1305 lines
38 KiB
C
1305 lines
38 KiB
C
//
|
||
// config.c
|
||
//
|
||
// Created by sunguosong on 2019/8/13.
|
||
//
|
||
|
||
#include "config.h"
|
||
|
||
/*==============================================================================*
|
||
* TEST-DATA |
|
||
*==============================================================================*/
|
||
|
||
// 测试数据iptables-save 配置文件路径
|
||
static const char *__iptables_conf_dir = "./iptables-conf.txt";
|
||
// 测试数据json
|
||
static const char *__json = "{ \"config_type\":3, \"content\":[ \
|
||
{\"action\":1,\"i_device\":\"ens33\",\"source\":\"192.168.12.12\",\
|
||
\"target\":\"SNAT\",\"to\":\"172.18.2.72\"}, \
|
||
{ \
|
||
\"action\": 1,\
|
||
\"target\": \"SNAT\", \
|
||
\"prot\": \"udp\", \
|
||
\"source\": \"192.168.80.0/24\", \
|
||
\"destination\": \"\", \
|
||
\"dport\": \"\", \
|
||
\"to\": \"10.10.10.1:450700-45100\", \
|
||
\"i_device\": \"\", \
|
||
\"o_device\": \"ens33\", \
|
||
\"match\": \"\", \
|
||
\"match_info\": \"\" \
|
||
}, \
|
||
{ \
|
||
\"action\": 1,\
|
||
\"target\": \"SNAT\", \
|
||
\"to\": \"10.10.10.1\", \
|
||
\"i_device\": \"\", \
|
||
\"o_device\": \"\", \
|
||
\"match\": \"mark\", \
|
||
\"match_info\": \"0x64\" \
|
||
}, \
|
||
{ \
|
||
\"action\": 0,\
|
||
\"target\": \"SNAT\", \
|
||
\"id\": 100 \
|
||
}, \
|
||
{ \
|
||
\"action\": 0,\
|
||
\"target\": \"SNAT\", \
|
||
\"id\": 1 \
|
||
}, \
|
||
{ \
|
||
\"action\": 0,\
|
||
\"target\": \"SNAT\", \
|
||
\"id\": 1 \
|
||
}, \
|
||
{ \
|
||
\"action\": 0,\
|
||
\"target\": \"SNAT\", \
|
||
\"id\": 1 \
|
||
}, \
|
||
{ \
|
||
\"action\": 0,\
|
||
\"target\": \"SNAT\", \
|
||
\"id\": 1 \
|
||
}，\
|
||
]}";
|
||
|
||
/*==============================================================================*
|
||
* MACRO |
|
||
*==============================================================================*/
|
||
|
||
#define FILE_FGETS(BUF, MAX_LEN, FP) while(fgets(BUF, MAX_LEN, FP) != NULL)
|
||
#define FILL_IPT_OPTION(OPTION, MAX) \
|
||
strncpy(conf->OPTION, *(_argv + _optind++), (MAX) - 1)
|
||
#define CMP_IPT_OPTION(OPTION) \
|
||
{ if (strcmp(condition->OPTION, "") != 0 && \
|
||
strcmp(condition->OPTION, _argv[_optind]) != 0) { \
|
||
*match = FAIL; goto pass;} \
|
||
}
|
||
|
||
#define isempty_str(ptr) (ptr[0] == '\0') // 字符串判空
|
||
#define isempty_int(v) (v == 0x7fffffff) // int数据未赋值判别
|
||
#define add_space(s) strncat(s, " ", 1)
|
||
#define is_snat(ptr) (strcmp(ptr->target, "SNAT") == 0)
|
||
#define is_dnat(ptr) (strcmp(ptr->target, "DNAT") == 0)
|
||
#define is_masquerade(ptr) (strcmp(ptr->target, "MASQUERADE") == 0)
|
||
#define set_chain(ptr, c) strcpy(ptr->chain, c)
|
||
#define get_chain(ptr) (ptr->chain)
|
||
#define get_id(ptr) (ptr->id)
|
||
#define max(a, b) (((a) > (b)) ? (a) : (b))
|
||
#define min(a, b) (((a) < (b)) ? (a) : (b))
|
||
|
||
/*
|
||
* fopen的包裹，包含异常处理
|
||
* parameters:
|
||
* @__filename: fopen文件路径
|
||
* @__mode: fopen打开模式
|
||
*/
|
||
#define Fopen(fp, __filename, __mode, msg) do { \
|
||
fp = fopen(__filename, __mode); \
|
||
if (fp == NULL) { \
|
||
__error_report(msg, -1, "Can't open the iptables-save file!\n"); \
|
||
return NULL; \
|
||
} \
|
||
} while (0)
|
||
|
||
/*
|
||
* cJSON_Parse的包裹，将字符串形式的json转化为cJSON结构，包含异常处理
|
||
* parameters:
|
||
* @json: 字符串形式的json
|
||
* @value: 字符串形式的json数据
|
||
* @msg: 信息返回
|
||
*/
|
||
#define cJSON_Parse_e(json, value, msg) do { \
|
||
json = cJSON_Parse(value); \
|
||
if (!json) { \
|
||
__error_report(msg, -1, "Error before: [%s]\n", cJSON_GetErrorPtr()); \
|
||
return NULL; \
|
||
} \
|
||
} while (0)
|
||
|
||
|
||
#define _IPT_STR_ITEM_TOJSON(CE, E) do { \
|
||
if (*(conf->CE) != 0) \
|
||
cJSON_AddStringToObject(obj, #E, conf->CE); \
|
||
/* else cJSON_AddNullToObject(obj, #E); */ \
|
||
} while (0)
|
||
|
||
#define _IPT_INT_ITEM_TOJSON(CE, E) do { \
|
||
if (conf->CE != 0) \
|
||
cJSON_AddNumberToObject(obj, #E, conf->CE); \
|
||
/* else cJSON_AddNullToObject(obj, #E); */ \
|
||
} while (0)
|
||
|
||
#define _JSON_STR_TO_IPT_ITEM(E, CE, MAX) do { \
|
||
cJSON *__json = cJSON_GetObjectItem(json, #E); \
|
||
if (__json) { \
|
||
if (strlen(__json->valuestring) >= MAX) {*ret = RET_INPUTERR; goto err;} \
|
||
else strcpy(conf->CE, __json->valuestring); \
|
||
} \
|
||
else strcpy(conf->CE, ""); \
|
||
} while (0)
|
||
|
||
#define _JSON_INT_TO_IPT_ITEM(E) do { \
|
||
cJSON *__json = cJSON_GetObjectItem(json, #E); \
|
||
if (__json) conf->E = __json->valueint; \
|
||
else conf->E = 0x7fffffff;\
|
||
} while (0)
|
||
|
||
// 宏: str拼接到字符串，并防止拼接越界
|
||
#define strcat_str_free_count(des, src) do { \
|
||
int len = strlen(src); \
|
||
if (free_space <= len) {ret = RET_NOMEM; goto err;} \
|
||
else { \
|
||
strncat(des, src, free_space-1); \
|
||
free_space -= len; \
|
||
} \
|
||
} while (0)
|
