1/*
2 * m_ipt.c	iptables based targets
3 * 		utilities mostly ripped from iptables <duh, its the linux way>
4 *
5 *		This program is free software; you can distribute it and/or
6 *		modify it under the terms of the GNU General Public License
7 *		as published by the Free Software Foundation; either version
8 *		2 of the License, or (at your option) any later version.
9 *
10 * Authors:  J Hadi Salim (hadi@cyberus.ca)
11 */
12
13#include <syslog.h>
14#include <sys/socket.h>
15#include <netinet/in.h>
16#include <arpa/inet.h>
17#include <linux/if.h>
18#include <iptables.h>
19#include <linux/netfilter.h>
20#include <linux/netfilter_ipv4/ip_tables.h>
21#include "utils.h"
22#include "tc_util.h"
23#include <linux/tc_act/tc_ipt.h>
24#include <stdio.h>
25#include <dlfcn.h>
26#include <getopt.h>
27#include <errno.h>
28#include <string.h>
29#include <netdb.h>
30#include <stdlib.h>
31#include <ctype.h>
32#include <stdarg.h>
33#include <unistd.h>
34#include <fcntl.h>
35#include <sys/wait.h>
36
37static const char *pname = "tc-ipt";
38static const char *tname = "mangle";
39static const char *pversion = "0.1";
40
41static const char *ipthooks[] = {
42	"NF_IP_PRE_ROUTING",
43	"NF_IP_LOCAL_IN",
44	"NF_IP_FORWARD",
45	"NF_IP_LOCAL_OUT",
46	"NF_IP_POST_ROUTING",
47};
48
49static struct option original_opts[] = {
50	{"jump", 1, 0, 'j'},
51	{0, 0, 0, 0}
52};
53
54static struct iptables_target *t_list = NULL;
55static struct option *opts = original_opts;
56static unsigned int global_option_offset = 0;
57#define OPTION_OFFSET 256
58
59char *lib_dir;
60
61void
62register_target(struct iptables_target *me)
63{
64/*      fprintf(stderr, "\nDummy register_target %s \n", me->name);
65*/
66	me->next = t_list;
67	t_list = me;
68
69}
70
71void
72xtables_register_target(struct iptables_target *me)
73{
74	me->next = t_list;
75	t_list = me;
76}
77
78void
79exit_tryhelp(int status)
80{
81	fprintf(stderr, "Try `%s -h' or '%s --help' for more information.\n",
82		pname, pname);
83	exit(status);
84}
85
86void
87exit_error(enum exittype status, char *msg, ...)
88{
89	va_list args;
90
91	va_start(args, msg);
92	fprintf(stderr, "%s v%s: ", pname, pversion);
93	vfprintf(stderr, msg, args);
94	va_end(args);
95	fprintf(stderr, "\n");
96	if (status == PARAMETER_PROBLEM)
97		exit_tryhelp(status);
98	if (status == VERSION_PROBLEM)
99		fprintf(stderr,
100			"Perhaps iptables or your kernel needs to be upgraded.\n");
101	exit(status);
102}
103
104/* stolen from iptables 1.2.11
105They should really have them as a library so i can link to them
106Email them next time i remember
107*/
108
109char *
110addr_to_dotted(const struct in_addr *addrp)
111{
112	static char buf[20];
113	const unsigned char *bytep;
114
115	bytep = (const unsigned char *) &(addrp->s_addr);
116	sprintf(buf, "%d.%d.%d.%d", bytep[0], bytep[1], bytep[2], bytep[3]);
117	return buf;
118}
119
120int string_to_number_ll(const char *s, unsigned long long min,
121			unsigned long long max,
122		 unsigned long long *ret)
123{
124	unsigned long long number;
125	char *end;
126
127	/* Handle hex, octal, etc. */
128	errno = 0;
129	number = strtoull(s, &end, 0);
130	if (*end == '\0' && end != s) {
131		/* we parsed a number, let's see if we want this */
132		if (errno != ERANGE && min <= number && (!max || number <= max)) {
133			*ret = number;
134			return 0;
135		}
136	}
137	return -1;
138}
139
140int string_to_number_l(const char *s, unsigned long min, unsigned long max,
141		       unsigned long *ret)
142{
143	int result;
144	unsigned long long number;
145
146	result = string_to_number_ll(s, min, max, &number);
147	*ret = (unsigned long)number;
148
149	return result;
150}
151
152int string_to_number(const char *s, unsigned int min, unsigned int max,
