1 /*
2 * Argument parser
3 * Copyright © Jan Engelhardt, 2011
4 *
5 * This program is free software; you can redistribute it and/or
6 * modify it under the terms of the GNU General Public License as
7 * published by the Free Software Foundation; either version 2 of
8 * the License, or (at your option) any later version.
9 */
10 #include <ctype.h>
11 #include <errno.h>
12 #include <getopt.h>
13 #include <limits.h>
14 #include <netdb.h>
15 #include <stdbool.h>
16 #include <stdint.h>
17 #include <stdio.h>
18 #include <stdlib.h>
19 #include <string.h>
20 #include <syslog.h>
21 #include <arpa/inet.h>
22 #include <netinet/ip.h>
23 #include "xtables.h"
24 #include "xshared.h"
25 #ifndef IPTOS_NORMALSVC
26 # define IPTOS_NORMALSVC 0
27 #endif
28
29 #define XTOPT_MKPTR(cb) \
30 ((void *)((char *)(cb)->data + (cb)->entry->ptroff))
31
32 /**
33 * Simple key-value pairs for syslog levels
34 */
35 struct syslog_level {
36 char name[8];
37 uint8_t level;
38 };
39
40 struct tos_value_mask {
41 uint8_t value, mask;
42 };
43
44 static const size_t xtopt_psize[] = {
45 /*
46 * All types not listed here, and thus essentially being initialized to
47 * zero have zero on purpose.
48 */
49 [XTTYPE_UINT8] = sizeof(uint8_t),
50 [XTTYPE_UINT16] = sizeof(uint16_t),
51 [XTTYPE_UINT32] = sizeof(uint32_t),
52 [XTTYPE_UINT64] = sizeof(uint64_t),
53 [XTTYPE_UINT8RC] = sizeof(uint8_t[2]),
54 [XTTYPE_UINT16RC] = sizeof(uint16_t[2]),
55 [XTTYPE_UINT32RC] = sizeof(uint32_t[2]),
56 [XTTYPE_UINT64RC] = sizeof(uint64_t[2]),
57 [XTTYPE_DOUBLE] = sizeof(double),
58 [XTTYPE_STRING] = -1,
59 [XTTYPE_SYSLOGLEVEL] = sizeof(uint8_t),
60 [XTTYPE_HOST] = sizeof(union nf_inet_addr),
61 [XTTYPE_HOSTMASK] = sizeof(union nf_inet_addr),
62 [XTTYPE_PROTOCOL] = sizeof(uint8_t),
63 [XTTYPE_PORT] = sizeof(uint16_t),
64 [XTTYPE_PORTRC] = sizeof(uint16_t[2]),
65 [XTTYPE_PLENMASK] = sizeof(union nf_inet_addr),
66 [XTTYPE_ETHERMAC] = sizeof(uint8_t[6]),
67 };
68
69 /**
70 * Creates getopt options from the x6-style option map, and assigns each a
71 * getopt id.
72 */
73 struct option *
xtables_options_xfrm(struct option * orig_opts,struct option * oldopts,const struct xt_option_entry * entry,unsigned int * offset)74 xtables_options_xfrm(struct option *orig_opts, struct option *oldopts,
75 const struct xt_option_entry *entry, unsigned int *offset)
76 {
77 unsigned int num_orig, num_old = 0, num_new, i;
78 struct option *merge, *mp;
79
80 if (entry == NULL)
81 return oldopts;
82 for (num_orig = 0; orig_opts[num_orig].name != NULL; ++num_orig)
83 ;
84 if (oldopts != NULL)
85 for (num_old = 0; oldopts[num_old].name != NULL; ++num_old)
86 ;
87 for (num_new = 0; entry[num_new].name != NULL; ++num_new)
88 ;
89
90 /*
91 * Since @oldopts also has @orig_opts already (and does so at the
92 * start), skip these entries.
93 */
94 if (oldopts != NULL) {
95 oldopts += num_orig;
96 num_old -= num_orig;
97 }
98
99 merge = malloc(sizeof(*mp) * (num_orig + num_old + num_new + 1));
100 if (merge == NULL)
101 return NULL;
102
103 /* Let the base options -[ADI...] have precedence over everything */
104 memcpy(merge, orig_opts, sizeof(*mp) * num_orig);
105 mp = merge + num_orig;
106
107 /* Second, the new options */
108 xt_params->option_offset += XT_OPTION_OFFSET_SCALE;
109 *offset = xt_params->option_offset;
110
111 for (i = 0; i < num_new; ++i, ++mp, ++entry) {
112 mp->name = entry->name;
113 mp->has_arg = entry->type != XTTYPE_NONE;
114 mp->flag = NULL;
115 mp->val = entry->id + *offset;
116 }
117
118 /* Third, the old options */
119 if (oldopts != NULL) {
120 memcpy(mp, oldopts, sizeof(*mp) * num_old);
121 mp += num_old;
122 }
123 xtables_free_opts(0);
124
125 /* Clear trailing entry */
126 memset(mp, 0, sizeof(*mp));
127 return merge;
128 }
129
130 /**
131 * Give the upper limit for a certain type.
132 */
xtopt_max_by_type(enum xt_option_type type)133 static uintmax_t xtopt_max_by_type(enum xt_option_type type)
134 {
135 switch (type) {
136 case XTTYPE_UINT8:
137 case XTTYPE_UINT8RC:
138 return UINT8_MAX;
139 case XTTYPE_UINT16:
140 case XTTYPE_UINT16RC:
141 return UINT16_MAX;
142 case XTTYPE_UINT32:
143 case XTTYPE_UINT32RC:
144 return UINT32_MAX;
145 case XTTYPE_UINT64:
146 case XTTYPE_UINT64RC:
147 return UINT64_MAX;
148 default:
149 return 0;
150 }
151 }
152
153 /**
154 * Return the size of a single entity based upon a type - predominantly an
155 * XTTYPE_UINT*RC type.
