Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 1 | /* Code to save the iptables state, in human readable-form. */ |
Harald Welte | 10a907f | 2002-08-07 09:07:41 +0000 | [diff] [blame] | 2 | /* (C) 1999 by Paul 'Rusty' Russell <rusty@rustcorp.com.au> and |
| 3 | * (C) 2000-2002 by Harald Welte <laforge@gnumonks.org> |
| 4 | * |
| 5 | * This code is distributed under the terms of GNU GPL v2 |
| 6 | * |
Harald Welte | ae1ff9f | 2000-12-01 14:26:20 +0000 | [diff] [blame] | 7 | */ |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 8 | #include <getopt.h> |
| 9 | #include <sys/errno.h> |
| 10 | #include <stdio.h> |
Harald Welte | ae1ff9f | 2000-12-01 14:26:20 +0000 | [diff] [blame] | 11 | #include <fcntl.h> |
| 12 | #include <stdlib.h> |
| 13 | #include <string.h> |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 14 | #include <time.h> |
Harald Welte | d8ac967 | 2004-04-15 10:10:19 +0000 | [diff] [blame] | 15 | #include <netdb.h> |
Rusty Russell | b1f69be | 2000-08-27 07:42:54 +0000 | [diff] [blame] | 16 | #include "libiptc/libiptc.h" |
| 17 | #include "iptables.h" |
Jan Engelhardt | 33690a1 | 2008-02-11 00:54:00 +0100 | [diff] [blame] | 18 | #include "iptables-multi.h" |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 19 | |
Mike Frysinger | 5a26b5f | 2007-12-19 14:51:17 +0000 | [diff] [blame] | 20 | #ifndef NO_SHARED_LIBS |
| 21 | #include <dlfcn.h> |
| 22 | #endif |
| 23 | |
Jan Engelhardt | dbb7754 | 2008-02-11 00:33:30 +0100 | [diff] [blame] | 24 | static int show_binary = 0, show_counters = 0; |
Rusty Russell | a8f033e | 2000-07-30 01:43:01 +0000 | [diff] [blame] | 25 | |
Gáspár Lajos | 7bc3cb7 | 2008-03-27 08:20:39 +0100 | [diff] [blame] | 26 | static const struct option options[] = { |
| 27 | {.name = "binary", .has_arg = false, .val = 'b'}, |
| 28 | {.name = "counters", .has_arg = false, .val = 'c'}, |
| 29 | {.name = "dump", .has_arg = false, .val = 'd'}, |
| 30 | {.name = "table", .has_arg = true, .val = 't'}, |
Jan Engelhardt | fbb5639 | 2009-03-19 16:57:35 +0100 | [diff] [blame^] | 31 | {.name = "modprobe", .has_arg = true, .val = 'M'}, |
Gáspár Lajos | 7bc3cb7 | 2008-03-27 08:20:39 +0100 | [diff] [blame] | 32 | {NULL}, |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 33 | }; |
| 34 | |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 35 | /* Debugging prototype. */ |
Rusty Russell | a8f033e | 2000-07-30 01:43:01 +0000 | [diff] [blame] | 36 | static int for_each_table(int (*func)(const char *tablename)) |
| 37 | { |
Max Kellermann | 5b76f68 | 2008-01-29 13:42:48 +0000 | [diff] [blame] | 38 | int ret = 1; |
Harald Welte | ae1ff9f | 2000-12-01 14:26:20 +0000 | [diff] [blame] | 39 | FILE *procfile = NULL; |
Rusty Russell | a8f033e | 2000-07-30 01:43:01 +0000 | [diff] [blame] | 40 | char tablename[IPT_TABLE_MAXNAMELEN+1]; |
| 41 | |
Harald Welte | ae1ff9f | 2000-12-01 14:26:20 +0000 | [diff] [blame] | 42 | procfile = fopen("/proc/net/ip_tables_names", "r"); |