153		unsigned int *ret)
154{
155	int result;
156	unsigned long number;
157
158	result = string_to_number_l(s, min, max, &number);
159	*ret = (unsigned int)number;
160
161	return result;
162}
163
164static void free_opts(struct option *local_opts)
165{
166	if (local_opts != original_opts) {
167		free(local_opts);
168		opts = original_opts;
169		global_option_offset = 0;
170	}
171}
172
173static struct option *
174merge_options(struct option *oldopts, const struct option *newopts,
175	      unsigned int *option_offset)
176{
177	struct option *merge;
178	unsigned int num_old, num_new, i;
179
180	for (num_old = 0; oldopts[num_old].name; num_old++) ;
181	for (num_new = 0; newopts[num_new].name; num_new++) ;
182
183	*option_offset = global_option_offset + OPTION_OFFSET;
184
185	merge = malloc(sizeof (struct option) * (num_new + num_old + 1));
186	memcpy(merge, oldopts, num_old * sizeof (struct option));
187	for (i = 0; i < num_new; i++) {
188		merge[num_old + i] = newopts[i];
189		merge[num_old + i].val += *option_offset;
190	}
191	memset(merge + num_old + num_new, 0, sizeof (struct option));
192
193	return merge;
194}
195
196static void *
197fw_calloc(size_t count, size_t size)
198{
199	void *p;
200
201	if ((p = (void *) calloc(count, size)) == NULL) {
202		perror("iptables: calloc failed");
203		exit(1);
204	}
205	return p;
206}
207
208static struct iptables_target *
209find_t(char *name)
210{
211	struct iptables_target *m;
212	for (m = t_list; m; m = m->next) {
213		if (strcmp(m->name, name) == 0)
214			return m;
215	}
216
217	return NULL;
218}
219
220static struct iptables_target *
221get_target_name(const char *name)
222{
223	void *handle;
224	char *error;
225	char *new_name, *lname;
226	struct iptables_target *m;
227	char path[strlen(lib_dir) + sizeof ("/libipt_.so") + strlen(name)];
228
229#ifdef NO_SHARED_LIBS
230	return NULL;
231#endif
232
233	new_name = malloc(strlen(name) + 1);
234	lname = malloc(strlen(name) + 1);
235	if (new_name)
236		memset(new_name, '\0', strlen(name) + 1);
237	else
238		exit_error(PARAMETER_PROBLEM, "get_target_name");
239
240	if (lname)
241		memset(lname, '\0', strlen(name) + 1);
242	else
243		exit_error(PARAMETER_PROBLEM, "get_target_name");
244
245	strcpy(new_name, name);
246	strcpy(lname, name);
247
248	if (isupper(lname[0])) {
249		int i;
250		for (i = 0; i < strlen(name); i++) {
251			lname[i] = tolower(lname[i]);
252		}
253	}
254
255	if (islower(new_name[0])) {
256		int i;
257		for (i = 0; i < strlen(new_name); i++) {
258			new_name[i] = toupper(new_name[i]);
259		}
260	}
261
262	/* try libxt_xx first */
263	sprintf(path, "%s/libxt_%s.so", lib_dir, new_name);
264	handle = dlopen(path, RTLD_LAZY);
265	if (!handle) {
266		/* try libipt_xx next */
267		sprintf(path, "%s/libipt_%s.so", lib_dir, new_name);
268		handle = dlopen(path, RTLD_LAZY);
269
270		if (!handle) {
271			sprintf(path, "%s/libxt_%s.so", lib_dir , lname);
272			handle = dlopen(path, RTLD_LAZY);
273		}
274
275		if (!handle) {
276			sprintf(path, "%s/libipt_%s.so", lib_dir , lname);
277			handle = dlopen(path, RTLD_LAZY);
278		}
279		/* ok, lets give up .. */
280		if (!handle) {
281			fputs(dlerror(), stderr);
282			printf("\n");
283			free(new_name);
284			free(lname);
285			return NULL;
286		}
287	}
288
289	m = dlsym(handle, new_name);
290	if ((error = dlerror()) != NULL) {
291		m = (struct iptables_target *) dlsym(handle, lname);
292		if ((error = dlerror()) != NULL) {
293			m = find_t(new_name);
294			if (NULL == m) {
295				m = find_t(lname);
296				if (NULL == m) {
297					fputs(error, stderr);
298					fprintf(stderr, "\n");
299					dlclose(handle);
300					free(new_name);
301					free(lname);
302					return NULL;
303				}
304			}
305		}
306	}
307
308	free(new_name);
