X-Git-Url: http://git.openwrt.org/?a=blobdiff_plain;f=rules.c;h=d34fb7e489dd538432f172380aa27b65add9dab6;hb=e264c8e585ea37ccb1739e7a8e12f8454da1d8a4;hp=a5f3fa9328f02eeb76188ba6ddf42c0505269503;hpb=1d0bd45db042c9dd916f15a5f4e3e5a2f63d0616;p=project%2Ffirewall3.git diff --git a/rules.c b/rules.c index a5f3fa9..d34fb7e 100644 --- a/rules.c +++ b/rules.c @@ -1,7 +1,7 @@ /* * firewall3 - 3rd OpenWrt UCI firewall implementation * - * Copyright (C) 2013 Jo-Philipp Wich + * Copyright (C) 2013 Jo-Philipp Wich * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -96,13 +96,112 @@ alloc_rule(struct fw3_state *state) return rule; } +static bool +check_rule(struct fw3_state *state, struct fw3_rule *r, struct uci_element *e) +{ + if (!r->enabled) + return false; + + if (r->src.invert || r->dest.invert) + { + warn_section("rule", r, e, "must not have inverted 'src' or 'dest' options"); + return false; + } + else if (r->src.set && !r->src.any && + !(r->_src = fw3_lookup_zone(state, r->src.name))) + { + warn_section("rule", r, e, "refers to not existing zone '%s'", r->src.name); + return false; + } + else if (r->dest.set && !r->dest.any && + !(r->_dest = fw3_lookup_zone(state, r->dest.name))) + { + warn_section("rule", r, e, "refers to not existing zone '%s'", r->dest.name); + return false; + } + else if (r->ipset.set && state->disable_ipsets) + { + warn_section("rule", r, e, "skipped due to disabled ipset support"); + return false; + } + else if (r->ipset.set && + !(r->ipset.ptr = fw3_lookup_ipset(state, r->ipset.name))) + { + warn_section("rule", r, e, "refers to unknown ipset '%s'", r->ipset.name); + return false; + } + + if (!r->_src && r->target == FW3_FLAG_NOTRACK) + { + warn_section("rule", r, e, "is set to target NOTRACK but has no source assigned"); + return false; + } + + if (!r->set_mark.set && !r->set_xmark.set && + r->target == FW3_FLAG_MARK) + { + warn_section("rule", r, e, "is set to target MARK but specifies neither " + "'set_mark' nor 'set_xmark' option"); + return false; + } + + if (r->_dest && r->target == FW3_FLAG_MARK) + { + warn_section("rule", r, e, "must not specify 'dest' for MARK target"); + return false; + } + + if (r->set_mark.invert || r->set_xmark.invert) + { + warn_section("rule", r, e, "must not have inverted 'set_mark' or 'set_xmark'"); + return false; + } + + if (!r->_src && !r->_dest && !r->src.any && !r->dest.any) + { + warn_section("rule", r, e, "has neither a source nor a destination zone assigned " + "- assuming an output r"); + } + + if (list_empty(&r->proto)) + { + warn_section("rule", r, e, "does not specify a protocol, assuming TCP+UDP"); + fw3_parse_protocol(&r->proto, "tcpudp", true); + } + + if (r->target == FW3_FLAG_UNSPEC) + { + warn_section("rule", r, e, "has no target specified, defaulting to REJECT"); + r->target = FW3_FLAG_REJECT; + } + else if (r->target > FW3_FLAG_MARK) + { + warn_section("rule", r, e, "has invalid target specified, defaulting to REJECT"); + r->target = FW3_FLAG_REJECT; + } + + /* NB: r family... */ + if (r->_dest) + { + fw3_setbit(r->_dest->flags[0], r->target); + fw3_setbit(r->_dest->flags[1], r->target); + } + else if (need_src_action_chain(r)) + { + fw3_setbit(r->_src->flags[0], fw3_to_src_target(r->target)); + fw3_setbit(r->_src->flags[1], fw3_to_src_target(r->target)); + } + + return true; +} + void fw3_load_rules(struct fw3_state *state, struct uci_package *p, struct blob_attr *a) { struct uci_section *s; struct uci_element *e; - struct fw3_rule *rule, *n; + struct fw3_rule *rule; struct blob_attr *entry, *opt; unsigned rem, orem; @@ -125,10 +224,13 @@ fw3_load_rules(struct fw3_state *state, struct uci_package *p, if (!fw3_parse_blob_options(rule, fw3_rule_opts, entry, name)) { - fprintf(stderr, "%s skipped due to invalid options\n", name); + warn_section("rule", rule, NULL, "skipped due to invalid options"); fw3_free_rule(rule); continue; } + + if (!check_rule(state, rule, NULL)) + fw3_free_rule(rule); } uci_foreach_element(&p->sections, e) @@ -147,114 +249,9 @@ fw3_load_rules(struct fw3_state *state, struct uci_package *p, fw3_free_rule(rule); continue; } - } - list_for_each_entry_safe(rule, n, &state->rules, list) - { - if (!rule->enabled) - { - fw3_free_rule(rule); - continue; - } - - if (rule->src.invert || rule->dest.invert) - { - warn_elem(e, "must not have inverted 'src' or 'dest' options"); + if (!check_rule(state, rule, e)) fw3_free_rule(rule); - continue; - } - else if (rule->src.set && !rule->src.any && - !