330 lines
11 KiB
C
330 lines
11 KiB
C
/*
|
|
* $Id: ebtables.c,v 1.03 2002/01/19
|
|
*
|
|
* Copyright (C) 2001-2002 Bart De Schuymer
|
|
*
|
|
* This code is stongly inspired on the iptables code which is
|
|
* Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
|
|
*
|
|
* This program is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU General Public License as
|
|
* published by the Free Software Foundation; either version 2 of the
|
|
* License, or (at your option) any later version.
|
|
*
|
|
* This program is distributed in the hope that it will be useful, but
|
|
* WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
* General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program; if not, write to the Free Software
|
|
* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
|
|
*/
|
|
|
|
#ifndef EBTABLES_U_H
|
|
#define EBTABLES_U_H
|
|
#include <netinet/in.h>
|
|
#include <linux/netfilter_bridge/ebtables.h>
|
|
#include <linux/netfilter/x_tables.h>
|
|
|
|
#ifndef IPPROTO_SCTP
|
|
#define IPPROTO_SCTP 132
|
|
#endif
|
|
#ifndef IPPROTO_DCCP
|
|
#define IPPROTO_DCCP 33
|
|
#endif
|
|
|
|
#ifndef EBT_MIN_ALIGN
|
|
#define EBT_MIN_ALIGN (__alignof__(struct _xt_align))
|
|
#endif
|
|
#define EBT_ALIGN(s) (((s) + (EBT_MIN_ALIGN-1)) & ~(EBT_MIN_ALIGN-1))
|
|
|
|
struct ebt_u_entries
|
|
{
|
|
int policy;
|
|
unsigned int nentries;
|
|
/* counter offset for this chain */
|
|
unsigned int counter_offset;
|
|
/* used for udc */
|
|
unsigned int hook_mask;
|
|
char *kernel_start;
|
|
char name[EBT_CHAIN_MAXNAMELEN];
|
|
struct ebt_u_entry *entries;
|
|
};
|
|
|
|
struct ebt_cntchanges
|
|
{
|
|
unsigned short type;
|
|
unsigned short change; /* determines incremental/decremental/change */
|
|
struct ebt_cntchanges *prev;
|
|
struct ebt_cntchanges *next;
|
|
};
|
|
|
|
#define EBT_ORI_MAX_CHAINS 10
|
|
struct ebt_u_replace
|
|
{
|
|
char name[EBT_TABLE_MAXNAMELEN];
|
|
unsigned int valid_hooks;
|
|
/* nr of rules in the table */
|
|
unsigned int nentries;
|
|
unsigned int num_chains;
|
|
unsigned int max_chains;
|
|
struct ebt_u_entries **chains;
|
|
/* nr of counters userspace expects back */
|
|
unsigned int num_counters;
|
|
/* where the kernel will put the old counters */
|
|
struct ebt_counter *counters;
|
|
/*
|
|
* can be used e.g. to know if a standard option
|
|
* has been specified twice
|
|
*/
|
|
unsigned int flags;
|
|
/* we stick the specified command (e.g. -A) in here */
|
|
char command;
|
|
/*
|
|
* here we stick the chain to do our thing on (can be -1 if unspecified)
|
|
*/
|
|
int selected_chain;
|
|
/* tells what happened to the old rules (counter changes) */
|
|
struct ebt_cntchanges *cc;
|
|
};
|
|
|
|
struct ebt_u_table
|
|
{
|
|
char name[EBT_TABLE_MAXNAMELEN];
|
|
void (*check)(struct ebt_u_replace *repl);
|
|
void (*help)(const char **);
|
|
struct ebt_u_table *next;
|
|
};
|
|
|
|
struct ebt_u_match_list
|
|
{
|
|
struct ebt_u_match_list *next;
|
