1 /*
2 * ebtables.c, v2.0 July 2002
3 *
4 * Author: Bart De Schuymer
5 *
6 * This code was stongly inspired on the iptables code which is
7 * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
8 *
9 * This program is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU General Public License as
11 * published by the Free Software Foundation; either version 2 of the
12 * License, or (at your option) any later version.
13 *
14 * This program is distributed in the hope that it will be useful, but
15 * WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
17 * General Public License for more details.
18 *
19 * You should have received a copy of the GNU General Public License
20 * along with this program; if not, write to the Free Software
21 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
22 */
23 #include "config.h"
24 #include <ctype.h>
25 #include <errno.h>
26 #include <getopt.h>
27 #include <string.h>
28 #include <stdio.h>
29 #include <stdlib.h>
30 #include <stdarg.h>
31 #include <inttypes.h>
32 #include <signal.h>
33 #include <net/if.h>
34 #include <netinet/ether.h>
35 #include <iptables.h>
36 #include <xtables.h>
37
38 #include <linux/netfilter_bridge.h>
39 #include <linux/netfilter/nf_tables.h>
40 #include <libiptc/libxtc.h>
41 #include "xshared.h"
42 #include "nft.h"
43 #include "nft-bridge.h"
44
45 /*
46 * From include/ebtables_u.h
47 */
48 #define ebt_check_option2(flags, mask) EBT_CHECK_OPTION(flags, mask)
49
50 /*
51 * From useful_functions.c
52 */
53
54 /* 0: default
55 * 1: the inverse '!' of the option has already been specified */
56 int ebt_invert = 0;
57
ebt_check_inverse2(const char option[],int argc,char ** argv)58 static int ebt_check_inverse2(const char option[], int argc, char **argv)
59 {
60 if (!option)
61 return ebt_invert;
62 if (strcmp(option, "!") == 0) {
63 if (ebt_invert == 1)
64 xtables_error(PARAMETER_PROBLEM,
65 "Double use of '!' not allowed");
66 if (optind >= argc)
67 optarg = NULL;
68 else
69 optarg = argv[optind];
70 optind++;
71 ebt_invert = 1;
72 return 1;
73 }
74 return ebt_invert;
75 }
76
77 /*
78 * Glue code to use libxtables
79 */
parse_rule_number(const char * rule)80 static int parse_rule_number(const char *rule)
81 {
82 unsigned int rule_nr;
83
84 if (!xtables_strtoui(rule, NULL, &rule_nr, 1, INT_MAX))
85 xtables_error(PARAMETER_PROBLEM,
86 "Invalid rule number `%s'", rule);
87
88 return rule_nr;
89 }
90
91 static int
append_entry(struct nft_handle * h,const char * chain,const char * table,struct iptables_command_state * cs,int rule_nr,bool verbose,bool append)92 append_entry(struct nft_handle *h,
93 const char *chain,
94 const char *table,
95 struct iptables_command_state *cs,
96 int rule_nr,
97 bool verbose, bool append)
98 {
99 int ret = 1;
100
101 if (append)
102 ret = nft_cmd_rule_append(h, chain, table, cs, NULL, verbose);
103 else
104 ret = nft_cmd_rule_insert(h, chain, table, cs, rule_nr, verbose);
105
106 return ret;
107 }
108
109 static int
delete_entry(struct nft_handle * h,const char * chain,const char * table,struct iptables_command_state * cs,int rule_nr,int rule_nr_end,bool verbose)110 delete_entry(struct nft_handle *h,
111 const char *chain,
112 const char *table,
113 struct iptables_command_state *cs,
114 int rule_nr,
115 int rule_nr_end,
116 bool verbose)
117 {
118 int ret = 1;
119
120 if (rule_nr == -1)
121 ret = nft_cmd_rule_delete(h, chain, table, cs, verbose);
122 else {
123 do {
124 ret = nft_cmd_rule_delete_num(h, chain, table,
125 rule_nr, verbose);
126 rule_nr++;
127 } while (rule_nr < rule_nr_end);
128 }
129
130 return ret;
131 }
132
ebt_get_current_chain(const char * chain)133 int ebt_get_current_chain(const char *chain)
134 {
135 if (!chain)
136 return -1;
137
138 if (strcmp(chain, "PREROUTING") == 0)
139 return NF_BR_PRE_ROUTING;
140 else if (strcmp(chain, "INPUT") == 0)
141 return NF_BR_LOCAL_IN;
142 else if (strcmp(chain, "FORWARD") == 0)
143 return NF_BR_FORWARD;
144 else if (strcmp(chain, "OUTPUT") == 0)
145 return NF_BR_LOCAL_OUT;
146 else if (strcmp(chain, "POSTROUTING") == 0)
147 return NF_BR_POST_ROUTING;
148
149 /* placeholder for user defined chain */
150 return NF_BR_NUMHOOKS;
151 }
152
153 /*
154 * The original ebtables parser
155 */
156
157 /* Checks whether a command has already been specified */
158 #define OPT_COMMANDS (flags & OPT_COMMAND || flags & OPT_ZERO)
159
160 #define OPT_COMMAND 0x01
161 #define OPT_TABLE 0x02
162 #define OPT_IN 0x04
163 #define OPT_OUT 0x08
164 #define OPT_JUMP 0x10
165 #define OPT_PROTOCOL 0x20
166 #define OPT_SOURCE 0x40
167 #define OPT_DEST 0x80
168 #define OPT_ZERO 0x100
169 #define OPT_LOGICALIN 0x200
170 #define OPT_LOGICALOUT 0x400
171 #define OPT_KERNELDATA 0x800 /* This value is also defined in ebtablesd.c */
172 #define OPT_COUNT 0x1000 /* This value is also defined in libebtc.c */
173 #define OPT_CNT_INCR 0x2000 /* This value is also defined in libebtc.c */
174 #define OPT_CNT_DECR 0x4000 /* This value is also defined in libebtc.c */
175
176 /* Default command line options. Do not mess around with the already
