iptables/nft-arp.c - platform/external/iptables - Git at Google

 /*
  * (C) 2013 by Pablo Neira Ayuso <pablo@netfilter.org>
  * (C) 2013 by Giuseppe Longo <giuseppelng@gmail.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation; either version 2 of the License, or
  * (at your option) any later version.
  *
  * This code has been sponsored by Sophos Astaro <http://www.sophos.com>
  */

 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <netdb.h>
 #include <net/if_arp.h>

 #include <xtables.h>
 #include <libiptc/libxtc.h>
 #include <net/if_arp.h>
 #include <netinet/if_ether.h>

 #include <linux/netfilter_arp/arp_tables.h>
 #include <linux/netfilter/nf_tables.h>

 #include "nft-shared.h"
 #include "nft-arp.h"
 #include "nft.h"

 /* a few names */
 char *opcodes[] =
 {
 	"Request",
 	"Reply",
 	"Request_Reverse",
 	"Reply_Reverse",
 	"DRARP_Request",
 	"DRARP_Reply",
 	"DRARP_Error",
 	"InARP_Request",
 	"ARP_NAK",
 };

 static char *
 addr_to_dotted(const struct in_addr *addrp)
 {
 	static char buf[20];
 	const unsigned char *bytep;

 	bytep = (const unsigned char *) &(addrp->s_addr);
 	sprintf(buf, "%d.%d.%d.%d", bytep[0], bytep[1], bytep[2], bytep[3]);
 	return buf;
 }

 static char *
 addr_to_host(const struct in_addr *addr)
 {
 	struct hostent *host;

 	if ((host = gethostbyaddr((char *) addr,
 					sizeof(struct in_addr), AF_INET)) != NULL)
 		return (char *) host->h_name;

 	return (char *) NULL;
 }

 static char *
 addr_to_network(const struct in_addr *addr)
 {
 	struct netent *net;

 	if ((net = getnetbyaddr((long) ntohl(addr->s_addr), AF_INET)) != NULL)
 		return (char *) net->n_name;

 	return (char *) NULL;
 }

 static char *
 addr_to_anyname(const struct in_addr *addr)
 {
 	char *name;

 	if ((name = addr_to_host(addr)) != NULL ||
 		(name = addr_to_network(addr)) != NULL)
 		return name;

 	return addr_to_dotted(addr);
 }

 static char *
 mask_to_dotted(const struct in_addr *mask)
 {
 	int i;
 	static char buf[20];
 	u_int32_t maskaddr, bits;

 	maskaddr = ntohl(mask->s_addr);

 	if (maskaddr == 0xFFFFFFFFL)
 		/* we don't want to see "/32" */
 		return "";

 	i = 32;
 	bits = 0xFFFFFFFEL;
 	while (--i >= 0 && maskaddr != bits)
 		bits <<= 1;
 	if (i >= 0)
 		sprintf(buf, "/%d", i);
 	else
 		/* mask was not a decent combination of 1's and 0's */
 		sprintf(buf, "/%s", addr_to_dotted(mask));

 	return buf;
 }

 static void print_mac(const unsigned char *mac, int l)
 {
 	int j;

 	for (j = 0; j < l; j++)
 		printf("%02x%s", mac[j],
 			(j==l-1) ? "" : ":");
 }

 static void print_mac_and_mask(const unsigned char *mac, const unsigned char *mask, int l)
 {
 	int i;

 	print_mac(mac, l);
 	for (i = 0; i < l ; i++)
 		if (mask[i] != 255)
 			break;
 	if (i == l)
 		return;
 	printf("/");
 	print_mac(mask, l);
 }

 static int nft_arp_add(struct nftnl_rule *r, void *data)
 {
 	struct arptables_command_state *cs = data;
 	struct arpt_entry *fw = &cs->fw;
 	uint32_t op;
 	int ret = 0;

 	if (fw->arp.iniface[0] != '\0') {
 		op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_VIA_IN);
 		add_iniface(r, fw->arp.iniface, op);
 	}

 	if (fw->arp.outiface[0] != '\0') {
 		op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_VIA_OUT);
 		add_outiface(r, fw->arp.outiface, op);
 	}

 	if (fw->arp.arhrd != 0) {
 		op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_ARPHRD);
 		add_payload(r, offsetof(struct arphdr, ar_hrd), 2,
 			    NFT_PAYLOAD_NETWORK_HEADER);
 		add_cmp_u16(r, fw->arp.arhrd, op);
 	}

 	if (fw->arp.arpro != 0) {
 		op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_ARPPRO);
 	        add_payload(r, offsetof(struct arphdr, ar_pro), 2,
 			    NFT_PAYLOAD_NETWORK_HEADER);
 		add_cmp_u16(r, fw->arp.arpro, op);
 	}

 	if (fw->arp.arhln != 0) {
 		op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_ARPHLN);
 		add_proto(r, offsetof(struct arphdr, ar_hln), 1,
 			  fw->arp.arhln, op);
 	}

 	add_proto(r, offsetof(struct arphdr, ar_pln), 1, 4, NFT_CMP_EQ);

 	if (fw->arp.arpop != 0) {
 		op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_ARPOP);
 		add_payload(r, offsetof(struct arphdr, ar_op), 2,
 			    NFT_PAYLOAD_NETWORK_HEADER);
 		add_cmp_u16(r, fw->arp.arpop, op);
 	}

 	if (fw->arp.src_devaddr.addr[0] != '\0') {
 		op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_SRCDEVADDR);
 		add_payload(r, sizeof(struct arphdr), fw->arp.arhln,
 			    NFT_PAYLOAD_NETWORK_HEADER);
 		add_cmp_ptr(r, op, fw->arp.src_devaddr.addr, fw->arp.arhln);
 	}

 	if (fw->arp.src.s_addr != 0) {
 		op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_SRCIP);
 		add_addr(r, sizeof(struct arphdr) + fw->arp.arhln,
 			 &fw->arp.src.s_addr, &fw->arp.smsk.s_addr,
 			 sizeof(struct in_addr), op);
 	}

 	if (fw->arp.tgt_devaddr.addr[0] != '\0') {
 		op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_TGTDEVADDR);
 		add_payload(r, sizeof(struct arphdr) + fw->arp.arhln + 4,
 			    fw->arp.arhln, NFT_PAYLOAD_NETWORK_HEADER);
 		add_cmp_ptr(r, op, fw->arp.tgt_devaddr.addr, fw->arp.arhln);
 	}

 	if (fw->arp.tgt.s_addr != 0) {
 		op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_TGTIP);
 		add_addr(r, sizeof(struct arphdr) + fw->arp.arhln + sizeof(struct in_addr),
 			 &fw->arp.tgt.s_addr, &fw->arp.tmsk.s_addr,
 			 sizeof(struct in_addr), op);
 	}

