András Kis-Szabó | 2f52379 | 2001-02-27 09:59:48 +0000 | [diff] [blame] | 1 | /* Code to save the ip6tables state, in human readable-form. */ |
| 2 | /* Author: Andras Kis-Szabo <kisza@sch.bme.hu> |
| 3 | * Original code: iptables-save |
| 4 | * Authors: Paul 'Rusty' Russel <rusty@linuxcare.com.au> and |
Max Kellermann | 5b76f68 | 2008-01-29 13:42:48 +0000 | [diff] [blame] | 5 | * Harald Welte <laforge@gnumonks.org> |
András Kis-Szabó | 0c4188f | 2002-08-14 11:40:41 +0000 | [diff] [blame] | 6 | * This code is distributed under the terms of GNU GPL v2 |
András Kis-Szabó | 2f52379 | 2001-02-27 09:59:48 +0000 | [diff] [blame] | 7 | */ |
| 8 | #include <getopt.h> |
| 9 | #include <sys/errno.h> |
| 10 | #include <stdio.h> |
| 11 | #include <fcntl.h> |
| 12 | #include <stdlib.h> |
| 13 | #include <string.h> |
András Kis-Szabó | 2f52379 | 2001-02-27 09:59:48 +0000 | [diff] [blame] | 14 | #include <time.h> |
| 15 | #include <netdb.h> |
| 16 | #include <arpa/inet.h> |
| 17 | #include "libiptc/libip6tc.h" |
| 18 | #include "ip6tables.h" |
Jan Engelhardt | 33690a1 | 2008-02-11 00:54:00 +0100 | [diff] [blame] | 19 | #include "ip6tables-multi.h" |
András Kis-Szabó | 2f52379 | 2001-02-27 09:59:48 +0000 | [diff] [blame] | 20 | |
Mike Frysinger | 5a26b5f | 2007-12-19 14:51:17 +0000 | [diff] [blame] | 21 | #ifndef NO_SHARED_LIBS |
| 22 | #include <dlfcn.h> |
| 23 | #endif |
| 24 | |
Jan Engelhardt | dbb7754 | 2008-02-11 00:33:30 +0100 | [diff] [blame] | 25 | static int show_binary = 0, show_counters = 0; |
András Kis-Szabó | 2f52379 | 2001-02-27 09:59:48 +0000 | [diff] [blame] | 26 | |
Gáspár Lajos | 7bc3cb7 | 2008-03-27 08:20:39 +0100 | [diff] [blame] | 27 | static const struct option options[] = { |
| 28 | {.name = "binary", .has_arg = false, .val = 'b'}, |
| 29 | {.name = "counters", .has_arg = false, .val = 'c'}, |
| 30 | {.name = "dump", .has_arg = false, .val = 'd'}, |
| 31 | {.name = "table", .has_arg = true, .val = 't'}, |
Jan Engelhardt | fbb5639 | 2009-03-19 16:57:35 +0100 | [diff] [blame] | 32 | {.name = "modprobe", .has_arg = true, .val = 'M'}, |
Gáspár Lajos | 7bc3cb7 | 2008-03-27 08:20:39 +0100 | [diff] [blame] | 33 | {NULL}, |
András Kis-Szabó | 2f52379 | 2001-02-27 09:59:48 +0000 | [diff] [blame] | 34 | }; |
| 35 | |
András Kis-Szabó | 2f52379 | 2001-02-27 09:59:48 +0000 | [diff] [blame] | 36 | |
András Kis-Szabó | 2f52379 | 2001-02-27 09:59:48 +0000 | [diff] [blame] | 37 | /* Debugging prototype. */ |
| 38 | static int for_each_table(int (*func)(const char *tablename)) |
| 39 | { |
Max Kellermann | 5b76f68 | 2008-01-29 13:42:48 +0000 | [diff] [blame] | 40 | int ret = 1; |
András Kis-Szabó | 2f52379 | 2001-02-27 09:59:48 +0000 | [diff] [blame] | 41 | FILE *procfile = NULL; |
| 42 | char tablename[IP6T_TABLE_MAXNAMELEN+1]; |
| 43 | |
