summaryrefslogtreecommitdiff
path: root/src/iptables.c
AgeCommit message (Collapse)AuthorFilesLines
2020-08-13Svace Fix: memory leakRahul Jain1-3/+19
Change-Id: Id10ede540b99d028f6ff40225b4dfcccb46d7fe0
2020-02-17iptables: Fix memory leaksubmit/tizen/20200227.012332submit/tizen/20200220.041614accepted/tizen/unified/20200227.121046Jaehyun Kim1-32/+38
Change-Id: I2f5dd43703af7583d18a7be8fc10ae0e99d402d5 Signed-off-by: Jaehyun Kim <jeik01.kim@samsung.com>
2019-09-18Imported Upstream version 1.37submit/tizen/20190920.082459Nishant Chaprana1-410/+2038
Change-Id: Idb47c1ddbedc9f97181b8e9a5eeac04ddd832a2c Signed-off-by: Nishant Chaprana <n.chaprana@samsung.com>
2019-07-04Imported Upstream version 1.37upstream/1.37Nishant Chaprana1-410/+2038
Change-Id: Ib5957e7ee3a9315ee86a331189bc3e9e71751ee8 Signed-off-by: Nishant Chaprana <n.chaprana@samsung.com>
2018-01-23Updated connman to version 1.35Seonah Moon1-17/+72
Change-Id: I13526fbf80296a79be15548fc226a308941ac9ec Signed-off-by: Taesub Kim <taesub.kim@samsung.com>
2018-01-08Imported Upstream version 1.35upstream/1.35Seonah Moon1-16/+80
Change-Id: I174854914d9fd06a813270b57d1f7bc2bac63c6a Signed-off-by: Seonah Moon <seonah1.moon@samsung.com>
2017-07-06[Upstream] iptables: Add missing function item of xtables to match iptables 1.6Saurav Babu1-0/+3
The struct of xtables_globals has been modified in iptables 1.6. If connman runs with iptables 1.6, it can crash. Program received signal SIGSEGV, Segmentation fault. 0x00000000 in ?? () 0xb7dea89c in xtables_find_target () from /usr/lib/libxtables.so.11 0xb7deac1c in ?? () from /usr/lib/libxtables.so.11 0xb7dea793 in xtables_find_target () from /usr/lib/libxtables.so.11 The the missing function item of xtables is added to xtables_globals. Commit ID: acea08a0e4234a4c1a87bedc087c73ff36de0c7b Change-Id: I670e100d816636d705d967ba69b3cb72c26d889e Signed-off-by: Saurav Babu <saurav.babu@samsung.com>
2016-06-08[connman] Fixed derefrencing of NULL pointer.Niraj Kumar Goit1-0/+4
Change-Id: I2174f8e6afca4e2c7795ec8ca8118c296ee9fece Signed-off-by: Niraj Kumar Goit <niraj.g@samsung.com>
2016-03-08iptables: Fix memory leakNiraj Kumar Goit1-1/+3
This patch free memory allocated to cbd by cb_data_new() when get_table() return NULL. Change-Id: Ifc40f97290c459d580f029f4cf8655d475fcd0ad Signed-off-by: Niraj Kumar Goit <niraj.g@samsung.com>
2015-08-07Base Code merged to SPIN 2.4submit/tizen/20150810.034432hyunuktak1-0/+0
Signed-off-by: hyunuktak <hyunuk.tak@samsung.com> Change-Id: I84a42375b5c59739e4caca1f726699ea7647ef17
2014-07-17Imported Upstream version 1.24upstream/1.24Zhang zhengguang1-185/+194
2013-05-31iptables: Fix memory leak when invoking xtables_find_matchDaniel Wagner1-12/+34
xtables_find_match() returns two different kind of pointers. The first type is pointing to the function pointer table loaded via dlopen(). The second type is a copy (via plain malloc) of the first type. xtables_find_match() marks the copies/clones with m == m->next. So we need to free the struct xtables_match which point back to themself. Also fix the issue that we didn't handle multple match instances at the same time. The memory leak is only visible when having more than one match of a kind.
