|
Packit |
7b22a4 |
/* Code to take an arptables-style command line and do it. */
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
/*
|
|
Packit |
7b22a4 |
* arptables:
|
|
Packit |
7b22a4 |
* Author: Bart De Schuymer <bdschuym@pandora.be>, but
|
|
Packit |
7b22a4 |
* almost all code is from the iptables userspace program, which has main
|
|
Packit |
7b22a4 |
* authors: Paul.Russell@rustcorp.com.au and mneuling@radlogic.com.au
|
|
Packit |
7b22a4 |
*
|
|
Packit |
7b22a4 |
* This program is free software; you can redistribute it and/or modify
|
|
Packit |
7b22a4 |
* it under the terms of the GNU General Public License as published by
|
|
Packit |
7b22a4 |
* the Free Software Foundation; either version 2 of the License, or
|
|
Packit |
7b22a4 |
* (at your option) any later version.
|
|
Packit |
7b22a4 |
*
|
|
Packit |
7b22a4 |
* This program is distributed in the hope that it will be useful,
|
|
Packit |
7b22a4 |
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
Packit |
7b22a4 |
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
Packit |
7b22a4 |
* GNU General Public License for more details.
|
|
Packit |
7b22a4 |
*
|
|
Packit |
7b22a4 |
* You should have received a copy of the GNU General Public License
|
|
Packit |
7b22a4 |
* along with this program; if not, write to the Free Software
|
|
Packit |
7b22a4 |
* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
|
|
Packit |
7b22a4 |
*/
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
/*
|
|
Packit |
7b22a4 |
Currently, only support for specifying hardware addresses for Ethernet
|
|
Packit |
7b22a4 |
is available.
|
|
Packit |
7b22a4 |
This tool is not luser-proof: you can specify an Ethernet source address
|
|
Packit |
7b22a4 |
and set hardware length to something different than 6, f.e.
|
|
Packit |
7b22a4 |
*/
|
|
Packit |
7b22a4 |
#include "config.h"
|
|
Packit |
7b22a4 |
#include <getopt.h>
|
|
Packit |
7b22a4 |
#include <string.h>
|
|
Packit |
7b22a4 |
#include <netdb.h>
|
|
Packit |
7b22a4 |
#include <errno.h>
|
|
Packit |
7b22a4 |
#include <stdio.h>
|
|
Packit |
7b22a4 |
#include <stdlib.h>
|
|
Packit |
7b22a4 |
#include <inttypes.h>
|
|
Packit |
7b22a4 |
#include <dlfcn.h>
|
|
Packit |
7b22a4 |
#include <ctype.h>
|
|
Packit |
7b22a4 |
#include <stdarg.h>
|
|
Packit |
7b22a4 |
#include <limits.h>
|
|
Packit |
7b22a4 |
#include <unistd.h>
|
|
Packit |
7b22a4 |
#include <fcntl.h>
|
|
Packit |
7b22a4 |
#include <sys/wait.h>
|
|
Packit |
7b22a4 |
#include <net/if.h>
|
|
Packit |
7b22a4 |
#include <netinet/ether.h>
|
|
Packit |
7b22a4 |
#include <iptables.h>
|
|
Packit |
7b22a4 |
#include <xtables.h>
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
#include "xshared.h"
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
#include "nft.h"
|
|
Packit |
7b22a4 |
#include "nft-arp.h"
|
|
Packit |
7b22a4 |
#include <linux/netfilter_arp/arp_tables.h>
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
#define NUMBER_OF_OPT 16
|
|
Packit |
7b22a4 |
static const char optflags[NUMBER_OF_OPT]
|
|
Packit |
7b22a4 |
= { 'n', 's', 'd', 2, 3, 7, 8, 4, 5, 6, 'j', 'v', 'i', 'o', '0', 'c'};
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static struct option original_opts[] = {
|
|
Packit |
7b22a4 |
{ "append", 1, 0, 'A' },
|
|
Packit |
7b22a4 |
{ "delete", 1, 0, 'D' },
|
|
Packit |
7b22a4 |
{ "insert", 1, 0, 'I' },
|
|
Packit |
7b22a4 |
{ "replace", 1, 0, 'R' },
|
|
Packit |
7b22a4 |
{ "list", 2, 0, 'L' },
|
|
Packit |
7b22a4 |
{ "flush", 2, 0, 'F' },
|
|
Packit |
7b22a4 |
{ "zero", 2, 0, 'Z' },
|
|
Packit |
7b22a4 |
{ "new-chain", 1, 0, 'N' },
|
|
Packit |
7b22a4 |
{ "delete-chain", 2, 0, 'X' },
|
|
Packit |
7b22a4 |
{ "rename-chain", 1, 0, 'E' },
|
|
Packit |
7b22a4 |
{ "policy", 1, 0, 'P' },
|
|
Packit |
7b22a4 |
{ "source-ip", 1, 0, 's' },
|
|
Packit |
7b22a4 |
{ "destination-ip", 1, 0, 'd' },
|
|
Packit |
7b22a4 |
{ "src-ip", 1, 0, 's' },
|
|
Packit |
7b22a4 |
{ "dst-ip", 1, 0, 'd' },
|
|
Packit |
7b22a4 |
{ "source-mac", 1, 0, 2},
|
|
Packit |
7b22a4 |
{ "destination-mac", 1, 0, 3},
|
|
Packit |
7b22a4 |
{ "src-mac", 1, 0, 2},
|
|
Packit |
7b22a4 |
{ "dst-mac", 1, 0, 3},
|
|
Packit |
7b22a4 |
{ "h-length", 1, 0, 'l' },
|
|
Packit |
7b22a4 |
{ "p-length", 1, 0, 8 },
|
|
Packit |
7b22a4 |
{ "opcode", 1, 0, 4 },
|
|
Packit |
7b22a4 |
{ "h-type", 1, 0, 5 },
|
|
Packit |
7b22a4 |
{ "proto-type", 1, 0, 6 },
|
|
Packit |
7b22a4 |
{ "in-interface", 1, 0, 'i' },
|
|
Packit |
7b22a4 |
{ "jump", 1, 0, 'j' },
|
|
Packit |
7b22a4 |
{ "table", 1, 0, 't' },
|
|
Packit |
7b22a4 |
{ "match", 1, 0, 'm' },
|
|
Packit |
7b22a4 |
{ "numeric", 0, 0, 'n' },
|
|
Packit |
7b22a4 |
{ "out-interface", 1, 0, 'o' },
|
|
Packit |
7b22a4 |
{ "verbose", 0, 0, 'v' },
|
|
Packit |
7b22a4 |
{ "exact", 0, 0, 'x' },
|
|
Packit |
7b22a4 |
{ "version", 0, 0, 'V' },
|
|
Packit |
7b22a4 |
{ "help", 2, 0, 'h' },
|
|
Packit |
7b22a4 |
{ "line-numbers", 0, 0, '0' },
|
|
Packit |
7b22a4 |
{ "modprobe", 1, 0, 'M' },
|
|
Packit |
7b22a4 |
{ "set-counters", 1, 0, 'c' },
|
|
Packit |
7b22a4 |
{ 0 }
|
|
Packit |
7b22a4 |
};
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
#define opts xt_params->opts
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
extern void xtables_exit_error(enum xtables_exittype status, const char *msg, ...) __attribute__((noreturn, format(printf,2,3)));
|
|
Packit |
7b22a4 |
struct xtables_globals arptables_globals = {
|
|
Packit |
7b22a4 |
.option_offset = 0,
|
|
Packit |
7b22a4 |
.program_version = PACKAGE_VERSION,
|
|
Packit |
7b22a4 |
.orig_opts = original_opts,
|
|
Packit |
7b22a4 |
.exit_err = xtables_exit_error,
|
|
Packit |
7b22a4 |
.compat_rev = nft_compatible_revision,
|
|
Packit |
7b22a4 |
};
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
/* index relates to bit of each OPT_* value */
|
|
Packit |
7b22a4 |
static int inverse_for_options[] =
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
/* -n */ 0,
|
|
Packit |
7b22a4 |
/* -s */ ARPT_INV_SRCIP,
