1/* 2 * m_ipt.c iptables based targets 3 * utilities mostly ripped from iptables <duh, its the linux way> 4 * 5 * This program is free software; you can distribute it and/or 6 * modify it under the terms of the GNU General Public License 7 * as published by the Free Software Foundation; either version 8 * 2 of the License, or (at your option) any later version. 9 * 10 * Authors: J Hadi Salim (hadi@cyberus.ca) 11 * 12 * TODO: bad bad hardcoding IPT_LIB_DIR and PROC_SYS_MODPROBE 13 * 14*/ 15 16#include <syslog.h> 17#include <sys/socket.h> 18#include <netinet/in.h> 19#include <arpa/inet.h> 20#include <iptables.h> 21#include <linux/netfilter_ipv4/ip_tables.h> 22#include "utils.h" 23#include "tc_util.h" 24#include <linux/tc_act/tc_ipt.h> 25#include <stdio.h> 26#include <dlfcn.h> 27#include <getopt.h> 28#include <errno.h> 29#include <string.h> 30#include <netdb.h> 31#include <stdlib.h> 32#include <ctype.h> 33#include <stdarg.h> 34#include <limits.h> 35#include <unistd.h> 36#include <fcntl.h> 37#include <sys/wait.h> 38 39const char *pname = "tc-ipt"; 40const char *tname = "mangle"; 41const char *pversion = "0.1"; 42 43#ifndef TRUE 44#define TRUE 1 45#endif 46#ifndef FALSE 47#define FALSE 0 48#endif 49 50#ifndef IPT_LIB_DIR 51#define IPT_LIB_DIR "/usr/local/lib/iptables" 52#endif 53 54#ifndef PROC_SYS_MODPROBE 55#define PROC_SYS_MODPROBE "/proc/sys/kernel/modprobe" 56#endif 57 58static const char *ipthooks[] = { 59 "NF_IP_PRE_ROUTING", 60 "NF_IP_LOCAL_IN", 61 "NF_IP_FORWARD", 62 "NF_IP_LOCAL_OUT", 63 "NF_IP_POST_ROUTING", 64}; 65 66static struct option original_opts[] = { 67 {"jump", 1, 0, 'j'}, 68 {0, 0, 0, 0} 69}; 70 71static struct iptables_target *t_list = NULL; 72static struct option *opts = original_opts; 73static unsigned int global_option_offset = 0; 74#define OPTION_OFFSET 256 75 76 77void 78register_target(struct iptables_target *me) 79{ 80/* fprintf(stderr, "\nDummy register_target %s \n", me->name); 81*/ 82 me->next = t_list; 83 t_list = me; 84 85} 86 87void 88exit_tryhelp(int status) 89{ 90 fprintf(stderr, "Try `%s -h' or '%s --help' for more information.\n", 91 pname, pname); 92 exit(status); 93} 94 95void 96exit_error(enum exittype status, char *msg, ...) 97{ 98 va_list args; 99 100 va_start(args, msg); 101 fprintf(stderr, "%s v%s: ", pname, pversion); 102 vfprintf(stderr, msg, args); 103 va_end(args); 104 fprintf(stderr, "\n"); 105 if (status == PARAMETER_PROBLEM) 106 exit_tryhelp(status); 107 if (status == VERSION_PROBLEM) 108 fprintf(stderr, 109 "Perhaps iptables or your kernel needs to be upgraded.\n"); 110 exit(status); 111} 112 113/* stolen from iptables 1.2.11 114They should really have them as a library so i can link to them 115Email them next time i remember 116*/ 117 118char * 119addr_to_dotted(const struct in_addr *addrp) 120{ 121 static char buf[20]; 122 const unsigned char *bytep; 123 124 bytep = (const unsigned char *) &(addrp->s_addr); 125 sprintf(buf, "%d.%d.%d.%d", bytep[0], bytep[1], bytep[2], bytep[3]); 126 return buf; 127} 128 129int string_to_number_ll(const char *s, unsigned long long min, 130 unsigned long long max, 131 unsigned long long *ret) 132{ 133 unsigned long long number; 134 char *end; 135 136 /* Handle hex, octal, etc. */ 137 errno = 0; 138 number = strtoull(s, &end, 0); 139 if (*end == '\0' && end != s) { 140 /* we parsed a number, let's see if we want this */ 141 if (errno != ERANGE && min <= number && (!max || number <= max)) { 142 *ret = number; 143 return 0; 144 } 145 } 146 return -1; 147} 148 149int