int
dump_entry(STRUCT_ENTRY *e, const TC_HANDLE_T handle)
{
size_t i;
STRUCT_ENTRY_TARGET *t;
printf("Entry %u (%lu):\n", iptcb_entry2index(handle, e),
iptcb_entry2offset(handle, e));
printf("SRC IP: %u.%u.%u.%u/%u.%u.%u.%u\n",
IP_PARTS(e->ip.src.s_addr),IP_PARTS(e->ip.smsk.s_addr));
printf("DST IP: %u.%u.%u.%u/%u.%u.%u.%u\n",
IP_PARTS(e->ip.dst.s_addr),IP_PARTS(e->ip.dmsk.s_addr));
printf("Interface: `%s'/", e->ip.iniface);
for (i = 0; i < IFNAMSIZ; i++)
printf("%c", e->ip.iniface_mask[i] ? 'X' : '.');
printf("to `%s'/", e->ip.outiface);
for (i = 0; i < IFNAMSIZ; i++)
printf("%c", e->ip.outiface_mask[i] ? 'X' : '.');
printf("\nProtocol: %u\n", e->ip.proto);
printf("Flags: %02X\n", e->ip.flags);
printf("Invflags: %02X\n", e->ip.invflags);
printf("Counters: %llu packets, %llu bytes\n",
(unsigned long long)e->counters.pcnt, (unsigned long long)e->counters.bcnt);
printf("Cache: %08X ", e->nfcache);
if (e->nfcache & NFC_ALTERED) printf("ALTERED ");
if (e->nfcache & NFC_UNKNOWN) printf("UNKNOWN ");
printf("\n");
IPT_MATCH_ITERATE(e, print_match);
t = GET_TARGET(e);
printf("Target name: `%s' [%u]\n", t->u.user.name, t->u.target_size);
if (strcmp(t->u.user.name, STANDARD_TARGET) == 0) {
int pos = *(int *)t->data;
if (pos < 0)
printf("verdict=%s\n",
pos == -NF_ACCEPT-1 ? "NF_ACCEPT"
: pos == -NF_DROP-1 ? "NF_DROP"
: pos == -NF_QUEUE-1 ? "NF_QUEUE"
: pos == RETURN ? "RETURN"
: "UNKNOWN");
else
printf("verdict=%u\n", pos);
} else if (strcmp(t->u.user.name, IPT_ERROR_TARGET) == 0)
printf("error=`%s'\n", t->data);
printf("\n");
return 0;
}
static inline int
check_entry(const STRUCT_ENTRY *e, unsigned int *i, unsigned int *off,
unsigned int user_offset, int *was_return,
struct iptc_handle *h)
{
unsigned int toff;
STRUCT_STANDARD_TARGET *t;
assert(e->target_offset >= sizeof(STRUCT_ENTRY));
assert(e->next_offset >= e->target_offset
+ sizeof(STRUCT_ENTRY_TARGET));
toff = sizeof(STRUCT_ENTRY);
IPT_MATCH_ITERATE(e, check_match, &toff);
assert(toff == e->target_offset);
t = (STRUCT_STANDARD_TARGET *)
GET_TARGET((STRUCT_ENTRY *)e);
/* next_offset will have to be multiple of entry alignment. */
assert(e->next_offset == ALIGN(e->next_offset));
assert(e->target_offset == ALIGN(e->target_offset));
assert(t->target.u.target_size == ALIGN(t->target.u.target_size));
assert(!TC_IS_CHAIN(t->target.u.user.name, h));
if (strcmp(t->target.u.user.name, STANDARD_TARGET) == 0) {
assert(t->target.u.target_size
== ALIGN(sizeof(STRUCT_STANDARD_TARGET)));
assert(t->verdict == -NF_DROP-1
|| t->verdict == -NF_ACCEPT-1
|| t->verdict == RETURN
|| t->verdict < (int)h->entries->size);
if (t->verdict >= 0) {
STRUCT_ENTRY *te = get_entry(h, t->verdict);
int idx;
idx = iptcb_entry2index(h, te);
