ip6tables-restore.c - platform/external/iptables - Gitiles

 /* Code to restore the iptables state, from file by ip6tables-save.
  * Author:  Andras Kis-Szabo <kisza@sch.bme.hu>
  *
  * based on iptables-restore
  * Authors:
  * 	Harald Welte <laforge@gnumonks.org>
  * 	Rusty Russell <rusty@linuxcare.com.au>
  *
  */

 #include <getopt.h>
 #include <sys/errno.h>
 #include <string.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include "ip6tables.h"
 #include "libiptc/libip6tc.h"

 #ifdef DEBUG
 #define DEBUGP(x, args...) fprintf(stderr, x, ## args)
 #else
 #define DEBUGP(x, args...)
 #endif

 extern int for_each_chain(int (*fn)(const ip6t_chainlabel, int, ip6tc_handle_t *), int verbose, int builtinstoo, ip6tc_handle_t *handle);
 extern int flush_entries(const ip6t_chainlabel chain, int verbose, ip6tc_handle_t *handle);
 extern int delete_chain(const ip6t_chainlabel chain, int verbose, ip6tc_handle_t *handle);

 static int binary = 0, counters = 0, verbose = 0, noflush = 0;

 /* Keeping track of external matches and targets.  */
 static struct option options[] = {
 	{ "binary", 0, 0, 'b' },
 	{ "counters", 0, 0, 'c' },
 /*	{ "verbose", 1, 0, 'v' }, */
 	{ "help", 0, 0, 'h' },
 	{ "noflush", 0, 0, 'n'},
 	{ "modprobe", 1, 0, 'M'},
 	{ 0 }
 };

 static void print_usage(const char *name, const char *version) __attribute__((noreturn));

 static void print_usage(const char *name, const char *version)
 {
 	fprintf(stderr, "Usage: %s [-b] [-c] [-v] [-h]\n"
 			"	   [ --binary ]\n"
 			"	   [ --counters ]\n"
 			"	   [ --verbose ]\n"
 			"	   [ --help ]\n"
 			"	   [ --noflush ]\n"
 		        "          [ --modprobe=<command>]\n", name);

 	exit(1);
 }

 ip6tc_handle_t create_handle(const char *tablename, const char* modprobe)
 {
 	ip6tc_handle_t handle;

 	handle = ip6tc_init(tablename);

 	if (!handle) {
                 /* try to insmod the module if iptc_init failed */
                 ip6tables_insmod("ip6_tables", modprobe);
                 handle = ip6tc_init(tablename);
 	}

 	if (!handle) {
 		exit_error(PARAMETER_PROBLEM, "%s: unable to initialize"
 			"table '%s'\n", program_name, tablename);
 		exit(1);
 	}
 	return handle;
 }

 int parse_counters(char *string, struct ip6t_counters *ctr)
 {
 	return (sscanf(string, "[%llu:%llu]", &ctr->pcnt, &ctr->bcnt) == 2);
 }

 /* global new argv and argc */
 static char *newargv[255];
 static int newargc;

 /* function adding one argument to newargv, updating newargc
  *  * returns true if argument added, false otherwise */
 static int add_argv(char *what) {
         if (what && ((newargc + 1) < sizeof(newargv)/sizeof(char *))) {
                 newargv[newargc] = strdup(what);
                 newargc++;
                 return 1;
         } else
                 return 0;
 }

 static void free_argv(void) {
         int i;

         for (i = 0; i < newargc; i++)
                 free(newargv[i]);
 }

 int main(int argc, char *argv[])
 {
 	ip6tc_handle_t handle;
 	char buffer[10240];
 	unsigned int line = 0;
 	int c;
 	char curtable[IP6T_TABLE_MAXNAMELEN + 1];
 	FILE *in;
 	const char *modprobe = 0;

 	program_name = "ip6tables-restore";
 	program_version = NETFILTER_VERSION;

 #ifdef NO_SHARED_LIBS
 	init_extensions();
 #endif

 	while ((c = getopt_long(argc, argv, "bcvhnM:", options, NULL)) != -1) {
 		switch (c) {
 			case 'b':
 				binary = 1;
 				break;
 			case 'c':
 				counters = 1;
 				break;
 			case 'h':
 				print_usage("ip6tables-restore",
 					    NETFILTER_VERSION);
 				break;
 			case 'n':
 				noflush = 1;
 				break;
 			case 'M':
 				modprobe = optarg;
 				break;
 		}
 	}

 	if (optind == argc - 1) {
 		in = fopen(argv[optind], "r");
 		if (!in) {
 			fprintf(stderr, "Can't open %s: %s", argv[optind],
 				strerror(errno));
 			exit(1);
 		}
 	}
 	else if (optind < argc) {
 		fprintf(stderr, "Unknown arguments found on commandline");
 		exit(1);
 	}
 	else in = stdin;

