00001
00002
00003
00004
00005
00006
00007
00008
00009
00010
00011
00012
00013
00014
00015
00016
00017
00018
00019
00020
00021
00022
00023
00024
00025
00026
00027 #include <stdlib.h>
00028 #include <stdio.h>
00029 #include <string.h>
00030 #include <unistd.h>
00031 #include <sys/time.h>
00032 #include <sys/types.h>
00033
00034 #include <libipq/libipq.h>
00035
00036
00037
00038
00039
00040
00041
00042 enum {
00043 IPQ_ERR_NONE = 0,
00044 IPQ_ERR_IMPL,
00045 IPQ_ERR_HANDLE,
00046 IPQ_ERR_SOCKET,
00047 IPQ_ERR_BIND,
00048 IPQ_ERR_BUFFER,
00049 IPQ_ERR_RECV,
00050 IPQ_ERR_NLEOF,
00051 IPQ_ERR_ADDRLEN,
00052 IPQ_ERR_STRUNC,
00053 IPQ_ERR_RTRUNC,
00054 IPQ_ERR_NLRECV,
00055 IPQ_ERR_SEND,
00056 IPQ_ERR_SUPP,
00057 IPQ_ERR_RECVBUF,
00058 IPQ_ERR_TIMEOUT,
00059 IPQ_ERR_PROTOCOL
00060 };
00061 #define IPQ_MAXERR IPQ_ERR_PROTOCOL
00062
00063 struct ipq_errmap_t {
00064 int errcode;
00065 char *message;
00066 } ipq_errmap[] = {
00067 { IPQ_ERR_NONE, "Unknown error" },
00068 { IPQ_ERR_IMPL, "Implementation error" },
00069 { IPQ_ERR_HANDLE, "Unable to create netlink handle" },
00070 { IPQ_ERR_SOCKET, "Unable to create netlink socket" },
00071 { IPQ_ERR_BIND, "Unable to bind netlink socket" },
00072 { IPQ_ERR_BUFFER, "Unable to allocate buffer" },
00073 { IPQ_ERR_RECV, "Failed to receive netlink message" },
00074 { IPQ_ERR_NLEOF, "Received EOF on netlink socket" },
00075 { IPQ_ERR_ADDRLEN, "Invalid peer address length" },
00076 { IPQ_ERR_STRUNC, "Sent message truncated" },
00077 { IPQ_ERR_RTRUNC, "Received message truncated" },
00078 { IPQ_ERR_NLRECV, "Received error from netlink" },
00079 { IPQ_ERR_SEND, "Failed to send netlink message" },
00080 { IPQ_ERR_SUPP, "Operation not supported" },
00081 { IPQ_ERR_RECVBUF, "Receive buffer size invalid" },
00082 { IPQ_ERR_TIMEOUT, "Timeout"},
00083 { IPQ_ERR_PROTOCOL, "Invalid protocol specified" }
00084 };
00085
00086 static int ipq_errno = IPQ_ERR_NONE;
00087
00088 static ssize_t ipq_netlink_sendto(const struct ipq_handle *h,
00089 const void *msg, size_t len);
00090
00091 static ssize_t ipq_netlink_recvfrom(const struct ipq_handle *h,
00092 unsigned char *buf, size_t len,
00093 int timeout);
00094
00095 static ssize_t ipq_netlink_sendmsg(const struct ipq_handle *h,
00096 const struct msghdr *msg,
00097 unsigned int flags);
00098
00099 static char *ipq_strerror(int errcode);
00100
00101 static ssize_t ipq_netlink_sendto(const struct ipq_handle *h,
00102 const void *msg, size_t len)
00103 {
00104 int status = sendto(h->fd, msg, len, 0,
00105 (struct sockaddr *)&h->peer, sizeof(h->peer));
00106 if (status < 0)
00107 ipq_errno = IPQ_ERR_SEND;
00108 return status;
00109 }
00110
00111 static ssize_t ipq_netlink_sendmsg(const struct ipq_handle *h,
00112 const struct msghdr *msg,
00113 unsigned int flags)
00114 {
00115 int status = sendmsg(h->fd, msg, flags);
00116 if (status < 0)
00117 ipq_errno = IPQ_ERR_SEND;
00118 return status;
00119 }
00120
00121 static ssize_t ipq_netlink_recvfrom(const struct ipq_handle *h,
00122 unsigned char *buf, size_t len,
00123 int timeout)
00124 {
00125 unsigned int addrlen;