||
|
||
// 宏: int拼接到字符串，并防止拼接越界
|
||
#define strcat_int_free_count(des, src) do { \
|
||
char s[21]; \
|
||
if (src == -1) s[0] = '\0'; else itoa(src, s); \
|
||
int len = strlen(s); \
|
||
if (free_space <= len) {ret = RET_NOMEM; goto err;} \
|
||
else { \
|
||
strncat(des, s, free_space-1); \
|
||
free_space -= len; \
|
||
} \
|
||
} while (0)
|
||
|
||
|
||
/*
|
||
* 宏: 命令拼接
|
||
* @rule: 已完成拼接命令
|
||
* @E: 待拼接字段
|
||
* @EX: 拓展拼接字符串
|
||
* @type: 带拼接字段类型，可选str，int
|
||
*/
|
||
#define splice_item(rule, E, CE, EX, type) do { \
|
||
enum ipt_config_item item = E; \
|
||
if (!isempty_##type(conf->CE)) { \
|
||
strcat_str_free_count(rule, __prefix[item]); \
|
||
if (!isempty_str(EX)) { \
|
||
strcat_str_free_count(rule, EX); \
|
||
strcat_str_free_count(rule, " "); \
|
||
} \
|
||
strcat_##type##_free_count(rule, conf->CE); \
|
||
} \
|
||
} while (0)
|
||
|
||
/*
|
||
* malloc宏，异常信息处理通过chk_malloc_oom_handler，goto MEMerr
|
||
* parameters:
|
||
* @ptr： 待分配指针
|
||
* @struct: 指针结构类型
|
||
* @size： 分配空间字节数
|
||
* @ret: ret_code返回码
|
||
* @msg: 信息返回
|
||
*/
|
||
#define __chk_malloc(ptr, struct, size, ret, msg) do { \
|
||
ptr = (struct)malloc(size); \
|
||
if(!(ptr)) { \
|
||
if(msg) chk_malloc_oom_handler(size, msg);\
|
||
ret = RET_NOMEM; \
|
||
goto MEMerr; \
|
||
} \
|
||
} while (0)
|
||
|
||
|
||
#define xfree(X) do{ \
|
||
if(X) { \
|
||
free(X); \
|
||
X = NULL; \
|
||
} \
|
||
} while(0)
|
||
|
||
/*==============================================================================*
|
||
* VARIABLES |
|
||
*==============================================================================*/
|
||
|
||
// 全局返回信息最大长度
|
||
static int free_space = MAX_ERR_MSG;
|
||
// 当前执行的命令id
|
||
static int current_id = -1;
|
||
|
||
typedef void *(*jsonfunc)(cJSON *json_arr, int *output_len, ret_code *ret, char **msg);
|
||
|
||
// iptables 命令参数拼接前缀
|
||
static char * __prefix[IPT_PARANUM] = {
|
||
" -D ",
|
||
" -I ",
|
||
" -A ",
|
||
" -s ",
|
||
" -d ",
|
||
" -p ",
|
||
" --sport ",
|
||
" --dport ",
|
||
" -i ",
|
||
" -o ",
|
||
" -m ",
|
||
" --",
|
||
" -j ",
|
||
" --to-"
|
||
};
|
||
|
||
static char *__field_match[NF_PARANUM] = {
|
||
"src=",
|
||
"dst=",
|
||
"sport=",
|
||
"dport=",
|
||
"src=",
|
||
"dst=",
|
||
"sport=",
|
||
"dport=",
|
||
};
|
||
|
||
// json字段枚举，action不参与命令拼接
|
||
enum ipt_config_item {
|
||
del, insert, chain, source, destination, prot, sport, dport, i_device,
|
||
o_device, match, match_info, target, to
|
||
};
|
||
|
||
// set配置枚举
|
||
enum action {
|
||
DELETE, SET, SAVE, RESTORE, UNKNOWN
|
||
};
|
||
|
||
/*==============================================================================*
|
||
* PRIVATE-API |
|
||
*==============================================================================*/
|
||
|
||
// 从iptables-save配置文件读取iptables中nat的配置信息,可指定范围
|
||
iptables_rule *__read_iptables_conf(const char *filename, int *output_len, int begin,
|
||
int offset, ret_code *ret, char **msg);
|
||
|
||
// 使用一条ipt_config结构配置信息，拼接成linux命令
|
||
ret_code __command_splice(struct ipt_config *conf, iptables_rule rule, char **msg);
|
||
|
||
// 按顺序解析参数序列中的参数标记
|
||
uchar __extract_parm(int *_optind, const int _argc, char **_argv);
|
||
// 将字符串按空格(space)拆分成字符串指针,可处理连续空格
|
||
char **__str2str_array(const char *str, int *output_len);
|
||
// 将字符串按指定分隔符拆分成字符串指针,可处理连续分隔符
|
||
char** split(const char * const targetString, const char * const delimiter,int * const length);
|
||
// 将int整数转化成char*字符串
|
||
void itoa(int a, char s[]);
|
||
// ipt_config结构的配置信息合法性检查，完成缺省配置推导
|
||
boolean __iptconfig_chk(struct ipt_config *conf, char **msg);
|
||
// 将一条ipt_config类型的配置信息转化为json数据
|
||
ret_code __ipt_config_tojson(cJSON *root, const struct ipt_config *conf);
|
||
|
||
// 将字符串格式的json配置信息解析为多种数据类型
|
||
void *__jsontxt_to_struct(const char *json_text, int *output_len, jsonfunc func,
|
||
ret_code *ret, char **msg);
|
||
// 将nat模块使用的cjson配置信息解析为ipt_config类型
|
||
void *__cjsonarr_to_ipt_config(cJSON *json_arr, int *output_len,
|
||
ret_code *ret, char **msg);
|
||
// 将nat模块使用的cjson配置信息解析为range_ipt_config类型
|
||
void *__cjsonarr_to_range_ipt_config(cJSON *json_arr, int *output_len,
|
||
ret_code *ret, char **msg);
|
||
|
||
// 解析ipt_config的action字段
|
||
enum action __parse_action(const struct ipt_config * const conf);
|
||
// 解析一条字符串形式的nat配置信息,并与规则进行匹配
|
||
ret_code __ipt_conf_parse(const iptables_rule rule, const struct ipt_config *condition,
|
||
boolean *match, struct ipt_config *conf);
|
||
|
||
// 从/proc/net/nf_conntrack中读取连接跟踪信息,暂不使用
|
||
char **__read_nf_conntrack(const char *filename, int *output_len,
|
||
ret_code *ret, char **msg);
|
||
// 连接跟踪信息解析,暂不使用,未完成
|
||
ret_code __nf_conntrack_parse(const char *conn, nf_conntrack *conf);
|
||
|
||
// 异常处理函数
|
||
char *__error_report(char** msg, int id, char *fmt, ...)
