options.c

   1 /*
   2  * firewall3 - 3rd OpenWrt UCI firewall implementation
   3  *
   4  *   Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
   5  *
   6  * Permission to use, copy, modify, and/or distribute this software for any
   7  * purpose with or without fee is hereby granted, provided that the above
   8  * copyright notice and this permission notice appear in all copies.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17  */
  18
  19 #include "options.h"
  20 #include "ubus.h"
  21
  22
  23 static bool
  24 put_value(void *ptr, void *val, int elem_size, bool is_list)
  25 {
  26         void *copy;
  27
  28         if (is_list)
  29         {
  30                 copy = malloc(elem_size);
  31
  32                 if (!copy)
  33                         return false;
  34
  35                 memcpy(copy, val, elem_size);
  36                 list_add_tail((struct list_head *)copy, (struct list_head *)ptr);
  37                 return true;
  38         }
  39
  40         memcpy(ptr, val, elem_size);
  41         return false;
  42 }
  43
  44 static bool
  45 parse_enum(void *ptr, const char *val, const char **values, int min, int max)
  46 {
  47         int i, l = strlen(val);
  48
  49         if (l > 0)
  50         {
  51                 for (i = 0; i <= (max - min); i++)
  52                 {
  53                         if (!strncasecmp(val, values[i], l))
  54                         {
  55                                 *((int *)ptr) = min + i;
  56                                 return true;
  57                         }
  58                 }
  59         }
  60
  61         return false;
  62 }
  63
  64
  65 const char *fw3_flag_names[__FW3_FLAG_MAX] = {
  66         "filter",
  67         "nat",
  68         "mangle",
  69         "raw",
  70
  71         "IPv4",
  72         "IPv6",
  73
  74         "ACCEPT",
  75         "REJECT",
  76         "DROP",
  77         "NOTRACK",
  78         "MARK",
  79         "DNAT",
  80         "SNAT",
  81
  82         "ACCEPT",
  83         "REJECT",
  84         "DROP",
  85 };
  86
  87 static const char *limit_units[] = {
  88         "second",
  89         "minute",
  90         "hour",
  91         "day",
  92 };
  93
  94 static const char *ipset_methods[] = {
  95         "bitmap",
  96         "hash",
  97         "list",
  98 };
  99
 100 static const char *ipset_types[] = {
 101         "ip",
 102         "port",
 103         "mac",
 104         "net",
 105         "set",
 106 };
 107
 108 static const char *weekdays[] = {
 109         "monday",
 110         "tuesday",
 111         "wednesday",
 112         "thursday",
 113         "friday",
 114         "saturday",
 115         "sunday",
 116 };
 117
 118 static const char *include_types[] = {
 119         "script",
 120         "restore",
 121 };
 122
 123 static const char *reflection_sources[] = {
 124         "internal",
 125         "external",
 126 };
 127
 128
 129 bool
 130 fw3_parse_bool(void *ptr, const char *val, bool is_list)
 131 {
 132         if (!strcmp(val, "true") || !strcmp(val, "yes") || !strcmp(val, "1"))
 133                 *((bool *)ptr) = true;
 134         else
 135                 *((bool *)ptr) = false;
 136
 137         return true;
 138 }
 139
 140 bool
 141 fw3_parse_int(void *ptr, const char *val, bool is_list)
 142 {
 143         int n = strtol(val, NULL, 0);
 144
 145         if (errno == ERANGE || errno == EINVAL)
 146                 return false;
 147
 148         *((int *)ptr) = n;
 149
 150         return true;
 151 }
 152
 153 bool
 154 fw3_parse_string(void *ptr, const char *val, bool is_list)
 155 {
 156         *((char **)ptr) = (char *)val;
 157         return true;
 158 }
 159
 160 bool
 161 fw3_parse_target(void *ptr, const char *val, bool is_list)
 162 {
 163         return parse_enum(ptr, val, &fw3_flag_names[FW3_FLAG_ACCEPT],
 164                           FW3_FLAG_ACCEPT, FW3_FLAG_SNAT);
 165 }
 166
 167 bool
 168 fw3_parse_limit(void *ptr, const char *val, bool is_list)
 169 {
 170         struct fw3_limit *limit = ptr;
 171         enum fw3_limit_unit u = FW3_LIMIT_UNIT_SECOND;
 172         char *e;
 173         int n;
 174
 175         if (*val == '!')
