libiptc.h"
20 static int binary = 0, counters = 0;
22 static struct option options[] = {
23 { "binary", 0, 0, 'b' },
24 { "counters", 0, 0, 'c' },
25 { "dump", 0, 0, 'd' },
26 { "table", 1, 0, 't' },
30 #define IP_PARTS_NATIVE(n) \
31 (unsigned int)((n)>>24)&0xFF, \
32 (unsigned int)((n)>>16)&0xFF, \
33 (unsigned int)((n)>>8)&0xFF, \
34 (unsigned int)((n)&0xFF)
36 #define IP_PARTS(n) IP_PARTS_NATIVE(ntohl(n))
38 /* This assumes that mask is contiguous, and byte-bounded. */
40 print_iface(char letter, const char *iface, const unsigned char *mask,
48 printf("-%c %s", letter, invert ? "! " : "");
50 for (i = 0; i < IFNAMSIZ; i++) {
53 printf("%c", iface[i]);
55 /* we can access iface[i-1] here, because
56 * a few lines above we make sure that mask[0] != 0 */
57 if (iface[i-1] != '\0')
66 /* These are hardcoded backups in iptables.c, so they are safe */
72 /* FIXME: why don't we use /etc/protocols ? */
73 static const struct pprot chain_protos[] = {
74 { "tcp", IPPROTO_TCP },
75 { "udp", IPPROTO_UDP },
76 { "icmp", IPPROTO_ICMP },
77 { "esp", IPPROTO_ESP },
79 { "sctp", IPPROTO_SCTP },
82 static void print_proto(u_int16_t proto, int invert)
86 const char *invertstr = invert ? "! " : "";
88 struct protoent *pent = getprotobynumber(proto);
90 printf("-p %s%s ", invertstr, pent->p_name);
94 for (i = 0; i < sizeof(chain_protos)/sizeof(struct pprot); i++)
95 if (chain_protos[i].num == proto) {
97 invertstr, chain_protos[i].name);
101 printf("-p %s%u ", invertstr, proto);
106 static int non_zero(const void *ptr, size_t size)
110 for (i = 0; i < size; i++)
111 if (((char *)ptr)[i])
118 static int print_match(const struct ipt_entry_match *e,
119 const struct ipt_ip *ip)
121 struct iptables_match *match
122 = find_match(e->u.user.name, TRY_LOAD, NULL);
125 printf("-m %s ", e->u.user.name);
127 /* some matches don't provide a save function */
131 if (e->u.match_size) {
133 "Can't find library for match `%s'\n",
141 /* print a given ip including mask if neccessary */
142 static void print_ip(char *prefix, u_int32_t ip, u_int32_t mask, int invert)
147 printf("%s %s%u.%u.%u.%u",
152 if (mask != 0xffffffff)
153 printf("/%u.%u.%u.%u ", IP_PARTS(mask));
158 /* We want this to be readable, so only print out neccessary fields.
