userapps/opensource/iptables/ip6tables.c

   1 /* Code to take an iptables-style command line and do it. */
   2
   3 /*
   4  * Author: Paul.Russell@rustcorp.com.au and mneuling@radlogic.com.au
   5  *
   6  * (C) 2000-2002 by the netfilter coreteam <coreteam@netfilter.org>:
   7  *                  Paul 'Rusty' Russell <rusty@rustcorp.com.au>
   8  *                  Marc Boucher <marc+nf@mbsi.ca>
   9  *                  James Morris <jmorris@intercode.com.au>
  10  *                  Harald Welte <laforge@gnumonks.org>
  11  *                  Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
  12  *
  13  *      This program is free software; you can redistribute it and/or modify
  14  *      it under the terms of the GNU General Public License as published by
  15  *      the Free Software Foundation; either version 2 of the License, or
  16  *      (at your option) any later version.
  17  *
  18  *      This program is distributed in the hope that it will be useful,
  19  *      but WITHOUT ANY WARRANTY; without even the implied warranty of
  20  *      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  21  *      GNU General Public License for more details.
  22  *
  23  *      You should have received a copy of the GNU General Public License
  24  *      along with this program; if not, write to the Free Software
  25  *      Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  26  */
  27
  28 #include <getopt.h>
  29 #include <string.h>
  30 #include <netdb.h>
  31 #include <errno.h>
  32 #include <stdio.h>
  33 #include <stdlib.h>
  34 #include <dlfcn.h>
  35 #include <ctype.h>
  36 #include <stdarg.h>
  37 #include <limits.h>
  38 #include <ip6tables.h>
  39 #include <arpa/inet.h>
  40 #include <unistd.h>
  41 #include <fcntl.h>
  42 #include <sys/wait.h>
  43 #include <sys/types.h>
  44 #include <sys/socket.h>
  45
  46 #ifndef TRUE
  47 #define TRUE 1
  48 #endif
  49 #ifndef FALSE
  50 #define FALSE 0
  51 #endif
  52
  53 #ifndef IP6T_LIB_DIR
  54 #define IP6T_LIB_DIR "/usr/local/lib/iptables"
  55 #endif
  56
  57 #ifndef PROC_SYS_MODPROBE
  58 #define PROC_SYS_MODPROBE "/proc/sys/kernel/modprobe"
  59 #endif
  60
  61 #define FMT_NUMERIC     0x0001
  62 #define FMT_NOCOUNTS    0x0002
  63 #define FMT_KILOMEGAGIGA 0x0004
  64 #define FMT_OPTIONS     0x0008
  65 #define FMT_NOTABLE     0x0010
  66 #define FMT_NOTARGET    0x0020
  67 #define FMT_VIA         0x0040
  68 #define FMT_NONEWLINE   0x0080
  69 #define FMT_LINENUMBERS 0x0100
  70
  71 #define FMT_PRINT_RULE (FMT_NOCOUNTS | FMT_OPTIONS | FMT_VIA \
  72                         | FMT_NUMERIC | FMT_NOTABLE)
  73 #define FMT(tab,notab) ((format) & FMT_NOTABLE ? (notab) : (tab))
  74
  75
  76 #define CMD_NONE                0x0000U
  77 #define CMD_INSERT              0x0001U
  78 #define CMD_DELETE              0x0002U
  79 #define CMD_DELETE_NUM          0x0004U
  80 #define CMD_REPLACE             0x0008U
  81 #define CMD_APPEND              0x0010U
  82 #define CMD_LIST                0x0020U
  83 #define CMD_FLUSH               0x0040U
  84 #define CMD_ZERO                0x0080U
  85 #define CMD_NEW_CHAIN           0x0100U
  86 #define CMD_DELETE_CHAIN        0x0200U
  87 #define CMD_SET_POLICY          0x0400U
  88 #define CMD_CHECK               0x0800U
  89 #define CMD_RENAME_CHAIN        0x1000U
  90 #define NUMBER_OF_CMD   13
  91 static const char cmdflags[] = { 'I', 'D', 'D', 'R', 'A', 'L', 'F', 'Z',
  92                                  'N', 'X', 'P', 'E' };
  93
  94 #define OPTION_OFFSET 256
  95
  96 #define OPT_NONE        0x00000U
  97 #define OPT_NUMERIC     0x00001U
  98 #define OPT_SOURCE      0x00002U
  99 #define OPT_DESTINATION 0x00004U
 100 #define OPT_PROTOCOL    0x00008U
 101 #define OPT_JUMP        0x00010U
 102 #define OPT_VERBOSE     0x00020U
 103 #define OPT_EXPANDED    0x00040U
 104 #define OPT_VIANAMEIN   0x00080U
 105 #define OPT_VIANAMEOUT  0x00100U
 106 #define OPT_LINENUMBERS 0x00200U
 107 #define OPT_COUNTERS    0x00400U
 108 #define NUMBER_OF_OPT   11
 109 static const char optflags[NUMBER_OF_OPT]
 110 = { 'n', 's', 'd', 'p', 'j', 'v', 'x', 'i', 'o', '3', 'c'};
 111
 112 static struct option original_opts[] = {
 113         { "append", 1, 0, 'A' },
 114         { "delete", 1, 0,  'D' },
 115         { "insert", 1, 0,  'I' },
 116         { "replace", 1, 0,  'R' },
 117         { "list", 2, 0,  'L' },
 118         { "flush", 2, 0,  'F' },
 119         { "zero", 2, 0,  'Z' },
 120         { "new-chain", 1, 0,  'N' },
 121         { "delete-chain", 2, 0,  'X' },
 122         { "rename-chain", 1, 0,  'E' },
 123         { "policy", 1, 0,  'P' },
 124         { "source", 1, 0, 's' },
 125         { "destination", 1, 0,  'd' },
 126         { "src", 1, 0,  's' }, /* synonym */
 127         { "dst", 1, 0,  'd' }, /* synonym */
 128         { "protocol", 1, 0,  'p' },
 129         { "in-interface", 1, 0, 'i' },
 130         { "jump", 1, 0, 'j' },
 131         { "table", 1, 0, 't' },
 132         { "match", 1, 0, 'm' },
 133         { "numeric", 0, 0, 'n' },
 134         { "out-interface", 1, 0, 'o' },
 135         { "verbose", 0, 0, 'v' },
 136         { "exact", 0, 0, 'x' },
 137         { "version", 0, 0, 'V' },
 138         { "help", 2, 0, 'h' },
 139         { "line-numbers", 0, 0, '0' },
 140         { "modprobe", 1, 0, 'M' },
 141         { "set-counters", 1, 0, 'c' },
 142         { 0 }
 143 };
 144
 145 /* we need this for ip6tables-restore. ip6tables-restore.c sets line to the
 146  * current line of the input file, in order to give a more precise error
 147  * message. ip6tables itself doesn't need this, so it is initialized to the
 148  * magic number of -1 */
 149 int line = -1;
 150
 151 #ifndef __OPTIMIZE__
 152 struct ip6t_entry_target *
 153 ip6t_get_target(struct ip6t_entry *e)
 154 {
 155         return (void *)e + e->target_offset;
 156 }
 157 #endif
 158
 159 static struct option *opts = original_opts;
 160 static unsigned int global_option_offset = 0;
 161
 162 /* Table of legal combinations of commands and options.  If any of the
 163  * given commands make an option legal, that option is legal (applies to
 164  * CMD_LIST and CMD_ZERO only).
 165  * Key:
 166  *  +  compulsory
 167  *  x  illegal
 168  *     optional
 169  */
 170
 171 static char commands_v_options[NUMBER_OF_CMD][NUMBER_OF_OPT] =
 172 /* Well, it's better than "Re: Linux vs FreeBSD" */
 173 {
 174         /*     -n  -s  -d  -p  -j  -v  -x  -i  -o  --line */
 175 /*INSERT*/    {'x',' ',' ',' ',' ',' ','x',' ',' ','x'},
 176 /*DELETE*/    {'x',' ',' ',' ',' ',' ','x',' ',' ','x'},
 177 /*DELETE_NUM*/{'x','x','x','x','x',' ','x','x','x','x'},
 178 /*REPLACE*/   {'x',' ',' ',' ',' ',' ','x',' ',' ','x'},
 179 /*APPEND*/    {'x',' ',' ',' ',' ',' ','x',' ',' ','x'},
 180 /*LIST*/      {' ','x','x','x','x',' ',' ','x','x',' '},
 181 /*FLUSH*/     {'x','x','x','x','x',' ','x','x','x','x'},
 182 /*ZERO*/      {'x','x','x','x','x',' ','x','x','x','x'},
 183 /*NEW_CHAIN*/ {'x','x','x','x','x',' ','x','x','x','x'},
 184 /*DEL_CHAIN*/ {'x','x','x','x','x',' ','x','x','x','x'},
 185 /*SET_POLICY*/{'x','x','x','x','x',' ','x','x','x','x'},
 186 /*CHECK*/     {'x','+','+','+','x',' ','x',' ',' ','x'},
 187 /*RENAME*/    {'x','x','x','x','x',' ','x','x','x','x'}
 188 };
 189
 190 static int inverse_for_options[NUMBER_OF_OPT] =
 191 {
 192 /* -n */ 0,
 193 /* -s */ IP6T_INV_SRCIP,
 194 /* -d */ IP6T_INV_DSTIP,
 195 /* -p */ IP6T_INV_PROTO,
 196 /* -j */ 0,
 197 /* -v */ 0,
 198 /* -x */ 0,
 199 /* -i */ IP6T_INV_VIA_IN,
 200 /* -o */ IP6T_INV_VIA_OUT,
 201 /*--line*/ 0
 202 };
 203
 204 const char *program_version;
 205 const char *program_name;
 206
 207 /* Keeping track of external matches and targets: linked lists.  */
 208 struct ip6tables_match *ip6tables_matches = NULL;
 209 struct ip6tables_target *ip6tables_targets = NULL;
 210
 211 /* Extra debugging from libiptc */
 212 extern void dump_entries6(const ip6tc_handle_t handle);
 213
 214 /* A few hardcoded protocols for 'all' and in case the user has no
 215    /etc/protocols */
 216 struct pprot {
 217         char *name;
 218         u_int8_t num;
 219 };
 220
 221 /* Primitive headers... */
 222 /* defined in netinet/in.h */
 223 #if 0
 224 #ifndef IPPROTO_ESP
 225 #define IPPROTO_ESP 50
 226 #endif
 227 #ifndef IPPROTO_AH
 228 #define IPPROTO_AH 51
 229 #endif
 230 #endif
 231
 232 static const struct pprot chain_protos[] = {
 233         { "tcp", IPPROTO_TCP },
 234         { "udp", IPPROTO_UDP },
 235         { "icmpv6", IPPROTO_ICMPV6 },
 236         { "esp", IPPROTO_ESP },
 237         { "ah", IPPROTO_AH },
 238         { "all", 0 },
 239 };
 240
 241 static char *
 242 proto_to_name(u_int8_t proto, int nolookup)
 243 {
 244         unsigned int i;
 245
 246         if (proto && !nolookup) {
 247                 struct protoent *pent = getprotobynumber(proto);
 248                 if (pent)
 249                         return pent->p_name;
 250         }
 251
 252         for (i = 0; i < sizeof(chain_protos)/sizeof(struct pprot); i++)
 253                 if (chain_protos[i].num == proto)
 254                         return chain_protos[i].name;
 255
 256         return NULL;
 257 }
 258
 259 static void
 260 in6addrcpy(struct in6_addr *dst, struct in6_addr *src)
 261 {
 262         memcpy(dst, src, sizeof(struct in6_addr));
 263         /* dst->s6_addr = src->s6_addr; */
 264 }
 265
 266 void
 267 exit_error(enum exittype status, char *msg, ...)