|
||
__attribute__((format(printf, 3, 4)));
|
||
|
||
// 字符串指针（char**）释放函数
|
||
void __free_dptr_char(char ***ptr, int len);
|
||
|
||
/*==============================================================================*
|
||
* FUNCTION |
|
||
*==============================================================================*/
|
||
|
||
/*
|
||
* 异常处理函数
|
||
* parameters:
|
||
* @msg: 异常信息返回
|
||
* @id: 命令序号
|
||
* @fmt, ...
|
||
*
|
||
* return: 错误信息字符串
|
||
*/
|
||
char* __error_report (char **msg, int id, char *fmt, ...) {
|
||
if (*msg == NULL) return NULL;
|
||
char _msg_head[MAX_LINE_LEN - 1];
|
||
char _msg_tail[MAX_LINE_LEN - 30];
|
||
va_list va;
|
||
|
||
// 使用宏strcat_str_free_count，不返回
|
||
ret_code ret;
|
||
|
||
va_start(va, fmt);
|
||
vsnprintf(_msg_tail, MAX_LINE_LEN - 30, fmt, va);
|
||
va_end(va);
|
||
|
||
snprintf(_msg_head, MAX_LINE_LEN - 1, "[err] JSON id: %03d, msg:", id);
|
||
strcat_str_free_count(_msg_head, _msg_tail);
|
||
if (_msg_head[strlen(_msg_head) - 1] != '\n') {
|
||
strcat_str_free_count(_msg_head, "\n");
|
||
}
|
||
|
||
strcat_str_free_count(*msg, _msg_head);
|
||
printf("%s\n", *msg);
|
||
|
||
err:
|
||
return NULL;
|
||
}
|
||
|
||
|
||
/*
|
||
* 将int整数转化成char*字符串
|
||
* parameters:
|
||
* @a: 待转化int类型整数
|
||
* @s: 返回转化后字符串数组
|
||
*
|
||
* return: void
|
||
*/
|
||
void itoa(int a, char s[]) {
|
||
snprintf(s, 20, "%d", a);
|
||
}
|
||
|
||
static void chk_malloc_default_oom(size_t size, char **msg) {
|
||
__error_report(msg, -1, "malloc: out of memory trying to allocate %zu bytes\n", size);
|
||
//abort();
|
||
}
|
||
|
||
static void(*chk_malloc_oom_handler)(size_t, char**) = chk_malloc_default_oom;
|
||
|
||
|
||
/*
|
||
* 字符串指针（char**）释放函数
|
||
* parameters:
|
||
* @ptr: 待释放字符串指针
|
||
* @len: 所包含一维指针个数
|
||
*
|
||
* return: 成功则返回void*
|
||
*/
|
||
void __free_dptr_char(char ***ptr, int len) {
|
||
int i = 0;
|
||
if (*ptr == NULL) return;
|
||
for ( ; i < len; ++i) xfree((*ptr)[i]);
|
||
xfree(*ptr);
|
||
}
|
||
|
||
/*
|
||
* linux系统命令执行函数
|
||
* parameters:
|
||
* @cmd： char*形式的linux命令
|
||
* @id: 命令执行序号
|
||
* @msg: 信息返回
|
||
*
|
||
* return: ret_code返回码
|
||
*/
|
||
ret_code run_command( char *const cmd, char **msg) {
|
||
char* result = NULL;
|
||
FILE *fpRead = NULL;
|
||
ret_code ret = RET_OK;
|
||
char buf[MAX_LINE_LEN] = {0};
|
||
//char result[MAX_LINE_LEN] = {0};
|
||
if(!cmd){
|
||
goto pass;
|
||
}
|
||
__chk_malloc(result, char*, MAX_LINE_LEN * sizeof(char), ret, msg);
|
||
result = (char *)malloc(MAX_LINE_LEN);
|
||
if(!result){
|
||
goto pass;
|
||
}
|
||
//printf("1cmd: addr is %x, content is %s\n", cmd, cmd);
|
||
//printf("1result: addr is %x, content is %s\n", result, result);
|
||
memset(result, 0, MAX_LINE_LEN);
|
||
printf("%s\n", cmd);
|
||
// 执行cmd命令，fpRead指向命令执行后的shell信息
|
||
fpRead = popen(cmd, "r");
|
||
if (fpRead == NULL) goto pass;
|
||
|
||
FILE_FGETS(buf, MAX_LINE_LEN - 1,fpRead) {
|
||
strncat(result, buf, MAX_LINE_LEN - 1);
|
||
// 只返回第一行错误信息
|
||
break;
|
||
}
|
||
//printf("2cmd: addr is %x, content is %s\n", cmd, cmd);
|
||
//printf("2result: addr is %x, content is %s\n", result, result);
|
||
if (!isempty_str(result)) {
|
||
__error_report(msg, current_id, "%s", result);
|
||
ret = RET_ERR;
|
||
goto pass;
|
||
}
|
||
|
||
|
||
MEMerr:
|
||
pass:
|
||
if(fpRead!=NULL)
|
||
pclose(fpRead);
|
||
|
||
xfree(result);
|
||
return ret;
|
||
}
|
||
|
||
|
||
/*
|
||
* 从iptables-save配置文件读取iptables中nat的配置信息,可指定范围
|
||
* parameters:
|
||
* @filename: iptables-save配置文件路径
|
||
* @output_len: 返回值中nat配置信息条目数，无需初始化
|
||
* @ret: ret_code返回码
|
||
* @begin: 指定nat配置开始位置
|
||
* @offset: 指定nat配置结束位置,相对begin偏移量;若为-1,则读取到nat配置结束
|
||
* @msg: 信息返回
|
||
*
|
||
* return: 包含nat配置信息的二级指针
|
||
*/
|
||
iptables_rule *__read_iptables_conf(const char *filename, int *output_len, int begin,
|
||
int offset, ret_code *ret, char **msg) {
|
||
FILE *fp = NULL;
|
||
char buf[MAX_LINE_LEN];
|
||
int nat_start_flag = 0, nat_offset = -1;
|
||
int lines = 0, count = 0, i = 0;
|
||
iptables_rule *__rules = NULL;
|
||
|
||
*output_len = 0;
|
||
Fopen(fp, filename, "r", msg);
|
||
|
||
FILE_FGETS(buf, MAX_LINE_LEN - 1,fp) {
|
||
if (strncmp("*nat", buf, 4) == 0) {
|
||
nat_start_flag = 1;
|
||
break;
|
||
}
|
||
}
|
||
|
||
// 定位nat配置信息在iptables-save文件中的起止位置，获取配置条目数count
|
||
if (nat_offset == -1) nat_offset = ftell(fp);
|
||
if (nat_start_flag == 0) {
