Hi to everyone, I'm trying to use your libiptc by java native Interface, but I encounter some problems. I wrote two little programs in C (ehm, I copied the one you wrote...:-) to add or delete a rule in the input chain. The programs work fine, but if I compile them making two shared libs (and after I use their methods by JNI), only the "deleting one" works (so I compiled well the shared libraries). The other one notify me an "Invalid Argument" on the iptc_commit().
Can You help me ? (I know that my English is very ugly, sorry....) I use linux 2.4.2, libiptc 0.1 (I guess), iptables 1.2.5 and java2 vers. 1.3.1_02. I acclude the source code of the C program and the output of the shell - I have setted on the "dump_entry" option - (you can see the output that I get using the C program and the outputs I get using the shared library by the JNI program; I have used different version of this shared lib, changing the method to add an entry: I used iptc_append_entry, iptc_insert_entry and iptc_replace_entry). I discovered some differences between the output that I get using the C code and the output that I get using the shared library: Interface, flags and invflags are not null. Why ? P.S.: to change the C program in a JNI-ready shared lib, I uncomment the 2 # include and change the "int main()" into "JNIEXPORT void.....", after i compile it using "gcc -o libaddrule.so Add.c -liptc -I/usr/java/jdk1.3.1._02/include" and after I copy the libaddrule.so in the right directory. Thanx for your time. I hope you can help me (otherways I've to shift my bachelor).
// sample code appending a new rule to the FORWARD chain in the filter table //#include "Add.h" //#include <jni.h> #include <libiptc/libiptc.h> #include <errno.h> #include <stdio.h> #include <stdlib.h> #include <linux/netfilter.h> int main() //JNIEXPORT void JNICALL //Java_Add_AddRule(JNIEnv *env, jobject obj) { long result = 0; iptc_handle_t handle; struct ipt_standard_target target; struct ipt_entry *chain_entry; ipt_chainlabel labelit; long size=0; /* configuring the entry we'll make: we want to append a rule to the forward chain in the filter table this rule is simple: accept everything that reaches this point in the chain */ printf("size of standard target: %d\n", sizeof(target)); chain_entry = NULL; /* the target of this rule is ACCEPT */ strncpy(&target.target.u.user.name[0], "DROP", 30); // other std rules would include DROP etc /* set the target size!! */ target.target.u.user.target_size=sizeof(target); chain_entry = malloc(sizeof(struct ipt_entry) + sizeof(target)); memset(chain_entry, 0, sizeof(chain_entry)); /* zero it out */ // these could be used to specify ip addresses to be matched for the target, here the src address is being matched chain_entry->ip.src.s_addr=inet_addr("143.225.229.6"); /* src address */ chain_entry->ip.smsk.s_addr=inet_addr("255.255.255.255"); /* mask */ chain_entry->ip.dst.s_addr=inet_addr("143.225.229.6"); /* dst address */ chain_entry->ip.dmsk.s_addr=inet_addr("255.255.255.255"); /* mask */ chain_entry->ip.proto=0; /* any protocol */ printf("ok"); chain_entry->ip.iniface=""; printf("ok"); chain_entry->ip.outiface=""; printf("ok"); /* assuming matches do not need to be taken into account, as we are matching everything! */ size=sizeof(struct ipt_entry); printf("sizeof chain_target_offset: %d\n", size); chain_entry->target_offset=size; chain_entry->next_offset= size + sizeof(target); /* next target is the next rule (offset is size of current entry) */ printf("value of chain entry next offset: %d\n", chain_entry->next_offset); memcpy(chain_entry->elems, &target, sizeof(target)); /* standard is the name given to any of the system defined targets, like DROP, ACCEPT, REJECT, QUEUE, RETURN */ handle = iptc_init("filter"); /* check if table is loaded */ if (handle == NULL) { printf("error: table not loaded!\n"); exit(0); } else { printf("table exists\n"); } result = iptc_is_chain("INPUT", handle); if(result) { printf("chain exists\n"); } else { printf("error: chain does not exist!\n"); exit(0); } // set the name of the chain we want to append to strncpy(&labelit, "INPUT", 30); result = iptc_append_entry(labelit, chain_entry, &handle); if(result == 0) printf("append error: %s\n", iptc_strerror(errno)); result=iptc_commit(&handle); if(result == 0) printf("commit error: %s\n", iptc_strerror(errno)); else printf("appended new rule to block successfully\n"); free(chain_entry); return 0; }