156 */
xtopt_esize_by_type(enum xt_option_type type)157 static size_t xtopt_esize_by_type(enum xt_option_type type)
158 {
159 switch (type) {
160 case XTTYPE_UINT8RC:
161 return xtopt_psize[XTTYPE_UINT8];
162 case XTTYPE_UINT16RC:
163 return xtopt_psize[XTTYPE_UINT16];
164 case XTTYPE_UINT32RC:
165 return xtopt_psize[XTTYPE_UINT32];
166 case XTTYPE_UINT64RC:
167 return xtopt_psize[XTTYPE_UINT64];
168 default:
169 return xtopt_psize[type];
170 }
171 }
172
173 /**
174 * Require a simple integer.
175 */
xtopt_parse_int(struct xt_option_call * cb)176 static void xtopt_parse_int(struct xt_option_call *cb)
177 {
178 const struct xt_option_entry *entry = cb->entry;
179 uintmax_t lmin = 0, lmax = xtopt_max_by_type(entry->type);
180 uintmax_t value;
181
182 if (cb->entry->min != 0)
183 lmin = cb->entry->min;
184 if (cb->entry->max != 0)
185 lmax = cb->entry->max;
186
187 if (!xtables_strtoul(cb->arg, NULL, &value, lmin, lmax))
188 xt_params->exit_err(PARAMETER_PROBLEM,
189 "%s: bad value for option \"--%s\", "
190 "or out of range (%ju-%ju).\n",
191 cb->ext_name, entry->name, lmin, lmax);
192
193 if (entry->type == XTTYPE_UINT8) {
194 cb->val.u8 = value;
195 if (entry->flags & XTOPT_PUT)
196 *(uint8_t *)XTOPT_MKPTR(cb) = cb->val.u8;
197 } else if (entry->type == XTTYPE_UINT16) {
198 cb->val.u16 = value;
199 if (entry->flags & XTOPT_PUT)
200 *(uint16_t *)XTOPT_MKPTR(cb) = cb->val.u16;
201 } else if (entry->type == XTTYPE_UINT32) {
202 cb->val.u32 = value;
203 if (entry->flags & XTOPT_PUT)
204 *(uint32_t *)XTOPT_MKPTR(cb) = cb->val.u32;
205 } else if (entry->type == XTTYPE_UINT64) {
206 cb->val.u64 = value;
207 if (entry->flags & XTOPT_PUT)
208 *(uint64_t *)XTOPT_MKPTR(cb) = cb->val.u64;
209 }
210 }
211
212 /**
213 * Require a simple floating point number.
214 */
xtopt_parse_float(struct xt_option_call * cb)215 static void xtopt_parse_float(struct xt_option_call *cb)
216 {
217 const struct xt_option_entry *entry = cb->entry;
218 double value;
219 char *end;
220
221 value = strtod(cb->arg, &end);
222 if (end == cb->arg || *end != '\0' ||
223 (entry->min != entry->max &&
224 (value < entry->min || value > entry->max)))
225 xt_params->exit_err(PARAMETER_PROBLEM,
226 "%s: bad value for option \"--%s\", "
227 "or out of range (%u-%u).\n",
228 cb->ext_name, entry->name, entry->min, entry->max);
229
230 cb->val.dbl = value;
231 if (entry->flags & XTOPT_PUT)
232 *(double *)XTOPT_MKPTR(cb) = cb->val.dbl;
233 }
234
235 /**
236 * Copy the parsed value to the appropriate entry in cb->val.
237 */
xtopt_mint_value_to_cb(struct xt_option_call * cb,uintmax_t value)238 static void xtopt_mint_value_to_cb(struct xt_option_call *cb, uintmax_t value)
239 {
240 const struct xt_option_entry *entry = cb->entry;
241
242 if (cb->nvals >= ARRAY_SIZE(cb->val.u32_range))
243 return;
244 if (entry->type == XTTYPE_UINT8RC)
245 cb->val.u8_range[cb->nvals] = value;
246 else if (entry->type == XTTYPE_UINT16RC)
247 cb->val.u16_range[cb->nvals] = value;
248 else if (entry->type == XTTYPE_UINT32RC)
249 cb->val.u32_range[cb->nvals] = value;
250 else if (entry->type == XTTYPE_UINT64RC)
251 cb->val.u64_range[cb->nvals] = value;
252 }
253
254 /**
255 * Copy the parsed value to the data area, using appropriate type access.
256 */
xtopt_mint_value_to_ptr(struct xt_option_call * cb,void ** datap,uintmax_t value)257 static void xtopt_mint_value_to_ptr(struct xt_option_call *cb, void **datap,
258 uintmax_t value)
259 {
260 const struct xt_option_entry *entry = cb->entry;
261 void *data = *datap;
262
263 if (!(entry->flags & XTOPT_PUT))
264 return;
265 if (entry->type == XTTYPE_UINT8RC)
266 *(uint8_t *)data = value;
267 else if (entry->type == XTTYPE_UINT16RC)
268 *(uint16_t *)data = value;
269 else if (entry->type == XTTYPE_UINT32RC)
270 *(uint32_t *)data = value;
271 else if (entry->type == XTTYPE_UINT64RC)
272 *(uint64_t *)data = value;
273 data += xtopt_esize_by_type(entry->type);
274 *datap = data;
275 }
276
277 /**
278 * Multiple integer parse routine.
279 *
280 * This function is capable of parsing any number of fields. Only the first
281 * two values from the string will be put into @cb however (and as such,
282 * @cb->val.uXX_range is just that large) to cater for the few extensions that
283 * do not have a range[2] field, but {min, max}, and which cannot use
284 * XTOPT_POINTER.
