mdw@git.distorted.org.uk Git - firewall/blob - functions.m4

   1 ### -*-sh-*-
   2 ###
   3 ### Utility functions for firewall scripts
   4 ###
   5 ### (c) 2008 Mark Wooding
   6 ###
   7
   8 ###----- Licensing notice ---------------------------------------------------
   9 ###
  10 ### This program is free software; you can redistribute it and/or modify
  11 ### it under the terms of the GNU General Public License as published by
  12 ### the Free Software Foundation; either version 2 of the License, or
  13 ### (at your option) any later version.
  14 ###
  15 ### This program is distributed in the hope that it will be useful,
  16 ### but WITHOUT ANY WARRANTY; without even the implied warranty of
  17 ### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18 ### GNU General Public License for more details.
  19 ###
  20 ### You should have received a copy of the GNU General Public License
  21 ### along with this program; if not, write to the Free Software Foundation,
  22 ### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  23
  24 m4_divert(20)m4_dnl
  25 ###--------------------------------------------------------------------------
  26 ### Utility functions.
  27
  28 ## doit COMMAND ARGS...
  29 ##
  30 ## If debugging, print the COMMAND and ARGS.  If serious, execute them.
  31 run () {
  32   set -e
  33   if [ "$FW_DEBUG" ]; then echo "* $*"; fi
  34   if ! [ "$FW_NOACT" ]; then "$@"; fi
  35 }
  36
  37 ## trace MESSAGE...
  38 ##
  39 ## If debugging, print the MESSAGE.
  40 trace () {
  41   set -e
  42   if [ "$FW_DEBUG" ]; then echo "$*"; fi
  43 }
  44
  45 ## defport NAME NUMBER
  46 ##
  47 ## Define $port_NAME to be NUMBER.
  48 defport () {
  49   name=$1 number=$2
  50   eval port_$name=$number
  51 }
  52
  53 ## defproto NAME NUMBER
  54 ##
  55 ## Define $proto_NAME to be NUMBER.
  56 defproto () {
  57   name=$1 number=$2
  58   eval proto_$name=$number
  59 }
  60
  61 ## addword VAR WORD
  62 ##
  63 ## Adds WORD to the value of the shell variable VAR, if it's not there
  64 ## already.  Words are separated by a single space; no leading or trailing
  65 ## spaces are introduced.
  66 addword () {
  67   var=$1 word=$2
  68   eval val=\$$var
  69   case " $val " in
  70     *" $word "*) ;;
  71     *) eval "$var=\${$var:+\$val }\$word" ;;
  72   esac
  73 }
  74
  75 m4_divert(38)m4_dnl
  76 ###--------------------------------------------------------------------------
  77 ### Utility chains (used by function definitions).
  78
  79 m4_divert(20)m4_dnl
  80 ###--------------------------------------------------------------------------
  81 ### Basic chain constructions.
  82
  83 ## ip46tables ARGS ...
  84 ##
  85 ## Do the same thing for `iptables' and `ip6tables'.
  86 ip46tables () {
  87   set -e
  88   iptables "$@"
  89   ip6tables "$@"
  90 }
  91
  92 ## clearchain CHAIN CHAIN ...
  93 ##
  94 ## Ensure that the named chains exist and are empty.
  95 clearchain () {
  96   set -e
  97   for _chain; do
  98     case $_chain in
  99       *:*) table=${_chain%:*} _chain=${_chain#*:} ;;
 100       *) table=filter ;;
 101     esac
 102     run ip46tables -t $table -N $_chain 2>/dev/null || :
 103   done
 104 }
 105
 106 ## makeset SET TYPE [PARAMS]
 107 ##
 108 ## Ensure that the named ipset exists.  Don't clear it.
 109 makeset () {
 110   set -e
 111   name=$1; shift
 112   if ipset -nL | grep -q "^Name: $name$"; then
 113     :
 114   else
 115     ipset -N "$name" "$@"
 116   fi
 117 }
 118
 119 ## errorchain CHAIN ACTION ARGS ...
 120 ##
 121 ## Make a chain which logs a message and then invokes some other action,
 122 ## typically REJECT.  Log messages are prefixed by `fw: CHAIN'.