|
struct ebt_entry_match *m;
|
|
};
|
|
|
|
struct ebt_u_entry
|
|
{
|
|
unsigned int bitmask;
|
|
unsigned int invflags;
|
|
uint16_t ethproto;
|
|
char in[IFNAMSIZ];
|
|
char logical_in[IFNAMSIZ];
|
|
char out[IFNAMSIZ];
|
|
char logical_out[IFNAMSIZ];
|
|
unsigned char sourcemac[ETH_ALEN];
|
|
unsigned char sourcemsk[ETH_ALEN];
|
|
unsigned char destmac[ETH_ALEN];
|
|
unsigned char destmsk[ETH_ALEN];
|
|
struct ebt_u_match_list *m_list;
|
|
struct ebt_entry_target *t;
|
|
struct ebt_u_entry *prev;
|
|
struct ebt_u_entry *next;
|
|
struct ebt_counter cnt;
|
|
struct ebt_counter cnt_surplus; /* for increasing/decreasing a counter and for option 'C' */
|
|
struct ebt_cntchanges *cc;
|
|
/* the standard target needs this to know the name of a udc when
|
|
* printing out rules. */
|
|
struct ebt_u_replace *replace;
|
|
};
|
|
|
|
struct ebt_u_match
|
|
{
|
|
char name[EBT_FUNCTION_MAXNAMELEN];
|
|
/* size of the real match data */
|
|
unsigned int size;
|
|
void (*help)(void);
|
|
void (*init)(struct ebt_entry_match *m);
|
|
int (*parse)(int c, char **argv, int argc,
|
|
const struct ebt_u_entry *entry, unsigned int *flags,
|
|
struct ebt_entry_match **match);
|
|
void (*final_check)(const struct ebt_u_entry *entry,
|
|
const struct ebt_entry_match *match,
|
|
const char *name, unsigned int hookmask, unsigned int time);
|
|
void (*print)(const struct ebt_u_entry *entry,
|
|
const struct ebt_entry_match *match);
|
|
int (*compare)(const struct ebt_entry_match *m1,
|
|
const struct ebt_entry_match *m2);
|
|
const struct option *extra_ops;
|
|
/*
|
|
* can be used e.g. to check for multiple occurance of the same option
|
|
*/
|
|
unsigned int flags;
|
|
unsigned int option_offset;
|
|
struct ebt_entry_match *m;
|
|
/*
|
|
* if used == 1 we no longer have to add it to
|
|
* the match chain of the new entry
|
|
* be sure to put it back on 0 when finished
|
|
*/
|
|
unsigned int used;
|
|
struct ebt_u_match *next;
|
|
};
|
|
|
|
struct ebt_u_target
|
|
{
|
|
char name[EBT_FUNCTION_MAXNAMELEN];
|
|
unsigned int size;
|
|
void (*help)(void);
|
|
void (*init)(struct ebt_entry_target *t);
|
|
int (*parse)(int c, char **argv, int argc,
|
|
const struct ebt_u_entry *entry, unsigned int *flags,
|
|
struct ebt_entry_target **target);
|
|
void (*final_check)(const struct ebt_u_entry *entry,
|
|
const struct ebt_entry_target *target, const char *name,
|
|
unsigned int hookmask, unsigned int time);
|
|
void (*print)(const struct ebt_u_entry *entry,
|
|
const struct ebt_entry_target *target);
|
|
int (*compare)(const struct ebt_entry_target *t1,
|
|
const struct ebt_entry_target *t2);
|
|
const struct option *extra_ops;
|
|
unsigned int option_offset;
|
|
unsigned int flags;
|
|
struct ebt_entry_target *t;
|
|
unsigned int used;
|
|
struct ebt_u_target *next;
|
|
};
|
|
|
|
|
|
struct ebt_icmp_names {
|
|
const char *name;
|
|
uint8_t type;
|
|
uint8_t code_min, code_max;
|
|
};
|
|
|
|
|
|
|
|
/* libebtc.c */