string_to_number_l(const char *s, unsigned long min, unsigned long max, 150 unsigned long *ret) 151{ 152 int result; 153 unsigned long long number; 154 155 result = string_to_number_ll(s, min, max, &number); 156 *ret = (unsigned long)number; 157 158 return result; 159} 160 161int string_to_number(const char *s, unsigned int min, unsigned int max, 162 unsigned int *ret) 163{ 164 int result; 165 unsigned long number; 166 167 result = string_to_number_l(s, min, max, &number); 168 *ret = (unsigned int)number; 169 170 return result; 171} 172 173static void free_opts(struct option *local_opts) 174{ 175 if (local_opts != original_opts) { 176 free(local_opts); 177 opts = original_opts; 178 global_option_offset = 0; 179 } 180} 181 182static struct option * 183merge_options(struct option *oldopts, const struct option *newopts, 184 unsigned int *option_offset) 185{ 186 struct option *merge; 187 unsigned int num_old, num_new, i; 188 189 for (num_old = 0; oldopts[num_old].name; num_old++) ; 190 for (num_new = 0; newopts[num_new].name; num_new++) ; 191 192 *option_offset = global_option_offset + OPTION_OFFSET; 193 194 merge = malloc(sizeof (struct option) * (num_new + num_old + 1)); 195 memcpy(merge, oldopts, num_old * sizeof (struct option)); 196 for (i = 0; i < num_new; i++) { 197 merge[num_old + i] = newopts[i]; 198 merge[num_old + i].val += *option_offset; 199 } 200 memset(merge + num_old + num_new, 0, sizeof (struct option)); 201 202 return merge; 203} 204 205static void * 206fw_calloc(size_t count, size_t size) 207{ 208 void *p; 209 210 if ((p = (void *) calloc(count, size)) == NULL) { 211 perror("iptables: calloc failed"); 212 exit(1); 213 } 214 return p; 215} 216 217static struct iptables_target * 218find_t(char *name) 219{ 220 struct iptables_target *m; 221 for (m = t_list; m; m = m->next) { 222 if (strcmp(m->name, name) == 0) 223 return m; 224 } 225 226 return NULL; 227} 228 229static struct iptables_target * 230get_target_name(char *name) 231{ 232 void *handle; 233 char *error; 234 char *new_name, *lname; 235 struct iptables_target *m; 236 237 char path[sizeof (IPT_LIB_DIR) + sizeof ("/libipt_.so") + strlen(name)]; 238 239 new_name = malloc(strlen(name) + 1); 240 lname = malloc(strlen(name) + 1); 241 if (new_name) 242 memset(new_name, '\0', strlen(name) + 1); 243 else 244 exit_error(PARAMETER_PROBLEM, "get_target_name"); 245 246 if (lname) 247 memset(lname, '\0', strlen(name) + 1); 248 else 249 exit_error(PARAMETER_PROBLEM, "get_target_name"); 250 251 strcpy(new_name, name); 252 strcpy(lname, name); 253 254 if (isupper(lname[0])) { 255 int i; 256 for (i = 0; i < strlen(name); i++) { 257 lname[i] = tolower(lname[i]); 258 } 259 } 260 261 if (islower(new_name[0])) { 262 int i; 263 for (i = 0; i < strlen(new_name); i++) { 264 new_name[i] = toupper(new_name[i]); 265 } 266 } 267 268 sprintf(path, IPT_LIB_DIR "/libipt_%s.so", new_name); 269 handle = dlopen(path, RTLD_LAZY); 270 if (!handle) { 271 sprintf(path, IPT_LIB_DIR "/libipt_%s.so", lname); 272 handle = dlopen(path, RTLD_LAZY); 273 if (!handle) { 274 fputs(dlerror(), stderr); 275 printf("\n"); 276 free(lname); 277 free(new_name); 278 return NULL; 279 } 280 } 281 282 m = dlsym(handle, new_name); 283 if ((error = dlerror()) != NULL) { 284 m = (struct iptables_target *) dlsym(handle, lname); 285 if ((error = dlerror()) != NULL) { 286 m = find_t(new_name); 287 if (NULL == m) { 288 m = find_t(lname); 289 if (NULL == m) { 290 fputs(error, stderr); 291 fprintf(stderr, "\n"); 292 dlclose(handle); 293 free(lname); 294 free(new_name); 