 123 errorchain () {
 124   set -e
 125   chain=$1; shift
 126   case $chain in
 127     *:*) table=${chain%:*} chain=${chain#*:} ;;
 128     *) table=filter ;;
 129   esac
 130   clearchain $table:$chain
 131   run ip46tables -t $table -A $chain -j LOG \
 132           -m limit --limit 3/minute --limit-burst 10 \
 133           --log-prefix "fw: $chain " --log-level notice
 134   run ip46tables -t $table -A $chain -j "$@" \
 135           -m limit --limit 20/second --limit-burst 100
 136   run ip46tables -t $table -A $chain -j DROP
 137 }
 138
 139 m4_divert(20)m4_dnl
 140 ###--------------------------------------------------------------------------
 141 ### Basic option setting.
 142
 143 ## setopt OPTION VALUE
 144 ##
 145 ## Set an IP sysctl.
 146 setopt () {
 147   set -e
 148   opt=$1 val=$2
 149   any=nil
 150   for ver in ipv4 ipv6; do
 151     if [ -f /proc/sys/net/$ver/$opt ]; then
 152       run sysctl -q net/$ver/$opt="$val"
 153       any=t
 154     fi
 155   done
 156   case $any in
 157     nil) echo >&2 "$0: unknown IP option $opt"; exit 1 ;;
 158   esac
 159 }
 160
 161 ## setdevopt OPTION VALUE [INTERFACES ...]
 162 ##
 163 ## Set an IP interface-level sysctl.
 164 setdevopt () {
 165   set -e
 166   opt=$1 val=$2; shift 2
 167   case "$#,$1" in
 168     0, | 1,all)
 169       set -- $(
 170         seen=:
 171         for ver in ipv4 ipv6; do
 172           cd /proc/sys/net/$ver/conf
 173           for i in *; do
 174             [ -f $i/$opt ] || continue
 175             case "$seen" in (*:$i:*) continue ;; esac
 176             echo $i
 177           done
 178         done)
 179       ;;
 180   esac
 181   for i in "$@"; do
 182     any=nil
 183     for ver in ipv4 ipv6; do
 184       if [ -f /proc/sys/net/$ver/conf/$i/$opt ]; then
 185         any=t
 186         run sysctl -q net/$ver/conf/$i/$opt="$val"
 187       fi
 188     done
 189     case $any in
 190       nil) echo >&2 "$0: unknown device option $opt"; exit 1 ;;
 191     esac
 192   done
 193 }
 194
 195 m4_divert(20)m4_dnl
 196 ###--------------------------------------------------------------------------
 197 ### Packet filter construction.
 198
 199 ## conntrack CHAIN
 200 ##
 201 ## Add connection tracking to CHAIN, and allow obvious stuff.
 202 conntrack () {
 203   set -e
 204   chain=$1
 205   run ip46tables -A $chain -p tcp -m state \
 206           --state ESTABLISHED,RELATED -j ACCEPT
 207   run ip46tables -A $chain -p tcp ! --syn -g bad-tcp
 208 }
 209
 210 ## commonrules CHAIN
 211 ##
 212 ## Add standard IP filtering rules to the CHAIN.
 213 commonrules () {
 214   set -e
 215   chain=$1
 216
 217   ## Pass fragments through, assuming that the eventual destination will sort
 218   ## things out properly.  Except for TCP, that is, which should never be
 219   ## fragmented.  This is an extra pain for ip6tables, which doesn't provide
 220   ## a pleasant way to detect non-initial fragments.
 221   run iptables -A $chain -p tcp -f -g tcp-fragment
 222   run iptables -A $chain -f -j ACCEPT
 223   run ip6tables -A $chain -p tcp -g tcp-fragment \
 224           -m ipv6header --soft --header frag
 225   run ip6tables -A $chain -j accept-non-init-frag
 226 }
 227
 228 m4_divert(38)m4_dnl
 229 ## Accept a non-initial fragment.  This is only needed by IPv6, to work
 230 ## around a deficiency in the option parser.