309	free(lname);
310	return m;
311}
312
313
314struct in_addr *dotted_to_addr(const char *dotted)
315{
316	static struct in_addr addr;
317	unsigned char *addrp;
318	char *p, *q;
319	unsigned int onebyte;
320	int i;
321	char buf[20];
322
323	/* copy dotted string, because we need to modify it */
324	strncpy(buf, dotted, sizeof (buf) - 1);
325	addrp = (unsigned char *) &(addr.s_addr);
326
327	p = buf;
328	for (i = 0; i < 3; i++) {
329		if ((q = strchr(p, '.')) == NULL)
330			return (struct in_addr *) NULL;
331
332		*q = '\0';
333		if (string_to_number(p, 0, 255, &onebyte) == -1)
334			return (struct in_addr *) NULL;
335
336		addrp[i] = (unsigned char) onebyte;
337		p = q + 1;
338	}
339
340	/* we've checked 3 bytes, now we check the last one */
341	if (string_to_number(p, 0, 255, &onebyte) == -1)
342		return (struct in_addr *) NULL;
343
344	addrp[3] = (unsigned char) onebyte;
345
346	return &addr;
347}
348
349static void set_revision(char *name, u_int8_t revision)
350{
351	/* Old kernel sources don't have ".revision" field,
352	*  but we stole a byte from name. */
353	name[IPT_FUNCTION_MAXNAMELEN - 2] = '\0';
354	name[IPT_FUNCTION_MAXNAMELEN - 1] = revision;
355}
356
357/*
358 * we may need to check for version mismatch
359*/
360int
361build_st(struct iptables_target *target, struct ipt_entry_target *t)
362{
363	unsigned int nfcache = 0;
364
365	if (target) {
366		size_t size;
367
368		size =
369		    IPT_ALIGN(sizeof (struct ipt_entry_target)) + target->size;
370
371		if (NULL == t) {
372			target->t = fw_calloc(1, size);
373			target->t->u.target_size = size;
374
375			if (target->init != NULL)
376				target->init(target->t, &nfcache);
377			set_revision(target->t->u.user.name, target->revision);
378		} else {
379			target->t = t;
380		}
381		strcpy(target->t->u.user.name, target->name);
382		return 0;
383	}
384
385	return -1;
386}
387
388static int parse_ipt(struct action_util *a,int *argc_p,
389		     char ***argv_p, int tca_id, struct nlmsghdr *n)
390{
391	struct iptables_target *m = NULL;
392	struct ipt_entry fw;
393	struct rtattr *tail;
394	int c;
395	int rargc = *argc_p;
396	char **argv = *argv_p;
397	int argc = 0, iargc = 0;
398	char k[16];
399	int res = -1;
400	int size = 0;
401	int iok = 0, ok = 0;
402	__u32 hook = 0, index = 0;
403	res = 0;
404
405	lib_dir = getenv("IPTABLES_LIB_DIR");
406	if (!lib_dir)
407		lib_dir = IPT_LIB_DIR;
408
409	{
410		int i;
411		for (i = 0; i < rargc; i++) {
412			if (NULL == argv[i] || 0 == strcmp(argv[i], "action")) {
413				break;
414			}
415		}
416		iargc = argc = i;
417	}
418
419	if (argc <= 2) {
420		fprintf(stderr,"bad arguements to ipt %d vs %d \n", argc, rargc);
421		return -1;
422	}
423
424	while (1) {
425		c = getopt_long(argc, argv, "j:", opts, NULL);
426		if (c == -1)
427			break;
428		switch (c) {
429		case 'j':
430			m = get_target_name(optarg);
431			if (NULL != m) {
432
433				if (0 > build_st(m, NULL)) {
434					printf(" %s error \n", m->name);
435					return -1;
436				}
437				opts =
438				    merge_options(opts, m->extra_opts,
439						  &m->option_offset);
440			} else {
441				fprintf(stderr," failed to find target %s\n\n", optarg);
442				return -1;
443			}
444			ok++;
445			break;
446
447		default:
448			memset(&fw, 0, sizeof (fw));
449			if (m) {
450				m->parse(c - m->option_offset, argv, 0,
451					 &m->tflags, NULL, &m->t);
452			} else {
453				fprintf(stderr," failed to find target %s\n\n", optarg);
454				return -1;
455
456			}
457			ok++;
458			break;
459
460		}
461	}
462
463	if (iargc > optind) {
464		if (matches(argv[optind], "index") == 0) {
465			if (get_u32(&index, argv[optind + 1], 10)) {
466				fprintf(stderr, "Illegal \"index\"\n");
467				free_opts(opts);
468				return -1;
469			}
