static void remove_inhibitor_rules(struct ipt_entry *caller_inhibitor_entry, struct ipt_entry *callee_inhibitor_entry) { struct iptc_handle *ipt_handle; unsigned char matchmask[IPTC_FULL_SIZE]; if ((ipt_handle = iptc_init("raw")) != NULL) { memset(matchmask, 255, IPTC_FULL_SIZE); // We release all rules to workaround stray rules that may remain in the // raw table after the application crashes without a chance to clean up. while(iptc_delete_entry("PREROUTING", caller_inhibitor_entry, matchmask, ipt_handle)); while(iptc_delete_entry("PREROUTING", callee_inhibitor_entry, matchmask, ipt_handle)); if (!iptc_commit(ipt_handle)) iptc_free(ipt_handle); } }
int ip4tables_add_rules(struct iptc_handle* handle, const char* chain_name, int rulenum, int dim, int src_dst, const char* target_name, const char* set_name, uint16_t protocol, int param, int cmd, bool ignore_errors) { size_t size; struct ipt_entry *fw; struct xt_entry_target *target; struct xt_entry_match *match; #ifdef HAVE_XT_SET_INFO_MATCH_V1 struct xt_set_info_match_v1 *setinfo; #else struct xt_set_info_match *setinfo; #endif ipt_chainlabel chain; int res; int sav_errno; /* Add an entry */ memset(chain, 0, sizeof(chain)); size = XT_ALIGN(sizeof (struct ipt_entry)) + XT_ALIGN(sizeof(struct xt_entry_match)) + XT_ALIGN(sizeof(struct xt_entry_target) + 1) + XT_ALIGN(sizeof(*setinfo)); if (protocol == IPPROTO_ICMP) size += XT_ALIGN(sizeof(struct xt_entry_match)) + XT_ALIGN(sizeof(struct ipt_icmp)); fw = (struct ipt_entry*)MALLOC(size); fw->target_offset = XT_ALIGN(sizeof(struct ipt_entry)); // set match = (struct xt_entry_match*)((char*)fw + fw->target_offset); match->u.match_size = XT_ALIGN(sizeof(struct xt_entry_match)) + XT_ALIGN(sizeof(*setinfo)); #ifdef HAVE_XT_SET_INFO_MATCH_V1 match->u.user.revision = 1; #else match->u.user.revision = 0; #endif fw->target_offset += match->u.match_size; strcpy(match->u.user.name, "set"); #ifdef HAVE_XT_SET_INFO_MATCH_V1 setinfo = (struct xt_set_info_match_v1 *)match->data; #else setinfo = (struct xt_set_info_match *)match->data; #endif get_set_byname(set_name, &setinfo->match_set, NFPROTO_IPV4, ignore_errors); if (setinfo->match_set.index == IPSET_INVALID_ID) { FREE(fw); return -1; } setinfo->match_set.dim = dim; setinfo->match_set.flags = src_dst; if (protocol != IPPROTO_NONE) { fw->ip.proto = protocol; // fw->ip.flags |= IP6T_F_PROTO ; // IPv6 only if (protocol == IPPROTO_ICMP) { match = (struct xt_entry_match*)((char*)fw + fw->target_offset); match->u.match_size = XT_ALIGN(sizeof(struct xt_entry_match)) + XT_ALIGN(sizeof(struct ipt_icmp)); match->u.user.revision = 0; fw->target_offset += match->u.match_size; strcpy(match->u.user.name, "icmp"); struct ipt_icmp *icmpinfo = (struct ipt_icmp *)match->data; icmpinfo->type = param; // type to match icmpinfo->code[0] = 0; // code lower icmpinfo->code[1] = 0xff; // code upper icmpinfo->invflags = 0; // don't invert } } // target is XTC_LABEL_DROP/XTC_LABEL_ACCEPT fw->next_offset = size; target = ipt_get_target(fw); target->u.user.target_size = XT_ALIGN(sizeof(struct xt_entry_target) + 1); strcpy(target->u.user.name, target_name); // fw->ip.flags |= IPT_F_GOTO; strcpy(chain, chain_name); // Use iptc_append_entry to add to the chain if (cmd == IPADDRESS_DEL) { unsigned char matchmask[fw->next_offset]; memset(matchmask, 0xff, fw->next_offset); res = iptc_delete_entry(chain, fw, matchmask, handle); } else if (rulenum == -1) res = iptc_append_entry(chain, fw, handle) ; else res = iptc_insert_entry(chain, fw, rulenum, handle) ; sav_errno = errno; FREE(fw); if (res!= 1) { if (!ignore_errors) log_message(LOG_INFO, "iptc_insert_entry for chain %s returned %d: %s", chain, res, iptc_strerror(sav_errno)) ; return sav_errno; } return 0; }