|
||
fclose(fp);
|
||
return NULL;
|
||
}
|
||
else { // 定位nat配置结束位置
|
||
FILE_FGETS(buf, MAX_LINE_LEN - 1,fp) {
|
||
if (strncmp("COMMIT", buf, 6) == 0) break;
|
||
count += 1;
|
||
}
|
||
}
|
||
|
||
if (offset < 0) offset = count;
|
||
*output_len = max(min(count - begin, offset), 0);
|
||
if (*output_len == 0) goto pass;
|
||
|
||
__chk_malloc(__rules, iptables_rule*, sizeof(iptables_rule) * (*output_len), *ret, msg);
|
||
|
||
// FILE指针重置到nat部分起始位置
|
||
fseek(fp, nat_offset, SEEK_SET);
|
||
FILE_FGETS(buf, MAX_LINE_LEN - 1, fp) {
|
||
if (i == count || i == begin + offset) break;
|
||
if (i < begin) continue;
|
||
__chk_malloc(__rules[i], iptables_rule, sizeof(char) * MAX_LINE_LEN, *ret, msg);
|
||
memset(__rules[i], 0, sizeof(char)*MAX_LINE_LEN);
|
||
|
||
strncpy(__rules[i], buf, MAX_LINE_LEN - 1);
|
||
i += 1;
|
||
}
|
||
|
||
if(fp!=NULL)
|
||
fclose(fp);
|
||
return __rules;
|
||
|
||
MEMerr:
|
||
__free_dptr_char(&__rules, *output_len);
|
||
*output_len = 0;
|
||
pass:
|
||
if(fp!=NULL)
|
||
fclose(fp);
|
||
return NULL;
|
||
}
|
||
|
||
/*
|
||
* 从/proc/net/nf_conntrack中读取连接跟踪信息,暂不使用
|
||
* parameters:
|
||
* @filename: iptables-save配置文件路径
|
||
* @output_len: 返回值中nat配置信息条目数，无需初始化
|
||
* @ret: ret_code返回码
|
||
* @msg: 信息返回
|
||
*
|
||
* return: 包含连接跟踪信息的二级指针
|
||
*/
|
||
char **__read_nf_conntrack(const char *filename, int *output_len,
|
||
ret_code *ret, char **msg) {
|
||
FILE *fp = NULL;
|
||
int count = 0, i = 0;
|
||
char ch, buf[MAX_LINE_LEN];
|
||
char **result = NULL;
|
||
|
||
Fopen(fp, filename, "r", msg);
|
||
|
||
while((ch = fgetc(fp)) != EOF) {
|
||
if(ch == '\n') count++;
|
||
}
|
||
|
||
__chk_malloc(result, char**, sizeof(char*) * count, *ret, msg);
|
||
|
||
fseek(fp, 0, SEEK_SET);
|
||
FILE_FGETS(buf, MAX_LINE_LEN - 1, fp) {
|
||
__chk_malloc(result[i], char*, MAX_LINE_LEN, *ret, msg);
|
||
memset(result[i], 0, MAX_LINE_LEN);
|
||
|
||
strncpy(result[i], buf, MAX_LINE_LEN - 1);
|
||
if (++i == count) break;
|
||
}
|
||
|
||
*output_len = count;
|
||
return result;
|
||
|
||
MEMerr:
|
||
__free_dptr_char(&result, count);
|
||
|
||
if(fp!=NULL)
|
||
fclose(fp);
|
||
return NULL;
|
||
}
|
||
|
||
/*
|
||
* 将字符串按空格(space)拆分成字符串指针,可处理连续空格
|
||
* parameters:
|
||
* @str: 待拆分字符串
|
||
* @output_len: 拆分后的字符串数目，初始化0
|
||
*/
|
||
char **__str2str_array(const char *str, int *output_len) {
|
||
char * ch1 = "\n";
|
||
char * ch2 = " ";
|
||
int length1 = 0;
|
||
int length2 = 0;
|
||
|
||
char **result1 = split(str, ch1, &length1);
|
||
if (!result1) return NULL;
|
||
|
||
char **result2 = split(result1[0], ch2, &length2);
|
||
|
||
*output_len = length2;
|
||
__free_dptr_char(&result1, length1);
|
||
return result2;
|
||
}
|
||
|
||
/*
|
||
* 将字符串按指定分隔符拆分成字符串指针,可处理连续分隔符
|
||
* parameters:
|
||
* @targetString: 待拆分字符串
|
||
* @delimiter: 指定分隔符
|
||
* @length: 拆分后的字符串数目，初始化0
|
||
*/
|
||
char **split(const char * const targetString, const char * const delimiter,
|
||
int * const length){
|
||
|
||
*length = 0;
|
||
char ** resultString = NULL;
|
||
char inputString[strlen(targetString)];
|
||
strcpy(inputString,targetString);
|
||
|
||
char inputDelimiter[strlen(delimiter)];
|
||
strcpy(inputDelimiter,delimiter);
|
||
|
||
char * splitedString = strtok(inputString, inputDelimiter);
|
||
while (splitedString){
|
||
(*length)++;
|
||
char *resultChar = NULL;
|
||
|
||
// 不使用__chk_malloc，将报错延迟到命令解析函数
|
||
resultChar = malloc(strlen(splitedString) + 1);
|
||
if (!resultChar) {
|
||
__free_dptr_char(&resultString, *length - 1);
|
||
return NULL;
|
||
}
|
||
|
||
strcpy(resultChar,splitedString);
|
||
resultString = realloc(resultString, (*length) * sizeof(char *));
|
||
if (!resultString) {
|
||
__free_dptr_char(&resultString, *length);
|
||
return NULL;
|
||
}
|
||
|
||
resultString[(*length) - 1] = resultChar;
|
||
|
||
splitedString = strtok(NULL, delimiter);
|
||
}
|
||
|
||
return resultString;
|
||
}
|
||
|
||
|
||
/*
|
||
* 按顺序解析参数序列中的参数标记
|
||
* parameters:
|
||
* @_optind: 正在处理的参数在参数序列中的位置, 函数返回前该值+1，指向下一参数
|
||
* @argc: 参数数目
|
||
* @argv: 参数序列指针
|
||
*
|
||
* return: 返回unsigned char类型的唯一参数标记
|
||
*/
|
||
uchar __extract_parm(int *_optind, const int _argc, char **_argv) {
|
||
char *_locate_2 = NULL;
|
||
|
||
// 当前参数位置超过参数序列中参数数目
|
||
if (*_optind >= _argc) return FAIL;
|
||
if (**(_argv + *_optind) == '-') {
|
||
//参数标记前只有一个“-”
|
||
