diff options
Diffstat (limited to 'natparse.c')
-rw-r--r-- | natparse.c | 902 |
1 files changed, 902 insertions, 0 deletions
diff --git a/natparse.c b/natparse.c new file mode 100644 index 0000000..7246234 --- /dev/null +++ b/natparse.c @@ -0,0 +1,902 @@ +/* + * Copyright (C) 1993-2002 by Darren Reed. + * + * See the IPFILTER.LICENCE file for details on licencing. + */ +#if defined(__sgi) && (IRIX > 602) +# include <sys/ptimers.h> +#endif +#include <stdio.h> +#include <string.h> +#include <fcntl.h> +#include <errno.h> +#include <sys/types.h> +#if !defined(__SVR4) && !defined(__svr4__) +# include <strings.h> +#else +# include <sys/byteorder.h> +#endif +#include <sys/time.h> +#include <sys/param.h> +#include <stdlib.h> +#include <unistd.h> +#include <stddef.h> +#include <sys/socket.h> +#include <sys/ioctl.h> +#if defined(sun) && (defined(__svr4__) || defined(__SVR4)) +# include <sys/ioccom.h> +# include <sys/sysmacros.h> +#endif +#include <netinet/in.h> +#include <netinet/in_systm.h> +#include <netinet/ip.h> +#include <netinet/tcp.h> +#include <net/if.h> +#if __FreeBSD_version >= 300000 +# include <net/if_var.h> +#endif +#include <netdb.h> +#include <arpa/nameser.h> +#include <arpa/inet.h> +#include <resolv.h> +#include <ctype.h> +#include "netinet/ip_compat.h" +#include "netinet/ip_fil.h" +#include "netinet/ip_nat.h" +#include "netinet/ip_state.h" +#include "netinet/ip_proxy.h" +#include "ipf.h" + +#if defined(sun) && !SOLARIS2 +# define STRERROR(x) sys_errlist[x] +extern char *sys_errlist[]; +#else +# define STRERROR(x) strerror(x) +#endif + +#if !defined(lint) +static const char sccsid[] ="@(#)ipnat.c 1.9 6/5/96 (C) 1993 Darren Reed"; +static const char rcsid[] = "@(#)$Id: natparse.c,v 1.17.2.29 2003/05/15 17:45:34 darrenr Exp $"; +#endif + + +#if SOLARIS +#define bzero(a,b) memset(a,0,b) +#endif + +extern void printnat __P((ipnat_t *, int)); +extern int countbits __P((u_32_t)); +extern char *proto; + +ipnat_t *natparse __P((char *, int, int *)); +void natparsefile __P((int, char *, int)); +void nat_setgroupmap __P((struct ipnat *)); + + +void nat_setgroupmap(n) +ipnat_t *n; +{ + if (n->in_outmsk == n->in_inmsk) + n->in_ippip = 1; + else if (n->in_flags & IPN_AUTOPORTMAP) { + n->in_ippip = ~ntohl(n->in_inmsk); + if (n->in_outmsk != 0xffffffff) + n->in_ippip /= (~ntohl(n->in_outmsk) + 1); + n->in_ippip++; + if (n->in_ippip == 0) + n->in_ippip = 1; + n->in_ppip = USABLE_PORTS / n->in_ippip; + } else { + n->in_space = USABLE_PORTS * ~ntohl(n->in_outmsk); + n->in_nip = 0; + if (!(n->in_ppip = n->in_pmin)) + n->in_ppip = 1; + n->in_ippip = USABLE_PORTS / n->in_ppip; + } +} + + +/* + * Parse a line of input from the ipnat configuration file + * + * status: + * < 0 error + * = 0 OK + * > 0 programmer error + */ +ipnat_t *natparse(line, linenum, status) +char *line; +int linenum; +int *status; +{ + static ipnat_t ipn; + struct protoent *pr; + char *dnetm = NULL, *dport = NULL; + char *s, *t, *cps[31], **cpp; + int i, cnt; + char *port1a = NULL, *port1b = NULL, *port2a = NULL; + + *status = 100; /* default to error */ + proto = NULL; + + /* + * Search for end of line and comment marker, advance of leading spaces + */ + if ((s = strchr(line, '\n'))) + *s = '\0'; + if ((s = strchr(line, '#'))) + *s = '\0'; + while (*line && isspace(*line)) + line++; + if (!