 268 {
 269         va_list args;
 270
 271         va_start(args, msg);
 272         fprintf(stderr, "%s v%s: ", program_name, program_version);
 273         vfprintf(stderr, msg, args);
 274         va_end(args);
 275         fprintf(stderr, "\n");
 276         if (status == PARAMETER_PROBLEM)
 277                 exit_tryhelp(status);
 278         if (status == VERSION_PROBLEM)
 279                 fprintf(stderr,
 280                         "Perhaps iptables or your kernel needs to be upgraded.\n");
 281         exit(status);
 282 }
 283
 284 void
 285 exit_tryhelp(int status)
 286 {
 287         if (line != -1)
 288                 fprintf(stderr, "Error occurred at line: %d\n", line);
 289         fprintf(stderr, "Try `%s -h' or '%s --help' for more information.\n",
 290                         program_name, program_name );
 291         exit(status);
 292 }
 293
 294 void
 295 exit_printhelp(struct ip6tables_rule_match *matches)
 296 {
 297         struct ip6tables_rule_match *matchp = NULL;
 298         struct ip6tables_target *t = NULL;
 299
 300         printf("%s v%s\n\n"
 301 "Usage: %s -[AD] chain rule-specification [options]\n"
 302 "       %s -[RI] chain rulenum rule-specification [options]\n"
 303 "       %s -D chain rulenum [options]\n"
 304 "       %s -[LFZ] [chain] [options]\n"
 305 "       %s -[NX] chain\n"
 306 "       %s -E old-chain-name new-chain-name\n"
 307 "       %s -P chain target [options]\n"
 308 "       %s -h (print this help information)\n\n",
 309                program_name, program_version, program_name, program_name,
 310                program_name, program_name, program_name, program_name,
 311                program_name, program_name);
 312
 313         printf(
 314 "Commands:\n"
 315 "Either long or short options are allowed.\n"
 316 "  --append  -A chain           Append to chain\n"
 317 "  --delete  -D chain           Delete matching rule from chain\n"
 318 "  --delete  -D chain rulenum\n"
 319 "                               Delete rule rulenum (1 = first) from chain\n"
 320 "  --insert  -I chain [rulenum]\n"
 321 "                               Insert in chain as rulenum (default 1=first)\n"
 322 "  --replace -R chain rulenum\n"
 323 "                               Replace rule rulenum (1 = first) in chain\n"
 324 "  --list    -L [chain]         List the rules in a chain or all chains\n"
 325 "  --flush   -F [chain]         Delete all rules in  chain or all chains\n"
 326 "  --zero    -Z [chain]         Zero counters in chain or all chains\n"
 327 "  --new     -N chain           Create a new user-defined chain\n"
 328 "  --delete-chain\n"
 329 "            -X [chain]         Delete a user-defined chain\n"
 330 "  --policy  -P chain target\n"
 331 "                               Change policy on chain to target\n"
 332 "  --rename-chain\n"
 333 "            -E old-chain new-chain\n"
 334 "                               Change chain name, (moving any references)\n"
 335
 336 "Options:\n"
 337 "  --proto      -p [!] proto    protocol: by number or name, eg. `tcp'\n"
 338 "  --source     -s [!] address[/mask]\n"
 339 "                               source specification\n"
 340 "  --destination -d [!] address[/mask]\n"
 341 "                               destination specification\n"
 342 "  --in-interface -i [!] input name[+]\n"
 343 "                               network interface name ([+] for wildcard)\n"
 344 "  --jump       -j target\n"
 345 "                               target for rule (may load target extension)\n"
 346 "  --match      -m match\n"
 347 "                               extended match (may load extension)\n"
 348 "  --numeric    -n              numeric output of addresses and ports\n"
 349 "  --out-interface -o [!] output name[+]\n"
 350 "                               network interface name ([+] for wildcard)\n"
 351 "  --table      -t table        table to manipulate (default: `filter')\n"
 352 "  --verbose    -v              verbose mode\n"
 353 "  --line-numbers               print line numbers when listing\n"
 354 "  --exact      -x              expand numbers (display exact values)\n"
 355 /*"[!] --fragment       -f              match second or further fragments only\n"*/
 356 "  --modprobe=<command>         try to insert modules using this command\n"
 357 "  --set-counters PKTS BYTES    set the counter during insert/append\n"
 358 "[!] --version  -V              print package version.\n");
 359
 360         /* Print out any special helps. A user might like to be able to add a --help
 361            to the commandline, and see expected results. So we call help for all
 362            specified matches & targets */
 363         for (t = ip6tables_targets; t; t = t->next) {
 364                 if (t->used) {
 365                         printf("\n");
 366                         t->help();
 367                 }
 368         }
 369         for (matchp = matches; matchp; matchp = matchp->next) {
 370                 printf("\n");
 371                 matchp->match->help();
 372         }
 373         exit(0);
 374 }
 375
 376 static void
 377 generic_opt_check(int command, int options)
 378 {
 379         int i, j, legal = 0;
 380
 381         /* Check that commands are valid with options.  Complicated by the
 382          * fact that if an option is legal with *any* command given, it is
 383          * legal overall (ie. -z and -l).
 384          */
 385         for (i = 0; i < NUMBER_OF_OPT; i++) {
 386                 legal = 0; /* -1 => illegal, 1 => legal, 0 => undecided. */
 387
 388                 for (j = 0; j < NUMBER_OF_CMD; j++) {
 389                         if (!(command & (1<<j)))
 390                                 continue;
 391
 392                         if (!(options & (1<<i))) {
 393                                 if (commands_v_options[j][i] == '+')
 394                                         exit_error(PARAMETER_PROBLEM,
 395                                                    "You need to supply the `-%c' "
 396                                                    "option for this command\n",
 397                                                    optflags[i]);
 398                         } else {
 399                                 if (commands_v_options[j][i] != 'x')
 400                                         legal = 1;
 401                                 else if (legal == 0)
 402                                         legal = -1;
 403                         }
 404                 }
 405                 if (legal == -1)
 406                         exit_error(PARAMETER_PROBLEM,
 407                                    "Illegal option `-%c' with this command\n",
 408                                    optflags[i]);
 409         }
 410 }
 411
 412 static char
 413 opt2char(int option)
 414 {
 415         const char *ptr;
 416         for (ptr = optflags; option > 1; option >>= 1, ptr++);
 417
 418         return *ptr;
 419 }
 420
 421 static char
 422 cmd2char(int option)
 423 {
 424         const char *ptr;
 425         for (ptr = cmdflags; option > 1; option >>= 1, ptr++);
 426
 427         return *ptr;
 428 }
 429
 430 static void
 431 add_command(int *cmd, const int newcmd, const int othercmds, int invert)
 432 {
 433         if (invert)
 434                 exit_error(PARAMETER_PROBLEM, "unexpected ! flag");
 435         if (*cmd & (~othercmds))
 436                 exit_error(PARAMETER_PROBLEM, "Can't use -%c with -%c\n",
 437                            cmd2char(newcmd), cmd2char(*cmd & (~othercmds)));
 438         *cmd |= newcmd;
 439 }
 440
 441 int
 442 check_inverse(const char option[], int *invert, int *optind, int argc)
 443 {
 444         if (option && strcmp(option, "!") == 0) {
 445                 if (*invert)
 446                         exit_error(PARAMETER_PROBLEM,
 447                                    "Multiple `!' flags not allowed");
 448                 *invert = TRUE;
 449                 if (optind) {
 450                         *optind = *optind+1;
 451                         if (argc && *optind > argc)
 452                                 exit_error(PARAMETER_PROBLEM,
 453                                            "no argument following `!'");
 454                 }
 455
 456                 return TRUE;
 457         }
 458         return FALSE;
 459 }
 460
 461 static void *
 462 fw_calloc(size_t count, size_t size)
 463 {
 464         void *p;
 465
 466         if ((p = calloc(count, size)) == NULL) {
 467                 perror("ip6tables: calloc failed");
 468                 exit(1);
 469         }
 470         return p;
 471 }
 472
 473 static void *
 474 fw_malloc(size_t size)
 475 {
 476         void *p;
 477
 478         if ((p = malloc(size)) == NULL) {
 479                 perror("ip6tables: malloc failed");
 480                 exit(1);
 481         }
 482         return p;
 483 }
 484
 485 static char *
 486 addr_to_numeric(const struct in6_addr *addrp)
 487 {
 488         /* 0000:0000:0000:0000:0000:000.000.000.000
 489          * 0000:0000:0000:0000:0000:0000:0000:0000 */
 490         static char buf[50+1];
 491         return (char *)inet_ntop(AF_INET6, addrp, buf, sizeof(buf));
 492 }
 493
 494 static struct in6_addr *
 495 numeric_to_addr(const char *num)
 496 {
 497         static struct in6_addr ap;
 498         int err;
 499         if ((err=inet_pton(AF_INET6, num, &ap)) == 1)
 500                 return &ap;
 501 #ifdef DEBUG
 502         fprintf(stderr, "\nnumeric2addr: %d\n", err);
 503 #endif
 504         return (struct in6_addr *)NULL;
 505 }
 506
 507
 508 static struct in6_addr *
 509 host_to_addr(const char *name, unsigned int *naddr)
 510 {
 511         struct addrinfo hints;
 512         struct addrinfo *res;
 513         static struct in6_addr *addr;
 514         int err;
 515
 516         memset(&hints, 0, sizeof(hints));
 517         hints.ai_flags=AI_CANONNAME;
 518         hints.ai_family=AF_INET6;
 519         hints.ai_socktype=SOCK_RAW;
 520         hints.ai_protocol=41;
 521         hints.ai_next=NULL;
 522
 523         *naddr = 0;
 524         if ( (err=getaddrinfo(name, NULL, &hints, &res)) != 0 ){
 525 #ifdef DEBUG
 526                 fprintf(stderr,"Name2IP: %s\n",gai_strerror(err));
 527 #endif
 528                 return (struct in6_addr *) NULL;
 529         } else {
 530                 if (res->ai_family != AF_INET6 ||
 531                     res->ai_addrlen != sizeof(struct sockaddr_in6))
 532                         return (struct in6_addr *) NULL;
 533
 534 #ifdef DEBUG
 535                 fprintf(stderr, "resolved: len=%d  %s ", res->ai_addrlen,
 536                     addr_to_numeric(&(((struct sockaddr_in6 *)res->ai_addr)->sin6_addr)));
 537 #endif
 538                 /* Get the first element of the address-chain */
 539                 addr = fw_calloc(1, sizeof(struct in6_addr));
 540                 in6addrcpy(addr, (struct in6_addr *)
 541                         &((struct sockaddr_in6 *)res->ai_addr)->sin6_addr);
 542                 freeaddrinfo(res);
 543                 *naddr = 1;
 544                 return addr;
 545         }
 546
 547         return (struct in6_addr *) NULL;
 548 }
 549
 550 static char *
 551 addr_to_host(const struct in6_addr *addr)
 552 {
 553         struct sockaddr_in6 saddr;
 554         int err;
 555         static char hostname[NI_MAXHOST];
 556
 557         memset(&saddr, 0, sizeof(struct sockaddr_in6));
 558         in6addrcpy(&(saddr.sin6_addr),(struct in6_addr *)addr);
 559         saddr.sin6_family = AF_INET6;
 560
 561         if ( (err=getnameinfo((struct sockaddr *)&saddr,
 562                                sizeof(struct sockaddr_in6),
 563                                hostname, sizeof(hostname)-1,
 564                                NULL, 0, 0)) != 0 ){
 565 #ifdef DEBUG
 566                 fprintf(stderr,"IP2Name: %s\n",gai_strerror(err));
 567 #endif
 568                 return (char *) NULL;
 569         } else {
 570 #ifdef DEBUG
 571                 fprintf (stderr, "\naddr2host: %s\n", hostname);
 572 #endif
 573
 574                 return hostname;
 575         }
 576
 577         return (char *) NULL;
 578 }
 579
 580 static char *
 581 mask_to_numeric(const struct in6_addr *addrp)
 582 {
 583         static char buf[50+2];
 584         int l = ipv6_prefix_length(addrp);
 585         if (l == -1) {
 586                 strcpy(buf, "/");
 587                 strcat(buf, addr_to_numeric(addrp));
 588                 return buf;
 589         }
 590         sprintf(buf, "/%d", l);
 591         return buf;
 592 }
 593
 594 static struct in6_addr *
 595 network_to_addr(const char *name)
 596 {
 597         /*      abort();*/
 598         /* TODO: not implemented yet, but the exception breaks the
 599          *       name resolvation */
 600         return (struct in6_addr *)NULL;
 601 }
 602
 603 static char *
 604 addr_to_anyname(const struct in6_addr *addr)
 605 {
 606         char *name;
 607
 608         if ((name = addr_to_host(addr)) != NULL)
 609                 return name;
 610
 611         return addr_to_numeric(addr);
 612 }
 613
 614 /*
 615  *      All functions starting with "parse" should succeed, otherwise
 616  *      the program fails.
