libiptc2/libip4tc.c

   1 /* Library which manipulates firewall rules.  Version 0.1. */
   2
   3 /* Architecture of firewall rules is as follows:
   4  *
   5  * Chains go INPUT, FORWARD, OUTPUT then user chains.
   6  * Each user chain starts with an ERROR node.
   7  * Every chain ends with an unconditional jump: a RETURN for user chains,
   8  * and a POLICY for built-ins.
   9  */
  10
  11 /* (C)1999 Paul ``Rusty'' Russell - Placed under the GNU GPL (See
  12    COPYING for details). */
  13
  14 #include <assert.h>
  15 #include <string.h>
  16 #include <errno.h>
  17 #include <stdlib.h>
  18 #include <stdio.h>
  19 #include <unistd.h>
  20
  21 #ifdef DEBUG_CONNTRACK
  22 #define inline
  23 #endif
  24
  25 #if !defined(__GLIBC__) || (__GLIBC__ < 2)
  26 typedef unsigned int socklen_t;
  27 #endif
  28
  29 #include "libiptc/libiptc.h"
  30
  31 #define IP_VERSION      4
  32 #define IP_OFFSET       0x1FFF
  33
  34 #define HOOK_PRE_ROUTING        NF_IP_PRE_ROUTING
  35 #define HOOK_LOCAL_IN           NF_IP_LOCAL_IN
  36 #define HOOK_FORWARD            NF_IP_FORWARD
  37 #define HOOK_LOCAL_OUT          NF_IP_LOCAL_OUT
  38 #define HOOK_POST_ROUTING       NF_IP_POST_ROUTING
  39 #ifdef NF_IP_DROPPING
  40 #define HOOK_DROPPING           NF_IP_DROPPING
  41 #endif
  42
  43 #define STRUCT_ENTRY_TARGET     struct ipt_entry_target
  44 #define STRUCT_ENTRY            struct ipt_entry
  45 #define STRUCT_ENTRY_MATCH      struct ipt_entry_match
  46 #define STRUCT_GETINFO          struct ipt_getinfo
  47 #define STRUCT_GET_ENTRIES      struct ipt_get_entries
  48 #define STRUCT_COUNTERS         struct ipt_counters
  49 #define STRUCT_COUNTERS_INFO    struct ipt_counters_info
  50 #define STRUCT_STANDARD_TARGET  struct ipt_standard_target
  51 #define STRUCT_REPLACE          struct ipt_replace
  52
  53 #define STRUCT_TC_HANDLE        struct iptc_handle
  54 #define TC_HANDLE_T             iptc_handle_t
  55
  56 #define ENTRY_ITERATE           IPT_ENTRY_ITERATE
  57 #define TABLE_MAXNAMELEN        IPT_TABLE_MAXNAMELEN
  58 #define FUNCTION_MAXNAMELEN     IPT_FUNCTION_MAXNAMELEN
  59
  60 #define GET_TARGET              ipt_get_target
  61
  62 #define ERROR_TARGET            IPT_ERROR_TARGET
  63 #define NUMHOOKS                NF_IP_NUMHOOKS
  64
  65 #define IPT_CHAINLABEL          ipt_chainlabel
  66
  67 #define TC_DUMP_ENTRIES         dump_entries
  68 #define TC_IS_CHAIN             iptc_is_chain
  69 #define TC_FIRST_CHAIN          iptc_first_chain
  70 #define TC_NEXT_CHAIN           iptc_next_chain
  71 #define TC_FIRST_RULE           iptc_first_rule
  72 #define TC_NEXT_RULE            iptc_next_rule
  73 #define TC_GET_TARGET           iptc_get_target
  74 #define TC_BUILTIN              iptc_builtin
  75 #define TC_GET_POLICY           iptc_get_policy
  76 #define TC_INSERT_ENTRY         iptc_insert_entry
  77 #define TC_REPLACE_ENTRY        iptc_replace_entry
  78 #define TC_APPEND_ENTRY         iptc_append_entry
  79 #define TC_DELETE_ENTRY         iptc_delete_entry
  80 #define TC_DELETE_NUM_ENTRY     iptc_delete_num_entry
  81 #define TC_CHECK_PACKET         iptc_check_packet
  82 #define TC_FLUSH_ENTRIES        iptc_flush_entries
  83 #define TC_ZERO_ENTRIES         iptc_zero_entries
  84 #define TC_READ_COUNTER         iptc_read_counter
  85 #define TC_ZERO_COUNTER         iptc_zero_counter
  86 #define TC_SET_COUNTER          iptc_set_counter
  87 #define TC_CREATE_CHAIN         iptc_create_chain
  88 #define TC_GET_REFERENCES       iptc_get_references
  89 #define TC_DELETE_CHAIN         iptc_delete_chain
  90 #define TC_RENAME_CHAIN         iptc_rename_chain
  91 #define TC_SET_POLICY           iptc_set_policy