if(*(*(_argv + *_optind) + 1) != '-') {
|
||
return *(*(_argv + (*_optind)++) + 1);
|
||
}
|
||
// 遇到两个连续的“--”
|
||
else {
|
||
_locate_2 = *(_argv + (*_optind)++) + 2;
|
||
|
||
// 非单字符参数标记重新映射
|
||
if (strcmp(_locate_2, "to-destination") == 0 || \
|
||
strcmp(_locate_2, "to-source") == 0) return 128;
|
||
if (strcmp(_locate_2, "sport") == 0) return 129;
|
||
if (strcmp(_locate_2, "dport") == 0) return 130;
|
||
if (strcmp(_locate_2, "mark") == 0) return 131;
|
||
|
||
else return FAIL;
|
||
}
|
||
}
|
||
else return FAIL;
|
||
}
|
||
|
||
/*
|
||
* 解析一条字符串形式的nat配置信息,并与规则进行匹配
|
||
* parameters:
|
||
* @rule: 一条字符串形式的nat配置信息
|
||
* @condition: 匹配规则
|
||
* @match: 若与condition匹配成功,则赋值为success,否则fail
|
||
* @conf: 返回指向解析结果的ipt_config指针,需要预分配空间
|
||
*
|
||
* return: ret_code返回码
|
||
*/
|
||
ret_code __ipt_conf_parse(const iptables_rule rule, const struct ipt_config *condition,
|
||
boolean *match, struct ipt_config *conf) {
|
||
int _optind = 0, _argc;
|
||
uchar option;
|
||
ret_code ret = RET_OK;
|
||
|
||
// 将字符串格式的配置信息分解为参数序列
|
||
// argv: 参数序列，argc: argv中参数个数
|
||
char **_argv = __str2str_array(rule, &_argc);
|
||
if (!_argv) {
|
||
ret = RET_NOMEM;
|
||
goto MEMerr;
|
||
}
|
||
|
||
*match = SUCCESS;
|
||
while(option = __extract_parm(&_optind, _argc, _argv)) {
|
||
if (_optind >= _argc) break;
|
||
switch(option) {
|
||
case 'A':
|
||
CMP_IPT_OPTION(chain);
|
||
FILL_IPT_OPTION(chain, MAX_CHAIN);
|
||
|
||
break;
|
||
|
||
case 'd':
|
||
CMP_IPT_OPTION(destination);
|
||
FILL_IPT_OPTION(destination, MAX_ADDR);
|
||
break;
|
||
|
||
case 's':
|
||
CMP_IPT_OPTION(source);
|
||
FILL_IPT_OPTION(source, MAX_ADDR);
|
||
break;
|
||
|
||
case 'i':
|
||
CMP_IPT_OPTION(i_device);
|
||
FILL_IPT_OPTION(i_device, MAX_DEVICE);
|
||
break;
|
||
|
||
case 'o':
|
||
CMP_IPT_OPTION(o_device);
|
||
FILL_IPT_OPTION(o_device, MAX_DEVICE);
|
||
break;
|
||
|
||
case 'p':
|
||
CMP_IPT_OPTION(prot);
|
||
FILL_IPT_OPTION(prot, MAX_PROT);
|
||
break;
|
||
|
||
case 'j':
|
||
//CMP_IPT_OPTION(target);
|
||
FILL_IPT_OPTION(target, MAX_TARGET);
|
||
break;
|
||
|
||
case 128:
|
||
CMP_IPT_OPTION(to);
|
||
FILL_IPT_OPTION(to, MAX_ADDR);
|
||
break;
|
||
|
||
case 129:
|
||
CMP_IPT_OPTION(sport);
|
||
FILL_IPT_OPTION(sport, MAX_PORT);
|
||
break;
|
||
|
||
case 130:
|
||
CMP_IPT_OPTION(dport);
|
||
FILL_IPT_OPTION(dport, MAX_PORT);
|
||
break;
|
||
|
||
case 'm':
|
||
CMP_IPT_OPTION(match);
|
||
FILL_IPT_OPTION(match, MAX_MATCH);
|
||
break;
|
||
|
||
case 131:
|
||
CMP_IPT_OPTION(match_info);
|
||
FILL_IPT_OPTION(match_info, MAX_MATCH_INFO);
|
||
break;
|
||
|
||
default:
|
||
_optind++;
|
||
break;
|
||
}
|
||
}
|
||
pass:
|
||
__free_dptr_char(&_argv, _argc);
|
||
|
||
MEMerr:
|
||
return ret;
|
||
}
|
||
|
||
// 连接跟踪信息解析,暂不使用,未完成
|
||
ret_code __nf_conntrack_parse(const char *conn, nf_conntrack *conf) {
|
||
int _argc = 0, i = 0, match_id = 0;
|
||
ret_code ret = RET_OK;
|
||
char **_argv = __str2str_array(conn, &_argc);
|
||
|
||
if (!_argv) {
|
||
ret = RET_NOMEM;
|
||
goto MEMerr;
|
||
}
|
||
|
||
strncpy(conf->prot, _argv[2], MAX_PROT - 1);
|
||
for (i = 3; i < _argc; ++i) {
|
||
if (strncmp(_argv[i], __field_match[match_id],
|
||
strlen(__field_match[match_id])) == 0) {
|
||
// TO DO
|
||
++match_id;
|
||
}
|
||
|
||
}
|
||
|
||
__free_dptr_char(&_argv, _argc);
|
||
|
||
MEMerr:
|
||
return ret;
|
||
}
|
||
|
||
// 解析ipt_config的action字段
|
||
enum action __parse_action(const struct ipt_config * const conf) {
|
||
enum action act;
|
||
|
||
if ((strcmp(conf->action, "ADD") == 0)) act = SET;
|
||
else if ((strcmp(conf->action, "DEL") == 0)) act = DELETE;
|
||
else if ((strcmp(conf->action, "SAVE") == 0)) act = SAVE;
|
||
else if ((strcmp(conf->action, "RESTORE") == 0)) act = RESTORE;
|
||
else act = UNKNOWN;
|
||
|
||
return act;
|
||
}
|
||
|
||
/*
|
||
* 将nat模块使用的cjson配置信息解析为ipt_config类型
|
||
* parameters:
|
||
* @json_arr: 待解析cjson配置信息
|
||
* @output_len: 返回值中ipt_config配置信息条数，赋值0
|
||
* @ret: ret_code返回码
|
||
* @msg: 返回信息
|
||
*
|
||
* return: 指向ipt_config格式配置信息的指针,可能包含多条配置信息
|
||
*/
|
||
void *__cjsonarr_to_ipt_config(cJSON *json_arr, int *output_len,
|
||
ret_code *ret, char **msg) {
|
||
size_t json_arr_size, i;
|
||
struct ipt_config *conf = NULL, *conf_start = NULL;
|
||
cJSON *json = NULL;
|
||
|
||
json_arr_size = cJSON_GetArraySize(json_arr);
|
||