 	/* Counters need to me added before the target, otherwise they are
 	 * increased for each rule because of the way nf_tables works.
 	 */
 	if (add_counters(r, fw->counters.pcnt, fw->counters.bcnt) < 0)
 		return -1;

 	if (cs->target != NULL) {
 		/* Standard target? */
 		if (strcmp(cs->jumpto, XTC_LABEL_ACCEPT) == 0)
 			ret = add_verdict(r, NF_ACCEPT);
 		else if (strcmp(cs->jumpto, XTC_LABEL_DROP) == 0)
 			ret = add_verdict(r, NF_DROP);
 		else if (strcmp(cs->jumpto, XTC_LABEL_RETURN) == 0)
 			ret = add_verdict(r, NFT_RETURN);
 		else
 			ret = add_target(r, cs->target->t);
 	} else if (strlen(cs->jumpto) > 0) {
 		/* No goto in arptables */
 		ret = add_jumpto(r, cs->jumpto, NFT_JUMP);
 	}

 	return ret;
 }

 static uint16_t ipt_to_arpt_flags(uint8_t invflags)
 {
 	uint16_t result = 0;

 	if (invflags & IPT_INV_VIA_IN)
 		result |= ARPT_INV_VIA_IN;

 	if (invflags & IPT_INV_VIA_OUT)
 		result |= ARPT_INV_VIA_OUT;

 	if (invflags & IPT_INV_SRCIP)
 		result |= ARPT_INV_SRCIP;

 	if (invflags & IPT_INV_DSTIP)
 		result |= ARPT_INV_TGTIP;

 	if (invflags & IPT_INV_PROTO)
 		result |= ARPT_INV_ARPPRO;

 	return result;
 }

 static void nft_arp_parse_meta(struct nft_xt_ctx *ctx, struct nftnl_expr *e,
 			       void *data)
 {
 	struct arptables_command_state *cs = data;
 	struct arpt_entry *fw = &cs->fw;
 	uint8_t flags = 0;

 	parse_meta(e, ctx->meta.key, fw->arp.iniface, fw->arp.iniface_mask,
 		   fw->arp.outiface, fw->arp.outiface_mask,
 		   &flags);

 	fw->arp.invflags |= ipt_to_arpt_flags(flags);
 }

 static void nft_arp_parse_target(struct xtables_target *target, void *data)
 {
 	struct arptables_command_state *cs = data;

 	cs->target = target;
 }

 static void nft_arp_parse_immediate(const char *jumpto, bool nft_goto,
 				    void *data)
 {
 	struct arptables_command_state *cs = data;

 	cs->jumpto = jumpto;
 }

 static void parse_mask_ipv4(struct nft_xt_ctx *ctx, struct in_addr *mask)
 {
 	mask->s_addr = ctx->bitwise.mask[0];
 }

 static void nft_arp_parse_payload(struct nft_xt_ctx *ctx,
 				  struct nftnl_expr *e, void *data)
 {
 	struct arptables_command_state *cs = data;
 	struct arpt_entry *fw = &cs->fw;
 	struct in_addr addr;
 	unsigned short int ar_hrd, ar_pro, ar_op, ar_hln;
 	bool inv;

 	switch (ctx->payload.offset) {
 	case offsetof(struct arphdr, ar_hrd):
 		get_cmp_data(e, &ar_hrd, sizeof(ar_hrd), &inv);
 		fw->arp.arhrd = ar_hrd;
 		fw->arp.arhrd_mask = 0xffff;
 		if (inv)
 			fw->arp.invflags |= ARPT_INV_ARPHRD;
 		break;
 	case offsetof(struct arphdr, ar_pro):
 		get_cmp_data(e, &ar_pro, sizeof(ar_pro), &inv);
 		fw->arp.arpro = ar_pro;
 		fw->arp.arpro_mask = 0xffff;
 		if (inv)
 			fw->arp.invflags |= ARPT_INV_ARPPRO;
 		break;
 	case offsetof(struct arphdr, ar_op):
 		get_cmp_data(e, &ar_op, sizeof(ar_op), &inv);
 		fw->arp.arpop = ar_op;
 		fw->arp.arpop_mask = 0xffff;
 		if (inv)
 			fw->arp.invflags |= ARPT_INV_ARPOP;
 		break;
 	case offsetof(struct arphdr, ar_hln):
 		get_cmp_data(e, &ar_hln, sizeof(ar_op), &inv);
 		fw->arp.arhln = ar_hln;
 		fw->arp.arhln_mask = 0xff;
 		if (inv)
 			fw->arp.invflags |= ARPT_INV_ARPOP;
 		break;
 	default:
 		if (fw->arp.arhln < 0)
 			break;

 		if (ctx->payload.offset == sizeof(struct arphdr) +
 					   fw->arp.arhln) {
 			get_cmp_data(e, &addr, sizeof(addr), &inv);
 			fw->arp.src.s_addr = addr.s_addr;
 			if (ctx->flags & NFT_XT_CTX_BITWISE) {
 				parse_mask_ipv4(ctx, &fw->arp.smsk);
 				ctx->flags &= ~NFT_XT_CTX_BITWISE;
 			} else {
 				fw->arp.smsk.s_addr = 0xffffffff;
 			}