  92 #define TC_GET_RAW_SOCKET       iptc_get_raw_socket
  93 #define TC_INIT                 iptc_init
  94 #define TC_FREE                 iptc_free
  95 #define TC_COMMIT               iptc_commit
  96 #define TC_STRERROR             iptc_strerror
  97
  98 #define TC_AF                   AF_INET
  99 #define TC_IPPROTO              IPPROTO_IP
 100
 101 #define SO_SET_REPLACE          IPT_SO_SET_REPLACE
 102 #define SO_SET_ADD_COUNTERS     IPT_SO_SET_ADD_COUNTERS
 103 #define SO_GET_INFO             IPT_SO_GET_INFO
 104 #define SO_GET_ENTRIES          IPT_SO_GET_ENTRIES
 105 #define SO_GET_VERSION          IPT_SO_GET_VERSION
 106
 107 #define STANDARD_TARGET         IPT_STANDARD_TARGET
 108 #define LABEL_RETURN            IPTC_LABEL_RETURN
 109 #define LABEL_ACCEPT            IPTC_LABEL_ACCEPT
 110 #define LABEL_DROP              IPTC_LABEL_DROP
 111 #define LABEL_QUEUE             IPTC_LABEL_QUEUE
 112
 113 #define ALIGN                   IPT_ALIGN
 114 #define RETURN                  IPT_RETURN
 115
 116 #include "libiptc.c"
 117
 118 #define IP_PARTS_NATIVE(n)                      \
 119 (unsigned int)((n)>>24)&0xFF,                   \
 120 (unsigned int)((n)>>16)&0xFF,                   \
 121 (unsigned int)((n)>>8)&0xFF,                    \
 122 (unsigned int)((n)&0xFF)
 123
 124 #define IP_PARTS(n) IP_PARTS_NATIVE(ntohl(n))
 125
 126 int
 127 dump_entry(STRUCT_ENTRY *e, const TC_HANDLE_T handle)
 128 {
 129         size_t i;
 130         STRUCT_ENTRY_TARGET *t;
 131
 132         printf("Entry %u (%lu):\n", entry2index(handle, e),
 133                entry2offset(handle, e));
 134         printf("SRC IP: %u.%u.%u.%u/%u.%u.%u.%u\n",
 135                IP_PARTS(e->ip.src.s_addr),IP_PARTS(e->ip.smsk.s_addr));
 136         printf("DST IP: %u.%u.%u.%u/%u.%u.%u.%u\n",
 137                IP_PARTS(e->ip.dst.s_addr),IP_PARTS(e->ip.dmsk.s_addr));
 138         printf("Interface: `%s'/", e->ip.iniface);
 139         for (i = 0; i < IFNAMSIZ; i++)
 140                 printf("%c", e->ip.iniface_mask[i] ? 'X' : '.');
 141         printf("to `%s'/", e->ip.outiface);
 142         for (i = 0; i < IFNAMSIZ; i++)
 143                 printf("%c", e->ip.outiface_mask[i] ? 'X' : '.');
 144         printf("\nProtocol: %u\n", e->ip.proto);
 145         printf("Flags: %02X\n", e->ip.flags);
 146         printf("Invflags: %02X\n", e->ip.invflags);
 147         printf("Counters: %llu packets, %llu bytes\n",
 148                e->counters.pcnt, e->counters.bcnt);
 149         printf("Cache: %08X ", e->nfcache);
 150         if (e->nfcache & NFC_ALTERED) printf("ALTERED ");
 151         if (e->nfcache & NFC_UNKNOWN) printf("UNKNOWN ");
 152         if (e->nfcache & NFC_IP_SRC) printf("IP_SRC ");
 153         if (e->nfcache & NFC_IP_DST) printf("IP_DST ");
 154         if (e->nfcache & NFC_IP_IF_IN) printf("IP_IF_IN ");
 155         if (e->nfcache & NFC_IP_IF_OUT) printf("IP_IF_OUT ");
 156         if (e->nfcache & NFC_IP_TOS) printf("IP_TOS ");
 157         if (e->nfcache & NFC_IP_PROTO) printf("IP_PROTO ");
 158         if (e->nfcache & NFC_IP_OPTIONS) printf("IP_OPTIONS ");
 159         if (e->nfcache & NFC_IP_TCPFLAGS) printf("IP_TCPFLAGS ");
 160         if (e->nfcache & NFC_IP_SRC_PT) printf("IP_SRC_PT ");
 161         if (e->nfcache & NFC_IP_DST_PT) printf("IP_DST_PT ");
 162         if (e->nfcache & NFC_IP_PROTO_UNKNOWN) printf("IP_PROTO_UNKNOWN ");
 163         printf("\n");
 164
 165         IPT_MATCH_ITERATE(e, print_match);
 166
 167         t = GET_TARGET(e);
 168         printf("Target name: `%s' [%u]\n", t->u.user.name, t->u.target_size);
 169         if (strcmp(t->u.user.name, STANDARD_TARGET) == 0) {
