/*
* firewall3 - 3rd OpenWrt UCI firewall implementation
*
- * Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
+ * Copyright (C) 2013 Jo-Philipp Wich <jo@mein.io>
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
*/
#define _GNU_SOURCE
+
+#include <net/if.h>
+#include <sys/ioctl.h>
+
#include "utils.h"
#include "options.h"
switch ((pid = fork()))
{
case -1:
+ free(args);
return false;
case 0:
}
pipe_fd = fdopen(pfds[1], "w");
+ free(args);
return true;
}
ptr.value = z->masq ? "1" : "0";
uci_set(ctx, &ptr);
- ptr.o = NULL;
- ptr.option = "conntrack";
- ptr.value = z->conntrack ? "1" : "0";
- uci_set(ctx, &ptr);
-
ptr.o = NULL;
ptr.option = "mtu_fix";
ptr.value = z->mtu_fix ? "1" : "0";
fw3_foreach(dev, &z->devices)
{
+ char *ep;
+
if (!dev)
continue;
p = buf;
+ ep = buf + sizeof(buf);
if (dev->invert)
- p += sprintf(p, "!");
+ p += snprintf(p, ep - p, "!");
if (*dev->network)
- p += sprintf(p, "%s@%s", dev->name, dev->network);
+ p += snprintf(p, ep - p, "%s@%s", dev->name, dev->network);
else
- p += sprintf(p, "%s", dev->name);
+ p += snprintf(p, ep - p, "%s", dev->name);
ptr.value = buf;
uci_add_list(ctx, &ptr);
ptr.value = s->name;
uci_set(ctx, &ptr);
+ ptr.o = NULL;
+ ptr.option = "family";
+ if (s->family == FW3_FAMILY_V4)
+ ptr.value = "ipv4";
+ else
+ ptr.value = "ipv6";
+ uci_set(ctx, &ptr);
+
ptr.o = NULL;
ptr.option = "storage";
ptr.value = fw3_ipset_method_names[s->method];
fw3_bitlen2netmask(int family, int bits, void *mask)
{
int i;
+ uint8_t rem, b;
struct in_addr *v4;
struct in6_addr *v6;
return false;
v6 = mask;
- i = abs(bits);
+ rem = abs(bits);
- memset(v6->s6_addr, 0xff, i / 8);
-
- if (i < 128)
+ for (i = 0; i < sizeof(v6->s6_addr); i++)
{
- memset(v6->s6_addr + (i / 8) + 1, 0, (128 - i) / 8);
- v6->s6_addr[i / 8] = 0xff << (8 - (i & 7));
+ b = (rem > 8) ? 8 : rem;
+ v6->s6_addr[i] = (uint8_t)(0xFF << (8 - b));
+ rem -= b;
}
if (bits < 0)
- for (i = 0; i < 16; i++)
+ for (i = 0; i < sizeof(v6->s6_addr); i++)
v6->s6_addr[i] = ~v6->s6_addr[i];
}
else
return false;
v4 = mask;
- v4->s_addr = htonl(~((1 << (32 - abs(bits))) - 1));
+ v4->s_addr = bits ? htonl(~((1 << (32 - abs(bits))) - 1)) : 0;
if (bits < 0)
v4->s_addr = ~v4->s_addr;
freeifaddrs(ifaddr);
}
+
+bool fw3_attr_parse_name_type(struct blob_attr *entry, const char **name, const char **type)
+{
+ struct blob_attr *opt;
+ unsigned orem;
+
+ if (!type || !name)
+ return false;
+
+ *type = NULL;
+
+ blobmsg_for_each_attr(opt, entry, orem)
+ if (!strcmp(blobmsg_name(opt), "type"))
+ *type = blobmsg_get_string(opt);
+ else if (!strcmp(blobmsg_name(opt), "name"))
+ *name = blobmsg_get_string(opt);
+
+ return *type != NULL ? true : false;
+}
+
+const char *
+fw3_protoname(void *proto)
+{
+ static char buf[sizeof("4294967295")];
+ struct fw3_protocol *p = proto;
+ struct protoent *pe;
+
+ if (!p)
+ return "?";
+
+ pe = getprotobynumber(p->protocol);
+
+ if (!pe)
+ {
+ snprintf(buf, sizeof(buf), "%u", p->protocol);
+ return buf;
+ }
+
+ return pe->p_name;
+}
+
+bool
+fw3_check_loopback_dev(const char *name)
+{
+ struct ifreq ifr;
+ int s;
+ bool rv = false;
+
+ s = socket(AF_LOCAL, SOCK_DGRAM, 0);
+
+ if (s < 0)
+ return false;
+
+ memset(&ifr, 0, sizeof(ifr));
+ strncpy(ifr.ifr_name, name, sizeof(ifr.ifr_name) - 1);
+
+ if (ioctl(s, SIOCGIFFLAGS, &ifr) >= 0) {
+ if (ifr.ifr_flags & IFF_LOOPBACK)
+ rv = true;
+ }
+
+ close(s);
+
+ return rv;
+}
+
+bool
+fw3_check_loopback_addr(struct fw3_address *addr)
+{
+ if (addr->family == FW3_FAMILY_V4 &&
+ (ntohl(addr->address.v4.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET)
+ return true;
+
+ if (addr->family == FW3_FAMILY_V6 && !addr->range &&
+ fw3_netmask2bitlen(FW3_FAMILY_V6, &addr->mask.v6) == 128 &&
+ IN6_IS_ADDR_LOOPBACK(&addr->address.v6))
+ return true;
+
+ return false;
+}