 176         {
 177                 limit->invert = true;
 178                 while (isspace(*++val));
 179         }
 180
 181         n = strtol(val, &e, 10);
 182
 183         if (errno == ERANGE || errno == EINVAL)
 184                 return false;
 185
 186         if (*e && *e++ != '/')
 187                 return false;
 188
 189         if (!strlen(e))
 190                 return false;
 191
 192         if (!parse_enum(&u, e, limit_units, 0, FW3_LIMIT_UNIT_DAY))
 193                 return false;
 194
 195         limit->rate = n;
 196         limit->unit = u;
 197
 198         return true;
 199 }
 200
 201 bool
 202 fw3_parse_device(void *ptr, const char *val, bool is_list)
 203 {
 204         struct fw3_device dev = { };
 205
 206         if (*val == '*')
 207         {
 208                 dev.set = true;
 209                 dev.any = true;
 210                 put_value(ptr, &dev, sizeof(dev), is_list);
 211                 return true;
 212         }
 213
 214         if (*val == '!')
 215         {
 216                 dev.invert = true;
 217                 while (isspace(*++val));
 218         }
 219
 220         if (*val)
 221                 snprintf(dev.name, sizeof(dev.name), "%s", val);
 222         else
 223                 return false;
 224
 225         dev.set = true;
 226         put_value(ptr, &dev, sizeof(dev), is_list);
 227         return true;
 228 }
 229
 230 bool
 231 fw3_parse_address(void *ptr, const char *val, bool is_list)
 232 {
 233         struct fw3_address addr = { };
 234         struct in_addr v4;
 235         struct in6_addr v6;
 236         char *p, *s, *e;
 237         int i, m = -1;
 238
 239         if (*val == '!')
 240         {
 241                 addr.invert = true;
 242                 while (isspace(*++val));
 243         }
 244
 245         s = strdup(val);
 246
 247         if (!s)
 248                 return false;
 249
 250         if ((p = strchr(s, '/')) != NULL)
 251         {
 252                 *p++ = 0;
 253                 m = strtoul(p, &e, 10);
 254
 255                 if ((e == p) || (*e != 0))
 256                 {
 257                         if (strchr(s, ':') || !inet_pton(AF_INET, p, &v4))
 258                         {
 259                                 free(s);
 260                                 return false;
 261                         }
 262
 263                         for (i = 0, m = 32; !(v4.s_addr & 1) && (i < 32); i++)
 264                         {
 265                                 m--;
 266                                 v4.s_addr >>= 1;
 267                         }
 268                 }
 269         }
 270         else if ((p = strchr(s, '-')) != NULL)
 271         {
 272                 *p++ = 0;
 273
 274                 if (inet_pton(AF_INET6, p, &v6))
 275                 {
 276                         addr.family = FW3_FAMILY_V6;
 277                         addr.address2.v6 = v6;
 278                         addr.range = true;
 279                 }
 280                 else if (inet_pton(AF_INET, p, &v4))
 281                 {
 282                         addr.family = FW3_FAMILY_V4;
 283                         addr.address2.v4 = v4;
 284                         addr.range = true;
 285                 }
 286                 else
 287                 {
 288                         free(s);
 289                         return false;
 290                 }
 291         }
 292
 293         if (inet_pton(AF_INET6, s, &v6))
 294         {
 295                 addr.family = FW3_FAMILY_V6;
 296                 addr.address.v6 = v6;
 297                 addr.mask = (m >= 0) ? m : 128;
 298         }
 299         else if (inet_pton(AF_INET, s, &v4))
 300         {
 301                 addr.family = FW3_FAMILY_V4;
 302                 addr.address.v4 = v4;
 303                 addr.mask = (m >= 0) ? m : 32;
 304         }
 305         else
 306         {
 307                 free(s);
 308                 return false;
 309         }
 310
 311         free(s);
 312         addr.set = true;
 313         put_value(ptr, &addr, sizeof(addr), is_list);
 314         return true;
 315 }
 316
 317 bool
 318 fw3_parse_network(void *ptr, const char *val, bool is_list)
 319 {
 320         struct fw3_device dev = { };
 321         struct fw3_address *addr;
 322         struct list_head *addr_list;
 323
 324         if (!fw3_parse_address(ptr, val, is_list))
 325         {
 326                 if (!fw3_parse_device(&dev, val, false))
 327                         return false;
 328
 329                 addr_list = fw3_ubus_address(dev.name);
 330
 331                 if (addr_list)
 332                 {
 333                         list_for_each_entry(addr, addr_list, list)
 334                         {
 335                                 addr->invert = dev.invert;
 336
 337                                 if (!put_value(ptr, addr, sizeof(*addr), is_list))
 338                                         break;
 339                         }
 340
 341                         fw3_ubus_address_free(addr_list);
 342                 }
 343         }
 344
 345         return true;
 346 }
 347
 348 bool
 349 fw3_parse_mac(void *ptr, const char *val, bool is_list)
 350 {
 351         struct fw3_mac addr = { };
 352         struct ether_addr *mac;
 353
 354         if (*val == '!')
