|
Packit Service |
d1fe03 |
/*
|
|
Packit Service |
d1fe03 |
* (C) 2012-2014 by Pablo Neira Ayuso <pablo@netfilter.org>
|
|
Packit Service |
d1fe03 |
* (C) 2013 by Tomasz Bursztyka <tomasz.bursztyka@linux.intel.com>
|
|
Packit Service |
d1fe03 |
*
|
|
Packit Service |
d1fe03 |
* This program is free software; you can redistribute it and/or modify
|
|
Packit Service |
d1fe03 |
* it under the terms of the GNU General Public License as published by
|
|
Packit Service |
d1fe03 |
* the Free Software Foundation; either version 2 of the License, or
|
|
Packit Service |
d1fe03 |
* (at your option) any later version.
|
|
Packit Service |
d1fe03 |
*
|
|
Packit Service |
d1fe03 |
* This code has been sponsored by Sophos Astaro <http://www.sophos.com>
|
|
Packit Service |
d1fe03 |
*/
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
#include <string.h>
|
|
Packit Service |
d1fe03 |
#include <stdio.h>
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
#include <sys/socket.h>
|
|
Packit Service |
d1fe03 |
#include <netinet/in.h>
|
|
Packit Service |
d1fe03 |
#include <arpa/inet.h>
|
|
Packit Service |
d1fe03 |
#include <netinet/ip.h>
|
|
Packit Service |
d1fe03 |
#include <netdb.h>
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
#include <xtables.h>
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
#include <linux/netfilter/nf_tables.h>
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
#include "nft.h"
|
|
Packit Service |
d1fe03 |
#include "nft-shared.h"
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
static int nft_ipv4_add(struct nft_handle *h, struct nftnl_rule *r, void *data)
|
|
Packit Service |
d1fe03 |
{
|
|
Packit Service |
d1fe03 |
struct iptables_command_state *cs = data;
|
|
Packit Service |
d1fe03 |
struct xtables_rule_match *matchp;
|
|
Packit Service |
d1fe03 |
uint32_t op;
|
|
Packit Service |
d1fe03 |
int ret;
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
if (cs->fw.ip.iniface[0] != '\0') {
|
|
Packit Service |
d1fe03 |
op = nft_invflags2cmp(cs->fw.ip.invflags, IPT_INV_VIA_IN);
|
|
Packit Service |
d1fe03 |
add_iniface(r, cs->fw.ip.iniface, op);
|
|
Packit Service |
d1fe03 |
}
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
if (cs->fw.ip.outiface[0] != '\0') {
|
|
Packit Service |
d1fe03 |
op = nft_invflags2cmp(cs->fw.ip.invflags, IPT_INV_VIA_OUT);
|
|
Packit Service |
d1fe03 |
add_outiface(r, cs->fw.ip.outiface, op);
|
|
Packit Service |
d1fe03 |
}
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
if (cs->fw.ip.proto != 0) {
|
|
Packit Service |
d1fe03 |
op = nft_invflags2cmp(cs->fw.ip.invflags, XT_INV_PROTO);
|
|
Packit Service |
d1fe03 |
add_l4proto(r, cs->fw.ip.proto, op);
|
|
Packit Service |
d1fe03 |
}
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
if (cs->fw.ip.src.s_addr || cs->fw.ip.smsk.s_addr || cs->fw.ip.invflags & IPT_INV_SRCIP) {
|
|
Packit Service |
d1fe03 |
op = nft_invflags2cmp(cs->fw.ip.invflags, IPT_INV_SRCIP);
|
|
Packit Service |
d1fe03 |
add_addr(r, offsetof(struct iphdr, saddr),
|
|
Packit Service |
d1fe03 |
&cs->fw.ip.src.s_addr, &cs->fw.ip.smsk.s_addr,