470			iok++;
471
472			optind += 2;
473		}
474	}
475
476	if (!ok && !iok) {
477		fprintf(stderr," ipt Parser BAD!! (%s)\n", *argv);
478		return -1;
479	}
480
481	/* check that we passed the correct parameters to the target */
482	if (m)
483		m->final_check(m->tflags);
484
485	{
486		struct tcmsg *t = NLMSG_DATA(n);
487		if (t->tcm_parent != TC_H_ROOT
488		    && t->tcm_parent == TC_H_MAJ(TC_H_INGRESS)) {
489			hook = NF_IP_PRE_ROUTING;
490		} else {
491			hook = NF_IP_POST_ROUTING;
492		}
493	}
494
495	tail = NLMSG_TAIL(n);
496	addattr_l(n, MAX_MSG, tca_id, NULL, 0);
497	fprintf(stdout, "tablename: %s hook: %s\n ", tname, ipthooks[hook]);
498	fprintf(stdout, "\ttarget: ");
499
500	if (m)
501		m->print(NULL, m->t, 0);
502	fprintf(stdout, " index %d\n", index);
503
504	if (strlen(tname) > 16) {
505		size = 16;
506		k[15] = 0;
507	} else {
508		size = 1 + strlen(tname);
509	}
510	strncpy(k, tname, size);
511
512	addattr_l(n, MAX_MSG, TCA_IPT_TABLE, k, size);
513	addattr_l(n, MAX_MSG, TCA_IPT_HOOK, &hook, 4);
514	addattr_l(n, MAX_MSG, TCA_IPT_INDEX, &index, 4);
515	if (m)
516		addattr_l(n, MAX_MSG, TCA_IPT_TARG, m->t, m->t->u.target_size);
517	tail->rta_len = (void *) NLMSG_TAIL(n) - (void *) tail;
518
519	argc -= optind;
520	argv += optind;
521	*argc_p = rargc - iargc;
522	*argv_p = argv;
523
524	optind = 0;
525	free_opts(opts);
526	/* Clear flags if target will be used again */
527        m->tflags=0;
528        m->used=0;
529	/* Free allocated memory */
530        if (m->t)
531            free(m->t);
532
533
534	return 0;
535
536}
537
538static int
539print_ipt(struct action_util *au,FILE * f, struct rtattr *arg)
540{
541	struct rtattr *tb[TCA_IPT_MAX + 1];
542	struct ipt_entry_target *t = NULL;
543
544	if (arg == NULL)
545		return -1;
546
547	lib_dir = getenv("IPTABLES_LIB_DIR");
548	if (!lib_dir)
549		lib_dir = IPT_LIB_DIR;
550
551	parse_rtattr_nested(tb, TCA_IPT_MAX, arg);
552
553	if (tb[TCA_IPT_TABLE] == NULL) {
554		fprintf(f, "[NULL ipt table name ] assuming mangle ");
555	} else {
556		fprintf(f, "tablename: %s ",
557			(char *) RTA_DATA(tb[TCA_IPT_TABLE]));
558	}
559
560	if (tb[TCA_IPT_HOOK] == NULL) {
561		fprintf(f, "[NULL ipt hook name ]\n ");
562		return -1;
563	} else {
564		__u32 hook;
565		hook = *(__u32 *) RTA_DATA(tb[TCA_IPT_HOOK]);
566		fprintf(f, " hook: %s \n", ipthooks[hook]);
567	}
568
569	if (tb[TCA_IPT_TARG] == NULL) {
570		fprintf(f, "\t[NULL ipt target parameters ] \n");
571		return -1;
572	} else {
573		struct iptables_target *m = NULL;
574		t = RTA_DATA(tb[TCA_IPT_TARG]);
575		m = get_target_name(t->u.user.name);
576		if (NULL != m) {
577			if (0 > build_st(m, t)) {
578				fprintf(stderr, " %s error \n", m->name);
579				return -1;
580			}
581
582			opts =
583			    merge_options(opts, m->extra_opts,
584					  &m->option_offset);
585		} else {
586			fprintf(stderr, " failed to find target %s\n\n",
587				t->u.user.name);
588			return -1;
589		}
590		fprintf(f, "\ttarget ");
591		m->print(NULL, m->t, 0);
592		if (tb[TCA_IPT_INDEX] == NULL) {
593			fprintf(f, " [NULL ipt target index ]\n");
594		} else {
595			__u32 index;
596			index = *(__u32 *) RTA_DATA(tb[TCA_IPT_INDEX]);
597			fprintf(f, " \n\tindex %d", index);
598		}
599
600		if (tb[TCA_IPT_CNT]) {
601			struct tc_cnt *c  = RTA_DATA(tb[TCA_IPT_CNT]);;
602			fprintf(f, " ref %d bind %d", c->refcnt, c->bindcnt);
603		}
604		if (show_stats) {
605			if (tb[TCA_IPT_TM]) {
606				struct tcf_t *tm = RTA_DATA(tb[TCA_IPT_TM]);
607				print_tm(f,tm);
608			}
609		}
610		fprintf(f, " \n");
611
612	}
613	free_opts(opts);
614
615	return 0;
616}
617
618struct action_util ipt_action_util = {
619        .id = "ipt",
620        .parse_aopt = parse_ipt,
621        .print_aopt = print_ipt,
622};
623
624