 170                 int pos = *(int *)t->data;
 171                 if (pos < 0)
 172                         printf("verdict=%s\n",
 173                                pos == -NF_ACCEPT-1 ? "NF_ACCEPT"
 174                                : pos == -NF_DROP-1 ? "NF_DROP"
 175                                : pos == -NF_QUEUE-1 ? "NF_QUEUE"
 176                                : pos == RETURN ? "RETURN"
 177                                : "UNKNOWN");
 178                 else
 179                         printf("verdict=%u\n", pos);
 180         } else if (strcmp(t->u.user.name, IPT_ERROR_TARGET) == 0)
 181                 printf("error=`%s'\n", t->data);
 182
 183         printf("\n");
 184         return 0;
 185 }
 186
 187 static int
 188 is_same(const STRUCT_ENTRY *a, const STRUCT_ENTRY *b, unsigned char *matchmask)
 189 {
 190         unsigned int i;
 191         STRUCT_ENTRY_TARGET *ta, *tb;
 192         unsigned char *mptr;
 193
 194         /* Always compare head structures: ignore mask here. */
 195         if (a->ip.src.s_addr != b->ip.src.s_addr
 196             || a->ip.dst.s_addr != b->ip.dst.s_addr
 197             || a->ip.smsk.s_addr != b->ip.smsk.s_addr
 198             || a->ip.dmsk.s_addr != b->ip.dmsk.s_addr
 199             || a->ip.proto != b->ip.proto
 200             || a->ip.flags != b->ip.flags
 201             || a->ip.invflags != b->ip.invflags)
 202                 return 0;
 203
 204         for (i = 0; i < IFNAMSIZ; i++) {
 205                 if (a->ip.iniface_mask[i] != b->ip.iniface_mask[i])
 206                         return 0;
 207                 if ((a->ip.iniface[i] & a->ip.iniface_mask[i])
 208                     != (b->ip.iniface[i] & b->ip.iniface_mask[i]))
 209                         return 0;
 210                 if (a->ip.outiface_mask[i] != b->ip.outiface_mask[i])
 211                         return 0;
 212                 if ((a->ip.outiface[i] & a->ip.outiface_mask[i])
 213                     != (b->ip.outiface[i] & b->ip.outiface_mask[i]))
 214                         return 0;
 215         }
 216
 217         if (a->nfcache != b->nfcache
 218             || a->target_offset != b->target_offset
 219             || a->next_offset != b->next_offset)
 220                 return 0;
 221
 222         mptr = matchmask + sizeof(STRUCT_ENTRY);
 223         if (IPT_MATCH_ITERATE(a, match_different, a->elems, b->elems, &mptr))
 224                 return 0;
 225
 226         ta = GET_TARGET((STRUCT_ENTRY *)a);
 227         tb = GET_TARGET((STRUCT_ENTRY *)b);
 228         if (ta->u.target_size != tb->u.target_size)
 229                 return 0;
 230         if (strcmp(ta->u.user.name, tb->u.user.name) != 0)
 231                 return 0;
 232
 233         mptr += sizeof(*ta);
 234         if (target_different(ta->data, tb->data,
 235                              ta->u.target_size - sizeof(*ta), mptr))
 236                 return 0;
 237
 238         return 1;
 239 }
 240
 241 /***************************** DEBUGGING ********************************/
 242 static inline int
 243 unconditional(const struct ipt_ip *ip)
 244 {
 245         unsigned int i;
 246
 247         for (i = 0; i < sizeof(*ip)/sizeof(u_int32_t); i++)
 248                 if (((u_int32_t *)ip)[i])
 249                         return 0;
 250
 251         return 1;
 252 }
 253
 254 static inline int
 255 check_match(const STRUCT_ENTRY_MATCH *m, unsigned int *off)
 256 {
 257         assert(m->u.match_size >= sizeof(STRUCT_ENTRY_MATCH));
 258         assert(ALIGN(m->u.match_size) == m->u.match_size);
 259
 260         (*off) += m->u.match_size;
 261         return 0;
 262 }
 263
 264 static inline int