285 */
xtopt_parse_mint(struct xt_option_call * cb)286 static void xtopt_parse_mint(struct xt_option_call *cb)
287 {
288 const struct xt_option_entry *entry = cb->entry;
289 const char *arg;
290 size_t esize = xtopt_esize_by_type(entry->type);
291 const uintmax_t lmax = xtopt_max_by_type(entry->type);
292 void *put = XTOPT_MKPTR(cb);
293 unsigned int maxiter;
294 uintmax_t value;
295 char *end = "";
296 char sep = ':';
297
298 maxiter = entry->size / esize;
299 if (maxiter == 0)
300 maxiter = ARRAY_SIZE(cb->val.u32_range);
301 if (entry->size % esize != 0)
302 xt_params->exit_err(OTHER_PROBLEM, "%s: memory block does "
303 "not have proper size\n", __func__);
304
305 cb->nvals = 0;
306 for (arg = cb->arg, end = (char *)arg; ; arg = end + 1) {
307 if (cb->nvals == maxiter)
308 xt_params->exit_err(PARAMETER_PROBLEM, "%s: Too many "
309 "components for option \"--%s\" (max: %u)\n",
310 cb->ext_name, entry->name, maxiter);
311 if (*arg == '\0' || *arg == sep) {
312 /* Default range components when field not spec'd. */
313 end = (char *)arg;
314 value = (cb->nvals == 1) ? lmax : 0;
315 } else {
316 if (!xtables_strtoul(arg, &end, &value, 0, lmax))
317 xt_params->exit_err(PARAMETER_PROBLEM,
318 "%s: bad value for option \"--%s\" near "
319 "\"%s\", or out of range (0-%ju).\n",
320 cb->ext_name, entry->name, arg, lmax);
321 if (*end != '\0' && *end != sep)
322 xt_params->exit_err(PARAMETER_PROBLEM,
323 "%s: Argument to \"--%s\" has "
324 "unexpected characters near \"%s\".\n",
325 cb->ext_name, entry->name, end);
326 }
327 xtopt_mint_value_to_cb(cb, value);
328 ++cb->nvals;
329 xtopt_mint_value_to_ptr(cb, &put, value);
330 if (*end == '\0')
331 break;
332 }
333 }
334
xtopt_parse_string(struct xt_option_call * cb)335 static void xtopt_parse_string(struct xt_option_call *cb)
336 {
337 const struct xt_option_entry *entry = cb->entry;
338 size_t z = strlen(cb->arg);
339 char *p;
340
341 if (entry->min != 0 && z < entry->min)
342 xt_params->exit_err(PARAMETER_PROBLEM,
343 "Argument must have a minimum length of "
344 "%u characters\n", entry->min);
345 if (entry->max != 0 && z > entry->max)
346 xt_params->exit_err(PARAMETER_PROBLEM,
347 "Argument must have a maximum length of "
348 "%u characters\n", entry->max);
349 if (!(entry->flags & XTOPT_PUT))
350 return;
351 if (z >= entry->size)
352 z = entry->size - 1;
353 p = XTOPT_MKPTR(cb);
354 strncpy(p, cb->arg, z);
355 p[z] = '\0';
356 }
357
358 static const struct tos_symbol_info {
359 unsigned char value;
360 const char *name;
361 } tos_symbol_names[] = {
362 {IPTOS_LOWDELAY, "Minimize-Delay"},
363 {IPTOS_THROUGHPUT, "Maximize-Throughput"},
364 {IPTOS_RELIABILITY, "Maximize-Reliability"},
365 {IPTOS_MINCOST, "Minimize-Cost"},
366 {IPTOS_NORMALSVC, "Normal-Service"},
367 {},
368 };
369
370 /*
371 * tos_parse_numeric - parse a string like "15/255"
372 *
373 * @str: input string
374 * @tvm: (value/mask) tuple
375 * @max: maximum allowed value (must be pow(2,some_int)-1)
376 */
tos_parse_numeric(const char * str,struct xt_option_call * cb,unsigned int max)377 static bool tos_parse_numeric(const char *str, struct xt_option_call *cb,
378 unsigned int max)
379 {
380 unsigned int value;
381 char *end;
382
383 xtables_strtoui(str, &end, &value, 0, max);
384 cb->val.tos_value = value;
385 cb->val.tos_mask = max;
386
387 if (*end == '/') {
388 const char *p = end + 1;
389
390 if (!xtables_strtoui(p, &end, &value, 0, max))
391 xtables_error(PARAMETER_PROBLEM, "Illegal value: \"%s\"",
392 str);
393 cb->val.tos_mask = value;
394 }
395
396 if (*end != '\0')
397 xtables_error(PARAMETER_PROBLEM, "Illegal value: \"%s\"", str);
398 return true;
399 }
400
401 /**
402 * @str: input string
403 * @tvm: (value/mask) tuple
404 * @def_mask: mask to force when a symbolic name is used
405 */
xtopt_parse_tosmask(struct xt_option_call * cb)406 static void xtopt_parse_tosmask(struct xt_option_call *cb)
407 {
408 const struct tos_symbol_info *symbol;
409 char *tmp;
410
411 if (xtables_strtoui(cb->arg, &tmp, NULL, 0, UINT8_MAX)) {
412 tos_parse_numeric(cb->arg, cb, UINT8_MAX);
413 return;
414 }
415 /*
416 * This is our way we deal with different defaults
417 * for different revisions.
418 */
419 cb->val.tos_mask = cb->entry->max;
420 for (symbol = tos_symbol_names; symbol->name != NULL; ++symbol)
421 if (strcasecmp(cb->arg, symbol->name) == 0) {
422 cb->val.tos_value = symbol->value;
423 return;
424 }
425
426 xtables_error(PARAMETER_PROBLEM, "Symbolic name \"%s\" is unknown",
427 cb->arg);
428 }
429
430 /**
431 * Validate the input for being conformant to "mark[/mask]".