 231 run ip6tables -N accept-non-init-frag
 232 run ip6tables -A accept-non-init-frag -j RETURN \
 233         -m frag --fragfirst
 234 run ip6tables -A accept-non-init-frag -j ACCEPT
 235
 236 m4_divert(20)m4_dnl
 237 ## allowservices CHAIN PROTO SERVICE ...
 238 ##
 239 ## Add rules to allow the SERVICES on the CHAIN.
 240 allowservices () {
 241   set -e
 242   chain=$1 proto=$2; shift 2
 243   count=0
 244   list=
 245   for svc; do
 246     case $svc in
 247       *:*)
 248         n=2
 249         left=${svc%:*} right=${svc#*:}
 250         case $left in *[!0-9]*) eval left=\$port_$left ;; esac
 251         case $right in *[!0-9]*) eval right=\$port_$right ;; esac
 252         svc=$left:$right
 253         ;;
 254       *)
 255         n=1
 256         case $svc in *[!0-9]*) eval svc=\$port_$svc ;; esac
 257         ;;
 258     esac
 259     case $svc in
 260       *: | :* | "" | *[!0-9:]*)
 261         echo >&2 "Bad service name"
 262         exit 1
 263         ;;
 264     esac
 265     count=$(( $count + $n ))
 266     if [ $count -gt 15 ]; then
 267       run ip46tables -A $chain -p $proto -m multiport -j ACCEPT \
 268              --destination-ports ${list#,}
 269       list= count=$n
 270     fi
 271     list=$list,$svc
 272   done
 273   case $list in
 274     "")
 275       ;;
 276     ,*,*)
 277       run ip46tables -A $chain -p $proto -m multiport -j ACCEPT \
 278               --destination-ports ${list#,}
 279       ;;
 280     *)
 281       run ip46tables -A $chain -p $proto -j ACCEPT \
 282               --destination-port ${list#,}
 283       ;;
 284   esac
 285 }
 286
 287 ## ntpclient CHAIN NTPSERVER ...
 288 ##
 289 ## Add rules to CHAIN to allow NTP with NTPSERVERs.
 290 ntpclient () {
 291   set -e
 292   ntpchain=$1; shift
 293
 294   clearchain ntp-servers
 295   for ntp; do run iptables -A ntp-servers -j ACCEPT -s $ntp; done
 296   run iptables -A $ntpchain -j ntp-servers \
 297           -p udp --source-port 123 --destination-port 123
 298 }
 299
 300 ## dnsresolver CHAIN
 301 ##
 302 ## Add rules to allow CHAIN to be a DNS resolver.
 303 dnsresolver () {
 304   set -e
 305   chain=$1
 306   for p in tcp udp; do
 307     run ip46tables -A $chain -j ACCEPT \
 308              -m state --state ESTABLISHED \
 309              -p $p --source-port 53
 310   done
 311 }
 312
 313 ## dnsserver CHAIN
 314 ##
 315 ## Add rules to allow CHAIN to be a DNS server.
 316 dnsserver () {
 317   set -e
 318   chain=$1
 319
 320   ## Allow TCP access.  Hitting us with SYNs will make us deploy SYN cookies,
 321   ## but that's tolerable.
 322   run ip46tables -A $chain -j ACCEPT -p tcp --destination-port 53
 323
 324   ## Avoid being a DDoS amplifier by rate-limiting incoming DNS queries.
 325   clearchain $chain-udp-dns
 326   run ip46tables -A $chain-udp-dns -j ACCEPT \
 327           -m limit --limit 20/second --limit-burst 300
 328   run ip46tables -A $chain-udp-dns -g dns-rate-limit
 329   run ip46tables -A $chain -j $chain-udp-dns \
 330           -p udp --destination-port 53
 331 }
 332
 333 ## openports CHAIN [MIN MAX]
 334 ##
 335 ## Add rules to CHAIN to allow the open ports.
 336 openports () {
 337   set -e
 338   chain=$1; shift
 339   [ $# -eq 0 ] && set -- $open_port_min $open_port_max
 340   run ip46tables -A $chain -p tcp -g interesting --destination-port $1:$2
 341   run ip46tables -A $chain -p udp -g interesting --destination-port $1:$2
 342 }
 343
 344 m4_divert(20)m4_dnl
 345 ###--------------------------------------------------------------------------
 346 ### Packet classification.