|
|
Packit Service |
d1fe03 |
sizeof(struct in_addr), op);
|
|
Packit Service |
d1fe03 |
}
|
|
Packit Service |
d1fe03 |
if (cs->fw.ip.dst.s_addr || cs->fw.ip.dmsk.s_addr || cs->fw.ip.invflags & IPT_INV_DSTIP) {
|
|
Packit Service |
d1fe03 |
op = nft_invflags2cmp(cs->fw.ip.invflags, IPT_INV_DSTIP);
|
|
Packit Service |
d1fe03 |
add_addr(r, offsetof(struct iphdr, daddr),
|
|
Packit Service |
d1fe03 |
&cs->fw.ip.dst.s_addr, &cs->fw.ip.dmsk.s_addr,
|
|
Packit Service |
d1fe03 |
sizeof(struct in_addr), op);
|
|
Packit Service |
d1fe03 |
}
|
|
Packit Service |
d1fe03 |
if (cs->fw.ip.flags & IPT_F_FRAG) {
|
|
Packit Service |
d1fe03 |
add_payload(r, offsetof(struct iphdr, frag_off), 2,
|
|
Packit Service |
d1fe03 |
NFT_PAYLOAD_NETWORK_HEADER);
|
|
Packit Service |
d1fe03 |
/* get the 13 bits that contain the fragment offset */
|
|
Packit Service |
d1fe03 |
add_bitwise_u16(r, htons(0x1fff), 0);
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
/* if offset is non-zero, this is a fragment */
|
|
Packit Service |
d1fe03 |
op = NFT_CMP_NEQ;
|
|
Packit Service |
d1fe03 |
if (cs->fw.ip.invflags & IPT_INV_FRAG)
|
|
Packit Service |
d1fe03 |
op = NFT_CMP_EQ;
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
add_cmp_u16(r, 0, op);
|
|
Packit Service |
d1fe03 |
}
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
add_compat(r, cs->fw.ip.proto, cs->fw.ip.invflags & XT_INV_PROTO);
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
for (matchp = cs->matches; matchp; matchp = matchp->next) {
|
|
Packit Service |
d1fe03 |
ret = add_match(h, r, matchp->match->m);
|
|
Packit Service |
d1fe03 |
if (ret < 0)
|
|
Packit Service |
d1fe03 |
return ret;
|
|
Packit Service |
d1fe03 |
}
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
/* Counters need to me added before the target, otherwise they are
|
|
Packit Service |
d1fe03 |
* increased for each rule because of the way nf_tables works.
|
|
Packit Service |
d1fe03 |
*/
|
|
Packit Service |
d1fe03 |
if (add_counters(r, cs->counters.pcnt, cs->counters.bcnt) < 0)
|
|
Packit Service |
d1fe03 |
return -1;
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
return add_action(r, cs, !!(cs->fw.ip.flags & IPT_F_GOTO));
|
|
Packit Service |
d1fe03 |
}
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
static bool nft_ipv4_is_same(const void *data_a,
|
|
Packit Service |
d1fe03 |
const void *data_b)
|
|
Packit Service |
d1fe03 |
{
|
|
Packit Service |
d1fe03 |
const struct iptables_command_state *a = data_a;
|
|
Packit Service |
d1fe03 |
const struct iptables_command_state *b = data_b;
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
if (a->fw.ip.src.s_addr != b->fw.ip.src.s_addr
|
|
Packit Service |
d1fe03 |
|| a->fw.ip.dst.s_addr != b->fw.ip.dst.s_addr
|
|
Packit Service |
d1fe03 |
|| a->fw.ip.smsk.s_addr != b->fw.ip.smsk.s_addr
|
|
Packit Service |
d1fe03 |
|| a->fw.ip.dmsk.s_addr != b->fw.ip.dmsk.s_addr
|
|
Packit Service |
d1fe03 |
|| a->fw.ip.proto != b->fw.ip.proto
|
|
Packit Service |
d1fe03 |
|| a->fw.ip.flags != b->fw.ip.flags
|
|
Packit Service |
d1fe03 |
