iptables/xtables-save.c

   1 /* Code to save the xtables state, in human readable-form. */
   2 /* (C) 1999 by Paul 'Rusty' Russell <rusty@rustcorp.com.au> and
   3  * (C) 2000-2002 by Harald Welte <laforge@gnumonks.org>
   4  * (C) 2012 by Pablo Neira Ayuso <pablo@netfilter.org>
   5  *
   6  * This code is distributed under the terms of GNU GPL v2
   7  *
   8  */
   9 #include "config.h"
  10 #include <getopt.h>
  11 #include <errno.h>
  12 #include <libgen.h>
  13 #include <stdio.h>
  14 #include <fcntl.h>
  15 #include <stdlib.h>
  16 #include <string.h>
  17 #include <time.h>
  18 #include <netdb.h>
  19 #include <unistd.h>
  20 #include "libiptc/libiptc.h"
  21 #include "iptables.h"
  22 #include "xtables-multi.h"
  23 #include "nft.h"
  24 #include "nft-cache.h"
  25
  26 #include <libnftnl/chain.h>
  27
  28 #ifndef NO_SHARED_LIBS
  29 #include <dlfcn.h>
  30 #endif
  31
  32 #define prog_name xtables_globals.program_name
  33 #define prog_vers xtables_globals.program_version
  34
  35 static const char *ipt_save_optstring = "bcdt:M:f:V";
  36 static const struct option ipt_save_options[] = {
  37         {.name = "counters", .has_arg = false, .val = 'c'},
  38         {.name = "version",  .has_arg = false, .val = 'V'},
  39         {.name = "dump",     .has_arg = false, .val = 'd'},
  40         {.name = "table",    .has_arg = true,  .val = 't'},
  41         {.name = "modprobe", .has_arg = true,  .val = 'M'},
  42         {.name = "file",     .has_arg = true,  .val = 'f'},
  43         {NULL},
  44 };
  45
  46 static const char *arp_save_optstring = "cM:V";
  47 static const struct option arp_save_options[] = {
  48         {.name = "counters", .has_arg = false, .val = 'c'},
  49         {.name = "version",  .has_arg = false, .val = 'V'},
  50         {.name = "modprobe", .has_arg = true,  .val = 'M'},
  51         {NULL},
  52 };
  53
  54 static const char *ebt_save_optstring = "ct:M:V";
  55 static const struct option ebt_save_options[] = {
  56         {.name = "counters", .has_arg = false, .val = 'c'},
  57         {.name = "version",  .has_arg = false, .val = 'V'},
  58         {.name = "table",    .has_arg = true,  .val = 't'},
  59         {.name = "modprobe", .has_arg = true,  .val = 'M'},
  60         {NULL},
  61 };
  62
  63 struct do_output_data {
  64         unsigned int format;
  65         bool commit;
  66 };
  67
  68 static int
  69 __do_output(struct nft_handle *h, const char *tablename, void *data)
  70 {
  71         struct do_output_data *d = data;
  72         time_t now;
  73
  74         if (!nft_table_builtin_find(h, tablename))
  75                 return 0;
  76
  77         if (!nft_is_table_compatible(h, tablename, NULL)) {
  78                 printf("# Table `%s' is incompatible, use 'nft' tool.\n",
  79                        tablename);
  80                 return 0;
  81         } else if (nft_is_table_tainted(h, tablename)) {
  82                 printf("# Table `%s' contains incompatible base-chains, use 'nft' tool to list them.\n",
  83                        tablename);
  84         }
  85
  86         now = time(NULL);
  87         printf("# Generated by %s v%s on %s", prog_name,
  88                prog_vers, ctime(&now));
  89
  90         printf("*%s\n", tablename);
  91         /* Dump out chain names first,
  92          * thereby preventing dependency conflicts */
  93         nft_cache_sort_chains(h, tablename);
  94         nft_chain_foreach(h, tablename, nft_chain_save, h);
  95         nft_rule_save(h, tablename, d->format);
  96         if (d->commit)
  97                 printf("COMMIT\n");
  98
  99         now = time(NULL);
 100         printf("# Completed on %s", ctime(&now));
 101         return 0;
 102 }
 103
 104 static int
 105 do_output(struct nft_handle *h, const char *tablename, struct do_output_data *d)
 106 {
 107         int ret;
 108
 109         if (!tablename) {
 110                 ret = nft_for_each_table(h, __do_output, d);
 111                 nft_check_xt_legacy(h->family, true);
 112                 return !!ret;
 113         }
 114
 115         if (!nft_table_find(h, tablename) &&
 116             !nft_table_builtin_find(h, tablename)) {
 117                 fprintf(stderr, "Table `%s' does not exist\n", tablename);
 118                 return 1;
 119         }
 120
 121         ret = __do_output(h, tablename, d);
 122         nft_check_xt_legacy(h->family, true);
 123         return ret;
 124 }
 125
 126 /* Format:
 127  * :Chain name POLICY packets bytes
 128  * rule
 129  */
 130 static int
 131 xtables_save_main(int family, int argc, char *argv[],
 132                   const char *optstring, const struct option *longopts)
 133 {
 134         const char *tablename = NULL;
 135         struct do_output_data d = {
 136                 .format = FMT_NOCOUNTS,
 137         };
 138         struct nft_handle h;
 139         bool dump = false;
 140         FILE *file = NULL;
 141         int ret, c;
 142
 143         xtables_globals.program_name = basename(*argv);;
 144         c = xtables_init_all(&xtables_globals, family);
 145         if (c < 0) {
