1 /*
2 * Argument parser
3 * Copyright © Jan Engelhardt, 2011
4 *
5 * This program is free software; you can redistribute it and/or
6 * modify it under the terms of the GNU General Public License as
7 * published by the Free Software Foundation; either version 2 of
8 * the License, or (at your option) any later version.
9 */
10 #include <ctype.h>
11 #include <errno.h>
12 #include <getopt.h>
13 #include <limits.h>
14 #include <netdb.h>
15 #include <stdbool.h>
16 #include <stdint.h>
17 #include <stdio.h>
18 #include <stdlib.h>
19 #include <string.h>
20 #include <syslog.h>
21 #include <arpa/inet.h>
22 #include <netinet/ip.h>
23 #include "xtables.h"
24 #include "xtables_internal.h"
25 #ifndef IPTOS_NORMALSVC
26 # define IPTOS_NORMALSVC 0
27 #endif
28
29 #define XTOPT_MKPTR(cb) \
30 ((void *)((char *)(cb)->data + (cb)->entry->ptroff))
31
32 /**
33 * Simple key-value pairs for syslog levels
34 */
35 struct syslog_level {
36 char name[8];
37 uint8_t level;
38 };
39
40 struct tos_value_mask {
41 uint8_t value, mask;
42 };
43
44 static const size_t xtopt_psize[] = {
45 /*
46 * All types not listed here, and thus essentially being initialized to
47 * zero have zero on purpose.
48 */
49 [XTTYPE_UINT8] = sizeof(uint8_t),
50 [XTTYPE_UINT16] = sizeof(uint16_t),
51 [XTTYPE_UINT32] = sizeof(uint32_t),
52 [XTTYPE_UINT64] = sizeof(uint64_t),
53 [XTTYPE_UINT8RC] = sizeof(uint8_t[2]),
54 [XTTYPE_UINT16RC] = sizeof(uint16_t[2]),
55 [XTTYPE_UINT32RC] = sizeof(uint32_t[2]),
56 [XTTYPE_UINT64RC] = sizeof(uint64_t[2]),
57 [XTTYPE_DOUBLE] = sizeof(double),
58 [XTTYPE_STRING] = -1,
59 [XTTYPE_SYSLOGLEVEL] = sizeof(uint8_t),
60 [XTTYPE_HOST] = sizeof(union nf_inet_addr),
61 [XTTYPE_PROTOCOL] = sizeof(uint8_t),
62 [XTTYPE_PORT] = sizeof(uint16_t),
63 [XTTYPE_PORTRC] = sizeof(uint16_t[2]),
64 [XTTYPE_PLENMASK] = sizeof(union nf_inet_addr),
65 [XTTYPE_ETHERMAC] = sizeof(uint8_t[6]),
66 };
67
68 /**
69 * Return a sanitized afinfo->family value, covering for NFPROTO_ARP
70 */
afinfo_family(void)71 static uint8_t afinfo_family(void)
72 {
73 switch (afinfo->family) {
74 case NFPROTO_ARP:
75 case NFPROTO_BRIDGE:
76 return NFPROTO_IPV4;
77 default:
78 return afinfo->family;
79 }
80 }
81
82 /**
83 * Creates getopt options from the x6-style option map, and assigns each a
84 * getopt id.
85 */
86 struct option *
xtables_options_xfrm(struct option * orig_opts,struct option * oldopts,const struct xt_option_entry * entry,unsigned int * offset)87 xtables_options_xfrm(struct option *orig_opts, struct option *oldopts,
88 const struct xt_option_entry *entry, unsigned int *offset)
89 {
90 int num_new, i;
91 struct option *merge, *mp;
92
93 for (num_new = 0; entry[num_new].name != NULL; ++num_new)
94 ;
95
96 mp = xtables_calloc(num_new + 1, sizeof(*mp));
97 for (i = 0; i < num_new; i++) {
98 mp[i].name = entry[i].name;
99 mp[i].has_arg = entry[i].type != XTTYPE_NONE;
100 mp[i].val = entry[i].id;
101 }
102
103 merge = xtables_merge_options(orig_opts, oldopts, mp, offset);
104
105 free(mp);
106 return merge;
107 }
108
109 /**
110 * Give the upper limit for a certain type.
111 */
xtopt_max_by_type(enum xt_option_type type)112 static uintmax_t xtopt_max_by_type(enum xt_option_type type)
113 {
114 switch (type) {
115 case XTTYPE_UINT8:
116 case XTTYPE_UINT8RC:
117 return UINT8_MAX;
118 case XTTYPE_UINT16:
119 case XTTYPE_UINT16RC:
120 return UINT16_MAX;
121 case XTTYPE_UINT32:
122 case XTTYPE_UINT32RC:
123 return UINT32_MAX;
124 case XTTYPE_UINT64:
125 case XTTYPE_UINT64RC:
126 return UINT64_MAX;
127 default:
128 return 0;
129 }
130 }
131
132 /**
133 * Return the size of a single entity based upon a type - predominantly an
134 * XTTYPE_UINT*RC type.
135 */
xtopt_esize_by_type(enum xt_option_type type)136 static size_t xtopt_esize_by_type(enum xt_option_type type)
137 {
138 switch (type) {
139 case XTTYPE_UINT8RC:
140 return xtopt_psize[XTTYPE_UINT8];
141 case XTTYPE_UINT16RC:
142 return xtopt_psize[XTTYPE_UINT16];
143 case XTTYPE_UINT32RC:
144 return xtopt_psize[XTTYPE_UINT32];
145 case XTTYPE_UINT64RC:
146 return xtopt_psize[XTTYPE_UINT64];
147 default:
148 return xtopt_psize[type];
149 }
150 }
151
htonll(uint64_t val)152 static uint64_t htonll(uint64_t val)
153 {
154 uint32_t high = val >> 32;
155 uint32_t low = val & UINT32_MAX;
156
157 return (uint64_t)htonl(low) << 32 | htonl(high);
158 }
159
160 /**
161 * Require a simple integer.