|| a->fw.ip.invflags != b->fw.ip.invflags) {
|
|
Packit Service |
d1fe03 |
DEBUGP("different src/dst/proto/flags/invflags\n");
|
|
Packit Service |
d1fe03 |
return false;
|
|
Packit Service |
d1fe03 |
}
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
return is_same_interfaces(a->fw.ip.iniface, a->fw.ip.outiface,
|
|
Packit Service |
d1fe03 |
a->fw.ip.iniface_mask, a->fw.ip.outiface_mask,
|
|
Packit Service |
d1fe03 |
b->fw.ip.iniface, b->fw.ip.outiface,
|
|
Packit Service |
d1fe03 |
b->fw.ip.iniface_mask, b->fw.ip.outiface_mask);
|
|
Packit Service |
d1fe03 |
}
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
static void get_frag(struct nft_xt_ctx *ctx, struct nftnl_expr *e, bool *inv)
|
|
Packit Service |
d1fe03 |
{
|
|
Packit Service |
d1fe03 |
uint8_t op;
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
/* we assume correct mask and xor */
|
|
Packit Service |
d1fe03 |
if (!(ctx->flags & NFT_XT_CTX_BITWISE))
|
|
Packit Service |
d1fe03 |
return;
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
/* we assume correct data */
|
|
Packit Service |
d1fe03 |
op = nftnl_expr_get_u32(e, NFTNL_EXPR_CMP_OP);
|
|
Packit Service |
d1fe03 |
if (op == NFT_CMP_EQ)
|
|
Packit Service |
d1fe03 |
*inv = true;
|
|
Packit Service |
d1fe03 |
else
|
|
Packit Service |
d1fe03 |
*inv = false;
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
ctx->flags &= ~NFT_XT_CTX_BITWISE;
|
|
Packit Service |
d1fe03 |
}
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
static const char *mask_to_str(uint32_t mask)
|
|
Packit Service |
d1fe03 |
{
|
|
Packit Service |
d1fe03 |
static char mask_str[sizeof("255.255.255.255")];
|
|
Packit Service |
d1fe03 |
uint32_t bits, hmask = ntohl(mask);
|
|
Packit Service |
d1fe03 |
struct in_addr mask_addr = {
|
|
Packit Service |
d1fe03 |
.s_addr = mask,
|
|
Packit Service |
d1fe03 |
};
|
|
Packit Service |
d1fe03 |
int i;
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
if (mask == 0xFFFFFFFFU) {
|
|
Packit Service |
d1fe03 |
sprintf(mask_str, "32");
|
|
Packit Service |
d1fe03 |
return mask_str;
|
|
Packit Service |
d1fe03 |
}
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
i = 32;
|
|
Packit Service |
d1fe03 |
bits = 0xFFFFFFFEU;
|
|
Packit Service |
d1fe03 |
while (--i >= 0 && hmask != bits)
|
|
Packit Service |
d1fe03 |
bits <<= 1;
|
|
Packit Service |
d1fe03 |
if (i >= 0)
|
|
Packit Service |
d1fe03 |
sprintf(mask_str, "%u", i);
|
|
Packit Service |
d1fe03 |
else
|
|
Packit Service |
d1fe03 |
sprintf(mask_str, "%s", inet_ntoa(mask_addr));
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
return mask_str;
|
|
Packit Service |
d1fe03 |
}
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
static void nft_ipv4_parse_meta(struct nft_xt_ctx *ctx, struct nftnl_expr *e,
|
|
Packit Service |
d1fe03 |
void *data)
|
|
Packit Service |
d1fe03 |
{
|
|
Packit Service |
d1fe03 |
struct iptables_command_state *cs = data;
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
switch (ctx->meta.key) {
|
|
Packit Service |
d1fe03 |
case NFT_META_L4PROTO:
|
|
Packit Service |
d1fe03 |