Rusty Russell | a8f033e | 2000-07-30 01:43:01 +0000 | [diff] [blame] | 43 | if (!procfile) |
Jan Engelhardt | fbb5639 | 2009-03-19 16:57:35 +0100 | [diff] [blame^] | 44 | return ret; |
Rusty Russell | a8f033e | 2000-07-30 01:43:01 +0000 | [diff] [blame] | 45 | |
| 46 | while (fgets(tablename, sizeof(tablename), procfile)) { |
| 47 | if (tablename[strlen(tablename) - 1] != '\n') |
Jan Engelhardt | 1829ed4 | 2009-02-21 03:29:44 +0100 | [diff] [blame] | 48 | xtables_error(OTHER_PROBLEM, |
Rusty Russell | a8f033e | 2000-07-30 01:43:01 +0000 | [diff] [blame] | 49 | "Badly formed tablename `%s'\n", |
| 50 | tablename); |
| 51 | tablename[strlen(tablename) - 1] = '\0'; |
| 52 | ret &= func(tablename); |
| 53 | } |
| 54 | |
| 55 | return ret; |
| 56 | } |
Max Kellermann | 5b76f68 | 2008-01-29 13:42:48 +0000 | [diff] [blame] | 57 | |
Rusty Russell | a8f033e | 2000-07-30 01:43:01 +0000 | [diff] [blame] | 58 | |
Rusty Russell | a8f033e | 2000-07-30 01:43:01 +0000 | [diff] [blame] | 59 | static int do_output(const char *tablename) |
| 60 | { |
Jan Engelhardt | fd18731 | 2008-11-10 16:59:27 +0100 | [diff] [blame] | 61 | struct iptc_handle *h; |
Rusty Russell | a8f033e | 2000-07-30 01:43:01 +0000 | [diff] [blame] | 62 | const char *chain = NULL; |
| 63 | |
| 64 | if (!tablename) |
| 65 | return for_each_table(&do_output); |
| 66 | |
| 67 | h = iptc_init(tablename); |
Jan Engelhardt | fbb5639 | 2009-03-19 16:57:35 +0100 | [diff] [blame^] | 68 | if (h == NULL) { |
| 69 | xtables_load_ko(xtables_modprobe_program, false); |
| 70 | h = iptc_init(tablename); |
| 71 | } |
Rusty Russell | a8f033e | 2000-07-30 01:43:01 +0000 | [diff] [blame] | 72 | if (!h) |
Jan Engelhardt | 1829ed4 | 2009-02-21 03:29:44 +0100 | [diff] [blame] | 73 | xtables_error(OTHER_PROBLEM, "Cannot initialize: %s\n", |
Rusty Russell | a8f033e | 2000-07-30 01:43:01 +0000 | [diff] [blame] | 74 | iptc_strerror(errno)); |
| 75 | |
Jan Engelhardt | dbb7754 | 2008-02-11 00:33:30 +0100 | [diff] [blame] | 76 | if (!show_binary) { |
Rusty Russell | a8f033e | 2000-07-30 01:43:01 +0000 | [diff] [blame] | 77 | time_t now = time(NULL); |
| 78 | |
| 79 | printf("# Generated by iptables-save v%s on %s", |
Jan Engelhardt | dacafa5 | 2009-01-27 20:56:23 +0100 | [diff] [blame] | 80 | IPTABLES_VERSION, ctime(&now)); |
Harald Welte | ae1ff9f | 2000-12-01 14:26:20 +0000 | [diff] [blame] | 81 | printf("*%s\n", tablename); |
Rusty Russell | a8f033e | 2000-07-30 01:43:01 +0000 | [diff] [blame] | 82 | |
Max Kellermann | 5b76f68 | 2008-01-29 13:42:48 +0000 | [diff] [blame] | 83 | /* Dump out chain names first, |
Harald Welte | 9f7fa49 | 2001-03-15 15:12:02 +0000 | [diff] [blame] | 84 | * thereby preventing dependency conflicts */ |
Jan Engelhardt | 1c9015b | 2008-11-10 17:00:41 +0100 | [diff] [blame] | 85 | for (chain = iptc_first_chain(h); |
Rusty Russell | a8f033e | 2000-07-30 01:43:01 +0000 | [diff] [blame] | 86 | chain; |
Jan Engelhardt | 1c9015b | 2008-11-10 17:00:41 +0100 | [diff] [blame] | 87 | chain = iptc_next_chain(h)) { |