00126 int status;
00127 struct nlmsghdr *nlh;
00128
00129 if (len < sizeof(struct nlmsgerr)) {
00130 ipq_errno = IPQ_ERR_RECVBUF;
00131 return -1;
00132 }
00133 addrlen = sizeof(h->peer);
00134
00135 if (timeout != 0) {
00136 int ret;
00137 struct timeval tv;
00138 fd_set read_fds;
00139
00140 if (timeout < 0) {
00141
00142 tv.tv_sec = 0;
00143 tv.tv_usec = 0;
00144 } else {
00145 tv.tv_sec = timeout / 1000000;
00146 tv.tv_usec = timeout % 1000000;
00147 }
00148
00149 FD_ZERO(&read_fds);
00150 FD_SET(h->fd, &read_fds);
00151 ret = select(h->fd+1, &read_fds, NULL, NULL, &tv);
00152 if (ret < 0) {
00153 if (errno == EINTR) {
00154 return 0;
00155 } else {
00156 ipq_errno = IPQ_ERR_RECV;
00157 return -1;
00158 }
00159 }
00160 if (!FD_ISSET(h->fd, &read_fds)) {
00161 ipq_errno = IPQ_ERR_TIMEOUT;
00162 return 0;
00163 }
00164 }
00165 status = recvfrom(h->fd, buf, len, 0,
00166 (struct sockaddr *)&h->peer, &addrlen);
00167 if (status < 0) {
00168 ipq_errno = IPQ_ERR_RECV;
00169 return status;
00170 }
00171 if (addrlen != sizeof(h->peer)) {
00172 ipq_errno = IPQ_ERR_RECV;
00173 return -1;
00174 }
00175 if (h->peer.nl_pid != 0) {
00176 ipq_errno = IPQ_ERR_RECV;
00177 return -1;
00178 }
00179 if (status == 0) {
00180 ipq_errno = IPQ_ERR_NLEOF;
00181 return -1;
00182 }
00183 nlh = (struct nlmsghdr *)buf;
00184 if (nlh->nlmsg_flags & MSG_TRUNC || nlh->nlmsg_len > status) {
00185 ipq_errno = IPQ_ERR_RTRUNC;
00186 return -1;
00187 }
00188 return status;
00189 }
00190
00191 static char *ipq_strerror(int errcode)
00192 {
00193 if (errcode < 0 || errcode > IPQ_MAXERR)
00194 errcode = IPQ_ERR_IMPL;
00195 return ipq_errmap[errcode].message;
00196 }
00197
00198
00199
00200
00201
00202
00203
00204
00205
00206
00207 struct ipq_handle *ipq_create_handle(u_int32_t flags, u_int32_t protocol)
00208 {
00209 int status;
00210 struct ipq_handle *h;
00211
00212 h = (struct ipq_handle *)malloc(sizeof(struct ipq_handle));
00213 if (h == NULL) {
00214 ipq_errno = IPQ_ERR_HANDLE;
00215 return NULL;
00216 }
00217
00218 memset(h, 0, sizeof(struct ipq_handle));
00219
00220 if (protocol == PF_INET)
00221 h->fd = socket(PF_NETLINK, SOCK_RAW, NETLINK_FIREWALL);
00222 else if (protocol == PF_INET6)
00223 h->fd = socket(PF_NETLINK, SOCK_RAW, NETLINK_IP6_FW);
00224 else {
00225 ipq_errno = IPQ_ERR_PROTOCOL;
00226 free(h);
00227 return NULL;
00228 }
00229
00230 if (h->fd == -1) {
00231 ipq_errno = IPQ_ERR_SOCKET;
00232 close(h->fd);
00233 free(h);
00234 return NULL;
00235 }
00236 memset(&h->local, 0, sizeof(struct sockaddr_nl));
00237 h->local.nl_family = AF_NETLINK;
00238 h->local.nl_pid = getpid();
00239 h->local.nl_groups = 0;
00240 status = bind(h->fd, (struct sockaddr *)&h->local, sizeof(h->local));
00241 if (status == -1) {
00242 ipq_errno = IPQ_ERR_BIND;
00243 close(h->fd);
00244 free(h);
00245 return NULL;
00246 }
00247 memset(&h->peer, 0, sizeof(struct sockaddr_nl));
00248 h->peer.nl_family = AF_NETLINK;
00249 h->peer.nl_pid = 0;
00250 h->peer.nl_groups = 0;
00251 return h;
00252 }
00253
00254
00255
00256
00257
00258 int ipq_destroy_handle(struct ipq_handle *h)
