This is an automated email from the ASF dual-hosted git repository.
xiaoxiang pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/nuttx-apps.git
The following commit(s) were added to refs/heads/master by this push:
new bbb2b289c iptables: add iptables libary
bbb2b289c is described below
commit bbb2b289cfbce7660cab94338b02d61e5836d79b
Author: zhanghongyu <[email protected]>
AuthorDate: Wed Jul 5 10:25:55 2023 +0800
iptables: add iptables libary
Add xtables.c and xtables.h
In order to support the compilation of third-party utils, we encounter some
situations where the macro is not defined, refer to the common
implementation
of other systems, add relevant definitions and empty function.
Signed-off-by: zhanghongyu <[email protected]>
---
include/netutils/xtables.h | 494 ++++++++++++++++++++++++++++++++++++++++++++
netutils/iptables/Kconfig | 10 +
netutils/iptables/Make.defs | 23 +++
netutils/iptables/Makefile | 25 +++
netutils/iptables/xtables.c | 113 ++++++++++
5 files changed, 665 insertions(+)
diff --git a/include/netutils/xtables.h b/include/netutils/xtables.h
new file mode 100644
index 000000000..5c8d4d8ff
--- /dev/null
+++ b/include/netutils/xtables.h
@@ -0,0 +1,494 @@
+/****************************************************************************
+ * apps/include/netutils/xtables.h
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership. The
+ * ASF licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the
+ * License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations
+ * under the License.
+ *
+ ****************************************************************************/
+
+#ifndef __APPS_INCLUDE_XTABLES_H
+#define __APPS_INCLUDE_XTABLES_H
+
+/****************************************************************************
+ * Included Files
+ ****************************************************************************/
+
+#include <getopt.h>
+#include <netinet/in.h>
+#include <stdbool.h>
+
+#include <nuttx/net/netfilter/netfilter.h>
+
+/****************************************************************************
+ * Pre-processor Definitions
+ ****************************************************************************/
+
+#define XTABLES_VERSION_CODE 12
+
+/**
+ * Select the format the input has to conform to, as well as the target type
+ * (area pointed to with XTOPT_POINTER). Note that the storing is not always
+ * uniform. @cb->val will be populated with as much as there is space, i.e.
+ * exactly 2 items for ranges, but the target area can receive more values
+ * (e.g. in case of ranges), or less values (e.g. %XTTYPE_HOSTMASK).
+ *
+ * %XTTYPE_NONE: option takes no argument
+ * %XTTYPE_UINT*: standard integer
+ * %XTTYPE_UINT*RC: colon-separated range of standard integers
+ * %XTTYPE_DOUBLE: double-precision floating point number
+ * %XTTYPE_STRING: arbitrary string
+ * %XTTYPE_TOSMASK: 8-bit TOS value with optional mask
+ * %XTTYPE_MARKMASK32: 32-bit mark with optional mask
+ * %XTTYPE_SYSLOGLEVEL: syslog level by name or number
+ * %XTTYPE_HOST: one host or address (ptr: union nf_inet_addr)
+ * %XTTYPE_HOSTMASK: one host or address, with an optional prefix length
+ * ptr: union nf_inet_addr; only host portion is stored
+ * %XTTYPE_PROTOCOL: protocol number/name from /etc/protocols ptr: uint8_t
+ * %XTTYPE_PORT: 16-bit port name or number (supports %XTOPT_NBO)