 			if (inv)
 				fw->arp.invflags |= ARPT_INV_SRCIP;
 		} else if (ctx->payload.offset == sizeof(struct arphdr) +
 						  fw->arp.arhln +
 						  sizeof(struct in_addr)) {
 			get_cmp_data(e, &addr, sizeof(addr), &inv);
 			fw->arp.tgt.s_addr = addr.s_addr;
 			if (ctx->flags & NFT_XT_CTX_BITWISE) {
 				parse_mask_ipv4(ctx, &fw->arp.tmsk);
 				ctx->flags &= ~NFT_XT_CTX_BITWISE;
 			} else {
 				fw->arp.tmsk.s_addr = 0xffffffff;
 			}

 			if (inv)
 				fw->arp.invflags |= ARPT_INV_TGTIP;
 		}
 		break;
 	}
 }

 void nft_rule_to_arptables_command_state(struct nftnl_rule *r,
 					 struct arptables_command_state *cs)
 {
 	struct nftnl_expr_iter *iter;
 	struct nftnl_expr *expr;
 	int family = nftnl_rule_get_u32(r, NFTNL_RULE_FAMILY);
 	struct nft_xt_ctx ctx = {
 		.state.cs_arp = cs,
 		.family = family,
 	};

 	iter = nftnl_expr_iter_create(r);
 	if (iter == NULL)
 		return;

 	ctx.iter = iter;
 	expr = nftnl_expr_iter_next(iter);
 	while (expr != NULL) {
 		const char *name =
 			nftnl_expr_get_str(expr, NFTNL_EXPR_NAME);

 		if (strcmp(name, "counter") == 0)
 			nft_parse_counter(expr, &ctx.state.cs_arp->fw.counters);
 		else if (strcmp(name, "payload") == 0)
 			nft_parse_payload(&ctx, expr);
 		else if (strcmp(name, "meta") == 0)
 			nft_parse_meta(&ctx, expr);
 		else if (strcmp(name, "bitwise") == 0)
 			nft_parse_bitwise(&ctx, expr);
 		else if (strcmp(name, "cmp") == 0)
 			nft_parse_cmp(&ctx, expr);
 		else if (strcmp(name, "immediate") == 0)
 			nft_parse_immediate(&ctx, expr);
 		else if (strcmp(name, "target") == 0)
 			nft_parse_target(&ctx, expr);

 		expr = nftnl_expr_iter_next(iter);
 	}

 	nftnl_expr_iter_destroy(iter);

 	if (cs->jumpto != NULL)
 		return;

 	if (cs->target != NULL && cs->target->name != NULL)
 		cs->target = xtables_find_target(cs->target->name, XTF_TRY_LOAD);
 	else
 		cs->jumpto = "";
 }

 static void nft_arp_print_header(unsigned int format, const char *chain,
 				 const char *pol,
 				 const struct xt_counters *counters,
 				 bool basechain, uint32_t refs)
 {
 	printf("Chain %s", chain);
 	if (pol) {
 		printf(" (policy %s", pol);
 		if (!(format & FMT_NOCOUNTS)) {
 			fputc(' ', stdout);
 			xtables_print_num(counters->pcnt, (format|FMT_NOTABLE));
 			fputs("packets, ", stdout);
 			xtables_print_num(counters->bcnt, (format|FMT_NOTABLE));
 			fputs("bytes", stdout);
 		}
 		printf(")\n");
 	} else {
 		printf(" (%u references)\n", refs);
 	}
 }

 static void print_fw_details(struct arpt_entry *fw, unsigned int format)
 {
 	char buf[BUFSIZ];
 	char iface[IFNAMSIZ+2];
 	int print_iface = 0;
 	int i;

 	iface[0] = '\0';

 	if (fw->arp.iniface[0] != '\0') {
 		strcat(iface, fw->arp.iniface);
 		print_iface = 1;
 	}
 	else if (format & FMT_VIA) {
 		print_iface = 1;
 		if (format & FMT_NUMERIC) strcat(iface, "*");
 		else strcat(iface, "any");
 	}
 	if (print_iface)
 		printf("%s-i %s ", fw->arp.invflags & ARPT_INV_VIA_IN ?
 				   "! " : "", iface);

 	print_iface = 0;
 	iface[0] = '\0';

 	if (fw->arp.outiface[0] != '\0') {
 		strcat(iface, fw->arp.outiface);
 		print_iface = 1;
 	}
 	else if (format & FMT_VIA) {
 		print_iface = 1;
 		if (format & FMT_NUMERIC) strcat(iface, "*");
 		else strcat(iface, "any");
 	}
 	if (print_iface)
 		printf("%s-o %s ", fw->arp.invflags & ARPT_INV_VIA_OUT ?
 				   "! " : "", iface);

 	if (fw->arp.smsk.s_addr != 0L) {
 		printf("%s", fw->arp.invflags & ARPT_INV_SRCIP
 			? "! " : "");
 		if (format & FMT_NUMERIC)
 			sprintf(buf, "%s", addr_to_dotted(&(fw->arp.src)));
 		else
 			sprintf(buf, "%s", addr_to_anyname(&(fw->arp.src)));
 		strncat(buf, mask_to_dotted(&(fw->arp.smsk)),
 			sizeof(buf) - strlen(buf) - 1);
 		printf("-s %s ", buf);
 	}

 	for (i = 0; i < ARPT_DEV_ADDR_LEN_MAX; i++)
 		if (fw->arp.src_devaddr.mask[i] != 0)
 			break;
 	if (i == ARPT_DEV_ADDR_LEN_MAX)
 		goto after_devsrc;
 	printf("%s", fw->arp.invflags & ARPT_INV_SRCDEVADDR
 		? "! " : "");
 	printf("--src-mac ");
 	print_mac_and_mask((unsigned char *)fw->arp.src_devaddr.addr,
 		(unsigned char *)fw->arp.src_devaddr.mask, ETH_ALEN);
 	printf(" ");
 after_devsrc:

 	if (fw->arp.tmsk.s_addr != 0L) {
 		printf("%s", fw->arp.invflags & ARPT_INV_TGTIP
 			? "! " : "");
 		if (format & FMT_NUMERIC)
 			sprintf(buf, "%s", addr_to_dotted(&(fw->arp.tgt)));
 		else
 			sprintf(buf, "%s", addr_to_anyname(&(fw->arp.tgt)));
 		strncat(buf, mask_to_dotted(&(fw->arp.tmsk)),
 			sizeof(buf) - strlen(buf) - 1);
 		printf("-d %s ", buf);
 	}

 	for (i = 0; i <ARPT_DEV_ADDR_LEN_MAX; i++)
 		if (fw->arp.tgt_devaddr.mask[i] != 0)
 			break;
 	if (i == ARPT_DEV_ADDR_LEN_MAX)
 		goto after_devdst;
 	printf("%s", fw->arp.invflags & ARPT_INV_TGTDEVADDR
 		? "! " : "");
 	printf("--dst-mac ");
 	print_mac_and_mask((unsigned char *)fw->arp.tgt_devaddr.addr,
 		(unsigned char *)fw->arp.tgt_devaddr.mask, ETH_ALEN);
 	printf(" ");

 after_devdst:

 	if (fw->arp.arhln_mask != 0) {
 		printf("%s", fw->arp.invflags & ARPT_INV_ARPHLN
 			? "! " : "");
 		printf("--h-length %d", fw->arp.arhln);
 		if (fw->arp.arhln_mask != 255)
 			printf("/%d", fw->arp.arhln_mask);
 		printf(" ");
 	}

 	if (fw->arp.arpop_mask != 0) {
 		int tmp = ntohs(fw->arp.arpop);

 		printf("%s", fw->arp.invflags & ARPT_INV_ARPOP
 			? "! " : "");
 		if (tmp <= NUMOPCODES && !(format & FMT_NUMERIC))
 			printf("--opcode %s", opcodes[tmp-1]);
 		else

 		if (fw->arp.arpop_mask != 65535)
 			printf("/%d", ntohs(fw->arp.arpop_mask));
 		printf(" ");
 	}

 	if (fw->arp.arhrd_mask != 0) {
 		uint16_t tmp = ntohs(fw->arp.arhrd);

 		printf("%s", fw->arp.invflags & ARPT_INV_ARPHRD
 			? "! " : "");
 		if (tmp == 1 && !(format & FMT_NUMERIC))
 			printf("--h-type %s", "Ethernet");
 		else
 			printf("--h-type %u", tmp);
 		if (fw->arp.arhrd_mask != 65535)
 			printf("/%d", ntohs(fw->arp.arhrd_mask));
 		printf(" ");
 	}

 	if (fw->arp.arpro_mask != 0) {
 		int tmp = ntohs(fw->arp.arpro);

 		printf("%s", fw->arp.invflags & ARPT_INV_ARPPRO
 			? "! " : "");
 		if (tmp == 0x0800 && !(format & FMT_NUMERIC))
 			printf("--proto-type %s", "IPv4");
 		else
 			printf("--proto-type 0x%x", tmp);
 		if (fw->arp.arpro_mask != 65535)
 			printf("/%x", ntohs(fw->arp.arpro_mask));
 		printf(" ");
 	}
 }

 static void
 nft_arp_print_firewall(struct nftnl_rule *r, unsigned int num,
 		       unsigned int format)
 {
 	struct arptables_command_state cs = {};

 	nft_rule_to_arptables_command_state(r, &cs);

 	if (format & FMT_LINENUMBERS)
 		printf("%u ", num);

 	print_fw_details(&cs.fw, format);

 	if (cs.jumpto != NULL && strcmp(cs.jumpto, "") != 0) {
 		printf("-j %s", cs.jumpto);
 	} else if (cs.target) {
 		printf("-j %s", cs.target->name);
 		cs.target->print(&cs.fw, cs.target->t, format & FMT_NUMERIC);
 	}

 	if (!(format & FMT_NOCOUNTS)) {
 		printf(", pcnt=");
 		xtables_print_num(cs.fw.counters.pcnt, format);
 		printf("-- bcnt=");
 		xtables_print_num(cs.fw.counters.bcnt, format);
 	}

 	if (!(format & FMT_NONEWLINE))
 		fputc('\n', stdout);
 }

 static bool nft_arp_is_same(const void *data_a,
 			    const void *data_b)
 {
 	const struct arpt_entry *a = data_a;
 	const struct arpt_entry *b = data_b;

 	if (a->arp.src.s_addr != b->arp.src.s_addr
 	    || a->arp.tgt.s_addr != b->arp.tgt.s_addr
 	    || a->arp.smsk.s_addr != b->arp.tmsk.s_addr
 	    || a->arp.arpro != b->arp.arpro
 	    || a->arp.flags != b->arp.flags
 	    || a->arp.invflags != b->arp.invflags) {
 		DEBUGP("different src/dst/proto/flags/invflags\n");
 		return false;
 	}

 	return is_same_interfaces(a->arp.iniface,
 				  a->arp.outiface,
 				  (unsigned char *)a->arp.iniface_mask,
 				  (unsigned char *)a->arp.outiface_mask,
 				  b->arp.iniface,
 				  b->arp.outiface,
 				  (unsigned char *)b->arp.iniface_mask,
 				  (unsigned char *)b->arp.outiface_mask);
 }

 static bool nft_arp_rule_find(struct nft_family_ops *ops, struct nftnl_rule *r,
 			      void *data)
 {
 	const struct arptables_command_state *cs = data;
 	struct arptables_command_state this = {};

