blob: 324dd1f1870a74574808504441899f1c68556577 [file] [log] [blame]
lh9ed821d2023-04-07 01:36:19 -07001/* Code to restore the iptables state, from file by ip6tables-save.
2 * Author: Andras Kis-Szabo <kisza@sch.bme.hu>
3 *
4 * based on iptables-restore
5 * Authors:
6 * Harald Welte <laforge@gnumonks.org>
7 * Rusty Russell <rusty@linuxcare.com.au>
8 * This code is distributed under the terms of GNU GPL v2
9 *
10 * $Id$
11 */
12
13#include <getopt.h>
14#include <sys/errno.h>
15#include <stdbool.h>
16#include <string.h>
17#include <stdio.h>
18#include <stdlib.h>
19#include "ip6tables.h"
20#include "xtables.h"
21#include "libiptc/libip6tc.h"
22#include "ip6tables-multi.h"
23
24#ifdef DEBUG
25#define DEBUGP(x, args...) fprintf(stderr, x, ## args)
26#else
27#define DEBUGP(x, args...)
28#endif
29
30static int binary = 0, counters = 0, verbose = 0, noflush = 0;
31
32/* Keeping track of external matches and targets. */
33static const struct option options[] = {
34 {.name = "binary", .has_arg = false, .val = 'b'},
35 {.name = "counters", .has_arg = false, .val = 'c'},
36 {.name = "verbose", .has_arg = false, .val = 'v'},
37 {.name = "test", .has_arg = false, .val = 't'},
38 {.name = "help", .has_arg = false, .val = 'h'},
39 {.name = "noflush", .has_arg = false, .val = 'n'},
40 {.name = "modprobe", .has_arg = true, .val = 'M'},
41 {NULL},
42};
43
44static void print_usage(const char *name, const char *version) __attribute__((noreturn));
45
46static void print_usage(const char *name, const char *version)
47{
48 fprintf(stderr, "Usage: %s [-b] [-c] [-v] [-t] [-h]\n"
49 " [ --binary ]\n"
50 " [ --counters ]\n"
51 " [ --verbose ]\n"
52 " [ --test ]\n"
53 " [ --help ]\n"
54 " [ --noflush ]\n"
55 " [ --modprobe=<command>]\n", name);
56
57 exit(1);
58}
59
60static struct ip6tc_handle *create_handle(const char *tablename)
61{
62 struct ip6tc_handle *handle;
63
64 handle = ip6tc_init(tablename);
65
66 if (!handle) {
67 /* try to insmod the module if iptc_init failed */
68 xtables_load_ko(xtables_modprobe_program, false);
69 handle = ip6tc_init(tablename);
70 }
71
72 if (!handle) {
73 xtables_error(PARAMETER_PROBLEM, "%s: unable to initialize "
74 "table '%s'\n", ip6tables_globals.program_name,
75 tablename);
76 exit(1);
77 }
78 return handle;
79}
80
81static int parse_counters(char *string, struct ip6t_counters *ctr)
82{
83 unsigned long long pcnt, bcnt;
84 int ret;
85
86 ret = sscanf(string, "[%llu:%llu]",
87 (unsigned long long *)&pcnt,
88 (unsigned long long *)&bcnt);
89 ctr->pcnt = pcnt;
90 ctr->bcnt = bcnt;
91 return ret == 2;
92}
93
94/* global new argv and argc */
95static char *newargv[255];
96static int newargc;
97
98/* function adding one argument to newargv, updating newargc
99 * returns true if argument added, false otherwise */
100static int add_argv(char *what) {
101 DEBUGP("add_argv: %s\n", what);
102 if (what && ((newargc + 1) < sizeof(newargv)/sizeof(char *))) {
103 newargv[newargc] = strdup(what);
104 newargc++;
105 return 1;
106 } else
107 return 0;
108}
109
110static void free_argv(void) {
111 int i;
112
113 for (i = 0; i < newargc; i++)
114 free(newargv[i]);
115}
116
117#ifdef IPTABLES_MULTI
118int ip6tables_restore_main(int argc, char *argv[])
119#else
120int main(int argc, char *argv[])
121#endif
122{
123 struct ip6tc_handle *handle = NULL;
124 char buffer[10240];
125 int c;
126 char curtable[IP6T_TABLE_MAXNAMELEN + 1];
127 FILE *in;
128 int in_table = 0, testing = 0;
129
130 line = 0;
131
132 ip6tables_globals.program_name = "ip6tables-restore";
133 c = xtables_init_all(&ip6tables_globals, NFPROTO_IPV6);
134 if (c < 0) {
135 fprintf(stderr, "%s/%s Failed to initialize xtables\n",