*line) { + *status = 0; + return NULL; + } + + bzero((char *)&ipn, sizeof(ipn)); + cnt = 0; + + /* + * split line upto into segments. + */ + for (i = 0, *cps = strtok(line, " \b\t\r\n"); cps[i] && i < 30; cnt++) + cps[++i] = strtok(NULL, " \b\t\r\n"); + + cps[i] = NULL; + + if (cnt < 3) { + fprintf(stderr, "%d: not enough segments in line\n", linenum); + *status = -1; + return NULL; + } + + cpp = cps; + + /* + * Check first word is a recognised keyword and then is the interface + */ + if (!strcasecmp(*cpp, "map")) + ipn.in_redir = NAT_MAP; + else if (!strcasecmp(*cpp, "map-block")) + ipn.in_redir = NAT_MAPBLK; + else if (!strcasecmp(*cpp, "rdr")) + ipn.in_redir = NAT_REDIRECT; + else if (!strcasecmp(*cpp, "bimap")) + ipn.in_redir = NAT_BIMAP; + else { + fprintf(stderr, "%d: unknown mapping: \"%s\"\n", + linenum, *cpp); + *status = -1; + return NULL; + } + + cpp++; + + strncpy(ipn.in_ifname, *cpp, sizeof(ipn.in_ifname) - 1); + ipn.in_ifname[sizeof(ipn.in_ifname) - 1] = '\0'; + cpp++; + + /* + * If the first word after the interface is "from" or is a ! then + * the expanded syntax is being used so parse it differently. + */ + if (!strcasecmp(*cpp, "from") || (**cpp == '!')) { + if (!strcmp(*cpp, "!")) { + cpp++; + if (strcasecmp(*cpp, "from")) { + fprintf(stderr, "Missing from after !\n"); + *status = -1; + return NULL; + } + ipn.in_flags |= IPN_NOTSRC; + } else if (**cpp == '!') { + if (strcasecmp(*cpp + 1, "from")) { + fprintf(stderr, "Missing from after !\n"); + *status = -1; + return NULL; + } + ipn.in_flags |= IPN_NOTSRC; + } + if ((ipn.in_flags & IPN_NOTSRC) && + (ipn.in_redir & (NAT_MAP|NAT_MAPBLK))) { + fprintf(stderr, "Cannot use '! from' with map\n"); + *status = -1; + return NULL; + } + + ipn.in_flags |= IPN_FILTER; + cpp++; + if (ipn.in_redir == NAT_REDIRECT) { + if (hostmask(&cpp, (u_32_t *)&ipn.in_srcip, + (u_32_t *)&ipn.in_srcmsk, &ipn.in_sport, + &ipn.in_scmp, &ipn.in_stop, linenum)) { + *status = -1; + return NULL; + } + } else { + if (hostmask(&cpp, (u_32_t *)&ipn.in_inip, + (u_32_t *)&ipn.in_inmsk, &ipn.in_sport, + &ipn.in_scmp, &ipn.in_stop, linenum)) { + *status = -1; + return NULL; + } + } + + if (!strcmp(*cpp, "!")) { + cpp++; + ipn.in_flags |= IPN_NOTDST; + } else if (**cpp == '!') { + (*cpp)++; + ipn.in_flags |= IPN_NOTDST; + } + + if (strcasecmp(*cpp, "to")) { + fprintf(stderr, "%d: unexpected keyword (%s) - to\n", + linenum, *cpp); + *status = -1; + return NULL; + } + if ((ipn.in_flags & IPN_NOTDST) && + (ipn.in_redir & (NAT_REDIRECT))) { + fprintf(stderr, "Cannot use '! to' with rdr\n"); + *status = -1; + return NULL; + } + + if (!