162 */
xtopt_parse_int(struct xt_option_call * cb)163 static void xtopt_parse_int(struct xt_option_call *cb)
164 {
165 const struct xt_option_entry *entry = cb->entry;
166 uintmax_t lmin = 0, lmax = xtopt_max_by_type(entry->type);
167 uintmax_t value;
168
169 if (cb->entry->min != 0)
170 lmin = cb->entry->min;
171 if (cb->entry->max != 0)
172 lmax = cb->entry->max;
173
174 if (!xtables_strtoul_base(cb->arg, NULL, &value,
175 lmin, lmax, cb->entry->base))
176 xt_params->exit_err(PARAMETER_PROBLEM,
177 "%s: bad value for option \"--%s\", "
178 "or out of range (%ju-%ju).\n",
179 cb->ext_name, entry->name, lmin, lmax);
180
181 if (entry->type == XTTYPE_UINT8) {
182 cb->val.u8 = value;
183 if (entry->flags & XTOPT_PUT)
184 *(uint8_t *)XTOPT_MKPTR(cb) = cb->val.u8;
185 } else if (entry->type == XTTYPE_UINT16) {
186 cb->val.u16 = value;
187 if (entry->flags & XTOPT_NBO)
188 cb->val.u16 = htons(cb->val.u16);
189 if (entry->flags & XTOPT_PUT)
190 *(uint16_t *)XTOPT_MKPTR(cb) = cb->val.u16;
191 } else if (entry->type == XTTYPE_UINT32) {
192 cb->val.u32 = value;
193 if (entry->flags & XTOPT_NBO)
194 cb->val.u32 = htonl(cb->val.u32);
195 if (entry->flags & XTOPT_PUT)
196 *(uint32_t *)XTOPT_MKPTR(cb) = cb->val.u32;
197 } else if (entry->type == XTTYPE_UINT64) {
198 cb->val.u64 = value;
199 if (entry->flags & XTOPT_NBO)
200 cb->val.u64 = htonll(cb->val.u64);
201 if (entry->flags & XTOPT_PUT)
202 *(uint64_t *)XTOPT_MKPTR(cb) = cb->val.u64;
203 }
204 }
205
206 /**
207 * Require a simple floating point number.
208 */
xtopt_parse_float(struct xt_option_call * cb)209 static void xtopt_parse_float(struct xt_option_call *cb)
210 {
211 const struct xt_option_entry *entry = cb->entry;
212 double value;
213 char *end;
214
215 value = strtod(cb->arg, &end);
216 if (end == cb->arg || *end != '\0' ||
217 (entry->min != entry->max &&
218 (value < entry->min || value > entry->max)))
219 xt_params->exit_err(PARAMETER_PROBLEM,
220 "%s: bad value for option \"--%s\", "
221 "or out of range (%u-%u).\n",
222 cb->ext_name, entry->name, entry->min, entry->max);
223
224 cb->val.dbl = value;
225 if (entry->flags & XTOPT_PUT)
226 *(double *)XTOPT_MKPTR(cb) = cb->val.dbl;
227 }
228
229 /**
230 * Copy the parsed value to the appropriate entry in cb->val.
231 */
xtopt_mint_value_to_cb(struct xt_option_call * cb,uintmax_t value)232 static void xtopt_mint_value_to_cb(struct xt_option_call *cb, uintmax_t value)
233 {
234 const struct xt_option_entry *entry = cb->entry;
235 uint8_t i = cb->nvals;
236
237 if (i >= ARRAY_SIZE(cb->val.u32_range))
238 return;
239 if (entry->type == XTTYPE_UINT8RC) {
240 cb->val.u8_range[i] = value;
241 } else if (entry->type == XTTYPE_UINT16RC) {
242 cb->val.u16_range[i] = value;
243 if (entry->flags & XTOPT_NBO)
244 cb->val.u16_range[i] = htons(cb->val.u16_range[i]);
245 } else if (entry->type == XTTYPE_UINT32RC) {
246 cb->val.u32_range[i] = value;
247 if (entry->flags & XTOPT_NBO)
248 cb->val.u32_range[i] = htonl(cb->val.u32_range[i]);
249 } else if (entry->type == XTTYPE_UINT64RC) {
250 cb->val.u64_range[i] = value;
251 if (entry->flags & XTOPT_NBO)
252 cb->val.u64_range[i] = htonll(cb->val.u64_range[i]);
253 }
254 }
255
256 /**
257 * Copy the parsed value to the data area, using appropriate type access.
258 */
xtopt_mint_value_to_ptr(struct xt_option_call * cb,void ** datap,uintmax_t value)259 static void xtopt_mint_value_to_ptr(struct xt_option_call *cb, void **datap,
260 uintmax_t value)
261 {
262 const struct xt_option_entry *entry = cb->entry;
263 void *data = *datap;
264
265 if (!(entry->flags & XTOPT_PUT))
266 return;
267 if (entry->type == XTTYPE_UINT8RC)
268 *(uint8_t *)data = value;
269 else if (entry->type == XTTYPE_UINT16RC)
270 *(uint16_t *)data = value;
271 else if (entry->type == XTTYPE_UINT32RC)
272 *(uint32_t *)data = value;
273 else if (entry->type == XTTYPE_UINT64RC)
274 *(uint64_t *)data = value;
275 data += xtopt_esize_by_type(entry->type);
276 *datap = data;
277 }
278
279 /**
280 * Multiple integer parse routine.
281 *
282 * This function is capable of parsing any number of fields. Only the first
283 * two values from the string will be put into @cb however (and as such,
284 * @cb->val.uXX_range is just that large) to cater for the few extensions that
285 * do not have a range[2] field, but {min, max}, and which cannot use
286 * XTOPT_POINTER.