|
|
Packit |
7b22a4 |
/* -d */ ARPT_INV_TGTIP,
|
|
Packit |
7b22a4 |
/* -p */ 0,
|
|
Packit |
7b22a4 |
/* -j */ 0,
|
|
Packit |
7b22a4 |
/* -v */ 0,
|
|
Packit |
7b22a4 |
/* -x */ 0,
|
|
Packit |
7b22a4 |
/* -i */ ARPT_INV_VIA_IN,
|
|
Packit |
7b22a4 |
/* -o */ ARPT_INV_VIA_OUT,
|
|
Packit |
7b22a4 |
/*--line*/ 0,
|
|
Packit |
7b22a4 |
/* -c */ 0,
|
|
Packit |
7b22a4 |
/* 2 */ ARPT_INV_SRCDEVADDR,
|
|
Packit |
7b22a4 |
/* 3 */ ARPT_INV_TGTDEVADDR,
|
|
Packit |
7b22a4 |
/* -l */ ARPT_INV_ARPHLN,
|
|
Packit |
7b22a4 |
/* 4 */ ARPT_INV_ARPOP,
|
|
Packit |
7b22a4 |
/* 5 */ ARPT_INV_ARPHRD,
|
|
Packit |
7b22a4 |
/* 6 */ ARPT_INV_ARPPRO,
|
|
Packit |
7b22a4 |
};
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
/***********************************************/
|
|
Packit |
7b22a4 |
/* ARPTABLES SPECIFIC NEW FUNCTIONS ADDED HERE */
|
|
Packit |
7b22a4 |
/***********************************************/
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static unsigned char mac_type_unicast[ETH_ALEN] = {0,0,0,0,0,0};
|
|
Packit |
7b22a4 |
static unsigned char msk_type_unicast[ETH_ALEN] = {1,0,0,0,0,0};
|
|
Packit |
7b22a4 |
static unsigned char mac_type_multicast[ETH_ALEN] = {1,0,0,0,0,0};
|
|
Packit |
7b22a4 |
static unsigned char msk_type_multicast[ETH_ALEN] = {1,0,0,0,0,0};
|
|
Packit |
7b22a4 |
static unsigned char mac_type_broadcast[ETH_ALEN] = {255,255,255,255,255,255};
|
|
Packit |
7b22a4 |
static unsigned char msk_type_broadcast[ETH_ALEN] = {255,255,255,255,255,255};
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
/*
|
|
Packit |
7b22a4 |
* put the mac address into 6 (ETH_ALEN) bytes
|
|
Packit |
7b22a4 |
*/
|
|
Packit |
7b22a4 |
static int getmac_and_mask(char *from, char *to, char *mask)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
char *p;
|
|
Packit |
7b22a4 |
int i;
|
|
Packit |
7b22a4 |
struct ether_addr *addr;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (strcasecmp(from, "Unicast") == 0) {
|
|
Packit |
7b22a4 |
memcpy(to, mac_type_unicast, ETH_ALEN);
|
|
Packit |
7b22a4 |
memcpy(mask, msk_type_unicast, ETH_ALEN);
|
|
Packit |
7b22a4 |
return 0;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
if (strcasecmp(from, "Multicast") == 0) {
|
|
Packit |
7b22a4 |
memcpy(to, mac_type_multicast, ETH_ALEN);
|
|
Packit |
7b22a4 |
memcpy(mask, msk_type_multicast, ETH_ALEN);
|
|
Packit |
7b22a4 |
return 0;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
if (strcasecmp(from, "Broadcast") == 0) {
|
|
Packit |
7b22a4 |
memcpy(to, mac_type_broadcast, ETH_ALEN);
|
|
Packit |
7b22a4 |
memcpy(mask, msk_type_broadcast, ETH_ALEN);
|
|
Packit |
7b22a4 |
return 0;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
if ( (p = strrchr(from, '/')) != NULL) {
|
|
Packit |
7b22a4 |
*p = '\0';
|
|
Packit |
7b22a4 |
if (!(addr = ether_aton(p + 1)))
|
|
Packit |
7b22a4 |
return -1;
|
|
Packit |
7b22a4 |
memcpy(mask, addr, ETH_ALEN);
|
|
Packit |
7b22a4 |
} else
|
|
Packit |
7b22a4 |
memset(mask, 0xff, ETH_ALEN);
|
|
Packit |
7b22a4 |
if (!(addr = ether_aton(from)))
|
|
Packit |
7b22a4 |
return -1;
|
|
Packit |
7b22a4 |
memcpy(to, addr, ETH_ALEN);
|
|
Packit |
7b22a4 |
for (i = 0; i < ETH_ALEN; i++)
|
|
Packit |
7b22a4 |
to[i] &= mask[i];
|
|
Packit |
7b22a4 |
return 0;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static int getlength_and_mask(char *from, uint8_t *to, uint8_t *mask)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
char *p, *buffer;
|
|
Packit |
7b22a4 |
int i;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if ( (p = strrchr(from, '/')) != NULL) {
|
|
Packit |
7b22a4 |
*p = '\0';
|
|
Packit |
7b22a4 |
i = strtol(p+1, &buffer, 10);
|
|
Packit |
7b22a4 |
if (*buffer != '\0' || i < 0 || i > 255)
|
|
Packit |
7b22a4 |
return -1;
|
|
Packit |
7b22a4 |
*mask = (uint8_t)i;
|
|
Packit |
7b22a4 |
} else
|
|
Packit |
7b22a4 |
*mask = 255;
|
|
Packit |
7b22a4 |
i = strtol(from, &buffer, 10);
|
|
Packit |
7b22a4 |
if (*buffer != '\0' || i < 0 || i > 255)
|
|
Packit |
7b22a4 |
return -1;
|
|
Packit |
7b22a4 |
*to = (uint8_t)i;
|
|
Packit |
7b22a4 |
return 0;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static int get16_and_mask(char *from, uint16_t *to, uint16_t *mask, int base)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
char *p, *buffer;
|
|
Packit |
7b22a4 |
int i;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if ( (p = strrchr(from, '/')) != NULL) {
|
|
Packit |
7b22a4 |
*p = '\0';
|
|
Packit |
7b22a4 |
i = strtol(p+1, &buffer, base);
|
|
Packit |
7b22a4 |
if (*buffer != '\0' || i < 0 || i > 65535)
|
|
Packit |
7b22a4 |
return -1;
|
|
Packit |
7b22a4 |
*mask = htons((uint16_t)i);
|
|
Packit |
7b22a4 |
} else
|
|
Packit |
7b22a4 |
*mask = 65535;
|
|
Packit |
7b22a4 |
i = strtol(from, &buffer, base);
|
|
Packit |
7b22a4 |
if (*buffer != '\0' || i < 0 || i > 65535)
|
|
Packit |
7b22a4 |
return -1;
|
|
Packit |
7b22a4 |
*to = htons((uint16_t)i);
|
|
Packit |
7b22a4 |
return 0;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
/*********************************************/
|
|
Packit |
7b22a4 |
/* ARPTABLES SPECIFIC NEW FUNCTIONS END HERE */
|
|
Packit |
7b22a4 |
/*********************************************/
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static void
|
|
Packit |
7b22a4 |
exit_tryhelp(int status)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
fprintf(stderr, "Try `%s -h' or '%s --help' for more information.\n",
|
|
Packit |
7b22a4 |
arptables_globals.program_name,
|
|
Packit |
7b22a4 |
arptables_globals.program_version);
|
|
Packit |
7b22a4 |
exit(status);
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static void
|
|
Packit |
7b22a4 |
exit_printhelp(void)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
struct xtables_target *t = NULL;
|
|
Packit |
7b22a4 |
int i;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
printf("%s v%s\n\n"
|
|
Packit |
7b22a4 |
"Usage: %s -[AD] chain rule-specification [options]\n"