 	/* Grab standard input. */
 	while (fgets(buffer, sizeof(buffer), in)) {
 		int ret;

 		line++;
 		if (buffer[0] == '\n') continue;
 		else if (buffer[0] == '#') {
 			if (verbose) fputs(buffer, stdout);
 			continue;
 		} else if (strcmp(buffer, "COMMIT\n") == 0) {
 			DEBUGP("Calling commit\n");
 			ret = ip6tc_commit(&handle);
 		} else if (buffer[0] == '*') {
 			/* New table */
 			char *table;

 			table = strtok(buffer+1, " \t\n");
 			DEBUGP("line %u, table '%s'\n", line, table);
 			if (!table) {
 				exit_error(PARAMETER_PROBLEM,
 					"%s: line %u table name invalid\n",
 					program_name, line);
 				exit(1);
 			}
 			strncpy(curtable, table, IP6T_TABLE_MAXNAMELEN);

 			handle = create_handle(table, modprobe);
 			if (noflush == 0) {
 				DEBUGP("Cleaning all chains of table '%s'\n",
 					table);
 				for_each_chain(flush_entries, verbose, 1,
 						&handle);

 				DEBUGP("Deleting all user-defined chains "
 				       "of table '%s'\n", table);
 				for_each_chain(delete_chain, verbose, 0,
 						&handle) ;
 			}

 			ret = 1;

 		} else if (buffer[0] == ':') {
 			/* New chain. */
 			char *policy, *chain;

 			chain = strtok(buffer+1, " \t\n");
 			DEBUGP("line %u, chain '%s'\n", line, chain);
 			if (!chain) {
 				exit_error(PARAMETER_PROBLEM,
 					   "%s: line %u chain name invalid\n",
 					   program_name, line);
 				exit(1);
 			}

 			if (!ip6tc_builtin(chain, handle)) {
 				DEBUGP("Creating new chain '%s'\n", curchain);
 				if (!ip6tc_create_chain(chain, &handle))
                                         exit_error(PARAMETER_PROBLEM,
                                                    "error creating chain "
                                                    "'%s':%s\n", chain,
                                                    strerror(errno));
 			}

 			policy = strtok(NULL, " \t\n");
 			DEBUGP("line %u, policy '%s'\n", line, policy);
 			if (!policy) {
 				exit_error(PARAMETER_PROBLEM,
 					   "%s: line %u policy invalid\n",
 					   program_name, line);
 				exit(1);
 			}

 			if (strcmp(policy, "-") != 0) {
 				struct ip6t_counters count;

 				if (counters) {
 					char *ctrs;
 					ctrs = strtok(NULL, " \t\n");

 					parse_counters(ctrs, &count);

 				} else {
 					memset(&count, 0,
 					       sizeof(struct ip6t_counters));
 				}

 				DEBUGP("Setting policy of chain %s to %s\n",
 					chain, policy);

 				if (!ip6tc_set_policy(chain, policy, &count,
 						     &handle))
 					exit_error(OTHER_PROBLEM,
 						"Can't set policy `%s'"
 						" on `%s' line %u: %s\n",
 						chain, policy, line,
 						ip6tc_strerror(errno));
 			}

 			ret = 1;

 		} else {
 			int a;
 			char *ptr = buffer;
 			char *pcnt = NULL;
 			char *bcnt = NULL;
                         char *parsestart;

                         /* the parser */
                         char *param_start, *curchar;
                         int quote_open;

                         /* reset the newargv */
                         newargc = 0;

 			if (buffer[0] == '[') {
                                 /* we have counters in our input */
 				ptr = strchr(buffer, ']');
 				if (!ptr)
 					exit_error(PARAMETER_PROBLEM,
 						   "Bad line %u: need ]\n",
 						   line);

 				pcnt = strtok(buffer+1, ":");
                                 if (!pcnt)
                                         exit_error(PARAMETER_PROBLEM,
                                                    "Bad line %u: need :\n",
                                                    line);

 				bcnt = strtok(NULL, "]");
                                 if (!bcnt)
                                         exit_error(PARAMETER_PROBLEM,
                                                    "Bad line %u: need ]\n",
                                                    line);

