summaryrefslogtreecommitdiff
path: root/src/iptables.c
AgeCommit message (Collapse)AuthorFilesLines
2014-07-17Imported Upstream version 1.24upstream/1.24Zhang zhengguang1-185/+194
2013-05-31iptables: Fix memory leak when invoking xtables_find_matchDaniel Wagner1-12/+34
xtables_find_match() returns two different kind of pointers. The first type is pointing to the function pointer table loaded via dlopen(). The second type is a copy (via plain malloc) of the first type. xtables_find_match() marks the copies/clones with m == m->next. So we need to free the struct xtables_match which point back to themself. Also fix the issue that we didn't handle multple match instances at the same time. The memory leak is only visible when having more than one match of a kind.
2013-03-25iptables: Add chain iteratorDaniel Wagner1-32/+14
We will implement the ConnMan iptables specific part in a different file and leave the iptables.c file as small as possible. Therefore, we move the flushing part out, but we need a way to find our chains on bootup (left over from a crash). Let's add an interater which walks over all chains which allows a higher level to find the chains it is looking for (e.g. connman-INPUT)
2013-03-25iptables: Add __connman_iptables_insert()Daniel Wagner1-0/+74
This was wrongly removed with commit 161efbae
2013-03-25iptables: Prepare rule to be inserted or appendedDaniel Wagner1-3/+4
Add a boolean helper to distinguish between insert and append operations. When chain_head == chain_tail->prev, the builtin chain is empty which makes an intended append operation equivalent to an insert operation.
2013-03-18iptables: Allocated memory blocks are already zerod outDaniel Wagner1-4/+0
entry_head and entry_return are allocated via g_try_malloc0().
2013-03-18iptables: Factor out duplicated update hook codeDaniel Wagner1-33/+27
After removing one or more rules the builtin hooks need to be updated accordingly. iptables_flush_chain() and iptables_delete_rule() share a common code part.
2013-03-18iptables: Fix invalid access to list after removing first ruleDaniel Wagner1-6/+16
The list pointer is invalid after remove_table_entry(). Since we entering the 'if' body only for the first rule in a builtin chain we can safely update list to point to the next element.
2013-03-18iptables: Rename pre_load_table() to get_table()Daniel Wagner1-12/+10
The second argument is not used anymore, let's remove it. The funciton name doesn't really match to its implementation, so it's also time to rename it.
2013-03-18iptables: Improve debug log outputDaniel Wagner1-4/+17
We need to see a bit more in detail what happens when CONNMAN_IPTABLES_DEBUG is not set, for example the removing/flushing during bootup. Also remove the DBG() from parse_rule_spec() because all callers already have a DBG(). So not much additional information here.
2013-03-18iptables: Lookup in table hash before module loadingDaniel Wagner1-10/+14
pre_load_table() is called always with table == NULL, we end up keep trying to load the kernel modules even though the table is already loaded. Therefore, move the lookup one level up.
2013-03-18iptables: Use glib function for string operationsDaniel Wagner1-31/+31
Streamline this file with the rest of ConnMan's code base.
2013-03-18iptables: Drop support for xtables < 1.4.11Daniel Wagner1-71/+0
The API changed between 1.4.10 (version code 5) and 1.4.11 (version code 6) and we needed to workaround with a bunch of ugly ifdefs. 1.4.11 was released on 26.05.2011 and even Debian testing ships 1.4.14 these days.
2013-03-18iptables: Add __connman_iptables_dump()Daniel Wagner1-0/+15
In order to allow our test tool iptables-tests to dump a table we need an dump function. The only user will be this tool. That allows the linker to remove this code, so no additional code size.
2013-03-07iptables: Fix rule appendingDaniel Wagner1-9/+6
Commit ba052f1f "iptables: Add split out iptables commands" introduced a bug. __connman_iptables_append() should call iptables_append_rule() instead of iptables_insert_rule().
2013-03-07iptables: Valid policies are only ACCEPT and DROPDaniel Wagner1-1/+6
2013-03-07iptables: Fix setting policyDaniel Wagner1-1/+6
The policy is kept at the end of the chain not at the beginning. Currently, the code assumes that the builtin chain is empty.
2013-03-07iptables: Always update options tableDaniel Wagner1-4/+0
The linked list is tracking all loading modules. Since we do not unload once they are loaded (xtables does not support this), we might up leaving prepare_matches() before we update the option table. Since we carefully reset the global xtable state after executing one rule, this check is wrong, e.g. if we add to similar rules (same matches (mark, nfacct)). In this case the second rule would not be parsed correctly. Nasty nasty iptables parser!
2013-03-07iptables: Do not flush in the wrong orderDaniel Wagner1-0/+8
2013-03-07iptables: Fix and refactor iterate_entries()Daniel Wagner1-25/+46
Updating the builtin and hook index is more complex then one would expect. In order to be able to update them correctly we need also to pass in the underflow table to the iterate function. To improve the readability the valid_hook magic has been moved into next_hook_entry_index() which does exactly as the name says.
2013-03-07iptables: Fix is_fallthrough() checkDaniel Wagner1-2/+6
A fallthrough rule is one which has the default target name, does not have a verdict and is not a jump rule. is_fallthrough() is called excluslive from the insert path, thus the value of verdict will be 0 for a fallthrough rule.
2013-02-22iptables: Merge clear_tables_flags() and reset_xtables()Daniel Wagner1-25/+19
Both function reset the xtables library. So let's do this at the same place.