287 */
xtopt_parse_mint(struct xt_option_call * cb)288 static void xtopt_parse_mint(struct xt_option_call *cb)
289 {
290 const struct xt_option_entry *entry = cb->entry;
291 const char *arg;
292 size_t esize = xtopt_esize_by_type(entry->type);
293 uintmax_t lmax = xtopt_max_by_type(entry->type);
294 uintmax_t value, lmin = entry->min;
295 void *put = XTOPT_MKPTR(cb);
296 unsigned int maxiter;
297 char *end = "";
298 char sep = ':';
299
300 if (entry->max && entry->max < lmax)
301 lmax = entry->max;
302
303 maxiter = entry->size / esize;
304 if (maxiter == 0)
305 maxiter = ARRAY_SIZE(cb->val.u32_range);
306 if (entry->size % esize != 0)
307 xt_params->exit_err(OTHER_PROBLEM, "%s: memory block does "
308 "not have proper size\n", __func__);
309
310 cb->nvals = 0;
311 for (arg = cb->arg, end = (char *)arg; ; arg = end + 1) {
312 if (cb->nvals == maxiter)
313 xt_params->exit_err(PARAMETER_PROBLEM, "%s: Too many "
314 "components for option \"--%s\" (max: %u)\n",
315 cb->ext_name, entry->name, maxiter);
316 if (*arg == '\0' || *arg == sep) {
317 /* Default range components when field not spec'd. */
318 end = (char *)arg;
319 value = (cb->nvals == 1) ? lmax : lmin;
320 } else {
321 if (!xtables_strtoul(arg, &end, &value, lmin, lmax))
322 xt_params->exit_err(PARAMETER_PROBLEM,
323 "%s: bad value for option \"--%s\" near "
324 "\"%s\", or out of range (%ju-%ju).\n",
325 cb->ext_name, entry->name, arg, lmin, lmax);
326 if (*end != '\0' && *end != sep)
327 xt_params->exit_err(PARAMETER_PROBLEM,
328 "%s: Argument to \"--%s\" has "
329 "unexpected characters near \"%s\".\n",
330 cb->ext_name, entry->name, end);
331 lmin = value;
332 }
333 xtopt_mint_value_to_cb(cb, value);
334 ++cb->nvals;
335 xtopt_mint_value_to_ptr(cb, &put, value);
336 if (*end == '\0')
337 break;
338 }
339 }
340
xtopt_parse_string(struct xt_option_call * cb)341 static void xtopt_parse_string(struct xt_option_call *cb)
342 {
343 const struct xt_option_entry *entry = cb->entry;
344 size_t z = strlen(cb->arg);
345 char *p;
346
347 if (entry->min != 0 && z < entry->min)
348 xt_params->exit_err(PARAMETER_PROBLEM,
349 "Argument must have a minimum length of "
350 "%u characters\n", entry->min);
351 if (entry->max != 0 && z > entry->max)
352 xt_params->exit_err(PARAMETER_PROBLEM,
353 "Argument must have a maximum length of "
354 "%u characters\n", entry->max);
355 if (!(entry->flags & XTOPT_PUT))
356 return;
357 if (z >= entry->size)
358 z = entry->size - 1;
359 p = XTOPT_MKPTR(cb);
360 strncpy(p, cb->arg, z);
361 p[z] = '\0';
362 }
363
364 static const struct tos_symbol_info {
365 unsigned char value;
366 const char *name;
367 } tos_symbol_names[] = {
368 {IPTOS_LOWDELAY, "Minimize-Delay"},
369 {IPTOS_THROUGHPUT, "Maximize-Throughput"},
370 {IPTOS_RELIABILITY, "Maximize-Reliability"},
371 {IPTOS_MINCOST, "Minimize-Cost"},
372 {IPTOS_NORMALSVC, "Normal-Service"},
373 {},
374 };
375
376 /*
377 * tos_parse_numeric - parse a string like "15/255"
378 *
379 * @str: input string
380 * @tvm: (value/mask) tuple
381 * @max: maximum allowed value (must be pow(2,some_int)-1)
382 */
tos_parse_numeric(const char * str,struct xt_option_call * cb,unsigned int max)383 static bool tos_parse_numeric(const char *str, struct xt_option_call *cb,
384 unsigned int max)
385 {
386 unsigned int value;
387 char *end;
388
389 xtables_strtoui(str, &end, &value, 0, max);
390 cb->val.tos_value = value;
391 cb->val.tos_mask = max;
392
393 if (*end == '/') {
394 const char *p = end + 1;
395
396 if (!xtables_strtoui(p, &end, &value, 0, max))
397 xtables_error(PARAMETER_PROBLEM, "Illegal value: \"%s\"",
398 str);
399 cb->val.tos_mask = value;
400 }
401
402 if (*end != '\0')
403 xtables_error(PARAMETER_PROBLEM, "Illegal value: \"%s\"", str);
404 return true;
405 }
406
407 /**
408 * @str: input string
409 * @tvm: (value/mask) tuple
410 * @def_mask: mask to force when a symbolic name is used
411 */
xtopt_parse_tosmask(struct xt_option_call * cb)412 static void xtopt_parse_tosmask(struct xt_option_call *cb)
413 {
414 const struct tos_symbol_info *symbol;
415 char *tmp;
416
417 if (xtables_strtoui(cb->arg, &tmp, NULL, 0, UINT8_MAX)) {
418 tos_parse_numeric(cb->arg, cb, UINT8_MAX);
419 return;
420 }
421 /*
422 * This is our way we deal with different defaults
423 * for different revisions.
424 */
425 cb->val.tos_mask = cb->entry->max;
426 for (symbol = tos_symbol_names; symbol->name != NULL; ++symbol)
427 if (strcasecmp(cb->arg, symbol->name) == 0) {
428 cb->val.tos_value = symbol->value;
429 return;
430 }
431
432 xtables_error(PARAMETER_PROBLEM, "Symbolic name \"%s\" is unknown",
433 cb->arg);
434 }
435
436 /**
437 * Validate the input for being conformant to "mark[/mask]".