 265 check_entry(const STRUCT_ENTRY *e, unsigned int *i, unsigned int *off,
 266             unsigned int user_offset, int *was_return,
 267             TC_HANDLE_T h)
 268 {
 269         unsigned int toff;
 270         STRUCT_STANDARD_TARGET *t;
 271
 272         assert(e->target_offset >= sizeof(STRUCT_ENTRY));
 273         assert(e->next_offset >= e->target_offset
 274                + sizeof(STRUCT_ENTRY_TARGET));
 275         toff = sizeof(STRUCT_ENTRY);
 276         IPT_MATCH_ITERATE(e, check_match, &toff);
 277
 278         assert(toff == e->target_offset);
 279
 280         t = (STRUCT_STANDARD_TARGET *)
 281                 GET_TARGET((STRUCT_ENTRY *)e);
 282         /* next_offset will have to be multiple of entry alignment. */
 283         assert(e->next_offset == ALIGN(e->next_offset));
 284         assert(e->target_offset == ALIGN(e->target_offset));
 285         assert(t->target.u.target_size == ALIGN(t->target.u.target_size));
 286         assert(!TC_IS_CHAIN(t->target.u.user.name, h));
 287
 288         if (strcmp(t->target.u.user.name, STANDARD_TARGET) == 0) {
 289                 assert(t->target.u.target_size
 290                        == ALIGN(sizeof(STRUCT_STANDARD_TARGET)));
 291
 292                 assert(t->verdict == -NF_DROP-1
 293                        || t->verdict == -NF_ACCEPT-1
 294                        || t->verdict == RETURN
 295                        || t->verdict < (int)h->entries.size);
 296
 297                 if (t->verdict >= 0) {
 298                         STRUCT_ENTRY *te = get_entry(h, t->verdict);
 299                         int idx;
 300
 301                         idx = entry2index(h, te);
 302                         assert(strcmp(GET_TARGET(te)->u.user.name,
 303                                       IPT_ERROR_TARGET)
 304                                != 0);
 305                         assert(te != e);
 306
 307                         /* Prior node must be error node, or this node. */
 308                         assert(t->verdict == entry2offset(h, e)+e->next_offset
 309                                || strcmp(GET_TARGET(index2entry(h, idx-1))
 310                                          ->u.user.name, IPT_ERROR_TARGET)
 311                                == 0);
 312                 }
 313
 314                 if (t->verdict == RETURN
 315                     && unconditional(&e->ip)
 316                     && e->target_offset == sizeof(*e))
 317                         *was_return = 1;
 318                 else
 319                         *was_return = 0;
 320         } else if (strcmp(t->target.u.user.name, IPT_ERROR_TARGET) == 0) {
 321                 assert(t->target.u.target_size
 322                        == ALIGN(sizeof(struct ipt_error_target)));
 323
 324                 /* If this is in user area, previous must have been return */
 325                 if (*off > user_offset)
 326                         assert(*was_return);
 327
 328                 *was_return = 0;
 329         }
 330         else *was_return = 0;
 331
 332         if (*off == user_offset)
 333                 assert(strcmp(t->target.u.user.name, IPT_ERROR_TARGET) == 0);
 334
 335         (*off) += e->next_offset;
 336         (*i)++;
 337         return 0;
 338 }
 339
 340 #ifdef IPTC_DEBUG
 341 /* Do every conceivable sanity check on the handle */
 342 static void
 343 do_check(TC_HANDLE_T h, unsigned int line)
 344 {
 345         unsigned int i, n;
 346         unsigned int user_offset; /* Offset of first user chain */
 347         int was_return;
 348
 349         assert(h->changed == 0 || h->changed == 1);
 350         if (strcmp(h->info.name, "filter") == 0) {
