iptables: remove usage of xt_id

Instead of relying on the nonstandard xt_id match, use the xt_comment match
to tag own rules. Any rule with a comment starting with "!fw3" is considered
to be firewall3 internal.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

2 files changed, 37 insertions, 42 deletions

diff --git a/iptables.c b/iptables.c
index b574f8d..ccfd29c 100644
--- a/iptables.c
+++ b/iptables.c
@@ -258,10 +258,9 @@ fw3_ipt_delete_chain(struct fw3_ipt_handle *h, const char *chain)
 		iptc_delete_chain(chain, h->handle);
 }
 
-static int
-get_rule_id(const void *base, unsigned int start, unsigned int end)
+static bool
+has_rule_tag(const void *base, unsigned int start, unsigned int end)
 {
-	uint32_t id;
 	unsigned int i;
 	const struct xt_entry_match *em;
 
@@ -269,18 +268,14 @@ get_rule_id(const void *base, unsigned int start, unsigned int end)
 	{
 		em = base + i;
 
-		if (strcmp(em->u.user.name, "id"))
-			continue;
-
-		memcpy(&id, em->data, sizeof(id));
-
-		if ((id & FW3_ID_MASK) != FW3_ID_MAGIC)
+		if (strcmp(em->u.user.name, "comment"))
 			continue;
 
-		return (id & ~FW3_ID_MASK);
+		if (!memcmp(em->data, "!fw3", 4))
+			return true;
 	}
 
-	return -1;
+	return false;
 }
 
 void
@@ -289,7 +284,6 @@ fw3_ipt_delete_id_rules(struct fw3_ipt_handle *h, const char *chain)
 	unsigned int num;
 	const struct ipt_entry *e;
 	bool found;
-	int id;
 
 #ifndef DISABLE_IPV6
 	if (h->family == FW3_FAMILY_V6)
@@ -305,9 +299,7 @@ fw3_ipt_delete_id_rules(struct fw3_ipt_handle *h, const char *chain)
 				 e6 != NULL;
 				 num++, e6 = ip6tc_next_rule(e6, h->handle))
 			{
-				id = get_rule_id(e6, sizeof(*e6), e6->target_offset);
-
-				if (id >= 0)
+				if (has_rule_tag(e6, sizeof(*e6), e6->target_offset))
 				{
 					if (fw3_pr_debug)
 						debug(h, "-D %s %u\n", chain, num + 1);
@@ -332,9 +324,7 @@ fw3_ipt_delete_id_rules(struct fw3_ipt_handle *h, const char *chain)
 				 e != NULL;
 				 num++, e = iptc_next_rule(e, h->handle))
 			{
-				id = get_rule_id(e, sizeof(*e), e->target_offset);
-
-				if (id >= 0)
+				if (has_rule_tag(e, sizeof(*e), e->target_offset))
 				{
 					if (fw3_pr_debug)
 						debug(h, "-D %s %u\n", chain, num + 1);
@@ -503,7 +493,6 @@ fw3_ipt_rule_new(struct fw3_ipt_handle *h)
 	r = fw3_alloc(sizeof(*r));
 
 	r->h = h;
-	r->id = 0;
 	r->argv = fw3_alloc(sizeof(char *));
 	r->argv[r->argc++] = "fw3";
 
@@ -1443,6 +1432,34 @@ rule_build(struct fw3_ipt_rule *r)
 	}
 }
 
+static void
+set_rule_tag(struct fw3_ipt_rule *r)
+{
+	int i;
+	char *p, **tmp;
+	const char *tag = "!fw3";
+
+	for (i = 0; i < r->argc; i++)
+		if (!strcmp(r->argv[i], "--comment") && (i + 1) < r->argc)
+			if (asprintf(&p, "%s: %s", tag, r->argv[i + 1]) > 0)
+			{
+				free(r->argv[i + 1]);
+				r->argv[i + 1] = p;
+				return;
+			}
+
+	tmp = realloc(r->argv, (r->argc + 4) * sizeof(*r->argv));
+
+	if (tmp)
+	{
+		r->argv = tmp;
+		r->argv[r->argc++] = fw3_strdup("-m");
+		r->argv[r->argc++] = fw3_strdup("comment");
+		r->argv[r->argc++] = fw3_strdup("--comment");
+		r->argv[r->argc++] = fw3_strdup(tag);
+	}
+}
+
 void
 __fw3_ipt_rule_append(struct fw3_ipt_rule *r, bool repl, const char *fmt, ...)
 {
@@ -1455,7 +1472,6 @@ __fw3_ipt_rule_append(struct fw3_ipt_rule *r, bool repl, const char *fmt, ...)
 	struct xtables_globals *g;
 
 	int i, optc;
-	uint32_t id;
 	bool inv = false;
 	char buf[32];
 	va_list ap;
@@ -1470,23 +1486,7 @@ __fw3_ipt_rule_append(struct fw3_ipt_rule *r, bool repl, const char *fmt, ...)
 	optind = 0;
 	opterr = 0;
 
-	if (r->id >= 0)
-	{
-		em = find_match(r, "id");
-
-		if (!em)
-		{
-			warn("fw3_ipt_rule_append(): Can't find match '%s'", "id");
-			goto free;
-		}
-
-		init_match(r, em, true);
-
-		id = FW3_ID_MAGIC | (r->id & ~FW3_ID_MASK);
-		memcpy(em->m->data, &id, sizeof(id));
-
-		em->mflags = 1;
-	}
+	set_rule_tag(r);
 
 	while ((optc = getopt_long(r->argc, r->argv, "-:m:j:", g->opts,
 	                           NULL)) != -1)
diff --git a/iptables.h b/iptables.h
index 1d98b76..a2c733d 100644
--- a/iptables.h
+++ b/iptables.h
@@ -32,9 +32,6 @@
 
 #include "options.h"
 
-#define FW3_ID_MAGIC	0x66773300	/* 'f' 'w' '3' */
-#define FW3_ID_MASK		0xffffff00
-
 /* xtables interface */
 #if (XTABLES_VERSION_CODE == 10 || XTABLES_VERSION_CODE == 11)
 # include "xtables-10.h"
@@ -76,8 +73,6 @@ struct fw3_ipt_rule {
 	struct xtables_rule_match *matches;
 	struct xtables_target *target;
 
-	int id;
-
 	int argc;
 	char **argv;