136 ip6tables_globals.program_name,
137 ip6tables_globals.program_version);
138 exit(1);
139 }
140#ifdef NO_SHARED_LIBS
141 init_extensions();
142#endif
143
144 while ((c = getopt_long(argc, argv, "bcvthnM:", options, NULL)) != -1) {
145 switch (c) {
146 case 'b':
147 binary = 1;
148 break;
149 case 'c':
150 counters = 1;
151 break;
152 case 'v':
153 verbose = 1;
154 break;
155 case 't':
156 testing = 1;
157 break;
158 case 'h':
159 print_usage("ip6tables-restore",
160 IPTABLES_VERSION);
161 break;
162 case 'n':
163 noflush = 1;
164 break;
165 case 'M':
166 xtables_modprobe_program = optarg;
167 break;
168 }
169 }
170
171 if (optind == argc - 1) {
172 in = fopen(argv[optind], "r");
173 if (!in) {
174 fprintf(stderr, "Can't open %s: %s\n", argv[optind],
175 strerror(errno));
176 exit(1);
177 }
178 }
179 else if (optind < argc) {
180 fprintf(stderr, "Unknown arguments found on commandline\n");
181 exit(1);
182 }
183 else in = stdin;
184
185 /* Grab standard input. */
186 while (fgets(buffer, sizeof(buffer), in)) {
187 int ret = 0;
188
189 line++;
190 if (buffer[0] == '\n')
191 continue;
192 else if (buffer[0] == '#') {
193 if (verbose)
194 fputs(buffer, stdout);
195 continue;
196 } else if ((strcmp(buffer, "COMMIT\n") == 0) && (in_table)) {
197 if (!testing) {
198 DEBUGP("Calling commit\n");
199 ret = ip6tc_commit(handle);
200 ip6tc_free(handle);
201 handle = NULL;
202 } else {
203 DEBUGP("Not calling commit, testing\n");
204 ret = 1;
205 }
206 in_table = 0;
207 } else if ((buffer[0] == '*') && (!in_table)) {
208 /* New table */
209 char *table;
210
211 table = strtok(buffer+1, " \t\n");
212 DEBUGP("line %u, table '%s'\n", line, table);
213 if (!table) {
214 xtables_error(PARAMETER_PROBLEM,
215 "%s: line %u table name invalid\n",
216 ip6tables_globals.program_name,
217 line);
218 exit(1);
219 }
220 strncpy(curtable, table, IP6T_TABLE_MAXNAMELEN);
221 curtable[IP6T_TABLE_MAXNAMELEN] = '\0';
222
223 if (handle)
224 ip6tc_free(handle);
225
226 handle = create_handle(table);
227 if (noflush == 0) {
228 DEBUGP("Cleaning all chains of table '%s'\n",
229 table);
230 for_each_chain(flush_entries, verbose, 1,
231 handle);
232
233 DEBUGP("Deleting all user-defined chains "
234 "of table '%s'\n", table);
235 for_each_chain(delete_chain, verbose, 0,
236 handle);
237 }
238
239 ret = 1;
240 in_table = 1;
241
242 } else if ((buffer[0] == ':') && (in_table)) {
243 /* New chain. */
244 char *policy, *chain;
245
246 chain = strtok(buffer+1, " \t\n");
247 DEBUGP("line %u, chain '%s'\n", line, chain);
248 if (!chain) {
249 xtables_error(PARAMETER_PROBLEM,
250 "%s: line %u chain name invalid\n",
251 ip6tables_globals.program_name,
252 line);
253 exit(1);
254 }
255
256 if (ip6tc_builtin(chain, handle) <= 0) {
257 if (noflush && ip6tc_is_chain(chain, handle)) {
258 DEBUGP("Flushing existing user defined chain '%s'\n", chain);
259 if (!ip6tc_flush_entries(chain, handle))
260 xtables_error(PARAMETER_PROBLEM,
261 "error flushing chain "
262 "'%s':%s\n", chain,
263 strerror(errno));
264 } else {
265 DEBUGP("Creating new chain '%s'\n", chain);
266 if (!ip6tc_create_chain(chain, handle))
267 xtables_error(PARAMETER_PROBLEM,
268 "error creating chain "
269 "'%s':%s\n", chain,
270 strerror(errno));
271 }
272 }
273
274 policy = strtok(NULL, " \t\n");
275 DEBUGP("line %u, policy '%s'\n", line, policy);
276 if (!policy) {
277 xtables_error(PARAMETER_PROBLEM,
278 "%s: line %u policy invalid\n",
279 ip6tables_globals.program_name,
280 line);
281 exit(1);
282 }
283
284 if (strcmp(policy, "-") != 0) {
285 struct ip6t_counters count;
286
287 if (counters) {
288 char *ctrs;
289 ctrs = strtok(NULL, " \t\n");
290