 355         {
 356                 addr.invert = true;
 357                 while (isspace(*++val));
 358         }
 359
 360         if ((mac = ether_aton(val)) != NULL)
 361         {
 362                 addr.mac = *mac;
 363                 addr.set = true;
 364
 365                 put_value(ptr, &addr, sizeof(addr), is_list);
 366                 return true;
 367         }
 368
 369         return false;
 370 }
 371
 372 bool
 373 fw3_parse_port(void *ptr, const char *val, bool is_list)
 374 {
 375         struct fw3_port range = { };
 376         uint16_t n;
 377         uint16_t m;
 378         char *p;
 379
 380         if (*val == '!')
 381         {
 382                 range.invert = true;
 383                 while (isspace(*++val));
 384         }
 385
 386         n = strtoul(val, &p, 10);
 387
 388         if (errno == ERANGE || errno == EINVAL)
 389                 return false;
 390
 391         if (*p && *p != '-' && *p != ':')
 392                 return false;
 393
 394         if (*p)
 395         {
 396                 m = strtoul(++p, NULL, 10);
 397
 398                 if (errno == ERANGE || errno == EINVAL || m < n)
 399                         return false;
 400
 401                 range.port_min = n;
 402                 range.port_max = m;
 403         }
 404         else
 405         {
 406                 range.port_min = n;
 407                 range.port_max = n;
 408         }
 409
 410         range.set = true;
 411         put_value(ptr, &range, sizeof(range), is_list);
 412         return true;
 413 }
 414
 415 bool
 416 fw3_parse_family(void *ptr, const char *val, bool is_list)
 417 {
 418         if (!strcmp(val, "any"))
 419                 *((enum fw3_family *)ptr) = FW3_FAMILY_ANY;
 420         else if (!strcmp(val, "inet") || strrchr(val, '4'))
 421                 *((enum fw3_family *)ptr) = FW3_FAMILY_V4;
 422         else if (!strcmp(val, "inet6") || strrchr(val, '6'))
 423                 *((enum fw3_family *)ptr) = FW3_FAMILY_V6;
 424         else
 425                 return false;
 426
 427         return true;
 428 }
 429
 430 bool
 431 fw3_parse_icmptype(void *ptr, const char *val, bool is_list)
 432 {
 433         struct fw3_icmptype icmp = { };
 434         bool v4 = false;
 435         bool v6 = false;
 436         char *p;
 437         int i;
 438
 439         for (i = 0; i < ARRAY_SIZE(fw3_icmptype_list_v4); i++)
 440         {
 441                 if (!strcmp(val, fw3_icmptype_list_v4[i].name))
 442                 {
 443                         icmp.type     = fw3_icmptype_list_v4[i].type;
 444                         icmp.code_min = fw3_icmptype_list_v4[i].code_min;
 445                         icmp.code_max = fw3_icmptype_list_v4[i].code_max;
 446
 447                         v4 = true;
 448                         break;
 449                 }
 450         }
 451
 452         for (i = 0; i < ARRAY_SIZE(fw3_icmptype_list_v6); i++)
 453         {
 454                 if (!strcmp(val, fw3_icmptype_list_v6[i].name))
 455                 {
 456                         icmp.type6     = fw3_icmptype_list_v6[i].type;
 457                         icmp.code6_min = fw3_icmptype_list_v6[i].code_min;
 458                         icmp.code6_max = fw3_icmptype_list_v6[i].code_max;
 459
 460                         v6 = true;
 461                         break;
 462                 }
 463         }
 464
 465         if (!v4 && !v6)
 466         {
 467                 i = strtoul(val, &p, 10);
 468
 469                 if ((p == val) || (*p != '/' && *p != 0) || (i > 0xFF))
 470                         return false;
 471
 472                 icmp.type = i;