                                 /* start command parsing after counter */
                                 parsestart = ptr + 1;
                         } else {
                                 /* start command parsing at start of line */
                                 parsestart = buffer;
                         }

                         add_argv(argv[0]);
                         add_argv("-t");
                         add_argv((char *) &curtable);

 /* IP6TABLES doesn't support this
 			if (counters && pcnt && bcnt) {
 				newargv[5] = "--set-counters";
 				newargv[6] = (char *) pcnt;
 				newargv[7] = (char *) bcnt;
 			}
 */

                         /* After fighting with strtok enough, here's now
                          * a 'real' parser. According to Rusty I'm now no
                          * longer a real hacker, but I can live with that */

                         quote_open = 0;
                         param_start = parsestart;

                         for (curchar = parsestart; *curchar; curchar++) {
                                 if (*curchar == '"') {
                                         if (quote_open) {
                                                 quote_open = 0;
                                                 *curchar = ' ';
                                         } else {
                                                 quote_open = 1;
                                                 param_start++;
                                         }
                                 }
                                 if (*curchar == ' '
                                     || *curchar == '\t'
                                     || * curchar == '\n') {
                                         char param_buffer[1024];
                                         int param_len = curchar-param_start;

                                         if (quote_open)
                                                 continue;

                                         if (!param_len) {
                                                 /* two spaces? */
                                                 param_start++;
                                                 continue;
                                         }

                                         /* end of one parameter */
                                         strncpy(param_buffer, param_start,
                                                 param_len);
                                         *(param_buffer+param_len) = '\0';

 					if (!strncmp(param_buffer, "-t", 3)) {
 						exit_error(PARAMETER_PROBLEM,
 						   "Line %u seems to have a "
 						   "-t table option.\n", line);
 						exit(1);
 					}

                                         add_argv(param_buffer);
                                         param_start += param_len + 1;
                                 } else {
                                         /* regular character, skip */
                                 }
                         }

 			DEBUGP("calling do_command6(%u, argv, &%s, handle):\n",
 					newargc, curtable);

 			for (a = 0; a <= newargc; a++)
 				DEBUGP("argv[%u]: %s\n", a, newargv[a]);

 			ret = do_command6(newargc, newargv,
                                           &newargv[2], &handle);

                         free_argv();
 		}
 		if (!ret) {
 			fprintf(stderr, "%s: line %u failed\n",
 					program_name, line);
 			exit(1);
 		}
 	}

 	return 0;
 }
	/* Code to restore the iptables state, from file by ip6tables-save.
	* Author: Andras Kis-Szabo <kisza@sch.bme.hu>
	*
	* based on iptables-restore
	* Authors:
	* Harald Welte <laforge@gnumonks.org>
	* Rusty Russell <rusty@linuxcare.com.au>
	*
	*/

	#include <getopt.h>
	#include <sys/errno.h>
	#include <string.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include "ip6tables.h"
	#include "libiptc/libip6tc.h"

	#ifdef DEBUG
	#define DEBUGP(x, args...) fprintf(stderr, x, ## args)
	#else
	#define DEBUGP(x, args...)
	#endif

	extern int for_each_chain(int (fn)(const ip6t_chainlabel, int, ip6tc_handle_t ), int verbose, int builtinstoo, ip6tc_handle_t *handle);
	extern int flush_entries(const ip6t_chainlabel chain, int verbose, ip6tc_handle_t *handle);
	extern int delete_chain(const ip6t_chainlabel chain, int verbose, ip6tc_handle_t *handle);

	static int binary = 0, counters = 0, verbose = 0, noflush = 0;