__chk_malloc(conf, struct ipt_config*, sizeof(*conf) * json_arr_size, *ret, msg);
|
||
memset(conf, 0, json_arr_size * sizeof(struct ipt_config));
|
||
conf_start = conf;
|
||
|
||
for (i = 0; i < json_arr_size; ++i, ++conf) {
|
||
json = cJSON_GetArrayItem(json_arr, i);
|
||
//__JSON_STR_TO_IPT_ITEM(chain, MAX_CHAIN);
|
||
_JSON_STR_TO_IPT_ITEM(action, action, MAX_ACTION);
|
||
_JSON_STR_TO_IPT_ITEM(id, id, MAX_ID);
|
||
_JSON_STR_TO_IPT_ITEM(target, target, MAX_TARGET);
|
||
_JSON_STR_TO_IPT_ITEM(prot, prot, MAX_PROT);
|
||
_JSON_STR_TO_IPT_ITEM(source, source, MAX_ADDR);
|
||
_JSON_STR_TO_IPT_ITEM(destination, destination, MAX_ADDR);
|
||
_JSON_STR_TO_IPT_ITEM(sport, sport, MAX_PORT);
|
||
_JSON_STR_TO_IPT_ITEM(dport, dport, MAX_PORT);
|
||
_JSON_STR_TO_IPT_ITEM(to, to, MAX_ADDR);
|
||
|
||
_JSON_STR_TO_IPT_ITEM(device, i_device, MAX_DEVICE);
|
||
_JSON_STR_TO_IPT_ITEM(device, o_device, MAX_DEVICE);
|
||
|
||
_JSON_STR_TO_IPT_ITEM(match, match, MAX_MATCH);
|
||
_JSON_STR_TO_IPT_ITEM(match_info, match_info, MAX_MATCH_INFO);
|
||
|
||
}
|
||
goto pass;
|
||
err:
|
||
__error_report(msg, i, "json item is too long to save in ipt_config.");
|
||
MEMerr:
|
||
xfree(conf_start);
|
||
pass:
|
||
*output_len = json_arr_size;
|
||
|
||
return conf_start;
|
||
}
|
||
|
||
/*
|
||
* 将nat模块使用的cjson配置信息解析为range_ipt_config类型
|
||
* parameters:
|
||
* @json_arr: 待解析cjson配置信息
|
||
* @output_len: 返回值中range_ipt_config配置信息条数，赋值0
|
||
* @ret: ret_code返回码
|
||
* @msg: 返回信息
|
||
*
|
||
* return: 指向range_ipt_config格式配置信息的指针,可能包含多条配置信息
|
||
*/
|
||
void *__cjsonarr_to_range_ipt_config(cJSON *json_arr, int *output_len,
|
||
ret_code *ret, char **msg){
|
||
size_t json_arr_size, i;
|
||
struct ipt_config *conf = NULL, *conf_start = NULL;
|
||
struct range_ipt_config *rwconf = NULL, *rwconf_start = NULL;
|
||
cJSON *json = NULL, *__json = NULL;
|
||
|
||
json_arr_size = cJSON_GetArraySize(json_arr);
|
||
__chk_malloc(rwconf, struct range_ipt_config*, sizeof(*rwconf) * json_arr_size, *ret, msg);
|
||
memset(rwconf, 0, json_arr_size * sizeof(struct range_ipt_config));
|
||
rwconf_start = rwconf;
|
||
|
||
__chk_malloc(conf, struct ipt_config*, sizeof(*conf) * json_arr_size, *ret, msg);
|
||
memset(conf, 0, json_arr_size * sizeof(struct ipt_config));
|
||
conf_start = conf;
|
||
|
||
conf = __cjsonarr_to_ipt_config(json_arr, output_len, ret, msg);
|
||
|
||
for (i = 0; i < json_arr_size; ++i, ++conf, ++rwconf) {
|
||
memcpy(&(rwconf->conf), conf, sizeof(struct ipt_config));
|
||
|
||
json = cJSON_GetArrayItem(json_arr, i);
|
||
__json = cJSON_GetObjectItem(json, "begin");
|
||
if (__json) rwconf->begin = atoi(__json->valuestring);
|
||
else {
|
||
*ret = RET_INPUTERR;
|
||
goto MEMerr;
|
||
}
|
||
|
||
json = cJSON_GetArrayItem(json_arr, i);
|
||
__json = cJSON_GetObjectItem(json, "offset");
|
||
if (__json) rwconf->offset = atoi(__json->valuestring);
|
||
else {
|
||
*ret = RET_INPUTERR;
|
||
goto MEMerr;
|
||
}
|
||
}
|
||
goto pass;
|
||
err:
|
||
__error_report(msg, i, "json item is too long to save in range_ipt_config.");
|
||
MEMerr:
|
||
xfree(rwconf_start);
|
||
pass:
|
||
xfree(conf_start);
|
||
*output_len = json_arr_size;
|
||
|
||
return rwconf_start;
|
||
}
|
||
|
||
/*
|
||
* 将字符串格式的json配置信息解析为多种数据类型
|
||
* parameters:
|
||
* @json_text: 字符串格式的json配置信息
|
||
* @output_len: 返回值中ipt_config配置信息条数，赋值0
|
||
* @func: 指向具体解析方法的函数指针
|
||
* @ret: ret_code返回码
|
||
* @msg: 返回信息
|
||
*
|
||
* return: 指向void*类型配置信息的指针,可能包含多条配置信息
|
||
*/
|
||
void *__jsontxt_to_struct(const char *json_text, int *output_len, jsonfunc func,
|
||
ret_code *ret, char **msg) {
|
||
cJSON *json_all = NULL, *json_arr = NULL;
|
||
void *conf = NULL;
|
||
|
||
*output_len = 0;
|
||
cJSON_Parse_e(json_all, json_text, msg);
|
||
|
||
json_arr = cJSON_GetObjectItem(json_all, "content");
|
||
if (!json_arr) {
|
||
__error_report(msg, -1, "%s", "json without content!");
|
||
*ret = RET_NOMEM;
|
||
goto MEMerr;
|
||
}
|
||
|
||
conf = func(json_arr, output_len, ret, msg);
|
||
|
||
MEMerr:
|
||
cJSON_Delete(json_all);
|
||
return conf;
|
||
}
|
||
|
||
|
||
/*
|
||
* 使用一条ipt_config结构配置信息，拼接成linux命令
|
||
* parameters:
|
||
* @conf: 一条ipt_config结构的的nat配置信息
|
||
* @rule: 返回拼接后的字符串格式linux命令,需要预分配空间
|
||
* @msg: 信息返回
|
||
*
|
||
* return: ret_code返回码
|
||
*/
|
||
ret_code __command_splice(struct ipt_config *conf, iptables_rule rule, char **msg) {
|
||
iptables_rule head = "sudo iptables -t nat";