 473
 474                 if (*p == '/')
 475                 {
 476                         val = ++p;
 477                         i = strtoul(val, &p, 10);
 478
 479                         if ((p == val) || (*p != 0) || (i > 0xFF))
 480                                 return false;
 481
 482                         icmp.code_min = i;
 483                         icmp.code_max = i;
 484                 }
 485                 else
 486                 {
 487                         icmp.code_min = 0;
 488                         icmp.code_max = 0xFF;
 489                 }
 490
 491                 icmp.type6     = icmp.type;
 492                 icmp.code6_min = icmp.code_max;
 493                 icmp.code6_max = icmp.code_max;
 494
 495                 v4 = true;
 496                 v6 = true;
 497         }
 498
 499         icmp.family = (v4 && v6) ? FW3_FAMILY_ANY
 500                                  : (v6 ? FW3_FAMILY_V6 : FW3_FAMILY_V4);
 501
 502         put_value(ptr, &icmp, sizeof(icmp), is_list);
 503         return true;
 504 }
 505
 506 bool
 507 fw3_parse_protocol(void *ptr, const char *val, bool is_list)
 508 {
 509         struct fw3_protocol proto = { };
 510         struct protoent *ent;
 511
 512         if (*val == '!')
 513         {
 514                 proto.invert = true;
 515                 while (isspace(*++val));
 516         }
 517
 518         if (!strcmp(val, "all"))
 519         {
 520                 proto.any = true;
 521                 put_value(ptr, &proto, sizeof(proto), is_list);
 522                 return true;
 523         }
 524         else if (!strcmp(val, "icmpv6"))
 525         {
 526                 val = "ipv6-icmp";
 527         }
 528         else if (!strcmp(val, "tcpudp"))
 529         {
 530                 proto.protocol = 6;
 531                 if (put_value(ptr, &proto, sizeof(proto), is_list))
 532                 {
 533                         proto.protocol = 17;
 534                         put_value(ptr, &proto, sizeof(proto), is_list);
 535                 }
 536
 537                 return true;
 538         }
 539
 540         ent = getprotobyname(val);
 541
 542         if (ent)
 543         {
 544                 proto.protocol = ent->p_proto;
 545                 put_value(ptr, &proto, sizeof(proto), is_list);
 546                 return true;
 547         }
 548
 549         proto.protocol = strtoul(val, NULL, 10);
 550
 551         if (errno == ERANGE || errno == EINVAL)
 552                 return false;
 553
 554         put_value(ptr, &proto, sizeof(proto), is_list);
 555         return true;
 556 }
 557
 558 bool
 559 fw3_parse_ipset_method(void *ptr, const char *val, bool is_list)
 560 {
 561         return parse_enum(ptr, val, ipset_methods,
 562                           FW3_IPSET_METHOD_BITMAP, FW3_IPSET_METHOD_LIST);
 563 }
 564
 565 bool
 566 fw3_parse_ipset_datatype(void *ptr, const char *val, bool is_list)
 567 {
 568         struct fw3_ipset_datatype type = { };
 569
 570         if (!strncmp(val, "dest_", 5))
 571         {
 572                 val += 5;
 573                 type.dest = true;
 574         }
 575         else if (!strncmp(val, "dst_", 4))
 576         {
 577                 val += 4;
 578                 type.dest = true;
 579         }
 580         else if (!strncmp(val, "src_", 4))
 581         {
 582                 val += 4;
 583                 type.dest = false;
 584         }
 585
 586         if (parse_enum(&type.type, val, ipset_types,
 587                        FW3_IPSET_TYPE_IP, FW3_IPSET_TYPE_SET))
 588         {
 589                 put_value(ptr, &type, sizeof(type), is_list);