 617  *      Most routines return pointers to static data that may change
 618  *      between calls to the same or other routines with a few exceptions:
 619  *      "host_to_addr", "parse_hostnetwork", and "parse_hostnetworkmask"
 620  *      return global static data.
 621 */
 622
 623 static struct in6_addr *
 624 parse_hostnetwork(const char *name, unsigned int *naddrs)
 625 {
 626         struct in6_addr *addrp, *addrptmp;
 627
 628         if ((addrptmp = numeric_to_addr(name)) != NULL ||
 629             (addrptmp = network_to_addr(name)) != NULL) {
 630                 addrp = fw_malloc(sizeof(struct in6_addr));
 631                 in6addrcpy(addrp, addrptmp);
 632                 *naddrs = 1;
 633                 return addrp;
 634         }
 635         if ((addrp = host_to_addr(name, naddrs)) != NULL)
 636                 return addrp;
 637
 638         exit_error(PARAMETER_PROBLEM, "host/network `%s' not found", name);
 639 }
 640
 641 static struct in6_addr *
 642 parse_mask(char *mask)
 643 {
 644         static struct in6_addr maskaddr;
 645         struct in6_addr *addrp;
 646         unsigned int bits;
 647
 648         if (mask == NULL) {
 649                 /* no mask at all defaults to 128 bits */
 650                 memset(&maskaddr, 0xff, sizeof maskaddr);
 651                 return &maskaddr;
 652         }
 653         if ((addrp = numeric_to_addr(mask)) != NULL)
 654                 return addrp;
 655         if (string_to_number(mask, 0, 128, &bits) == -1)
 656                 exit_error(PARAMETER_PROBLEM,
 657                            "invalid mask `%s' specified", mask);
 658         if (bits != 0) {
 659                 char *p = (char *)&maskaddr;
 660                 memset(p, 0xff, bits / 8);
 661                 memset(p + (bits / 8) + 1, 0, (128 - bits) / 8);
 662                 p[bits / 8] = 0xff << (8 - (bits & 7));
 663                 return &maskaddr;
 664         }
 665
 666         memset(&maskaddr, 0, sizeof maskaddr);
 667         return &maskaddr;
 668 }
 669
 670 void
 671 parse_hostnetworkmask(const char *name, struct in6_addr **addrpp,
 672                       struct in6_addr *maskp, unsigned int *naddrs)
 673 {
 674         struct in6_addr *addrp;
 675         char buf[256];
 676         char *p;
 677         int i, j, n;
 678
 679         strncpy(buf, name, sizeof(buf) - 1);
 680         buf[sizeof(buf) - 1] = '\0';
 681         if ((p = strrchr(buf, '/')) != NULL) {
 682                 *p = '\0';
 683                 addrp = parse_mask(p + 1);
 684         } else
 685                 addrp = parse_mask(NULL);
 686         in6addrcpy(maskp, addrp);
 687
 688         /* if a null mask is given, the name is ignored, like in "any/0" */
 689         if (!memcmp(maskp, &in6addr_any, sizeof(in6addr_any)))
 690                 strcpy(buf, "::");
 691
 692         addrp = *addrpp = parse_hostnetwork(buf, naddrs);
 693         n = *naddrs;
 694         for (i = 0, j = 0; i < n; i++) {
 695                 int k;
 696                 for (k = 0; k < 4; k++)
 697                         addrp[j].in6_u.u6_addr32[k] &= maskp->in6_u.u6_addr32[k];
 698                 j++;
 699                 for (k = 0; k < j - 1; k++) {
 700                         if (IN6_ARE_ADDR_EQUAL(&addrp[k], &addrp[j - 1])) {
 701                                 (*naddrs)--;
 702                                 j--;
 703                                 break;
 704                         }
 705                 }
 706         }
 707 }
 708
 709 struct ip6tables_match *
 710 find_match(const char *name, enum ip6t_tryload tryload, struct ip6tables_rule_match **matches)
 711 {
 712         struct ip6tables_match *ptr;
 713         int icmphack = 0;
 714
 715         /* This is ugly as hell. Nonetheless, there is no way of changing
 716          * this without hurting backwards compatibility */
 717         if ( (strcmp(name,"icmpv6") == 0) ||
 718              (strcmp(name,"ipv6-icmp") == 0) ||
 719              (strcmp(name,"icmp6") == 0) ) icmphack = 1;
 720
 721         if (!icmphack) {
 722                 for (ptr = ip6tables_matches; ptr; ptr = ptr->next) {
 723                         if (strcmp(name, ptr->name) == 0)
 724                                 break;
 725                 }
 726         } else {
 727                 for (ptr = ip6tables_matches; ptr; ptr = ptr->next) {
 728                         if (strcmp("icmp6", ptr->name) == 0)
 729                                 break;
 730                 }
 731         }
 732
 733 #ifndef NO_SHARED_LIBS
 734         if (!ptr && tryload != DONT_LOAD) {
 735                 char path[sizeof(IP6T_LIB_DIR) + sizeof("/libip6t_.so")
 736                          + strlen(name)];
 737                 if (!icmphack)
 738                         sprintf(path, IP6T_LIB_DIR "/libip6t_%s.so", name);
 739                 else
 740                         sprintf(path, IP6T_LIB_DIR "/libip6t_%s.so", "icmpv6");
 741                 if (dlopen(path, RTLD_NOW)) {
 742                         /* Found library.  If it didn't register itself,
 743                            maybe they specified target as match. */
 744                         ptr = find_match(name, DONT_LOAD, NULL);
 745
 746                         if (!ptr)
 747                                 exit_error(PARAMETER_PROBLEM,
 748                                            "Couldn't load match `%s'\n",
 749                                            name);
 750                 } else if (tryload == LOAD_MUST_SUCCEED)
 751                         exit_error(PARAMETER_PROBLEM,
 752                                    "Couldn't load match `%s':%s\n",
 753                                    name, dlerror());
 754         }
 755 #else
 756         if (ptr && !ptr->loaded) {
 757                 if (tryload != DONT_LOAD)
 758                         ptr->loaded = 1;
 759                 else
 760                         ptr = NULL;
 761         }
 762         if(!ptr && (tryload == LOAD_MUST_SUCCEED)) {
 763                 exit_error(PARAMETER_PROBLEM,
 764                            "Couldn't find match `%s'\n", name);
 765         }
 766 #endif
 767
 768         if (ptr && matches) {
 769                 struct ip6tables_rule_match **i;
 770                 struct ip6tables_rule_match *newentry;
 771
 772                 newentry = fw_malloc(sizeof(struct ip6tables_rule_match));
 773
 774                 for (i = matches; *i; i = &(*i)->next);
 775                 newentry->match = ptr;
 776                 newentry->next = NULL;
 777                 *i = newentry;
 778         }
 779
 780         return ptr;
 781 }
 782
 783 /* Christophe Burki wants `-p 6' to imply `-m tcp'.  */
 784 static struct ip6tables_match *
 785 find_proto(const char *pname, enum ip6t_tryload tryload, int nolookup, struct ip6tables_rule_match **matches)
 786 {
 787         unsigned int proto;
 788
 789         if (string_to_number(pname, 0, 255, &proto) != -1) {
 790                 char *protoname = proto_to_name(proto, nolookup);
 791
 792                 if (protoname)
 793                         return find_match(protoname, tryload, matches);
 794         } else
 795                 return find_match(pname, tryload, matches);
 796
 797         return NULL;
 798 }
 799
 800 u_int16_t
 801 parse_protocol(const char *s)
 802 {
 803         unsigned int proto;
 804
 805         if (string_to_number(s, 0, 255, &proto) == -1) {
 806                 struct protoent *pent;
 807
 808                 if ((pent = getprotobyname(s)))
 809                         proto = pent->p_proto;
 810                 else {
 811                         unsigned int i;
 812                         for (i = 0;
 813                              i < sizeof(chain_protos)/sizeof(struct pprot);
 814                              i++) {
 815                                 if (strcmp(s, chain_protos[i].name) == 0) {
 816                                         proto = chain_protos[i].num;
 817                                         break;
 818                                 }
 819                         }
 820                         if (i == sizeof(chain_protos)/sizeof(struct pprot))
 821                                 exit_error(PARAMETER_PROBLEM,
 822                                            "unknown protocol `%s' specified",
 823                                            s);
 824                 }
 825         }
 826
 827         return (u_int16_t)proto;
 828 }
 829
 830 static void
 831 parse_interface(const char *arg, char *vianame, unsigned char *mask)
 832 {
 833         int vialen = strlen(arg);
 834         unsigned int i;
 835
 836         memset(mask, 0, IFNAMSIZ);
 837         memset(vianame, 0, IFNAMSIZ);
 838
 839         if (vialen + 1 > IFNAMSIZ)
 840                 exit_error(PARAMETER_PROBLEM,
 841                            "interface name `%s' must be shorter than IFNAMSIZ"
 842                            " (%i)", arg, IFNAMSIZ-1);
 843
 844         strcpy(vianame, arg);
 845         if ((vialen == 0) || (vialen == 1 && vianame[0] == '+'))
 846                 memset(mask, 0, IFNAMSIZ);
 847         else if (vianame[vialen - 1] == '+') {
 848                 memset(mask, 0xFF, vialen - 1);
 849                 memset(mask + vialen - 1, 0, IFNAMSIZ - vialen + 1);
 850                 /* Don't remove `+' here! -HW */
 851         } else {
 852                 /* Include nul-terminator in match */
 853                 memset(mask, 0xFF, vialen + 1);
 854                 memset(mask + vialen + 1, 0, IFNAMSIZ - vialen - 1);
 855                 for (i = 0; vianame[i]; i++) {
 856                         if (!isalnum(vianame[i])
 857                             && vianame[i] != '_'
 858                             && vianame[i] != '.') {
 859                                 printf("Warning: wierd character in interface"
 860                                        " `%s' (No aliases, :, ! or *).\n",
 861                                        vianame);
 862                                 break;
 863                         }
 864                 }
 865         }
 866 }
 867
 868 /* Can't be zero. */
 869 static int
 870 parse_rulenumber(const char *rule)
 871 {
 872         unsigned int rulenum;
 873
 874         if (string_to_number(rule, 1, INT_MAX, &rulenum) == -1)
 875                 exit_error(PARAMETER_PROBLEM,
 876                            "Invalid rule number `%s'", rule);
 877
 878         return rulenum;
 879 }
 880
 881 static const char *
 882 parse_target(const char *targetname)
 883 {
 884         const char *ptr;
 885
 886         if (strlen(targetname) < 1)
 887                 exit_error(PARAMETER_PROBLEM,
 888                            "Invalid target name (too short)");
 889
 890         if (strlen(targetname)+1 > sizeof(ip6t_chainlabel))
 891                 exit_error(PARAMETER_PROBLEM,
 892                            "Invalid target name `%s' (%u chars max)",