|
|
Packit |
7b22a4 |
" %s -[RI] chain rulenum rule-specification [options]\n"
|
|
Packit |
7b22a4 |
" %s -D chain rulenum [options]\n"
|
|
Packit |
7b22a4 |
" %s -[LFZ] [chain] [options]\n"
|
|
Packit |
7b22a4 |
" %s -[NX] chain\n"
|
|
Packit |
7b22a4 |
" %s -E old-chain-name new-chain-name\n"
|
|
Packit |
7b22a4 |
" %s -P chain target [options]\n"
|
|
Packit |
7b22a4 |
" %s -h (print this help information)\n\n",
|
|
Packit |
7b22a4 |
arptables_globals.program_name,
|
|
Packit |
7b22a4 |
arptables_globals.program_version,
|
|
Packit |
7b22a4 |
arptables_globals.program_name,
|
|
Packit |
7b22a4 |
arptables_globals.program_name,
|
|
Packit |
7b22a4 |
arptables_globals.program_name,
|
|
Packit |
7b22a4 |
arptables_globals.program_name,
|
|
Packit |
7b22a4 |
arptables_globals.program_name,
|
|
Packit |
7b22a4 |
arptables_globals.program_name,
|
|
Packit |
7b22a4 |
arptables_globals.program_name,
|
|
Packit |
7b22a4 |
arptables_globals.program_name);
|
|
Packit |
7b22a4 |
printf(
|
|
Packit |
7b22a4 |
"Commands:\n"
|
|
Packit |
7b22a4 |
"Either long or short options are allowed.\n"
|
|
Packit |
7b22a4 |
" --append -A chain Append to chain\n"
|
|
Packit |
7b22a4 |
" --delete -D chain Delete matching rule from chain\n"
|
|
Packit |
7b22a4 |
" --delete -D chain rulenum\n"
|
|
Packit |
7b22a4 |
" Delete rule rulenum (1 = first) from chain\n"
|
|
Packit |
7b22a4 |
" --insert -I chain [rulenum]\n"
|
|
Packit |
7b22a4 |
" Insert in chain as rulenum (default 1=first)\n"
|
|
Packit |
7b22a4 |
" --replace -R chain rulenum\n"
|
|
Packit |
7b22a4 |
" Replace rule rulenum (1 = first) in chain\n"
|
|
Packit |
7b22a4 |
" --list -L [chain] List the rules in a chain or all chains\n"
|
|
Packit |
7b22a4 |
" --flush -F [chain] Delete all rules in chain or all chains\n"
|
|
Packit |
7b22a4 |
" --zero -Z [chain] Zero counters in chain or all chains\n"
|
|
Packit |
7b22a4 |
" --new -N chain Create a new user-defined chain\n"
|
|
Packit |
7b22a4 |
" --delete-chain\n"
|
|
Packit |
7b22a4 |
" -X [chain] Delete a user-defined chain\n"
|
|
Packit |
7b22a4 |
" --policy -P chain target\n"
|
|
Packit |
7b22a4 |
" Change policy on chain to target\n"
|
|
Packit |
7b22a4 |
" --rename-chain\n"
|
|
Packit |
7b22a4 |
" -E old-chain new-chain\n"
|
|
Packit |
7b22a4 |
" Change chain name, (moving any references)\n"
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
"Options:\n"
|
|
Packit |
7b22a4 |
" --source-ip -s [!] address[/mask]\n"
|
|
Packit |
7b22a4 |
" source specification\n"
|
|
Packit |
7b22a4 |
" --destination-ip -d [!] address[/mask]\n"
|
|
Packit |
7b22a4 |
" destination specification\n"
|
|
Packit |
7b22a4 |
" --source-mac [!] address[/mask]\n"
|
|
Packit |
7b22a4 |
" --destination-mac [!] address[/mask]\n"
|
|
Packit |
7b22a4 |
" --h-length -l length[/mask] hardware length (nr of bytes)\n"
|
|
Packit |
7b22a4 |
" --opcode code[/mask] operation code (2 bytes)\n"
|
|
Packit |
7b22a4 |
" --h-type type[/mask] hardware type (2 bytes, hexadecimal)\n"
|
|
Packit |
7b22a4 |
" --proto-type type[/mask] protocol type (2 bytes)\n"
|
|
Packit |
7b22a4 |
" --in-interface -i [!] input name[+]\n"
|
|
Packit |
7b22a4 |
" network interface name ([+] for wildcard)\n"
|
|
Packit |
7b22a4 |
" --out-interface -o [!] output name[+]\n"
|
|
Packit |
7b22a4 |
" network interface name ([+] for wildcard)\n"
|
|
Packit |
7b22a4 |
" --jump -j target\n"
|
|
Packit |
7b22a4 |
" target for rule (may load target extension)\n"
|
|
Packit |
7b22a4 |
" --match -m match\n"
|
|
Packit |
7b22a4 |
" extended match (may load extension)\n"
|
|
Packit |
7b22a4 |
" --numeric -n numeric output of addresses and ports\n"
|
|
Packit |
7b22a4 |
" --table -t table table to manipulate (default: `filter')\n"
|
|
Packit |
7b22a4 |
" --verbose -v verbose mode\n"
|
|
Packit |
7b22a4 |
" --line-numbers print line numbers when listing\n"
|
|
Packit |
7b22a4 |
" --exact -x expand numbers (display exact values)\n"
|
|
Packit |
7b22a4 |
" --modprobe=<command> try to insert modules using this command\n"
|
|
Packit |
7b22a4 |
" --set-counters -c PKTS BYTES set the counter during insert/append\n"
|
|
Packit |
7b22a4 |
"[!] --version -V print package version.\n");
|
|
Packit |
7b22a4 |
printf(" opcode strings: \n");
|
|
Packit |
7b22a4 |
for (i = 0; i < NUMOPCODES; i++)
|
|
Packit |
7b22a4 |
printf(" %d = %s\n", i + 1, arp_opcodes[i]);
|
|
Packit |
7b22a4 |
printf(
|
|
Packit |
7b22a4 |
" hardware type string: 1 = Ethernet\n"
|
|
Packit |
7b22a4 |
" protocol type string: 0x800 = IPv4\n");
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
/* Print out any special helps. A user might like to be able
|
|
Packit |
7b22a4 |
to add a --help to the commandline, and see expected
|
|
Packit |
7b22a4 |
results. So we call help for all matches & targets */
|
|
Packit |
7b22a4 |
for (t = xtables_targets; t; t = t->next) {
|
|
Packit |
7b22a4 |
if (strcmp(t->name, "CLASSIFY") && strcmp(t->name, "mangle"))
|
|
Packit |
7b22a4 |
continue;
|
|
Packit |
7b22a4 |
printf("\n");
|
|
Packit |
7b22a4 |
t->help();
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
exit(0);
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static char
|
|
Packit |
7b22a4 |
opt2char(int option)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
const char *ptr;
|
|
Packit |
7b22a4 |
for (ptr = optflags; option > 1; option >>= 1, ptr++);
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
return *ptr;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static int
|
|
Packit |
7b22a4 |
check_inverse(const char option[], int *invert, int *optidx, int argc)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
if (option && strcmp(option, "!") == 0) {
|
|
Packit |
7b22a4 |
if (*invert)
|
|
Packit |
7b22a4 |
xtables_error(PARAMETER_PROBLEM,
|
|
Packit |
7b22a4 |
"Multiple `!' flags not allowed");
|
|
Packit |
7b22a4 |
*invert = true;
|
|
Packit |
7b22a4 |
if (optidx) {
|
|
Packit |
7b22a4 |
*optidx = *optidx+1;
|
|
Packit |
7b22a4 |