2013-03-25iptables: Add chain iteratorDaniel Wagner1-32/+14
We will implement the ConnMan iptables specific part in a different file and leave the iptables.c file as small as possible. Therefore, we move the flushing part out, but we need a way to find our chains on bootup (left over from a crash). Let's add an interater which walks over all chains which allows a higher level to find the chains it is looking for (e.g. connman-INPUT)
2013-03-25iptables: Add __connman_iptables_insert()Daniel Wagner1-0/+74
This was wrongly removed with commit 161efbae
2013-03-25iptables: Prepare rule to be inserted or appendedDaniel Wagner1-3/+4
Add a boolean helper to distinguish between insert and append operations. When chain_head == chain_tail->prev, the builtin chain is empty which makes an intended append operation equivalent to an insert operation.
2013-03-18iptables: Allocated memory blocks are already zerod outDaniel Wagner1-4/+0
entry_head and entry_return are allocated via g_try_malloc0().
2013-03-18iptables: Factor out duplicated update hook codeDaniel Wagner1-33/+27
After removing one or more rules the builtin hooks need to be updated accordingly. iptables_flush_chain() and iptables_delete_rule() share a common code part.
2013-03-18iptables: Fix invalid access to list after removing first ruleDaniel Wagner1-6/+16
The list pointer is invalid after remove_table_entry(). Since we entering the 'if' body only for the first rule in a builtin chain we can safely update list to point to the next element.
2013-03-18iptables: Rename pre_load_table() to get_table()Daniel Wagner1-12/+10
The second argument is not used anymore, let's remove it. The funciton name doesn't really match to its implementation, so it's also time to rename it.
2013-03-18iptables: Improve debug log outputDaniel Wagner1-4/+17
We need to see a bit more in detail what happens when CONNMAN_IPTABLES_DEBUG is not set, for example the removing/flushing during bootup. Also remove the DBG() from parse_rule_spec() because all callers already have a DBG(). So not much additional information here.
2013-03-18iptables: Lookup in table hash before module loadingDaniel Wagner1-10/+14
pre_load_table() is called always with table == NULL, we end up keep trying to load the kernel modules even though the table is already loaded. Therefore, move the lookup one level up.
2013-03-18iptables: Use glib function for string operationsDaniel Wagner1-31/+31
Streamline this file with the rest of ConnMan's code base.
2013-03-18iptables: Drop support for xtables < 1.4.11Daniel Wagner1-71/+0
The API changed between 1.4.10 (version code 5) and 1.4.11 (version code 6) and we needed to workaround with a bunch of ugly ifdefs. 1.4.11 was released on 26.05.2011 and even Debian testing ships 1.4.14 these days.
2013-03-18iptables: Add __connman_iptables_dump()Daniel Wagner1-0/+15
In order to allow our test tool iptables-tests to dump a table we need an dump function. The only user will be this tool. That allows the linker to remove this code, so no additional code size.
2013-03-07iptables: Fix rule appendingDaniel Wagner1-9/+6
Commit ba052f1f "iptables: Add split out iptables commands" introduced a bug. __connman_iptables_append() should call iptables_append_rule() instead of iptables_insert_rule().
2013-03-07iptables: Valid policies are only ACCEPT and DROPDaniel Wagner1-1/+6
2013-03-07iptables: Fix setting policyDaniel Wagner1-1/+6
The policy is kept at the end of the chain not at the beginning. Currently, the code assumes that the builtin chain is empty.
2013-03-07iptables: Always update options tableDaniel Wagner1-4/+0
The linked list is tracking all loading modules. Since we do not unload once they are loaded (xtables does not support this), we might up leaving prepare_matches() before we update the option table. Since we carefully reset the global xtable state after executing one rule, this check is wrong, e.g. if we add to similar rules (same matches (mark, nfacct)). In this case the second rule would not be parsed correctly. Nasty nasty iptables parser!
2013-03-07iptables: Do not flush in the wrong orderDaniel Wagner1-0/+8
2013-03-07iptables: Fix and refactor iterate_entries()Daniel Wagner1-25/+46
Updating the builtin and hook index is more complex then one would expect. In order to be able to update them correctly we need also to pass in the underflow table to the iterate function. To improve the readability the valid_hook magic has been moved into next_hook_entry_index() which does exactly as the name says.
2013-03-07iptables: Fix is_fallthrough() checkDaniel Wagner1-2/+6
A fallthrough rule is one which has the default target name, does not have a verdict and is not a jump rule. is_fallthrough() is called excluslive from the insert path, thus the value of verdict will be 0 for a fallthrough rule.