295 return NULL; 296 } 297 } 298 } 299 } 300 301 free(lname); 302 free(new_name); 303 return m; 304} 305 306 307struct in_addr *dotted_to_addr(const char *dotted) 308{ 309 static struct in_addr addr; 310 unsigned char *addrp; 311 char *p, *q; 312 unsigned int onebyte; 313 int i; 314 char buf[20]; 315 316 /* copy dotted string, because we need to modify it */ 317 strncpy(buf, dotted, sizeof (buf) - 1); 318 addrp = (unsigned char *) &(addr.s_addr); 319 320 p = buf; 321 for (i = 0; i < 3; i++) { 322 if ((q = strchr(p, '.')) == NULL) 323 return (struct in_addr *) NULL; 324 325 *q = '\0'; 326 if (string_to_number(p, 0, 255, &onebyte) == -1) 327 return (struct in_addr *) NULL; 328 329 addrp[i] = (unsigned char) onebyte; 330 p = q + 1; 331 } 332 333 /* we've checked 3 bytes, now we check the last one */ 334 if (string_to_number(p, 0, 255, &onebyte) == -1) 335 return (struct in_addr *) NULL; 336 337 addrp[3] = (unsigned char) onebyte; 338 339 return &addr; 340} 341 342static void set_revision(char *name, u_int8_t revision) 343{ 344 /* Old kernel sources don't have ".revision" field, 345 * but we stole a byte from name. */ 346 name[IPT_FUNCTION_MAXNAMELEN - 2] = '\0'; 347 name[IPT_FUNCTION_MAXNAMELEN - 1] = revision; 348} 349 350/* 351 * we may need to check for version mismatch 352*/ 353int 354build_st(struct iptables_target *target, struct ipt_entry_target *t) 355{ 356 unsigned int nfcache = 0; 357 358 if (target) { 359 size_t size; 360 361 size = 362 IPT_ALIGN(sizeof (struct ipt_entry_target)) + target->size; 363 364 if (NULL == t) { 365 target->t = fw_calloc(1, size); 366 target->t->u.target_size = size; 367 368 if (target->init != NULL) 369 target->init(target->t, &nfcache); 370 set_revision(target->t->u.user.name, target->revision); 371 } else { 372 target->t = t; 373 } 374 strcpy(target->t->u.user.name, target->name); 375 return 0; 376 } 377 378 return -1; 379} 380 381static int parse_ipt(struct action_util *a,int *argc_p, 382 char ***argv_p, int tca_id, struct nlmsghdr *n) 383{ 384 struct iptables_target *m = NULL; 385 struct ipt_entry fw; 386 struct rtattr *tail; 387 int c; 388 int rargc = *argc_p; 389 char **argv = *argv_p; 390 int argc = 0, iargc = 0; 391 char k[16]; 392 int res = -1; 393 int size = 0; 394 int iok = 0, ok = 0; 395 __u32 hook = 0, index = 0; 396 res = 0; 397 398 { 399 int i; 400 for (i = 0; i < rargc; i++) { 401 if (NULL == argv[i] || 0 == strcmp(argv[i], "action")) { 402 break; 403 } 404 } 405 iargc = argc = i; 406 } 407 408 if (argc <= 2) { 409 fprintf(stderr,"bad arguements to ipt %d vs %d \n", argc, rargc); 410 return -1; 411 } 412 413 while (1) { 414 c = getopt_long(argc, argv, "j:", opts, NULL); 415 if (c == -1) 416 break; 417 switch (c) { 418 case 'j': 419 m = get_target_name(optarg); 420 if (NULL != m) { 421 422 if (0 > build_st(m, NULL)) { 423 printf(" %s error \n", m->name); 424 return -1; 425 } 426 opts = 427 merge_options(opts, m->extra_opts, 428 &m->option_offset); 429 } else { 430 fprintf(stderr," failed to find target %s\n\n", optarg); 431 return -1; 432 } 433 ok++; 434 break; 435 436 default: 437 memset(&fw, 0, sizeof (fw)); 438 if (m) { 439 m->parse(c - m->option_offset, argv, 0, 440 &m->tflags, NULL, &m->t); 441 } else { 442 fprintf(stderr," failed to find target %s\n\n", optarg); 443 return -1; 444 445 } 446 ok++; 447 break; 448 449 } 450 } 451 452 if (iargc > optind) { 453 if (matches(argv[optind], "index") == 0) { 454 if (get_u32(&index, argv[optind + 1], 10)) { 455 fprintf(stderr, "Illegal \"index\"\n"); 456 