 893                            targetname, (unsigned int)sizeof(ip6t_chainlabel)-1);
 894
 895         for (ptr = targetname; *ptr; ptr++)
 896                 if (isspace(*ptr))
 897                         exit_error(PARAMETER_PROBLEM,
 898                                    "Invalid target name `%s'", targetname);
 899         return targetname;
 900 }
 901
 902 int
 903 string_to_number_ll(const char *s, unsigned long long min, unsigned long long max,
 904                  unsigned long long *ret)
 905 {
 906         unsigned long long number;
 907         char *end;
 908
 909         /* Handle hex, octal, etc. */
 910         errno = 0;
 911         number = strtoull(s, &end, 0);
 912         if (*end == '\0' && end != s) {
 913                 /* we parsed a number, let's see if we want this */
 914                 if (errno != ERANGE && min <= number && (!max || number <= max)) {
 915                         *ret = number;
 916                         return 0;
 917                 }
 918         }
 919         return -1;
 920 }
 921
 922 int
 923 string_to_number_l(const char *s, unsigned long min, unsigned long max,
 924                  unsigned long *ret)
 925 {
 926         int result;
 927         unsigned long long number;
 928
 929         result = string_to_number_ll(s, min, max, &number);
 930         *ret = (unsigned long)number;
 931
 932         return result;
 933 }
 934
 935 int string_to_number(const char *s, unsigned int min, unsigned int max,
 936                 unsigned int *ret)
 937 {
 938         int result;
 939         unsigned long number;
 940
 941         result = string_to_number_l(s, min, max, &number);
 942         *ret = (unsigned int)number;
 943
 944         return result;
 945 }
 946
 947 static void
 948 set_option(unsigned int *options, unsigned int option, u_int8_t *invflg,
 949            int invert)
 950 {
 951         if (*options & option)
 952                 exit_error(PARAMETER_PROBLEM, "multiple -%c flags not allowed",
 953                            opt2char(option));
 954         *options |= option;
 955
 956         if (invert) {
 957                 unsigned int i;
 958                 for (i = 0; 1 << i != option; i++);
 959
 960                 if (!inverse_for_options[i])
 961                         exit_error(PARAMETER_PROBLEM,
 962                                    "cannot have ! before -%c",
 963                                    opt2char(option));
 964                 *invflg |= inverse_for_options[i];
 965         }
 966 }
 967
 968 struct ip6tables_target *
 969 find_target(const char *name, enum ip6t_tryload tryload)
 970 {
 971         struct ip6tables_target *ptr;
 972
 973         /* Standard target? */
 974         if (strcmp(name, "") == 0
 975             || strcmp(name, IP6TC_LABEL_ACCEPT) == 0
 976             || strcmp(name, IP6TC_LABEL_DROP) == 0
 977             || strcmp(name, IP6TC_LABEL_QUEUE) == 0
 978             || strcmp(name, IP6TC_LABEL_RETURN) == 0)
 979                 name = "standard";
 980
 981         for (ptr = ip6tables_targets; ptr; ptr = ptr->next) {
 982                 if (strcmp(name, ptr->name) == 0)
 983                         break;
 984         }
 985
 986 #ifndef NO_SHARED_LIBS
 987         if (!ptr && tryload != DONT_LOAD) {
 988                 char path[sizeof(IP6T_LIB_DIR) + sizeof("/libip6t_.so")
 989                          + strlen(name)];
 990                 sprintf(path, IP6T_LIB_DIR "/libip6t_%s.so", name);
 991                 if (dlopen(path, RTLD_NOW)) {
 992                         /* Found library.  If it didn't register itself,
 993                            maybe they specified match as a target. */
 994                         ptr = find_target(name, DONT_LOAD);
 995                         if (!ptr)
 996                                 exit_error(PARAMETER_PROBLEM,
 997                                            "Couldn't load target `%s'\n",
 998                                            name);
 999                 } else if (tryload == LOAD_MUST_SUCCEED)
1000                         exit_error(PARAMETER_PROBLEM,
1001                                    "Couldn't load target `%s':%s\n",
1002                                    name, dlerror());
1003         }
1004 #else
1005         if (ptr && !ptr->loaded) {
1006                 if (tryload != DONT_LOAD)
1007                         ptr->loaded = 1;
1008                 else
1009                         ptr = NULL;
1010         }
1011         if(!ptr && (tryload == LOAD_MUST_SUCCEED)) {
1012                 exit_error(PARAMETER_PROBLEM,
1013                            "Couldn't find target `%s'\n", name);
1014         }
1015 #endif
1016
1017         if (ptr)
1018                 ptr->used = 1;
1019
1020         return ptr;
1021 }
1022
1023 static struct option *
1024 merge_options(struct option *oldopts, const struct option *newopts,
1025               unsigned int *option_offset)
1026 {
1027         unsigned int num_old, num_new, i;
1028         struct option *merge;
1029
1030         for (num_old = 0; oldopts[num_old].name; num_old++);
1031         for (num_new = 0; newopts[num_new].name; num_new++);
1032
1033         global_option_offset += OPTION_OFFSET;
1034         *option_offset = global_option_offset;
1035
1036         merge = malloc(sizeof(struct option) * (num_new + num_old + 1));
1037         memcpy(merge, oldopts, num_old * sizeof(struct option));
1038         for (i = 0; i < num_new; i++) {
1039                 merge[num_old + i] = newopts[i];
1040                 merge[num_old + i].val += *option_offset;
1041         }
1042         memset(merge + num_old + num_new, 0, sizeof(struct option));
1043
1044         return merge;
1045 }
1046
1047 void
1048 register_match6(struct ip6tables_match *me)
1049 {
1050         struct ip6tables_match **i;
1051
1052         if (strcmp(me->version, program_version) != 0) {
1053                 fprintf(stderr, "%s: match `%s' v%s (I'm v%s).\n",
1054                         program_name, me->name, me->version, program_version);
1055                 exit(1);
1056         }
1057
1058         if (find_match(me->name, DONT_LOAD, NULL)) {
1059                 fprintf(stderr, "%s: match `%s' already registered.\n",
1060                         program_name, me->name);
1061                 exit(1);
1062         }
1063
1064         if (me->size != IP6T_ALIGN(me->size)) {
1065                 fprintf(stderr, "%s: match `%s' has invalid size %u.\n",
1066                         program_name, me->name, (unsigned int)me->size);
1067                 exit(1);
1068         }
1069
1070         /* Append to list. */
1071         for (i = &ip6tables_matches; *i; i = &(*i)->next);
1072         me->next = NULL;
1073         *i = me;
1074
1075         me->m = NULL;
1076         me->mflags = 0;
1077 }
1078
1079 void
1080 register_target6(struct ip6tables_target *me)
1081 {
1082         if (strcmp(me->version, program_version) != 0) {
1083                 fprintf(stderr, "%s: target `%s' v%s (I'm v%s).\n",
1084                         program_name, me->name, me->version, program_version);
1085                 exit(1);
1086         }
1087
1088         if (find_target(me->name, DONT_LOAD)) {
1089                 fprintf(stderr, "%s: target `%s' already registered.\n",
1090                         program_name, me->name);
1091                 exit(1);
1092         }
1093
1094         if (me->size != IP6T_ALIGN(me->size)) {
1095                 fprintf(stderr, "%s: target `%s' has invalid size %u.\n",
1096                         program_name, me->name, (unsigned int)me->size);
1097                 exit(1);
1098         }
1099
1100         /* Prepend to list. */
1101         me->next = ip6tables_targets;
1102         ip6tables_targets = me;
1103         me->t = NULL;
1104         me->tflags = 0;
1105 }
1106
1107 static void
1108 print_num(u_int64_t number, unsigned int format)
1109 {
1110         if (format & FMT_KILOMEGAGIGA) {
1111                 if (number > 99999) {
1112                         number = (number + 500) / 1000;
1113                         if (number > 9999) {
1114                                 number = (number + 500) / 1000;
1115                                 if (number > 9999) {
1116                                         number = (number + 500) / 1000;
1117                                         if (number > 9999) {
1118                                                 number = (number + 500) / 1000;
1119                                                 printf(FMT("%4lluT ","%lluT "), (unsigned long long)number);
1120                                         }
1121                                         else printf(FMT("%4lluG ","%lluG "), (unsigned long long)number);
1122                                 }
1123                                 else printf(FMT("%4lluM ","%lluM "), (unsigned long long)number);
1124                         } else
1125                                 printf(FMT("%4lluK ","%lluK "), (unsigned long long)number);
1126                 } else
1127                         printf(FMT("%5llu ","%llu "), (unsigned long long)number);
1128         } else
1129                 printf(FMT("%8llu ","%llu "), (unsigned long long)number);
1130 }
1131
1132
1133 static void
1134 print_header(unsigned int format, const char *chain, ip6tc_handle_t *handle)
1135 {
1136         struct ip6t_counters counters;
1137         const char *pol = ip6tc_get_policy(chain, &counters, handle);
1138         printf("Chain %s", chain);
1139         if (pol) {
1140                 printf(" (policy %s", pol);
1141                 if (!(format & FMT_NOCOUNTS)) {
1142                         fputc(' ', stdout);
1143                         print_num(counters.pcnt, (format|FMT_NOTABLE));
1144                         fputs("packets, ", stdout);
1145                         print_num(counters.bcnt, (format|FMT_NOTABLE));
1146                         fputs("bytes", stdout);
1147                 }
1148                 printf(")\n");
1149         } else {
1150                 unsigned int refs;
1151                 if (!ip6tc_get_references(&refs, chain, handle))
1152                         printf(" (ERROR obtaining refs)\n");
1153                 else
1154                         printf(" (%u references)\n", refs);
1155         }
1156
1157         if (format & FMT_LINENUMBERS)
1158                 printf(FMT("%-4s ", "%s "), "num");
1159         if (!(format & FMT_NOCOUNTS)) {
1160                 if (format & FMT_KILOMEGAGIGA) {
1161                         printf(FMT("%5s ","%s "), "pkts");
1162                         printf(FMT("%5s ","%s "), "bytes");
1163                 } else {
1164                         printf(FMT("%8s ","%s "), "pkts");
1165                         printf(FMT("%10s ","%s "), "bytes");
1166                 }
1167         }
1168         if (!(format & FMT_NOTARGET))
1169                 printf(FMT("%-9s ","%s "), "target");