 	/* Delete by matching rule case */
 	nft_rule_to_arptables_command_state(r, &this);

 	if (!nft_arp_is_same(cs, &this))
 		return false;

 	if (!compare_targets(cs->target, this.target))
 		return false;

 	if (strcmp(cs->jumpto, this.jumpto) != 0)
 		return false;

 	return true;
 }

 struct nft_family_ops nft_family_ops_arp = {
 	.add			= nft_arp_add,
 	.is_same		= nft_arp_is_same,
 	.print_payload		= NULL,
 	.parse_meta		= nft_arp_parse_meta,
 	.parse_payload		= nft_arp_parse_payload,
 	.parse_immediate	= nft_arp_parse_immediate,
 	.print_header		= nft_arp_print_header,
 	.print_firewall		= nft_arp_print_firewall,
 	.save_firewall		= NULL,
 	.save_counters		= NULL,
 	.post_parse		= NULL,
 	.rule_find		= nft_arp_rule_find,
 	.parse_target		= nft_arp_parse_target,
 };
	/*
	* (C) 2013 by Pablo Neira Ayuso <pablo@netfilter.org>
	* (C) 2013 by Giuseppe Longo <giuseppelng@gmail.com>
	*
	* This program is free software; you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation; either version 2 of the License, or
	* (at your option) any later version.
	*
	* This code has been sponsored by Sophos Astaro <http://www.sophos.com>
	*/

	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <netdb.h>
	#include <net/if_arp.h>

	#include <xtables.h>
	#include <libiptc/libxtc.h>
	#include <net/if_arp.h>
	#include <netinet/if_ether.h>

	#include <linux/netfilter_arp/arp_tables.h>
	#include <linux/netfilter/nf_tables.h>

	#include "nft-shared.h"
	#include "nft-arp.h"
	#include "nft.h"

	/* a few names */
	char *opcodes[] =
	{
	"Request",
	"Reply",
	"Request_Reverse",
	"Reply_Reverse",
	"DRARP_Request",
	"DRARP_Reply",
	"DRARP_Error",
	"InARP_Request",
	"ARP_NAK",
	};

	static char *
	addr_to_dotted(const struct in_addr *addrp)
	{
	static char buf[20];
	const unsigned char *bytep;

	bytep = (const unsigned char *) &(addrp->s_addr);
	sprintf(buf, "%d.%d.%d.%d", bytep[0], bytep[1], bytep[2], bytep[3]);
	return buf;
	}

	static char *
	addr_to_host(const struct in_addr *addr)
	{
	struct hostent *host;

	if ((host = gethostbyaddr((char *) addr,
	sizeof(struct in_addr), AF_INET)) != NULL)
	return (char *) host->h_name;

	return (char *) NULL;
	}

	static char *
	addr_to_network(const struct in_addr *addr)
	{
	struct netent *net;

	if ((net = getnetbyaddr((long) ntohl(addr->s_addr), AF_INET)) != NULL)
	return (char *) net->n_name;

	return (char *) NULL;
	}

	static char *
	addr_to_anyname(const struct in_addr *addr)
	{
	char *name;

	if ((name = addr_to_host(addr)) != NULL \|\|
	(name = addr_to_network(addr)) != NULL)
	return name;

	return addr_to_dotted(addr);
	}

	static char *
	mask_to_dotted(const struct in_addr *mask)
	{
	int i;
	static char buf[20];
	u_int32_t maskaddr, bits;

	maskaddr = ntohl(mask->s_addr);

	if (maskaddr == 0xFFFFFFFFL)
	/* we don't want to see "/32" */
	return "";

	i = 32;
	bits = 0xFFFFFFFEL;
	while (--i >= 0 && maskaddr != bits)
	bits <<= 1;
	if (i >= 0)
	sprintf(buf, "/%d", i);
	else
	/* mask was not a decent combination of 1's and 0's */
	sprintf(buf, "/%s", addr_to_dotted(mask));

	return buf;
	}

	static void print_mac(const unsigned char *mac, int l)
	{
	int j;

	for (j = 0; j < l; j++)
	printf("%02x%s", mac[j],
	(j==l-1) ? "" : ":");
	}

	static void print_mac_and_mask(const unsigned char mac, const unsigned char mask, int l)
	{
	int i;

	print_mac(mac, l);
	for (i = 0; i < l ; i++)
	if (mask[i] != 255)
	break;
	if (i == l)
	return;
	printf("/");
	print_mac(mask, l);
	}

	static int nft_arp_add(struct nftnl_rule r, void data)
	{
	struct arptables_command_state *cs = data;
	struct arpt_entry *fw = &cs->fw;
	uint32_t op;
	int ret = 0;

	if (fw->arp.iniface[0] != '\0') {
	op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_VIA_IN);
	add_iniface(r, fw->arp.iniface, op);
	}

	if (fw->arp.outiface[0] != '\0') {
	op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_VIA_OUT);
	add_outiface(r, fw->arp.outiface, op);
	}

	if (fw->arp.arhrd != 0) {
	op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_ARPHRD);
	add_payload(r, offsetof(struct arphdr, ar_hrd), 2,
	NFT_PAYLOAD_NETWORK_HEADER);
	add_cmp_u16(r, fw->arp.arhrd, op);
	}

	if (fw->arp.arpro != 0) {
	op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_ARPPRO);
	add_payload(r, offsetof(struct arphdr, ar_pro), 2,
	NFT_PAYLOAD_NETWORK_HEADER);
	add_cmp_u16(r, fw->arp.arpro, op);
	}

	if (fw->arp.arhln != 0) {
	op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_ARPHLN);
	add_proto(r, offsetof(struct arphdr, ar_hln), 1,
	fw->arp.arhln, op);
	}

	add_proto(r, offsetof(struct arphdr, ar_pln), 1, 4, NFT_CMP_EQ);

	if (fw->arp.arpop != 0) {
	op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_ARPOP);
	add_payload(r, offsetof(struct arphdr, ar_op), 2,
	NFT_PAYLOAD_NETWORK_HEADER);
	add_cmp_u16(r, fw->arp.arpop, op);
	}

	if (fw->arp.src_devaddr.addr[0] != '\0') {
	op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_SRCDEVADDR);
	add_payload(r, sizeof(struct arphdr), fw->arp.arhln,
	NFT_PAYLOAD_NETWORK_HEADER);
	add_cmp_ptr(r, op, fw->arp.src_devaddr.addr, fw->arp.arhln);
	}

