X-Git-Url: http://git.openwrt.org/?a=blobdiff_plain;f=rules.c;h=8f232d3e06449f5e6221adacb8675103d1876c7b;hb=19acf041bfdb479e68d53699cc8940d21d76434b;hp=1a4473b18730f1a030df4df7d293971210396323;hpb=e43e3cc546ef1d79ca2125e2381662bf9501ccd4;p=project%2Ffirewall3.git diff --git a/rules.c b/rules.c index 1a4473b..8f232d3 100644 --- a/rules.c +++ b/rules.c @@ -1,7 +1,7 @@ /* * firewall3 - 3rd OpenWrt UCI firewall implementation * - * Copyright (C) 2013 Jo-Philipp Wich + * Copyright (C) 2013 Jo-Philipp Wich * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -28,6 +28,9 @@ const struct fw3_option fw3_rule_opts[] = { FW3_OPT("src", device, rule, src), FW3_OPT("dest", device, rule, dest), + FW3_OPT("device", string, rule, device), + FW3_OPT("direction", direction, rule, direction_out), + FW3_OPT("ipset", setmatch, rule, ipset), FW3_LIST("proto", protocol, rule, proto), @@ -69,44 +72,85 @@ need_src_action_chain(struct fw3_rule *r) return (r->_src && r->_src->log && (r->target > FW3_FLAG_ACCEPT)); } +static struct fw3_rule* +alloc_rule(struct fw3_state *state) +{ + struct fw3_rule *rule = calloc(1, sizeof(*rule)); + + if (rule) { + INIT_LIST_HEAD(&rule->proto); + + INIT_LIST_HEAD(&rule->ip_src); + INIT_LIST_HEAD(&rule->mac_src); + INIT_LIST_HEAD(&rule->port_src); + + INIT_LIST_HEAD(&rule->ip_dest); + INIT_LIST_HEAD(&rule->port_dest); + + INIT_LIST_HEAD(&rule->icmp_type); + + list_add_tail(&rule->list, &state->rules); + rule->enabled = true; + } + + return rule; +} + void -fw3_load_rules(struct fw3_state *state, struct uci_package *p) +fw3_load_rules(struct fw3_state *state, struct uci_package *p, + struct blob_attr *a) { struct uci_section *s; struct uci_element *e; - struct fw3_rule *rule; + struct fw3_rule *rule, *n; + struct blob_attr *entry, *opt; + unsigned rem, orem; INIT_LIST_HEAD(&state->rules); - uci_foreach_element(&p->sections, e) - { - s = uci_to_section(e); + blob_for_each_attr(entry, a, rem) { + const char *type = NULL; + const char *name = "ubus rule"; + blobmsg_for_each_attr(opt, entry, orem) + if (!strcmp(blobmsg_name(opt), "type")) + type = blobmsg_get_string(opt); + else if (!strcmp(blobmsg_name(opt), "name")) + name = blobmsg_get_string(opt); - if (strcmp(s->type, "rule")) + if (!type || strcmp(type, "rule")) continue; - rule = malloc(sizeof(*rule)); - - if (!rule) + if (!(rule = alloc_rule(state))) continue; - memset(rule, 0, sizeof(*rule)); - - INIT_LIST_HEAD(&rule->proto); - - INIT_LIST_HEAD(&rule->ip_src); - INIT_LIST_HEAD(&rule->mac_src); - INIT_LIST_HEAD(&rule->port_src); + if (!fw3_parse_blob_options(rule, fw3_rule_opts, entry, name)) + { + fprintf(stderr, "%s skipped due to invalid options\n", name); + fw3_free_rule(rule); + continue; + } + } - INIT_LIST_HEAD(&rule->ip_dest); - INIT_LIST_HEAD(&rule->port_dest); + uci_foreach_element(&p->sections, e) + { + s = uci_to_section(e); - INIT_LIST_HEAD(&rule->icmp_type); + if (strcmp(s->type, "rule")) + continue; - rule->enabled = true; + if (!(rule = alloc_rule(state))) + continue; - fw3_parse_options(rule, fw3_rule_opts, s); + if (!fw3_parse_options(rule, fw3_rule_opts, s)) + { + warn_elem(e, "skipped due to invalid options"); + fw3_free_rule(rule); + continue; + } + } + list_for_each_entry_safe(rule, n, &state->rules, list) + { if (!rule->enabled) { fw3_free_rule(rule); @@ -203,17 +247,14 @@ fw3_load_rules(struct fw3_state *state, struct uci_package *p) /* NB: rule family... */ if (rule->_dest) { - setbit(rule->_dest->flags[0], rule->target); - setbit(rule->_dest->flags[1], rule->target); + fw3_setbit(rule->_dest->flags[0], rule->target); + fw3_setbit(rule->_dest->flags[1], rule->target); } else if (need_src_action_chain(rule)) { - setbit(rule->_src->flags[0], fw3_to_src_target(rule->target)); - setbit(rule->_src->flags[1], fw3_to_src_target(rule->target)); + fw3_setbit(rule->_src->flags[0], fw3_to_src_target(rule->target)); + fw3_setbit(rule->_src->flags[1], fw3_to_src_target(rule->target)); } - - list_add_tail(&rule->list, &state->rules); - continue; } } @@ -223,15 +264,15 @@ append_chain(struct fw3_ipt_rule *r, struct fw3_rule *rule) { char chain[32]; - snprintf(chain, sizeof(chain), "delegate_output"); + snprintf(chain, sizeof(chain), "OUTPUT"); if (rule->target == FW3_FLAG_NOTRACK) { snprintf(chain, sizeof(chain), "zone_%s_notrack", rule->src.name); } - else if (rule->target == FW3_FLAG_MARK) + else if (rule->target == FW3_FLAG_MARK && (rule->_src || rule->src.any)) { - snprintf(chain, sizeof(chain), "fwmark"); + snprintf(chain, sizeof(chain), "PREROUTING"); } else { @@ -249,16 +290,16 @@ append_chain(struct fw3_ipt_rule *r, struct fw3_rule *rule) else { if (rule->dest.set) - snprintf(chain, sizeof(chain), "delegate_forward"); + snprintf(chain, sizeof(chain), "FORWARD"); else - snprintf(chain, sizeof(chain), "delegate_input"); + snprintf(chain, sizeof(chain), "INPUT"); } } if (rule->dest.set && !rule->src.set) { if (rule->dest.any) - snprintf(chain, sizeof(chain), "delegate_output"); + snprintf(chain, sizeof(chain), "OUTPUT"); else snprintf(chain, sizeof(chain), "zone_%s_output", rule->dest.name); @@ -286,7 +327,8 @@ static void set_target(struct fw3_ipt_rule *r, struct fw3_rule *rule) return; case FW3_FLAG_NOTRACK: - fw3_ipt_rule_target(r, fw3_flag_names[rule->target]); + fw3_ipt_rule_target(r, "CT"); + fw3_ipt_rule_addarg(r, false, "--notrack", NULL); return; case FW3_FLAG_ACCEPT: @@ -344,6 +386,7 @@ print_rule(struct fw3_ipt_handle *handle, struct fw3_state *state, r = fw3_ipt_rule_create(handle, proto, NULL, NULL, sip, dip); fw3_ipt_rule_sport_dport(r, sport, dport); + fw3_ipt_rule_device(r, rule->device, rule->direction_out); fw3_ipt_rule_icmptype(r, icmptype); fw3_ipt_rule_mac(r, mac); fw3_ipt_rule_ipset(r, &rule->ipset);