432 */
xtopt_parse_markmask(struct xt_option_call * cb)433 static void xtopt_parse_markmask(struct xt_option_call *cb)
434 {
435 xtables_parse_mark_mask(cb, &cb->val.mark, &cb->val.mask);
436 }
437
xtopt_sysloglvl_compare(const void * a,const void * b)438 static int xtopt_sysloglvl_compare(const void *a, const void *b)
439 {
440 const char *name = a;
441 const struct syslog_level *entry = b;
442
443 return strcmp(name, entry->name);
444 }
445
xtopt_parse_sysloglevel(struct xt_option_call * cb)446 static void xtopt_parse_sysloglevel(struct xt_option_call *cb)
447 {
448 static const struct syslog_level log_names[] = { /* must be sorted */
449 {"alert", LOG_ALERT},
450 {"crit", LOG_CRIT},
451 {"debug", LOG_DEBUG},
452 {"emerg", LOG_EMERG},
453 {"error", LOG_ERR}, /* deprecated */
454 {"info", LOG_INFO},
455 {"notice", LOG_NOTICE},
456 {"panic", LOG_EMERG}, /* deprecated */
457 {"warning", LOG_WARNING},
458 };
459 const struct syslog_level *e;
460 unsigned int num = 0;
461
462 if (!xtables_strtoui(cb->arg, NULL, &num, 0, 7)) {
463 e = bsearch(cb->arg, log_names, ARRAY_SIZE(log_names),
464 sizeof(*log_names), xtopt_sysloglvl_compare);
465 if (e == NULL)
466 xt_params->exit_err(PARAMETER_PROBLEM,
467 "log level \"%s\" unknown\n", cb->arg);
468 num = e->level;
469 }
470 cb->val.syslog_level = num;
471 if (cb->entry->flags & XTOPT_PUT)
472 *(uint8_t *)XTOPT_MKPTR(cb) = num;
473 }
474
xtables_sa_host(const void * sa,unsigned int afproto)475 static void *xtables_sa_host(const void *sa, unsigned int afproto)
476 {
477 if (afproto == AF_INET6)
478 return &((struct sockaddr_in6 *)sa)->sin6_addr;
479 else if (afproto == AF_INET)
480 return &((struct sockaddr_in *)sa)->sin_addr;
481 return (void *)sa;
482 }
483
xtables_sa_hostlen(unsigned int afproto)484 static socklen_t xtables_sa_hostlen(unsigned int afproto)
485 {
486 if (afproto == AF_INET6)
487 return sizeof(struct in6_addr);
488 else if (afproto == AF_INET)
489 return sizeof(struct in_addr);
490 return 0;
491 }
492
493 /**
494 * Accepts: a hostname (DNS), or a single inetaddr - without any mask. The
495 * result is stored in @cb->val.haddr. Additionally, @cb->val.hmask and
496 * @cb->val.hlen are set for completeness to the appropriate values.
497 */
xtopt_parse_host(struct xt_option_call * cb)498 static void xtopt_parse_host(struct xt_option_call *cb)
499 {
500 struct addrinfo hints = {.ai_family = afinfo->family};
501 unsigned int adcount = 0;
502 struct addrinfo *res, *p;
503 int ret;
504
505 ret = getaddrinfo(cb->arg, NULL, &hints, &res);
506 if (ret != 0)
507 xt_params->exit_err(PARAMETER_PROBLEM,
508 "getaddrinfo: %s\n", gai_strerror(ret));
509
510 memset(&cb->val.hmask, 0xFF, sizeof(cb->val.hmask));
511 cb->val.hlen = (afinfo->family == NFPROTO_IPV4) ? 32 : 128;
512
513 for (p = res; p != NULL; p = p->ai_next) {
514 if (adcount == 0) {
515 memset(&cb->val.haddr, 0, sizeof(cb->val.haddr));
516 memcpy(&cb->val.haddr,
517 xtables_sa_host(p->ai_addr, p->ai_family),
518 xtables_sa_hostlen(p->ai_family));
519 ++adcount;
520 continue;
521 }
522 if (memcmp(&cb->val.haddr,
523 xtables_sa_host(p->ai_addr, p->ai_family),
524 xtables_sa_hostlen(p->ai_family)) != 0)
525 xt_params->exit_err(PARAMETER_PROBLEM,
526 "%s resolves to more than one address\n",
527 cb->arg);
528 }
529
530 freeaddrinfo(res);
531 if (cb->entry->flags & XTOPT_PUT)
532 /* Validation in xtables_option_metavalidate */
533 memcpy(XTOPT_MKPTR(cb), &cb->val.haddr,
534 sizeof(cb->val.haddr));
535 }
536
537 /**
538 * @name: port name, or number as a string (e.g. "http" or "80")
539 *
540 * Resolve a port name to a number. Returns the port number in integral
541 * form on success, or <0 on error. (errno will not be set.)
542 */
xtables_getportbyname(const char * name)543 static int xtables_getportbyname(const char *name)
544 {
545 struct addrinfo *res = NULL, *p;
546 int ret;
547
548 ret = getaddrinfo(NULL, name, NULL, &res);
549 if (ret != 0)
550 return -1;
551 ret = -1;
552 for (p = res; p != NULL; p = p->ai_next) {
553 if (p->ai_family == AF_INET6) {
554 ret = ((struct sockaddr_in6 *)p->ai_addr)->sin6_port;
555 break;
556 } else if (p->ai_family == AF_INET) {
557 ret = ((struct sockaddr_in *)p->ai_addr)->sin_port;
558 break;
559 }
560 }
561 freeaddrinfo(res);
562 if (ret < 0)
563 return ret;
564 return ntohs(ret);
565 }
566
567 /**
568 * Validate and parse a protocol specification (number or name) by use of
569 * /etc/protocols and put the result into @cb->val.protocol.
570 */
xtopt_parse_protocol(struct xt_option_call * cb)571 static void xtopt_parse_protocol(struct xt_option_call *cb)
572 {
573 cb->val.protocol = xtables_parse_protocol(cb->arg);
574 if (cb->entry->flags & XTOPT_PUT)
575 *(uint8_t *)XTOPT_MKPTR(cb) = cb->val.protocol;
576 }
577
578 /**
579 * Validate and parse a port specification and put the result into
580 * @cb->val.port.