cs->fw.ip.proto = nftnl_expr_get_u8(e, NFTNL_EXPR_CMP_DATA);
|
|
Packit Service |
d1fe03 |
if (nftnl_expr_get_u32(e, NFTNL_EXPR_CMP_OP) == NFT_CMP_NEQ)
|
|
Packit Service |
d1fe03 |
cs->fw.ip.invflags |= XT_INV_PROTO;
|
|
Packit Service |
d1fe03 |
return;
|
|
Packit Service |
d1fe03 |
default:
|
|
Packit Service |
d1fe03 |
break;
|
|
Packit Service |
d1fe03 |
}
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
parse_meta(e, ctx->meta.key, cs->fw.ip.iniface, cs->fw.ip.iniface_mask,
|
|
Packit Service |
d1fe03 |
cs->fw.ip.outiface, cs->fw.ip.outiface_mask,
|
|
Packit Service |
d1fe03 |
&cs->fw.ip.invflags);
|
|
Packit Service |
d1fe03 |
}
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
static void parse_mask_ipv4(struct nft_xt_ctx *ctx, struct in_addr *mask)
|
|
Packit Service |
d1fe03 |
{
|
|
Packit Service |
d1fe03 |
mask->s_addr = ctx->bitwise.mask[0];
|
|
Packit Service |
d1fe03 |
}
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
static void nft_ipv4_parse_payload(struct nft_xt_ctx *ctx,
|
|
Packit Service |
d1fe03 |
struct nftnl_expr *e, void *data)
|
|
Packit Service |
d1fe03 |
{
|
|
Packit Service |
d1fe03 |
struct iptables_command_state *cs = data;
|
|
Packit Service |
d1fe03 |
struct in_addr addr;
|
|
Packit Service |
d1fe03 |
uint8_t proto;
|
|
Packit Service |
d1fe03 |
bool inv;
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
switch(ctx->payload.offset) {
|
|
Packit Service |
d1fe03 |
case offsetof(struct iphdr, saddr):
|
|
Packit Service |
d1fe03 |
get_cmp_data(e, &addr, sizeof(addr), &inv;;
|
|
Packit Service |
d1fe03 |
cs->fw.ip.src.s_addr = addr.s_addr;
|
|
Packit Service |
d1fe03 |
if (ctx->flags & NFT_XT_CTX_BITWISE) {
|
|
Packit Service |
d1fe03 |
parse_mask_ipv4(ctx, &cs->fw.ip.smsk);
|
|
Packit Service |
d1fe03 |
ctx->flags &= ~NFT_XT_CTX_BITWISE;
|
|
Packit Service |
d1fe03 |
} else {
|
|
Packit Service |
d1fe03 |
cs->fw.ip.smsk.s_addr = 0xffffffff;
|
|
Packit Service |
d1fe03 |
}
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
if (inv)
|
|
Packit Service |
d1fe03 |
cs->fw.ip.invflags |= IPT_INV_SRCIP;
|
|
Packit Service |
d1fe03 |
break;
|
|
Packit Service |
d1fe03 |
case offsetof(struct iphdr, daddr):
|
|
Packit Service |
d1fe03 |
get_cmp_data(e, &addr, sizeof(addr), &inv;;
|
|
Packit Service |
d1fe03 |
cs->fw.ip.dst.s_addr = addr.s_addr;
|
|
Packit Service |
d1fe03 |
if (ctx->flags & NFT_XT_CTX_BITWISE) {
|
|
Packit Service |
d1fe03 |
parse_mask_ipv4(ctx, &cs->fw.ip.dmsk);
|
|
Packit Service |
d1fe03 |
ctx->flags &= ~NFT_XT_CTX_BITWISE;
|
|
Packit Service |
d1fe03 |
} else {
|
|
Packit Service |
d1fe03 |
cs->fw.ip.dmsk.s_addr = 0xffffffff;
|
|
Packit Service |
d1fe03 |
}
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
if (inv)
|
|
Packit Service |
d1fe03 |
cs->fw.ip.invflags |= IPT_INV_DSTIP;
|
|
Packit Service |
d1fe03 |
break;
|
|
Packit Service |
d1fe03 |
case offsetof(struct iphdr, protocol):
|
|
Packit Service |
d1fe03 |
get_cmp_data(e, &proto, sizeof(proto), &inv;;
|
|
Packit Service |
d1fe03 |
cs->fw.ip.proto = proto;
|
|
Packit Service |
d1fe03 |
if (inv)
