Hinzufügen einer benutzerdefinierten Kette zu OUTPUT mit libiptc

Question

Ich versuche, den folgenden iptable-Befehl mit libiptc zu erreichen, kann aber keine Beispiele finden, wie dies zu tun ist.

iptables -A OUTPUT -j my_outbound_rules 

Ich habe versucht, den folgenden Code:

int addChainToBuiltin(const char *_pChain, const char *_pTarget) 
{ 
    /*iptables -A OUTPUT -j <chain>*/ 
    const char *pTable = "filter"; 

    struct xtc_handle  *pHandle; 
    struct ipt_entry  *pEntry; 
    struct xt_entry_target *pTarget; 

    size_t entrySize = XT_ALIGN(sizeof(struct ipt_entry)); 
    size_t targetSize = XT_ALIGN(sizeof(struct xt_entry_target)); 

    pHandle = iptc_init(pTable); 
    if (! pHandle) 
     return errno; 

    pEntry = calloc(1, entrySize + targetSize); 
    pTarget = (struct xt_entry_target *)((char*)pEntry + entrySize); 

    strncpy(pTarget->u.user.name, _pTarget, sizeof(pTarget->u.user.name)); 
    pTarget->u.target_size  = targetSize; 
    pTarget->u.user.target_size = targetSize; 
    pTarget->u.user.revision = 1; 

    pEntry->target_offset = entrySize; 
    pEntry->next_offset = entrySize + targetSize; 

    pEntry->ip.src.s_addr = INADDR_ANY; 
    pEntry->ip.smsk.s_addr = 0; 
    pEntry->ip.dst.s_addr = INADDR_ANY; 
    pEntry->ip.dmsk.s_addr = 0; 

    pEntry->ip.proto = 0; // any 
    pEntry->ip.flags = 0; 
    pEntry->ip.invflags = 0; 
    pEntry->nfcache  = NFC_UNKNOWN; 

    int res = applyRule(Append, _pChain, pEntry, pHandle); 
    if (res == 0) 
     res = commitAndFree(pHandle); 

    printf("Result: %d %s\n", res, iptc_strerror(res)); 

    free(pEntry); 

    return res; 
} 

Aber ich erhalte eine Fehlermeldung 'Invalid Argument' von iptc_strerror, kann aber nicht sehen, welches Argument ist ungültig.

Vielen Dank

Answer 1

es mit dem folgenden Code Gelöst:

int addChainToBuiltin(const char *_pChain, const char *_pTarget) 
{ 
    /*iptables -A OUTPUT -j <chain>*/ 
    const char *pTable = "filter"; 

    struct xtc_handle   *pHandle; 
    struct ipt_entry   *pEntry; 
    struct xt_standard_target *pTarget; 

    size_t entrySize = XT_ALIGN(sizeof(struct ipt_entry)); 
    size_t targetSize = XT_ALIGN(sizeof(struct xt_standard_target)); 

    pHandle = iptc_init(pTable); 
    if (! pHandle) 
     return errno; 

    pEntry = calloc(1, entrySize + targetSize); 
    pTarget = (struct xt_entry_target *)((char*)pEntry + entrySize); 

    strncpy(pTarget->target.u.user.name, _pTarget, sizeof(pTarget->target.u.user.name)); 
    pTarget->target.u.target_size  = targetSize; 
    pTarget->target.u.user.target_size = targetSize; 
    pTarget->target.u.user.revision = 0; 

    pEntry->target_offset = entrySize; 
    pEntry->next_offset = entrySize + targetSize; 

    pEntry->ip.src.s_addr = INADDR_ANY; 
    pEntry->ip.smsk.s_addr = 0; 
    pEntry->ip.dst.s_addr = INADDR_ANY; 
    pEntry->ip.dmsk.s_addr = 0; 

    pEntry->ip.proto = 0; // any 
    pEntry->ip.flags = 0; 
    pEntry->ip.invflags = 0; 
    pEntry->nfcache  = NFC_UNKNOWN; 

    printf("Adding: %s to %s\n", pTarget->target.u.user.name, _pChain); 

    int res = applyRule(Append, _pChain, pEntry, pHandle); 
    if (res == 0) 
     res = commitAndFree(pHandle); 

    free(pEntry); 

    return res; 
}