1170         fputs(" prot ", stdout);
1171         if (format & FMT_OPTIONS)
1172                 fputs("opt", stdout);
1173         if (format & FMT_VIA) {
1174                 printf(FMT(" %-6s ","%s "), "in");
1175                 printf(FMT("%-6s ","%s "), "out");
1176         }
1177         printf(FMT(" %-19s ","%s "), "source");
1178         printf(FMT(" %-19s "," %s "), "destination");
1179         printf("\n");
1180 }
1181
1182
1183 static int
1184 print_match(const struct ip6t_entry_match *m,
1185             const struct ip6t_ip6 *ip,
1186             int numeric)
1187 {
1188         struct ip6tables_match *match = find_match(m->u.user.name, TRY_LOAD, NULL);
1189
1190         if (match) {
1191                 if (match->print)
1192                         match->print(ip, m, numeric);
1193                 else
1194                         printf("%s ", match->name);
1195         } else {
1196                 if (m->u.user.name[0])
1197                         printf("UNKNOWN match `%s' ", m->u.user.name);
1198         }
1199         /* Don't stop iterating. */
1200         return 0;
1201 }
1202
1203 /* e is called `fw' here for hysterical raisins */
1204 static void
1205 print_firewall(const struct ip6t_entry *fw,
1206                const char *targname,
1207                unsigned int num,
1208                unsigned int format,
1209                const ip6tc_handle_t handle)
1210 {
1211         struct ip6tables_target *target = NULL;
1212         const struct ip6t_entry_target *t;
1213         u_int8_t flags;
1214         char buf[BUFSIZ];
1215
1216         if (!ip6tc_is_chain(targname, handle))
1217                 target = find_target(targname, TRY_LOAD);
1218         else
1219                 target = find_target(IP6T_STANDARD_TARGET, LOAD_MUST_SUCCEED);
1220
1221         t = ip6t_get_target((struct ip6t_entry *)fw);
1222         flags = fw->ipv6.flags;
1223
1224         if (format & FMT_LINENUMBERS)
1225                 printf(FMT("%-4u ", "%u "), num+1);
1226
1227         if (!(format & FMT_NOCOUNTS)) {
1228                 print_num(fw->counters.pcnt, format);
1229                 print_num(fw->counters.bcnt, format);
1230         }
1231
1232         if (!(format & FMT_NOTARGET))
1233                 printf(FMT("%-9s ", "%s "), targname);
1234
1235         fputc(fw->ipv6.invflags & IP6T_INV_PROTO ? '!' : ' ', stdout);
1236         {
1237                 char *pname = proto_to_name(fw->ipv6.proto, format&FMT_NUMERIC);
1238                 if (pname)
1239                         printf(FMT("%-5s", "%s "), pname);
1240                 else
1241                         printf(FMT("%-5hu", "%hu "), fw->ipv6.proto);
1242         }
1243
1244         if (format & FMT_OPTIONS) {
1245                 if (format & FMT_NOTABLE)
1246                         fputs("opt ", stdout);
1247                 fputc(' ', stdout); /* Invert flag of FRAG */
1248                 fputc(' ', stdout); /* -f */
1249                 fputc(' ', stdout);
1250         }
1251
1252         if (format & FMT_VIA) {
1253                 char iface[IFNAMSIZ+2];
1254
1255                 if (fw->ipv6.invflags & IP6T_INV_VIA_IN) {
1256                         iface[0] = '!';
1257                         iface[1] = '\0';
1258                 }
1259                 else iface[0] = '\0';
1260
1261                 if (fw->ipv6.iniface[0] != '\0') {
1262                         strcat(iface, fw->ipv6.iniface);
1263                 }
1264                 else if (format & FMT_NUMERIC) strcat(iface, "*");
1265                 else strcat(iface, "any");
1266                 printf(FMT(" %-6s ","in %s "), iface);
1267
1268                 if (fw->ipv6.invflags & IP6T_INV_VIA_OUT) {
1269                         iface[0] = '!';
1270                         iface[1] = '\0';
1271                 }
1272                 else iface[0] = '\0';
1273
1274                 if (fw->ipv6.outiface[0] != '\0') {
1275                         strcat(iface, fw->ipv6.outiface);
1276                 }
1277                 else if (format & FMT_NUMERIC) strcat(iface, "*");
1278                 else strcat(iface, "any");
1279                 printf(FMT("%-6s ","out %s "), iface);
1280         }
1281
1282         fputc(fw->ipv6.invflags & IP6T_INV_SRCIP ? '!' : ' ', stdout);
1283         if (!memcmp(&fw->ipv6.smsk, &in6addr_any, sizeof in6addr_any)
1284             && !(format & FMT_NUMERIC))
1285                 printf(FMT("%-19s ","%s "), "anywhere");
1286         else {
1287                 if (format & FMT_NUMERIC)
1288                         sprintf(buf, "%s", addr_to_numeric(&(fw->ipv6.src)));
1289                 else
1290                         sprintf(buf, "%s", addr_to_anyname(&(fw->ipv6.src)));
1291                 strcat(buf, mask_to_numeric(&(fw->ipv6.smsk)));
1292                 printf(FMT("%-19s ","%s "), buf);
1293         }
1294
1295         fputc(fw->ipv6.invflags & IP6T_INV_DSTIP ? '!' : ' ', stdout);
1296         if (!memcmp(&fw->ipv6.dmsk, &in6addr_any, sizeof in6addr_any)
1297             && !(format & FMT_NUMERIC))
1298                 printf(FMT("%-19s","-> %s"), "anywhere");
1299         else {
1300                 if (format & FMT_NUMERIC)
1301                         sprintf(buf, "%s", addr_to_numeric(&(fw->ipv6.dst)));
1302                 else
1303                         sprintf(buf, "%s", addr_to_anyname(&(fw->ipv6.dst)));
1304                 strcat(buf, mask_to_numeric(&(fw->ipv6.dmsk)));
1305                 printf(FMT("%-19s","-> %s"), buf);
1306         }
1307
1308         if (format & FMT_NOTABLE)
1309                 fputs("  ", stdout);
1310
1311         IP6T_MATCH_ITERATE(fw, print_match, &fw->ipv6, format & FMT_NUMERIC);
1312
1313         if (target) {
1314                 if (target->print)
1315                         /* Print the target information. */
1316                         target->print(&fw->ipv6, t, format & FMT_NUMERIC);
1317         } else if (t->u.target_size != sizeof(*t))
1318                 printf("[%u bytes of unknown target data] ",
1319                        (unsigned int)(t->u.target_size - sizeof(*t)));
1320
1321         if (!(format & FMT_NONEWLINE))
1322                 fputc('\n', stdout);
1323 }
1324
1325 static void
1326 print_firewall_line(const struct ip6t_entry *fw,
1327                     const ip6tc_handle_t h)
1328 {
1329         struct ip6t_entry_target *t;
1330
1331         t = ip6t_get_target((struct ip6t_entry *)fw);
1332         print_firewall(fw, t->u.user.name, 0, FMT_PRINT_RULE, h);
1333 }
1334
1335 static int
1336 append_entry(const ip6t_chainlabel chain,
1337              struct ip6t_entry *fw,
1338              unsigned int nsaddrs,
1339              const struct in6_addr saddrs[],
1340              unsigned int ndaddrs,
1341              const struct in6_addr daddrs[],
1342              int verbose,
1343              ip6tc_handle_t *handle)
1344 {
1345         unsigned int i, j;
1346         int ret = 1;
1347
1348         for (i = 0; i < nsaddrs; i++) {
1349                 fw->ipv6.src = saddrs[i];
1350                 for (j = 0; j < ndaddrs; j++) {
1351                         fw->ipv6.dst = daddrs[j];
1352                         if (verbose)
1353                                 print_firewall_line(fw, *handle);
1354                         ret &= ip6tc_append_entry(chain, fw, handle);
1355                 }
1356         }
1357
1358         return ret;
1359 }
1360
1361 static int
1362 replace_entry(const ip6t_chainlabel chain,
1363               struct ip6t_entry *fw,
1364               unsigned int rulenum,
1365               const struct in6_addr *saddr,
1366               const struct in6_addr *daddr,
1367               int verbose,
1368               ip6tc_handle_t *handle)
1369 {
1370         fw->ipv6.src = *saddr;
1371         fw->ipv6.dst = *daddr;
1372
1373         if (verbose)
1374                 print_firewall_line(fw, *handle);
1375         return ip6tc_replace_entry(chain, fw, rulenum, handle);
1376 }
1377
1378 static int
1379 insert_entry(const ip6t_chainlabel chain,
1380              struct ip6t_entry *fw,
1381              unsigned int rulenum,
1382              unsigned int nsaddrs,
1383              const struct in6_addr saddrs[],
1384              unsigned int ndaddrs,
1385              const struct in6_addr daddrs[],
1386              int verbose,
1387              ip6tc_handle_t *handle)
1388 {
1389         unsigned int i, j;
1390         int ret = 1;
1391
1392         for (i = 0; i < nsaddrs; i++) {
1393                 fw->ipv6.src = saddrs[i];
1394                 for (j = 0; j < ndaddrs; j++) {
1395                         fw->ipv6.dst = daddrs[j];
1396                         if (verbose)
1397                                 print_firewall_line(fw, *handle);
1398                         ret &= ip6tc_insert_entry(chain, fw, rulenum, handle);
1399                 }
1400         }
1401
1402         return ret;
1403 }
1404
1405 static unsigned char *
1406 make_delete_mask(struct ip6t_entry *fw, struct ip6tables_rule_match *matches)
1407 {
1408         /* Establish mask for comparison */
1409         unsigned int size;
1410         struct ip6tables_rule_match *matchp;
1411         unsigned char *mask, *mptr;
1412
1413         size = sizeof(struct ip6t_entry);
1414         for (matchp = matches; matchp; matchp = matchp->next)
1415                 size += IP6T_ALIGN(sizeof(struct ip6t_entry_match)) + matchp->match->size;
1416
1417         mask = fw_calloc(1, size
1418                          + IP6T_ALIGN(sizeof(struct ip6t_entry_target))
1419                          + ip6tables_targets->size);
1420
1421         memset(mask, 0xFF, sizeof(struct ip6t_entry));
1422         mptr = mask + sizeof(struct ip6t_entry);
1423
1424         for (matchp = matches; matchp; matchp = matchp->next) {
1425                 memset(mptr, 0xFF,
1426                        IP6T_ALIGN(sizeof(struct ip6t_entry_match))
1427                        + matchp->match->userspacesize);
1428                 mptr += IP6T_ALIGN(sizeof(struct ip6t_entry_match)) + matchp->match->size;
1429         }
1430
1431         memset(mptr, 0xFF,
1432                IP6T_ALIGN(sizeof(struct ip6t_entry_target))
1433                + ip6tables_targets->userspacesize);
1434
1435         return mask;
1436 }
1437
1438 static int
1439 delete_entry(const ip6t_chainlabel chain,
1440              struct ip6t_entry *fw,
1441              unsigned int nsaddrs,
1442              const struct in6_addr saddrs[],
1443              unsigned int ndaddrs,
1444              const struct in6_addr daddrs[],
1445              int verbose,
1446              ip6tc_handle_t *handle,
1447              struct ip6tables_rule_match *matches)
1448 {
1449         unsigned int i, j;
1450         int ret = 1;
1451         unsigned char *mask;
1452
1453         mask = make_delete_mask(fw, matches);
1454         for (i = 0; i < nsaddrs; i++) {
1455                 fw->ipv6.src = saddrs[i];