if (argc && *optidx > argc)
|
|
Packit |
7b22a4 |
xtables_error(PARAMETER_PROBLEM,
|
|
Packit |
7b22a4 |
"no argument following `!'");
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
return true;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
return false;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static void
|
|
Packit |
7b22a4 |
set_option(unsigned int *options, unsigned int option, u_int16_t *invflg,
|
|
Packit |
7b22a4 |
int invert)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
if (*options & option)
|
|
Packit |
7b22a4 |
xtables_error(PARAMETER_PROBLEM, "multiple -%c flags not allowed",
|
|
Packit |
7b22a4 |
opt2char(option));
|
|
Packit |
7b22a4 |
*options |= option;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (invert) {
|
|
Packit |
7b22a4 |
unsigned int i;
|
|
Packit |
7b22a4 |
for (i = 0; 1 << i != option; i++);
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (!inverse_for_options[i])
|
|
Packit |
7b22a4 |
xtables_error(PARAMETER_PROBLEM,
|
|
Packit |
7b22a4 |
"cannot have ! before -%c",
|
|
Packit |
7b22a4 |
opt2char(option));
|
|
Packit |
7b22a4 |
*invflg |= inverse_for_options[i];
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static int
|
|
Packit |
7b22a4 |
list_entries(struct nft_handle *h, const char *chain, const char *table,
|
|
Packit |
7b22a4 |
int rulenum, int verbose, int numeric, int expanded,
|
|
Packit |
7b22a4 |
int linenumbers)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
unsigned int format;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
format = FMT_OPTIONS;
|
|
Packit |
7b22a4 |
if (!verbose)
|
|
Packit |
7b22a4 |
format |= FMT_NOCOUNTS;
|
|
Packit |
7b22a4 |
else
|
|
Packit |
7b22a4 |
format |= FMT_VIA;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (numeric)
|
|
Packit |
7b22a4 |
format |= FMT_NUMERIC;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (!expanded)
|
|
Packit |
7b22a4 |
format |= FMT_KILOMEGAGIGA;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (linenumbers)
|
|
Packit |
7b22a4 |
format |= FMT_LINENUMBERS;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
return nft_rule_list(h, chain, table, rulenum, format);
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static int
|
|
Packit |
7b22a4 |
append_entry(struct nft_handle *h,
|
|
Packit |
7b22a4 |
const char *chain,
|
|
Packit |
7b22a4 |
const char *table,
|
|
Packit |
7b22a4 |
struct iptables_command_state *cs,
|
|
Packit |
7b22a4 |
int rulenum,
|
|
Packit |
7b22a4 |
unsigned int nsaddrs,
|
|
Packit |
7b22a4 |
const struct in_addr saddrs[],
|
|
Packit |
7b22a4 |
const struct in_addr smasks[],
|
|
Packit |
7b22a4 |
unsigned int ndaddrs,
|
|
Packit |
7b22a4 |
const struct in_addr daddrs[],
|
|
Packit |
7b22a4 |
const struct in_addr dmasks[],
|
|
Packit |
7b22a4 |
bool verbose, bool append)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
unsigned int i, j;
|
|
Packit |
7b22a4 |
int ret = 1;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
for (i = 0; i < nsaddrs; i++) {
|
|
Packit |
7b22a4 |
cs->arp.arp.src.s_addr = saddrs[i].s_addr;
|
|
Packit |
7b22a4 |
cs->arp.arp.smsk.s_addr = smasks[i].s_addr;
|
|
Packit |
7b22a4 |
for (j = 0; j < ndaddrs; j++) {
|
|
Packit |
7b22a4 |
cs->arp.arp.tgt.s_addr = daddrs[j].s_addr;
|
|
Packit |
7b22a4 |
cs->arp.arp.tmsk.s_addr = dmasks[j].s_addr;
|
|
Packit |
7b22a4 |
if (append) {
|
|
Packit |
7b22a4 |
ret = nft_rule_append(h, chain, table, cs, NULL,
|
|
Packit |
7b22a4 |
verbose);
|
|
Packit |
7b22a4 |
} else {
|
|
Packit |
7b22a4 |
ret = nft_rule_insert(h, chain, table, cs,
|
|
Packit |
7b22a4 |
rulenum, verbose);
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
return ret;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static int
|
|
Packit |
7b22a4 |
replace_entry(const char *chain,
|
|
Packit |
7b22a4 |
const char *table,
|
|
Packit |
7b22a4 |
struct iptables_command_state *cs,
|
|
Packit |
7b22a4 |
unsigned int rulenum,
|
|
Packit |
7b22a4 |
const struct in_addr *saddr,
|
|
Packit |
7b22a4 |
const struct in_addr *smask,
|
|
Packit |
7b22a4 |
const struct in_addr *daddr,
|
|
Packit |
7b22a4 |
const struct in_addr *dmask,
|
|
Packit |
7b22a4 |
bool verbose, struct nft_handle *h)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
cs->arp.arp.src.s_addr = saddr->s_addr;
|
|
Packit |
7b22a4 |
cs->arp.arp.tgt.s_addr = daddr->s_addr;
|
|
Packit |
7b22a4 |
cs->arp.arp.smsk.s_addr = smask->s_addr;
|
|
Packit |
7b22a4 |
cs->arp.arp.tmsk.s_addr = dmask->s_addr;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
return nft_rule_replace(h, chain, table, cs, rulenum, verbose);
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
static int
|
|
Packit |
7b22a4 |
delete_entry(const char *chain,
|
|
Packit |
7b22a4 |
const char *table,
|
|
Packit |
7b22a4 |
struct iptables_command_state *cs,
|
|
Packit |
7b22a4 |
unsigned int nsaddrs,
|
|
Packit |
7b22a4 |
const struct in_addr saddrs[],
|
|
Packit |
7b22a4 |
const struct in_addr smasks[],
|
|
Packit |
7b22a4 |
unsigned int ndaddrs,
|
|
Packit |
7b22a4 |
const struct in_addr daddrs[],
|
|
Packit |
7b22a4 |
const struct in_addr dmasks[],
|
|
Packit |
7b22a4 |
bool verbose, struct nft_handle *h)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
unsigned int i, j;
|
|
Packit |
7b22a4 |
int ret = 1;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
for (i = 0; i < nsaddrs; i++) {
|
|
Packit |
7b22a4 |
cs->arp.arp.src.s_addr = saddrs[i].s_addr;
|
|
Packit |
7b22a4 |
cs->arp.arp.smsk.s_addr = smasks[i].s_addr;
|
|
Packit |
7b22a4 |
for (j = 0; j < ndaddrs; j++) {
|
|
Packit |
7b22a4 |
cs->arp.arp.tgt.s_addr = daddrs[j].s_addr;
|
|
Packit |
7b22a4 |
cs->arp.arp.tmsk.s_addr = dmasks[j].s_addr;
|
|
Packit |
7b22a4 |
ret = nft_rule_delete(h, chain, table, cs, verbose);
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
return ret;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
int nft_init_arp(struct nft_handle *h, const char *pname)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