+ * %XTTYPE_PORTRC: colon-separated port range (names acceptable),
+ * (supports %XTOPT_NBO)
+ * %XTTYPE_PLEN: prefix length
+ * %XTTYPE_PLENMASK: prefix length (ptr: union nf_inet_addr)
+ * %XTTYPE_ETHERMAC: Ethernet MAC address in hex form
+ */
+
+enum xt_option_type
+{
+ XTTYPE_NONE,
+ XTTYPE_UINT8,
+ XTTYPE_UINT16,
+ XTTYPE_UINT32,
+ XTTYPE_UINT64,
+ XTTYPE_UINT8RC,
+ XTTYPE_UINT16RC,
+ XTTYPE_UINT32RC,
+ XTTYPE_UINT64RC,
+ XTTYPE_DOUBLE,
+ XTTYPE_STRING,
+ XTTYPE_TOSMASK,
+ XTTYPE_MARKMASK32,
+ XTTYPE_SYSLOGLEVEL,
+ XTTYPE_HOST,
+ XTTYPE_HOSTMASK,
+ XTTYPE_PROTOCOL,
+ XTTYPE_PORT,
+ XTTYPE_PORTRC,
+ XTTYPE_PLEN,
+ XTTYPE_PLENMASK,
+ XTTYPE_ETHERMAC,
+};
+
+enum xtables_tryload
+{
+ XTF_DONT_LOAD,
+ XTF_DURING_LOAD,
+ XTF_TRY_LOAD,
+ XTF_LOAD_MUST_SUCCEED,
+};
+
+enum xtables_exittype
+{
+ OTHER_PROBLEM = 1,
+ PARAMETER_PROBLEM,
+ VERSION_PROBLEM,
+ RESOURCE_PROBLEM,
+ XTF_ONLY_ONCE,
+ XTF_NO_INVERT,
+ XTF_BAD_VALUE,
+ XTF_ONE_ACTION,
+};
+
+/****************************************************************************
+ * Public Types
+ ****************************************************************************/
+
+struct xtables_globals
+{
+ unsigned int option_offset;
+ FAR const char *program_name;
+ FAR const char *program_version;
+ FAR struct option *orig_opts;
+ FAR struct option *opts;
+ void (*exit_err)(enum xtables_exittype status, FAR const char *msg, ...)
+ __attribute__ ((noreturn, format(printf, 2, 3)));
+ int (*compat_rev)(FAR const char *name, uint8_t rev, int opt);
+};
+
+/**
+ * @name: name of option
+ * @type: type of input and validation method, see %XTTYPE_*
+ * @id: unique number (within extension) for option, 0-31
+ * @excl: bitmask of flags that cannot be used with this option
+ * @also: bitmask of flags that must be used with this option
+ * @flags: bitmask of option flags, see %XTOPT_*
+ * @ptroff: offset into private structure for member
+ * @size: size of the item pointed to by @ptroff; this is a safeguard
+ * @min: lowest allowed value (for singular integral types)
+ * @max: highest allowed value (for singular integral types)
+ */
+
+struct xt_option_entry
+{
+ FAR const char *name;
+ enum xt_option_type type;
+ unsigned int id;
+ unsigned int excl;
+ unsigned int also;
+ unsigned int flags;
+ unsigned int ptroff;
+ size_t size;
+ unsigned int min;
+ unsigned int max;
+};
+
+struct xt_xlate;
+struct xt_xlate_tg_params
+{
+ FAR const void *ip;
+ FAR const struct xt_entry_target *target;
+ int numeric;
+ bool escape_quotes;
+};
+
+/**
+ * @ext_name: name of extension currently being processed
+ * @data: per-extension (kernel) data block
+ * @udata: per-extension private scratch area
+ * (cf. xtables_{match,target}->udata_size)
+ * @xflags: options of the extension that have been used
+ */
+
+struct xt_fcheck_call
+{
+ FAR const char *ext_name;
+ FAR void *data;
+ FAR void *udata;
+ unsigned int xflags;
+};
+
+struct xt_xlate_mt_params
+{
+ FAR const void *ip;
+ FAR const struct xt_entry_match *match;
+ int numeric;
+ bool escape_quotes;
+};
+
+/**
+ * @arg: input from command line
+ * @ext_name: name of extension currently being processed
+ * @entry: current option being processed
+ * @data: per-extension kernel data block
+ * @xflags: options of the extension that have been used
+ * @invert: whether option was used with !