438 */
xtopt_parse_markmask(struct xt_option_call * cb)439 static void xtopt_parse_markmask(struct xt_option_call *cb)
440 {
441 xtables_parse_mark_mask(cb, &cb->val.mark, &cb->val.mask);
442 }
443
xtopt_sysloglvl_compare(const void * a,const void * b)444 static int xtopt_sysloglvl_compare(const void *a, const void *b)
445 {
446 const char *name = a;
447 const struct syslog_level *entry = b;
448
449 return strcmp(name, entry->name);
450 }
451
xtopt_parse_sysloglevel(struct xt_option_call * cb)452 static void xtopt_parse_sysloglevel(struct xt_option_call *cb)
453 {
454 static const struct syslog_level log_names[] = { /* must be sorted */
455 {"alert", LOG_ALERT},
456 {"crit", LOG_CRIT},
457 {"debug", LOG_DEBUG},
458 {"emerg", LOG_EMERG},
459 {"error", LOG_ERR}, /* deprecated */
460 {"info", LOG_INFO},
461 {"notice", LOG_NOTICE},
462 {"panic", LOG_EMERG}, /* deprecated */
463 {"warning", LOG_WARNING},
464 };
465 const struct syslog_level *e;
466 unsigned int num = 0;
467
468 if (!xtables_strtoui(cb->arg, NULL, &num, 0, 7)) {
469 e = bsearch(cb->arg, log_names, ARRAY_SIZE(log_names),
470 sizeof(*log_names), xtopt_sysloglvl_compare);
471 if (e == NULL)
472 xt_params->exit_err(PARAMETER_PROBLEM,
473 "log level \"%s\" unknown\n", cb->arg);
474 num = e->level;
475 }
476 cb->val.syslog_level = num;
477 if (cb->entry->flags & XTOPT_PUT)
478 *(uint8_t *)XTOPT_MKPTR(cb) = num;
479 }
480
xtables_sa_host(const void * sa,unsigned int afproto)481 static void *xtables_sa_host(const void *sa, unsigned int afproto)
482 {
483 if (afproto == AF_INET6)
484 return &((struct sockaddr_in6 *)sa)->sin6_addr;
485 else if (afproto == AF_INET)
486 return &((struct sockaddr_in *)sa)->sin_addr;
487 return (void *)sa;
488 }
489
xtables_sa_hostlen(unsigned int afproto)490 static socklen_t xtables_sa_hostlen(unsigned int afproto)
491 {
492 if (afproto == AF_INET6)
493 return sizeof(struct in6_addr);
494 else if (afproto == AF_INET)
495 return sizeof(struct in_addr);
496 return 0;
497 }
498
499 /**
500 * Accepts: a hostname (DNS), or a single inetaddr - without any mask. The
501 * result is stored in @cb->val.haddr. Additionally, @cb->val.hmask and
502 * @cb->val.hlen are set for completeness to the appropriate values.
503 */
xtopt_parse_host(struct xt_option_call * cb)504 static void xtopt_parse_host(struct xt_option_call *cb)
505 {
506 struct addrinfo hints = {.ai_family = afinfo_family()};
507 unsigned int adcount = 0;
508 struct addrinfo *res, *p;
509 int ret;
510
511 ret = getaddrinfo(cb->arg, NULL, &hints, &res);
512 if (ret != 0)
513 xt_params->exit_err(PARAMETER_PROBLEM,
514 "getaddrinfo: %s\n", gai_strerror(ret));
515
516 memset(&cb->val.hmask, 0xFF, sizeof(cb->val.hmask));
517 cb->val.hlen = (afinfo_family() == NFPROTO_IPV4) ? 32 : 128;
518
519 for (p = res; p != NULL; p = p->ai_next) {
520 if (adcount == 0) {
521 memset(&cb->val.haddr, 0, sizeof(cb->val.haddr));
522 memcpy(&cb->val.haddr,
523 xtables_sa_host(p->ai_addr, p->ai_family),
524 xtables_sa_hostlen(p->ai_family));
525 ++adcount;
526 continue;
527 }
528 if (memcmp(&cb->val.haddr,
529 xtables_sa_host(p->ai_addr, p->ai_family),
530 xtables_sa_hostlen(p->ai_family)) != 0)
531 xt_params->exit_err(PARAMETER_PROBLEM,
532 "%s resolves to more than one address\n",
533 cb->arg);
534 }
535
536 freeaddrinfo(res);
537 if (cb->entry->flags & XTOPT_PUT)
538 /* Validation in xtables_option_metavalidate */
539 memcpy(XTOPT_MKPTR(cb), &cb->val.haddr,
540 sizeof(cb->val.haddr));
541 }
542
543 /**
544 * @name: port name, or number as a string (e.g. "http" or "80")
545 *
546 * Resolve a port name to a number. Returns the port number in integral
547 * form on success, or <0 on error. (errno will not be set.)
548 */
xtables_getportbyname(const char * name)549 static int xtables_getportbyname(const char *name)
550 {
551 struct addrinfo *res = NULL, *p;
552 int ret;
553
554 ret = getaddrinfo(NULL, name, NULL, &res);
555 if (ret != 0)
556 return -1;
557 ret = -1;
558 for (p = res; p != NULL; p = p->ai_next) {
559 if (p->ai_family == AF_INET6) {
560 ret = ((struct sockaddr_in6 *)p->ai_addr)->sin6_port;
561 break;
562 } else if (p->ai_family == AF_INET) {
563 ret = ((struct sockaddr_in *)p->ai_addr)->sin_port;
564 break;
565 }
566 }
567 freeaddrinfo(res);
568 if (ret < 0)
569 return ret;
570 return ntohs(ret);
571 }
572
573 /**
574 * Validate and parse a protocol specification (number or name) by use of
575 * /etc/protocols and put the result into @cb->val.protocol.
576 */
xtopt_parse_protocol(struct xt_option_call * cb)577 static void xtopt_parse_protocol(struct xt_option_call *cb)
578 {
579 cb->val.protocol = xtables_parse_protocol(cb->arg);
580 if (cb->entry->flags & XTOPT_PUT)
581 *(uint8_t *)XTOPT_MKPTR(cb) = cb->val.protocol;
582 }
583
584 /**
585 * Validate and parse a port specification and put the result into
586 * @cb->val.port.