 347 ###
 348 ### See `classify.m4' for an explanation of how the firewall machinery for
 349 ### packet classification works.
 350 ###
 351 ### A list of all network names is kept in `allnets'.  For each network NET,
 352 ### shell variables are defined describing their properties.
 353 ###
 354 ### net_class_NET       The class of the network, as defined by
 355 ###                     `defnetclass'.
 356 ### net_inet_NET        List of IPv4 address ranges in the network.
 357 ### net_inet6_NET       List of IPv6 address ranges in the network.
 358 ### net_fwd_NET         List of other networks that this one forwards to.
 359 ### net_hosts_NET       List of hosts known to be in the network.
 360 ### host_inet_HOST      IPv4 address of the named HOST.
 361 ### host_inet6_HOST     IPv6 address of the named HOST.
 362 ###
 363 ### Similarly, a list of hosts is kept in `allhosts', and for each host HOST,
 364 ### a shell variables are defined:
 365 ###
 366 ### host_ifaces_HOST    List of interfaces for this host and the networks
 367 ###                     they attach to, in the form IFACE=NET.
 368
 369 ## defbitfield NAME WIDTH
 370 ##
 371 ## Defines MASK_NAME and BIT_NAME symbolic constants for dealing with
 372 ## bitfields: x << BIT_NAME yields the value x in the correct position, and
 373 ## ff & MASK_NAME extracts the corresponding value.
 374 defbitfield () {
 375   set -e
 376   name=$1 width=$2
 377   eval MASK_$name=$(( (1 << $width) - 1 << $bitindex ))
 378   eval BIT_$name=$bitindex
 379   bitindex=$(( $bitindex + $width ))
 380 }
 381
 382 ## Define the layout of the bitfield.
 383 bitindex=0
 384 defbitfield MASK 16
 385 defbitfield FROM 4
 386 defbitfield TO 4
 387
 388 ## defnetclass NAME FORWARD-TO...
 389 ##
 390 ## Defines a netclass called NAME, which is allowed to forward to the
 391 ## FORWARD-TO netclasses.
 392 ##
 393 ## For each netclass, constants from_NAME and to_NAME are defined as the
 394 ## appropriate values in the FROM and TO fields (i.e., not including any mask
 395 ## bits).
 396 ##
 397 ## This function also establishes mangle chains mark-from-NAME and
 398 ## mark-to-NAME for applying the appropriate mark bits to the packet.
 399 ##
 400 ## Because it needs to resolve forward references, netclasses must be defined
 401 ## in a two-pass manner, using a loop of the form
 402 ##
 403 ##   for pass in 1 2; do netclassindex=0; ...; done
 404 netclassess=
 405 defnetclass () {
 406   set -e
 407   name=$1; shift
 408   case $pass in
 409     1)
 410
 411       ## Pass 1.  Establish the from_NAME and to_NAME constants, and the
 412       ## netclass's mask bit.
 413       trace "netclass $name = $netclassindex"
 414       eval from_$name=$(( $netclassindex << $BIT_FROM ))
 415       eval to_$name=$(( $netclassindex << $BIT_TO ))
 416       eval fwd_$name=$(( 1 << ($netclassindex + $BIT_MASK) ))
 417       nets="$nets $name"
 418       ;;
 419     2)
 420
 421       ## Pass 2.  Compute the actual from and to values.  This is fiddly:
 422       ## we want to preserve the other flags.
 423       from=$(( ($netclassindex << $BIT_FROM) ))
 424       frommask=$(( $MASK_FROM | $MASK_MASK ))
 425       for net; do
 426         eval bit=\$fwd_$net
 427         from=$(( $from + $bit ))
 428       done
 429       to=$(( ($netclassindex << $BIT_TO) ))
 430       tomask=$(( $MASK_MASK ^ (1 << ($netclassindex + $BIT_MASK)) ))
 431       trace "from $name --> set $(printf %08x/%08x $from $frommask)"
 432       trace "  to $name --> and $(printf %08x/%08x $to $tomask)"
 433
 434       ## Now establish the mark-from-NAME and mark-to-NAME chains.