581 */
xtopt_parse_port(struct xt_option_call * cb)582 static void xtopt_parse_port(struct xt_option_call *cb)
583 {
584 const struct xt_option_entry *entry = cb->entry;
585 int ret;
586
587 ret = xtables_getportbyname(cb->arg);
588 if (ret < 0)
589 xt_params->exit_err(PARAMETER_PROBLEM,
590 "Port \"%s\" does not resolve to anything.\n",
591 cb->arg);
592 if (entry->flags & XTOPT_NBO)
593 ret = htons(ret);
594 cb->val.port = ret;
595 if (entry->flags & XTOPT_PUT)
596 *(uint16_t *)XTOPT_MKPTR(cb) = cb->val.port;
597 }
598
xtopt_parse_mport(struct xt_option_call * cb)599 static void xtopt_parse_mport(struct xt_option_call *cb)
600 {
601 static const size_t esize = sizeof(uint16_t);
602 const struct xt_option_entry *entry = cb->entry;
603 char *lo_arg, *wp_arg, *arg;
604 unsigned int maxiter;
605 int value;
606
607 wp_arg = lo_arg = strdup(cb->arg);
608 if (lo_arg == NULL)
609 xt_params->exit_err(RESOURCE_PROBLEM, "strdup");
610
611 maxiter = entry->size / esize;
612 if (maxiter == 0)
613 maxiter = 2; /* ARRAY_SIZE(cb->val.port_range) */
614 if (entry->size % esize != 0)
615 xt_params->exit_err(OTHER_PROBLEM, "%s: memory block does "
616 "not have proper size\n", __func__);
617
618 cb->val.port_range[0] = 0;
619 cb->val.port_range[1] = UINT16_MAX;
620 cb->nvals = 0;
621
622 while ((arg = strsep(&wp_arg, ":")) != NULL) {
623 if (cb->nvals == maxiter)
624 xt_params->exit_err(PARAMETER_PROBLEM, "%s: Too many "
625 "components for option \"--%s\" (max: %u)\n",
626 cb->ext_name, entry->name, maxiter);
627 if (*arg == '\0') {
628 ++cb->nvals;
629 continue;
630 }
631
632 value = xtables_getportbyname(arg);
633 if (value < 0)
634 xt_params->exit_err(PARAMETER_PROBLEM,
635 "Port \"%s\" does not resolve to "
636 "anything.\n", arg);
637 if (entry->flags & XTOPT_NBO)
638 value = htons(value);
639 if (cb->nvals < ARRAY_SIZE(cb->val.port_range))
640 cb->val.port_range[cb->nvals] = value;
641 ++cb->nvals;
642 }
643
644 if (cb->nvals == 1) {
645 cb->val.port_range[1] = cb->val.port_range[0];
646 ++cb->nvals;
647 }
648 if (entry->flags & XTOPT_PUT)
649 memcpy(XTOPT_MKPTR(cb), cb->val.port_range, sizeof(uint16_t) *
650 (cb->nvals <= maxiter ? cb->nvals : maxiter));
651 free(lo_arg);
652 }
653
xtopt_parse_mask(struct xt_option_call * cb)654 static int xtopt_parse_mask(struct xt_option_call *cb)
655 {
656 struct addrinfo hints = {.ai_family = afinfo->family,
657 .ai_flags = AI_NUMERICHOST };
658 struct addrinfo *res;
659 int ret;
660
661 ret = getaddrinfo(cb->arg, NULL, &hints, &res);
662 if (ret != 0)
663 return 0;
664
665 memcpy(&cb->val.hmask, xtables_sa_host(res->ai_addr, res->ai_family),
666 xtables_sa_hostlen(res->ai_family));
667
668 switch(afinfo->family) {
669 case AF_INET:
670 cb->val.hlen = xtables_ipmask_to_cidr(&cb->val.hmask.in);
671 break;
672 case AF_INET6:
673 cb->val.hlen = xtables_ip6mask_to_cidr(&cb->val.hmask.in6);
674 break;
675 }
676
677 freeaddrinfo(res);
678 return 1;
679 }
680
681 /**
682 * Parse an integer and ensure it is within the address family's prefix length
683 * limits. The result is stored in @cb->val.hlen.
684 */
xtopt_parse_plen(struct xt_option_call * cb)685 static void xtopt_parse_plen(struct xt_option_call *cb)
686 {
687 const struct xt_option_entry *entry = cb->entry;
688 unsigned int prefix_len = 128; /* happiness is a warm gcc */
689
690 cb->val.hlen = (afinfo->family == NFPROTO_IPV4) ? 32 : 128;
691 if (!xtables_strtoui(cb->arg, NULL, &prefix_len, 0, cb->val.hlen)) {
692 /* Is this mask expressed in full format? e.g. 255.255.255.0 */
693 if (xtopt_parse_mask(cb))
694 return;
695
696 xt_params->exit_err(PARAMETER_PROBLEM,
697 "%s: bad value for option \"--%s\", "
698 "neither a valid network mask "
699 "nor valid CIDR (%u-%u).\n",
700 cb->ext_name, entry->name, 0, cb->val.hlen);
701 }
702 cb->val.hlen = prefix_len;
703 }
704
705 /**
706 * Reuse xtopt_parse_plen for testing the integer. Afterwards convert this to
707 * a bitmask, and make it available through @cb->val.hmask (hlen remains
708 * valid). If %XTOPT_PUT is used, hmask will be copied to the target area.
709 */
xtopt_parse_plenmask(struct xt_option_call * cb)710 static void xtopt_parse_plenmask(struct xt_option_call *cb)
711 {
712 const struct xt_option_entry *entry = cb->entry;
713 uint32_t *mask = cb->val.hmask.all;
714
715 xtopt_parse_plen(cb);
716
717 memset(mask, 0xFF, sizeof(union nf_inet_addr));
718 /* This shifting is AF-independent. */
719 if (cb->val.hlen == 0) {
720 mask[0] = mask[1] = mask[2] = mask[3] = 0;
721 } else if (cb->val.hlen <= 32) {
722 mask[0] <<= 32 - cb->val.hlen;
723 mask[1] = mask[2] = mask[3] = 0;
724 } else if (cb->val.hlen <= 64) {
725 mask[1] <<= 32 - (cb->val.hlen - 32);
726 mask[2] = mask[3] = 0;
727 } else if (cb->val.hlen <= 96) {
728 mask[2] <<= 32 - (cb->val.hlen - 64);
729 mask[3] = 0;
730 } else if (cb->val.hlen <= 128) {
731 mask[3] <<= 32 - (cb->val.hlen - 96);
732 }
733 mask[0] = htonl(mask[0]);
734 mask[1] = htonl(mask[1]);
735 mask[2] = htonl(mask[2]);
736 mask[3] = htonl(mask[3]);
737 if (entry->flags & XTOPT_PUT)
738 memcpy(XTOPT_MKPTR(cb), mask, sizeof(union nf_inet_addr));
739 }
740
xtopt_parse_hostmask(struct xt_option_call * cb)741 static void xtopt_parse_hostmask(struct xt_option_call *cb)
742 {
743 const char *orig_arg = cb->arg;
744 char *work, *p;
745
746 if (strchr(cb->arg, '/') == NULL) {
747 xtopt_parse_host(cb);
748 return;
749 }
750 work = strdup(orig_arg);
751 if (work == NULL)
752 xt_params->exit_err(PARAMETER_PROBLEM, "strdup");
753 p = strchr(work, '/'); /* by def this can't be NULL now */
754 *p++ = '\0';
755 /*
756 * Because xtopt_parse_host and xtopt_parse_plenmask would store
757 * different things in the same target area, XTTYPE_HOSTMASK must
758 * disallow XTOPT_PUT, which it does by forcing its absence,
759 * cf. not being listed in xtopt_psize.
