usr/src/cmd/ipf/tools/ipfzone.c

   1 /*
   2  * Copyright (c) 2014 Joyent, Inc.  All rights reserved.
   3  * Use is subject to license terms.
   4  *
   5  * See the IPFILTER.LICENCE file for details on licensing.
   6  */
   7
   8
   9 #include <errno.h>
  10 #include <net/if.h>
  11 #include <stdio.h>
  12 #include <string.h>
  13 #include <unistd.h>
  14 #include <zone.h>
  15
  16 #include "netinet/ip_fil.h"
  17 #include "ipfzone.h"
  18
  19 static ipfzoneobj_t     ipzo;
  20 static boolean_t        do_setzone = 0;
  21 static int              num_setzones = 0;
  22
  23 extern int      errno;
  24 extern int      opterr;
  25 extern int      optind;
  26 extern char     *optarg;
  27
  28 /*
  29  * Get the zonename if it's the last argument and set the zonename
  30  * in ipfzo to it. This is used by ipf(1m) only - all of the other tools
  31  * specify the zone with the -z option, and therefore use getzoneopt() below.
  32  */
  33 void
  34 getzonearg(int argc, char *argv[], const char *optstr)
  35 {
  36         int c;
  37
  38         /*
  39          * Don't warn about unknown options - let subsequent calls to
  40          * getopt() handle this.
  41          */
  42         opterr = 0;
  43
  44         /*
  45          * getopt is also used here to set optind so that we can
  46          * determine if the last argument belongs to a flag or is
  47          * actually a zonename.
  48          */
  49         while ((c = getopt(argc, argv, optstr)) != -1) {
  50                 if (c == 'G')
  51                         ipzo.ipfz_gz = 1;
  52         }
  53
  54         if (optind < argc)
  55                 setzonename(argv[optind]);
  56
  57         /*
  58          * Reset optind and opterr so the next getopt call will go through all
  59          * of argv again and warn about unknown options.
  60          */
  61         optind = 1;
  62         opterr = 1;
  63 }
  64
  65 /*
  66  * Get a -z option from argv and set the zonename in ipfzo accordingly
  67  */
  68 void
  69 getzoneopt(int argc, char *argv[], const char *optstr)
  70 {
  71         int c;
  72
  73         /*
  74          * Don't warn about unknown options - let subsequent calls to
  75          * getopt() handle this.
  76          */
  77         opterr = 0;
  78
  79         while ((c = getopt(argc, argv, optstr)) != -1) {
  80                 if (c == 'G')
  81                         setzonename_global(optarg);
  82
  83                 if (c == 'z')
  84                         setzonename(optarg);
  85         }
  86
  87         /*
  88          * Reset optind and opterr so the next getopt call will go through all
  89          * of argv again and warn about unknown options.
  90          */
  91         optind = 1;
  92         opterr = 1;
  93 }
  94
  95 /*
  96  * Set the zonename in ipfzo to the given string: this is the zone all further
  97  * ioctls will act on.
  98  */
  99 void
 100 setzonename(const char *zonename)
 101 {
 102         memcpy(ipzo.ipfz_zonename, zonename, sizeof (ipzo.ipfz_zonename));
 103         do_setzone = B_TRUE;
 104         num_setzones++;
 105 }
 106
 107 /*
 108  * Set the zonename in ipfo, and the gz flag. This indicates that we want all
 109  * further ioctls to act on the GZ-controlled stack for that zone.
 110  */
 111 void
 112 setzonename_global(const char *zonename)
 113 {
 114         setzonename(zonename);
 115         ipzo.ipfz_gz = 1;
 116 }
 117
 118 /*
 119  * Set the zone that all further ioctls will operate on. See the "GZ-controlled
 120  * and per-zone stacks" note at the top of ip_fil_solaris.c for further
 121  * explanation.
 122  */
 123 int
 124 setzone(int fd)
 125 {
 126         if (!do_setzone)
 127                 return (0);
 128
 129         if (num_setzones > 1) {
 130                 (void) fprintf(stderr,
 131                     "Only one of -G and -z may be set\n");
 132                 return (-1);
 133         }
 134
 135         if (ipzo.ipfz_gz == 1 &&
 136             getzoneidbyname(ipzo.ipfz_zonename) == GLOBAL_ZONEID) {
 137                 (void) fprintf(stderr,
 138                     "-G cannot be used with the global zone\n");
 139                 return (-1);
 140         }
 141
 142         if (ioctl(fd, SIOCIPFZONESET, &ipzo) == -1) {
 143                 switch (errno) {
 144                 case ENODEV:
 145                         (void) fprintf(stderr,
 146                             "Could not find running zone: %s\n",
 147                             ipzo.ipfz_zonename);
 148                         break;
 149                 case EACCES:
 150                         (void) fprintf(stderr,
 151                             "Permission denied setting zone: %s\n",
 152                             ipzo.ipfz_zonename);
 153                         break;
 154                 default:
 155                         perror("Error setting zone");
 156                 }
 157                 return (-1);
 158         }
 159
 160         return (0);
 161 }