+ * @nvals: number of results in uXX_multi
+ * @val: parsed result
+ * @udata: per-extension private scratch area
+ * (cf. xtables_{match,target}->udata_size)
+ */
+
+struct xt_option_call
+{
+ FAR const char *arg;
+ FAR const char *ext_name;
+ FAR const struct xt_option_entry *entry;
+ FAR void *data;
+ unsigned int xflags;
+ bool invert;
+ uint8_t nvals;
+ union
+ {
+ uint8_t u8;
+ uint8_t u8_range[2];
+ uint8_t syslog_level;
+ uint8_t protocol;
+ uint16_t u16;
+ uint16_t u16_range[2];
+ uint16_t port;
+ uint16_t port_range[2];
+ uint32_t u32;
+ uint32_t u32_range[2];
+ uint64_t u64;
+ uint64_t u64_range[2];
+ double dbl;
+ struct
+ {
+ union nf_inet_addr haddr;
+ union nf_inet_addr hmask;
+ uint8_t hlen;
+ };
+ struct
+ {
+ uint8_t tos_value;
+ uint8_t tos_mask;
+ };
+ struct
+ {
+ uint32_t mark;
+ uint32_t mask;
+ };
+ uint8_t ethermac[6];
+ } val;
+
+ /* Wished for a world where the ones below were gone: */
+
+ union
+ {
+ FAR struct xt_entry_match **match;
+ FAR struct xt_entry_target **target;
+ };
+
+ FAR void *xt_entry;
+ FAR void *udata;
+};
+
+/* Include file for additions: new matches and targets. */
+
+struct xtables_match
+{
+ /* ABI/API version this module requires. Must be first member,
+ * as the rest of this struct may be subject to ABI changes.
+ */
+
+ FAR const char *version;
+ FAR struct xtables_match *next;
+ FAR const char *name;
+ FAR const char *real_name;
+
+ /* Revision of match (0 by default). */
+
+ uint8_t revision;
+
+ /* Extension flags */
+
+ uint8_t ext_flags;
+ uint16_t family;
+
+ /* Size of match data. */
+
+ size_t size;
+
+ /* Size of match data relevant for userspace comparison purposes */
+
+ size_t userspacesize;
+
+ /* Function which prints out usage message. */
+
+ void (*help)(void);
+
+ /* Initialize the match. */
+
+ void (*init)(FAR struct xt_entry_match *m);
+
+ /* Function which parses command options; returns true if it
+ * ate an option
+ */
+
+ /* entry is struct ipt_entry for example */
+
+ int (*parse)(int c, FAR char **argv, int invert, FAR unsigned int *flags,
+ FAR const void *entry, FAR struct xt_entry_match **match);
+
+ /* Final check; exit if not ok. */
+
+ void (*final_check)(unsigned int flags);
+
+ /* Prints out the match iff non-NULL: put space at end */
+
+ /* ip is struct ipt_ip * for example */
+
+ void (*print)(FAR const void *ip,
+ FAR const struct xt_entry_match *match, int numeric);
+
+ /* Saves the match info in parsable form to stdout. */
+
+ /* ip is struct ipt_ip * for example */
+
+ void (*save)(FAR const void *ip, FAR const struct xt_entry_match *match);
+
+ /* Print match name or alias */
+
+ FAR const char *(*alias)(FAR const struct xt_entry_match *match);
+
+ /* Pointer to list of extra command-line options */
+
+ FAR const struct option *extra_opts;
+
+ /* New parser */
+
+ void (*x6_parse)(FAR struct xt_option_call *);
+ void (*x6_fcheck)(FAR struct xt_fcheck_call *);
+ FAR const struct xt_option_entry *x6_options;
+
+ /* Translate iptables to nft */
+
+ int (*xlate)(FAR struct xt_xlate *xl,
+ FAR const struct xt_xlate_mt_params *params);
+
+ /* Size of per-extension instance extra "global" scratch space */
+
+ size_t udata_size;
+
+ /* Ignore these men behind the curtain: */
+
+ FAR void *udata;
+ unsigned int option_offset;
+ FAR struct xt_entry_match *m;
+ unsigned int mflags;
+ unsigned int loaded; /* simulate loading so options are merged properly */
+};
+
+struct xtables_target
+{
+ /**
+ * ABI/API version this module requires. Must be first member,
+ * as the rest of this struct may be subject to ABI changes.