 435       clearchain mangle:mark-from-$name mangle:mark-to-$name
 436       run ip46tables -t mangle -A mark-from-$name -j MARK \
 437               --set-xmark $from/$frommask
 438       run ip46tables -t mangle -A mark-to-$name -j MARK \
 439               --set-xmark $to/$tomask
 440       ;;
 441   esac
 442   netclassindex=$(( $netclassindex + 1 ))
 443 }
 444
 445 ## defnet NET CLASS
 446 ##
 447 ## Define a network.  Follow by calls to `addr', `forwards', etc. to define
 448 ## properties of the network.  Networks are processed in order, so if their
 449 ## addresses overlap then the more specific addresses should be defined
 450 ## earlier.
 451 defnet () {
 452   net=$1 class=$2
 453   addword allnets $net
 454   eval net_class_$1=\$class
 455 }
 456
 457 ## addr ADDRESS/LEN ...
 458 ##
 459 ## Define addresses for the network being defined.  ADDRESSes are in
 460 ## colon-separated IPv6 or dotted-quad IPv4 form.
 461 addr () {
 462   for i in "$@"; do
 463     case "$i" in
 464       *:*) addword net_inet6_$net $i ;;
 465       *) addword net_inet_$net $i ;;
 466     esac
 467   done
 468 }
 469
 470 ## forwards NET ...
 471 ##
 472 ## Declare that packets from this network are forwarded to the other NETs.
 473 forwards () {
 474   eval "net_fwd_$net=\"$*\""
 475 }
 476
 477 ## noxit NET ...
 478 ##
 479 ## Declare that packets from this network must not be forwarded to the other
 480 ## NETs.
 481 noxit () {
 482   eval "net_noxit_$net=\"$*\""
 483 }
 484
 485 ## host HOST ADDR ...
 486 ##
 487 ## Define the address of an individual host on the current network.  The
 488 ## ADDRs may be full IPv4 or IPv6 addresses, or offsets from the containing
 489 ## network address, which is a simple number for IPv4, or a suffix beginning
 490 ## with `::' for IPv6.  If an IPv6 base address is provided for the network
 491 ## but not for the host then the host's IPv4 address is used as a suffix.
 492 host () {
 493   name=$1; shift
 494
 495   ## Work out which addresses we've actually been given.
 496   unset a6
 497   for i in "$@"; do
 498     case "$i" in ::*) a6=$i ;; *) a=$i ;; esac
 499   done
 500   case "${a+t}" in
 501     t) ;;
 502     *) echo >&2 "$0: no address for $name"; exit 1 ;;
 503   esac
 504   case "${a6+t}" in t) ;; *) a6=::$a ;; esac
 505
 506   ## Work out the IPv4 address.
 507   eval nn=\$net_inet_$net
 508   for n in $nn; do
 509     addr=${n%/*}
 510     base=${addr%.*}
 511     offset=${addr##*.}
 512     case $a in *.*) aa=$a ;; *) aa=$base.$(( $offset + $a )) ;; esac
 513     eval host_inet_$name=$aa
 514   done
 515
 516   ## Work out the IPv6 address.
 517   eval nn=\$net_inet6_$net
 518   for n in $nn; do
 519     addr=${n%/*}
 520     base=${addr%::*}
 521     case $a6 in ::*) aa=$base$a6 ;; *) aa=$a6 ;; esac
 522     eval host_inet6_$name=$aa
 523   done
 524
 525   ## Remember the host in the list.
 526   addword net_hosts_$net $name
 527 }
 528
 529 ## defhost NAME
 530 ##
 531 ## Define a new host.  Follow by calls to `iface' to define the host's
 532 ## interfaces.
 533 defhost () {
 534   host=$1
 535   addword allhosts $host
 536   eval host_type_$host=server
 537 }
 538
 539 ## hosttype TYPE
 540 ##
 541 ## Declare the host to have the given type.