|
|
|
|
extern struct ebt_u_table *ebt_tables;
|
|
extern struct ebt_u_match *ebt_matches;
|
|
extern struct ebt_u_target *ebt_targets;
|
|
|
|
void ebt_register_table(struct ebt_u_table *);
|
|
void ebt_register_match(struct ebt_u_match *);
|
|
void ebt_register_target(struct ebt_u_target *t);
|
|
int ebt_get_kernel_table(struct ebt_u_replace *replace);
|
|
struct ebt_u_target *ebt_find_target(const char *name);
|
|
struct ebt_u_match *ebt_find_match(const char *name);
|
|
struct ebt_u_table *ebt_find_table(const char *name);
|
|
void ebt_list_extensions();
|
|
void ebt_initialize_entry(struct ebt_u_entry *e);
|
|
void ebt_double_chains(struct ebt_u_replace *replace);
|
|
void ebt_free_u_entry(struct ebt_u_entry *e);
|
|
int ebt_get_chainnr(const struct ebt_u_replace *replace, const char* arg);
|
|
/**/
|
|
void ebt_change_policy(struct ebt_u_replace *replace, int policy);
|
|
void ebt_flush_chains(struct ebt_u_replace *replace);
|
|
int ebt_check_rule_exists(struct ebt_u_replace *replace,
|
|
struct ebt_u_entry *new_entry);
|
|
void ebt_add_rule(struct ebt_u_replace *replace, struct ebt_u_entry *new_entry,
|
|
int rule_nr);
|
|
void ebt_delete_rule(struct ebt_u_replace *replace,
|
|
struct ebt_u_entry *new_entry, int begin, int end);
|
|
void ebt_new_chain(struct ebt_u_replace *replace, const char *name, int policy);
|
|
void ebt_delete_chain(struct ebt_u_replace *replace);
|
|
void ebt_rename_chain(struct ebt_u_replace *replace, const char *name);
|
|
/**/
|
|
void ebt_do_final_checks(struct ebt_u_replace *replace, struct ebt_u_entry *e,
|
|
struct ebt_u_entries *entries);
|
|
int ebt_check_for_references(struct ebt_u_replace *replace, int print_err);
|
|
void ebt_check_for_loops(struct ebt_u_replace *replace);
|
|
void ebt_add_match(struct ebt_u_entry *new_entry, struct ebt_u_match *m);
|
|
void ebt_iterate_matches(void (*f)(struct ebt_u_match *));
|
|
void ebt_iterate_targets(void (*f)(struct ebt_u_target *));
|
|
void __ebt_print_bug(char *file, int line, char *format, ...);
|
|
void __ebt_print_error(char *format, ...);
|
|
|
|
/* communication.c */
|
|
|
|
int ebt_get_table(struct ebt_u_replace *repl);
|
|
void ebt_deliver_counters(struct ebt_u_replace *repl);
|
|
void ebt_deliver_table(struct ebt_u_replace *repl);
|
|
|
|
/* useful_functions.c */
|
|
|
|
extern int ebt_invert;
|
|
void ebt_check_option(unsigned int *flags, unsigned int mask);
|
|
#define ebt_check_inverse(arg) _ebt_check_inverse(arg, argc, argv)
|
|
int _ebt_check_inverse(const char option[], int argc, char **argv);
|
|
void ebt_print_mac(const unsigned char *mac);
|
|
void ebt_print_mac_and_mask(const unsigned char *mac, const unsigned char *mask);
|
|
int ebt_get_mac_and_mask(const char *from, unsigned char *to, unsigned char *mask);
|
|
void ebt_parse_ip_address(char *address, uint32_t *addr, uint32_t *msk);
|
|
char *ebt_mask_to_dotted(uint32_t mask);
|
|
void ebt_parse_ip6_address(char *address, struct in6_addr *addr,