free_opts(opts); 457 return -1; 458 } 459 iok++; 460 461 optind += 2; 462 } 463 } 464 465 if (!ok && !iok) { 466 fprintf(stderr," ipt Parser BAD!! (%s)\n", *argv); 467 return -1; 468 } 469 470 /* check that we passed the correct parameters to the target */ 471 if (m) 472 m->final_check(m->tflags); 473 474 { 475 struct tcmsg *t = NLMSG_DATA(n); 476 if (t->tcm_parent != TC_H_ROOT 477 && t->tcm_parent == TC_H_MAJ(TC_H_INGRESS)) { 478 hook = NF_IP_PRE_ROUTING; 479 } else { 480 hook = NF_IP_POST_ROUTING; 481 } 482 } 483 484 tail = NLMSG_TAIL(n); 485 addattr_l(n, MAX_MSG, tca_id, NULL, 0); 486 fprintf(stdout, "tablename: %s hook: %s\n ", tname, ipthooks[hook]); 487 fprintf(stdout, "\ttarget: "); 488 489 if (m) 490 m->print(NULL, m->t, 0); 491 fprintf(stdout, " index %d\n", index); 492 493 if (strlen(tname) > 16) { 494 size = 16; 495 k[15] = 0; 496 } else { 497 size = 1 + strlen(tname); 498 } 499 strncpy(k, tname, size); 500 501 addattr_l(n, MAX_MSG, TCA_IPT_TABLE, k, size); 502 addattr_l(n, MAX_MSG, TCA_IPT_HOOK, &hook, 4); 503 addattr_l(n, MAX_MSG, TCA_IPT_INDEX, &index, 4); 504 if (m) 505 addattr_l(n, MAX_MSG, TCA_IPT_TARG, m->t, m->t->u.target_size); 506 tail->rta_len = (void *) NLMSG_TAIL(n) - (void *) tail; 507 508 argc -= optind; 509 argv += optind; 510 *argc_p = rargc - iargc; 511 *argv_p = argv; 512 513 optind = 0; 514 free_opts(opts); 515 /* Clear flags if target will be used again */ 516 m->tflags=0; 517 m->used=0; 518 /* Free allocated memory */ 519 if (m->t) 520 free(m->t); 521 522 523 return 0; 524 525} 526 527static int 528print_ipt(struct action_util *au,FILE * f, struct rtattr *arg) 529{ 530 struct rtattr *tb[TCA_IPT_MAX + 1]; 531 struct ipt_entry_target *t = NULL; 532 533 if (arg == NULL) 534 return -1; 535 536 parse_rtattr_nested(tb, TCA_IPT_MAX, arg); 537 538 if (tb[TCA_IPT_TABLE] == NULL) { 539 fprintf(f, "[NULL ipt table name ] assuming mangle "); 540 } else { 541 fprintf(f, "tablename: %s ", 542 (char *) RTA_DATA(tb[TCA_IPT_TABLE])); 543 } 544 545 if (tb[TCA_IPT_HOOK] == NULL) { 546 fprintf(f, "[NULL ipt hook name ]\n "); 547 return -1; 548 } else { 549 __u32 hook; 550 hook = *(__u32 *) RTA_DATA(tb[TCA_IPT_HOOK]); 551 fprintf(f, " hook: %s \n", ipthooks[hook]); 552 } 553 554 if (tb[TCA_IPT_TARG] == NULL) { 555 fprintf(f, "\t[NULL ipt target parameters ] \n"); 556 return -1; 557 } else { 558 struct iptables_target *m = NULL; 559 t = RTA_DATA(tb[TCA_IPT_TARG]); 560 m = get_target_name(t->u.user.name); 561 if (NULL != m) { 562 if (0 > build_st(m, t)) { 563 fprintf(stderr, " %s error \n", m->name); 564 return -1; 565 } 566 567 opts = 568 merge_options(opts, m->extra_opts, 569 &m->option_offset); 570 } else { 571 fprintf(stderr, " failed to find target %s\n\n", 572 t->u.user.name); 573 return -1; 574 } 575 fprintf(f, "\ttarget "); 576 m->print(NULL, m->t, 0); 577 if (tb[TCA_IPT_INDEX] == NULL) { 578 fprintf(f, " [NULL ipt target index ]\n"); 579 } else { 580 __u32 index; 581 index = *(__u32 *) RTA_DATA(tb[TCA_IPT_INDEX]); 582 fprintf(f, " \n\tindex %d", index); 583 } 584 585 if (tb[TCA_IPT_CNT]) { 586 struct tc_cnt *c = RTA_DATA(tb[TCA_IPT_CNT]);; 587 fprintf(f, " ref %d bind %d", c->refcnt, c->bindcnt); 588 } 589 if (show_stats) { 590 if (tb[TCA_IPT_TM]) { 591 struct tcf_t *tm = RTA_DATA(tb[TCA_IPT_TM]); 592 print_tm(f,tm); 593 } 594 } 595 fprintf(f, " \n"); 596 597 } 598 free_opts(opts); 599 600 return 0; 601} 602 603struct action_util ipt_action_util = { 604 .id = "ipt", 605 .parse_aopt = parse_ipt, 606 .print_aopt = print_ipt, 607}; 608 609