177 * assigned numbers unless you know what you are doing */
178 struct option ebt_original_options[] =
179 {
180 { "append" , required_argument, 0, 'A' },
181 { "insert" , required_argument, 0, 'I' },
182 { "delete" , required_argument, 0, 'D' },
183 { "list" , optional_argument, 0, 'L' },
184 { "Lc" , no_argument , 0, 4 },
185 { "Ln" , no_argument , 0, 5 },
186 { "Lx" , no_argument , 0, 6 },
187 { "Lmac2" , no_argument , 0, 12 },
188 { "zero" , optional_argument, 0, 'Z' },
189 { "flush" , optional_argument, 0, 'F' },
190 { "policy" , required_argument, 0, 'P' },
191 { "in-interface" , required_argument, 0, 'i' },
192 { "in-if" , required_argument, 0, 'i' },
193 { "logical-in" , required_argument, 0, 2 },
194 { "logical-out" , required_argument, 0, 3 },
195 { "out-interface" , required_argument, 0, 'o' },
196 { "out-if" , required_argument, 0, 'o' },
197 { "version" , no_argument , 0, 'V' },
198 { "help" , no_argument , 0, 'h' },
199 { "jump" , required_argument, 0, 'j' },
200 { "set-counters" , required_argument, 0, 'c' },
201 { "change-counters", required_argument, 0, 'C' },
202 { "proto" , required_argument, 0, 'p' },
203 { "protocol" , required_argument, 0, 'p' },
204 { "db" , required_argument, 0, 'b' },
205 { "source" , required_argument, 0, 's' },
206 { "src" , required_argument, 0, 's' },
207 { "destination" , required_argument, 0, 'd' },
208 { "dst" , required_argument, 0, 'd' },
209 { "table" , required_argument, 0, 't' },
210 { "modprobe" , required_argument, 0, 'M' },
211 { "new-chain" , required_argument, 0, 'N' },
212 { "rename-chain" , required_argument, 0, 'E' },
213 { "delete-chain" , optional_argument, 0, 'X' },
214 { "atomic-init" , no_argument , 0, 7 },
215 { "atomic-commit" , no_argument , 0, 8 },
216 { "atomic-file" , required_argument, 0, 9 },
217 { "atomic-save" , no_argument , 0, 10 },
218 { "init-table" , no_argument , 0, 11 },
219 { "concurrent" , no_argument , 0, 13 },
220 { 0 }
221 };
222
223 extern void xtables_exit_error(enum xtables_exittype status, const char *msg, ...) __attribute__((noreturn, format(printf,2,3)));
224 struct xtables_globals ebtables_globals = {
225 .option_offset = 0,
226 .program_version = PACKAGE_VERSION,
227 .orig_opts = ebt_original_options,
228 .exit_err = xtables_exit_error,
229 .compat_rev = nft_compatible_revision,
230 };
231
232 #define opts ebtables_globals.opts
233 #define prog_name ebtables_globals.program_name
234 #define prog_vers ebtables_globals.program_version
235
236 /*
237 * From libebtc.c
238 */
239
240 /* Prints all registered extensions */
ebt_list_extensions(const struct xtables_target * t,const struct xtables_rule_match * m)241 static void ebt_list_extensions(const struct xtables_target *t,
242 const struct xtables_rule_match *m)
243 {
244 printf("%s v%s\n", prog_name, prog_vers);
245 printf("Loaded userspace extensions:\n");
246 /*printf("\nLoaded tables:\n");
247 while (tbl) {
248 printf("%s\n", tbl->name);
249 tbl = tbl->next;
250 }*/
251 printf("\nLoaded targets:\n");
252 for (t = xtables_targets; t; t = t->next) {
253 printf("%s\n", t->name);
254 }
255 printf("\nLoaded matches:\n");
256 for (; m != NULL; m = m->next)
257 printf("%s\n", m->match->name);
258 /*printf("\nLoaded watchers:\n");
259 while (w) {
260 printf("%s\n", w->name);
261 w = w->next;
262 }*/
263 }
264
265 #define OPTION_OFFSET 256
merge_options(struct option * oldopts,const struct option * newopts,unsigned int * options_offset)266 static struct option *merge_options(struct option *oldopts,
267 const struct option *newopts,
268 unsigned int *options_offset)
269 {
270 unsigned int num_old, num_new, i;
271 struct option *merge;
272
273 if (!newopts || !oldopts || !options_offset)
274 return oldopts;
275 for (num_old = 0; oldopts[num_old].name; num_old++);
276 for (num_new = 0; newopts[num_new].name; num_new++);
277
278 ebtables_globals.option_offset += OPTION_OFFSET;
279 *options_offset = ebtables_globals.option_offset;
280
281 merge = malloc(sizeof(struct option) * (num_new + num_old + 1));
282 if (!merge)
283 return NULL;
284 memcpy(merge, oldopts, num_old * sizeof(struct option));
285 for (i = 0; i < num_new; i++) {
286 merge[num_old + i] = newopts[i];
287 merge[num_old + i].val += *options_offset;
288 }
289 memset(merge + num_old + num_new, 0, sizeof(struct option));
290 /* Only free dynamically allocated stuff */
291 if (oldopts != ebt_original_options)
292 free(oldopts);
293
294 return merge;
295 }
296
print_help(const struct xtables_target * t,const struct xtables_rule_match * m,const char * table)297 static void print_help(const struct xtables_target *t,
298 const struct xtables_rule_match *m, const char *table)
299 {
300 printf("%s %s\n", prog_name, prog_vers);
301 printf(
302 "Usage:\n"
303 "ebtables -[ADI] chain rule-specification [options]\n"
304 "ebtables -P chain target\n"
305 "ebtables -[LFZ] [chain]\n"
306 "ebtables -[NX] [chain]\n"
307 "ebtables -E old-chain-name new-chain-name\n\n"
308 "Commands:\n"
309 "--append -A chain : append to chain\n"
310 "--delete -D chain : delete matching rule from chain\n"