 146                 fprintf(stderr, "%s/%s Failed to initialize xtables\n",
 147                                 xtables_globals.program_name,
 148                                 xtables_globals.program_version);
 149                 exit(1);
 150         }
 151
 152         while ((c = getopt_long(argc, argv, optstring, longopts, NULL)) != -1) {
 153                 switch (c) {
 154                 case 'b':
 155                         fprintf(stderr, "-b/--binary option is not implemented\n");
 156                         break;
 157                 case 'c':
 158                         d.format &= ~FMT_NOCOUNTS;
 159                         break;
 160
 161                 case 't':
 162                         /* Select specific table. */
 163                         tablename = optarg;
 164                         break;
 165                 case 'M':
 166                         xtables_modprobe_program = optarg;
 167                         break;
 168                 case 'f':
 169                         file = fopen(optarg, "w");
 170                         if (file == NULL) {
 171                                 fprintf(stderr, "Failed to open file, error: %s\n",
 172                                         strerror(errno));
 173                                 exit(1);
 174                         }
 175                         ret = dup2(fileno(file), STDOUT_FILENO);
 176                         if (ret == -1) {
 177                                 fprintf(stderr, "Failed to redirect stdout, error: %s\n",
 178                                         strerror(errno));
 179                                 exit(1);
 180                         }
 181                         fclose(file);
 182                         break;
 183                 case 'd':
 184                         dump = true;
 185                         break;
 186                 case 'V':
 187                         printf("%s v%s\n", prog_name, prog_vers);
 188                         exit(0);
 189                 default:
 190                         fprintf(stderr,
 191                                 "Look at manual page `%s.8' for more information.\n",
 192                                 prog_name);
 193                         exit(1);
 194                 }
 195         }
 196
 197         if (optind < argc) {
 198                 fprintf(stderr, "Unknown arguments found on commandline\n");
 199                 exit(1);
 200         }
 201
 202         init_extensions();
 203         switch (family) {
 204         case NFPROTO_IPV4:
 205                 init_extensions4();
 206                 d.commit = true;
 207                 break;
 208         case NFPROTO_IPV6:
 209                 init_extensions6();
 210                 d.commit = true;
 211                 break;
 212         case NFPROTO_ARP:
 213                 init_extensionsa();
 214                 break;
 215         case NFPROTO_BRIDGE: {
 216                 const char *ctr = getenv("EBTABLES_SAVE_COUNTER");
 217
 218                 if (!(d.format & FMT_NOCOUNTS)) {
 219                         d.format |= FMT_EBT_SAVE;
 220                 } else if (ctr && !strcmp(ctr, "yes")) {
 221                         d.format &= ~FMT_NOCOUNTS;
 222                         d.format |= FMT_C_COUNTS | FMT_EBT_SAVE;
 223                 }
 224                 init_extensionsb();
 225                 break;
 226         }
 227         default:
 228                 fprintf(stderr, "Unknown family %d\n", family);
 229                 return 1;
 230         }
 231
 232         if (nft_init(&h, family) < 0) {
 233                 fprintf(stderr, "%s/%s Failed to initialize nft: %s\n",
 234                                 xtables_globals.program_name,
 235                                 xtables_globals.program_version,
 236                                 strerror(errno));
 237                 exit(EXIT_FAILURE);
 238         }
 239
 240         nft_cache_level_set(&h, NFT_CL_RULES, NULL);
 241         nft_cache_build(&h);
 242         nft_xt_fake_builtin_chains(&h, tablename, NULL);
 243
 244         ret = do_output(&h, tablename, &d);
 245         nft_fini(&h);
 246         xtables_fini();
 247         if (dump)
 248                 exit(0);
 249
 250         return ret;
 251 }
 252
 253 int xtables_ip4_save_main(int argc, char *argv[])
 254 {
 255         return xtables_save_main(NFPROTO_IPV4, argc, argv,
 256                                  ipt_save_optstring, ipt_save_options);
 257 }
 258
 259 int xtables_ip6_save_main(int argc, char *argv[])
 260 {
 261         return xtables_save_main(NFPROTO_IPV6, argc, argv,
 262                                  ipt_save_optstring, ipt_save_options);
 263 }
 264
 265 int xtables_eb_save_main(int argc, char *argv[])
 266 {
 267         return xtables_save_main(NFPROTO_BRIDGE, argc, argv,
 268                                  ebt_save_optstring, ebt_save_options);
 269 }
 270
 271 int xtables_arp_save_main(int argc, char *argv[])
 272 {
 273         return xtables_save_main(NFPROTO_ARP, argc, argv,
 274                                  arp_save_optstring, arp_save_options);
 275 }