1 /* Code to save the xtables state, in human readable-form. */
2 /* (C) 1999 by Paul 'Rusty' Russell <rusty@rustcorp.com.au> and
3 * (C) 2000-2002 by Harald Welte <laforge@gnumonks.org>
4 * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org>
5 *
6 * This code is distributed under the terms of GNU GPL v2
7 *
8 */
9 #include "config.h"
10 #include <getopt.h>
11 #include <errno.h>
12 #include <libgen.h>
13 #include <stdio.h>
14 #include <fcntl.h>
15 #include <stdlib.h>
16 #include <string.h>
17 #include <time.h>
18 #include <netdb.h>
19 #include <unistd.h>
20 #include "libiptc/libiptc.h"
21 #include "iptables.h"
22 #include "xtables-multi.h"
23 #include "nft.h"
24 #include "nft-cache.h"
25
26 #include <libnftnl/chain.h>
27
28 #ifndef NO_SHARED_LIBS
29 #include <dlfcn.h>
30 #endif
31
32 #define prog_name xtables_globals.program_name
33 #define prog_vers xtables_globals.program_version
34
35 static const char *ipt_save_optstring = "bcdt:M:f:V";
36 static const struct option ipt_save_options[] = {
37 {.name = "counters", .has_arg = false, .val = 'c'},
38 {.name = "version", .has_arg = false, .val = 'V'},
39 {.name = "dump", .has_arg = false, .val = 'd'},
40 {.name = "table", .has_arg = true, .val = 't'},
41 {.name = "modprobe", .has_arg = true, .val = 'M'},
42 {.name = "file", .has_arg = true, .val = 'f'},
43 {NULL},
44 };
45
46 static const char *arp_save_optstring = "cM:V";
47 static const struct option arp_save_options[] = {
48 {.name = "counters", .has_arg = false, .val = 'c'},
49 {.name = "version", .has_arg = false, .val = 'V'},
50 {.name = "modprobe", .has_arg = true, .val = 'M'},
51 {NULL},
52 };
53
54 static const char *ebt_save_optstring = "ct:M:V";
55 static const struct option ebt_save_options[] = {
56 {.name = "counters", .has_arg = false, .val = 'c'},
57 {.name = "version", .has_arg = false, .val = 'V'},
58 {.name = "table", .has_arg = true, .val = 't'},
59 {.name = "modprobe", .has_arg = true, .val = 'M'},
60 {NULL},
61 };
62
63 struct do_output_data {
64 unsigned int format;
65 bool commit;
66 };
67
68 static int
__do_output(struct nft_handle * h,const char * tablename,void * data)69 __do_output(struct nft_handle *h, const char *tablename, void *data)
70 {
71 struct do_output_data *d = data;
72 time_t now;
73
74 if (!nft_table_builtin_find(h, tablename))
75 return 0;
76
77 if (!nft_is_table_compatible(h, tablename, NULL)) {
78 printf("# Table `%s' is incompatible, use 'nft' tool.\n",
79 tablename);
80 return 0;
81 }
82
83 now = time(NULL);
84 printf("# Generated by %s v%s on %s", prog_name,
85 prog_vers, ctime(&now));
86
87 printf("*%s\n", tablename);
88 /* Dump out chain names first,
89 * thereby preventing dependency conflicts */
90 nft_chain_foreach(h, tablename, nft_chain_save, h);
91 nft_rule_save(h, tablename, d->format);
92 if (d->commit)
93 printf("COMMIT\n");
94
95 now = time(NULL);
96 printf("# Completed on %s", ctime(&now));
97 return 0;
98 }
99
100 static int
do_output(struct nft_handle * h,const char * tablename,struct do_output_data * d)101 do_output(struct nft_handle *h, const char *tablename, struct do_output_data *d)
102 {
103 int ret;
104
105 if (!tablename) {
106 ret = nft_for_each_table(h, __do_output, d);
107 nft_check_xt_legacy(h->family, true);
108 return !!ret;
109 }
110
111 if (!nft_table_find(h, tablename) &&
112 !nft_table_builtin_find(h, tablename)) {
113 fprintf(stderr, "Table `%s' does not exist\n", tablename);
114 return 1;
115 }
116
117 ret = __do_output(h, tablename, d);
118 nft_check_xt_legacy(h->family, true);
119 return ret;
120 }
121
122 /* Format:
123 * :Chain name POLICY packets bytes
124 * rule
125 */
126 static int
xtables_save_main(int family,int argc,char * argv[],const char * optstring,const struct option * longopts)127 xtables_save_main(int family, int argc, char *argv[],