*++cpp) { + fprintf(stderr, "%d: missing host after to\n", linenum); + *status = -1; + return NULL; + } + if (ipn.in_redir == NAT_REDIRECT) { + if (hostmask(&cpp, (u_32_t *)&ipn.in_outip, + (u_32_t *)&ipn.in_outmsk, &ipn.in_dport, + &ipn.in_dcmp, &ipn.in_dtop, linenum)) { + *status = -1; + return NULL; + } + ipn.in_pmin = htons(ipn.in_dport); + } else { + if (hostmask(&cpp, (u_32_t *)&ipn.in_srcip, + (u_32_t *)&ipn.in_srcmsk, &ipn.in_dport, + &ipn.in_dcmp, &ipn.in_dtop, linenum)) { + *status = -1; + return NULL; + } + } + } else { + s = *cpp; + if (!s) { + fprintf(stderr, "%d: short line\n", linenum); + *status = -1; + return NULL; + } + t = strchr(s, '/'); + if (!t) { + fprintf(stderr, "%d: no netmask on LHS\n", linenum); + *status = -1; + return NULL; + } + *t++ = '\0'; + if (ipn.in_redir == NAT_REDIRECT) { + if (hostnum((u_32_t *)&ipn.in_outip, s, linenum) == -1){ + *status = -1; + return NULL; + } + if (genmask(t, (u_32_t *)&ipn.in_outmsk) == -1) { + *status = -1; + return NULL; + } + } else { + if (hostnum((u_32_t *)&ipn.in_inip, s, linenum) == -1) { + *status = -1; + return NULL; + } + if (genmask(t, (u_32_t *)&ipn.in_inmsk) == -1) { + *status = -1; + return NULL; + } + } + cpp++; + if (!*cpp) { + fprintf(stderr, "%d: short line\n", linenum); + *status = -1; + return NULL; + } + } + + /* + * If it is a standard redirect then we expect it to have a port + * match after the hostmask. + */ + if ((ipn.in_redir == NAT_REDIRECT) && !(ipn.in_flags & IPN_FILTER)) { + if (strcasecmp(*cpp, "port")) { + fprintf(stderr, "%d: missing fields - 1st port\n", + linenum); + *status = -1; + return NULL; + } + + cpp++; + + if (!*cpp) { + fprintf(stderr, + "%d: missing fields (destination port)\n", + linenum); + *status = -1; + return NULL; + } + + if (isdigit(**cpp) && (s = strchr(*cpp, '-'))) + *s++ = '\0'; + else + s = NULL; + + port1a = *cpp++; + + if (!strcmp(*cpp, "-")) { + cpp++; + s = *cpp++; + } + + if (s) + port1b = s; + else + ipn.in_pmax = ipn.in_pmin; + } + + /* + * In the middle of the NAT rule syntax is -> to indicate the + * direction of translation. + */ + if (!*cpp) { + fprintf(stderr, "%d: missing fields (->)\n", linenum); + *status = -1; + return NULL; + } + if (strcmp(*cpp, "->")) { + fprintf(stderr, "%d: missing ->\n", linenum); + *status = -1; + return NULL; + } + cpp++; + + if (!*cpp) { + fprintf(stderr, "%d: missing fields (%s)\n", + linenum, ipn.in_redir ? "destination" : "target"); + *status = -1; + return NULL; + } + + if (ipn.in_redir == NAT_MAP) { + if (!strcasecmp(*cpp, "range")) { + cpp++; + ipn.in_flags |= IPN_IPRANGE; + if (!*cpp) { + fprintf(stderr, "%d: missing fields (%s)\n", + linenum, + ipn.in_redir ? "destination":"target"); + *status = -1; + return NULL; + } + } + } + + if (ipn.in_flags & IPN_IPRANGE) { + dnetm = strrchr(*cpp, '-'); + if (dnetm == NULL) { + cpp++; + if (*cpp && !strcmp(*cpp, "-") && *(cpp + 1)) + dnetm = *(cpp + 1); + } else + *dnetm++ = '\0'; + if (dnetm == NULL || *dnetm == '\0') { + fprintf(stderr, + "%d: desination range not specified\n", + linenum); + *status = -1; + return NULL; + } + } else if (ipn.in_redir != NAT_REDIRECT) { + dnetm = strrchr(*cpp, '/'); + if (dnetm == NULL) { + cpp++; + if (*cpp && !strcasecmp(*cpp, "netmask")) + dnetm = *++cpp; + } + if (dnetm == NULL) { + fprintf(stderr, + "%d: missing fields (dest netmask)\n", + linenum); + *status = -1; + return NULL; + } + if (*dnetm == '/') + *dnetm++ = '\0'; + } + + if (ipn.in_redir == NAT_REDIRECT) { + dnetm = strchr(*cpp, ','); + if (dnetm != NULL) { + ipn.in_flags |= IPN_SPLIT; + *dnetm++ = '\0'; + } + if (hostnum((u_32_t *)&ipn.in_inip, *cpp, linenum) == -1) { + *status = -1; + return NULL; + } +#if SOLARIS + if (ntohl(ipn.in_inip) == INADDR_LOOPBACK) { + fprintf(stderr, + "localhost as destination not supported\n"); + *status = -1; + return NULL; + } +#endif + } else { + if (!strcmp(*cpp, ipn.in_ifname)) + *cpp = "0"; + if (hostnum((u_32_t *)&ipn.in_outip, *cpp, linenum) == -1) { + *status = -1; + return NULL; + } + } + cpp++; + + if (ipn.in_redir & NAT_MAPBLK) { + if (*cpp) { + if (strcasecmp(*cpp, "ports")) { + fprintf(stderr, + "%d: expected \"ports\" - got \"%s\"\n", + linenum, *cpp); + *status = -1; + return NULL; + } + cpp++; + if (*cpp == NULL) { + fprintf(stderr, + "%d: missing argument to \"ports\"\n", + linenum); + *status = -1; + return NULL; + } + if (!strcasecmp(*cpp, "auto")) + ipn.in_flags |= IPN_AUTOPORTMAP; + else + ipn.in_pmin = atoi(*cpp); + cpp++; + } else + ipn.in_pmin = 0; + } else if ((ipn.in_redir & NAT_BIMAP) == NAT_REDIRECT) { + if (*cpp && (strrchr(*cpp, '/') != NULL)) { + fprintf(stderr, "%d: No netmask supported in %s\n", + linenum, "destination host for redirect"); + *status = -1; + return NULL; + } + + if (!*cpp) { + fprintf(stderr, "%d: Missing destination port %s\n", + linenum, "in redirect"); + *status = -1; + return NULL; + } + + /* If it's a in_redir, expect target port */ + + if (strcasecmp(*cpp, "port")) { + fprintf(stderr, "%d: missing fields - 2nd port (%s)\n", + linenum, *cpp); + *status = -1; + return NULL; + } + cpp++; + if (!*cpp) { + fprintf(stderr, + "%d: missing fields (destination port)\n", + linenum); + *status = -1; + return NULL; + } + + port2a = *cpp++; + } + if (dnetm && *dnetm == '/') + *dnetm++ = '\0'; + + if (ipn.in_redir & (NAT_MAP|NAT_MAPBLK)) { + if (ipn.in_flags & IPN_IPRANGE) { + if (hostnum((u_32_t *)&ipn.in_outmsk, dnetm, + linenum) == -1) { + *status = -1; + return NULL; + } + } else if (genmask(dnetm, (u_32_t *)&ipn.in_outmsk)) { + *status = -1; + return NULL; + } + } else { + if (ipn.in_flags & IPN_SPLIT) { + if (hostnum((u_32_t *)&ipn.in_inmsk, dnetm, + linenum) == -1) { + *status = -1; + return NULL; + } + } else if (genmask("255.255.255.255", (u_32_t *)&ipn.in_inmsk)){ + *status = -1; + return NULL; + } + if (!*cpp) { + ipn.in_flags |= IPN_TCP; /* XXX- TCP only by default */ + proto = "tcp"; + } else { + proto = *cpp++; + if (!strcasecmp(proto, "tcp")) + ipn.in_flags |= IPN_TCP; + else if (!strcasecmp(proto, "udp")) + ipn.in_flags |= IPN_UDP; + else if (!strcasecmp(proto, "tcp/udp")) + ipn.in_flags |= IPN_TCPUDP; + else if (!strcasecmp(proto, "tcpudp")) { + ipn.in_flags |= IPN_TCPUDP; + proto = "tcp/udp"; + } else if (!strcasecmp(proto, "ip")) + ipn.in_flags |= IPN_ANY; + else { + ipn.in_flags |= IPN_ANY; + if ((pr = getprotobyname(proto))) + ipn.in_p = pr->p_proto; + else { + if (!isdigit(*proto)) { + fprintf(stderr, + "%d: Unknown protocol %s\n", + linenum, proto); + *status = -1; + return NULL; + } else + ipn.in_p = atoi(proto); + } + } + if ((ipn.in_flags & IPN_TCPUDP) == 0) { + port1a = "0"; + port2a = "0"; + } + + if (*cpp && !strcasecmp(*cpp, "round-robin")) { + cpp++; + ipn.in_flags |= IPN_ROUNDR; + } + + if (*cpp && !strcasecmp(*cpp, "frag")) { + cpp++; + ipn.in_flags |= IPN_FRAG; + } + + if (*cpp && !strcasecmp(*cpp, "age")) { + cpp++; + if (!