311 "--delete -D chain rulenum : delete rule at position rulenum from chain\n"
312 "--change-counters -C chain\n"
313 " [rulenum] pcnt bcnt : change counters of existing rule\n"
314 "--insert -I chain rulenum : insert rule at position rulenum in chain\n"
315 "--list -L [chain] : list the rules in a chain or in all chains\n"
316 "--flush -F [chain] : delete all rules in chain or in all chains\n"
317 "--init-table : replace the kernel table with the initial table\n"
318 "--zero -Z [chain] : put counters on zero in chain or in all chains\n"
319 "--policy -P chain target : change policy on chain to target\n"
320 "--new-chain -N chain : create a user defined chain\n"
321 "--rename-chain -E old new : rename a chain\n"
322 "--delete-chain -X [chain] : delete a user defined chain\n"
323 "--atomic-commit : update the kernel w/t table contained in <FILE>\n"
324 "--atomic-init : put the initial kernel table into <FILE>\n"
325 "--atomic-save : put the current kernel table into <FILE>\n"
326 "--atomic-file file : set <FILE> to file\n\n"
327 "Options:\n"
328 "--proto -p [!] proto : protocol hexadecimal, by name or LENGTH\n"
329 "--src -s [!] address[/mask]: source mac address\n"
330 "--dst -d [!] address[/mask]: destination mac address\n"
331 "--in-if -i [!] name[+] : network input interface name\n"
332 "--out-if -o [!] name[+] : network output interface name\n"
333 "--logical-in [!] name[+] : logical bridge input interface name\n"
334 "--logical-out [!] name[+] : logical bridge output interface name\n"
335 "--set-counters -c chain\n"
336 " pcnt bcnt : set the counters of the to be added rule\n"
337 "--modprobe -M program : try to insert modules using this program\n"
338 "--concurrent : use a file lock to support concurrent scripts\n"
339 "--version -V : print package version\n\n"
340 "Environment variable:\n"
341 /*ATOMIC_ENV_VARIABLE " : if set <FILE> (see above) will equal its value"*/
342 "\n\n");
343 for (; m != NULL; m = m->next) {
344 printf("\n");
345 m->match->help();
346 }
347 if (t != NULL) {
348 printf("\n");
349 t->help();
350 }
351
352 // if (table->help)
353 // table->help(ebt_hooknames);
354 }
355
356 /* Execute command L */
list_rules(struct nft_handle * h,const char * chain,const char * table,int rule_nr,int verbose,int numeric,int expanded,int linenumbers,int counters)357 static int list_rules(struct nft_handle *h, const char *chain, const char *table,
358 int rule_nr, int verbose, int numeric, int expanded,
359 int linenumbers, int counters)
360 {
361 unsigned int format;
362
363 format = FMT_OPTIONS | FMT_C_COUNTS;
364 if (verbose)
365 format |= FMT_VIA;
366
367 if (numeric)
368 format |= FMT_NUMERIC;
369
370 if (!expanded)
371 format |= FMT_KILOMEGAGIGA;
372
373 if (linenumbers)
374 format |= FMT_LINENUMBERS;
375
376 if (!counters)
377 format |= FMT_NOCOUNTS;
378
379 return nft_cmd_rule_list(h, chain, table, rule_nr, format);
380 }
381
parse_rule_range(const char * argv,int * rule_nr,int * rule_nr_end)382 static int parse_rule_range(const char *argv, int *rule_nr, int *rule_nr_end)
383 {
384 char *colon = strchr(argv, ':'), *buffer;
385
386 if (colon) {
387 *colon = '\0';
388 if (*(colon + 1) == '\0')
389 *rule_nr_end = -1; /* Until the last rule */
390 else {
391 *rule_nr_end = strtol(colon + 1, &buffer, 10);
392 if (*buffer != '\0' || *rule_nr_end == 0)
393 return -1;
394 }
395 }
396 if (colon == argv)
397 *rule_nr = 1; /* Beginning with the first rule */
398 else {
399 *rule_nr = strtol(argv, &buffer, 10);
400 if (*buffer != '\0' || *rule_nr == 0)
401 return -1;
402 }
403 if (!colon)
404 *rule_nr_end = *rule_nr;
405 return 0;
406 }
407
408 /* Incrementing or decrementing rules in daemon mode is not supported as the
409 * involved code overload is not worth it (too annoying to take the increased
410 * counters in the kernel into account). */
parse_change_counters_rule(int argc,char ** argv,int * rule_nr,int * rule_nr_end,struct iptables_command_state * cs)411 static int parse_change_counters_rule(int argc, char **argv, int *rule_nr, int *rule_nr_end, struct iptables_command_state *cs)
412 {
413 char *buffer;
414 int ret = 0;
415
416 if (optind + 1 >= argc || argv[optind][0] == '-' || argv[optind + 1][0] == '-')
417 xtables_error(PARAMETER_PROBLEM,
418 "The command -C needs at least 2 arguments");
419 if (optind + 2 < argc && (argv[optind + 2][0] != '-' || (argv[optind + 2][1] >= '0' && argv[optind + 2][1] <= '9'))) {
420 if (optind + 3 != argc)
421 xtables_error(PARAMETER_PROBLEM,
422 "No extra options allowed with -C start_nr[:end_nr] pcnt bcnt");
423 if (parse_rule_range(argv[optind], rule_nr, rule_nr_end))
424 xtables_error(PARAMETER_PROBLEM,
425 "Something is wrong with the rule number specification '%s'", argv[optind]);
426 optind++;
427 }
428
429 if (argv[optind][0] == '+') {
430 ret += 1;
431 cs->counters.pcnt = strtoull(argv[optind] + 1, &buffer, 10);
432 } else if (argv[optind][0] == '-') {
433 ret += 2;
434 cs->counters.pcnt = strtoull(argv[optind] + 1, &buffer, 10);
435 } else