| 44 | procfile = fopen("/proc/net/ip6_tables_names", "r"); |
| 45 | if (!procfile) |
Jan Engelhardt | fbb5639 | 2009-03-19 16:57:35 +0100 | [diff] [blame] | 46 | return ret; |
András Kis-Szabó | 2f52379 | 2001-02-27 09:59:48 +0000 | [diff] [blame] | 47 | |
| 48 | while (fgets(tablename, sizeof(tablename), procfile)) { |
| 49 | if (tablename[strlen(tablename) - 1] != '\n') |
Jan Engelhardt | 1829ed4 | 2009-02-21 03:29:44 +0100 | [diff] [blame] | 50 | xtables_error(OTHER_PROBLEM, |
András Kis-Szabó | 2f52379 | 2001-02-27 09:59:48 +0000 | [diff] [blame] | 51 | "Badly formed tablename `%s'\n", |
| 52 | tablename); |
| 53 | tablename[strlen(tablename) - 1] = '\0'; |
| 54 | ret &= func(tablename); |
| 55 | } |
| 56 | |
Jan Engelhardt | f1afcc8 | 2009-06-10 13:52:58 +0200 | [diff] [blame] | 57 | fclose(procfile); |
András Kis-Szabó | 2f52379 | 2001-02-27 09:59:48 +0000 | [diff] [blame] | 58 | return ret; |
| 59 | } |
Max Kellermann | 5b76f68 | 2008-01-29 13:42:48 +0000 | [diff] [blame] | 60 | |
András Kis-Szabó | 2f52379 | 2001-02-27 09:59:48 +0000 | [diff] [blame] | 61 | |
| 62 | static int do_output(const char *tablename) |
| 63 | { |
Jan Engelhardt | fd18731 | 2008-11-10 16:59:27 +0100 | [diff] [blame] | 64 | struct ip6tc_handle *h; |
András Kis-Szabó | 2f52379 | 2001-02-27 09:59:48 +0000 | [diff] [blame] | 65 | const char *chain = NULL; |
| 66 | |
| 67 | if (!tablename) |
| 68 | return for_each_table(&do_output); |
| 69 | |
| 70 | h = ip6tc_init(tablename); |
Jan Engelhardt | fbb5639 | 2009-03-19 16:57:35 +0100 | [diff] [blame] | 71 | if (h == NULL) { |
| 72 | xtables_load_ko(xtables_modprobe_program, false); |
| 73 | h = ip6tc_init(tablename); |
| 74 | } |
András Kis-Szabó | 2f52379 | 2001-02-27 09:59:48 +0000 | [diff] [blame] | 75 | if (!h) |
Jan Engelhardt | 1829ed4 | 2009-02-21 03:29:44 +0100 | [diff] [blame] | 76 | xtables_error(OTHER_PROBLEM, "Cannot initialize: %s\n", |
András Kis-Szabó | 2f52379 | 2001-02-27 09:59:48 +0000 | [diff] [blame] | 77 | ip6tc_strerror(errno)); |
| 78 | |
Jan Engelhardt | dbb7754 | 2008-02-11 00:33:30 +0100 | [diff] [blame] | 79 | if (!show_binary) { |
András Kis-Szabó | 2f52379 | 2001-02-27 09:59:48 +0000 | [diff] [blame] | 80 | time_t now = time(NULL); |
| 81 | |
| 82 | printf("# Generated by ip6tables-save v%s on %s", |
Jan Engelhardt | dacafa5 | 2009-01-27 20:56:23 +0100 | [diff] [blame] | 83 | IPTABLES_VERSION, ctime(&now)); |
András Kis-Szabó | 2f52379 | 2001-02-27 09:59:48 +0000 | [diff] [blame] | 84 | printf("*%s\n", tablename); |
| 85 | |
Max Kellermann | 5b76f68 | 2008-01-29 13:42:48 +0000 | [diff] [blame] | 86 | /* Dump out chain names first, |
Harald Welte | 885c6eb | 2001-10-04 08:30:46 +0000 | [diff] [blame] | 87 | * thereby preventing dependency conflicts */ |