*cpp) { + fprintf(stderr, + "%d: age with no parameters\n", + linenum); + *status = -1; + return NULL; + } + + ipn.in_age[0] = atoi(*cpp); + s = index(*cpp, '/'); + if (s != NULL) + ipn.in_age[1] = atoi(s + 1); + else + ipn.in_age[1] = ipn.in_age[0]; + cpp++; + } + + if (*cpp && !strcasecmp(*cpp, "mssclamp")) { + cpp++; + if (*cpp) { + ipn.in_mssclamp = atoi(*cpp); + cpp++; + } else { + fprintf(stderr, + "%d: mssclamp with no parameters\n", + linenum); + *status = -1; + return NULL; + } + } + + if (*cpp) { + fprintf(stderr, + "%d: extra junk at the end of the line: %s\n", + linenum, *cpp); + *status = -1; + return NULL; + } + } + } + + if ((ipn.in_redir == NAT_REDIRECT) && !(ipn.in_flags & IPN_FILTER)) { + if (!portnum(port1a, &ipn.in_pmin, linenum)) { + *status = -1; + return NULL; + } + ipn.in_pmin = htons(ipn.in_pmin); + if (port1b != NULL) { + if (!portnum(port1b, &ipn.in_pmax, linenum)) { + *status = -1; + return NULL; + } + ipn.in_pmax = htons(ipn.in_pmax); + } else + ipn.in_pmax = ipn.in_pmin; + } + + if ((ipn.in_redir & NAT_BIMAP) == NAT_REDIRECT) { + if (!portnum(port2a, &ipn.in_pnext, linenum)) { + *status = -1; + return NULL; + } + ipn.in_pnext = htons(ipn.in_pnext); + } + + if (!(ipn.in_flags & IPN_SPLIT)) + ipn.in_inip &= ipn.in_inmsk; + if ((ipn.in_flags & IPN_IPRANGE) == 0) + ipn.in_outip &= ipn.in_outmsk; + ipn.in_srcip &= ipn.in_srcmsk; + + if ((ipn.in_redir & NAT_MAPBLK) != 0) + nat_setgroupmap(&ipn); + + if (*cpp && !*(cpp+1) && !strcasecmp(*cpp, "frag")) { + cpp++; + ipn.in_flags |= IPN_FRAG; + } + + if (!*cpp) { + *status = 0; + return &ipn; + } + + if (ipn.in_redir != NAT_BIMAP && !strcasecmp(*cpp, "proxy")) { + u_short pport; + + if (ipn.in_redir == NAT_BIMAP) { + fprintf(stderr, "%d: cannot use proxy with bimap\n", + linenum); + *status = -1; + return NULL; + } + cpp++; + if (!*cpp) { + fprintf(stderr, + "%d: missing parameter for \"proxy\"\n", + linenum); + *status = -1; + return NULL; + } + dport = NULL; + + if (!strcasecmp(*cpp, "port")) { + cpp++; + if (!*cpp) { + fprintf(stderr, + "%d: missing parameter for \"port\"\n", + linenum); + *status = -1; + return NULL; + } + + dport = *cpp; + cpp++; + + if (!*cpp) { + fprintf(stderr, + "%d: missing parameter for \"proxy\"\n", + linenum); + *status = -1; + return NULL; + } + } else { + fprintf(stderr, + "%d: missing keyword \"port\"\n", linenum); + *status = -1; + return NULL; + } + + if ((proto = index(*cpp, '/'))) { + *proto++ = '\0'; + if ((pr = getprotobyname(proto))) + ipn.in_p = pr->p_proto; + else + ipn.in_p = atoi(proto); + } else + ipn.in_p = 0; + + if (dport && !portnum(dport, &pport, linenum)) + return NULL; + if (ipn.in_dcmp != 0) { + if (pport != ipn.in_dport) { + fprintf(stderr, + "%d: mismatch in port numbers\n", + linenum); + return NULL; + } + } else + ipn.in_dport = htons(pport); + + (void) strncpy(ipn.in_plabel, *cpp, sizeof(ipn.in_plabel)); + cpp++; + + } else if (ipn.in_redir != NAT_BIMAP && !strcasecmp(*cpp, "portmap")) { + if (ipn.in_redir == NAT_BIMAP) { + fprintf(stderr, "%d: cannot use portmap with bimap\n", + linenum); + *status = -1; + return NULL; + } + cpp++; + if (!