00259 {
00260 if (h) {
00261 close(h->fd);
00262 free(h);
00263 }
00264 return 0;
00265 }
00266
00267 int ipq_set_mode(const struct ipq_handle *h,
00268 u_int8_t mode, size_t range)
00269 {
00270 struct {
00271 struct nlmsghdr nlh;
00272 ipq_peer_msg_t pm;
00273 } req;
00274
00275 memset(&req, 0, sizeof(req));
00276 req.nlh.nlmsg_len = NLMSG_LENGTH(sizeof(req));
00277 req.nlh.nlmsg_flags = NLM_F_REQUEST;
00278 req.nlh.nlmsg_type = IPQM_MODE;
00279 req.nlh.nlmsg_pid = h->local.nl_pid;
00280 req.pm.msg.mode.value = mode;
00281 req.pm.msg.mode.range = range;
00282 return ipq_netlink_sendto(h, (void *)&req, req.nlh.nlmsg_len);
00283 }
00284
00285
00286
00287
00288
00289 ssize_t ipq_read(const struct ipq_handle *h,
00290 unsigned char *buf, size_t len, int timeout)
00291 {
00292 return ipq_netlink_recvfrom(h, buf, len, timeout);
00293 }
00294
00295 int ipq_message_type(const unsigned char *buf)
00296 {
00297 return ((struct nlmsghdr*)buf)->nlmsg_type;
00298 }
00299
00300 int ipq_get_msgerr(const unsigned char *buf)
00301 {
00302 struct nlmsghdr *h = (struct nlmsghdr *)buf;
00303 struct nlmsgerr *err = (struct nlmsgerr*)NLMSG_DATA(h);
00304 return -err->error;
00305 }
00306
00307 ipq_packet_msg_t *ipq_get_packet(const unsigned char *buf)
00308 {
00309 return NLMSG_DATA((struct nlmsghdr *)(buf));
00310 }
00311
00312 int ipq_set_verdict(const struct ipq_handle *h,
00313 ipq_id_t id,
00314 unsigned int verdict,
00315 size_t data_len,
00316 unsigned char *buf)
00317 {
00318 unsigned char nvecs;
00319 size_t tlen;
00320 struct nlmsghdr nlh;
00321 ipq_peer_msg_t pm;
00322 struct iovec iov[3];
00323 struct msghdr msg;
00324
00325 memset(&nlh, 0, sizeof(nlh));
00326 nlh.nlmsg_flags = NLM_F_REQUEST;
00327 nlh.nlmsg_type = IPQM_VERDICT;
00328 nlh.nlmsg_pid = h->local.nl_pid;
00329 memset(&pm, 0, sizeof(pm));
00330 pm.msg.verdict.value = verdict;
00331 pm.msg.verdict.id = id;
00332 pm.msg.verdict.data_len = data_len;
00333 iov[0].iov_base = &nlh;
00334 iov[0].iov_len = sizeof(nlh);
00335 iov[1].iov_base = ±
00336 iov[1].iov_len = sizeof(pm);
00337 tlen = sizeof(nlh) + sizeof(pm);
00338 nvecs = 2;
00339 if (data_len && buf) {
00340 iov[2].iov_base = buf;
00341 iov[2].iov_len = data_len;
00342 tlen += data_len;
00343 nvecs++;
00344 }
00345 msg.msg_name = (void *)&h->peer;
00346 msg.msg_namelen = sizeof(h->peer);
00347 msg.msg_iov = iov;
00348 msg.msg_iovlen = nvecs;
00349 msg.msg_control = NULL;
00350 msg.msg_controllen = 0;
00351 msg.msg_flags = 0;
00352 nlh.nlmsg_len = tlen;
00353 return ipq_netlink_sendmsg(h, &msg, 0);
00354 }
00355
00356
00357 int ipq_ctl(const struct ipq_handle *h, int request, ...)
00358 {
00359 return 1;
00360 }
00361
00362 char *ipq_errstr(void)
00363 {
00364 return ipq_strerror(ipq_errno);
00365 }
00366
00367 void ipq_perror(const char *s)
00368 {
00369 if (s)
00370 fputs(s, stderr);
00371 else
00372 fputs("ERROR", stderr);
00373 if (ipq_errno)
00374 fprintf(stderr, ": %s", ipq_errstr());
00375 if (errno)
00376 fprintf(stderr, ": %s", strerror(errno));
00377 fputc('\n', stderr);
00378 }