带你手把手解读rejail沙盒源码(0.9.72版本) (七) fnetfilter

最新推荐文章于 2024-10-23 18:47:46 发布

原创

最新推荐文章于 2024-10-23 18:47:46 发布 · 1k 阅读

18 ·

CC 4.0 BY-SA版权

文章标签：

#dumpable #sandbox #firejail #linux

本文围绕一个用C语言编写的Netfilter规则处理程序展开。介绍了iptables防火墙规则脚本，解释了程序中各函数功能，如usage、err_exit_cannot_open_file等。还说明了进程dumpable状态检测，以及程序处理命令行参数、配置Netfilter规则的方式和不同输入情况的结果。

├── fnetfilter
│   ├── Makefile
│   └── main.c

文章目录

main.c


#include "../include/common.h"

#define MAXBUF 4098
#define MAXARGS 16
static char *args[MAXARGS] = {
   
   0};
static int argcnt = 0;
int arg_quiet = 0;


static char *default_filter =
"*filter\n"
":INPUT DROP [0:0]\n"
":FORWARD DROP [0:0]\n"
":OUTPUT ACCEPT [0:0]\n"
"-A INPUT -i lo -j ACCEPT\n"
"-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT\n"
"# echo replay is handled by -m state RELATED/ESTABLISHED above\n"
"#-A INPUT -p icmp --icmp-type echo-reply -j ACCEPT\n"
"-A INPUT -p icmp --icmp-type destination-unreachable -j ACCEPT\n"
"-A INPUT -p icmp --icmp-type time-exceeded -j ACCEPT\n"
"-A INPUT -p icmp --icmp-type echo-request -j ACCEPT \n"
"# disable STUN\n"
"-A OUTPUT -p udp --dport 3478 -j DROP\n"
"-A OUTPUT -p udp --dport 3479 -j DROP\n"
"-A OUTPUT -p tcp --dport 3478 -j DROP\n"
"-A OUTPUT -p tcp --dport 3479 -j DROP\n"
"COMMIT\n";

static void usage(void) {
   
   
	printf("Usage:\n");
	printf("\tfnetfilter netfilter-command destination-file\n");
}

static void err_exit_cannot_open_file(const char *fname) {
   
   
	fprintf(stderr, "Error fnetfilter: cannot open %s\n", fname);
	exit(1);
}


static void copy(const char *src, const char *dest) {
   
   
	FILE *fp1 = fopen(src, "r");
	if (!fp1)
		err_exit_cannot_open_file(src);

	FILE *fp2 = fopen(dest, "w");
	if (!fp2)
		err_exit_cannot_open_file(dest);

	char buf[MAXBUF];
	while (fgets(buf, MAXBUF, fp1))
		fprintf(fp2, "%s", buf);

	fclose(fp1);
	fclose(fp2);
}

static void process_template(char *src, const char *dest) {
   
   
	char *arg_start = strchr(src, ',');
	assert(arg_start);
	*arg_start = '\0';
	arg_start++;
	if (*arg_start == '\0') {
   
   
		fprintf(stderr, "Error fnetfilter: you need to provide at least one argument\n");
		exit(1);
	}

	// extract the arguments from command line
	char *token = strtok(arg_start, ",");
	while (token) {
   
   
		if (argcnt == MAXARGS) {
   
   
			fprintf(stderr, "Error fnetfilter: only up to %u arguments are supported\n", (unsigned) MAXARGS);
			exit(1);
		}
		// look for abnormal things
		int len = strlen(token);
		if (strcspn(token, "\\&!?\"'<>%^(){};,*[]") != (size_t)len) {
   
   
			fprintf(stderr, "Error fnetfilter: invalid argument in netfilter command\n");
			exit(1);
		}
		args[argcnt] = token;
		argcnt++;
		token = strtok(NULL, ",");
	}
#if 0
{
   
   
printf("argcnt %d\n", argcnt);
int i;
for (i = 0; i < argcnt; i++)
	printf("%s\n", args[i])