587 */
xtopt_parse_port(struct xt_option_call * cb)588 static void xtopt_parse_port(struct xt_option_call *cb)
589 {
590 const struct xt_option_entry *entry = cb->entry;
591 int ret;
592
593 ret = xtables_getportbyname(cb->arg);
594 if (ret < 0)
595 xt_params->exit_err(PARAMETER_PROBLEM,
596 "Port \"%s\" does not resolve to anything.\n",
597 cb->arg);
598 if (entry->flags & XTOPT_NBO)
599 ret = htons(ret);
600 cb->val.port = ret;
601 if (entry->flags & XTOPT_PUT)
602 *(uint16_t *)XTOPT_MKPTR(cb) = cb->val.port;
603 }
604
xtopt_parse_mport(struct xt_option_call * cb)605 static void xtopt_parse_mport(struct xt_option_call *cb)
606 {
607 static const size_t esize = sizeof(uint16_t);
608 const struct xt_option_entry *entry = cb->entry;
609 char *lo_arg, *wp_arg, *arg;
610 unsigned int maxiter;
611 int value, prev = 0;
612
613 wp_arg = lo_arg = xtables_strdup(cb->arg);
614
615 maxiter = entry->size / esize;
616 if (maxiter == 0)
617 maxiter = 2; /* ARRAY_SIZE(cb->val.port_range) */
618 if (entry->size % esize != 0)
619 xt_params->exit_err(OTHER_PROBLEM, "%s: memory block does "
620 "not have proper size\n", __func__);
621
622 cb->val.port_range[0] = 0;
623 cb->val.port_range[1] = UINT16_MAX;
624 cb->nvals = 0;
625
626 while ((arg = strsep(&wp_arg, ":")) != NULL) {
627 if (cb->nvals == maxiter)
628 xt_params->exit_err(PARAMETER_PROBLEM, "%s: Too many "
629 "components for option \"--%s\" (max: %u)\n",
630 cb->ext_name, entry->name, maxiter);
631 if (*arg == '\0') {
632 ++cb->nvals;
633 continue;
634 }
635
636 value = xtables_getportbyname(arg);
637 if (value < 0)
638 xt_params->exit_err(PARAMETER_PROBLEM,
639 "Port \"%s\" does not resolve to "
640 "anything.\n", arg);
641 if (value < prev)
642 xt_params->exit_err(PARAMETER_PROBLEM,
643 "Port range %d-%d is negative.\n",
644 prev, value);
645 prev = value;
646 if (entry->flags & XTOPT_NBO)
647 value = htons(value);
648 if (cb->nvals < ARRAY_SIZE(cb->val.port_range))
649 cb->val.port_range[cb->nvals] = value;
650 ++cb->nvals;
651 }
652
653 if (cb->nvals == 1) {
654 cb->val.port_range[1] = cb->val.port_range[0];
655 ++cb->nvals;
656 }
657 if (entry->flags & XTOPT_PUT)
658 memcpy(XTOPT_MKPTR(cb), cb->val.port_range, sizeof(uint16_t) *
659 (cb->nvals <= maxiter ? cb->nvals : maxiter));
660 free(lo_arg);
661 }
662
xtopt_parse_mask(struct xt_option_call * cb)663 static int xtopt_parse_mask(struct xt_option_call *cb)
664 {
665 struct addrinfo hints = {.ai_family = afinfo_family(),
666 .ai_flags = AI_NUMERICHOST };
667 struct addrinfo *res;
668 int ret;
669
670 ret = getaddrinfo(cb->arg, NULL, &hints, &res);
671 if (ret != 0)
672 return 0;
673
674 memcpy(&cb->val.hmask, xtables_sa_host(res->ai_addr, res->ai_family),
675 xtables_sa_hostlen(res->ai_family));
676
677 switch(afinfo_family()) {
678 case AF_INET:
679 cb->val.hlen = xtables_ipmask_to_cidr(&cb->val.hmask.in);
680 break;
681 case AF_INET6:
682 cb->val.hlen = xtables_ip6mask_to_cidr(&cb->val.hmask.in6);
683 break;
684 }
685
686 freeaddrinfo(res);
687 return 1;
688 }
689
690 /**
691 * Parse an integer and ensure it is within the address family's prefix length
692 * limits. The result is stored in @cb->val.hlen.
693 */
xtopt_parse_plen(struct xt_option_call * cb)694 static void xtopt_parse_plen(struct xt_option_call *cb)
695 {
696 const struct xt_option_entry *entry = cb->entry;
697 unsigned int prefix_len = 128; /* happiness is a warm gcc */
698
699 cb->val.hlen = (afinfo_family() == NFPROTO_IPV4) ? 32 : 128;
700 if (!xtables_strtoui(cb->arg, NULL, &prefix_len, 0, cb->val.hlen)) {
701 /* Is this mask expressed in full format? e.g. 255.255.255.0 */
702 if (xtopt_parse_mask(cb))
703 return;
704
705 xt_params->exit_err(PARAMETER_PROBLEM,
706 "%s: bad value for option \"--%s\", "
707 "neither a valid network mask "
708 "nor valid CIDR (%u-%u).\n",
709 cb->ext_name, entry->name, 0, cb->val.hlen);
710 }
711 cb->val.hlen = prefix_len;
712 }
713
714 /**
715 * Reuse xtopt_parse_plen for testing the integer. Afterwards convert this to
716 * a bitmask, and make it available through @cb->val.hmask (hlen remains
717 * valid). If %XTOPT_PUT is used, hmask will be copied to the target area.
718 */
xtopt_parse_plenmask(struct xt_option_call * cb)719 static void xtopt_parse_plenmask(struct xt_option_call *cb)
720 {
721 const struct xt_option_entry *entry = cb->entry;
722 uint32_t *mask = cb->val.hmask.all;
723
724 xtopt_parse_plen(cb);
725
726 /* may not be convertible to CIDR notation */
727 if (cb->val.hlen == (uint8_t)-1)
728 goto out_put;
729
730 memset(mask, 0xFF, sizeof(union nf_inet_addr));
731 /* This shifting is AF-independent. */
732 if (cb->val.hlen == 0) {
733 mask[0] = mask[1] = mask[2] = mask[3] = 0;
734 } else if (cb->val.hlen <= 32) {
735 mask[0] <<= 32 - cb->val.hlen;
736 mask[1] = mask[2] = mask[3] = 0;
737 } else if (cb->val.hlen <= 64) {
738 mask[1] <<= 32 - (cb->val.hlen - 32);
739 mask[2] = mask[3] = 0;
740 } else if (cb->val.hlen <= 96) {
741 mask[2] <<= 32 - (cb->val.hlen - 64);
742 mask[3] = 0;
743 } else if (cb->val.hlen <= 128) {
744 mask[3] <<= 32 - (cb->val.hlen - 96);
745 }
746 mask[0] = htonl(mask[0]);
747 mask[1] = htonl(mask[1]);
748 mask[2] = htonl(mask[2]);
749 mask[3] = htonl(mask[3]);
750 out_put:
751 if (entry->flags & XTOPT_PUT)
752 memcpy(XTOPT_MKPTR(cb), mask, sizeof(union nf_inet_addr));
753 }
754
xtopt_parse_hostmask(struct xt_option_call * cb)755 static void xtopt_parse_hostmask(struct xt_option_call *cb)
756 {
757 const char *orig_arg = cb->arg;
758 char *work, *p;
759
760 if (strchr(cb->arg, '/') == NULL) {
761 xtopt_parse_host(cb);
762 return;
763 }
764 work = xtables_strdup(orig_arg);
765 p = strchr(work, '/'); /* by def this can't be NULL now */
766 *p++ = '\0';
767 /*
768 * Because xtopt_parse_host and xtopt_parse_plenmask would store
769 * different things in the same target area, XTTYPE_HOSTMASK must
770 * disallow XTOPT_PUT, which it does by forcing its absence,
771 * cf. not being listed in xtopt_psize.