 590                 return true;
 591         }
 592
 593         return false;
 594 }
 595
 596 bool
 597 fw3_parse_date(void *ptr, const char *val, bool is_list)
 598 {
 599         unsigned int year = 1970, mon = 1, day = 1, hour = 0, min = 0, sec = 0;
 600         struct tm tm = { 0 };
 601         char *p;
 602
 603         year = strtoul(val, &p, 10);
 604         if ((*p != '-' && *p) || year < 1970 || year > 2038)
 605                 goto fail;
 606         else if (!*p)
 607                 goto ret;
 608
 609         mon = strtoul(++p, &p, 10);
 610         if ((*p != '-' && *p) || mon > 12)
 611                 goto fail;
 612         else if (!*p)
 613                 goto ret;
 614
 615         day = strtoul(++p, &p, 10);
 616         if ((*p != 'T' && *p) || day > 31)
 617                 goto fail;
 618         else if (!*p)
 619                 goto ret;
 620
 621         hour = strtoul(++p, &p, 10);
 622         if ((*p != ':' && *p) || hour > 23)
 623                 goto fail;
 624         else if (!*p)
 625                 goto ret;
 626
 627         min = strtoul(++p, &p, 10);
 628         if ((*p != ':' && *p) || min > 59)
 629                 goto fail;
 630         else if (!*p)
 631                 goto ret;
 632
 633         sec = strtoul(++p, &p, 10);
 634         if (*p || sec > 59)
 635                 goto fail;
 636
 637 ret:
 638         tm.tm_year = year - 1900;
 639         tm.tm_mon  = mon - 1;
 640         tm.tm_mday = day;
 641         tm.tm_hour = hour;
 642         tm.tm_min  = min;
 643         tm.tm_sec  = sec;
 644
 645         if (mktime(&tm) >= 0)
 646         {
 647                 *((struct tm *)ptr) = tm;
 648                 return true;
 649         }
 650
 651 fail:
 652         return false;
 653 }
 654
 655 bool
 656 fw3_parse_time(void *ptr, const char *val, bool is_list)
 657 {
 658         unsigned int hour = 0, min = 0, sec = 0;
 659         char *p;
 660
 661         hour = strtoul(val, &p, 10);
 662         if (*p != ':' || hour > 23)
 663                 goto fail;
 664
 665         min = strtoul(++p, &p, 10);
 666         if ((*p != ':' && *p) || min > 59)
 667                 goto fail;
 668         else if (!*p)
 669                 goto ret;
 670
 671         sec = strtoul(++p, &p, 10);
 672         if (*p || sec > 59)
 673                 goto fail;
 674
 675 ret:
 676         *((int *)ptr) = 60 * 60 * hour + 60 * min + sec;
 677         return true;
 678
 679 fail:
 680         return false;
 681 }
 682
 683 bool
 684 fw3_parse_weekdays(void *ptr, const char *val, bool is_list)
 685 {
 686         unsigned int w = 0;
 687         char *p, *s;
 688
 689         if (*val == '!')
 690         {
 691                 setbit(*(uint8_t *)ptr, 0);
 692                 while (isspace(*++val));
 693         }
 694
 695         if (!(s = strdup(val)))
 696                 return false;
 697
 698         for (p = strtok(s, " \t"); p; p = strtok(NULL, " \t"))
 699         {
 700                 if (!parse_enum(&w, p, weekdays, 1, 7))
 701                 {
 702                         w = strtoul(p, &p, 10);
 703
 704                         if (*p || w < 1 || w > 7)
 705                         {
 706                                 free(s);
 707                                 return false;
 708                         }
 709                 }
 710
 711                 setbit(*(uint8_t *)ptr, w);
 712         }
 713
 714         free(s);
 715         return true;
 716 }
 717
 718 bool
 719 fw3_parse_monthdays(void *ptr, const char *val, bool is_list)
 720 {
 721         unsigned int d;
 722         char *p, *s;
 723
 724         if (*val == '!')