291 if (!ctrs || !parse_counters(ctrs, &count))
292 xtables_error(PARAMETER_PROBLEM,
293 "invalid policy counters "
294 "for chain '%s'\n", chain);
295
296 } else {
297 memset(&count, 0,
298 sizeof(struct ip6t_counters));
299 }
300
301 DEBUGP("Setting policy of chain %s to %s\n",
302 chain, policy);
303
304 if (!ip6tc_set_policy(chain, policy, &count,
305 handle))
306 xtables_error(OTHER_PROBLEM,
307 "Can't set policy `%s'"
308 " on `%s' line %u: %s\n",
309 chain, policy, line,
310 ip6tc_strerror(errno));
311 }
312
313 ret = 1;
314
315 } else if (in_table) {
316 int a;
317 char *ptr = buffer;
318 char *pcnt = NULL;
319 char *bcnt = NULL;
320 char *parsestart;
321
322 /* the parser */
323 char *curchar;
324 int quote_open, escaped;
325 size_t param_len;
326
327 /* reset the newargv */
328 newargc = 0;
329
330 if (buffer[0] == '[') {
331 /* we have counters in our input */
332 ptr = strchr(buffer, ']');
333 if (!ptr)
334 xtables_error(PARAMETER_PROBLEM,
335 "Bad line %u: need ]\n",
336 line);
337
338 pcnt = strtok(buffer+1, ":");
339 if (!pcnt)
340 xtables_error(PARAMETER_PROBLEM,
341 "Bad line %u: need :\n",
342 line);
343
344 bcnt = strtok(NULL, "]");
345 if (!bcnt)
346 xtables_error(PARAMETER_PROBLEM,
347 "Bad line %u: need ]\n",
348 line);
349
350 /* start command parsing after counter */
351 parsestart = ptr + 1;
352 } else {
353 /* start command parsing at start of line */
354 parsestart = buffer;
355 }
356
357 add_argv(argv[0]);
358 add_argv("-t");
359 add_argv((char *) &curtable);
360
361 if (counters && pcnt && bcnt) {
362 add_argv("--set-counters");
363 add_argv((char *) pcnt);
364 add_argv((char *) bcnt);
365 }
366
367 /* After fighting with strtok enough, here's now
368 * a 'real' parser. According to Rusty I'm now no
369 * longer a real hacker, but I can live with that */
370
371 quote_open = 0;
372 escaped = 0;
373 param_len = 0;
374
375 for (curchar = parsestart; *curchar; curchar++) {
376 char param_buffer[1024];
377
378 if (quote_open) {
379 if (escaped) {
380 param_buffer[param_len++] = *curchar;
381 escaped = 0;
382 continue;
383 } else if (*curchar == '\\') {
384 escaped = 1;
385 continue;
386 } else if (*curchar == '"') {
387 quote_open = 0;
388 *curchar = ' ';
389 } else {
390 param_buffer[param_len++] = *curchar;
391 continue;
392 }
393 } else {
394 if (*curchar == '"') {
395 quote_open = 1;
396 continue;
397 }
398 }
399
400 if (*curchar == ' '
401 || *curchar == '\t'
402 || * curchar == '\n') {
403 if (!param_len) {
404 /* two spaces? */
405 continue;
406 }
407
408 param_buffer[param_len] = '\0';
409
410 /* check if table name specified */
411 if (!strncmp(param_buffer, "-t", 2)
412 || !strncmp(param_buffer, "--table", 8)) {
413 xtables_error(PARAMETER_PROBLEM,
414 "Line %u seems to have a "
415 "-t table option.\n", line);
416 exit(1);
417 }
418
419 add_argv(param_buffer);
420 param_len = 0;
421 } else {
422 /* regular character, copy to buffer */
423 param_buffer[param_len++] = *curchar;
424
425 if (param_len >= sizeof(param_buffer))
426 xtables_error(PARAMETER_PROBLEM,
427 "Parameter too long!");
428 }
429 }
430
431 DEBUGP("calling do_command6(%u, argv, &%s, handle):\n",
432 newargc, curtable);
433
434 for (a = 0; a < newargc; a++)
435 DEBUGP("argv[%u]: %s\n", a, newargv[a]);
436
437 ret = do_command6(newargc, newargv,
438 &newargv[2], &handle);
439
440 free_argv();
441 fflush(stdout);
442 }
443 if (!ret) {
444 fprintf(stderr, "%s: line %u failed\n",
445 ip6tables_globals.program_name,
446 line);
447 exit(1);
448 }
449 }
450 if (in_table) {
451 fprintf(stderr, "%s: COMMIT expected at line %u\n",
452 ip6tables_globals.program_name,
453 line + 1);
454 exit(1);
455 }
456
457 return 0;
458}