|
|
Packit Service |
d1fe03 |
cs->fw.ip.invflags |= IPT_INV_PROTO;
|
|
Packit Service |
d1fe03 |
break;
|
|
Packit Service |
d1fe03 |
case offsetof(struct iphdr, frag_off):
|
|
Packit Service |
d1fe03 |
cs->fw.ip.flags |= IPT_F_FRAG;
|
|
Packit Service |
d1fe03 |
inv = false;
|
|
Packit Service |
d1fe03 |
get_frag(ctx, e, &inv;;
|
|
Packit Service |
d1fe03 |
if (inv)
|
|
Packit Service |
d1fe03 |
cs->fw.ip.invflags |= IPT_INV_FRAG;
|
|
Packit Service |
d1fe03 |
break;
|
|
Packit Service |
d1fe03 |
default:
|
|
Packit Service |
d1fe03 |
DEBUGP("unknown payload offset %d\n", ctx->payload.offset);
|
|
Packit Service |
d1fe03 |
break;
|
|
Packit Service |
d1fe03 |
}
|
|
Packit Service |
d1fe03 |
}
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
static void nft_ipv4_parse_immediate(const char *jumpto, bool nft_goto,
|
|
Packit Service |
d1fe03 |
void *data)
|
|
Packit Service |
d1fe03 |
{
|
|
Packit Service |
d1fe03 |
struct iptables_command_state *cs = data;
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
cs->jumpto = jumpto;
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
if (nft_goto)
|
|
Packit Service |
d1fe03 |
cs->fw.ip.flags |= IPT_F_GOTO;
|
|
Packit Service |
d1fe03 |
}
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
static void print_fragment(unsigned int flags, unsigned int invflags,
|
|
Packit Service |
d1fe03 |
unsigned int format)
|
|
Packit Service |
d1fe03 |
{
|
|
Packit Service |
d1fe03 |
if (!(format & FMT_OPTIONS))
|
|
Packit Service |
d1fe03 |
return;
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
if (format & FMT_NOTABLE)
|
|
Packit Service |
d1fe03 |
fputs("opt ", stdout);
|
|
Packit Service |
d1fe03 |
fputc(invflags & IPT_INV_FRAG ? '!' : '-', stdout);
|
|
Packit Service |
d1fe03 |
fputc(flags & IPT_F_FRAG ? 'f' : '-', stdout);
|
|
Packit Service |
d1fe03 |
fputc(' ', stdout);
|
|
Packit Service |
d1fe03 |
}
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
static void nft_ipv4_print_rule(struct nft_handle *h, struct nftnl_rule *r,
|
|
Packit Service |
d1fe03 |
unsigned int num, unsigned int format)
|
|
Packit Service |
d1fe03 |
{
|
|
Packit Service |
d1fe03 |
struct iptables_command_state cs = {};
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
nft_rule_to_iptables_command_state(h, r, &cs);
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
print_rule_details(&cs, cs.jumpto, cs.fw.ip.flags,
|
|
Packit Service |
d1fe03 |
cs.fw.ip.invflags, cs.fw.ip.proto, num, format);
|
|
Packit Service |
d1fe03 |
print_fragment(cs.fw.ip.flags, cs.fw.ip.invflags, format);
|
|
Packit Service |
d1fe03 |
print_ifaces(cs.fw.ip.iniface, cs.fw.ip.outiface, cs.fw.ip.invflags,
|
|
Packit Service |
d1fe03 |
format);
|
|
Packit Service |
d1fe03 |
print_ipv4_addresses(&cs.fw, format);
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
if (format & FMT_NOTABLE)
|
|
Packit Service |
d1fe03 |
fputs(" ", stdout);
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
#ifdef IPT_F_GOTO
|
|
Packit Service |
d1fe03 |
if (cs.fw.ip.flags & IPT_F_GOTO)
|
|
Packit Service |
d1fe03 |
printf("[goto] ");