436 cs->counters.pcnt = strtoull(argv[optind], &buffer, 10);
437
438 if (*buffer != '\0')
439 goto invalid;
440 optind++;
441 if (argv[optind][0] == '+') {
442 ret += 3;
443 cs->counters.bcnt = strtoull(argv[optind] + 1, &buffer, 10);
444 } else if (argv[optind][0] == '-') {
445 ret += 6;
446 cs->counters.bcnt = strtoull(argv[optind] + 1, &buffer, 10);
447 } else
448 cs->counters.bcnt = strtoull(argv[optind], &buffer, 10);
449
450 if (*buffer != '\0')
451 goto invalid;
452 optind++;
453 return ret;
454 invalid:
455 xtables_error(PARAMETER_PROBLEM,"Packet counter '%s' invalid", argv[optind]);
456 }
457
ebtables_parse_interface(const char * arg,char * vianame)458 static void ebtables_parse_interface(const char *arg, char *vianame)
459 {
460 unsigned char mask[IFNAMSIZ];
461 char *c;
462
463 xtables_parse_interface(arg, vianame, mask);
464
465 if ((c = strchr(vianame, '+'))) {
466 if (*(c + 1) != '\0')
467 xtables_error(PARAMETER_PROBLEM,
468 "Spurious characters after '+' wildcard");
469 }
470 }
471
472 /* This code is very similar to iptables/xtables.c:command_match() */
ebt_load_match(const char * name)473 static void ebt_load_match(const char *name)
474 {
475 struct xtables_match *m;
476 size_t size;
477
478 m = xtables_find_match(name, XTF_TRY_LOAD, NULL);
479 if (m == NULL) {
480 fprintf(stderr, "Unable to load %s match\n", name);
481 return;
482 }
483
484 size = XT_ALIGN(sizeof(struct xt_entry_match)) + m->size;
485 m->m = xtables_calloc(1, size);
486 m->m->u.match_size = size;
487 strcpy(m->m->u.user.name, m->name);
488 m->m->u.user.revision = m->revision;
489 xs_init_match(m);
490
491 opts = merge_options(opts, m->extra_opts, &m->option_offset);
492 if (opts == NULL)
493 xtables_error(OTHER_PROBLEM, "Can't alloc memory");
494 }
495
__ebt_load_watcher(const char * name,const char * typename)496 static void __ebt_load_watcher(const char *name, const char *typename)
497 {
498 struct xtables_target *watcher;
499 size_t size;
500
501 watcher = xtables_find_target(name, XTF_TRY_LOAD);
502 if (!watcher) {
503 fprintf(stderr, "Unable to load %s %s\n", name, typename);
504 return;
505 }
506
507 size = XT_ALIGN(sizeof(struct xt_entry_target)) + watcher->size;
508
509 watcher->t = xtables_calloc(1, size);
510 watcher->t->u.target_size = size;
511 snprintf(watcher->t->u.user.name,
512 sizeof(watcher->t->u.user.name), "%s", name);
513 watcher->t->u.user.name[sizeof(watcher->t->u.user.name)-1] = '\0';
514 watcher->t->u.user.revision = watcher->revision;
515
516 xs_init_target(watcher);
517
518 opts = merge_options(opts, watcher->extra_opts,
519 &watcher->option_offset);
520 if (opts == NULL)
521 xtables_error(OTHER_PROBLEM, "Can't alloc memory");
522 }
523
ebt_load_watcher(const char * name)524 static void ebt_load_watcher(const char *name)
525 {
526 return __ebt_load_watcher(name, "watcher");
527 }
528
ebt_load_target(const char * name)529 static void ebt_load_target(const char *name)
530 {
531 return __ebt_load_watcher(name, "target");
532 }
533
ebt_load_match_extensions(void)534 void ebt_load_match_extensions(void)
535 {
536 opts = ebt_original_options;
537 ebt_load_match("802_3");
538 ebt_load_match("arp");
539 ebt_load_match("ip");
540 ebt_load_match("ip6");
541 ebt_load_match("mark_m");
542 ebt_load_match("limit");
543 ebt_load_match("pkttype");
544 ebt_load_match("vlan");
545 ebt_load_match("stp");
546 ebt_load_match("among");
547
548 ebt_load_watcher("log");
549 ebt_load_watcher("nflog");
550
551 ebt_load_target("mark");
552 ebt_load_target("dnat");
553 ebt_load_target("snat");
554 ebt_load_target("arpreply");
555 ebt_load_target("redirect");
556 ebt_load_target("standard");
557 }
558
ebt_add_match(struct xtables_match * m,struct iptables_command_state * cs)559 void ebt_add_match(struct xtables_match *m,
560 struct iptables_command_state *cs)
561 {
562 struct xtables_rule_match **rule_matches = &cs->matches;
563 struct xtables_match *newm;
564 struct ebt_match *newnode, **matchp;
565 struct xt_entry_match *m2;
566
567 newm = xtables_find_match(m->name, XTF_LOAD_MUST_SUCCEED, rule_matches);
568 if (newm == NULL)
569 xtables_error(OTHER_PROBLEM,
570 "Unable to add match %s", m->name);
571
572 m2 = xtables_calloc(1, newm->m->u.match_size);
573 memcpy(m2, newm->m, newm->m->u.match_size);
574 memset(newm->m->data, 0, newm->size);
575 xs_init_match(newm);
576 newm->m = m2;
577
578 newm->mflags = m->mflags;
579 m->mflags = 0;
580
581 /* glue code for watchers */
582 newnode = calloc(1, sizeof(struct ebt_match));
583 if (newnode == NULL)
584 xtables_error(OTHER_PROBLEM, "Unable to alloc memory");
585
586 newnode->ismatch = true;
587 newnode->u.match = newm;
588
589 for (matchp = &cs->match_list; *matchp; matchp = &(*matchp)->next)
590 ;
591 *matchp = newnode;
592 }
593
ebt_add_watcher(struct xtables_target * watcher,struct iptables_command_state * cs)594 void ebt_add_watcher(struct xtables_target *watcher,
595 struct iptables_command_state *cs)
596 {
597 struct ebt_match *newnode, **matchp;
598 struct xtables_target *clone;
599
600 clone = xtables_malloc(sizeof(struct xtables_target));