1456                 for (j = 0; j < ndaddrs; j++) {
1457                         fw->ipv6.dst = daddrs[j];
1458                         if (verbose)
1459                                 print_firewall_line(fw, *handle);
1460                         ret &= ip6tc_delete_entry(chain, fw, mask, handle);
1461                 }
1462         }
1463         free(mask);
1464
1465         return ret;
1466 }
1467
1468 int
1469 for_each_chain(int (*fn)(const ip6t_chainlabel, int, ip6tc_handle_t *),
1470                int verbose, int builtinstoo, ip6tc_handle_t *handle)
1471 {
1472         int ret = 1;
1473         const char *chain;
1474         char *chains;
1475         unsigned int i, chaincount = 0;
1476
1477         chain = ip6tc_first_chain(handle);
1478         while (chain) {
1479                 chaincount++;
1480                 chain = ip6tc_next_chain(handle);
1481         }
1482
1483         chains = fw_malloc(sizeof(ip6t_chainlabel) * chaincount);
1484         i = 0;
1485         chain = ip6tc_first_chain(handle);
1486         while (chain) {
1487                 strcpy(chains + i*sizeof(ip6t_chainlabel), chain);
1488                 i++;
1489                 chain = ip6tc_next_chain(handle);
1490         }
1491
1492         for (i = 0; i < chaincount; i++) {
1493                 if (!builtinstoo
1494                     && ip6tc_builtin(chains + i*sizeof(ip6t_chainlabel),
1495                                     *handle))
1496                         continue;
1497                 ret &= fn(chains + i*sizeof(ip6t_chainlabel), verbose, handle);
1498         }
1499
1500         free(chains);
1501         return ret;
1502 }
1503
1504 int
1505 flush_entries(const ip6t_chainlabel chain, int verbose,
1506               ip6tc_handle_t *handle)
1507 {
1508         if (!chain)
1509                 return for_each_chain(flush_entries, verbose, 1, handle);
1510
1511         if (verbose)
1512                 fprintf(stdout, "Flushing chain `%s'\n", chain);
1513         return ip6tc_flush_entries(chain, handle);
1514 }
1515
1516 static int
1517 zero_entries(const ip6t_chainlabel chain, int verbose,
1518              ip6tc_handle_t *handle)
1519 {
1520         if (!chain)
1521                 return for_each_chain(zero_entries, verbose, 1, handle);
1522
1523         if (verbose)
1524                 fprintf(stdout, "Zeroing chain `%s'\n", chain);
1525         return ip6tc_zero_entries(chain, handle);
1526 }
1527
1528 int
1529 delete_chain(const ip6t_chainlabel chain, int verbose,
1530              ip6tc_handle_t *handle)
1531 {
1532         if (!chain)
1533                 return for_each_chain(delete_chain, verbose, 0, handle);
1534
1535         if (verbose)
1536                 fprintf(stdout, "Deleting chain `%s'\n", chain);
1537         return ip6tc_delete_chain(chain, handle);
1538 }
1539
1540 static int
1541 list_entries(const ip6t_chainlabel chain, int verbose, int numeric,
1542              int expanded, int linenumbers, ip6tc_handle_t *handle)
1543 {
1544         int found = 0;
1545         unsigned int format;
1546         const char *this;
1547
1548         format = FMT_OPTIONS;
1549         if (!verbose)
1550                 format |= FMT_NOCOUNTS;
1551         else
1552                 format |= FMT_VIA;
1553
1554         if (numeric)
1555                 format |= FMT_NUMERIC;
1556
1557         if (!expanded)
1558                 format |= FMT_KILOMEGAGIGA;
1559
1560         if (linenumbers)
1561                 format |= FMT_LINENUMBERS;
1562
1563         for (this = ip6tc_first_chain(handle);
1564              this;
1565              this = ip6tc_next_chain(handle)) {
1566                 const struct ip6t_entry *i;
1567                 unsigned int num;
1568
1569                 if (chain && strcmp(chain, this) != 0)
1570                         continue;
1571
1572                 if (found) printf("\n");
1573
1574                 print_header(format, this, handle);
1575                 i = ip6tc_first_rule(this, handle);
1576
1577                 num = 0;
1578                 while (i) {
1579                         print_firewall(i,
1580                                        ip6tc_get_target(i, handle),
1581                                        num++,
1582                                        format,
1583                                        *handle);
1584                         i = ip6tc_next_rule(i, handle);
1585                 }
1586                 found = 1;
1587         }
1588
1589         errno = ENOENT;
1590         return found;
1591 }
1592
1593 static char *get_modprobe(void)
1594 {
1595         int procfile;
1596         char *ret;
1597
1598         procfile = open(PROC_SYS_MODPROBE, O_RDONLY);
1599         if (procfile < 0)
1600                 return NULL;
1601
1602         ret = malloc(1024);
1603         if (ret) {
1604                 switch (read(procfile, ret, 1024)) {
1605                 case -1: goto fail;
1606                 case 1024: goto fail; /* Partial read.  Wierd */
1607                 }
1608                 if (ret[strlen(ret)-1]=='\n')
1609                         ret[strlen(ret)-1]=0;
1610                 close(procfile);
1611                 return ret;
1612         }
1613  fail:
1614         free(ret);
1615         close(procfile);
1616         return NULL;
1617 }
1618
1619 int ip6tables_insmod(const char *modname, const char *modprobe)
1620 {
1621         char *buf = NULL;
1622         char *argv[3];
1623
1624         /* If they don't explicitly set it, read out of kernel */
1625         if (!modprobe) {
1626                 buf = get_modprobe();
1627                 if (!buf)
1628                         return -1;
1629                 modprobe = buf;
1630         }
1631
1632         switch (fork()) {
1633         case 0:
1634                 argv[0] = (char *)modprobe;
1635                 argv[1] = (char *)modname;
1636                 argv[2] = NULL;
1637                 execv(argv[0], argv);
1638
1639                 /* not usually reached */
1640                 exit(0);
1641         case -1:
1642                 return -1;
1643
1644         default: /* parent */
1645                 wait(NULL);
1646         }
1647
1648         free(buf);
1649         return 0;
1650 }
1651
1652 static struct ip6t_entry *
1653 generate_entry(const struct ip6t_entry *fw,
1654                struct ip6tables_rule_match *matches,
1655                struct ip6t_entry_target *target)
1656 {
1657         unsigned int size;
1658         struct ip6tables_rule_match *matchp;
1659         struct ip6t_entry *e;
1660
1661         size = sizeof(struct ip6t_entry);
1662         for (matchp = matches; matchp; matchp = matchp->next)
1663                 size += matchp->match->m->u.match_size;
1664
1665         e = fw_malloc(size + target->u.target_size);
1666         *e = *fw;
1667         e->target_offset = size;
1668         e->next_offset = size + target->u.target_size;
1669
1670         size = 0;
1671         for (matchp = matches; matchp; matchp = matchp->next) {
1672                 memcpy(e->elems + size, matchp->match->m, matchp->match->m->u.match_size);
1673                 size += matchp->match->m->u.match_size;
1674         }
1675         memcpy(e->elems + size, target, target->u.target_size);
1676
1677         return e;
1678 }
1679
1680 void clear_rule_matches(struct ip6tables_rule_match **matches)
1681 {
1682         struct ip6tables_rule_match *matchp, *tmp;
1683
1684         for (matchp = *matches; matchp;) {
1685                 tmp = matchp->next;
1686                 if (matchp->match->m)
1687                         free(matchp->match->m);
1688                 free(matchp);
1689                 matchp = tmp;
1690         }
1691
1692         *matches = NULL;
1693 }
1694
1695 int do_command6(int argc, char *argv[], char **table, ip6tc_handle_t *handle)
1696 {
1697         struct ip6t_entry fw, *e = NULL;
1698         int invert = 0;
1699         unsigned int nsaddrs = 0, ndaddrs = 0;
1700         struct in6_addr *saddrs = NULL, *daddrs = NULL;
1701
1702         int c, verbose = 0;
1703         const char *chain = NULL;
1704         const char *shostnetworkmask = NULL, *dhostnetworkmask = NULL;
1705         const char *policy = NULL, *newname = NULL;
1706         unsigned int rulenum = 0, options = 0, command = 0;
1707         const char *pcnt = NULL, *bcnt = NULL;
1708         int ret = 1;
1709         struct ip6tables_match *m;
1710         struct ip6tables_rule_match *matches = NULL;
1711         struct ip6tables_rule_match *matchp;
1712         struct ip6tables_target *target = NULL;
1713         struct ip6tables_target *t;
1714         const char *jumpto = "";
1715         char *protocol = NULL;
1716         const char *modprobe = NULL;
1717         int proto_used = 0;
1718         char icmp6p[] = "icmpv6";
1719
1720         memset(&fw, 0, sizeof(fw));
1721
1722         /* re-set optind to 0 in case do_command gets called
1723          * a second time */
1724         optind = 0;
1725
1726         /* clear mflags in case do_command gets called a second time
1727          * (we clear the global list of all matches for security)*/
1728         for (m = ip6tables_matches; m; m = m->next)
1729                 m->mflags = 0;
1730
1731         for (t = ip6tables_targets; t; t = t->next) {
1732                 t->tflags = 0;
1733                 t->used = 0;
1734         }
1735
1736         /* Suppress error messages: we may add new options if we
1737            demand-load a protocol. */
1738         opterr = 0;
1739
1740         while ((c = getopt_long(argc, argv,
1741            "-A:D:R:I:L::M:F::Z::N:X::E:P:Vh::o:p:s:d:j:i:bvnt:m:xc:",
1742                                            opts, NULL)) != -1) {
1743                 switch (c) {
1744                         /*
1745                          * Command selection
1746                          */
1747                 case 'A':
1748                         add_command(&command, CMD_APPEND, CMD_NONE,
1749                                     invert);
1750                         chain = optarg;
1751                         break;
1752
1753                 case 'D':
1754                         add_command(&command, CMD_DELETE, CMD_NONE,
1755                                     invert);
1756                         chain = optarg;
1757                         if (optind < argc && argv[optind][0] != '-'
1758                             && argv[optind][0] != '!') {
1759                                 rulenum = parse_rulenumber(argv[optind++]);
1760                                 command = CMD_DELETE_NUM;
1761                         }
1762                         break;
1763
1764                 case 'R':
1765                         add_command(&command, CMD_REPLACE, CMD_NONE,
1766                                     invert);
1767                         chain = optarg;
1768                         if (optind < argc && argv[optind][0] != '-'
1769                             && argv[optind][0] != '!')