/* DO NOT EDIT THIS FILE - it is machine generated */ #include <jni.h> /* Header for class Add */ #ifndef _Included_Add #define _Included_Add #ifdef __cplusplus extern "C" { #endif /* * Class: Add * Method: AddRule * Signature: ()V */ JNIEXPORT void JNICALL Java_Add_AddRule (JNIEnv *, jobject); #ifdef __cplusplus } #endif #endif
// // Add.java // public class Add { public native void AddRule(); static { System.loadLibrary("Add"); } public static void main(String[] args){ new Add().AddRule(); } }
-- program written in C -- [root@ns velardi]# ./a.out size of standard target: 36 sizeof chain_target_offset: 112 value of chain entry next offset: 148 table exists chain exists TC_COMMIT: Checking entries...OK libiptc v1.2.5. 5 entries, 768 bytes. Table `filter' Hooks: pre/in/fwd/out/post = 0/0/296/444/0 Underflows: pre/in/fwd/out/post = 148/148/296/444/148 Entry 0 (0): SRC IP: 143.225.229.6/255.255.255.255 DST IP: 143.225.229.6/255.255.255.255 Interface: `'/................to `'/................ Protocol: 0 Flags: 00 Invflags: 00 Counters: 0 packets, 0 bytes Cache: 00000000 Target name: `' [36] verdict=NF_DROP Entry 1 (148): SRC IP: 0.0.0.0/0.0.0.0 DST IP: 0.0.0.0/0.0.0.0 Interface: `'/................to `'/................ Protocol: 0 Flags: 00 Invflags: 00 Counters: 62930 packets, 15670922 bytes Cache: 00000000 Target name: `' [36] verdict=NF_ACCEPT Entry 2 (296): SRC IP: 0.0.0.0/0.0.0.0 DST IP: 0.0.0.0/0.0.0.0 Interface: `'/................to `'/................ Protocol: 0 Flags: 00 Invflags: 00 Counters: 0 packets, 0 bytes Cache: 00000000 Target name: `' [36] verdict=NF_ACCEPT Entry 3 (444): SRC IP: 0.0.0.0/0.0.0.0 DST IP: 0.0.0.0/0.0.0.0 Interface: `'/................to `'/................ Protocol: 0 Flags: 00 Invflags: 00 Counters: 13215 packets, 1949697 bytes Cache: 00000000 Target name: `' [36] verdict=NF_ACCEPT Entry 4 (592): SRC IP: 0.0.0.0/0.0.0.0 DST IP: 0.0.0.0/0.0.0.0 Interface: `'/................to `'/................ Protocol: 0 Flags: 00 Invflags: 00 Counters: 0 packets, 0 bytes Cache: 00000000 Target name: `ERROR' [64] error=`ERROR' appended new rule to block successfully -- by the JNI ( I used the "iptc_insert_entry" or the "iptc_replace_entry" method) -- [root@ns velardi]# java Add size of standard target: 36 sizeof chain_target_offset: 112 value of chain entry next offset: 148 table exists chain exists TC_COMMIT: Checking entries...OK libiptc v1.2.5. 5 entries, 768 bytes. Table `filter' Hooks: pre/in/fwd/out/post = 0/0/296/444/0 Underflows: pre/in/fwd/out/post = 148/148/296/444/148 Entry 0 (0): SRC IP: 143.225.229.6/255.255.255.255 DST IP: 143.225.229.6/255.255.255.255 Interface: `: JNI_OnLoad'/XXXXXXXXXXXXXXXXto `r/java/jdk1.3.1_02/jre/lib/i386/native_threads/l'/XXXXXXXXXXXXXXXX Protocol: 0 Flags: 68 Invflags: 70 Counters: 356482287104 packets, 309237647616 bytes Cache: 6F732E69 IP_SRC IP_IF_OUT IP_PROTO IP_OPTIONS IP_SRC_PT IP_DST_PT IP_PROTO_UNKNOWN Target name: `' [36] verdict=NF_DROP Entry 1 (148): SRC IP: 0.0.0.0/0.0.0.0 DST IP: 0.0.0.0/0.0.0.0 Interface: `'/................to `'/................ Protocol: 0 Flags: 00 Invflags: 00 Counters: 63053 packets, 15687581 bytes Cache: 00000000 Target name: `' [36] verdict=NF_ACCEPT [cut] commit error: Target problem -- by JNI (I used the "iptc_append_entry" method) -- [root@ns velardi]# java Add size of standard target: 36 sizeof chain_target_offset: 112 value of chain entry next offset: 148 table exists chain exists TC_COMMIT: Checking entries...OK libiptc v1.2.5. 5 entries, 768 bytes. Table `filter' Hooks: pre/in/fwd/out/post = 0/0/296/444/0 Underflows: pre/in/fwd/out/post = 148/148/296/444/148 Entry 0 (0): SRC IP: 143.225.229.6/255.255.255.255 DST IP: 143.225.229.6/255.255.255.255 Interface: `: JNI_OnLoad'/XXXXXXXXXXXXXXXXto `r/java/jdk1.3.1_02/jre/lib/i386/native_threads/l'/XXXXXXXXXXXXXXXX Protocol: 0 Flags: 68 Invflags: 70 Counters: 0 packets, 0 bytes Cache: 6F732E69 IP_SRC IP_IF_OUT IP_PROTO IP_OPTIONS IP_SRC_PT IP_DST_PT IP_PROTO_UNKNOWN Target name: `' [36] verdict=NF_DROP Entry 1 (148): SRC IP: 0.0.0.0/0.0.0.0 DST IP: 0.0.0.0/0.0.0.0 Interface: `'/................to `'/................ Protocol: 0 Flags: 00 Invflags: 00 Counters: 63142 packets, 15703308 bytes Cache: 00000000 Target name: `' [36] verdict=NF_ACCEPT [cut] commit error: Invalid argument
I've seen things you people wouldn't believe. Attack ships on fire off the shoulder of Orion. I watched C-beams glitter in the dark near the Tannhauser gate. All those moments will be lost in time, like tears in rain. Time to die.