601 memcpy(clone, watcher, sizeof(struct xtables_target));
602 clone->udata = NULL;
603 clone->tflags = watcher->tflags;
604 clone->next = clone;
605
606 clone->t = xtables_calloc(1, watcher->t->u.target_size);
607 memcpy(clone->t, watcher->t, watcher->t->u.target_size);
608
609 memset(watcher->t->data, 0, watcher->size);
610 xs_init_target(watcher);
611 watcher->tflags = 0;
612
613
614 newnode = calloc(1, sizeof(struct ebt_match));
615 if (newnode == NULL)
616 xtables_error(OTHER_PROBLEM, "Unable to alloc memory");
617
618 newnode->u.watcher = clone;
619
620 for (matchp = &cs->match_list; *matchp; matchp = &(*matchp)->next)
621 ;
622 *matchp = newnode;
623 }
624
ebt_command_default(struct iptables_command_state * cs)625 int ebt_command_default(struct iptables_command_state *cs)
626 {
627 struct xtables_target *t = cs->target;
628 struct xtables_match *m;
629 struct ebt_match *matchp;
630
631 /* Is it a target option? */
632 if (t && t->parse) {
633 if (t->parse(cs->c - t->option_offset, cs->argv,
634 ebt_invert, &t->tflags, NULL, &t->t))
635 return 0;
636 }
637
638 /* check previously added matches/watchers to this rule first */
639 for (matchp = cs->match_list; matchp; matchp = matchp->next) {
640 if (matchp->ismatch) {
641 m = matchp->u.match;
642 if (m->parse &&
643 m->parse(cs->c - m->option_offset, cs->argv,
644 ebt_invert, &m->mflags, NULL, &m->m))
645 return 0;
646 } else {
647 t = matchp->u.watcher;
648 if (t->parse &&
649 t->parse(cs->c - t->option_offset, cs->argv,
650 ebt_invert, &t->tflags, NULL, &t->t))
651 return 0;
652 }
653 }
654
655 /* Is it a match_option? */
656 for (m = xtables_matches; m; m = m->next) {
657 if (m->parse &&
658 m->parse(cs->c - m->option_offset, cs->argv,
659 ebt_invert, &m->mflags, NULL, &m->m)) {
660 ebt_add_match(m, cs);
661 return 0;
662 }
663 }
664
665 /* Is it a watcher option? */
666 for (t = xtables_targets; t; t = t->next) {
667 if (t->parse &&
668 t->parse(cs->c - t->option_offset, cs->argv,
669 ebt_invert, &t->tflags, NULL, &t->t)) {
670 ebt_add_watcher(t, cs);
671 return 0;
672 }
673 }
674 return 1;
675 }
676
nft_init_eb(struct nft_handle * h,const char * pname)677 int nft_init_eb(struct nft_handle *h, const char *pname)
678 {
679 ebtables_globals.program_name = pname;
680 if (xtables_init_all(&ebtables_globals, NFPROTO_BRIDGE) < 0) {
681 fprintf(stderr, "%s/%s Failed to initialize ebtables-compat\n",
682 ebtables_globals.program_name,
683 ebtables_globals.program_version);
684 exit(1);
685 }
686
687 #if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS)
688 init_extensionsb();
689 #endif
690
691 if (nft_init(h, NFPROTO_BRIDGE, xtables_bridge) < 0)
692 xtables_error(OTHER_PROBLEM,
693 "Could not initialize nftables layer.");
694
695 /* manually registering ebt matches, given the original ebtables parser
696 * don't use '-m matchname' and the match can't be loaded dynamically when
697 * the user calls it.
698 */
699 ebt_load_match_extensions();
700
701 return 0;
702 }
703
nft_fini_eb(struct nft_handle * h)704 void nft_fini_eb(struct nft_handle *h)
705 {
706 struct xtables_match *match;
707 struct xtables_target *target;
708
709 for (match = xtables_matches; match; match = match->next) {
710 free(match->m);
711 }
712 for (target = xtables_targets; target; target = target->next) {
713 free(target->t);
714 }
715
716 free(opts);
717
718 nft_fini(h);
719 xtables_fini();
720 }
721
do_commandeb(struct nft_handle * h,int argc,char * argv[],char ** table,bool restore)722 int do_commandeb(struct nft_handle *h, int argc, char *argv[], char **table,
723 bool restore)
724 {
725 char *buffer;
726 int c, i;
727 int chcounter = 0; /* Needed for -C */
728 int rule_nr = 0;
729 int rule_nr_end = 0;
730 int ret = 0;
731 unsigned int flags = 0;
732 struct xtables_target *t;
733 struct iptables_command_state cs = {
734 .argv = argv,
735 .jumpto = "",
736 .eb.bitmask = EBT_NOPROTO,
737 };
738 char command = 'h';
739 const char *chain = NULL;
740 const char *policy = NULL;
741 int selected_chain = -1;
742 struct xtables_rule_match *xtrm_i;
743 struct ebt_match *match;
744 bool table_set = false;
745
746 /* prevent getopt to spoil our error reporting */
747 optind = 0;
748 opterr = false;
749
750 /* Getopt saves the day */
751 while ((c = getopt_long(argc, argv,
752 "-A:D:C:I:N:E:X::L::Z::F::P:Vhi:o:j:c:p:s:d:t:M:", opts, NULL)) != -1) {
753 cs.c = c;
754 cs.invert = ebt_invert;
755 switch (c) {
756
757 case 'A': /* Add a rule */
758 case 'D': /* Delete a rule */
759 case 'C': /* Change counters */
760 case 'P': /* Define policy */
761 case 'I': /* Insert a rule */
762 case 'N': /* Make a user defined chain */
763 case 'E': /* Rename chain */
764 case 'X': /* Delete chain */
765 /* We allow -N chainname -P policy */
766 if (command == 'N' && c == 'P') {
767 command = c;
768 optind--; /* No table specified */
769 goto handle_P;
770 }
771 if (OPT_COMMANDS)
772 xtables_error(PARAMETER_PROBLEM,
773 "Multiple commands are not allowed");
774
775 command = c;
776 if (optarg && (optarg[0] == '-' || !strcmp(optarg, "!")))