|
|
Packit Service |
d1fe03 |
#endif
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
print_matches_and_target(&cs, format);
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
if (!(format & FMT_NONEWLINE))
|
|
Packit Service |
d1fe03 |
fputc('\n', stdout);
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
xtables_rule_matches_free(&cs.matches);
|
|
Packit Service |
d1fe03 |
}
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
static void save_ipv4_addr(char letter, const struct in_addr *addr,
|
|
Packit Service |
d1fe03 |
uint32_t mask, int invert)
|
|
Packit Service |
d1fe03 |
{
|
|
Packit Service |
d1fe03 |
if (!mask && !invert && !addr->s_addr)
|
|
Packit Service |
d1fe03 |
return;
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
printf("%s-%c %s/%s ", invert ? "! " : "", letter, inet_ntoa(*addr),
|
|
Packit Service |
d1fe03 |
mask_to_str(mask));
|
|
Packit Service |
d1fe03 |
}
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
static void nft_ipv4_save_rule(const void *data, unsigned int format)
|
|
Packit Service |
d1fe03 |
{
|
|
Packit Service |
d1fe03 |
const struct iptables_command_state *cs = data;
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
save_ipv4_addr('s', &cs->fw.ip.src, cs->fw.ip.smsk.s_addr,
|
|
Packit Service |
d1fe03 |
cs->fw.ip.invflags & IPT_INV_SRCIP);
|
|
Packit Service |
d1fe03 |
save_ipv4_addr('d', &cs->fw.ip.dst, cs->fw.ip.dmsk.s_addr,
|
|
Packit Service |
d1fe03 |
cs->fw.ip.invflags & IPT_INV_DSTIP);
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
save_rule_details(cs, cs->fw.ip.invflags, cs->fw.ip.proto,
|
|
Packit Service |
d1fe03 |
cs->fw.ip.iniface, cs->fw.ip.iniface_mask,
|
|
Packit Service |
d1fe03 |
cs->fw.ip.outiface, cs->fw.ip.outiface_mask);
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
if (cs->fw.ip.flags & IPT_F_FRAG) {
|
|
Packit Service |
d1fe03 |
if (cs->fw.ip.invflags & IPT_INV_FRAG)
|
|
Packit Service |
d1fe03 |
printf("! ");
|
|
Packit Service |
d1fe03 |
printf("-f ");
|
|
Packit Service |
d1fe03 |
}
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
save_matches_and_target(cs, cs->fw.ip.flags & IPT_F_GOTO,
|
|
Packit Service |
d1fe03 |
&cs->fw, format);
|
|
Packit Service |
d1fe03 |
}
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
static void nft_ipv4_proto_parse(struct iptables_command_state *cs,
|
|
Packit Service |
d1fe03 |
struct xtables_args *args)
|
|
Packit Service |
d1fe03 |
{
|
|
Packit Service |
d1fe03 |
cs->fw.ip.proto = args->proto;
|
|
Packit Service |
d1fe03 |
cs->fw.ip.invflags = args->invflags;
|
|
Packit Service |
d1fe03 |
}
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
static void nft_ipv4_post_parse(int command,
|
|
Packit Service |
d1fe03 |
struct iptables_command_state *cs,
|
|
Packit Service |
d1fe03 |
struct xtables_args *args)
|
|
Packit Service |
d1fe03 |
{
|
|
Packit Service |
d1fe03 |
cs->fw.ip.flags = args->flags;
|
|
Packit Service |
d1fe03 |
/* We already set invflags in proto_parse, but we need to refresh it
|
|
Packit Service |
d1fe03 |
* to include new parsed options.