Jan Engelhardt | 1c9015b | 2008-11-10 17:00:41 +0100 | [diff] [blame] | 88 | for (chain = ip6tc_first_chain(h); |
András Kis-Szabó | 2f52379 | 2001-02-27 09:59:48 +0000 | [diff] [blame] | 89 | chain; |
Jan Engelhardt | 1c9015b | 2008-11-10 17:00:41 +0100 | [diff] [blame] | 90 | chain = ip6tc_next_chain(h)) { |
András Kis-Szabó | 2f52379 | 2001-02-27 09:59:48 +0000 | [diff] [blame] | 91 | |
| 92 | printf(":%s ", chain); |
| 93 | if (ip6tc_builtin(chain, h)) { |
| 94 | struct ip6t_counters count; |
| 95 | printf("%s ", |
Jan Engelhardt | 1c9015b | 2008-11-10 17:00:41 +0100 | [diff] [blame] | 96 | ip6tc_get_policy(chain, &count, h)); |
Martin Josefsson | a28d495 | 2004-05-26 16:04:48 +0000 | [diff] [blame] | 97 | printf("[%llu:%llu]\n", (unsigned long long)count.pcnt, (unsigned long long)count.bcnt); |
András Kis-Szabó | 2f52379 | 2001-02-27 09:59:48 +0000 | [diff] [blame] | 98 | } else { |
| 99 | printf("- [0:0]\n"); |
| 100 | } |
Harald Welte | 885c6eb | 2001-10-04 08:30:46 +0000 | [diff] [blame] | 101 | } |
| 102 | |
András Kis-Szabó | 97fd91a | 2002-03-03 09:44:31 +0000 | [diff] [blame] | 103 | |
Jan Engelhardt | 1c9015b | 2008-11-10 17:00:41 +0100 | [diff] [blame] | 104 | for (chain = ip6tc_first_chain(h); |
Harald Welte | 885c6eb | 2001-10-04 08:30:46 +0000 | [diff] [blame] | 105 | chain; |
Jan Engelhardt | 1c9015b | 2008-11-10 17:00:41 +0100 | [diff] [blame] | 106 | chain = ip6tc_next_chain(h)) { |
András Kis-Szabó | 97fd91a | 2002-03-03 09:44:31 +0000 | [diff] [blame] | 107 | const struct ip6t_entry *e; |
András Kis-Szabó | 2f52379 | 2001-02-27 09:59:48 +0000 | [diff] [blame] | 108 | |
| 109 | /* Dump out rules */ |
Jan Engelhardt | 1c9015b | 2008-11-10 17:00:41 +0100 | [diff] [blame] | 110 | e = ip6tc_first_rule(chain, h); |
András Kis-Szabó | 2f52379 | 2001-02-27 09:59:48 +0000 | [diff] [blame] | 111 | while(e) { |
Jan Engelhardt | 1c9015b | 2008-11-10 17:00:41 +0100 | [diff] [blame] | 112 | print_rule(e, h, chain, show_counters); |
| 113 | e = ip6tc_next_rule(e, h); |
András Kis-Szabó | 2f52379 | 2001-02-27 09:59:48 +0000 | [diff] [blame] | 114 | } |
| 115 | } |
| 116 | |
| 117 | now = time(NULL); |
| 118 | printf("COMMIT\n"); |
| 119 | printf("# Completed on %s", ctime(&now)); |
| 120 | } else { |
| 121 | /* Binary, huh? OK. */ |
Jan Engelhardt | 1829ed4 | 2009-02-21 03:29:44 +0100 | [diff] [blame] | 122 | xtables_error(OTHER_PROBLEM, "Binary NYI\n"); |
András Kis-Szabó | 2f52379 | 2001-02-27 09:59:48 +0000 | [diff] [blame] | 123 | } |
| 124 | |
Jan Engelhardt | 1c9015b | 2008-11-10 17:00:41 +0100 | [diff] [blame] | 125 | ip6tc_free(h); |
Martin Josefsson | 841e4ae | 2003-05-02 15:30:11 +0000 | [diff] [blame] | 126 | |
András Kis-Szabó | 2f52379 | 2001-02-27 09:59:48 +0000 | [diff] [blame] | 127 | return 1; |
| 128 | } |
| 129 | |
| 130 | /* Format: |