777 xtables_error(PARAMETER_PROBLEM, "No chain name specified");
778 chain = optarg;
779 selected_chain = ebt_get_current_chain(chain);
780 flags |= OPT_COMMAND;
781
782 if (c == 'N') {
783 ret = nft_cmd_chain_user_add(h, chain, *table);
784 break;
785 } else if (c == 'X') {
786 /* X arg is optional, optarg is NULL */
787 if (!chain && optind < argc && argv[optind][0] != '-') {
788 chain = argv[optind];
789 optind++;
790 }
791 ret = nft_cmd_chain_user_del(h, chain, *table, 0);
792 break;
793 }
794
795 if (c == 'E') {
796 if (optind >= argc)
797 xtables_error(PARAMETER_PROBLEM, "No new chain name specified");
798 else if (optind < argc - 1)
799 xtables_error(PARAMETER_PROBLEM, "No extra options allowed with -E");
800 else if (strlen(argv[optind]) >= NFT_CHAIN_MAXNAMELEN)
801 xtables_error(PARAMETER_PROBLEM, "Chain name length can't exceed %d"" characters", NFT_CHAIN_MAXNAMELEN - 1);
802 else if (strchr(argv[optind], ' ') != NULL)
803 xtables_error(PARAMETER_PROBLEM, "Use of ' ' not allowed in chain names");
804
805 errno = 0;
806 ret = nft_cmd_chain_user_rename(h, chain, *table,
807 argv[optind]);
808 if (ret != 0 && errno == ENOENT)
809 xtables_error(PARAMETER_PROBLEM, "Chain '%s' doesn't exists", chain);
810
811 optind++;
812 break;
813 } else if (c == 'D' && optind < argc && (argv[optind][0] != '-' || (argv[optind][1] >= '0' && argv[optind][1] <= '9'))) {
814 if (optind != argc - 1)
815 xtables_error(PARAMETER_PROBLEM,
816 "No extra options allowed with -D start_nr[:end_nr]");
817 if (parse_rule_range(argv[optind], &rule_nr, &rule_nr_end))
818 xtables_error(PARAMETER_PROBLEM,
819 "Problem with the specified rule number(s) '%s'", argv[optind]);
820 optind++;
821 } else if (c == 'C') {
822 if ((chcounter = parse_change_counters_rule(argc, argv, &rule_nr, &rule_nr_end, &cs)) == -1)
823 return -1;
824 } else if (c == 'I') {
825 if (optind >= argc || (argv[optind][0] == '-' && (argv[optind][1] < '0' || argv[optind][1] > '9')))
826 rule_nr = 1;
827 else {
828 rule_nr = parse_rule_number(argv[optind]);
829 optind++;
830 }
831 } else if (c == 'P') {
832 handle_P:
833 if (optind >= argc)
834 xtables_error(PARAMETER_PROBLEM,
835 "No policy specified");
836 for (i = 0; i < NUM_STANDARD_TARGETS; i++)
837 if (!strcmp(argv[optind], nft_ebt_standard_target(i))) {
838 policy = argv[optind];
839 if (-i-1 == EBT_CONTINUE)
840 xtables_error(PARAMETER_PROBLEM,
841 "Wrong policy '%s'",
842 argv[optind]);
843 break;
844 }
845 if (i == NUM_STANDARD_TARGETS)
846 xtables_error(PARAMETER_PROBLEM,
847 "Unknown policy '%s'", argv[optind]);
848 optind++;
849 }
850 break;
851 case 'L': /* List */
852 case 'F': /* Flush */
853 case 'Z': /* Zero counters */
854 if (c == 'Z') {
855 if ((flags & OPT_ZERO) || (flags & OPT_COMMAND && command != 'L'))
856 print_zero:
857 xtables_error(PARAMETER_PROBLEM,
858 "Command -Z only allowed together with command -L");
859 flags |= OPT_ZERO;
860 } else {
861 if (flags & OPT_COMMAND)
862 xtables_error(PARAMETER_PROBLEM,
863 "Multiple commands are not allowed");
864 command = c;
865 flags |= OPT_COMMAND;
866 if (flags & OPT_ZERO && c != 'L')
867 goto print_zero;
868 }
869
870 if (optind < argc && argv[optind][0] != '-') {
871 chain = argv[optind];
872 optind++;
873 }
874 break;
875 case 'V': /* Version */
876 if (OPT_COMMANDS)
877 xtables_error(PARAMETER_PROBLEM,
878 "Multiple commands are not allowed");
879 printf("%s %s (nf_tables)\n", prog_name, prog_vers);
880 exit(0);
881 case 'h': /* Help */
882 if (OPT_COMMANDS)
883 xtables_error(PARAMETER_PROBLEM,
884 "Multiple commands are not allowed");
885 command = 'h';
886
887 /* All other arguments should be extension names */
888 while (optind < argc) {
889 /*struct ebt_u_match *m;
890 struct ebt_u_watcher *w;*/
891
892 if (!strcasecmp("list_extensions", argv[optind])) {
893 ebt_list_extensions(xtables_targets, cs.matches);
894 exit(0);
895 }
896 /*if ((m = ebt_find_match(argv[optind])))
897 ebt_add_match(new_entry, m);
898 else if ((w = ebt_find_watcher(argv[optind])))
899 ebt_add_watcher(new_entry, w);
900 else {*/
901 if (!(t = xtables_find_target(argv[optind], XTF_TRY_LOAD)))
902 xtables_error(PARAMETER_PROBLEM,"Extension '%s' not found", argv[optind]);
903 if (flags & OPT_JUMP)
904 xtables_error(PARAMETER_PROBLEM,"Sorry, you can only see help for one target extension at a time");
905 flags |= OPT_JUMP;
906 cs.target = t;
907 //}
908 optind++;
909 }
910 break;
911 case 't': /* Table */
912 ebt_check_option2(&flags, OPT_TABLE);
913 if (restore && table_set)
914 xtables_error(PARAMETER_PROBLEM,
915 "The -t option (seen in line %u) cannot be used in %s.\n",
916 line, xt_params->program_name);
917 if (strlen(optarg) > EBT_TABLE_MAXNAMELEN - 1)
918 xtables_error(PARAMETER_PROBLEM,
919 "Table name length cannot exceed %d characters",
920 EBT_TABLE_MAXNAMELEN - 1);
921 *table = optarg;
922 table_set = true;
923 break;
924 case 'i': /* Input interface */
925 case 2 : /* Logical input interface */
926 case 'o': /* Output interface */
927 case 3 : /* Logical output interface */
928 case 'j': /* Target */