772 */
773 cb->arg = work;
774 xtopt_parse_host(cb);
775 cb->arg = p;
776 xtopt_parse_plenmask(cb);
777 cb->arg = orig_arg;
778 free(work);
779 }
780
xtopt_parse_ethermac(struct xt_option_call * cb)781 static void xtopt_parse_ethermac(struct xt_option_call *cb)
782 {
783 const char *arg = cb->arg;
784 unsigned int i;
785 char *end;
786
787 for (i = 0; i < ARRAY_SIZE(cb->val.ethermac) - 1; ++i) {
788 cb->val.ethermac[i] = strtoul(arg, &end, 16);
789 if (*end != ':' || end - arg > 2)
790 goto out;
791 arg = end + 1;
792 }
793 i = ARRAY_SIZE(cb->val.ethermac) - 1;
794 cb->val.ethermac[i] = strtoul(arg, &end, 16);
795 if (*end != '\0' || end - arg > 2)
796 goto out;
797 if (cb->entry->flags & XTOPT_PUT)
798 memcpy(XTOPT_MKPTR(cb), cb->val.ethermac,
799 sizeof(cb->val.ethermac));
800 return;
801 out:
802 xt_params->exit_err(PARAMETER_PROBLEM, "Invalid MAC address specified.");
803 }
804
xtopt_parse_ethermacmask(struct xt_option_call * cb)805 static void xtopt_parse_ethermacmask(struct xt_option_call *cb)
806 {
807 memset(cb->val.ethermacmask, 0xff, ETH_ALEN);
808 if (xtables_parse_mac_and_mask(cb->arg, cb->val.ethermac,
809 cb->val.ethermacmask))
810 xt_params->exit_err(PARAMETER_PROBLEM,
811 "Invalid MAC/mask address specified.");
812 }
813
814 static void (*const xtopt_subparse[])(struct xt_option_call *) = {
815 [XTTYPE_UINT8] = xtopt_parse_int,
816 [XTTYPE_UINT16] = xtopt_parse_int,
817 [XTTYPE_UINT32] = xtopt_parse_int,
818 [XTTYPE_UINT64] = xtopt_parse_int,
819 [XTTYPE_UINT8RC] = xtopt_parse_mint,
820 [XTTYPE_UINT16RC] = xtopt_parse_mint,
821 [XTTYPE_UINT32RC] = xtopt_parse_mint,
822 [XTTYPE_UINT64RC] = xtopt_parse_mint,
823 [XTTYPE_DOUBLE] = xtopt_parse_float,
824 [XTTYPE_STRING] = xtopt_parse_string,
825 [XTTYPE_TOSMASK] = xtopt_parse_tosmask,
826 [XTTYPE_MARKMASK32] = xtopt_parse_markmask,
827 [XTTYPE_SYSLOGLEVEL] = xtopt_parse_sysloglevel,
828 [XTTYPE_HOST] = xtopt_parse_host,
829 [XTTYPE_HOSTMASK] = xtopt_parse_hostmask,
830 [XTTYPE_PROTOCOL] = xtopt_parse_protocol,
831 [XTTYPE_PORT] = xtopt_parse_port,
832 [XTTYPE_PORTRC] = xtopt_parse_mport,
833 [XTTYPE_PLEN] = xtopt_parse_plen,
834 [XTTYPE_PLENMASK] = xtopt_parse_plenmask,
835 [XTTYPE_ETHERMAC] = xtopt_parse_ethermac,
836 [XTTYPE_ETHERMACMASK]= xtopt_parse_ethermacmask,
837 };
838
839 /**
840 * The master option parsing routine. May be used for the ".x6_parse"
841 * function pointer in extensions if fully automatic parsing is desired.
842 * It may be also called manually from a custom x6_parse function.
843 */
xtables_option_parse(struct xt_option_call * cb)844 void xtables_option_parse(struct xt_option_call *cb)
845 {
846 const struct xt_option_entry *entry = cb->entry;
847 unsigned int eflag = 1 << cb->entry->id;
848
849 /*
850 * With {.id = P_FOO, .excl = P_FOO} we can have simple double-use
851 * prevention. Though it turned out that this is too much typing (most
852 * of the options are one-time use only), so now we also have
853 * %XTOPT_MULTI.
854 */
855 if ((!(entry->flags & XTOPT_MULTI) || (entry->excl & eflag)) &&
856 cb->xflags & eflag)
857 xt_params->exit_err(PARAMETER_PROBLEM,
858 "%s: option \"--%s\" can only be used once.\n",
859 cb->ext_name, cb->entry->name);
860 if (cb->invert && !(entry->flags & XTOPT_INVERT))
861 xt_params->exit_err(PARAMETER_PROBLEM,
862 "%s: option \"--%s\" cannot be inverted.\n",
863 cb->ext_name, entry->name);
864 if (entry->type != XTTYPE_NONE && optarg == NULL)
865 xt_params->exit_err(PARAMETER_PROBLEM,
866 "%s: option \"--%s\" requires an argument.\n",
867 cb->ext_name, entry->name);
868 /*
869 * Fill in fallback value for "nvals", in case an extension (as it
870 * happened with libxt_conntrack.2) tries to read it, despite not using
871 * a *RC option type.
872 */
873 cb->nvals = 1;
874 if (entry->type < ARRAY_SIZE(xtopt_subparse) &&
875 xtopt_subparse[entry->type] != NULL)
876 xtopt_subparse[entry->type](cb);
877 /* Exclusion with other flags tested later in finalize. */
878 cb->xflags |= 1 << entry->id;
879 }
880
881 /**
882 * Verifies that an extension's option map descriptor is valid, and ought to
883 * be called right after the extension has been loaded, and before option
884 * merging/xfrm.