arptables_globals.program_name = pname;
|
|
Packit |
7b22a4 |
if (xtables_init_all(&arptables_globals, NFPROTO_ARP) < 0) {
|
|
Packit |
7b22a4 |
fprintf(stderr, "%s/%s Failed to initialize arptables-compat\n",
|
|
Packit |
7b22a4 |
arptables_globals.program_name,
|
|
Packit |
7b22a4 |
arptables_globals.program_version);
|
|
Packit |
7b22a4 |
exit(1);
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
#if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS)
|
|
Packit |
7b22a4 |
init_extensionsa();
|
|
Packit |
7b22a4 |
#endif
|
|
Packit |
7b22a4 |
|
|
Packit Service |
10e551 |
if (nft_init(h, NFPROTO_ARP, xtables_arp) < 0)
|
|
Packit |
7b22a4 |
xtables_error(OTHER_PROBLEM,
|
|
Packit |
7b22a4 |
"Could not initialize nftables layer.");
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
return 0;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
int do_commandarp(struct nft_handle *h, int argc, char *argv[], char **table,
|
|
Packit |
7b22a4 |
bool restore)
|
|
Packit |
7b22a4 |
{
|
|
Packit |
7b22a4 |
struct iptables_command_state cs = {
|
|
Packit |
7b22a4 |
.jumpto = "",
|
|
Packit |
7b22a4 |
.arp.arp = {
|
|
Packit |
7b22a4 |
.arhln = 6,
|
|
Packit |
7b22a4 |
.arhln_mask = 255,
|
|
Packit |
7b22a4 |
.arhrd = htons(ARPHRD_ETHER),
|
|
Packit |
7b22a4 |
.arhrd_mask = 65535,
|
|
Packit |
7b22a4 |
},
|
|
Packit |
7b22a4 |
};
|
|
Packit |
7b22a4 |
int invert = 0;
|
|
Packit |
7b22a4 |
unsigned int nsaddrs = 0, ndaddrs = 0;
|
|
Packit |
7b22a4 |
struct in_addr *saddrs = NULL, *smasks = NULL;
|
|
Packit |
7b22a4 |
struct in_addr *daddrs = NULL, *dmasks = NULL;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
int c, verbose = 0;
|
|
Packit |
7b22a4 |
const char *chain = NULL;
|
|
Packit |
7b22a4 |
const char *shostnetworkmask = NULL, *dhostnetworkmask = NULL;
|
|
Packit |
7b22a4 |
const char *policy = NULL, *newname = NULL;
|
|
Packit |
7b22a4 |
unsigned int rulenum = 0, options = 0, command = 0;
|
|
Packit |
7b22a4 |
const char *pcnt = NULL, *bcnt = NULL;
|
|
Packit |
7b22a4 |
int ret = 1;
|
|
Packit |
7b22a4 |
struct xtables_target *t;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
/* re-set optind to 0 in case do_command gets called
|
|
Packit |
7b22a4 |
* a second time */
|
|
Packit |
7b22a4 |
optind = 0;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
for (t = xtables_targets; t; t = t->next) {
|
|
Packit |
7b22a4 |
t->tflags = 0;
|
|
Packit |
7b22a4 |
t->used = 0;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
/* Suppress error messages: we may add new options if we
|
|
Packit |
7b22a4 |
demand-load a protocol. */
|
|
Packit |
7b22a4 |
opterr = 0;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
opts = xt_params->orig_opts;
|
|
Packit |
7b22a4 |
while ((c = getopt_long(argc, argv,
|
|
Packit |
7b22a4 |
"-A:D:R:I:L::M:F::Z::N:X::E:P:Vh::o:p:s:d:j:l:i:vnt:m:c:",
|
|
Packit |
7b22a4 |
opts, NULL)) != -1) {
|
|
Packit |
7b22a4 |
switch (c) {
|
|
Packit |
7b22a4 |
/*
|
|
Packit |
7b22a4 |
* Command selection
|
|
Packit |
7b22a4 |
*/
|
|
Packit |
7b22a4 |
case 'A':
|
|
Packit |
7b22a4 |
add_command(&command, CMD_APPEND, CMD_NONE,
|
|
Packit |
7b22a4 |
invert);
|
|
Packit |
7b22a4 |
chain = optarg;
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
case 'D':
|
|
Packit |
7b22a4 |
add_command(&command, CMD_DELETE, CMD_NONE,
|
|
Packit |
7b22a4 |
invert);
|
|
Packit |
7b22a4 |
chain = optarg;
|
|
Packit |
7b22a4 |
if (xs_has_arg(argc, argv)) {
|
|
Packit |
7b22a4 |
rulenum = parse_rulenumber(argv[optind++]);
|
|
Packit |
7b22a4 |
command = CMD_DELETE_NUM;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
case 'R':
|
|
Packit |
7b22a4 |
add_command(&command, CMD_REPLACE, CMD_NONE,
|
|
Packit |
7b22a4 |
invert);
|
|
Packit |
7b22a4 |
chain = optarg;
|
|
Packit |
7b22a4 |
if (xs_has_arg(argc, argv))
|
|
Packit |
7b22a4 |
rulenum = parse_rulenumber(argv[optind++]);
|
|
Packit |
7b22a4 |
else
|
|
Packit |
7b22a4 |
xtables_error(PARAMETER_PROBLEM,
|
|
Packit |
7b22a4 |
"-%c requires a rule number",
|
|
Packit |
7b22a4 |
cmd2char(CMD_REPLACE));
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
case 'I':
|
|
Packit |
7b22a4 |
add_command(&command, CMD_INSERT, CMD_NONE,
|
|
Packit |
7b22a4 |
invert);
|
|
Packit |
7b22a4 |
chain = optarg;
|
|
Packit |
7b22a4 |
if (xs_has_arg(argc, argv))
|
|
Packit |
7b22a4 |
rulenum = parse_rulenumber(argv[optind++]);
|
|
Packit |
7b22a4 |
else rulenum = 1;
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
case 'L':
|
|
Packit |
7b22a4 |
add_command(&command, CMD_LIST, CMD_ZERO,
|
|
Packit |
7b22a4 |
invert);
|
|
Packit |
7b22a4 |
if (optarg) chain = optarg;
|
|
Packit |
7b22a4 |
else if (xs_has_arg(argc, argv))
|
|
Packit |
7b22a4 |
chain = argv[optind++];
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
case 'F':
|
|
Packit |
7b22a4 |
add_command(&command, CMD_FLUSH, CMD_NONE,
|
|
Packit |
7b22a4 |
invert);
|
|
Packit |
7b22a4 |
if (optarg) chain = optarg;
|
|
Packit |
7b22a4 |
else if (xs_has_arg(argc, argv))
|
|
Packit |
7b22a4 |
chain = argv[optind++];
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
case 'Z':
|
|
Packit |
7b22a4 |
add_command(&command, CMD_ZERO, CMD_LIST,
|
|
Packit |
7b22a4 |
invert);
|
|
Packit |
7b22a4 |
if (optarg) chain = optarg;
|
|
Packit |
7b22a4 |
else if (xs_has_arg(argc, argv))
|
|
Packit |
7b22a4 |
chain = argv[optind++];
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
case 'N':
|
|
Packit |
7b22a4 |
if (optarg && *optarg == '-')
|
|
Packit |
7b22a4 |
xtables_error(PARAMETER_PROBLEM,
|
|
Packit |
7b22a4 |
"chain name not allowed to start "
|
|
Packit |
7b22a4 |
"with `-'\n");
|
|
Packit |
7b22a4 |
if (xtables_find_target(optarg, XTF_TRY_LOAD))
|
|
Packit |
7b22a4 |
xtables_error(PARAMETER_PROBLEM,
|
|
Packit |
7b22a4 |
"chain name may not clash "
|
|
Packit |
7b22a4 |
"with target name\n");
|
|
Packit |
7b22a4 |
add_command(&command, CMD_NEW_CHAIN, CMD_NONE,