2013-02-22iptables: Free table pointerDaniel Wagner1-1/+3
And also use g_strv_length() to count the number of entries. Thanks Tomasz!
2013-02-22iptables: Free match rulesDaniel Wagner1-0/+9
We forgot to free the match rules.
2013-02-22iptables: Reset pointer after freeingDaniel Wagner1-2/+6
The match or the target might be reused in the next invocation of iptables and then xtables operates on this invalid pointer. xt_t->t and xt_m->m are keept alive via the global variables xtables_targets and xtables_matches.
2013-02-22iptables: Reinitialize global parser tableDaniel Wagner1-2/+16
xtables modifies the global parse table and allocates additional memory. If that happens we need to free it afterwards.
2013-02-22iptables: Free xtables entry when removing one entry from the tableDaniel Wagner1-2/+3
2013-02-18iptables: Cannot flush all rules without API to set themPatrik Flykt1-10/+2
Currently there exists no API where iptables rules can be set. The flush code does not touch the default chain policy at the moment. Any pre- existing iptables rules setting default policy to reject and relying on individual iptables rules allowing packets going through will prevent all IP communication. Removing all iptables rules on startup can expose the device to unwanted traffic as well. For the time being disable iptables flush on init. Please be careful with iptables rules and the masquerading ones ConnMan sets when tethering.
2013-02-12iptables: Update the hook entries correctly in iptables_delete_rule()Daniel Wagner1-3/+8
The builtin value is only valid in the chain head entry and not in any other entry. That means we need to lookup the head entry and use that builtin value (== hook id) and then update all references which follow that chain.
2013-02-12iptables: Test if match and target arguments are also the sameDaniel Wagner1-1/+21
We need to verify that also the arguments are the same, e.g. if we have two rules like -t filter -A INPUT -m mark --mark 1 -j LOG -t filter -A INPUT -m mark --mark 2 -j LOG then the matcher and the target would be the same without looking at '1' or '2'. When deleting a rule, we would always remove the first rule which matches the 'match' type and target type, so let's have a look also on the arguments. iptables does it the same way.
2013-02-12iptables: Fix fallthrough rulesDaniel Wagner1-0/+21
2013-02-12iptables: Remove unused __connman_iptables_command()Daniel Wagner1-462/+0
2013-02-12iptables: Add split out iptables commandsDaniel Wagner1-0/+511
Instead of having a pure string based API, we add two new main functions, __connman_iptables_append() and __connman_iptables_remove(). The missing commands will be added later. To simplify the whole code, the __connman_iptables_command() code is refactored into smaller pieces: parse_rule_spec() calls a few functions such as clear_tables_flags() and parse_xt_modules() which should make the reading of the main parser loop simpler. Also added a few comments on the parser which is really tricky.
2013-02-12iptables: Flush 'filter' 'mangle' and 'nat' tableDaniel Wagner1-1/+60
The implementation is ugly but there is not much we can do about it, the iptables API is being just plain stupid here.
2013-02-12iptables: Add CONNMAN_IPTABLES_DEBUG environment variableDaniel Wagner1-30/+84
If CONNMAN_IPTABLES_DEBUG is set, then print the table when it is loaded and print it the table which will be written. Also use DBG() instead of connman_info().
2013-02-12iptables: Remove dependency on table in iterator_entries_cb_tDaniel Wagner1-24/+14
With removing the table argument the callback can now either iterate over buffer we get from the kernel or the one we write to the kernel.
2013-02-12iptables: Do not pass table into dump_match() and dump_target()Daniel Wagner1-8/+5
2013-02-12iptables: Get rid of the iterator macroDaniel Wagner1-57/+60
Instead implement the iterator loop directly. Since both dump_entry() and add_entry() have calculated 'builtin' and 'offset' let's pass in them in as well. In the next step we are able to remove also the table argument which will allow us to unify the parsing the table we get from IPT_SO_GET_ENTRIES and the table we will pass in to the kernel via IPT_SO_SET_REPLACE.
2013-02-12iptables: Clear global parser flagsDaniel Wagner1-0/+20
That allows the parser to be reentrantable.
2013-02-12iptables: Make string arguments constDaniel Wagner1-23/+30
2013-02-12iptables: Add some documentationDaniel Wagner1-0/+90
These are some random notes but should give the next person to debug iptables some introduction.
2012-11-13iptables: A file descriptor cannot be a nagative integerDanny Jeongseok Seo1-1/+2
When a socket() has failed and a negative file descriptor has been set, close() cannot accept a negative number as a parameter.
2012-10-15iptables: Ignore module loading errorJukka Rissanen1-6/+7
In iptables 1.4.9 module loading gives an error even if the module is built in. Ignore the loading errors because the missing iptables support is noticed when trying to get the iptables socket options.
2012-08-14iptables: Load table at the right placesTomasz Bursztyka1-9/+27
Using -j/-m options without -t one, will segfault due to table not loaded before hand.
2012-08-14iptables: Refactor default return code usageTomasz Bursztyka1-9/+7
2012-05-09iptables: Remove dead assignmentHenrique Dante de Almeida1-1/+1
2012-04-29core: Update copyright informationMarcel Holtmann1-1/+1
2012-02-13iptables: Mask address when parsing ip/prefixlenDaniel Wagner1-0/+1
Netfilter likes to have the address properly masked.
2012-02-13iptables: Fix rule insertion in a builtin chainTomasz Bursztyka1-1/+4
2012-02-13iptables: Parse also netmask for src/dst addressesDaniel Wagner1-9/+38
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-04 02:12:50 +0000