 542 hosttype () {
 543   type=$1
 544   case $type in
 545     router | server | client) ;;
 546      *) echo >&2 "$0: bad host type \`$type'"; exit 1 ;;
 547   esac
 548   eval host_type_$host=$type
 549 }
 550
 551 ## iface IFACE NET ...
 552 ##
 553 ## Define a host's interfaces.  Specifically, declares that the host has an
 554 ## interface IFACE attached to the listed NETs.
 555 iface () {
 556   name=$1; shift
 557   for net in "$@"; do
 558     addword host_ifaces_$host $name=$net
 559   done
 560 }
 561
 562 ## matchnets OPT WIN FLAGS PREPARE BASE SUFFIX NEXT NET [NET ...]
 563 ##
 564 ## Build rules which match a particular collection of networks.
 565 ##
 566 ## Specifically, use the address-comparison operator OPT (typically `-s' or
 567 ## `-d') to match the addresses of each NET, writing the rules to the chain
 568 ## BASESUFFIX.  If we find a match, dispatch to WIN-CLASS, where CLASS is the
 569 ## class of the matching network.  In order to deal with networks containing
 570 ## negative address ranges, more chains may need to be constructed; they will
 571 ## be named BASE#Q for sequence numbers Q starting with NEXT.  All of this
 572 ## happens on the `mangle' table, and there isn't (currently) a way to tweak
 573 ## this.
 574 ##
 575 ## The FLAGS gather additional interesting information about the job,
 576 ## separated by colons.  The only flag currently is :default: which means
 577 ## that the default network was listed.
 578 ##
 579 ## Finally, there is a hook PREPARE which is called just in advance of
 580 ## processing the final network, passing it the argument FLAGS.  (The PREPARE
 581 ## string will be subjected to shell word-splitting, so it can provide some
 582 ## arguments of its own if it wants.)  It should set `mode' to indicate how
 583 ## the chain should be finished.
 584 ##
 585 ## goto         If no networks matched, then issue a final `goto' to the
 586 ##              chain named by the variable `fail'.
 587 ##
 588 ## call         Run `$finish CHAIN' to write final rules to the named CHAIN
 589 ##              (which may be suffixed from the original BASE argument if
 590 ##              this was necessary).  This function will arrange to call
 591 ##              these rules if no networks match.
 592 ##
 593 ## ret          If no network matches then return (maybe by falling off the
 594 ##              end of the chain).
 595 matchnets () {
 596   local opt win flags prepare base suffix next net lose splitp
 597   opt=$1 win=$2 flags=$3 prepare=$4 base=$5 suffix=$6 next=$7 net=$8
 598   shift 8
 599
 600   ## If this is the default network, then set the flag.
 601   case "$net" in default) flags=${flags}default: ;; esac
 602
 603   ## Do an initial pass over the addresses to see whether there are any
 604   ## negative ranges.  If so, we'll need to split.  See also the standard
 605   ## joke about soup.
 606   splitp=nil
 607   eval "addrs=\"\$net_inet_$net \$net_inet6_$net\""
 608   for a in $addrs; do case $a in !*) splitp=t; break ;; esac; done
 609
 610   trace "MATCHNETS [splitp $splitp] $opt $win $flags [$prepare] $base $suffix $next : $net $*"
 611
 612   ## Work out how to handle matches against negative address ranges.  If this
 613   ## is the last network, invoke the PREPARE hook to find out.  Otherwise, if
 614   ## we have to split the chain, recursively build the target here.
 615   case $splitp,$# in
 616     t,0 | nil,0)
 617       $prepare $flags
 618       case $splitp,$mode in
 619         *,goto)
 620           lose="-g $fail"
 621           ;;
 622         *,ret)
 623           lose="-j RETURN"
 624           ;;
 625         t,call)
 626           clearchain mangle:$base#$next
 627           lose="-g $base#$next"
 628           ;;
 629         nil,call)
 630           ;;
 631       esac
 632       ;;
 633     t,*)
 634       clearchain mangle:$base#$next
 635       matchnets $opt $win $flags "$prepare" \
 636         $base \#$next $(( $next + 1 )) "$@"
 637       lose="-g $base#$next" mode=goto
 638       ;;
 639     *)
 640       mode=continue
 641       ;;
 642   esac
 643
 644   ## Populate the chain with rules to match the necessary networks.