int ip4tables_process_entry( struct iptc_handle* handle, const char* chain_name, int rulenum, const char* target_name, const ip_address_t* src_ip_address, const ip_address_t* dst_ip_address, const char* in_iface, const char* out_iface, uint16_t protocol, uint16_t type, int cmd, bool force) { size_t size; struct ipt_entry *fw; struct xt_entry_target *target; struct xt_entry_match *match ; ipt_chainlabel chain; int res; int sav_errno; /* Add an entry */ memset (chain, 0, sizeof (chain)); size = XT_ALIGN (sizeof (struct ipt_entry)) + XT_ALIGN (sizeof (struct xt_entry_target) + 1); if ( protocol == IPPROTO_ICMP ) size += XT_ALIGN ( sizeof(struct xt_entry_match) ) + XT_ALIGN ( sizeof(struct ipt_icmp) ) ; fw = (struct ipt_entry*)MALLOC(size); fw->target_offset = XT_ALIGN ( sizeof ( struct ipt_entry ) ) ; if ( src_ip_address && src_ip_address->ifa.ifa_family != AF_UNSPEC ) { memcpy(&fw->ip.src, &src_ip_address->u.sin.sin_addr, sizeof ( src_ip_address->u.sin.sin_addr ) ); memset ( &fw->ip.smsk, 0xff, sizeof(fw->ip.smsk)); } if ( dst_ip_address && dst_ip_address->ifa.ifa_family != AF_UNSPEC ) { memcpy(&fw->ip.dst, &dst_ip_address->u.sin.sin_addr, sizeof ( dst_ip_address->u.sin.sin_addr ) ); memset ( &fw->ip.dmsk, 0xff, sizeof(fw->ip.dmsk)); } if (in_iface) set_iface(fw->ip.iniface, fw->ip.iniface_mask, in_iface); if (out_iface) set_iface(fw->ip.outiface, fw->ip.outiface_mask, out_iface); if ( protocol != IPPROTO_NONE ) { fw->ip.proto = protocol ; // fw->ip.flags |= IP6T_F_PROTO ; // IPv6 only if ( protocol == IPPROTO_ICMP ) { match = (struct xt_entry_match*)((char*)fw + fw->target_offset); match->u.match_size = XT_ALIGN ( sizeof (struct xt_entry_match) ) + XT_ALIGN ( sizeof (struct ipt_icmp) ) ; match->u.user.revision = 0; fw->target_offset += match->u.match_size ; strcpy ( match->u.user.name, "icmp" ) ; struct ipt_icmp *icmpinfo = (struct ipt_icmp *) match->data; icmpinfo->type = type ; // type to match icmpinfo->code[0] = 0 ; // code lower icmpinfo->code[1] = 0xff ; // code upper icmpinfo->invflags = 0 ; // don't invert } } // target is XTC_LABEL_DROP/XTC_LABEL_ACCEPT fw->next_offset = size; target = ipt_get_target ( fw ) ; target->u.user.target_size = XT_ALIGN (sizeof (struct xt_entry_target) + 1); strcpy (target->u.user.name, target_name ); // fw->ip.flags |= IPT_F_GOTO; strcpy (chain, chain_name); // Use iptc_append_entry to add to the chain if (cmd == IPADDRESS_DEL) { unsigned char matchmask[fw->next_offset]; memset(matchmask, 0xff, fw->next_offset); res = iptc_delete_entry(chain, fw, matchmask, handle); } else if ( rulenum == -1 ) res = iptc_append_entry (chain, fw, handle ) ; else res = iptc_insert_entry (chain, fw, rulenum, handle ) ; sav_errno = errno ; if (res != 1 && (!force || sav_errno != ENOENT)) { log_message(LOG_INFO, "ip4tables_process_entry for chain %s returned %d: %s", chain, res, iptc_strerror (sav_errno) ) ; return sav_errno ; } return 0 ; }