	/* Keeping track of external matches and targets. */
	static struct option options[] = {
	{ "binary", 0, 0, 'b' },
	{ "counters", 0, 0, 'c' },
	/* { "verbose", 1, 0, 'v' }, */
	{ "help", 0, 0, 'h' },
	{ "noflush", 0, 0, 'n'},
	{ "modprobe", 1, 0, 'M'},
	{ 0 }
	};

	static void print_usage(const char name, const char version) __attribute__((noreturn));

	static void print_usage(const char name, const char version)
	{
	fprintf(stderr, "Usage: %s [-b] [-c] [-v] [-h]\n"
	" [ --binary ]\n"
	" [ --counters ]\n"
	" [ --verbose ]\n"
	" [ --help ]\n"
	" [ --noflush ]\n"
	" [ --modprobe=<command>]\n", name);

	exit(1);
	}

	ip6tc_handle_t create_handle(const char tablename, const char modprobe)
	{
	ip6tc_handle_t handle;

	handle = ip6tc_init(tablename);

	if (!handle) {
	/* try to insmod the module if iptc_init failed */
	ip6tables_insmod("ip6_tables", modprobe);
	handle = ip6tc_init(tablename);
	}

	if (!handle) {
	exit_error(PARAMETER_PROBLEM, "%s: unable to initialize"
	"table '%s'\n", program_name, tablename);
	exit(1);
	}
	return handle;
	}

	int parse_counters(char string, struct ip6t_counters ctr)
	{
	return (sscanf(string, "[%llu:%llu]", &ctr->pcnt, &ctr->bcnt) == 2);
	}

	/* global new argv and argc */
	static char *newargv[255];
	static int newargc;

	/* function adding one argument to newargv, updating newargc
	* * returns true if argument added, false otherwise */
	static int add_argv(char *what) {
	if (what && ((newargc + 1) < sizeof(newargv)/sizeof(char *))) {
	newargv[newargc] = strdup(what);
	newargc++;
	return 1;
	} else
	return 0;
	}

	static void free_argv(void) {
	int i;

	for (i = 0; i < newargc; i++)
	free(newargv[i]);
	}

	int main(int argc, char *argv[])
	{
	ip6tc_handle_t handle;
	char buffer[10240];
	unsigned int line = 0;
	int c;
	char curtable[IP6T_TABLE_MAXNAMELEN + 1];
	FILE *in;
	const char *modprobe = 0;

	program_name = "ip6tables-restore";
	program_version = NETFILTER_VERSION;

	#ifdef NO_SHARED_LIBS
	init_extensions();
	#endif

	while ((c = getopt_long(argc, argv, "bcvhnM:", options, NULL)) != -1) {
	switch (c) {
	case 'b':
	binary = 1;
	break;
	case 'c':
	counters = 1;
	break;
	case 'h':
	print_usage("ip6tables-restore",
	NETFILTER_VERSION);
	break;
	case 'n':
	noflush = 1;
	break;
	case 'M':
	modprobe = optarg;
	break;
	}
	}

	if (optind == argc - 1) {
	in = fopen(argv[optind], "r");
	if (!in) {
	fprintf(stderr, "Can't open %s: %s", argv[optind],
	strerror(errno));
	exit(1);
	}
	}
	else if (optind < argc) {
	fprintf(stderr, "Unknown arguments found on commandline");
	exit(1);
	}
	else in = stdin;

	/* Grab standard input. */
	while (fgets(buffer, sizeof(buffer), in)) {
	int ret;

	line++;
	if (buffer[0] == '\n') continue;
	else if (buffer[0] == '#') {
	if (verbose) fputs(buffer, stdout);
	continue;
	} else if (strcmp(buffer, "COMMIT\n") == 0) {
	DEBUGP("Calling commit\n");
	ret = ip6tc_commit(&handle);
	} else if (buffer[0] == '*') {
	/* New table */
	char *table;

	table = strtok(buffer+1, " \t\n");
	DEBUGP("line %u, table '%s'\n", line, table);
	if (!table) {
	exit_error(PARAMETER_PROBLEM,
	"%s: line %u table name invalid\n",
	program_name, line);
	exit(1);
	}
	strncpy(curtable, table, IP6T_TABLE_MAXNAMELEN);

	handle = create_handle(table, modprobe);
	if (noflush == 0) {
	DEBUGP("Cleaning all chains of table '%s'\n",
	table);
	for_each_chain(flush_entries, verbose, 1,
	&handle);

	DEBUGP("Deleting all user-defined chains "
	"of table '%s'\n", table);
	for_each_chain(delete_chain, verbose, 0,
	&handle) ;
	}

	ret = 1;