	if (fw->arp.src.s_addr != 0) {
	op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_SRCIP);
	add_addr(r, sizeof(struct arphdr) + fw->arp.arhln,
	&fw->arp.src.s_addr, &fw->arp.smsk.s_addr,
	sizeof(struct in_addr), op);
	}

	if (fw->arp.tgt_devaddr.addr[0] != '\0') {
	op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_TGTDEVADDR);
	add_payload(r, sizeof(struct arphdr) + fw->arp.arhln + 4,
	fw->arp.arhln, NFT_PAYLOAD_NETWORK_HEADER);
	add_cmp_ptr(r, op, fw->arp.tgt_devaddr.addr, fw->arp.arhln);
	}

	if (fw->arp.tgt.s_addr != 0) {
	op = nft_invflags2cmp(fw->arp.invflags, ARPT_INV_TGTIP);
	add_addr(r, sizeof(struct arphdr) + fw->arp.arhln + sizeof(struct in_addr),
	&fw->arp.tgt.s_addr, &fw->arp.tmsk.s_addr,
	sizeof(struct in_addr), op);
	}

	/* Counters need to me added before the target, otherwise they are
	* increased for each rule because of the way nf_tables works.
	*/
	if (add_counters(r, fw->counters.pcnt, fw->counters.bcnt) < 0)
	return -1;

	if (cs->target != NULL) {
	/* Standard target? */
	if (strcmp(cs->jumpto, XTC_LABEL_ACCEPT) == 0)
	ret = add_verdict(r, NF_ACCEPT);
	else if (strcmp(cs->jumpto, XTC_LABEL_DROP) == 0)
	ret = add_verdict(r, NF_DROP);
	else if (strcmp(cs->jumpto, XTC_LABEL_RETURN) == 0)
	ret = add_verdict(r, NFT_RETURN);
	else
	ret = add_target(r, cs->target->t);
	} else if (strlen(cs->jumpto) > 0) {
	/* No goto in arptables */
	ret = add_jumpto(r, cs->jumpto, NFT_JUMP);
	}

	return ret;
	}

	static uint16_t ipt_to_arpt_flags(uint8_t invflags)
	{
	uint16_t result = 0;

	if (invflags & IPT_INV_VIA_IN)
	result \|= ARPT_INV_VIA_IN;

	if (invflags & IPT_INV_VIA_OUT)
	result \|= ARPT_INV_VIA_OUT;

	if (invflags & IPT_INV_SRCIP)
	result \|= ARPT_INV_SRCIP;

	if (invflags & IPT_INV_DSTIP)
	result \|= ARPT_INV_TGTIP;

	if (invflags & IPT_INV_PROTO)
	result \|= ARPT_INV_ARPPRO;

	return result;
	}

	static void nft_arp_parse_meta(struct nft_xt_ctx ctx, struct nftnl_expr e,
	void *data)
	{
	struct arptables_command_state *cs = data;
	struct arpt_entry *fw = &cs->fw;
	uint8_t flags = 0;

	parse_meta(e, ctx->meta.key, fw->arp.iniface, fw->arp.iniface_mask,
	fw->arp.outiface, fw->arp.outiface_mask,
	&flags);

	fw->arp.invflags \|= ipt_to_arpt_flags(flags);
	}

	static void nft_arp_parse_target(struct xtables_target target, void data)
	{
	struct arptables_command_state *cs = data;

	cs->target = target;
	}

	static void nft_arp_parse_immediate(const char *jumpto, bool nft_goto,
	void *data)
	{
	struct arptables_command_state *cs = data;

	cs->jumpto = jumpto;
	}

	static void parse_mask_ipv4(struct nft_xt_ctx ctx, struct in_addr mask)
	{
	mask->s_addr = ctx->bitwise.mask[0];
	}

	static void nft_arp_parse_payload(struct nft_xt_ctx *ctx,
	struct nftnl_expr e, void data)
	{
	struct arptables_command_state *cs = data;
	struct arpt_entry *fw = &cs->fw;
	struct in_addr addr;
	unsigned short int ar_hrd, ar_pro, ar_op, ar_hln;
	bool inv;

	switch (ctx->payload.offset) {
	case offsetof(struct arphdr, ar_hrd):
	get_cmp_data(e, &ar_hrd, sizeof(ar_hrd), &inv);
	fw->arp.arhrd = ar_hrd;
	fw->arp.arhrd_mask = 0xffff;
	if (inv)
	fw->arp.invflags \|= ARPT_INV_ARPHRD;
	break;
	case offsetof(struct arphdr, ar_pro):
	get_cmp_data(e, &ar_pro, sizeof(ar_pro), &inv);
	fw->arp.arpro = ar_pro;
	fw->arp.arpro_mask = 0xffff;
	if (inv)
	fw->arp.invflags \|= ARPT_INV_ARPPRO;
	break;
	case offsetof(struct arphdr, ar_op):
	get_cmp_data(e, &ar_op, sizeof(ar_op), &inv);
	fw->arp.arpop = ar_op;
	fw->arp.arpop_mask = 0xffff;
	if (inv)
	fw->arp.invflags \|= ARPT_INV_ARPOP;
	break;
	case offsetof(struct arphdr, ar_hln):
	get_cmp_data(e, &ar_hln, sizeof(ar_op), &inv);
	fw->arp.arhln = ar_hln;
	fw->arp.arhln_mask = 0xff;
	if (inv)
	fw->arp.invflags \|= ARPT_INV_ARPOP;
	break;
	default:
	if (fw->arp.arhln < 0)
	break;

	if (ctx->payload.offset == sizeof(struct arphdr) +
	fw->arp.arhln) {
	get_cmp_data(e, &addr, sizeof(addr), &inv);
	fw->arp.src.s_addr = addr.s_addr;
	if (ctx->flags & NFT_XT_CTX_BITWISE) {
	parse_mask_ipv4(ctx, &fw->arp.smsk);
	ctx->flags &= ~NFT_XT_CTX_BITWISE;
	} else {
	fw->arp.smsk.s_addr = 0xffffffff;
	}