Max Kellermann | 5b76f68 | 2008-01-29 13:42:48 +0000 | [diff] [blame] | 88 | |
Rusty Russell | a8f033e | 2000-07-30 01:43:01 +0000 | [diff] [blame] | 89 | printf(":%s ", chain); |
Harald Welte | ae1ff9f | 2000-12-01 14:26:20 +0000 | [diff] [blame] | 90 | if (iptc_builtin(chain, h)) { |
Rusty Russell | a8f033e | 2000-07-30 01:43:01 +0000 | [diff] [blame] | 91 | struct ipt_counters count; |
| 92 | printf("%s ", |
Jan Engelhardt | 1c9015b | 2008-11-10 17:00:41 +0100 | [diff] [blame] | 93 | iptc_get_policy(chain, &count, h)); |
Martin Josefsson | a28d495 | 2004-05-26 16:04:48 +0000 | [diff] [blame] | 94 | printf("[%llu:%llu]\n", (unsigned long long)count.pcnt, (unsigned long long)count.bcnt); |
Rusty Russell | a8f033e | 2000-07-30 01:43:01 +0000 | [diff] [blame] | 95 | } else { |
Harald Welte | d8e6563 | 2001-01-05 15:20:07 +0000 | [diff] [blame] | 96 | printf("- [0:0]\n"); |
Rusty Russell | a8f033e | 2000-07-30 01:43:01 +0000 | [diff] [blame] | 97 | } |
Harald Welte | 9f7fa49 | 2001-03-15 15:12:02 +0000 | [diff] [blame] | 98 | } |
Max Kellermann | 5b76f68 | 2008-01-29 13:42:48 +0000 | [diff] [blame] | 99 | |
Harald Welte | 9f7fa49 | 2001-03-15 15:12:02 +0000 | [diff] [blame] | 100 | |
Jan Engelhardt | 1c9015b | 2008-11-10 17:00:41 +0100 | [diff] [blame] | 101 | for (chain = iptc_first_chain(h); |
Harald Welte | 9f7fa49 | 2001-03-15 15:12:02 +0000 | [diff] [blame] | 102 | chain; |
Jan Engelhardt | 1c9015b | 2008-11-10 17:00:41 +0100 | [diff] [blame] | 103 | chain = iptc_next_chain(h)) { |
Harald Welte | 9f7fa49 | 2001-03-15 15:12:02 +0000 | [diff] [blame] | 104 | const struct ipt_entry *e; |
Rusty Russell | a8f033e | 2000-07-30 01:43:01 +0000 | [diff] [blame] | 105 | |
Harald Welte | ae1ff9f | 2000-12-01 14:26:20 +0000 | [diff] [blame] | 106 | /* Dump out rules */ |
Jan Engelhardt | 1c9015b | 2008-11-10 17:00:41 +0100 | [diff] [blame] | 107 | e = iptc_first_rule(chain, h); |
Harald Welte | ae1ff9f | 2000-12-01 14:26:20 +0000 | [diff] [blame] | 108 | while(e) { |
Jan Engelhardt | 1c9015b | 2008-11-10 17:00:41 +0100 | [diff] [blame] | 109 | print_rule(e, h, chain, show_counters); |
| 110 | e = iptc_next_rule(e, h); |
Rusty Russell | a8f033e | 2000-07-30 01:43:01 +0000 | [diff] [blame] | 111 | } |
| 112 | } |
| 113 | |
| 114 | now = time(NULL); |
| 115 | printf("COMMIT\n"); |
| 116 | printf("# Completed on %s", ctime(&now)); |
| 117 | } else { |
| 118 | /* Binary, huh? OK. */ |
Jan Engelhardt | 1829ed4 | 2009-02-21 03:29:44 +0100 | [diff] [blame] | 119 | xtables_error(OTHER_PROBLEM, "Binary NYI\n"); |
Rusty Russell | a8f033e | 2000-07-30 01:43:01 +0000 | [diff] [blame] | 120 | } |
| 121 | |
Jan Engelhardt | 1c9015b | 2008-11-10 17:00:41 +0100 | [diff] [blame] | 122 | iptc_free(h); |
Martin Josefsson | 841e4ae | 2003-05-02 15:30:11 +0000 | [diff] [blame] | 123 | |
Rusty Russell | a8f033e | 2000-07-30 01:43:01 +0000 | [diff] [blame] | 124 | return 1; |
| 125 | } |
| 126 | |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 127 | /* Format: |