|
||
size_t free_space = MAX_LINE_LEN;
|
||
enum action option;
|
||
ret_code ret = RET_OK;
|
||
|
||
switch (option = __parse_action(conf)) {
|
||
|
||
// delete
|
||
case DELETE:
|
||
if (!isempty_str(conf->id)) {
|
||
strcat_str_free_count(rule, head);
|
||
splice_item(rule, del, id, get_chain(conf), str);
|
||
}
|
||
else {
|
||
strcpy(conf->id, " ");
|
||
strcat_str_free_count(rule, head);
|
||
splice_item(rule, del, id, get_chain(conf), str);
|
||
goto setmode;
|
||
}
|
||
|
||
break;
|
||
|
||
// set
|
||
case SET:
|
||
strcat_str_free_count(rule, head);
|
||
if (isempty_str(conf->id)) splice_item(rule, chain, chain, "", str);
|
||
else splice_item(rule, insert, id, get_chain(conf), str);
|
||
setmode:
|
||
splice_item(rule, source, source, "", str);
|
||
splice_item(rule, destination, destination, "", str);
|
||
splice_item(rule, prot, prot, "", str);
|
||
splice_item(rule, sport, sport, "", str);
|
||
splice_item(rule, dport, dport, "", str);
|
||
splice_item(rule, i_device, i_device, "", str);
|
||
splice_item(rule, o_device, o_device, "", str);
|
||
splice_item(rule, match, match, "", str);
|
||
splice_item(rule, match_info, match_info, conf->match, str);
|
||
splice_item(rule, target, target, "", str);
|
||
|
||
if (is_snat(conf)) splice_item(rule, to, to, "source", str);
|
||
else if (is_dnat(conf)) splice_item(rule, to, to, "destination", str);
|
||
break;
|
||
|
||
// save
|
||
case SAVE:
|
||
// TO DO
|
||
break;
|
||
|
||
// restore
|
||
case RESTORE:
|
||
// TO DO
|
||
break;
|
||
|
||
default:
|
||
// TO DO
|
||
break;
|
||
err:
|
||
__error_report(msg, current_id, "the iptables command is too long to splice!\n");
|
||
}
|
||
|
||
return ret;
|
||
|
||
}
|
||
|
||
|
||
|
||
/*
|
||
* ipt_config结构的配置信息合法性检查，完成缺省配置推导
|
||
* parameters:
|
||
* @conf: 一条ipt_config结构的nat配置信息
|
||
*
|
||
* return: 配置完成且合法，返回SUCCESS
|
||
*/
|
||
boolean __iptconfig_chk(struct ipt_config *conf, char **msg) {
|
||
// TO DO
|
||
enum action option;
|
||
|
||
if (conf == NULL) return FAIL;
|
||
|
||
if (isempty_str(conf->target)) {
|
||
__error_report(msg, current_id, "Blank target is not allowed!\n");
|
||
return FAIL;
|
||
}
|
||
|
||
if (is_snat(conf)) {
|
||
if (isempty_str(conf->to)) strcpy(conf->target, "MASQUERADE");
|
||
set_chain(conf, "POSTROUTING");
|
||
conf->i_device[0] = '\0';
|
||
|
||
}
|
||
else if (is_dnat(conf)) {
|
||
set_chain(conf, "PREROUTING");
|
||
conf->o_device[0] = '\0';
|
||
}
|
||
else if (is_masquerade(conf)) {
|
||
set_chain(conf, "POSTROUTING");
|
||
conf->i_device[0] = '\0';
|
||
}
|
||
else {
|
||
__error_report(msg, current_id, "\"%s\" is not is valid target!\n", conf->target);
|
||
return FAIL;
|
||
}
|
||
|
||
switch (option = __parse_action(conf)) {
|
||
case DELETE:
|
||
|
||
break;
|
||
|
||
case SET:
|
||
|
||
break;
|
||
|
||
case SAVE:
|
||
return FAIL;
|
||
break;
|
||
|
||
case RESTORE:
|
||
return FAIL;
|
||
break;
|
||
}
|
||
|
||
return SUCCESS;
|
||
}
|
||
|
||
/*
|
||
* 使用json数据格式，配置ipables nat
|
||
* parameters:
|
||
* @json: 字符串格式的json配置信息
|
||
* @msg: 信息返回
|
||
*
|
||
* return: ret_code返回码
|
||
*/
|
||
ret_code set_iptables_config(const char *json, char **msg) {
|
||
int len = 0, i;
|
||
iptables_rule rule = NULL;
|
||
ret_code ret = RET_OK;
|
||
struct ipt_config *conf = NULL, *conf_start = NULL;
|
||
|
||
free_space = MAX_ERR_MSG;
|
||
__chk_malloc((*msg), char*, sizeof(char) * free_space, ret, msg);
|
||
memset(*msg, 0, sizeof(char) * free_space);
|
||
|
||
conf = (struct ipt_config*)__jsontxt_to_struct(json, &len,
|
||
__cjsonarr_to_ipt_config, &ret, msg);
|
||
if (ret != RET_OK) goto err;
|
||
conf_start = conf;
|
||
|
||
for (i = 0; i < len; ++i, ++conf) {
|
||
current_id = i;
|
||
|
||
if (__iptconfig_chk(conf, msg)) {
|
||
__chk_malloc(rule, iptables_rule, MAX_LINE_LEN + 1, ret, msg);
|
||
memset(rule, 0, sizeof(char) * (MAX_LINE_LEN + 1));
|
||
|
||
if ((ret = __command_splice(conf, rule, msg)) != RET_OK) goto err;
|
||
#if 0
|
||
// shell输出拼接后的linux配置命令
|
||
printf("%s\n", rule);
|
||
#endif
|
||
// 错误输出重定向
|
||
strncat(rule, " 2>&1", MAX_LINE_LEN - 1);
|
||
if ((ret = run_command(rule, msg)) != RET_OK) goto err;
|
||
|
||
xfree(rule);
|
||
|
||
}
|
||
else {
|
||
ret = RET_INPUTERR;
|
||
goto err;
|
||
}
|
||
}
|
||
|
||
MEMerr:
|
||
err:
|
||
xfree(rule);
|
||
xfree(conf_start);
|
||
return ret;