	if (inv)
	fw->arp.invflags \|= ARPT_INV_SRCIP;
	} else if (ctx->payload.offset == sizeof(struct arphdr) +
	fw->arp.arhln +
	sizeof(struct in_addr)) {
	get_cmp_data(e, &addr, sizeof(addr), &inv);
	fw->arp.tgt.s_addr = addr.s_addr;
	if (ctx->flags & NFT_XT_CTX_BITWISE) {
	parse_mask_ipv4(ctx, &fw->arp.tmsk);
	ctx->flags &= ~NFT_XT_CTX_BITWISE;
	} else {
	fw->arp.tmsk.s_addr = 0xffffffff;
	}

	if (inv)
	fw->arp.invflags \|= ARPT_INV_TGTIP;
	}
	break;
	}
	}

	void nft_rule_to_arptables_command_state(struct nftnl_rule *r,
	struct arptables_command_state *cs)
	{
	struct nftnl_expr_iter *iter;
	struct nftnl_expr *expr;
	int family = nftnl_rule_get_u32(r, NFTNL_RULE_FAMILY);
	struct nft_xt_ctx ctx = {
	.state.cs_arp = cs,
	.family = family,
	};

	iter = nftnl_expr_iter_create(r);
	if (iter == NULL)
	return;

	ctx.iter = iter;
	expr = nftnl_expr_iter_next(iter);
	while (expr != NULL) {
	const char *name =
	nftnl_expr_get_str(expr, NFTNL_EXPR_NAME);

	if (strcmp(name, "counter") == 0)
	nft_parse_counter(expr, &ctx.state.cs_arp->fw.counters);
	else if (strcmp(name, "payload") == 0)
	nft_parse_payload(&ctx, expr);
	else if (strcmp(name, "meta") == 0)
	nft_parse_meta(&ctx, expr);
	else if (strcmp(name, "bitwise") == 0)
	nft_parse_bitwise(&ctx, expr);
	else if (strcmp(name, "cmp") == 0)
	nft_parse_cmp(&ctx, expr);
	else if (strcmp(name, "immediate") == 0)
	nft_parse_immediate(&ctx, expr);
	else if (strcmp(name, "target") == 0)
	nft_parse_target(&ctx, expr);

	expr = nftnl_expr_iter_next(iter);
	}

	nftnl_expr_iter_destroy(iter);

	if (cs->jumpto != NULL)
	return;

	if (cs->target != NULL && cs->target->name != NULL)
	cs->target = xtables_find_target(cs->target->name, XTF_TRY_LOAD);
	else
	cs->jumpto = "";
	}

	static void nft_arp_print_header(unsigned int format, const char *chain,
	const char *pol,
	const struct xt_counters *counters,
	bool basechain, uint32_t refs)
	{
	printf("Chain %s", chain);
	if (pol) {
	printf(" (policy %s", pol);
	if (!(format & FMT_NOCOUNTS)) {
	fputc(' ', stdout);
	xtables_print_num(counters->pcnt, (format\|FMT_NOTABLE));
	fputs("packets, ", stdout);
	xtables_print_num(counters->bcnt, (format\|FMT_NOTABLE));
	fputs("bytes", stdout);
	}
	printf(")\n");
	} else {
	printf(" (%u references)\n", refs);
	}
	}

	static void print_fw_details(struct arpt_entry *fw, unsigned int format)
	{
	char buf[BUFSIZ];
	char iface[IFNAMSIZ+2];
	int print_iface = 0;
	int i;

	iface[0] = '\0';

	if (fw->arp.iniface[0] != '\0') {
	strcat(iface, fw->arp.iniface);
	print_iface = 1;
	}
	else if (format & FMT_VIA) {
	print_iface = 1;
	if (format & FMT_NUMERIC) strcat(iface, "*");
	else strcat(iface, "any");
	}
	if (print_iface)
	printf("%s-i %s ", fw->arp.invflags & ARPT_INV_VIA_IN ?
	"! " : "", iface);

	print_iface = 0;
	iface[0] = '\0';

	if (fw->arp.outiface[0] != '\0') {
	strcat(iface, fw->arp.outiface);
	print_iface = 1;
	}
	else if (format & FMT_VIA) {
	print_iface = 1;
	if (format & FMT_NUMERIC) strcat(iface, "*");
	else strcat(iface, "any");
	}
	if (print_iface)
	printf("%s-o %s ", fw->arp.invflags & ARPT_INV_VIA_OUT ?
	"! " : "", iface);

	if (fw->arp.smsk.s_addr != 0L) {
	printf("%s", fw->arp.invflags & ARPT_INV_SRCIP
	? "! " : "");
	if (format & FMT_NUMERIC)
	sprintf(buf, "%s", addr_to_dotted(&(fw->arp.src)));
	else
	sprintf(buf, "%s", addr_to_anyname(&(fw->arp.src)));
	strncat(buf, mask_to_dotted(&(fw->arp.smsk)),
	sizeof(buf) - strlen(buf) - 1);
	printf("-s %s ", buf);
	}

	for (i = 0; i < ARPT_DEV_ADDR_LEN_MAX; i++)
	if (fw->arp.src_devaddr.mask[i] != 0)
	break;
	if (i == ARPT_DEV_ADDR_LEN_MAX)
	goto after_devsrc;
	printf("%s", fw->arp.invflags & ARPT_INV_SRCDEVADDR
	? "! " : "");
	printf("--src-mac ");
	print_mac_and_mask((unsigned char *)fw->arp.src_devaddr.addr,
	(unsigned char *)fw->arp.src_devaddr.mask, ETH_ALEN);
	printf(" ");
	after_devsrc:

	if (fw->arp.tmsk.s_addr != 0L) {
	printf("%s", fw->arp.invflags & ARPT_INV_TGTIP
	? "! " : "");
	if (format & FMT_NUMERIC)
	sprintf(buf, "%s", addr_to_dotted(&(fw->arp.tgt)));
	else
	sprintf(buf, "%s", addr_to_anyname(&(fw->arp.tgt)));
	strncat(buf, mask_to_dotted(&(fw->arp.tmsk)),
	sizeof(buf) - strlen(buf) - 1);
	printf("-d %s ", buf);
	}