760 */
761 cb->arg = work;
762 xtopt_parse_host(cb);
763 cb->arg = p;
764 xtopt_parse_plenmask(cb);
765 cb->arg = orig_arg;
766 }
767
xtopt_parse_ethermac(struct xt_option_call * cb)768 static void xtopt_parse_ethermac(struct xt_option_call *cb)
769 {
770 const char *arg = cb->arg;
771 unsigned int i;
772 char *end;
773
774 for (i = 0; i < ARRAY_SIZE(cb->val.ethermac) - 1; ++i) {
775 cb->val.ethermac[i] = strtoul(arg, &end, 16);
776 if (*end != ':' || end - arg > 2)
777 goto out;
778 arg = end + 1;
779 }
780 i = ARRAY_SIZE(cb->val.ethermac) - 1;
781 cb->val.ethermac[i] = strtoul(arg, &end, 16);
782 if (*end != '\0' || end - arg > 2)
783 goto out;
784 if (cb->entry->flags & XTOPT_PUT)
785 memcpy(XTOPT_MKPTR(cb), cb->val.ethermac,
786 sizeof(cb->val.ethermac));
787 return;
788 out:
789 xt_params->exit_err(PARAMETER_PROBLEM, "Invalid MAC address specified.");
790 }
791
792 static void (*const xtopt_subparse[])(struct xt_option_call *) = {
793 [XTTYPE_UINT8] = xtopt_parse_int,
794 [XTTYPE_UINT16] = xtopt_parse_int,
795 [XTTYPE_UINT32] = xtopt_parse_int,
796 [XTTYPE_UINT64] = xtopt_parse_int,
797 [XTTYPE_UINT8RC] = xtopt_parse_mint,
798 [XTTYPE_UINT16RC] = xtopt_parse_mint,
799 [XTTYPE_UINT32RC] = xtopt_parse_mint,
800 [XTTYPE_UINT64RC] = xtopt_parse_mint,
801 [XTTYPE_DOUBLE] = xtopt_parse_float,
802 [XTTYPE_STRING] = xtopt_parse_string,
803 [XTTYPE_TOSMASK] = xtopt_parse_tosmask,
804 [XTTYPE_MARKMASK32] = xtopt_parse_markmask,
805 [XTTYPE_SYSLOGLEVEL] = xtopt_parse_sysloglevel,
806 [XTTYPE_HOST] = xtopt_parse_host,
807 [XTTYPE_HOSTMASK] = xtopt_parse_hostmask,
808 [XTTYPE_PROTOCOL] = xtopt_parse_protocol,
809 [XTTYPE_PORT] = xtopt_parse_port,
810 [XTTYPE_PORTRC] = xtopt_parse_mport,
811 [XTTYPE_PLEN] = xtopt_parse_plen,
812 [XTTYPE_PLENMASK] = xtopt_parse_plenmask,
813 [XTTYPE_ETHERMAC] = xtopt_parse_ethermac,
814 };
815
816 /**
817 * The master option parsing routine. May be used for the ".x6_parse"
818 * function pointer in extensions if fully automatic parsing is desired.
819 * It may be also called manually from a custom x6_parse function.
820 */
xtables_option_parse(struct xt_option_call * cb)821 void xtables_option_parse(struct xt_option_call *cb)
822 {
823 const struct xt_option_entry *entry = cb->entry;
824 unsigned int eflag = 1 << cb->entry->id;
825
826 /*
827 * With {.id = P_FOO, .excl = P_FOO} we can have simple double-use
828 * prevention. Though it turned out that this is too much typing (most
829 * of the options are one-time use only), so now we also have
830 * %XTOPT_MULTI.
831 */
832 if ((!(entry->flags & XTOPT_MULTI) || (entry->excl & eflag)) &&
833 cb->xflags & eflag)
834 xt_params->exit_err(PARAMETER_PROBLEM,
835 "%s: option \"--%s\" can only be used once.\n",
836 cb->ext_name, cb->entry->name);
837 if (cb->invert && !(entry->flags & XTOPT_INVERT))
838 xt_params->exit_err(PARAMETER_PROBLEM,
839 "%s: option \"--%s\" cannot be inverted.\n",
840 cb->ext_name, entry->name);
841 if (entry->type != XTTYPE_NONE && optarg == NULL)
842 xt_params->exit_err(PARAMETER_PROBLEM,
843 "%s: option \"--%s\" requires an argument.\n",
844 cb->ext_name, entry->name);
845 /*
846 * Fill in fallback value for "nvals", in case an extension (as it
847 * happened with libxt_conntrack.2) tries to read it, despite not using
848 * a *RC option type.
849 */
850 cb->nvals = 1;
851 if (entry->type < ARRAY_SIZE(xtopt_subparse) &&
852 xtopt_subparse[entry->type] != NULL)
853 xtopt_subparse[entry->type](cb);
854 /* Exclusion with other flags tested later in finalize. */
855 cb->xflags |= 1 << entry->id;
856 }
857
858 /**
859 * Verifies that an extension's option map descriptor is valid, and ought to
860 * be called right after the extension has been loaded, and before option
861 * merging/xfrm.