1770                                 rulenum = parse_rulenumber(argv[optind++]);
1771                         else
1772                                 exit_error(PARAMETER_PROBLEM,
1773                                            "-%c requires a rule number",
1774                                            cmd2char(CMD_REPLACE));
1775                         break;
1776
1777                 case 'I':
1778                         add_command(&command, CMD_INSERT, CMD_NONE,
1779                                     invert);
1780                         chain = optarg;
1781                         if (optind < argc && argv[optind][0] != '-'
1782                             && argv[optind][0] != '!')
1783                                 rulenum = parse_rulenumber(argv[optind++]);
1784                         else rulenum = 1;
1785                         break;
1786
1787                 case 'L':
1788                         add_command(&command, CMD_LIST, CMD_ZERO,
1789                                     invert);
1790                         if (optarg) chain = optarg;
1791                         else if (optind < argc && argv[optind][0] != '-'
1792                                  && argv[optind][0] != '!')
1793                                 chain = argv[optind++];
1794                         break;
1795
1796                 case 'F':
1797                         add_command(&command, CMD_FLUSH, CMD_NONE,
1798                                     invert);
1799                         if (optarg) chain = optarg;
1800                         else if (optind < argc && argv[optind][0] != '-'
1801                                  && argv[optind][0] != '!')
1802                                 chain = argv[optind++];
1803                         break;
1804
1805                 case 'Z':
1806                         add_command(&command, CMD_ZERO, CMD_LIST,
1807                                     invert);
1808                         if (optarg) chain = optarg;
1809                         else if (optind < argc && argv[optind][0] != '-'
1810                                 && argv[optind][0] != '!')
1811                                 chain = argv[optind++];
1812                         break;
1813
1814                 case 'N':
1815                         if (optarg && *optarg == '-')
1816                                 exit_error(PARAMETER_PROBLEM,
1817                                            "chain name not allowed to start "
1818                                            "with `-'\n");
1819                         if (find_target(optarg, TRY_LOAD))
1820                                 exit_error(PARAMETER_PROBLEM,
1821                                            "chain name may not clash "
1822                                            "with target name\n");
1823                         add_command(&command, CMD_NEW_CHAIN, CMD_NONE,
1824                                     invert);
1825                         chain = optarg;
1826                         break;
1827
1828                 case 'X':
1829                         add_command(&command, CMD_DELETE_CHAIN, CMD_NONE,
1830                                     invert);
1831                         if (optarg) chain = optarg;
1832                         else if (optind < argc && argv[optind][0] != '-'
1833                                  && argv[optind][0] != '!')
1834                                 chain = argv[optind++];
1835                         break;
1836
1837                 case 'E':
1838                         add_command(&command, CMD_RENAME_CHAIN, CMD_NONE,
1839                                     invert);
1840                         chain = optarg;
1841                         if (optind < argc && argv[optind][0] != '-'
1842                             && argv[optind][0] != '!')
1843                                 newname = argv[optind++];
1844                         else
1845                                 exit_error(PARAMETER_PROBLEM,
1846                                            "-%c requires old-chain-name and "
1847                                            "new-chain-name",
1848                                             cmd2char(CMD_RENAME_CHAIN));
1849                         break;
1850
1851                 case 'P':
1852                         add_command(&command, CMD_SET_POLICY, CMD_NONE,
1853                                     invert);
1854                         chain = optarg;
1855                         if (optind < argc && argv[optind][0] != '-'
1856                             && argv[optind][0] != '!')
1857                                 policy = argv[optind++];
1858                         else
1859                                 exit_error(PARAMETER_PROBLEM,
1860                                            "-%c requires a chain and a policy",
1861                                            cmd2char(CMD_SET_POLICY));
1862                         break;
1863
1864                 case 'h':
1865                         if (!optarg)
1866                                 optarg = argv[optind];
1867
1868                         /* iptables -p icmp -h */
1869                         if (!matches && protocol)
1870                                 find_match(protocol, TRY_LOAD, &matches);
1871
1872                         exit_printhelp(matches);
1873
1874                         /*
1875                          * Option selection
1876                          */
1877                 case 'p':
1878                         check_inverse(optarg, &invert, &optind, argc);
1879                         set_option(&options, OPT_PROTOCOL, &fw.ipv6.invflags,
1880                                    invert);
1881
1882                         /* Canonicalize into lower case */
1883                         for (protocol = argv[optind-1]; *protocol; protocol++)
1884                                 *protocol = tolower(*protocol);
1885
1886                         protocol = argv[optind-1];
1887                         if ( strcmp(protocol,"ipv6-icmp") == 0)
1888                                 protocol = icmp6p;
1889                         fw.ipv6.proto = parse_protocol(protocol);
1890                         fw.ipv6.flags |= IP6T_F_PROTO;
1891
1892                         if (fw.ipv6.proto == 0
1893                             && (fw.ipv6.invflags & IP6T_INV_PROTO))
1894                                 exit_error(PARAMETER_PROBLEM,
1895                                            "rule would never match protocol");
1896                         fw.nfcache |= NFC_IP6_PROTO;
1897                         break;
1898
1899                 case 's':
1900                         check_inverse(optarg, &invert, &optind, argc);
1901                         set_option(&options, OPT_SOURCE, &fw.ipv6.invflags,
1902                                    invert);
1903                         shostnetworkmask = argv[optind-1];
1904                         fw.nfcache |= NFC_IP6_SRC;
1905                         break;
1906
1907                 case 'd':
1908                         check_inverse(optarg, &invert, &optind, argc);
1909                         set_option(&options, OPT_DESTINATION, &fw.ipv6.invflags,
1910                                    invert);
1911                         dhostnetworkmask = argv[optind-1];
1912                         fw.nfcache |= NFC_IP6_DST;
1913                         break;
1914
1915                 case 'j':
1916                         set_option(&options, OPT_JUMP, &fw.ipv6.invflags,
1917                                    invert);
1918                         jumpto = parse_target(optarg);
1919                         /* TRY_LOAD (may be chain name) */
1920                         target = find_target(jumpto, TRY_LOAD);
1921
1922                         if (target) {
1923                                 size_t size;
1924
1925                                 size = IP6T_ALIGN(sizeof(struct ip6t_entry_target))
1926                                         + target->size;
1927
1928                                 target->t = fw_calloc(1, size);
1929                                 target->t->u.target_size = size;
1930                                 strcpy(target->t->u.user.name, jumpto);
1931                                 target->init(target->t, &fw.nfcache);
1932                                 opts = merge_options(opts, target->extra_opts, &target->option_offset);
1933                         }
1934                         break;
1935
1936
1937                 case 'i':
1938                         check_inverse(optarg, &invert, &optind, argc);
1939                         set_option(&options, OPT_VIANAMEIN, &fw.ipv6.invflags,
1940                                    invert);
1941                         parse_interface(argv[optind-1],
1942                                         fw.ipv6.iniface,
1943                                         fw.ipv6.iniface_mask);
1944                         fw.nfcache |= NFC_IP6_IF_IN;
1945                         break;
1946
1947                 case 'o':
1948                         check_inverse(optarg, &invert, &optind, argc);
1949                         set_option(&options, OPT_VIANAMEOUT, &fw.ipv6.invflags,
1950                                    invert);
1951                         parse_interface(argv[optind-1],
1952                                         fw.ipv6.outiface,
1953                                         fw.ipv6.outiface_mask);
1954                         fw.nfcache |= NFC_IP6_IF_OUT;
1955                         break;
1956
1957                 case 'v':
1958                         if (!verbose)
1959                                 set_option(&options, OPT_VERBOSE,
1960                                            &fw.ipv6.invflags, invert);
1961                         verbose++;
1962                         break;
1963
1964                 case 'm': {
1965                         size_t size;
1966
1967                         if (invert)
1968                                 exit_error(PARAMETER_PROBLEM,
1969                                            "unexpected ! flag before --match");
1970
1971                         m = find_match(optarg, LOAD_MUST_SUCCEED, &matches);
1972                         size = IP6T_ALIGN(sizeof(struct ip6t_entry_match))
1973                                          + m->size;
1974                         m->m = fw_calloc(1, size);
1975                         m->m->u.match_size = size;
1976                         strcpy(m->m->u.user.name, m->name);
1977                         m->init(m->m, &fw.nfcache);
1978                         opts = merge_options(opts, m->extra_opts, &m->option_offset);
1979                 }
1980                 break;
1981
1982                 case 'n':
1983                         set_option(&options, OPT_NUMERIC, &fw.ipv6.invflags,
1984                                    invert);
1985                         break;
1986
1987                 case 't':
1988                         if (invert)
1989                                 exit_error(PARAMETER_PROBLEM,
1990                                            "unexpected ! flag before --table");
1991                         *table = argv[optind-1];
1992                         break;
1993
1994                 case 'x':
1995                         set_option(&options, OPT_EXPANDED, &fw.ipv6.invflags,
1996                                    invert);
1997                         break;
1998
1999                 case 'V':
2000                         if (invert)
2001                                 printf("Not %s ;-)\n", program_version);
2002                         else
2003                                 printf("%s v%s\n",
2004                                        program_name, program_version);
2005                         exit(0);
2006
2007                 case '0':
2008                         set_option(&options, OPT_LINENUMBERS, &fw.ipv6.invflags,
2009                                    invert);
2010                         break;
2011
2012                 case 'M':
2013                         modprobe = optarg;
2014                         break;
2015
2016                 case 'c':
2017
2018                         set_option(&options, OPT_COUNTERS, &fw.ipv6.invflags,
2019                                    invert);
2020                         pcnt = optarg;
2021                         if (optind < argc && argv[optind][0] != '-'
2022                             && argv[optind][0] != '!')
2023                                 bcnt = argv[optind++];
2024                         else
2025                                 exit_error(PARAMETER_PROBLEM,
2026                                         "-%c requires packet and byte counter",
2027                                         opt2char(OPT_COUNTERS));
2028
2029                         if (sscanf(pcnt, "%llu", (unsigned long long *)&fw.counters.pcnt) != 1)
2030                                 exit_error(PARAMETER_PROBLEM,
2031                                         "-%c packet counter not numeric",
2032                                         opt2char(OPT_COUNTERS));
2033
2034                         if (sscanf(bcnt, "%llu", (unsigned long long *)&fw.counters.bcnt) != 1)
2035                                 exit_error(PARAMETER_PROBLEM,
2036                                         "-%c byte counter not numeric",
2037                                         opt2char(OPT_COUNTERS));
2038
2039                         break;
2040
2041
2042                 case 1: /* non option */
2043                         if (optarg[0] == '!' && optarg[1] == '\0') {
2044                                 if (invert)
2045                                         exit_error(PARAMETER_PROBLEM,
2046                                                    "multiple consecutive ! not"
2047                                                    " allowed");
2048                                 invert = TRUE;
2049                                 optarg[0] = '\0';
2050                                 continue;
2051                         }
2052                         printf("Bad argument `%s'\n", optarg);
2053                         exit_tryhelp(2);
2054
2055                 default:
2056                         /* FIXME: This scheme doesn't allow two of the same
2057                            matches --RR */
2058                         if (!target
2059                             || !(target->parse(c - target->option_offset,
2060                                                argv, invert,
2061                                                &target->tflags,
2062                                                &fw, &target->t))) {
2063                                 for (matchp = matches; matchp; matchp = matchp->next) {
2064                                         if (matchp->match->parse(c - matchp->match->option_offset,
2065                                                      argv, invert,
2066                                                      &matchp->match->mflags,
2067                                                      &fw,
2068                                                      &fw.nfcache,
2069                                                      &matchp->match->m))
2070                                                 break;
2071                                 }
2072                                 m = matchp ? matchp->match : NULL;
2073
2074                                 /* If you listen carefully, you can
2075                                    actually hear this code suck. */
2076
2077                                 /* some explanations (after four different bugs
2078                                  * in 3 different releases): If we encountere a
2079                                  * parameter, that has not been parsed yet,
2080                                  * it's not an option of an explicitly loaded
2081                                  * match or a target.  However, we support
2082                                  * implicit loading of the protocol match
2083                                  * extension.  '-p tcp' means 'l4 proto 6' and
2084                                  * at the same time 'load tcp protocol match on
2085                                  * demand if we specify --dport'.