128 const char *optstring, const struct option *longopts)
129 {
130 const struct builtin_table *tables;
131 const char *tablename = NULL;
132 struct do_output_data d = {
133 .format = FMT_NOCOUNTS,
134 };
135 struct nft_handle h;
136 bool dump = false;
137 FILE *file = NULL;
138 int ret, c;
139
140 xtables_globals.program_name = basename(*argv);;
141 c = xtables_init_all(&xtables_globals, family);
142 if (c < 0) {
143 fprintf(stderr, "%s/%s Failed to initialize xtables\n",
144 xtables_globals.program_name,
145 xtables_globals.program_version);
146 exit(1);
147 }
148
149 while ((c = getopt_long(argc, argv, optstring, longopts, NULL)) != -1) {
150 switch (c) {
151 case 'b':
152 fprintf(stderr, "-b/--binary option is not implemented\n");
153 break;
154 case 'c':
155 d.format &= ~FMT_NOCOUNTS;
156 break;
157
158 case 't':
159 /* Select specific table. */
160 tablename = optarg;
161 break;
162 case 'M':
163 xtables_modprobe_program = optarg;
164 break;
165 case 'f':
166 file = fopen(optarg, "w");
167 if (file == NULL) {
168 fprintf(stderr, "Failed to open file, error: %s\n",
169 strerror(errno));
170 exit(1);
171 }
172 ret = dup2(fileno(file), STDOUT_FILENO);
173 if (ret == -1) {
174 fprintf(stderr, "Failed to redirect stdout, error: %s\n",
175 strerror(errno));
176 exit(1);
177 }
178 fclose(file);
179 break;
180 case 'd':
181 dump = true;
182 break;
183 case 'V':
184 printf("%s v%s (nf_tables)\n", prog_name, prog_vers);
185 exit(0);
186 default:
187 fprintf(stderr,
188 "Look at manual page `%s.8' for more information.\n",
189 prog_name);
190 exit(1);
191 }
192 }
193
194 if (optind < argc) {
195 fprintf(stderr, "Unknown arguments found on commandline\n");
196 exit(1);
197 }
198
199 switch (family) {
200 case NFPROTO_IPV4:
201 case NFPROTO_IPV6: /* fallthough, same table */
202 #if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS)
203 init_extensions();
204 init_extensions4();
205 #endif
206 tables = xtables_ipv4;
207 d.commit = true;
208 break;
209 case NFPROTO_ARP:
210 tables = xtables_arp;
211 break;
212 case NFPROTO_BRIDGE: {
213 const char *ctr = getenv("EBTABLES_SAVE_COUNTER");
214
215 if (!(d.format & FMT_NOCOUNTS)) {
216 d.format |= FMT_EBT_SAVE;
217 } else if (ctr && !strcmp(ctr, "yes")) {
218 d.format &= ~FMT_NOCOUNTS;
219 d.format |= FMT_C_COUNTS | FMT_EBT_SAVE;
220 }
221 tables = xtables_bridge;
222 break;
223 }
224 default:
225 fprintf(stderr, "Unknown family %d\n", family);
226 return 1;
227 }
228
229 if (nft_init(&h, family, tables) < 0) {
230 fprintf(stderr, "%s/%s Failed to initialize nft: %s\n",
231 xtables_globals.program_name,
232 xtables_globals.program_version,
233 strerror(errno));
234 exit(EXIT_FAILURE);
235 }
236
237 nft_cache_level_set(&h, NFT_CL_RULES, NULL);
238 nft_cache_build(&h);
239 nft_xt_fake_builtin_chains(&h, tablename, NULL);
240
241 ret = do_output(&h, tablename, &d);
242 nft_fini(&h);
243 xtables_fini();
244 if (dump)
245 exit(0);
246
247 return ret;
248 }
249
xtables_ip4_save_main(int argc,char * argv[])250 int xtables_ip4_save_main(int argc, char *argv[])
251 {
252 return xtables_save_main(NFPROTO_IPV4, argc, argv,
253 ipt_save_optstring, ipt_save_options);
254 }
255
xtables_ip6_save_main(int argc,char * argv[])256 int xtables_ip6_save_main(int argc, char *argv[])
257 {
258 return xtables_save_main(NFPROTO_IPV6, argc, argv,
259 ipt_save_optstring, ipt_save_options);
260 }
261
xtables_eb_save_main(int argc,char * argv[])262 int xtables_eb_save_main(int argc, char *argv[])
263 {
264 return xtables_save_main(NFPROTO_BRIDGE, argc, argv,
265 ebt_save_optstring, ebt_save_options);
266 }
267
xtables_arp_save_main(int argc,char * argv[])268 int xtables_arp_save_main(int argc, char *argv[])
269 {
270 return xtables_save_main(NFPROTO_ARP, argc, argv,
271 arp_save_optstring, arp_save_options);
272 }
273