862 */
xtables_option_metavalidate(const char * name,const struct xt_option_entry * entry)863 void xtables_option_metavalidate(const char *name,
864 const struct xt_option_entry *entry)
865 {
866 for (; entry->name != NULL; ++entry) {
867 if (entry->id >= CHAR_BIT * sizeof(unsigned int) ||
868 entry->id >= XT_OPTION_OFFSET_SCALE)
869 xt_params->exit_err(OTHER_PROBLEM,
870 "Extension %s uses invalid ID %u\n",
871 name, entry->id);
872 if (!(entry->flags & XTOPT_PUT)) {
873 if (entry->ptroff != 0)
874 xt_params->exit_err(OTHER_PROBLEM,
875 "%s: ptroff for \"--%s\" is non-"
876 "zero but no XTOPT_PUT is specified. "
877 "Oversight?", name, entry->name);
878 continue;
879 }
880 if (entry->type >= ARRAY_SIZE(xtopt_psize) ||
881 xtopt_psize[entry->type] == 0)
882 xt_params->exit_err(OTHER_PROBLEM,
883 "%s: entry type of option \"--%s\" cannot be "
884 "combined with XTOPT_PUT\n",
885 name, entry->name);
886 if (xtopt_psize[entry->type] != -1 &&
887 xtopt_psize[entry->type] != entry->size)
888 xt_params->exit_err(OTHER_PROBLEM,
889 "%s: option \"--%s\" points to a memory block "
890 "of wrong size (expected %zu, got %zu)\n",
891 name, entry->name,
892 xtopt_psize[entry->type], entry->size);
893 }
894 }
895
896 /**
897 * Find an option entry by its id.
898 */
899 static const struct xt_option_entry *
xtables_option_lookup(const struct xt_option_entry * entry,unsigned int id)900 xtables_option_lookup(const struct xt_option_entry *entry, unsigned int id)
901 {
902 for (; entry->name != NULL; ++entry)
903 if (entry->id == id)
904 return entry;
905 return NULL;
906 }
907
908 /**
909 * @c: getopt id (i.e. with offset)
910 * @fw: struct ipt_entry or ip6t_entry
911 *
912 * Dispatch arguments to the appropriate parse function, based upon the
913 * extension's choice of API.
914 */
xtables_option_tpcall(unsigned int c,char ** argv,bool invert,struct xtables_target * t,void * fw)915 void xtables_option_tpcall(unsigned int c, char **argv, bool invert,
916 struct xtables_target *t, void *fw)
917 {
918 struct xt_option_call cb;
919
920 if (t->x6_parse == NULL) {
921 if (t->parse != NULL)
922 t->parse(c - t->option_offset, argv, invert,
923 &t->tflags, fw, &t->t);
924 return;
925 }
926
927 c -= t->option_offset;
928 cb.entry = xtables_option_lookup(t->x6_options, c);
929 if (cb.entry == NULL)
930 xtables_error(OTHER_PROBLEM,
931 "Extension does not know id %u\n", c);
932 cb.arg = optarg;
933 cb.invert = invert;
934 cb.ext_name = t->name;
935 cb.data = t->t->data;
936 cb.xflags = t->tflags;
937 cb.target = &t->t;
938 cb.xt_entry = fw;
939 cb.udata = t->udata;
940 t->x6_parse(&cb);
941 t->tflags = cb.xflags;
942 }
943
944 /**
945 * @c: getopt id (i.e. with offset)
946 * @fw: struct ipt_entry or ip6t_entry
947 *
948 * Dispatch arguments to the appropriate parse function, based upon the
949 * extension's choice of API.
950 */
xtables_option_mpcall(unsigned int c,char ** argv,bool invert,struct xtables_match * m,void * fw)951 void xtables_option_mpcall(unsigned int c, char **argv, bool invert,
952 struct xtables_match *m, void *fw)
953 {
954 struct xt_option_call cb;
955
956 if (m->x6_parse == NULL) {
957 if (m->parse != NULL)
958 m->parse(c - m->option_offset, argv, invert,
959 &m->mflags, fw, &m->m);
960 return;
961 }
962
963 c -= m->option_offset;
964 cb.entry = xtables_option_lookup(m->x6_options, c);
965 if (cb.entry == NULL)
966 xtables_error(OTHER_PROBLEM,
967 "Extension does not know id %u\n", c);
968 cb.arg = optarg;
969 cb.invert = invert;
970 cb.ext_name = m->name;
971 cb.data = m->m->data;
972 cb.xflags = m->mflags;
973 cb.match = &m->m;
974 cb.xt_entry = fw;
975 cb.udata = m->udata;
976 m->x6_parse(&cb);
977 m->mflags = cb.xflags;
978 }
979
980 /**
981 * @name: name of extension
982 * @entry: current option (from all ext's entries) being validated
983 * @xflags: flags the extension has collected
984 * @i: conflicting option (id) to test for
985 */
986 static void
xtables_option_fcheck2(const char * name,const struct xt_option_entry * entry,const struct xt_option_entry * other,unsigned int xflags)987 xtables_option_fcheck2(const char *name, const struct xt_option_entry *entry,
988 const struct xt_option_entry *other,
989 unsigned int xflags)
990 {
991 unsigned int ef = 1 << entry->id, of = 1 << other->id;
992
993 if (entry->also & of && !(xflags & of))
994 xt_params->exit_err(PARAMETER_PROBLEM,
995 "%s: option \"--%s\" also requires \"--%s\".\n",
996 name, entry->name, other->name);
997
998 if (!(entry->excl & of))
999 /* Use of entry does not collide with other option, good. */
1000 return;
1001 if ((xflags & (ef | of)) != (ef | of))
1002 /* Conflicting options were not used. */
1003 return;
1004
1005 xt_params->exit_err(PARAMETER_PROBLEM,
1006 "%s: option \"--%s\" cannot be used together with \"--%s\".\n",
1007 name, entry->name, other->name);
1008 }
1009
1010 /**
1011 * @name: name of extension
1012 * @xflags: accumulated flags
1013 * @entry: extension's option table
1014 *
1015 * Check that all option constraints have been met. This effectively replaces
1016 * ->final_check of the older API.