2086                                  *
2087                                  * To make this work, we need to make sure:
2088                                  * - the parameter has not been parsed by
2089                                  *   a match (m above)
2090                                  * - a protocol has been specified
2091                                  * - the protocol extension has not been
2092                                  *   loaded yet, or is loaded and unused
2093                                  *   [think of iptables-restore!]
2094                                  * - the protocol extension can be successively
2095                                  *   loaded
2096                                  */
2097                                 if (m == NULL
2098                                     && protocol
2099                                     && (!find_proto(protocol, DONT_LOAD,
2100                                                    options&OPT_NUMERIC, NULL)
2101                                         || (find_proto(protocol, DONT_LOAD,
2102                                                         options&OPT_NUMERIC, NULL)
2103                                             && (proto_used == 0))
2104                                        )
2105                                     && (m = find_proto(protocol, TRY_LOAD,
2106                                                        options&OPT_NUMERIC, &matches))) {
2107                                         /* Try loading protocol */
2108                                         size_t size;
2109
2110                                         proto_used = 1;
2111
2112                                         size = IP6T_ALIGN(sizeof(struct ip6t_entry_match))
2113                                                          + m->size;
2114
2115                                         m->m = fw_calloc(1, size);
2116                                         m->m->u.match_size = size;
2117                                         strcpy(m->m->u.user.name, m->name);
2118                                         m->init(m->m, &fw.nfcache);
2119
2120                                         opts = merge_options(opts,
2121                                             m->extra_opts, &m->option_offset);
2122
2123                                         optind--;
2124                                         continue;
2125                                 }
2126
2127                                 if (!m)
2128                                         exit_error(PARAMETER_PROBLEM,
2129                                                    "Unknown arg `%s'",
2130                                                    argv[optind-1]);
2131                         }
2132                 }
2133                 invert = FALSE;
2134         }
2135
2136         for (matchp = matches; matchp; matchp = matchp->next)
2137                 matchp->match->final_check(matchp->match->mflags);
2138
2139         if (target)
2140                 target->final_check(target->tflags);
2141
2142         /* Fix me: must put inverse options checking here --MN */
2143
2144         if (optind < argc)
2145                 exit_error(PARAMETER_PROBLEM,
2146                            "unknown arguments found on commandline");
2147         if (!command)
2148                 exit_error(PARAMETER_PROBLEM, "no command specified");
2149         if (invert)
2150                 exit_error(PARAMETER_PROBLEM,
2151                            "nothing appropriate following !");
2152
2153         if (command & (CMD_REPLACE | CMD_INSERT | CMD_DELETE | CMD_APPEND)) {
2154                 if (!(options & OPT_DESTINATION))
2155                         dhostnetworkmask = "::0/0";
2156                 if (!(options & OPT_SOURCE))
2157                         shostnetworkmask = "::0/0";
2158         }
2159
2160         if (shostnetworkmask)
2161                 parse_hostnetworkmask(shostnetworkmask, &saddrs,
2162                                       &(fw.ipv6.smsk), &nsaddrs);
2163
2164         if (dhostnetworkmask)
2165                 parse_hostnetworkmask(dhostnetworkmask, &daddrs,
2166                                       &(fw.ipv6.dmsk), &ndaddrs);
2167
2168         if ((nsaddrs > 1 || ndaddrs > 1) &&
2169             (fw.ipv6.invflags & (IP6T_INV_SRCIP | IP6T_INV_DSTIP)))
2170                 exit_error(PARAMETER_PROBLEM, "! not allowed with multiple"
2171                            " source or destination IP addresses");
2172
2173         if (command == CMD_REPLACE && (nsaddrs != 1 || ndaddrs != 1))
2174                 exit_error(PARAMETER_PROBLEM, "Replacement rule does not "
2175                            "specify a unique address");
2176
2177         generic_opt_check(command, options);
2178
2179         if (chain && strlen(chain) > IP6T_FUNCTION_MAXNAMELEN)
2180                 exit_error(PARAMETER_PROBLEM,
2181                            "chain name `%s' too long (must be under %i chars)",
2182                            chain, IP6T_FUNCTION_MAXNAMELEN);
2183
2184         /* only allocate handle if we weren't called with a handle */
2185         if (!*handle)
2186                 *handle = ip6tc_init(*table);
2187
2188         if (!*handle) {
2189                 /* try to insmod the module if iptc_init failed */
2190                 ip6tables_insmod("ip6_tables", modprobe);
2191                 *handle = ip6tc_init(*table);
2192         }
2193
2194         if (!*handle)
2195                 exit_error(VERSION_PROBLEM,
2196                         "can't initialize ip6tables table `%s': %s",
2197                         *table, ip6tc_strerror(errno));
2198
2199         if (command == CMD_APPEND
2200             || command == CMD_DELETE
2201             || command == CMD_INSERT
2202             || command == CMD_REPLACE) {
2203                 if (strcmp(chain, "PREROUTING") == 0
2204                     || strcmp(chain, "INPUT") == 0) {
2205                         /* -o not valid with incoming packets. */
2206                         if (options & OPT_VIANAMEOUT)
2207                                 exit_error(PARAMETER_PROBLEM,
2208                                            "Can't use -%c with %s\n",
2209                                            opt2char(OPT_VIANAMEOUT),
2210                                            chain);
2211                 }
2212
2213                 if (strcmp(chain, "POSTROUTING") == 0
2214                     || strcmp(chain, "OUTPUT") == 0) {
2215                         /* -i not valid with outgoing packets */
2216                         if (options & OPT_VIANAMEIN)
2217                                 exit_error(PARAMETER_PROBLEM,
2218                                            "Can't use -%c with %s\n",
2219                                            opt2char(OPT_VIANAMEIN),
2220                                            chain);
2221                 }
2222
2223                 if (target && ip6tc_is_chain(jumpto, *handle)) {
2224                         printf("Warning: using chain %s, not extension\n",
2225                                jumpto);
2226
2227                         if (target->t)
2228                                 free(target->t);
2229
2230                         target = NULL;
2231                 }
2232
2233                 /* If they didn't specify a target, or it's a chain
2234                    name, use standard. */
2235                 if (!target
2236                     && (strlen(jumpto) == 0
2237                         || ip6tc_is_chain(jumpto, *handle))) {
2238                         size_t size;
2239
2240                         target = find_target(IP6T_STANDARD_TARGET,
2241                                              LOAD_MUST_SUCCEED);
2242
2243                         size = sizeof(struct ip6t_entry_target)
2244                                 + target->size;
2245                         target->t = fw_calloc(1, size);
2246                         target->t->u.target_size = size;
2247                         strcpy(target->t->u.user.name, jumpto);
2248                         target->init(target->t, &fw.nfcache);
2249                 }
2250
2251                 if (!target) {
2252                         /* it is no chain, and we can't load a plugin.
2253                          * We cannot know if the plugin is corrupt, non
2254                          * existant OR if the user just misspelled a
2255                          * chain. */
2256                         find_target(jumpto, LOAD_MUST_SUCCEED);
2257                 } else {
2258                         e = generate_entry(&fw, matches, target->t);
2259                         free(target->t);
2260                 }
2261         }
2262
2263         switch (command) {
2264         case CMD_APPEND:
2265                 ret = append_entry(chain, e,
2266                                    nsaddrs, saddrs, ndaddrs, daddrs,
2267                                    options&OPT_VERBOSE,
2268                                    handle);
2269                 break;
2270         case CMD_DELETE:
2271                 ret = delete_entry(chain, e,
2272                                    nsaddrs, saddrs, ndaddrs, daddrs,
2273                                    options&OPT_VERBOSE,
2274                                    handle, matches);
2275                 break;
2276         case CMD_DELETE_NUM:
2277                 ret = ip6tc_delete_num_entry(chain, rulenum - 1, handle);
2278                 break;
2279         case CMD_REPLACE:
2280                 ret = replace_entry(chain, e, rulenum - 1,
2281                                     saddrs, daddrs, options&OPT_VERBOSE,
2282                                     handle);
2283                 break;
2284         case CMD_INSERT:
2285                 ret = insert_entry(chain, e, rulenum - 1,
2286                                    nsaddrs, saddrs, ndaddrs, daddrs,
2287                                    options&OPT_VERBOSE,
2288                                    handle);
2289                 break;
2290         case CMD_LIST:
2291                 ret = list_entries(chain,
2292                                    options&OPT_VERBOSE,
2293                                    options&OPT_NUMERIC,
2294                                    options&OPT_EXPANDED,
2295                                    options&OPT_LINENUMBERS,
2296                                    handle);
2297                 break;
2298         case CMD_FLUSH:
2299                 ret = flush_entries(chain, options&OPT_VERBOSE, handle);
2300                 break;
2301         case CMD_ZERO:
2302                 ret = zero_entries(chain, options&OPT_VERBOSE, handle);
2303                 break;
2304         case CMD_LIST|CMD_ZERO:
2305                 ret = list_entries(chain,
2306                                    options&OPT_VERBOSE,
2307                                    options&OPT_NUMERIC,
2308                                    options&OPT_EXPANDED,
2309                                    options&OPT_LINENUMBERS,
2310                                    handle);
2311                 if (ret)
2312                         ret = zero_entries(chain,
2313                                            options&OPT_VERBOSE, handle);
2314                 break;
2315         case CMD_NEW_CHAIN:
2316                 ret = ip6tc_create_chain(chain, handle);
2317                 break;
2318         case CMD_DELETE_CHAIN:
2319                 ret = delete_chain(chain, options&OPT_VERBOSE, handle);
2320                 break;
2321         case CMD_RENAME_CHAIN:
2322                 ret = ip6tc_rename_chain(chain, newname,        handle);
2323                 break;
2324         case CMD_SET_POLICY:
2325                 ret = ip6tc_set_policy(chain, policy, NULL, handle);
2326                 break;
2327         default:
2328                 /* We should never reach this... */
2329                 exit_tryhelp(2);
2330         }
2331
2332         if (verbose > 1)
2333                 dump_entries6(*handle);
2334
2335         clear_rule_matches(&matches);
2336
2337         if (e != NULL) {
2338                 free(e);
2339                 e = NULL;
2340         }
2341
2342         for (c = 0; c < nsaddrs; c++)
2343                 free(&saddrs[c]);
2344
2345         for (c = 0; c < ndaddrs; c++)
2346                 free(&daddrs[c]);
2347
2348         if (opts != original_opts) {
2349                 free(opts);
2350                 opts = original_opts;
2351                 global_option_offset = 0;
2352         }
2353
2354         return ret;
2355 }