885 */
xtables_option_metavalidate(const char * name,const struct xt_option_entry * entry)886 void xtables_option_metavalidate(const char *name,
887 const struct xt_option_entry *entry)
888 {
889 for (; entry->name != NULL; ++entry) {
890 if (entry->id >= CHAR_BIT * sizeof(unsigned int) ||
891 entry->id >= XT_OPTION_OFFSET_SCALE)
892 xt_params->exit_err(OTHER_PROBLEM,
893 "Extension %s uses invalid ID %u\n",
894 name, entry->id);
895 if (!(entry->flags & XTOPT_PUT)) {
896 if (entry->ptroff != 0)
897 xt_params->exit_err(OTHER_PROBLEM,
898 "%s: ptroff for \"--%s\" is non-"
899 "zero but no XTOPT_PUT is specified. "
900 "Oversight?", name, entry->name);
901 continue;
902 }
903 if (entry->type >= ARRAY_SIZE(xtopt_psize) ||
904 xtopt_psize[entry->type] == 0)
905 xt_params->exit_err(OTHER_PROBLEM,
906 "%s: entry type of option \"--%s\" cannot be "
907 "combined with XTOPT_PUT\n",
908 name, entry->name);
909 if (xtopt_psize[entry->type] != -1 &&
910 xtopt_psize[entry->type] != entry->size)
911 xt_params->exit_err(OTHER_PROBLEM,
912 "%s: option \"--%s\" points to a memory block "
913 "of wrong size (expected %zu, got %zu)\n",
914 name, entry->name,
915 xtopt_psize[entry->type], entry->size);
916 }
917 }
918
919 /**
920 * Find an option entry by its id.
921 */
922 static const struct xt_option_entry *
xtables_option_lookup(const struct xt_option_entry * entry,unsigned int id)923 xtables_option_lookup(const struct xt_option_entry *entry, unsigned int id)
924 {
925 for (; entry->name != NULL; ++entry)
926 if (entry->id == id)
927 return entry;
928 return NULL;
929 }
930
931 /**
932 * @c: getopt id (i.e. with offset)
933 * @fw: struct ipt_entry or ip6t_entry
934 *
935 * Dispatch arguments to the appropriate parse function, based upon the
936 * extension's choice of API.
937 */
xtables_option_tpcall(unsigned int c,char ** argv,bool invert,struct xtables_target * t,void * fw)938 void xtables_option_tpcall(unsigned int c, char **argv, bool invert,
939 struct xtables_target *t, void *fw)
940 {
941 struct xt_option_call cb;
942
943 if (t->x6_parse == NULL) {
944 if (t->parse != NULL)
945 t->parse(c - t->option_offset, argv, invert,
946 &t->tflags, fw, &t->t);
947 return;
948 }
949
950 c -= t->option_offset;
951 cb.entry = xtables_option_lookup(t->x6_options, c);
952 if (cb.entry == NULL)
953 xtables_error(OTHER_PROBLEM,
954 "Extension does not know id %u", c);
955 cb.arg = optarg;
956 cb.invert = invert;
957 cb.ext_name = t->name;
958 cb.data = t->t->data;
959 cb.xflags = t->tflags;
960 cb.target = &t->t;
961 cb.xt_entry = fw;
962 cb.udata = t->udata;
963 t->x6_parse(&cb);
964 t->tflags = cb.xflags;
965 }
966
967 /**
968 * @c: getopt id (i.e. with offset)
969 * @fw: struct ipt_entry or ip6t_entry
970 *
971 * Dispatch arguments to the appropriate parse function, based upon the
972 * extension's choice of API.
973 */
xtables_option_mpcall(unsigned int c,char ** argv,bool invert,struct xtables_match * m,void * fw)974 void xtables_option_mpcall(unsigned int c, char **argv, bool invert,
975 struct xtables_match *m, void *fw)
976 {
977 struct xt_option_call cb;
978
979 if (m->x6_parse == NULL) {
980 if (m->parse != NULL)
981 m->parse(c - m->option_offset, argv, invert,
982 &m->mflags, fw, &m->m);
983 return;
984 }
985
986 c -= m->option_offset;
987 cb.entry = xtables_option_lookup(m->x6_options, c);
988 if (cb.entry == NULL)
989 xtables_error(OTHER_PROBLEM,
990 "Extension does not know id %u", c);
991 cb.arg = optarg;
992 cb.invert = invert;
993 cb.ext_name = m->name;
994 cb.data = m->m->data;
995 cb.xflags = m->mflags;
996 cb.match = &m->m;
997 cb.xt_entry = fw;
998 cb.udata = m->udata;
999 m->x6_parse(&cb);
1000 m->mflags = cb.xflags;
1001 }
1002
1003 /**
1004 * @name: name of extension
1005 * @entry: current option (from all ext's entries) being validated
1006 * @xflags: flags the extension has collected
1007 * @i: conflicting option (id) to test for
1008 */
1009 static void
xtables_option_fcheck2(const char * name,const struct xt_option_entry * entry,const struct xt_option_entry * other,unsigned int xflags)1010 xtables_option_fcheck2(const char *name, const struct xt_option_entry *entry,
1011 const struct xt_option_entry *other,
1012 unsigned int xflags)
1013 {
1014 unsigned int ef = 1 << entry->id, of = 1 << other->id;
1015
1016 if (entry->also & of && !(xflags & of))
1017 xt_params->exit_err(PARAMETER_PROBLEM,
1018 "%s: option \"--%s\" also requires \"--%s\".\n",
1019 name, entry->name, other->name);
1020
1021 if (!(entry->excl & of))
1022 /* Use of entry does not collide with other option, good. */
1023 return;
1024 if ((xflags & (ef | of)) != (ef | of))
1025 /* Conflicting options were not used. */
1026 return;
1027
1028 xt_params->exit_err(PARAMETER_PROBLEM,
1029 "%s: option \"--%s\" cannot be used together with \"--%s\".\n",
1030 name, entry->name, other->name);
1031 }
1032
1033 /**
1034 * @name: name of extension
1035 * @xflags: accumulated flags
1036 * @entry: extension's option table
1037 *
1038 * Check that all option constraints have been met. This effectively replaces
1039 * ->final_check of the older API.