	for (i = 0; i <ARPT_DEV_ADDR_LEN_MAX; i++)
	if (fw->arp.tgt_devaddr.mask[i] != 0)
	break;
	if (i == ARPT_DEV_ADDR_LEN_MAX)
	goto after_devdst;
	printf("%s", fw->arp.invflags & ARPT_INV_TGTDEVADDR
	? "! " : "");
	printf("--dst-mac ");
	print_mac_and_mask((unsigned char *)fw->arp.tgt_devaddr.addr,
	(unsigned char *)fw->arp.tgt_devaddr.mask, ETH_ALEN);
	printf(" ");

	after_devdst:

	if (fw->arp.arhln_mask != 0) {
	printf("%s", fw->arp.invflags & ARPT_INV_ARPHLN
	? "! " : "");
	printf("--h-length %d", fw->arp.arhln);
	if (fw->arp.arhln_mask != 255)
	printf("/%d", fw->arp.arhln_mask);
	printf(" ");
	}

	if (fw->arp.arpop_mask != 0) {
	int tmp = ntohs(fw->arp.arpop);

	printf("%s", fw->arp.invflags & ARPT_INV_ARPOP
	? "! " : "");
	if (tmp <= NUMOPCODES && !(format & FMT_NUMERIC))
	printf("--opcode %s", opcodes[tmp-1]);
	else

	if (fw->arp.arpop_mask != 65535)
	printf("/%d", ntohs(fw->arp.arpop_mask));
	printf(" ");
	}

	if (fw->arp.arhrd_mask != 0) {
	uint16_t tmp = ntohs(fw->arp.arhrd);

	printf("%s", fw->arp.invflags & ARPT_INV_ARPHRD
	? "! " : "");
	if (tmp == 1 && !(format & FMT_NUMERIC))
	printf("--h-type %s", "Ethernet");
	else
	printf("--h-type %u", tmp);
	if (fw->arp.arhrd_mask != 65535)
	printf("/%d", ntohs(fw->arp.arhrd_mask));
	printf(" ");
	}

	if (fw->arp.arpro_mask != 0) {
	int tmp = ntohs(fw->arp.arpro);

	printf("%s", fw->arp.invflags & ARPT_INV_ARPPRO
	? "! " : "");
	if (tmp == 0x0800 && !(format & FMT_NUMERIC))
	printf("--proto-type %s", "IPv4");
	else
	printf("--proto-type 0x%x", tmp);
	if (fw->arp.arpro_mask != 65535)
	printf("/%x", ntohs(fw->arp.arpro_mask));
	printf(" ");
	}
	}

	static void
	nft_arp_print_firewall(struct nftnl_rule *r, unsigned int num,
	unsigned int format)
	{
	struct arptables_command_state cs = {};

	nft_rule_to_arptables_command_state(r, &cs);

	if (format & FMT_LINENUMBERS)
	printf("%u ", num);

	print_fw_details(&cs.fw, format);

	if (cs.jumpto != NULL && strcmp(cs.jumpto, "") != 0) {
	printf("-j %s", cs.jumpto);
	} else if (cs.target) {
	printf("-j %s", cs.target->name);
	cs.target->print(&cs.fw, cs.target->t, format & FMT_NUMERIC);
	}

	if (!(format & FMT_NOCOUNTS)) {
	printf(", pcnt=");
	xtables_print_num(cs.fw.counters.pcnt, format);
	printf("-- bcnt=");
	xtables_print_num(cs.fw.counters.bcnt, format);
	}

	if (!(format & FMT_NONEWLINE))
	fputc('\n', stdout);
	}

	static bool nft_arp_is_same(const void *data_a,
	const void *data_b)
	{
	const struct arpt_entry *a = data_a;
	const struct arpt_entry *b = data_b;

	if (a->arp.src.s_addr != b->arp.src.s_addr
	\|\| a->arp.tgt.s_addr != b->arp.tgt.s_addr
	\|\| a->arp.smsk.s_addr != b->arp.tmsk.s_addr
	\|\| a->arp.arpro != b->arp.arpro
	\|\| a->arp.flags != b->arp.flags
	\|\| a->arp.invflags != b->arp.invflags) {
	DEBUGP("different src/dst/proto/flags/invflags\n");
	return false;
	}

	return is_same_interfaces(a->arp.iniface,
	a->arp.outiface,
	(unsigned char *)a->arp.iniface_mask,
	(unsigned char *)a->arp.outiface_mask,
	b->arp.iniface,
	b->arp.outiface,
	(unsigned char *)b->arp.iniface_mask,
	(unsigned char *)b->arp.outiface_mask);
	}

	static bool nft_arp_rule_find(struct nft_family_ops ops, struct nftnl_rule r,
	void *data)
	{
	const struct arptables_command_state *cs = data;
	struct arptables_command_state this = {};

	/* Delete by matching rule case */
	nft_rule_to_arptables_command_state(r, &this);

	if (!nft_arp_is_same(cs, &this))
	return false;

	if (!compare_targets(cs->target, this.target))
	return false;

	if (strcmp(cs->jumpto, this.jumpto) != 0)
	return false;

	return true;
	}

	struct nft_family_ops nft_family_ops_arp = {
	.add = nft_arp_add,
	.is_same = nft_arp_is_same,
	.print_payload = NULL,
	.parse_meta = nft_arp_parse_meta,
	.parse_payload = nft_arp_parse_payload,
	.parse_immediate = nft_arp_parse_immediate,
	.print_header = nft_arp_print_header,
	.print_firewall = nft_arp_print_firewall,
	.save_firewall = NULL,
	.save_counters = NULL,
	.post_parse = NULL,
	.rule_find = nft_arp_rule_find,
	.parse_target = nft_arp_parse_target,
	};