|
|
Packit Service |
d1fe03 |
*/
|
|
Packit Service |
d1fe03 |
cs->fw.ip.invflags = args->invflags;
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
strncpy(cs->fw.ip.iniface, args->iniface, IFNAMSIZ);
|
|
Packit Service |
d1fe03 |
memcpy(cs->fw.ip.iniface_mask,
|
|
Packit Service |
d1fe03 |
args->iniface_mask, IFNAMSIZ*sizeof(unsigned char));
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
strncpy(cs->fw.ip.outiface, args->outiface, IFNAMSIZ);
|
|
Packit Service |
d1fe03 |
memcpy(cs->fw.ip.outiface_mask,
|
|
Packit Service |
d1fe03 |
args->outiface_mask, IFNAMSIZ*sizeof(unsigned char));
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
if (args->goto_set)
|
|
Packit Service |
d1fe03 |
cs->fw.ip.flags |= IPT_F_GOTO;
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
cs->counters.pcnt = args->pcnt_cnt;
|
|
Packit Service |
d1fe03 |
cs->counters.bcnt = args->bcnt_cnt;
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
if (command & (CMD_REPLACE | CMD_INSERT |
|
|
Packit Service |
d1fe03 |
CMD_DELETE | CMD_APPEND | CMD_CHECK)) {
|
|
Packit Service |
d1fe03 |
if (!(cs->options & OPT_DESTINATION))
|
|
Packit Service |
d1fe03 |
args->dhostnetworkmask = "0.0.0.0/0";
|
|
Packit Service |
d1fe03 |
if (!(cs->options & OPT_SOURCE))
|
|
Packit Service |
d1fe03 |
args->shostnetworkmask = "0.0.0.0/0";
|
|
Packit Service |
d1fe03 |
}
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
if (args->shostnetworkmask)
|
|
Packit Service |
d1fe03 |
xtables_ipparse_multiple(args->shostnetworkmask,
|
|
Packit Service |
d1fe03 |
&args->s.addr.v4, &args->s.mask.v4,
|
|
Packit Service |
d1fe03 |
&args->s.naddrs);
|
|
Packit Service |
d1fe03 |
if (args->dhostnetworkmask)
|
|
Packit Service |
d1fe03 |
xtables_ipparse_multiple(args->dhostnetworkmask,
|
|
Packit Service |
d1fe03 |
&args->d.addr.v4, &args->d.mask.v4,
|
|
Packit Service |
d1fe03 |
&args->d.naddrs);
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
if ((args->s.naddrs > 1 || args->d.naddrs > 1) &&
|
|
Packit Service |
d1fe03 |
(cs->fw.ip.invflags & (IPT_INV_SRCIP | IPT_INV_DSTIP)))
|
|
Packit Service |
d1fe03 |
xtables_error(PARAMETER_PROBLEM,
|
|
Packit Service |
d1fe03 |
"! not allowed with multiple"
|
|
Packit Service |
d1fe03 |
" source or destination IP addresses");
|
|
Packit Service |
d1fe03 |
}
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
static int nft_ipv4_xlate(const void *data, struct xt_xlate *xl)
|
|
Packit Service |
d1fe03 |
{
|
|
Packit Service |
d1fe03 |
const struct iptables_command_state *cs = data;
|
|
Packit Service |
d1fe03 |
const char *comment;
|
|
Packit Service |
d1fe03 |
int ret;
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
xlate_ifname(xl, "iifname", cs->fw.ip.iniface,
|
|
Packit Service |
d1fe03 |
cs->fw.ip.invflags & IPT_INV_VIA_IN);
|
|
Packit Service |
d1fe03 |
xlate_ifname(xl, "oifname", cs->fw.ip.outiface,
|
|
Packit Service |
d1fe03 |
cs->fw.ip.invflags & IPT_INV_VIA_OUT);
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
if (cs->fw.ip.flags & IPT_F_FRAG) {
|
|
Packit Service |
d1fe03 |
xt_xlate_add(xl, "ip frag-off & 0x1fff %s%x ",
|
|
Packit Service |
d1fe03 |
cs->fw.ip.invflags & IPT_INV_FRAG? "" : "!= ", 0);
|
|
Packit Service |
d1fe03 |
}
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
if (cs->fw.ip.proto != 0) {
|
|
Packit Service |
d1fe03 |
const struct protoent *pent =
|
|
Packit Service |
d1fe03 |
getprotobynumber(cs->fw.ip.proto);
|
|
Packit Service |
d1fe03 |
char protonum[sizeof("65535")];
|
|
Packit Service |
d1fe03 |
const char *name = protonum;
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
snprintf(protonum, sizeof(protonum), "%u",
|
|
Packit Service |
d1fe03 |
cs->fw.ip.proto);
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
if (!pent || !xlate_find_match(cs, pent->p_name)) {
|
|
Packit Service |
d1fe03 |
if (pent)
|
|
Packit Service |
d1fe03 |
name = pent->p_name;
|
|
Packit Service |
d1fe03 |
xt_xlate_add(xl, "ip protocol %s%s ",
|
|
Packit Service |
d1fe03 |
cs->fw.ip.invflags & IPT_INV_PROTO ?