1040 */
xtables_options_fcheck(const char * name,unsigned int xflags,const struct xt_option_entry * table)1041 void xtables_options_fcheck(const char *name, unsigned int xflags,
1042 const struct xt_option_entry *table)
1043 {
1044 const struct xt_option_entry *entry, *other;
1045 unsigned int i;
1046
1047 for (entry = table; entry->name != NULL; ++entry) {
1048 if (entry->flags & XTOPT_MAND &&
1049 !(xflags & (1 << entry->id)))
1050 xt_params->exit_err(PARAMETER_PROBLEM,
1051 "%s: option \"--%s\" must be specified\n",
1052 name, entry->name);
1053 if (!(xflags & (1 << entry->id)))
1054 /* Not required, not specified, thus skip. */
1055 continue;
1056
1057 for (i = 0; i < CHAR_BIT * sizeof(entry->id); ++i) {
1058 if (entry->id == i)
1059 /*
1060 * Avoid conflict with self. Multi-use check
1061 * was done earlier in xtables_option_parse.
1062 */
1063 continue;
1064 other = xtables_option_lookup(table, i);
1065 if (other == NULL)
1066 continue;
1067 xtables_option_fcheck2(name, entry, other, xflags);
1068 }
1069 }
1070 }
1071
1072 /**
1073 * Dispatch arguments to the appropriate final_check function, based upon the
1074 * extension's choice of API.
1075 */
xtables_option_tfcall(struct xtables_target * t)1076 void xtables_option_tfcall(struct xtables_target *t)
1077 {
1078 if (t->x6_fcheck != NULL) {
1079 struct xt_fcheck_call cb;
1080
1081 cb.ext_name = t->name;
1082 cb.data = t->t->data;
1083 cb.xflags = t->tflags;
1084 cb.udata = t->udata;
1085 t->x6_fcheck(&cb);
1086 } else if (t->final_check != NULL) {
1087 t->final_check(t->tflags);
1088 }
1089 if (t->x6_options != NULL)
1090 xtables_options_fcheck(t->name, t->tflags, t->x6_options);
1091 }
1092
1093 /**
1094 * Dispatch arguments to the appropriate final_check function, based upon the
1095 * extension's choice of API.
1096 */
xtables_option_mfcall(struct xtables_match * m)1097 void xtables_option_mfcall(struct xtables_match *m)
1098 {
1099 if (m->x6_fcheck != NULL) {
1100 struct xt_fcheck_call cb;
1101
1102 cb.ext_name = m->name;
1103 cb.data = m->m->data;
1104 cb.xflags = m->mflags;
1105 cb.udata = m->udata;
1106 m->x6_fcheck(&cb);
1107 } else if (m->final_check != NULL) {
1108 m->final_check(m->mflags);
1109 }
1110 if (m->x6_options != NULL)
1111 xtables_options_fcheck(m->name, m->mflags, m->x6_options);
1112 }
1113
xtables_lmap_init(const char * file)1114 struct xtables_lmap *xtables_lmap_init(const char *file)
1115 {
1116 struct xtables_lmap *lmap_head = NULL, *lmap_prev = NULL, *lmap_this;
1117 char buf[512];
1118 FILE *fp;
1119 char *cur, *nxt;
1120 int id;
1121
1122 fp = fopen(file, "re");
1123 if (fp == NULL)
1124 return NULL;
1125
1126 while (fgets(buf, sizeof(buf), fp) != NULL) {
1127 cur = buf;
1128 while (isspace(*cur))
1129 ++cur;
1130 if (*cur == '#' || *cur == '\n' || *cur == '\0')
1131 continue;
1132
1133 /* iproute2 allows hex and dec format */
1134 errno = 0;
1135 id = strtoul(cur, &nxt, strncmp(cur, "0x", 2) == 0 ? 16 : 10);
1136 if (nxt == cur || errno != 0)
1137 continue;
1138
1139 /* same boundaries as in iproute2 */
1140 if (id < 0 || id > 255)
1141 continue;
1142 cur = nxt;
1143
1144 if (!isspace(*cur))
1145 continue;
1146 while (isspace(*cur))
1147 ++cur;
1148 if (*cur == '#' || *cur == '\n' || *cur == '\0')
1149 continue;
1150 nxt = cur;
1151 while (*nxt != '\0' && !isspace(*nxt))
1152 ++nxt;
1153 if (nxt == cur)
1154 continue;
1155 *nxt = '\0';
1156
1157 /* found valid data */
1158 lmap_this = malloc(sizeof(*lmap_this));
1159 if (lmap_this == NULL) {
1160 perror("malloc");
1161 goto out;
1162 }
1163 lmap_this->id = id;
1164 lmap_this->name = xtables_strdup(cur);
1165 lmap_this->next = NULL;
1166
1167 if (lmap_prev != NULL)
1168 lmap_prev->next = lmap_this;
1169 else
1170 lmap_head = lmap_this;
1171 lmap_prev = lmap_this;
1172 }
1173
1174 fclose(fp);
1175 return lmap_head;
1176 out:
1177 fclose(fp);
1178 xtables_lmap_free(lmap_head);
1179 return NULL;
1180 }
1181
xtables_lmap_free(struct xtables_lmap * head)1182 void xtables_lmap_free(struct xtables_lmap *head)
1183 {
1184 struct xtables_lmap *next;
1185
1186 for (; head != NULL; head = next) {
1187 next = head->next;
1188 free(head->name);
1189 free(head);
1190 }
1191 }
1192
xtables_lmap_name2id(const struct xtables_lmap * head,const char * name)1193 int xtables_lmap_name2id(const struct xtables_lmap *head, const char *name)
1194 {
1195 for (; head != NULL; head = head->next)
1196 if (strcmp(head->name, name) == 0)
1197 return head->id;
1198 return -1;
1199 }
1200
xtables_lmap_id2name(const struct xtables_lmap * head,int id)1201 const char *xtables_lmap_id2name(const struct xtables_lmap *head, int id)
1202 {
1203 for (; head != NULL; head = head->next)
1204 if (head->id == id)
1205 return head->name;
1206 return NULL;
1207 }
1208