| 131 | * :Chain name POLICY packets bytes |
| 132 | * rule |
| 133 | */ |
Hann-Huei Chiou | 4bc4833 | 2007-10-23 14:22:34 +0000 | [diff] [blame] | 134 | #ifdef IPTABLES_MULTI |
| 135 | int ip6tables_save_main(int argc, char *argv[]) |
| 136 | #else |
András Kis-Szabó | 2f52379 | 2001-02-27 09:59:48 +0000 | [diff] [blame] | 137 | int main(int argc, char *argv[]) |
Hann-Huei Chiou | 4bc4833 | 2007-10-23 14:22:34 +0000 | [diff] [blame] | 138 | #endif |
András Kis-Szabó | 2f52379 | 2001-02-27 09:59:48 +0000 | [diff] [blame] | 139 | { |
| 140 | const char *tablename = NULL; |
| 141 | int c; |
| 142 | |
Jamal Hadi Salim | 617d3d1 | 2009-02-11 16:28:31 -0500 | [diff] [blame] | 143 | ip6tables_globals.program_name = "ip6tables-save"; |
Jamal Hadi Salim | 7e4db2f | 2009-02-13 09:14:17 -0500 | [diff] [blame] | 144 | c = xtables_init_all(&ip6tables_globals, NFPROTO_IPV6); |
| 145 | if (c < 0) { |
| 146 | fprintf(stderr, "%s/%s Failed to initialize xtables\n", |
| 147 | ip6tables_globals.program_name, |
| 148 | ip6tables_globals.program_version); |
| 149 | exit(1); |
| 150 | } |
Jan Engelhardt | b79ec69 | 2009-07-23 17:41:21 +0200 | [diff] [blame] | 151 | #if defined(ALL_INCLUSIVE) || defined(NO_SHARED_LIBS) |
Harald Welte | 3efb6ea | 2001-08-06 18:50:21 +0000 | [diff] [blame] | 152 | init_extensions(); |
| 153 | #endif |
| 154 | |
András Kis-Szabó | 97fd91a | 2002-03-03 09:44:31 +0000 | [diff] [blame] | 155 | while ((c = getopt_long(argc, argv, "bcdt:", options, NULL)) != -1) { |
András Kis-Szabó | 2f52379 | 2001-02-27 09:59:48 +0000 | [diff] [blame] | 156 | switch (c) { |
| 157 | case 'b': |
Jan Engelhardt | dbb7754 | 2008-02-11 00:33:30 +0100 | [diff] [blame] | 158 | show_binary = 1; |
András Kis-Szabó | 2f52379 | 2001-02-27 09:59:48 +0000 | [diff] [blame] | 159 | break; |
| 160 | |
| 161 | case 'c': |
Jan Engelhardt | dbb7754 | 2008-02-11 00:33:30 +0100 | [diff] [blame] | 162 | show_counters = 1; |
András Kis-Szabó | 2f52379 | 2001-02-27 09:59:48 +0000 | [diff] [blame] | 163 | break; |
| 164 | |
| 165 | case 't': |
| 166 | /* Select specific table. */ |
| 167 | tablename = optarg; |
| 168 | break; |
Jan Engelhardt | fbb5639 | 2009-03-19 16:57:35 +0100 | [diff] [blame] | 169 | case 'M': |
| 170 | xtables_modprobe_program = optarg; |
| 171 | break; |
András Kis-Szabó | 2f52379 | 2001-02-27 09:59:48 +0000 | [diff] [blame] | 172 | case 'd': |
| 173 | do_output(tablename); |
| 174 | exit(0); |
| 175 | } |
| 176 | } |
| 177 | |
| 178 | if (optind < argc) { |
Pavel Rusnak | 972af09 | 2007-05-10 15:00:39 +0000 | [diff] [blame] | 179 | fprintf(stderr, "Unknown arguments found on commandline\n"); |
András Kis-Szabó | 2f52379 | 2001-02-27 09:59:48 +0000 | [diff] [blame] | 180 | exit(1); |
| 181 | } |
| 182 | |
| 183 | return !do_output(tablename); |
| 184 | } |