	} else if (buffer[0] == ':') {
	/* New chain. */
	char policy, chain;

	chain = strtok(buffer+1, " \t\n");
	DEBUGP("line %u, chain '%s'\n", line, chain);
	if (!chain) {
	exit_error(PARAMETER_PROBLEM,
	"%s: line %u chain name invalid\n",
	program_name, line);
	exit(1);
	}

	if (!ip6tc_builtin(chain, handle)) {
	DEBUGP("Creating new chain '%s'\n", curchain);
	if (!ip6tc_create_chain(chain, &handle))
	exit_error(PARAMETER_PROBLEM,
	"error creating chain "
	"'%s':%s\n", chain,
	strerror(errno));
	}

	policy = strtok(NULL, " \t\n");
	DEBUGP("line %u, policy '%s'\n", line, policy);
	if (!policy) {
	exit_error(PARAMETER_PROBLEM,
	"%s: line %u policy invalid\n",
	program_name, line);
	exit(1);
	}

	if (strcmp(policy, "-") != 0) {
	struct ip6t_counters count;

	if (counters) {
	char *ctrs;
	ctrs = strtok(NULL, " \t\n");

	parse_counters(ctrs, &count);

	} else {
	memset(&count, 0,
	sizeof(struct ip6t_counters));
	}

	DEBUGP("Setting policy of chain %s to %s\n",
	chain, policy);

	if (!ip6tc_set_policy(chain, policy, &count,
	&handle))
	exit_error(OTHER_PROBLEM,
	"Can't set policy `%s'"
	" on `%s' line %u: %s\n",
	chain, policy, line,
	ip6tc_strerror(errno));
	}

	ret = 1;

	} else {
	int a;
	char *ptr = buffer;
	char *pcnt = NULL;
	char *bcnt = NULL;
	char *parsestart;

	/* the parser */
	char param_start, curchar;
	int quote_open;

	/* reset the newargv */
	newargc = 0;

	if (buffer[0] == '[') {
	/* we have counters in our input */
	ptr = strchr(buffer, ']');
	if (!ptr)
	exit_error(PARAMETER_PROBLEM,
	"Bad line %u: need ]\n",
	line);

	pcnt = strtok(buffer+1, ":");
	if (!pcnt)
	exit_error(PARAMETER_PROBLEM,
	"Bad line %u: need :\n",
	line);

	bcnt = strtok(NULL, "]");
	if (!bcnt)
	exit_error(PARAMETER_PROBLEM,
	"Bad line %u: need ]\n",
	line);

	/* start command parsing after counter */
	parsestart = ptr + 1;
	} else {
	/* start command parsing at start of line */
	parsestart = buffer;
	}

	add_argv(argv[0]);
	add_argv("-t");
	add_argv((char *) &curtable);

	/* IP6TABLES doesn't support this
	if (counters && pcnt && bcnt) {
	newargv[5] = "--set-counters";
	newargv[6] = (char *) pcnt;
	newargv[7] = (char *) bcnt;
	}
	*/

	/* After fighting with strtok enough, here's now
	* a 'real' parser. According to Rusty I'm now no
	* longer a real hacker, but I can live with that */

	quote_open = 0;
	param_start = parsestart;

	for (curchar = parsestart; *curchar; curchar++) {
	if (*curchar == '"') {
	if (quote_open) {
	quote_open = 0;
	*curchar = ' ';
	} else {
	quote_open = 1;
	param_start++;
	}
	}
	if (*curchar == ' '
	\|\| *curchar == '\t'
	\|\| * curchar == '\n') {
	char param_buffer[1024];
	int param_len = curchar-param_start;

	if (quote_open)
	continue;

	if (!param_len) {
	/* two spaces? */
	param_start++;
	continue;
	}

	/* end of one parameter */
	strncpy(param_buffer, param_start,
	param_len);
	*(param_buffer+param_len) = '\0';

	if (!strncmp(param_buffer, "-t", 3)) {
	exit_error(PARAMETER_PROBLEM,
	"Line %u seems to have a "
	"-t table option.\n", line);
	exit(1);
	}

	add_argv(param_buffer);
	param_start += param_len + 1;
	} else {
	/* regular character, skip */
	}
	}

	DEBUGP("calling do_command6(%u, argv, &%s, handle):\n",
	newargc, curtable);

	for (a = 0; a <= newargc; a++)
	DEBUGP("argv[%u]: %s\n", a, newargv[a]);

	ret = do_command6(newargc, newargv,
	&newargv[2], &handle);

	free_argv();
	}
	if (!ret) {
	fprintf(stderr, "%s: line %u failed\n",
	program_name, line);
	exit(1);
	}
	}

	return 0;
	}