|
||
}
|
||
|
||
/*
|
||
* 将一条ipt_config类型的配置信息转化为json数据
|
||
* parameters:
|
||
* @root: json数据插入根节点指针
|
||
* @conf: 一条ipt_config类型的配置信息的指针,需要预分配空间
|
||
*
|
||
* return: ret_code返回码
|
||
*/
|
||
ret_code __ipt_config_tojson(cJSON *root, const struct ipt_config *conf) {
|
||
if (root == NULL) return FAIL;
|
||
cJSON *obj = NULL;
|
||
|
||
cJSON_AddItemToArray(root, obj=cJSON_CreateObject());
|
||
//_IPT_INT_ITEM_TOJSON(id);
|
||
_IPT_STR_ITEM_TOJSON(chain, chain);
|
||
_IPT_STR_ITEM_TOJSON(target, target);
|
||
_IPT_STR_ITEM_TOJSON(prot, prot);
|
||
_IPT_STR_ITEM_TOJSON(source, source);
|
||
_IPT_STR_ITEM_TOJSON(destination, destination);
|
||
_IPT_STR_ITEM_TOJSON(sport, sport);
|
||
_IPT_STR_ITEM_TOJSON(dport, dport);
|
||
_IPT_STR_ITEM_TOJSON(to,to);
|
||
_IPT_STR_ITEM_TOJSON(i_device, device);
|
||
_IPT_STR_ITEM_TOJSON(o_device, device);
|
||
|
||
_IPT_STR_ITEM_TOJSON(match, match);
|
||
_IPT_STR_ITEM_TOJSON(match_info, match_info);
|
||
|
||
return RET_OK;
|
||
}
|
||
|
||
/*
|
||
* 从iptables-save配置文件中，获取json格式的nat配置信息
|
||
* parameters:
|
||
* @__filename: iptables-save配置文件路径
|
||
* @output: 返回字符串类型的json格式nat配置信息,需要预分配空间
|
||
* @outlen: 返回配置信息字符串长度
|
||
* @msg: 信息返回
|
||
*
|
||
* return: ret_code返回码
|
||
*/
|
||
ret_code get_iptables_config(const char *json, const char * __restrict__ __filename,
|
||
char *output, int *outlen, char **msg) {
|
||
cJSON *root = NULL;
|
||
iptables_rule *rules = NULL, *rules_start = NULL;
|
||
struct ipt_config *conf = NULL;
|
||
struct range_ipt_config *rwconf = NULL;
|
||
int len = 0, i;
|
||
int count = 0, offset = 0;
|
||
char* out = NULL;
|
||
free_space = MAX_ERR_MSG;
|
||
boolean match = FAIL;
|
||
ret_code ret = RET_OK;
|
||
|
||
__chk_malloc((*msg), char*, sizeof(char) * free_space, ret, msg);
|
||
memset(*msg, 0, sizeof(char)*free_space);
|
||
|
||
ret = run_command("sudo iptables-save -t nat > ./iptables-conf.txt 2>&1", msg);
|
||
if (ret != RET_OK) goto err;
|
||
|
||
root = cJSON_CreateArray();
|
||
if (!root) {
|
||
__error_report(msg, -1, "Error before: [%s]\n", cJSON_GetErrorPtr());
|
||
ret = RET_NOMEM;
|
||
goto MEMerr;
|
||
}
|
||
rwconf = (struct range_ipt_config*)__jsontxt_to_struct(json, &len,
|
||
__cjsonarr_to_range_ipt_config, &ret, msg);
|
||
if (ret != RET_OK) goto err;
|
||
|
||
rules = __read_iptables_conf(__filename, &len, 0, -1, &ret, msg);
|
||
rules_start = rules;
|
||
if (!__iptconfig_chk(&(rwconf->conf), msg)) goto err;
|
||
if (rwconf->begin < 0) rwconf->begin = 0;
|
||
if (rwconf->offset < 0) rwconf->offset = len;
|
||
|
||
for (i = 0; i < len; ++i, ++rules) {
|
||
if (count >= rwconf->begin + rwconf->offset) break;
|
||
if (**rules == ':') continue;
|
||
match = FAIL;
|
||
|
||
__chk_malloc(conf, struct ipt_config*, sizeof(*conf), ret, msg);
|
||
memset(conf, 0, sizeof(struct ipt_config));
|
||
|
||
if ((ret = __ipt_conf_parse(*rules, &(rwconf->conf), &match, conf)) != RET_OK) {
|
||
goto err;
|
||
}
|
||
if (match) {
|
||
if (count >= rwconf->begin) __ipt_config_tojson(root, conf);
|
||
count += 1;
|
||
}
|
||
|
||
xfree(conf);
|
||
}
|
||
|
||
out = cJSON_PrintUnformatted(root);
|
||
*outlen = strlen(out) + 1;
|
||
memcpy(output, out, *outlen);
|
||
|
||
MEMerr:
|
||
err:
|
||
xfree(conf);
|
||
xfree(rwconf);
|
||
xfree(out);
|
||
cJSON_Delete(root);
|
||
__free_dptr_char(&rules_start, len);
|
||
|
||
return ret;
|
||
}
|
||
|
||
ret_code get_nf_conntrack(const char * __restrict__ __filename,
|
||
char *output, int *outlen, char **msg) {
|
||
char **conntrack = NULL;
|
||
int len = 0, i;
|
||
char* out = NULL;
|
||
free_space = MAX_ERR_MSG;
|
||
ret_code ret = RET_OK;
|
||
|
||
//__chk_malloc((*msg), char*, free_space, ret, msg);
|
||
memset(*msg, 0, sizeof(char)*free_space);
|
||
|
||
conntrack = __read_nf_conntrack(__filename, &len, &ret, msg);
|
||
// TO DO
|
||
|
||
MEMerr:
|
||
return ret;
|
||
}
|
||
|
||
/*
|
||
* 原始调试程序,待修改,暂不可使用
|
||
*/
|
||
#ifdef NAT_DEBUG
|
||
int main(int argc, char *argv[]) {
|
||
int len;
|
||
char *out = NULL;
|
||
|
||
// 返回错误信息
|
||
char *err1 = NULL, *err2 = NULL;
|
||
|
||
//out = get_iptables_config(__iptables_conf_dir, &err1);
|
||
|
||
printf("%s\n", out);
|
||
printf("%s", err1);
|
||
|
||
__chk_free(out);
|
||
|
||
//set_iptables_config(__json, &err2);
|
||
printf("%s", err2);
|
||
|
||
free(err1);
|
||
free(err2);
|
||
return 0;
|
||
}
|
||
#endif
|
||
|