assert(strcmp(GET_TARGET(te)->u.user.name,
IPT_ERROR_TARGET)
!= 0);
assert(te != e);
/* Prior node must be error node, or this node. */
assert(t->verdict == iptcb_entry2offset(h, e)+e->next_offset
|| strcmp(GET_TARGET(index2entry(h, idx-1))
->u.user.name, IPT_ERROR_TARGET)
== 0);
}
if (t->verdict == RETURN
&& unconditional(&e->ip)
&& e->target_offset == sizeof(*e))
*was_return = 1;
else
*was_return = 0;
} else if (strcmp(t->target.u.user.name, IPT_ERROR_TARGET) == 0) {
assert(t->target.u.target_size
== ALIGN(sizeof(struct ipt_error_target)));
/* If this is in user area, previous must have been return */
if (*off > user_offset)
assert(*was_return);
*was_return = 0;
}
else *was_return = 0;
if (*off == user_offset)
assert(strcmp(t->target.u.user.name, IPT_ERROR_TARGET) == 0);
(*off) += e->next_offset;
(*i)++;
return 0;
}
static int
dump_entry(struct ip6t_entry *e, struct ip6tc_handle *const handle)
{
size_t i;
char buf[40];
int len;
struct ip6t_entry_target *t;
printf("Entry %u (%lu):\n", iptcb_entry2index(handle, e),
iptcb_entry2offset(handle, e));
puts("SRC IP: ");
inet_ntop(AF_INET6, &e->ipv6.src, buf, sizeof buf);
puts(buf);
putchar('/');
len = ipv6_prefix_length(&e->ipv6.smsk);
if (len != -1)
printf("%d", len);
else {
inet_ntop(AF_INET6, &e->ipv6.smsk, buf, sizeof buf);
puts(buf);
}
putchar('\n');
puts("DST IP: ");
inet_ntop(AF_INET6, &e->ipv6.dst, buf, sizeof buf);
puts(buf);
putchar('/');
len = ipv6_prefix_length(&e->ipv6.dmsk);
if (len != -1)
printf("%d", len);
else {
inet_ntop(AF_INET6, &e->ipv6.dmsk, buf, sizeof buf);
puts(buf);
}
putchar('\n');
printf("Interface: `%s'/", e->ipv6.iniface);
for (i = 0; i < IFNAMSIZ; i++)
printf("%c", e->ipv6.iniface_mask[i] ? 'X' : '.');
printf("to `%s'/", e->ipv6.outiface);
for (i = 0; i < IFNAMSIZ; i++)
printf("%c", e->ipv6.outiface_mask[i] ? 'X' : '.');
printf("\nProtocol: %u\n", e->ipv6.proto);
if (e->ipv6.flags & IP6T_F_TOS)
printf("TOS: %u\n", e->ipv6.tos);
printf("Flags: %02X\n", e->ipv6.flags);
printf("Invflags: %02X\n", e->ipv6.invflags);
printf("Counters: %llu packets, %llu bytes\n",
(unsigned long long)e->counters.pcnt, (unsigned long long)e->counters.bcnt);
printf("Cache: %08X\n", e->nfcache);
IP6T_MATCH_ITERATE(e, print_match);
t = ip6t_get_target(e);
printf("Target name: `%s' [%u]\n", t->u.user.name, t->u.target_size);
if (strcmp(t->u.user.name, IP6T_STANDARD_TARGET) == 0) {
const unsigned char *data = t->data;
int pos = *(const int *)data;
if (pos < 0)
printf("verdict=%s\n",
pos == -NF_ACCEPT-1 ? "NF_ACCEPT"
: pos == -NF_DROP-1 ? "NF_DROP"
: pos == IP6T_RETURN ? "RETURN"
: "UNKNOWN");
else
printf("verdict=%u\n", pos);
} else if (strcmp(t->u.user.name, IP6T_ERROR_TARGET) == 0)
printf("error=`%s'\n", t->data);
printf("\n");
return 0;
}