 645   eval addr=\$net_inet_$net addr6=\$net_inet6_$net class=\$net_class_$net
 646   for a in $addr; do
 647     case $a in
 648       !*) run iptables -t mangle -A $base$suffix $lose $opt ${a#!} ;;
 649       *) run iptables -t mangle -A $base$suffix -g $win-$class $opt $a ;;
 650     esac
 651   done
 652   for a in $addr6; do
 653     case $a in
 654       !*) run ip6tables -t mangle -A $base$suffix $lose $opt ${a#!} ;;
 655       *) run ip6tables -t mangle -A $base$suffix -g $win-$class $opt $a ;;
 656     esac
 657   done
 658
 659   ## Wrap up the chain appropriately.  If we didn't split and there are more
 660   ## networks to handle then append the necessary rules now.  (If we did
 661   ## split, then we already wrote the rules for them above.)  If there are no
 662   ## more networks then consult the `mode' setting to find out what to do.
 663   case $splitp,$#,$mode in
 664     *,0,ret) ;;
 665     *,*,goto) run ip46tables -t mangle -A $base$suffix $lose ;;
 666     t,0,call) $finish $base#$next ;;
 667     nil,0,call) $finish $base$suffix ;;
 668     nil,*,*)
 669       matchnets $opt $win $flags "$prepare" $base "$suffix" $next "$@"
 670       ;;
 671   esac
 672 }
 673
 674 ## net_interfaces HOST NET
 675 ##
 676 ## Determine the interfaces on which packets may plausibly arrive from the
 677 ## named NET.  Returns `-' if no such interface exists.
 678 ##
 679 ## This algorithm is not very clever.  It's just about barely good enough to
 680 ## deduce transitivity through a simple routed network; with complicated
 681 ## networks, it will undoubtedly give wrong answers.  Check the results
 682 ## carefully, and, if necessary, list the connectivity explicitly; use the
 683 ## special interface `-' for networks you know shouldn't send packets to a
 684 ## host.
 685 net_interfaces () {
 686   host=$1 startnet=$2
 687
 688   ## Determine the locally attached networks.
 689   targets=:
 690   eval ii=\$host_ifaces_$host
 691   for i in $ii; do targets=$targets$i:; done
 692
 693   ## Determine the transitivity.
 694   seen=:
 695   nets=$startnet
 696   while :; do
 697
 698     ## First pass.  Determine whether any of the networks we're considering
 699     ## are in the target set.  If they are, then return the corresponding
 700     ## interfaces.
 701     found=""
 702     for net in $nets; do
 703       tg=$targets
 704       while :; do
 705         any=nil
 706         case $tg in
 707           *"=$net:"*)
 708             n=${tg%=$net:*}; tg=${n%:*}:; n=${n##*:}
 709             addword found $n
 710             any=t
 711             ;;
 712         esac
 713         case $any in nil) break ;; esac
 714       done
 715     done
 716     case "$found" in ?*) echo $found; return ;; esac
 717
 718     ## No joy.  Determine the set of networks which (a) these ones can
 719     ## forward to, and (b) that we've not considered already.  These are the
 720     ## nets we'll consider next time around.
 721     nextnets=""
 722     any=nil
 723     for net in $nets; do
 724       eval fwd=\$net_fwd_$net
 725       for n in $fwd; do
 726         case $seen in *":$n:"*) continue ;; esac
 727         seen=$seen$n:
 728         eval noxit=\$net_noxit_$n
 729         case " $noxit " in *" $startnet "*) continue ;; esac
 730         case " $nextnets " in
 731           *" $n "*) ;;
 732           *) addword nextnets $n; any=t ;;
 733         esac
 734       done
 735     done
 736
 737     ## If we've run out of networks then there's no reachability.  Return a
 738     ## failure.
 739     case $any in nil) echo -; return ;; esac
 740     nets=$nextnets
 741   done
 742 }
 743
 744 m4_divert(-1)
 745 ###----- That's all, folks --------------------------------------------------