2013-02-22iptables: Merge clear_tables_flags() and reset_xtables()Daniel Wagner1-25/+19
Both function reset the xtables library. So let's do this at the same place.
2013-02-22iptables: Free table pointerDaniel Wagner1-1/+3
And also use g_strv_length() to count the number of entries. Thanks Tomasz!
2013-02-22iptables: Free match rulesDaniel Wagner1-0/+9
We forgot to free the match rules.
2013-02-22iptables: Reset pointer after freeingDaniel Wagner1-2/+6
The match or the target might be reused in the next invocation of iptables and then xtables operates on this invalid pointer. xt_t->t and xt_m->m are keept alive via the global variables xtables_targets and xtables_matches.
2013-02-22iptables: Reinitialize global parser tableDaniel Wagner1-2/+16
xtables modifies the global parse table and allocates additional memory. If that happens we need to free it afterwards.
2013-02-22iptables: Free xtables entry when removing one entry from the tableDaniel Wagner1-2/+3
2013-02-18iptables: Cannot flush all rules without API to set themPatrik Flykt1-10/+2
Currently there exists no API where iptables rules can be set. The flush code does not touch the default chain policy at the moment. Any pre- existing iptables rules setting default policy to reject and relying on individual iptables rules allowing packets going through will prevent all IP communication. Removing all iptables rules on startup can expose the device to unwanted traffic as well. For the time being disable iptables flush on init. Please be careful with iptables rules and the masquerading ones ConnMan sets when tethering.
2013-02-12iptables: Update the hook entries correctly in iptables_delete_rule()Daniel Wagner1-3/+8
The builtin value is only valid in the chain head entry and not in any other entry. That means we need to lookup the head entry and use that builtin value (== hook id) and then update all references which follow that chain.
2013-02-12iptables: Test if match and target arguments are also the sameDaniel Wagner1-1/+21
We need to verify that also the arguments are the same, e.g. if we have two rules like -t filter -A INPUT -m mark --mark 1 -j LOG -t filter -A INPUT -m mark --mark 2 -j LOG then the matcher and the target would be the same without looking at '1' or '2'. When deleting a rule, we would always remove the first rule which matches the 'match' type and target type, so let's have a look also on the arguments. iptables does it the same way.
2013-02-12iptables: Fix fallthrough rulesDaniel Wagner1-0/+21
2013-02-12iptables: Remove unused __connman_iptables_command()Daniel Wagner1-462/+0
2013-02-12iptables: Add split out iptables commandsDaniel Wagner1-0/+511
Instead of having a pure string based API, we add two new main functions, __connman_iptables_append() and __connman_iptables_remove(). The missing commands will be added later. To simplify the whole code, the __connman_iptables_command() code is refactored into smaller pieces: parse_rule_spec() calls a few functions such as clear_tables_flags() and parse_xt_modules() which should make the reading of the main parser loop simpler. Also added a few comments on the parser which is really tricky.
2013-02-12iptables: Flush 'filter' 'mangle' and 'nat' tableDaniel Wagner1-1/+60
The implementation is ugly but there is not much we can do about it, the iptables API is being just plain stupid here.
2013-02-12iptables: Add CONNMAN_IPTABLES_DEBUG environment variableDaniel Wagner1-30/+84
If CONNMAN_IPTABLES_DEBUG is set, then print the table when it is loaded and print it the table which will be written. Also use DBG() instead of connman_info().
2013-02-12iptables: Remove dependency on table in iterator_entries_cb_tDaniel Wagner1-24/+14
With removing the table argument the callback can now either iterate over buffer we get from the kernel or the one we write to the kernel.
2013-02-12iptables: Do not pass table into dump_match() and dump_target()Daniel Wagner1-8/+5
2013-02-12iptables: Get rid of the iterator macroDaniel Wagner1-57/+60
Instead implement the iterator loop directly. Since both dump_entry() and add_entry() have calculated 'builtin' and 'offset' let's pass in them in as well. In the next step we are able to remove also the table argument which will allow us to unify the parsing the table we get from IPT_SO_GET_ENTRIES and the table we will pass in to the kernel via IPT_SO_SET_REPLACE.
2013-02-12iptables: Clear global parser flagsDaniel Wagner1-0/+20
That allows the parser to be reentrantable.
2013-02-12iptables: Make string arguments constDaniel Wagner1-23/+30
generated by cgit v1.2.3 (git 2.25.1) at 2024-09-27 04:21:19 +0000