/usr/src/xtables-addons-2.10/extensions/ACCOUNT/libxt_ACCOUNT_cl.c is in xtables-addons-dkms 2.10-1build1.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 | /***************************************************************************
* Copyright (C) 2004 by Intra2net AG *
* opensource@intra2net.com *
* *
* This program is free software; you can redistribute it and/or modify *
* it under the terms of the GNU Lesser General Public License *
* version 2.1 as published by the Free Software Foundation; *
* *
***************************************************************************/
#include <sys/types.h>
#include <sys/socket.h>
#include <string.h>
#include <stdlib.h>
#include <unistd.h>
#include <netinet/in.h>
#include <linux/if.h>
#include <libxt_ACCOUNT_cl.h>
int ipt_ACCOUNT_init(struct ipt_ACCOUNT_context *ctx)
{
memset(ctx, 0, sizeof(struct ipt_ACCOUNT_context));
ctx->handle.handle_nr = -1;
ctx->sockfd = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
if (ctx->sockfd < 0) {
ctx->sockfd = -1;
ctx->error_str = "Can't open socket to kernel. "
"Permission denied or ipt_ACCOUNT module not loaded";
return -1;
}
// 4096 bytes default buffer should save us from reallocations
// as it fits 200 concurrent active clients
if ((ctx->data = malloc(IPT_ACCOUNT_MIN_BUFSIZE)) == NULL) {
close(ctx->sockfd);
ctx->sockfd = -1;
ctx->error_str = "Out of memory for data buffer";
return -1;
}
ctx->data_size = IPT_ACCOUNT_MIN_BUFSIZE;
return 0;
}
void ipt_ACCOUNT_free_entries(struct ipt_ACCOUNT_context *ctx)
{
if (ctx->handle.handle_nr != -1) {
setsockopt(ctx->sockfd, IPPROTO_IP, IPT_SO_SET_ACCOUNT_HANDLE_FREE,
&ctx->handle, sizeof(struct ipt_acc_handle_sockopt));
ctx->handle.handle_nr = -1;
}
ctx->handle.itemcount = 0;
ctx->pos = 0;
}
void ipt_ACCOUNT_deinit(struct ipt_ACCOUNT_context *ctx)
{
free(ctx->data);
ctx->data = NULL;
ipt_ACCOUNT_free_entries(ctx);
close(ctx->sockfd);
ctx->sockfd = -1;
}
int ipt_ACCOUNT_read_entries(struct ipt_ACCOUNT_context *ctx,
const char *table, char dont_flush)
{
unsigned int s = sizeof(struct ipt_acc_handle_sockopt);
unsigned int new_size;
int rtn;
strncpy(ctx->handle.name, table, ACCOUNT_TABLE_NAME_LEN-1);
// Get table information
if (!dont_flush)
rtn = getsockopt(ctx->sockfd, IPPROTO_IP,
IPT_SO_GET_ACCOUNT_PREPARE_READ_FLUSH, &ctx->handle, &s);
else
rtn = getsockopt(ctx->sockfd, IPPROTO_IP, IPT_SO_GET_ACCOUNT_PREPARE_READ,
&ctx->handle, &s);
if (rtn < 0) {
ctx->error_str = "Can't get table information from kernel. "
"Does it exist?";
return -1;
}
// Check data buffer size
ctx->pos = 0;
new_size = ctx->handle.itemcount * sizeof(struct ipt_acc_handle_ip);
// We want to prevent reallocations all the time
if (new_size < IPT_ACCOUNT_MIN_BUFSIZE)
new_size = IPT_ACCOUNT_MIN_BUFSIZE;
// Reallocate if it's too small or twice as big
if (ctx->data_size < new_size || ctx->data_size > new_size * 2) {
// Free old buffer
free(ctx->data);
ctx->data_size = 0;
if ((ctx->data = malloc(new_size)) == NULL) {
ctx->error_str = "Out of memory for data buffer";
ipt_ACCOUNT_free_entries(ctx);
return -1;
}
ctx->data_size = new_size;
}
// Copy data from kernel
memcpy(ctx->data, &ctx->handle, sizeof(struct ipt_acc_handle_sockopt));
rtn = getsockopt(ctx->sockfd, IPPROTO_IP, IPT_SO_GET_ACCOUNT_GET_DATA,
ctx->data, &ctx->data_size);
if (rtn < 0) {
ctx->error_str = "Can't get data from kernel. "
"Check /var/log/messages for details.";
ipt_ACCOUNT_free_entries(ctx);
return -1;
}
// Free kernel handle but don't reset pos/itemcount
setsockopt(ctx->sockfd, IPPROTO_IP, IPT_SO_SET_ACCOUNT_HANDLE_FREE,
&ctx->handle, sizeof(struct ipt_acc_handle_sockopt));
ctx->handle.handle_nr = -1;
return 0;
}
struct ipt_acc_handle_ip *ipt_ACCOUNT_get_next_entry(struct ipt_ACCOUNT_context *ctx)
{
struct ipt_acc_handle_ip *rtn;
// Empty or no more items left to return?
if (!ctx->handle.itemcount || ctx->pos >= ctx->handle.itemcount)
return NULL;
// Get next entry
rtn = (struct ipt_acc_handle_ip *)(ctx->data + ctx->pos
* sizeof(struct ipt_acc_handle_ip));
ctx->pos++;
return rtn;
}
int ipt_ACCOUNT_get_handle_usage(struct ipt_ACCOUNT_context *ctx)
{
unsigned int s = sizeof(struct ipt_acc_handle_sockopt);
if (getsockopt(ctx->sockfd, IPPROTO_IP,
IPT_SO_GET_ACCOUNT_GET_HANDLE_USAGE, &ctx->handle, &s) < 0) {
ctx->error_str = "Can't get handle usage information from kernel";
return -1;
}
ctx->handle.handle_nr = -1;
return ctx->handle.itemcount;
}
int ipt_ACCOUNT_free_all_handles(struct ipt_ACCOUNT_context *ctx)
{
if (setsockopt(ctx->sockfd, IPPROTO_IP,
IPT_SO_SET_ACCOUNT_HANDLE_FREE_ALL, NULL, 0) < 0) {
ctx->error_str = "Can't free all kernel handles";
return -1;
}
return 0;
}
int ipt_ACCOUNT_get_table_names(struct ipt_ACCOUNT_context *ctx)
{
int rtn = getsockopt(ctx->sockfd, IPPROTO_IP,
IPT_SO_GET_ACCOUNT_GET_TABLE_NAMES,
ctx->data, &ctx->data_size);
if (rtn < 0) {
ctx->error_str = "Can't get table names from kernel. Out of memory, "
"MINBUFISZE too small?";
return -1;
}
ctx->pos = 0;
return 0;
}
const char *ipt_ACCOUNT_get_next_name(struct ipt_ACCOUNT_context *ctx)
{
const char *rtn;
if (((char *)ctx->data)[ctx->pos] == 0)
return 0;
rtn = ctx->data + ctx->pos;
ctx->pos += strlen(ctx->data + ctx->pos) + 1;
return rtn;
}
|