(rule->_src = fw3_lookup_zone(state, rule->src.name))) - { - warn_elem(e, "refers to not existing zone '%s'", rule->src.name); - fw3_free_rule(rule); - continue; - } - else if (rule->dest.set && !rule->dest.any && - !(rule->_dest = fw3_lookup_zone(state, rule->dest.name))) - { - warn_elem(e, "refers to not existing zone '%s'", rule->dest.name); - fw3_free_rule(rule); - continue; - } - else if (rule->ipset.set && state->disable_ipsets) - { - warn_elem(e, "skipped due to disabled ipset support"); - fw3_free_rule(rule); - continue; - } - else if (rule->ipset.set && - !(rule->ipset.ptr = fw3_lookup_ipset(state, rule->ipset.name))) - { - warn_elem(e, "refers to unknown ipset '%s'", rule->ipset.name); - fw3_free_rule(rule); - continue; - } - - if (!rule->_src && rule->target == FW3_FLAG_NOTRACK) - { - warn_elem(e, "is set to target NOTRACK but has no source assigned"); - fw3_free_rule(rule); - continue; - } - - if (!rule->set_mark.set && !rule->set_xmark.set && - rule->target == FW3_FLAG_MARK) - { - warn_elem(e, "is set to target MARK but specifies neither " - "'set_mark' nor 'set_xmark' option"); - fw3_free_rule(rule); - continue; - } - - if (rule->_dest && rule->target == FW3_FLAG_MARK) - { - warn_elem(e, "must not specify 'dest' for MARK target"); - fw3_free_rule(rule); - continue; - } - - if (rule->set_mark.invert || rule->set_xmark.invert) - { - warn_elem(e, "must not have inverted 'set_mark' or 'set_xmark'"); - fw3_free_rule(rule); - continue; - } - - if (!rule->_src && !rule->_dest && !rule->src.any && !rule->dest.any) - { - warn_elem(e, "has neither a source nor a destination zone assigned " - "- assuming an output rule"); - } - - if (list_empty(&rule->proto)) - { - warn_elem(e, "does not specify a protocol, assuming TCP+UDP"); - fw3_parse_protocol(&rule->proto, "tcpudp", true); - } - - if (rule->target == FW3_FLAG_UNSPEC) - { - warn_elem(e, "has no target specified, defaulting to REJECT"); - rule->target = FW3_FLAG_REJECT; - } - else if (rule->target > FW3_FLAG_MARK) - { - warn_elem(e, "has invalid target specified, defaulting to REJECT"); - rule->target = FW3_FLAG_REJECT; - } - - /* NB: rule family... */ - if (rule->_dest) - { - setbit(rule->_dest->flags[0], rule->target); - setbit(rule->_dest->flags[1], rule->target); - } - else if (need_src_action_chain(rule)) - { - setbit(rule->_src->flags[0], fw3_to_src_target(rule->target)); - setbit(rule->_src->flags[1], fw3_to_src_target(rule->target)); - } } } @@ -264,15 +261,15 @@ append_chain(struct fw3_ipt_rule *r, struct fw3_rule *rule) { char chain[32]; - snprintf(chain, sizeof(chain), "delegate_output"); + snprintf(chain, sizeof(chain), "OUTPUT"); if (rule->target == FW3_FLAG_NOTRACK) { snprintf(chain, sizeof(chain), "zone_%s_notrack", rule->src.name); } - else if (rule->target == FW3_FLAG_MARK) + else if (rule->target == FW3_FLAG_MARK && (rule->_src || rule->src.any)) { - snprintf(chain, sizeof(chain), "fwmark"); + snprintf(chain, sizeof(chain), "PREROUTING"); } else { @@ -290,16 +287,16 @@ append_chain(struct fw3_ipt_rule *r, struct fw3_rule *rule) else { if (rule->dest.set) - snprintf(chain, sizeof(chain), "delegate_forward"); + snprintf(chain, sizeof(chain), "FORWARD"); else - snprintf(chain, sizeof(chain), "delegate_input"); + snprintf(chain, sizeof(chain), "INPUT"); } } if (rule->dest.set && !rule->src.set) { if (rule->dest.any) - snprintf(chain, sizeof(chain), "delegate_output"); + snprintf(chain, sizeof(chain), "OUTPUT"); else snprintf(chain, sizeof(chain), "zone_%s_output", rule->dest.name);