159 * Because that's the kind of world I want to live in. */
160 static void print_rule(const struct ipt_entry *e,
161 iptc_handle_t *h, const char *chain, int counters)
163 struct ipt_entry_target *t;
164 const char *target_name;
168 printf("[%llu:%llu] ", (unsigned long long)e->counters.pcnt, (unsigned long long)e->counters.bcnt);
170 /* print chain name */
171 printf("-A %s ", chain);
174 print_ip("-s", e->ip.src.s_addr,e->ip.smsk.s_addr,
175 e->ip.invflags & IPT_INV_SRCIP);
177 print_ip("-d", e->ip.dst.s_addr, e->ip.dmsk.s_addr,
178 e->ip.invflags & IPT_INV_DSTIP);
180 print_iface('i', e->ip.iniface, e->ip.iniface_mask,
181 e->ip.invflags & IPT_INV_VIA_IN);
183 print_iface('o', e->ip.outiface, e->ip.outiface_mask,
184 e->ip.invflags & IPT_INV_VIA_OUT);
186 print_proto(e->ip.proto, e->ip.invflags & IPT_INV_PROTO);
188 if (e->ip.flags & IPT_F_FRAG)
190 e->ip.invflags & IPT_INV_FRAG ? "! " : "");
192 /* Print matchinfo part */
193 if (e->target_offset) {
194 IPT_MATCH_ITERATE(e, print_match, &e->ip);
197 /* Print target name */
198 target_name = iptc_get_target(e, h);
199 if (target_name && (*target_name != '\0'))
200 printf("-j %s ", target_name);
202 /* Print targinfo part */
203 t = ipt_get_target((struct ipt_entry *)e);
204 if (t->u.user.name[0]) {
205 struct iptables_target *target
206 = find_target(t->u.user.name, TRY_LOAD);
209 fprintf(stderr, "Can't find library for target `%s'\n",
215 target->save(&e->ip, t);
217 /* If the target size is greater than ipt_entry_target
218 * there is something to be saved, we just don't know
220 if (t->u.target_size !=
221 sizeof(struct ipt_entry_target)) {
222 fprintf(stderr, "Target `%s' is missing "
232 /* Debugging prototype. */
233 static int for_each_table(int (*func)(const char *tablename))
236 FILE *procfile = NULL;
237 char tablename[IPT_TABLE_MAXNAMELEN+1];
239 procfile = fopen("/proc/net/ip_tables_names", "r");
243 while (fgets(tablename, sizeof(tablename), procfile)) {
244 if (tablename[strlen(tablename) - 1] != '\n')
245 exit_error(OTHER_PROBLEM,
246 "Badly formed tablename `%s'\n",
248 tablename[strlen(tablename) - 1] = '\0';
249 ret &= func(tablename);
256 static int do_output(const char *tablename)
259 const char *chain = NULL;
262 return for_each_table(&do_output);
264 h = iptc_init(tablename);
266 exit_error(OTHER_PROBLEM, "Can't initialize: %s\n",
267 iptc_strerror(errno));
270 time_t now = time(NULL);
272 printf("# Generated by iptables-save v%s on %s",
273 IPTABLES_VERSION, ctime(&now));
274 printf("*%s\n", tablename);
276 /* Dump out chain names first,
277 * thereby preventing dependency conflicts */
278 for (chain = iptc_first_chain(&h);
280 chain = iptc_next_chain(&h)) {
282 printf(":%s ", chain);
283 if (iptc_builtin(chain, h)) {
284 struct ipt_counters count;
286 iptc_get_policy(chain, &count, &h));
287 printf("[%llu:%llu]\n", (unsigned long long)count.pcnt, (unsigned long long)count.bcnt);
294 for (chain = iptc_first_chain(&h);
296 chain = iptc_next_chain(&h)) {
297 const struct ipt_entry *e;
300 e = iptc_first_rule(chain, &h);
302 print_rule(e, &h, chain, counters);
303 e = iptc_next_rule(e, &h);
309 printf("# Completed on %s", ctime(&now));
311 /* Binary, huh? OK. */
312 exit_error(OTHER_PROBLEM, "Binary NYI\n");
321 * :Chain name POLICY packets bytes
324 #ifdef IPTABLES_MULTI
326 iptables_save_main(int argc, char *argv[])
329 main(int argc, char *argv[])
332 const char *tablename = NULL;
335 program_name = "iptables-save";
336 program_version = IPTABLES_VERSION;
338 lib_dir = getenv("IPTABLES_LIB_DIR");
340 lib_dir = IPT_LIB_DIR;
342 #ifdef NO_SHARED_LIBS
346 while ((c = getopt_long(argc, argv, "bcdt:", options, NULL)) != -1) {
357 /* Select specific table. */
361 do_output(tablename);
367 fprintf(stderr, "Unknown arguments found on commandline");
371 return !do_output(tablename);