929 case 'p': /* Net family protocol */
930 case 's': /* Source mac */
931 case 'd': /* Destination mac */
932 case 'c': /* Set counters */
933 if (!OPT_COMMANDS)
934 xtables_error(PARAMETER_PROBLEM,
935 "No command specified");
936 if (command != 'A' && command != 'D' && command != 'I' && command != 'C')
937 xtables_error(PARAMETER_PROBLEM,
938 "Command and option do not match");
939 if (c == 'i') {
940 ebt_check_option2(&flags, OPT_IN);
941 if (selected_chain > 2 && selected_chain < NF_BR_BROUTING)
942 xtables_error(PARAMETER_PROBLEM,
943 "Use -i only in INPUT, FORWARD, PREROUTING and BROUTING chains");
944 if (ebt_check_inverse2(optarg, argc, argv))
945 cs.eb.invflags |= EBT_IIN;
946
947 ebtables_parse_interface(optarg, cs.eb.in);
948 break;
949 } else if (c == 2) {
950 ebt_check_option2(&flags, OPT_LOGICALIN);
951 if (selected_chain > 2 && selected_chain < NF_BR_BROUTING)
952 xtables_error(PARAMETER_PROBLEM,
953 "Use --logical-in only in INPUT, FORWARD, PREROUTING and BROUTING chains");
954 if (ebt_check_inverse2(optarg, argc, argv))
955 cs.eb.invflags |= EBT_ILOGICALIN;
956
957 ebtables_parse_interface(optarg, cs.eb.logical_in);
958 break;
959 } else if (c == 'o') {
960 ebt_check_option2(&flags, OPT_OUT);
961 if (selected_chain < 2 || selected_chain == NF_BR_BROUTING)
962 xtables_error(PARAMETER_PROBLEM,
963 "Use -o only in OUTPUT, FORWARD and POSTROUTING chains");
964 if (ebt_check_inverse2(optarg, argc, argv))
965 cs.eb.invflags |= EBT_IOUT;
966
967 ebtables_parse_interface(optarg, cs.eb.out);
968 break;
969 } else if (c == 3) {
970 ebt_check_option2(&flags, OPT_LOGICALOUT);
971 if (selected_chain < 2 || selected_chain == NF_BR_BROUTING)
972 xtables_error(PARAMETER_PROBLEM,
973 "Use --logical-out only in OUTPUT, FORWARD and POSTROUTING chains");
974 if (ebt_check_inverse2(optarg, argc, argv))
975 cs.eb.invflags |= EBT_ILOGICALOUT;
976
977 ebtables_parse_interface(optarg, cs.eb.logical_out);
978 break;
979 } else if (c == 'j') {
980 ebt_check_option2(&flags, OPT_JUMP);
981 if (strcmp(optarg, "CONTINUE") != 0) {
982 command_jump(&cs, optarg);
983 }
984 break;
985 } else if (c == 's') {
986 ebt_check_option2(&flags, OPT_SOURCE);
987 if (ebt_check_inverse2(optarg, argc, argv))
988 cs.eb.invflags |= EBT_ISOURCE;
989
990 if (xtables_parse_mac_and_mask(optarg,
991 cs.eb.sourcemac,
992 cs.eb.sourcemsk))
993 xtables_error(PARAMETER_PROBLEM, "Problem with specified source mac '%s'", optarg);
994 cs.eb.bitmask |= EBT_SOURCEMAC;
995 break;
996 } else if (c == 'd') {
997 ebt_check_option2(&flags, OPT_DEST);
998 if (ebt_check_inverse2(optarg, argc, argv))
999 cs.eb.invflags |= EBT_IDEST;
1000
1001 if (xtables_parse_mac_and_mask(optarg,
1002 cs.eb.destmac,
1003 cs.eb.destmsk))
1004 xtables_error(PARAMETER_PROBLEM, "Problem with specified destination mac '%s'", optarg);
1005 cs.eb.bitmask |= EBT_DESTMAC;
1006 break;
1007 } else if (c == 'c') {
1008 ebt_check_option2(&flags, OPT_COUNT);
1009 if (ebt_check_inverse2(optarg, argc, argv))
1010 xtables_error(PARAMETER_PROBLEM,
1011 "Unexpected '!' after -c");
1012 if (optind >= argc || optarg[0] == '-' || argv[optind][0] == '-')
1013 xtables_error(PARAMETER_PROBLEM,
1014 "Option -c needs 2 arguments");
1015
1016 cs.counters.pcnt = strtoull(optarg, &buffer, 10);
1017 if (*buffer != '\0')
1018 xtables_error(PARAMETER_PROBLEM,
1019 "Packet counter '%s' invalid",
1020 optarg);
1021 cs.counters.bcnt = strtoull(argv[optind], &buffer, 10);
1022 if (*buffer != '\0')
1023 xtables_error(PARAMETER_PROBLEM,
1024 "Packet counter '%s' invalid",
1025 argv[optind]);
1026 optind++;
1027 break;
1028 }
1029 ebt_check_option2(&flags, OPT_PROTOCOL);
1030 if (ebt_check_inverse2(optarg, argc, argv))
1031 cs.eb.invflags |= EBT_IPROTO;
1032
1033 cs.eb.bitmask &= ~((unsigned int)EBT_NOPROTO);
1034 i = strtol(optarg, &buffer, 16);
1035 if (*buffer == '\0' && (i < 0 || i > 0xFFFF))
1036 xtables_error(PARAMETER_PROBLEM,
1037 "Problem with the specified protocol");
1038 if (*buffer != '\0') {
1039 struct xt_ethertypeent *ent;
1040
1041 if (!strcasecmp(optarg, "LENGTH")) {
1042 cs.eb.bitmask |= EBT_802_3;
1043 break;
1044 }
1045 ent = xtables_getethertypebyname(optarg);
1046 if (!ent)
1047 xtables_error(PARAMETER_PROBLEM,
1048 "Problem with the specified Ethernet protocol '%s', perhaps "XT_PATH_ETHERTYPES " is missing", optarg);
1049 cs.eb.ethproto = ent->e_ethertype;
1050 } else
1051 cs.eb.ethproto = i;
1052
1053 if (cs.eb.ethproto < 0x0600)
1054 xtables_error(PARAMETER_PROBLEM,
1055 "Sorry, protocols have values above or equal to 0x0600");
1056 break;
1057 case 4 : /* Lc */
1058 ebt_check_option2(&flags, LIST_C);
1059 if (command != 'L')
1060 xtables_error(PARAMETER_PROBLEM,
1061 "Use --Lc with -L");
1062 flags |= LIST_C;
1063 break;
1064 case 5 : /* Ln */
1065 ebt_check_option2(&flags, LIST_N);
1066 if (command != 'L')
1067 xtables_error(PARAMETER_PROBLEM,
1068 "Use --Ln with -L");
1069 if (flags & LIST_X)
1070 xtables_error(PARAMETER_PROBLEM,
1071 "--Lx is not compatible with --Ln");
1072 flags |= LIST_N;
1073 break;
1074 case 6 : /* Lx */
1075 ebt_check_option2(&flags, LIST_X);