|
|
Packit |
7b22a4 |
invert);
|
|
Packit |
7b22a4 |
chain = optarg;
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
case 'X':
|
|
Packit |
7b22a4 |
add_command(&command, CMD_DELETE_CHAIN, CMD_NONE,
|
|
Packit |
7b22a4 |
invert);
|
|
Packit |
7b22a4 |
if (optarg) chain = optarg;
|
|
Packit |
7b22a4 |
else if (xs_has_arg(argc, argv))
|
|
Packit |
7b22a4 |
chain = argv[optind++];
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
case 'E':
|
|
Packit |
7b22a4 |
add_command(&command, CMD_RENAME_CHAIN, CMD_NONE,
|
|
Packit |
7b22a4 |
invert);
|
|
Packit |
7b22a4 |
chain = optarg;
|
|
Packit |
7b22a4 |
if (xs_has_arg(argc, argv))
|
|
Packit |
7b22a4 |
newname = argv[optind++];
|
|
Packit |
7b22a4 |
else
|
|
Packit |
7b22a4 |
xtables_error(PARAMETER_PROBLEM,
|
|
Packit |
7b22a4 |
"-%c requires old-chain-name and "
|
|
Packit |
7b22a4 |
"new-chain-name",
|
|
Packit |
7b22a4 |
cmd2char(CMD_RENAME_CHAIN));
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
case 'P':
|
|
Packit |
7b22a4 |
add_command(&command, CMD_SET_POLICY, CMD_NONE,
|
|
Packit |
7b22a4 |
invert);
|
|
Packit |
7b22a4 |
chain = optarg;
|
|
Packit |
7b22a4 |
if (xs_has_arg(argc, argv))
|
|
Packit |
7b22a4 |
policy = argv[optind++];
|
|
Packit |
7b22a4 |
else
|
|
Packit |
7b22a4 |
xtables_error(PARAMETER_PROBLEM,
|
|
Packit |
7b22a4 |
"-%c requires a chain and a policy",
|
|
Packit |
7b22a4 |
cmd2char(CMD_SET_POLICY));
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
case 'h':
|
|
Packit |
7b22a4 |
if (!optarg)
|
|
Packit |
7b22a4 |
optarg = argv[optind];
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
exit_printhelp();
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
case 's':
|
|
Packit |
7b22a4 |
check_inverse(optarg, &invert, &optind, argc);
|
|
Packit |
7b22a4 |
set_option(&options, OPT_SOURCE, &cs.arp.arp.invflags,
|
|
Packit |
7b22a4 |
invert);
|
|
Packit |
7b22a4 |
shostnetworkmask = argv[optind-1];
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
case 'd':
|
|
Packit |
7b22a4 |
check_inverse(optarg, &invert, &optind, argc);
|
|
Packit |
7b22a4 |
set_option(&options, OPT_DESTINATION, &cs.arp.arp.invflags,
|
|
Packit |
7b22a4 |
invert);
|
|
Packit |
7b22a4 |
dhostnetworkmask = argv[optind-1];
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
case 2:/* src-mac */
|
|
Packit |
7b22a4 |
check_inverse(optarg, &invert, &optind, argc);
|
|
Packit |
7b22a4 |
set_option(&options, OPT_S_MAC, &cs.arp.arp.invflags,
|
|
Packit |
7b22a4 |
invert);
|
|
Packit |
7b22a4 |
if (getmac_and_mask(argv[optind - 1],
|
|
Packit |
7b22a4 |
cs.arp.arp.src_devaddr.addr, cs.arp.arp.src_devaddr.mask))
|
|
Packit |
7b22a4 |
xtables_error(PARAMETER_PROBLEM, "Problem with specified "
|
|
Packit |
7b22a4 |
"source mac");
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
case 3:/* dst-mac */
|
|
Packit |
7b22a4 |
check_inverse(optarg, &invert, &optind, argc);
|
|
Packit |
7b22a4 |
set_option(&options, OPT_D_MAC, &cs.arp.arp.invflags,
|
|
Packit |
7b22a4 |
invert);
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (getmac_and_mask(argv[optind - 1],
|
|
Packit |
7b22a4 |
cs.arp.arp.tgt_devaddr.addr, cs.arp.arp.tgt_devaddr.mask))
|
|
Packit |
7b22a4 |
xtables_error(PARAMETER_PROBLEM, "Problem with specified "
|
|
Packit |
7b22a4 |
"destination mac");
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
case 'l':/* hardware length */
|
|
Packit |
7b22a4 |
check_inverse(optarg, &invert, &optind, argc);
|
|
Packit |
7b22a4 |
set_option(&options, OPT_H_LENGTH, &cs.arp.arp.invflags,
|
|
Packit |
7b22a4 |
invert);
|
|
Packit |
7b22a4 |
getlength_and_mask(argv[optind - 1], &cs.arp.arp.arhln,
|
|
Packit |
7b22a4 |
&cs.arp.arp.arhln_mask);
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (cs.arp.arp.arhln != 6) {
|
|
Packit |
7b22a4 |
xtables_error(PARAMETER_PROBLEM,
|
|
Packit |
7b22a4 |
"Only harware address length of"
|
|
Packit |
7b22a4 |
" 6 is supported currently.");
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
case 8: /* was never supported, not even in arptables-legacy */
|
|
Packit |
7b22a4 |
xtables_error(PARAMETER_PROBLEM, "not supported");
|
|
Packit |
7b22a4 |
case 4:/* opcode */
|
|
Packit |
7b22a4 |
check_inverse(optarg, &invert, &optind, argc);
|
|
Packit |
7b22a4 |
set_option(&options, OPT_OPCODE, &cs.arp.arp.invflags,
|
|
Packit |
7b22a4 |
invert);
|
|
Packit |
7b22a4 |
if (get16_and_mask(argv[optind - 1], &cs.arp.arp.arpop,
|
|
Packit |
7b22a4 |
&cs.arp.arp.arpop_mask, 10)) {
|
|
Packit |
7b22a4 |
int i;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
for (i = 0; i < NUMOPCODES; i++)
|
|
Packit |
7b22a4 |
if (!strcasecmp(arp_opcodes[i], optarg))
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
if (i == NUMOPCODES)
|
|
Packit |
7b22a4 |
xtables_error(PARAMETER_PROBLEM, "Problem with specified opcode");
|
|
Packit |
7b22a4 |
cs.arp.arp.arpop = htons(i+1);
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
case 5:/* h-type */
|
|
Packit |
7b22a4 |
check_inverse(optarg, &invert, &optind, argc);
|
|
Packit |
7b22a4 |
set_option(&options, OPT_H_TYPE, &cs.arp.arp.invflags,
|
|
Packit |
7b22a4 |
invert);
|
|
Packit |
7b22a4 |
if (get16_and_mask(argv[optind - 1], &cs.arp.arp.arhrd,
|
|
Packit |
7b22a4 |
&cs.arp.arp.arhrd_mask, 16)) {
|
|
Packit |
7b22a4 |
if (strcasecmp(argv[optind-1], "Ethernet"))
|
|
Packit |
7b22a4 |
xtables_error(PARAMETER_PROBLEM, "Problem with specified hardware type");
|
|
Packit |
7b22a4 |
cs.arp.arp.arhrd = htons(1);
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
case 6:/* proto-type */
|
|
Packit |
7b22a4 |
check_inverse(optarg, &invert, &optind, argc);
|
|
Packit |
7b22a4 |
set_option(&options, OPT_P_TYPE, &cs.arp.arp.invflags,
|
|
Packit |
7b22a4 |
invert);
|
|
Packit |
7b22a4 |
if (get16_and_mask(argv[optind - 1], &cs.arp.arp.arpro,
|
|
Packit |
7b22a4 |
&cs.arp.arp.arpro_mask, 0)) {
|
|
Packit |
7b22a4 |
if (strcasecmp(argv[optind-1], "ipv4"))
|
|
Packit |
7b22a4 |