+ */
+
+ FAR const char *version;
+ FAR struct xtables_target *next;
+ FAR const char *name;
+
+ /* Real target behind this, if any. */
+
+ FAR const char *real_name;
+
+ /* Revision of target (0 by default). */
+
+ uint8_t revision;
+
+ /* Extension flags */
+
+ uint8_t ext_flags;
+ uint16_t family;
+
+ /* Size of target data. */
+
+ size_t size;
+
+ /* Size of target data relevant for userspace comparison purposes */
+
+ size_t userspacesize;
+
+ /* Function which prints out usage message. */
+
+ void (*help)(void);
+
+ /* Initialize the target. */
+
+ FAR void (*init)(struct xt_entry_target *t);
+
+ /* Function which parses command options; returns true if it
+ * ate an option
+ */
+
+ /* entry is struct ipt_entry for example */
+
+ int (*parse)(int c, FAR char **argv, int invert, FAR unsigned int *flags,
+ FAR const void *entry,
+ FAR struct xt_entry_target **targetinfo);
+
+ /* Final check; exit if not ok. */
+
+ void (*final_check)(unsigned int flags);
+
+ /* Prints out the target iff non-NULL: put space at end */
+
+ void (*print)(FAR const void *ip,
+ FAR const struct xt_entry_target *target, int numeric);
+
+ /* Saves the targinfo in parsable form to stdout. */
+
+ void (*save)(FAR const void *ip,
+ FAR const struct xt_entry_target *target);
+
+ /* Print target name or alias */
+
+ FAR const char *(*alias)(FAR const struct xt_entry_target *target);
+
+ /* Pointer to list of extra command-line options */
+
+ FAR const struct option *extra_opts;
+
+ /* New parser */
+
+ void (*x6_parse)(FAR struct xt_option_call *);
+ void (*x6_fcheck)(FAR struct xt_fcheck_call *);
+ FAR const struct xt_option_entry *x6_options;
+
+ /* Translate iptables to nft */
+
+ int (*xlate)(FAR struct xt_xlate *xl,
+ FAR const struct xt_xlate_tg_params *params);
+ size_t udata_size;
+
+ /* Ignore these men behind the curtain: */
+
+ FAR void *udata;
+ unsigned int option_offset;
+ FAR struct xt_entry_target *t;
+ unsigned int tflags;
+ unsigned int used;
+ unsigned int loaded; /* simulate loading so options are merged properly */
+};
+
+struct xtables_rule_match
+{
+ FAR struct xtables_rule_match *next;
+ FAR struct xtables_match *match;
+
+ /* Multiple matches of the same type: the ones before
+ * the current one are completed from parsing point of view
+ */
+
+ bool completed;
+};
+
+/****************************************************************************
+ * Public Data
+ ****************************************************************************/
+
+extern FAR struct xtables_match *xtables_matches;
+extern FAR struct xtables_target *xtables_targets;
+extern FAR struct xtables_globals *xt_params;
+
+/****************************************************************************
+ * Public Function Prototypes
+ ****************************************************************************/
+
+extern int xtables_insmod(FAR const char *, FAR const char *, bool);
+extern int xtables_init_all(FAR struct xtables_globals *xtp,
+ uint8_t nfproto);
+extern uint16_t xtables_parse_protocol(FAR const char *s);
+extern void xtables_option_tpcall(unsigned int, FAR char **, bool,
+ FAR struct xtables_target *, FAR void *);
+extern void xtables_option_mpcall(unsigned int, FAR char **, bool,
+ FAR struct xtables_match *, FAR void *);
+extern void xtables_option_tfcall(FAR struct xtables_target *);
+extern void xtables_option_mfcall(FAR struct xtables_match *);
+extern FAR struct option *xtables_options_xfrm(FAR struct option *,
+ FAR struct option *, FAR const struct xt_option_entry *,
+ FAR unsigned int *);
+extern FAR struct option *xtables_merge_options(FAR struct option *origopts,
+ FAR struct option *oldopts, FAR const struct option *newopts,
+ FAR unsigned int *option_offset);
+extern FAR struct xtables_match *xtables_find_match(FAR const char *name,
+ enum xtables_tryload, FAR struct xtables_rule_match **match);
+extern FAR struct xtables_target *xtables_find_target(FAR const char *name,
+ enum xtables_tryload);
+extern int xtables_compatible_revision(FAR const char *name,
+ uint8_t revision, int opt);
+
+#endif /* __APPS_INCLUDE_XTABLES_H */
diff --git a/netutils/iptables/Kconfig b/netutils/iptables/Kconfig
new file mode 100644
index 000000000..0db2202e8
--- /dev/null
+++ b/netutils/iptables/Kconfig
@@ -0,0 +1,10 @@
+#
+# For a description of the syntax of this configuration file,
+# see the file kconfig-language.txt in the NuttX tools repository.