1017 */
xtables_options_fcheck(const char * name,unsigned int xflags,const struct xt_option_entry * table)1018 void xtables_options_fcheck(const char *name, unsigned int xflags,
1019 const struct xt_option_entry *table)
1020 {
1021 const struct xt_option_entry *entry, *other;
1022 unsigned int i;
1023
1024 for (entry = table; entry->name != NULL; ++entry) {
1025 if (entry->flags & XTOPT_MAND &&
1026 !(xflags & (1 << entry->id)))
1027 xt_params->exit_err(PARAMETER_PROBLEM,
1028 "%s: option \"--%s\" must be specified\n",
1029 name, entry->name);
1030 if (!(xflags & (1 << entry->id)))
1031 /* Not required, not specified, thus skip. */
1032 continue;
1033
1034 for (i = 0; i < CHAR_BIT * sizeof(entry->id); ++i) {
1035 if (entry->id == i)
1036 /*
1037 * Avoid conflict with self. Multi-use check
1038 * was done earlier in xtables_option_parse.
1039 */
1040 continue;
1041 other = xtables_option_lookup(table, i);
1042 if (other == NULL)
1043 continue;
1044 xtables_option_fcheck2(name, entry, other, xflags);
1045 }
1046 }
1047 }
1048
1049 /**
1050 * Dispatch arguments to the appropriate final_check function, based upon the
1051 * extension's choice of API.
1052 */
xtables_option_tfcall(struct xtables_target * t)1053 void xtables_option_tfcall(struct xtables_target *t)
1054 {
1055 if (t->x6_fcheck != NULL) {
1056 struct xt_fcheck_call cb;
1057
1058 cb.ext_name = t->name;
1059 cb.data = t->t->data;
1060 cb.xflags = t->tflags;
1061 cb.udata = t->udata;
1062 t->x6_fcheck(&cb);
1063 } else if (t->final_check != NULL) {
1064 t->final_check(t->tflags);
1065 }
1066 if (t->x6_options != NULL)
1067 xtables_options_fcheck(t->name, t->tflags, t->x6_options);
1068 }
1069
1070 /**
1071 * Dispatch arguments to the appropriate final_check function, based upon the
1072 * extension's choice of API.
1073 */
xtables_option_mfcall(struct xtables_match * m)1074 void xtables_option_mfcall(struct xtables_match *m)
1075 {
1076 if (m->x6_fcheck != NULL) {
1077 struct xt_fcheck_call cb;
1078
1079 cb.ext_name = m->name;
1080 cb.data = m->m->data;
1081 cb.xflags = m->mflags;
1082 cb.udata = m->udata;
1083 m->x6_fcheck(&cb);
1084 } else if (m->final_check != NULL) {
1085 m->final_check(m->mflags);
1086 }
1087 if (m->x6_options != NULL)
1088 xtables_options_fcheck(m->name, m->mflags, m->x6_options);
1089 }
1090
xtables_lmap_init(const char * file)1091 struct xtables_lmap *xtables_lmap_init(const char *file)
1092 {
1093 struct xtables_lmap *lmap_head = NULL, *lmap_prev = NULL, *lmap_this;
1094 char buf[512];
1095 FILE *fp;
1096 char *cur, *nxt;
1097 int id;
1098
1099 fp = fopen(file, "re");
1100 if (fp == NULL)
1101 return NULL;
1102
1103 while (fgets(buf, sizeof(buf), fp) != NULL) {
1104 cur = buf;
1105 while (isspace(*cur))
1106 ++cur;
1107 if (*cur == '#' || *cur == '\n' || *cur == '\0')
1108 continue;
1109
1110 /* iproute2 allows hex and dec format */
1111 errno = 0;
1112 id = strtoul(cur, &nxt, strncmp(cur, "0x", 2) == 0 ? 16 : 10);
1113 if (nxt == cur || errno != 0)
1114 continue;
1115
1116 /* same boundaries as in iproute2 */
1117 if (id < 0 || id > 255)
1118 continue;
1119 cur = nxt;
1120
1121 if (!isspace(*cur))
1122 continue;
1123 while (isspace(*cur))
1124 ++cur;
1125 if (*cur == '#' || *cur == '\n' || *cur == '\0')
1126 continue;
1127 nxt = cur;
1128 while (*nxt != '\0' && !isspace(*nxt))
1129 ++nxt;
1130 if (nxt == cur)
1131 continue;
1132 *nxt = '\0';
1133
1134 /* found valid data */
1135 lmap_this = malloc(sizeof(*lmap_this));
1136 if (lmap_this == NULL) {
1137 perror("malloc");
1138 goto out;
1139 }
1140 lmap_this->id = id;
1141 lmap_this->name = strdup(cur);
1142 if (lmap_this->name == NULL) {
1143 free(lmap_this);
1144 goto out;
1145 }
1146 lmap_this->next = NULL;
1147
1148 if (lmap_prev != NULL)
1149 lmap_prev->next = lmap_this;
1150 else
1151 lmap_head = lmap_this;
1152 lmap_prev = lmap_this;
1153 }
1154
1155 fclose(fp);
1156 return lmap_head;
1157 out:
1158 fclose(fp);
1159 xtables_lmap_free(lmap_head);
1160 return NULL;
1161 }
1162
xtables_lmap_free(struct xtables_lmap * head)1163 void xtables_lmap_free(struct xtables_lmap *head)
1164 {
1165 struct xtables_lmap *next;
1166
1167 for (; head != NULL; head = next) {
1168 next = head->next;
1169 free(head->name);
1170 free(head);
1171 }
1172 }
1173
xtables_lmap_name2id(const struct xtables_lmap * head,const char * name)1174 int xtables_lmap_name2id(const struct xtables_lmap *head, const char *name)
1175 {
1176 for (; head != NULL; head = head->next)
1177 if (strcmp(head->name, name) == 0)
1178 return head->id;
1179 return -1;
1180 }
1181
xtables_lmap_id2name(const struct xtables_lmap * head,int id)1182 const char *xtables_lmap_id2name(const struct xtables_lmap *head, int id)
1183 {
1184 for (; head != NULL; head = head->next)
1185 if (head->id == id)
1186 return head->name;
1187 return NULL;
1188 }
1189