xtables_error(PARAMETER_PROBLEM, "Problem with specified protocol type");
|
|
Packit |
7b22a4 |
cs.arp.arp.arpro = htons(0x800);
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
case 'j':
|
|
Packit |
7b22a4 |
set_option(&options, OPT_JUMP, &cs.arp.arp.invflags,
|
|
Packit |
7b22a4 |
invert);
|
|
Packit |
7b22a4 |
command_jump(&cs, optarg);
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
case 'i':
|
|
Packit |
7b22a4 |
check_inverse(optarg, &invert, &optind, argc);
|
|
Packit |
7b22a4 |
set_option(&options, OPT_VIANAMEIN, &cs.arp.arp.invflags,
|
|
Packit |
7b22a4 |
invert);
|
|
Packit |
7b22a4 |
xtables_parse_interface(argv[optind-1],
|
|
Packit |
7b22a4 |
cs.arp.arp.iniface,
|
|
Packit |
7b22a4 |
cs.arp.arp.iniface_mask);
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
case 'o':
|
|
Packit |
7b22a4 |
check_inverse(optarg, &invert, &optind, argc);
|
|
Packit |
7b22a4 |
set_option(&options, OPT_VIANAMEOUT, &cs.arp.arp.invflags,
|
|
Packit |
7b22a4 |
invert);
|
|
Packit |
7b22a4 |
xtables_parse_interface(argv[optind-1],
|
|
Packit |
7b22a4 |
cs.arp.arp.outiface,
|
|
Packit |
7b22a4 |
cs.arp.arp.outiface_mask);
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
case 'v':
|
|
Packit |
7b22a4 |
if (!verbose)
|
|
Packit |
7b22a4 |
set_option(&options, OPT_VERBOSE,
|
|
Packit |
7b22a4 |
&cs.arp.arp.invflags, invert);
|
|
Packit |
7b22a4 |
verbose++;
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
case 'm': /* ignored by arptables-legacy */
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
case 'n':
|
|
Packit |
7b22a4 |
set_option(&options, OPT_NUMERIC, &cs.arp.arp.invflags,
|
|
Packit |
7b22a4 |
invert);
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
case 't':
|
|
Packit |
7b22a4 |
if (invert)
|
|
Packit |
7b22a4 |
xtables_error(PARAMETER_PROBLEM,
|
|
Packit |
7b22a4 |
"unexpected ! flag before --table");
|
|
Packit |
7b22a4 |
/* ignore this option.
|
|
Packit |
7b22a4 |
* arptables-legacy parses it, but libarptc doesn't use it.
|
|
Packit |
7b22a4 |
* arptables only has a 'filter' table anyway.
|
|
Packit |
7b22a4 |
*/
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
case 'V':
|
|
Packit |
7b22a4 |
if (invert)
|
|
Packit |
7b22a4 |
printf("Not %s ;-)\n", arptables_globals.program_version);
|
|
Packit |
7b22a4 |
else
|
|
Packit |
7b22a4 |
printf("%s v%s (nf_tables)\n",
|
|
Packit |
7b22a4 |
arptables_globals.program_name,
|
|
Packit |
7b22a4 |
arptables_globals.program_version);
|
|
Packit |
7b22a4 |
exit(0);
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
case '0':
|
|
Packit |
7b22a4 |
set_option(&options, OPT_LINENUMBERS, &cs.arp.arp.invflags,
|
|
Packit |
7b22a4 |
invert);
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
case 'M':
|
|
Packit |
7b22a4 |
//modprobe = optarg;
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
case 'c':
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
set_option(&options, OPT_COUNTERS, &cs.arp.arp.invflags,
|
|
Packit |
7b22a4 |
invert);
|
|
Packit |
7b22a4 |
pcnt = optarg;
|
|
Packit |
7b22a4 |
if (xs_has_arg(argc, argv))
|
|
Packit |
7b22a4 |
bcnt = argv[optind++];
|
|
Packit |
7b22a4 |
else
|
|
Packit |
7b22a4 |
xtables_error(PARAMETER_PROBLEM,
|
|
Packit |
7b22a4 |
"-%c requires packet and byte counter",
|
|
Packit |
7b22a4 |
opt2char(OPT_COUNTERS));
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (sscanf(pcnt, "%llu", &cs.arp.counters.pcnt) != 1)
|
|
Packit |
7b22a4 |
xtables_error(PARAMETER_PROBLEM,
|
|
Packit |
7b22a4 |
"-%c packet counter not numeric",
|
|
Packit |
7b22a4 |
opt2char(OPT_COUNTERS));
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (sscanf(bcnt, "%llu", &cs.arp.counters.bcnt) != 1)
|
|
Packit |
7b22a4 |
xtables_error(PARAMETER_PROBLEM,
|
|
Packit |
7b22a4 |
"-%c byte counter not numeric",
|
|
Packit |
7b22a4 |
opt2char(OPT_COUNTERS));
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
case 1: /* non option */
|
|
Packit |
7b22a4 |
if (optarg[0] == '!' && optarg[1] == '\0') {
|
|
Packit |
7b22a4 |
if (invert)
|
|
Packit |
7b22a4 |
xtables_error(PARAMETER_PROBLEM,
|
|
Packit |
7b22a4 |
"multiple consecutive ! not"
|
|
Packit |
7b22a4 |
" allowed");
|
|
Packit |
7b22a4 |
invert = true;
|
|
Packit |
7b22a4 |
optarg[0] = '\0';
|
|
Packit |
7b22a4 |
continue;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
printf("Bad argument `%s'\n", optarg);
|
|
Packit |
7b22a4 |
exit_tryhelp(2);
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
default:
|
|
Packit |
7b22a4 |
if (cs.target) {
|
|
Packit |
7b22a4 |
xtables_option_tpcall(c, argv,
|
|
Packit |
7b22a4 |
invert, cs.target, &cs.arp);
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
invert = false;
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (cs.target)
|
|
Packit |
7b22a4 |
xtables_option_tfcall(cs.target);
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (optind < argc)
|
|
Packit |
7b22a4 |
xtables_error(PARAMETER_PROBLEM,
|
|
Packit |
7b22a4 |
"unknown arguments found on commandline");
|
|
Packit |
7b22a4 |
if (!command)
|
|
Packit |
7b22a4 |
xtables_error(PARAMETER_PROBLEM, "no command specified");
|
|
Packit |
7b22a4 |
if (invert)
|
|
Packit |
7b22a4 |
xtables_error(PARAMETER_PROBLEM,
|
|
Packit |
7b22a4 |
"nothing appropriate following !");
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (command & (CMD_REPLACE | CMD_INSERT | CMD_DELETE | CMD_APPEND)) {
|
|
Packit |
7b22a4 |
if (!(options & OPT_DESTINATION))
|
|
Packit |
7b22a4 |
dhostnetworkmask = "0.0.0.0/0";
|
|
Packit |
7b22a4 |
if (!(options & OPT_SOURCE))
|
|
Packit |
7b22a4 |
shostnetworkmask = "0.0.0.0/0";
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (shostnetworkmask)
|
|
Packit |
7b22a4 |
xtables_ipparse_multiple(shostnetworkmask, &saddrs,
|
|
Packit |
7b22a4 |
&smasks, &nsaddrs);
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (dhostnetworkmask)
|
|
Packit |
7b22a4 |
xtables_ipparse_multiple(dhostnetworkmask, &daddrs,
|
|
Packit |
7b22a4 |