|
|
struct in6_addr *msk);
|
|
char *ebt_ip6_to_numeric(const struct in6_addr *addrp);
|
|
char *ebt_ip6_mask_to_string(const struct in6_addr *msk);
|
|
|
|
int ebt_parse_icmp(const struct ebt_icmp_names *icmp_codes, size_t n_codes,
|
|
const char *icmptype, uint8_t type[], uint8_t code[]);
|
|
void ebt_print_icmp_type(const struct ebt_icmp_names *icmp_codes,
|
|
size_t n_codes, uint8_t *type, uint8_t *code);
|
|
void ebt_print_icmp_types(const struct ebt_icmp_names *icmp_codes,
|
|
size_t n_codes);
|
|
|
|
int do_command(int argc, char *argv[], struct ebt_u_replace *replace_);
|
|
|
|
#define ebt_to_chain(repl) \
|
|
({struct ebt_u_entries *_ch = NULL; \
|
|
if (repl->selected_chain != -1) \
|
|
_ch = repl->chains[repl->selected_chain]; \
|
|
_ch;})
|
|
#define ebt_print_bug(format, args...) \
|
|
__ebt_print_bug(__FILE__, __LINE__, format, ##args)
|
|
#define ebt_print_error(format,args...) __ebt_print_error(format, ##args);
|
|
#define ebt_print_error2(format, args...) do {__ebt_print_error(format, ##args); \
|
|
return -1;} while (0)
|
|
#define ebt_check_option2(flags,mask) \
|
|
({ebt_check_option(flags,mask);})
|
|
#define ebt_check_inverse2(option) \
|
|
({int __ret = ebt_check_inverse(option); \
|
|
if (!optarg) { \
|
|
__ebt_print_error("Option without (mandatory) argument"); \
|
|
return -1; \
|
|
} \
|
|
__ret;})
|
|
#define ebt_print_memory() do {printf("Ebtables: " __FILE__ \
|
|
" %s %d :Out of memory.\n", __FUNCTION__, __LINE__); exit(-1);} while (0)
|
|
|
|
/* used for keeping the rule counters right during rule adds or deletes */
|
|
#define CNT_NORM 0
|
|
#define CNT_DEL 1
|
|
#define CNT_ADD 2
|
|
#define CNT_CHANGE 3
|
|
|
|
extern const char *ebt_hooknames[NF_BR_NUMHOOKS];
|
|
extern const char *ebt_standard_targets[NUM_STANDARD_TARGETS];
|
|
|
|
/*
|
|
* Transforms a target string into the right integer,
|
|
* returns 0 on success.
|
|
*/
|
|
#define FILL_TARGET(_str, _pos) ({ \
|
|
int _i, _ret = 0; \
|
|
for (_i = 0; _i < NUM_STANDARD_TARGETS; _i++) \
|
|
if (!strcmp(_str, ebt_standard_targets[_i])) {\
|
|
_pos = -_i - 1; \
|
|
break; \
|
|
} \
|
|
if (_i == NUM_STANDARD_TARGETS) \
|
|
_ret = 1; \
|
|
_ret; \
|
|
})
|
|
|
|
/* Transforms the target value to an index into standard_targets[] */
|
|
#define TARGET_INDEX(_value) (-_value - 1)
|
|
/* Returns a target string corresponding to the value */
|
|
#define TARGET_NAME(_value) (ebt_standard_targets[TARGET_INDEX(_value)])
|
|
/* True if the hook mask denotes that the rule is in a base chain */
|
|
#define BASE_CHAIN (hookmask & (1 << NF_BR_NUMHOOKS))
|
|
/* Clear the bit in the hook_mask that tells if the rule is on a base chain */
|
|
#define CLEAR_BASE_CHAIN_BIT (hookmask &= ~(1 << NF_BR_NUMHOOKS))
|
|
#define PRINT_VERSION printf("ebtables (tiny)\n")
|
|
|
|
#ifndef ARRAY_SIZE
|
|
# define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
|
|
#endif
|
|
#endif /* EBTABLES_U_H */
|