 351                 assert(h->info.valid_hooks
 352                        == (1 << NF_IP_LOCAL_IN
 353                            | 1 << NF_IP_FORWARD
 354                            | 1 << NF_IP_LOCAL_OUT));
 355
 356                 /* Hooks should be first three */
 357                 assert(h->info.hook_entry[NF_IP_LOCAL_IN] == 0);
 358
 359                 n = get_chain_end(h, 0);
 360                 n += get_entry(h, n)->next_offset;
 361                 assert(h->info.hook_entry[NF_IP_FORWARD] == n);
 362
 363                 n = get_chain_end(h, n);
 364                 n += get_entry(h, n)->next_offset;
 365                 assert(h->info.hook_entry[NF_IP_LOCAL_OUT] == n);
 366
 367                 user_offset = h->info.hook_entry[NF_IP_LOCAL_OUT];
 368         } else if (strcmp(h->info.name, "nat") == 0) {
 369                 assert((h->info.valid_hooks
 370                         == (1 << NF_IP_PRE_ROUTING
 371                             | 1 << NF_IP_POST_ROUTING
 372                             | 1 << NF_IP_LOCAL_OUT)) ||
 373                        (h->info.valid_hooks
 374                         == (1 << NF_IP_PRE_ROUTING
 375                             | 1 << NF_IP_LOCAL_IN
 376                             | 1 << NF_IP_POST_ROUTING
 377                             | 1 << NF_IP_LOCAL_OUT)));
 378
 379                 assert(h->info.hook_entry[NF_IP_PRE_ROUTING] == 0);
 380
 381                 n = get_chain_end(h, 0);
 382
 383                 n += get_entry(h, n)->next_offset;
 384                 assert(h->info.hook_entry[NF_IP_POST_ROUTING] == n);
 385                 n = get_chain_end(h, n);
 386
 387                 n += get_entry(h, n)->next_offset;
 388                 assert(h->info.hook_entry[NF_IP_LOCAL_OUT] == n);
 389                 user_offset = h->info.hook_entry[NF_IP_LOCAL_OUT];
 390
 391                 if (h->info.valid_hooks & (1 << NF_IP_LOCAL_IN)) {
 392                         n = get_chain_end(h, n);
 393                         n += get_entry(h, n)->next_offset;
 394                         assert(h->info.hook_entry[NF_IP_LOCAL_IN] == n);
 395                         user_offset = h->info.hook_entry[NF_IP_LOCAL_IN];
 396                 }
 397
 398         } else if (strcmp(h->info.name, "mangle") == 0) {
 399                 /* This code is getting ugly because linux < 2.4.18-pre6 had
 400                  * two mangle hooks, linux >= 2.4.18-pre6 has five mangle hooks
 401                  * */
 402                 assert((h->info.valid_hooks
 403                         == (1 << NF_IP_PRE_ROUTING
 404                             | 1 << NF_IP_LOCAL_OUT)) ||
 405                        (h->info.valid_hooks
 406                         == (1 << NF_IP_PRE_ROUTING
 407                             | 1 << NF_IP_LOCAL_IN
 408                             | 1 << NF_IP_FORWARD
 409                             | 1 << NF_IP_LOCAL_OUT
 410                             | 1 << NF_IP_POST_ROUTING)));
 411
 412                 /* Hooks should be first five */
 413                 assert(h->info.hook_entry[NF_IP_PRE_ROUTING] == 0);
 414
 415                 n = get_chain_end(h, 0);
 416
 417                 if (h->info.valid_hooks & (1 << NF_IP_LOCAL_IN)) {
 418                         n += get_entry(h, n)->next_offset;
 419                         assert(h->info.hook_entry[NF_IP_LOCAL_IN] == n);
 420                         n = get_chain_end(h, n);
 421                 }
 422
 423                 if (h->info.valid_hooks & (1 << NF_IP_FORWARD)) {
 424                         n += get_entry(h, n)->next_offset;
 425                         assert(h->info.hook_entry[NF_IP_FORWARD] == n);