1076 if (command != 'L')
1077 xtables_error(PARAMETER_PROBLEM,
1078 "Use --Lx with -L");
1079 if (flags & LIST_N)
1080 xtables_error(PARAMETER_PROBLEM,
1081 "--Lx is not compatible with --Ln");
1082 flags |= LIST_X;
1083 break;
1084 case 12 : /* Lmac2 */
1085 ebt_check_option2(&flags, LIST_MAC2);
1086 if (command != 'L')
1087 xtables_error(PARAMETER_PROBLEM,
1088 "Use --Lmac2 with -L");
1089 flags |= LIST_MAC2;
1090 break;
1091 case 8 : /* atomic-commit */
1092 /*
1093 replace->command = c;
1094 if (OPT_COMMANDS)
1095 ebt_print_error2("Multiple commands are not allowed");
1096 replace->flags |= OPT_COMMAND;
1097 if (!replace->filename)
1098 ebt_print_error2("No atomic file specified");*/
1099 /* Get the information from the file */
1100 /*ebt_get_table(replace, 0);*/
1101 /* We don't want the kernel giving us its counters,
1102 * they would overwrite the counters extracted from
1103 * the file */
1104 /*replace->num_counters = 0;*/
1105 /* Make sure the table will be written to the kernel */
1106 /*free(replace->filename);
1107 replace->filename = NULL;
1108 break;*/
1109 /*case 7 :*/ /* atomic-init */
1110 /*case 10:*/ /* atomic-save */
1111 case 11: /* init-table */
1112 nft_cmd_table_flush(h, *table, false);
1113 return 1;
1114 /*
1115 replace->command = c;
1116 if (OPT_COMMANDS)
1117 ebt_print_error2("Multiple commands are not allowed");
1118 if (c != 11 && !replace->filename)
1119 ebt_print_error2("No atomic file specified");
1120 replace->flags |= OPT_COMMAND;
1121 {
1122 char *tmp = replace->filename;*/
1123
1124 /* Get the kernel table */
1125 /*replace->filename = NULL;
1126 ebt_get_kernel_table(replace, c == 10 ? 0 : 1);
1127 replace->filename = tmp;
1128 }
1129 break;
1130 case 9 :*/ /* atomic */
1131 /*
1132 if (OPT_COMMANDS)
1133 ebt_print_error2("--atomic has to come before the command");*/
1134 /* A possible memory leak here, but this is not
1135 * executed in daemon mode */
1136 /*replace->filename = (char *)malloc(strlen(optarg) + 1);
1137 strcpy(replace->filename, optarg);
1138 break; */
1139 case 13 :
1140 break;
1141 case 1 :
1142 if (!strcmp(optarg, "!"))
1143 ebt_check_inverse2(optarg, argc, argv);
1144 else
1145 xtables_error(PARAMETER_PROBLEM,
1146 "Bad argument : '%s'", optarg);
1147 /* ebt_ebt_check_inverse2() did optind++ */
1148 optind--;
1149 continue;
1150 default:
1151 ebt_check_inverse2(optarg, argc, argv);
1152
1153 if (ebt_command_default(&cs))
1154 xtables_error(PARAMETER_PROBLEM,
1155 "Unknown argument: '%s'",
1156 argv[optind]);
1157
1158 if (command != 'A' && command != 'I' &&
1159 command != 'D' && command != 'C')
1160 xtables_error(PARAMETER_PROBLEM,
1161 "Extensions only for -A, -I, -D and -C");
1162 }
1163 ebt_invert = 0;
1164 }
1165
1166 /* Just in case we didn't catch an error */
1167 /*if (ebt_errormsg[0] != '\0')
1168 return -1;
1169
1170 if (!(table = ebt_find_table(replace->name)))
1171 ebt_print_error2("Bad table name");*/
1172
1173 if (command == 'h' && !(flags & OPT_ZERO)) {
1174 print_help(cs.target, cs.matches, *table);
1175 ret = 1;
1176 }
1177
1178 /* Do the final checks */
1179 if (command == 'A' || command == 'I' ||
1180 command == 'D' || command == 'C') {
1181 for (xtrm_i = cs.matches; xtrm_i; xtrm_i = xtrm_i->next)
1182 xtables_option_mfcall(xtrm_i->match);
1183
1184 for (match = cs.match_list; match; match = match->next) {
1185 if (match->ismatch)
1186 continue;
1187
1188 xtables_option_tfcall(match->u.watcher);
1189 }
1190
1191 if (cs.target != NULL)
1192 xtables_option_tfcall(cs.target);
1193 }
1194 /* So, the extensions can work with the host endian.
1195 * The kernel does not have to do this of course */
1196 cs.eb.ethproto = htons(cs.eb.ethproto);
1197
1198 if (command == 'P') {
1199 if (selected_chain >= NF_BR_NUMHOOKS) {
1200 ret = ebt_cmd_user_chain_policy(h, *table, chain, policy);
1201 } else {
1202 if (strcmp(policy, "RETURN") == 0) {
1203 xtables_error(PARAMETER_PROBLEM,
1204 "Policy RETURN only allowed for user defined chains");
1205 }
1206 ret = nft_cmd_chain_set(h, *table, chain, policy, NULL);
1207 if (ret < 0)
1208 xtables_error(PARAMETER_PROBLEM, "Wrong policy");
1209 }
1210 } else if (command == 'L') {
1211 ret = list_rules(h, chain, *table, rule_nr,
1212 0,
1213 0,
1214 /*flags&OPT_EXPANDED*/0,
1215 flags&LIST_N,
1216 flags&LIST_C);
1217 }
1218 if (flags & OPT_ZERO) {
1219 ret = nft_cmd_chain_zero_counters(h, chain, *table, 0);
1220 } else if (command == 'F') {
1221 ret = nft_cmd_rule_flush(h, chain, *table, 0);
1222 } else if (command == 'A') {
1223 ret = append_entry(h, chain, *table, &cs, 0, 0, true);
1224 } else if (command == 'I') {
1225 ret = append_entry(h, chain, *table, &cs, rule_nr - 1,
1226 0, false);
1227 } else if (command == 'D') {
1228 ret = delete_entry(h, chain, *table, &cs, rule_nr - 1,
1229 rule_nr_end, 0);
1230 } /*else if (replace->command == 'C') {
1231 ebt_change_counters(replace, new_entry, rule_nr, rule_nr_end, &(new_entry->cnt_surplus), chcounter);
1232 if (ebt_errormsg[0] != '\0')
1233 return -1;
1234 }*/
1235
1236 ebt_cs_clean(&cs);
1237 return ret;
1238 }
1239