&dmasks, &ndaddrs);
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if ((nsaddrs > 1 || ndaddrs > 1) &&
|
|
Packit |
7b22a4 |
(cs.arp.arp.invflags & (ARPT_INV_SRCIP | ARPT_INV_TGTIP)))
|
|
Packit |
7b22a4 |
xtables_error(PARAMETER_PROBLEM, "! not allowed with multiple"
|
|
Packit |
7b22a4 |
" source or destination IP addresses");
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (command == CMD_REPLACE && (nsaddrs != 1 || ndaddrs != 1))
|
|
Packit |
7b22a4 |
xtables_error(PARAMETER_PROBLEM, "Replacement rule does not "
|
|
Packit |
7b22a4 |
"specify a unique address");
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (chain && strlen(chain) > ARPT_FUNCTION_MAXNAMELEN)
|
|
Packit |
7b22a4 |
xtables_error(PARAMETER_PROBLEM,
|
|
Packit |
7b22a4 |
"chain name `%s' too long (must be under %i chars)",
|
|
Packit |
7b22a4 |
chain, ARPT_FUNCTION_MAXNAMELEN);
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (command == CMD_APPEND
|
|
Packit |
7b22a4 |
|| command == CMD_DELETE
|
|
Packit |
7b22a4 |
|| command == CMD_INSERT
|
|
Packit |
7b22a4 |
|| command == CMD_REPLACE) {
|
|
Packit |
7b22a4 |
if (strcmp(chain, "PREROUTING") == 0
|
|
Packit |
7b22a4 |
|| strcmp(chain, "INPUT") == 0) {
|
|
Packit |
7b22a4 |
/* -o not valid with incoming packets. */
|
|
Packit |
7b22a4 |
if (options & OPT_VIANAMEOUT)
|
|
Packit |
7b22a4 |
xtables_error(PARAMETER_PROBLEM,
|
|
Packit |
7b22a4 |
"Can't use -%c with %s\n",
|
|
Packit |
7b22a4 |
opt2char(OPT_VIANAMEOUT),
|
|
Packit |
7b22a4 |
chain);
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (strcmp(chain, "POSTROUTING") == 0
|
|
Packit |
7b22a4 |
|| strcmp(chain, "OUTPUT") == 0) {
|
|
Packit |
7b22a4 |
/* -i not valid with outgoing packets */
|
|
Packit |
7b22a4 |
if (options & OPT_VIANAMEIN)
|
|
Packit |
7b22a4 |
xtables_error(PARAMETER_PROBLEM,
|
|
Packit |
7b22a4 |
"Can't use -%c with %s\n",
|
|
Packit |
7b22a4 |
opt2char(OPT_VIANAMEIN),
|
|
Packit |
7b22a4 |
chain);
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
switch (command) {
|
|
Packit |
7b22a4 |
case CMD_APPEND:
|
|
Packit |
7b22a4 |
ret = append_entry(h, chain, *table, &cs, 0,
|
|
Packit |
7b22a4 |
nsaddrs, saddrs, smasks,
|
|
Packit |
7b22a4 |
ndaddrs, daddrs, dmasks,
|
|
Packit |
7b22a4 |
options&OPT_VERBOSE, true);
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
case CMD_DELETE:
|
|
Packit |
7b22a4 |
ret = delete_entry(chain, *table, &cs,
|
|
Packit |
7b22a4 |
nsaddrs, saddrs, smasks,
|
|
Packit |
7b22a4 |
ndaddrs, daddrs, dmasks,
|
|
Packit |
7b22a4 |
options&OPT_VERBOSE, h);
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
case CMD_DELETE_NUM:
|
|
Packit |
7b22a4 |
ret = nft_rule_delete_num(h, chain, *table, rulenum - 1, verbose);
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
case CMD_REPLACE:
|
|
Packit |
7b22a4 |
ret = replace_entry(chain, *table, &cs, rulenum - 1,
|
|
Packit |
7b22a4 |
saddrs, smasks, daddrs, dmasks,
|
|
Packit |
7b22a4 |
options&OPT_VERBOSE, h);
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
case CMD_INSERT:
|
|
Packit |
7b22a4 |
ret = append_entry(h, chain, *table, &cs, rulenum - 1,
|
|
Packit |
7b22a4 |
nsaddrs, saddrs, smasks,
|
|
Packit |
7b22a4 |
ndaddrs, daddrs, dmasks,
|
|
Packit |
7b22a4 |
options&OPT_VERBOSE, false);
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
case CMD_LIST:
|
|
Packit |
7b22a4 |
ret = list_entries(h, chain, *table,
|
|
Packit |
7b22a4 |
rulenum,
|
|
Packit |
7b22a4 |
options&OPT_VERBOSE,
|
|
Packit |
7b22a4 |
options&OPT_NUMERIC,
|
|
Packit |
7b22a4 |
/*options&OPT_EXPANDED*/0,
|
|
Packit |
7b22a4 |
options&OPT_LINENUMBERS);
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
case CMD_FLUSH:
|
|
Packit |
7b22a4 |
ret = nft_rule_flush(h, chain, *table, options & OPT_VERBOSE);
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
case CMD_ZERO:
|
|
Packit |
7b22a4 |
ret = nft_chain_zero_counters(h, chain, *table,
|
|
Packit |
7b22a4 |
options & OPT_VERBOSE);
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
case CMD_LIST|CMD_ZERO:
|
|
Packit |
7b22a4 |
ret = list_entries(h, chain, *table, rulenum,
|
|
Packit |
7b22a4 |
options&OPT_VERBOSE,
|
|
Packit |
7b22a4 |
options&OPT_NUMERIC,
|
|
Packit |
7b22a4 |
/*options&OPT_EXPANDED*/0,
|
|
Packit |
7b22a4 |
options&OPT_LINENUMBERS);
|
|
Packit |
7b22a4 |
if (ret)
|
|
Packit |
7b22a4 |
ret = nft_chain_zero_counters(h, chain, *table,
|
|
Packit |
7b22a4 |
options & OPT_VERBOSE);
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
case CMD_NEW_CHAIN:
|
|
Packit |
7b22a4 |
ret = nft_chain_user_add(h, chain, *table);
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
case CMD_DELETE_CHAIN:
|
|
Packit |
7b22a4 |
ret = nft_chain_user_del(h, chain, *table,
|
|
Packit |
7b22a4 |
options & OPT_VERBOSE);
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
case CMD_RENAME_CHAIN:
|
|
Packit |
7b22a4 |
ret = nft_chain_user_rename(h, chain, *table, newname);
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
case CMD_SET_POLICY:
|
|
Packit |
7b22a4 |
ret = nft_chain_set(h, *table, chain, policy, NULL);
|
|
Packit |
7b22a4 |
if (ret < 0)
|
|
Packit |
7b22a4 |
xtables_error(PARAMETER_PROBLEM, "Wrong policy `%s'\n",
|
|
Packit |
7b22a4 |
policy);
|
|
Packit |
7b22a4 |
break;
|
|
Packit |
7b22a4 |
default:
|
|
Packit |
7b22a4 |
/* We should never reach this... */
|
|
Packit |
7b22a4 |
exit_tryhelp(2);
|
|
Packit |
7b22a4 |
}
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
free(saddrs);
|
|
Packit |
7b22a4 |
free(smasks);
|
|
Packit |
7b22a4 |
free(daddrs);
|
|
Packit |
7b22a4 |
free(dmasks);
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
if (cs.target)
|
|
Packit |
7b22a4 |
free(cs.target->t);
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
xtables_free_opts(1);
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
/* if (verbose > 1)
|
|
Packit |
7b22a4 |
dump_entries(*handle);*/
|
|
Packit |
7b22a4 |
|
|
Packit |
7b22a4 |
return ret;
|
|
Packit |
7b22a4 |
}
|