|
|
Packit Service |
d1fe03 |
"!= " : "", name);
|
|
Packit Service |
d1fe03 |
}
|
|
Packit Service |
d1fe03 |
}
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
if (cs->fw.ip.src.s_addr != 0) {
|
|
Packit Service |
d1fe03 |
xt_xlate_add(xl, "ip saddr %s%s%s ",
|
|
Packit Service |
d1fe03 |
cs->fw.ip.invflags & IPT_INV_SRCIP ? "!= " : "",
|
|
Packit Service |
d1fe03 |
inet_ntoa(cs->fw.ip.src),
|
|
Packit Service |
d1fe03 |
xtables_ipmask_to_numeric(&cs->fw.ip.smsk));
|
|
Packit Service |
d1fe03 |
}
|
|
Packit Service |
d1fe03 |
if (cs->fw.ip.dst.s_addr != 0) {
|
|
Packit Service |
d1fe03 |
xt_xlate_add(xl, "ip daddr %s%s%s ",
|
|
Packit Service |
d1fe03 |
cs->fw.ip.invflags & IPT_INV_DSTIP ? "!= " : "",
|
|
Packit Service |
d1fe03 |
inet_ntoa(cs->fw.ip.dst),
|
|
Packit Service |
d1fe03 |
xtables_ipmask_to_numeric(&cs->fw.ip.dmsk));
|
|
Packit Service |
d1fe03 |
}
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
ret = xlate_matches(cs, xl);
|
|
Packit Service |
d1fe03 |
if (!ret)
|
|
Packit Service |
d1fe03 |
return ret;
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
/* Always add counters per rule, as in iptables */
|
|
Packit Service |
d1fe03 |
xt_xlate_add(xl, "counter");
|
|
Packit Service |
d1fe03 |
ret = xlate_action(cs, !!(cs->fw.ip.flags & IPT_F_GOTO), xl);
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
comment = xt_xlate_get_comment(xl);
|
|
Packit Service |
d1fe03 |
if (comment)
|
|
Packit Service |
d1fe03 |
xt_xlate_add(xl, " comment %s", comment);
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
return ret;
|
|
Packit Service |
d1fe03 |
}
|
|
Packit Service |
d1fe03 |
|
|
Packit Service |
d1fe03 |
struct nft_family_ops nft_family_ops_ipv4 = {
|
|
Packit Service |
d1fe03 |
.add = nft_ipv4_add,
|
|
Packit Service |
d1fe03 |
.is_same = nft_ipv4_is_same,
|
|
Packit Service |
d1fe03 |
.parse_meta = nft_ipv4_parse_meta,
|
|
Packit Service |
d1fe03 |
.parse_payload = nft_ipv4_parse_payload,
|
|
Packit Service |
d1fe03 |
.parse_immediate = nft_ipv4_parse_immediate,
|
|
Packit Service |
d1fe03 |
.print_header = print_header,
|
|
Packit Service |
d1fe03 |
.print_rule = nft_ipv4_print_rule,
|
|
Packit Service |
d1fe03 |
.save_rule = nft_ipv4_save_rule,
|
|
Packit Service |
d1fe03 |
.save_counters = save_counters,
|
|
Packit Service |
d1fe03 |
.save_chain = nft_ipv46_save_chain,
|
|
Packit Service |
d1fe03 |
.proto_parse = nft_ipv4_proto_parse,
|
|
Packit Service |
d1fe03 |
.post_parse = nft_ipv4_post_parse,
|
|
Packit Service |
d1fe03 |
.parse_target = nft_ipv46_parse_target,
|
|
Packit Service |
d1fe03 |
.rule_to_cs = nft_rule_to_iptables_command_state,
|
|
Packit Service |
d1fe03 |
.clear_cs = nft_clear_iptables_command_state,
|
|
Packit Service |
d1fe03 |
.rule_find = nft_ipv46_rule_find,
|
|
Packit Service |
d1fe03 |
.xlate = nft_ipv4_xlate,
|
|
Packit Service |
d1fe03 |
};
|