+#
+
+config NETUTILS_IPTABLES
+ bool "iptables libary"
+ default n
+ ---help---
+ iptable libary support.
diff --git a/netutils/iptables/Make.defs b/netutils/iptables/Make.defs
new file mode 100644
index 000000000..3c4d1d076
--- /dev/null
+++ b/netutils/iptables/Make.defs
@@ -0,0 +1,23 @@
+############################################################################
+# apps/netutils/ping/Make.defs
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership. The
+# ASF licenses this file to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance with the
+# License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+############################################################################
+
+ifneq ($(CONFIG_NETUTILS_IPTABLES),)
+CONFIGURED_APPS += $(APPDIR)/netutils/iptables
+endif
diff --git a/netutils/iptables/Makefile b/netutils/iptables/Makefile
new file mode 100644
index 000000000..4b1a53d81
--- /dev/null
+++ b/netutils/iptables/Makefile
@@ -0,0 +1,25 @@
+############################################################################
+# apps/netutils/ping/Makefile
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership. The
+# ASF licenses this file to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance with the
+# License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+#
+############################################################################
+
+include $(APPDIR)/Make.defs
+
+CSRCS += xtables.c
+
+include $(APPDIR)/Application.mk
diff --git a/netutils/iptables/xtables.c b/netutils/iptables/xtables.c
new file mode 100644
index 000000000..6691706a0
--- /dev/null
+++ b/netutils/iptables/xtables.c
@@ -0,0 +1,113 @@
+/****************************************************************************
+ * apps/netutils/iptables/xtables.c
+ *
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership. The
+ * ASF licenses this file to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the
+ * License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+ * License for the specific language governing permissions and limitations
+ * under the License.
+ *
+ ****************************************************************************/
+
+/****************************************************************************
+ * Included Files
+ ****************************************************************************/
+
+#include <errno.h>
+
+#include <nuttx/net/netfilter/ip_tables.h>
+#include <nuttx/net/netfilter/ip6_tables.h>
+
+#include <netutils/xtables.h>
+
+/****************************************************************************
+ * Public Data
+ ****************************************************************************/
+
+/* Keep track of fully registered external matches/targets: linked lists. */
+
+FAR struct xtables_match *xtables_matches;
+FAR struct xtables_target *xtables_targets;
+FAR struct xtables_globals *xt_params;
+
+/****************************************************************************
+ * Public Functions
+ ****************************************************************************/
+
+int xtables_insmod(FAR const char *modname, FAR const char *modprobe,
+ bool quiet)
+{
+ return -ENOSYS;
+}
+
+int xtables_init_all(FAR struct xtables_globals *xtp, uint8_t nfproto)
+{
+ return -ENOSYS;
+}
+
+uint16_t xtables_parse_protocol(FAR const char *s)
+{
+ return -ENOSYS;
+}
+
+void xtables_option_tpcall(unsigned int c, FAR char **argv, bool invert,
+ FAR struct xtables_target *t, FAR void *fw)
+{
+}
+
+void xtables_option_mpcall(unsigned int c, FAR char **argv, bool invert,
+ FAR struct xtables_match *m, FAR void *fw)
+{
+}
+
+void xtables_option_tfcall(FAR struct xtables_target *t)
+{
+}
+
+void xtables_option_mfcall(FAR struct xtables_match *m)
+{
+}
+
+FAR struct option *xtables_options_xfrm(FAR struct option *orig_opts,
+ FAR struct option *oldopts,
+ FAR const struct xt_option_entry *entry,
+ FAR unsigned int *offset)
+{
+ return NULL;
+}
+
+FAR struct option *xtables_merge_options(FAR struct option *origopts,
+ FAR struct option *oldopts,
+ FAR const struct option *newopts,
+ FAR unsigned int *option_offset)
+{
+ return NULL;
+}
+
+FAR struct xtables_match *xtables_find_match(FAR const char *name,
+ enum xtables_tryload tryload,
+ FAR struct xtables_rule_match **match)
+{
+ return NULL;
+}
+
+FAR struct xtables_target *xtables_find_target(FAR const char *name,
+ enum xtables_tryload tryload)
+{
+ return NULL;
+}
+
+int xtables_compatible_revision(FAR const char *name, uint8_t revision,
+ int opt)
+{
+ return -ENOSYS;
+}