 426                         n = get_chain_end(h, n);
 427                 }
 428
 429                 n += get_entry(h, n)->next_offset;
 430                 assert(h->info.hook_entry[NF_IP_LOCAL_OUT] == n);
 431                 user_offset = h->info.hook_entry[NF_IP_LOCAL_OUT];
 432
 433                 if (h->info.valid_hooks & (1 << NF_IP_POST_ROUTING)) {
 434                         n = get_chain_end(h, n);
 435                         n += get_entry(h, n)->next_offset;
 436                         assert(h->info.hook_entry[NF_IP_POST_ROUTING] == n);
 437                         user_offset = h->info.hook_entry[NF_IP_POST_ROUTING];
 438                 }
 439
 440 #ifdef NF_IP_DROPPING
 441         } else if (strcmp(h->info.name, "drop") == 0) {
 442                 assert(h->info.valid_hooks == (1 << NF_IP_DROPPING));
 443
 444                 /* Hook should be first */
 445                 assert(h->info.hook_entry[NF_IP_DROPPING] == 0);
 446                 user_offset = 0;
 447 #endif
 448         } else {
 449                 fprintf(stderr, "Unknown table `%s'\n", h->info.name);
 450                 abort();
 451         }
 452
 453         /* User chain == end of last builtin + policy entry */
 454         user_offset = get_chain_end(h, user_offset);
 455         user_offset += get_entry(h, user_offset)->next_offset;
 456
 457         /* Overflows should be end of entry chains, and unconditional
 458            policy nodes. */
 459         for (i = 0; i < NUMHOOKS; i++) {
 460                 STRUCT_ENTRY *e;
 461                 STRUCT_STANDARD_TARGET *t;
 462
 463                 if (!(h->info.valid_hooks & (1 << i)))
 464                         continue;
 465                 assert(h->info.underflow[i]
 466                        == get_chain_end(h, h->info.hook_entry[i]));
 467
 468                 e = get_entry(h, get_chain_end(h, h->info.hook_entry[i]));
 469                 assert(unconditional(&e->ip));
 470                 assert(e->target_offset == sizeof(*e));
 471                 t = (STRUCT_STANDARD_TARGET *)GET_TARGET(e);
 472                 assert(t->target.u.target_size == ALIGN(sizeof(*t)));
 473                 assert(e->next_offset == sizeof(*e) + ALIGN(sizeof(*t)));
 474
 475                 assert(strcmp(t->target.u.user.name, STANDARD_TARGET)==0);
 476                 assert(t->verdict == -NF_DROP-1 || t->verdict == -NF_ACCEPT-1);
 477
 478                 /* Hooks and underflows must be valid entries */
 479                 entry2index(h, get_entry(h, h->info.hook_entry[i]));
 480                 entry2index(h, get_entry(h, h->info.underflow[i]));
 481         }
 482
 483         assert(h->info.size
 484                >= h->info.num_entries * (sizeof(STRUCT_ENTRY)
 485                                          +sizeof(STRUCT_STANDARD_TARGET)));
 486
 487         assert(h->entries.size
 488                >= (h->new_number
 489                    * (sizeof(STRUCT_ENTRY)
 490                       + sizeof(STRUCT_STANDARD_TARGET))));
 491         assert(strcmp(h->info.name, h->entries.name) == 0);
 492
 493         i = 0; n = 0;
 494         was_return = 0;
 495         /* Check all the entries. */
 496         ENTRY_ITERATE(h->entries.entrytable, h->entries.size,
 497                       check_entry, &i, &n, user_offset, &was_return, h);
 498
 499         assert(i == h->new_number);
 500         assert(n == h->entries.size);
 501
 502         /* Final entry must be error node */
 503         assert(strcmp(GET_TARGET(index2entry(h, h->new_number-1))
 504                       ->u.user.name,
 505                       ERROR_TARGET) == 0);
 506 }
 507 #endif /*IPTC_DEBUG*/