| 128 | * :Chain name POLICY packets bytes |
| 129 | * rule |
| 130 | */ |
Bastiaan Bakker | 4e3771f | 2004-06-25 11:18:57 +0000 | [diff] [blame] | 131 | #ifdef IPTABLES_MULTI |
| 132 | int |
| 133 | iptables_save_main(int argc, char *argv[]) |
| 134 | #else |
| 135 | int |
| 136 | main(int argc, char *argv[]) |
| 137 | #endif |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 138 | { |
Rusty Russell | a8f033e | 2000-07-30 01:43:01 +0000 | [diff] [blame] | 139 | const char *tablename = NULL; |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 140 | int c; |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 141 | |
Jamal Hadi Salim | 617d3d1 | 2009-02-11 16:28:31 -0500 | [diff] [blame] | 142 | iptables_globals.program_name = "iptables-save"; |
Jamal Hadi Salim | 7e4db2f | 2009-02-13 09:14:17 -0500 | [diff] [blame] | 143 | c = xtables_init_all(&iptables_globals, NFPROTO_IPV4); |
| 144 | if (c < 0) { |
| 145 | fprintf(stderr, "%s/%s Failed to initialize xtables\n", |
| 146 | iptables_globals.program_name, |
| 147 | iptables_globals.program_version); |
| 148 | exit(1); |
| 149 | } |
Harald Welte | 3efb6ea | 2001-08-06 18:50:21 +0000 | [diff] [blame] | 150 | #ifdef NO_SHARED_LIBS |
| 151 | init_extensions(); |
| 152 | #endif |
| 153 | |
Marc Boucher | 163ad78 | 2001-12-06 15:05:48 +0000 | [diff] [blame] | 154 | while ((c = getopt_long(argc, argv, "bcdt:", options, NULL)) != -1) { |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 155 | switch (c) { |
| 156 | case 'b': |
Jan Engelhardt | dbb7754 | 2008-02-11 00:33:30 +0100 | [diff] [blame] | 157 | show_binary = 1; |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 158 | break; |
| 159 | |
| 160 | case 'c': |
Jan Engelhardt | dbb7754 | 2008-02-11 00:33:30 +0100 | [diff] [blame] | 161 | show_counters = 1; |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 162 | break; |
| 163 | |
Rusty Russell | a8f033e | 2000-07-30 01:43:01 +0000 | [diff] [blame] | 164 | case 't': |
| 165 | /* Select specific table. */ |
| 166 | tablename = optarg; |
| 167 | break; |
Jan Engelhardt | fbb5639 | 2009-03-19 16:57:35 +0100 | [diff] [blame^] | 168 | case 'M': |
| 169 | xtables_modprobe_program = optarg; |
| 170 | break; |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 171 | case 'd': |
Harald Welte | ae1ff9f | 2000-12-01 14:26:20 +0000 | [diff] [blame] | 172 | do_output(tablename); |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 173 | exit(0); |
| 174 | } |
| 175 | } |
| 176 | |
| 177 | if (optind < argc) { |
Pavel Rusnak | 972af09 | 2007-05-10 15:00:39 +0000 | [diff] [blame] | 178 | fprintf(stderr, "Unknown arguments found on commandline\n"); |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 179 | exit(1); |
| 180 | } |
| 181 | |
Rusty Russell | a8f033e | 2000-07-30 01:43:01 +0000 | [diff] [blame] | 182 | return !do_output(tablename); |
Marc Boucher | e6869a8 | 2000-03-20 06:03:29 +0000 | [diff] [blame] | 183 | } |