*cpp) { + fprintf(stderr, + "%d: missing expression following portmap\n", + linenum); + *status = -1; + return NULL; + } + + if (!strcasecmp(*cpp, "tcp")) + ipn.in_flags |= IPN_TCP; + else if (!strcasecmp(*cpp, "udp")) + ipn.in_flags |= IPN_UDP; + else if (!strcasecmp(*cpp, "tcpudp")) + ipn.in_flags |= IPN_TCPUDP; + else if (!strcasecmp(*cpp, "tcp/udp")) + ipn.in_flags |= IPN_TCPUDP; + else { + fprintf(stderr, + "%d: expected protocol name - got \"%s\"\n", + linenum, *cpp); + *status = -1; + return NULL; + } + proto = *cpp; + cpp++; + + if (!*cpp) { + fprintf(stderr, "%d: no port range found\n", linenum); + *status = -1; + return NULL; + } + + if (!strcasecmp(*cpp, "auto")) { + ipn.in_flags |= IPN_AUTOPORTMAP; + ipn.in_pmin = htons(1024); + ipn.in_pmax = htons(65535); + nat_setgroupmap(&ipn); + cpp++; + } else { + if (!(t = strchr(*cpp, ':'))) { + fprintf(stderr, + "%d: no port range in \"%s\"\n", + linenum, *cpp); + *status = -1; + return NULL; + } + *t++ = '\0'; + if (!portnum(*cpp, &ipn.in_pmin, linenum) || + !portnum(t, &ipn.in_pmax, linenum)) { + *status = -1; + return NULL; + } + ipn.in_pmin = htons(ipn.in_pmin); + ipn.in_pmax = htons(ipn.in_pmax); + cpp++; + } + } + + if (*cpp && !strcasecmp(*cpp, "frag")) { + cpp++; + ipn.in_flags |= IPN_FRAG; + } + + if (*cpp && !strcasecmp(*cpp, "age")) { + cpp++; + if (!*cpp) { + fprintf(stderr, "%d: age with no parameters\n", + linenum); + *status = -1; + return NULL; + } + ipn.in_age[0] = atoi(*cpp); + s = index(*cpp, '/'); + if (s != NULL) + ipn.in_age[1] = atoi(s + 1); + else + ipn.in_age[1] = ipn.in_age[0]; + cpp++; + } + + if (*cpp && !strcasecmp(*cpp, "mssclamp")) { + cpp++; + if (*cpp) { + ipn.in_mssclamp = atoi(*cpp); + cpp++; + } else { + fprintf(stderr, "%d: mssclamp with no parameters\n", + linenum); + *status = -1; + return NULL; + } + } + + if (*cpp) { + fprintf(stderr, "%d: extra junk at the end of the line: %s\n", + linenum, *cpp); + *status = -1; + return NULL; + } + + *status = 0; + return &ipn; +} + + +void natparsefile(fd, file, opts) +int fd; +char *file; +int opts; +{ + char line[512], *s; + ipnat_t *np; + FILE *fp; + int linenum = 0; + int parsestatus; + + if (strcmp(file, "-")) { + if (!(fp = fopen(file, "r"))) { + fprintf(stderr, "%s: open: %s\n", file, + STRERROR(errno)); + exit(1); + } + } else + fp = stdin; + + while (fgets(line, sizeof(line) - 1, fp)) { + linenum++; + line[sizeof(line) - 1] = '\0'; + if ((s = strchr(line, '\n'))) + *s = '\0'; + + parsestatus = 1; + np = natparse(line, linenum, &parsestatus); + if (parsestatus != 0) { + if (*line) { + fprintf(stderr, "%d: syntax error in \"%s\"\n", + linenum, line); + } + fprintf(stderr, "%s: %s error (%d), quitting\n", + file, + ((parsestatus < 0)? "parse": "internal"), + parsestatus); + exit(1); + } + if (np) { + if ((opts & OPT_VERBOSE) && np) + printnat(np, opts); + if (!(opts & OPT_NODO)) { + if (!(opts & OPT_REMOVE)) { + if (ioctl(fd, SIOCADNAT, &np) == -1) { + fprintf(stderr, "%d:", + linenum); + perror("ioctl(SIOCADNAT)"); + } + } else if (ioctl(fd, SIOCRMNAT, &np) == -1) { + fprintf(stderr, "%d:", linenum); + perror("ioctl(SIOCRMNAT)"); + } + } + } + } + if (fp != stdin) + fclose(fp); +} |