 725         {
 726                 setbit(*(uint32_t *)ptr, 0);
 727                 while (isspace(*++val));
 728         }
 729
 730         if (!(s = strdup(val)))
 731                 return false;
 732
 733         for (p = strtok(s, " \t"); p; p = strtok(NULL, " \t"))
 734         {
 735                 d = strtoul(p, &p, 10);
 736
 737                 if (*p || d < 1 || d > 31)
 738                 {
 739                         free(s);
 740                         return false;
 741                 }
 742
 743                 setbit(*(uint32_t *)ptr, d);
 744         }
 745
 746         free(s);
 747         return true;
 748 }
 749
 750 bool
 751 fw3_parse_include_type(void *ptr, const char *val, bool is_list)
 752 {
 753         return parse_enum(ptr, val, include_types,
 754                           FW3_INC_TYPE_SCRIPT, FW3_INC_TYPE_RESTORE);
 755 }
 756
 757 bool
 758 fw3_parse_reflection_source(void *ptr, const char *val, bool is_list)
 759 {
 760         return parse_enum(ptr, val, reflection_sources,
 761                           FW3_REFLECTION_INTERNAL, FW3_REFLECTION_EXTERNAL);
 762 }
 763
 764 bool
 765 fw3_parse_mark(void *ptr, const char *val, bool is_list)
 766 {
 767         uint32_t n;
 768         char *s, *e;
 769         struct fw3_mark *m = ptr;
 770
 771         if (*val == '!')
 772         {
 773                 m->invert = true;
 774                 while (isspace(*++val));
 775         }
 776
 777         if ((s = strchr(val, '/')) != NULL)
 778                 *s++ = 0;
 779
 780         n = strtoul(val, &e, 0);
 781
 782         if (e == val || *e)
 783                 return false;
 784
 785         m->mark = n;
 786         m->mask = 0xFFFFFFFF;
 787
 788         if (s)
 789         {
 790                 n = strtoul(s, &e, 0);
 791
 792                 if (e == s || *e)
 793                         return false;
 794
 795                 m->mask = n;
 796         }
 797
 798         m->set = true;
 799         return true;
 800 }
 801
 802
 803 void
 804 fw3_parse_options(void *s, const struct fw3_option *opts,
 805                   struct uci_section *section)
 806 {
 807         char *p, *v;
 808         bool known;
 809         struct uci_element *e, *l;
 810         struct uci_option *o;
 811         const struct fw3_option *opt;
 812         struct list_head *dest;
 813
 814         uci_foreach_element(&section->options, e)
 815         {
 816                 o = uci_to_option(e);
 817                 known = false;
 818
 819                 for (opt = opts; opt->name; opt++)
 820                 {
 821                         if (!opt->parse)
 822                                 continue;
 823
 824                         if (strcmp(opt->name, e->name))
 825                                 continue;
 826
 827                         if (o->type == UCI_TYPE_LIST)
 828                         {
 829                                 if (!opt->elem_size)
 830                                 {
 831                                         warn_elem(e, "must not be a list");
 832                                 }
 833                                 else
 834                                 {
 835                                         dest = (struct list_head *)((char *)s + opt->offset);
 836
 837                                         uci_foreach_element(&o->v.list, l)
 838                                         {
 839                                                 if (!l->name)
 840                                                         continue;
 841
 842                                                 if (!opt->parse(dest, l->name, true))
 843                                                 {
 844                                                         warn_elem(e, "has invalid value '%s'", l->name);
 845                                                         continue;
 846                                                 }
 847                                         }
 848                                 }
 849                         }
 850                         else
 851                         {
 852                                 v = o->v.string;
 853
 854                                 if (!v)
 855                                         continue;
 856
 857                                 if (!opt->elem_size)
 858                                 {
 859                                         if (!opt->parse((char *)s + opt->offset, o->v.string, false))
 860                                                 warn_elem(e, "has invalid value '%s'", o->v.string);
 861                                 }
 862                                 else
 863                                 {
 864                                         dest = (struct list_head *)((char *)s + opt->offset);
 865
 866                                         for (p = strtok(v, " \t"); p != NULL; p = strtok(NULL, " \t"))
 867                                         {
 868                                                 if (!opt->parse(dest, p, true))
 869                                                 {
 870                                                         warn_elem(e, "has invalid value '%s'", p);
 871                                                         continue;
 872                                                 }
 873                                         }
 874                                 }
 875                         }
 876
 877                         known = true;
 878                         break;
 879                 }
 880
 881                 if (!known)
 882                         warn_elem(e, "is unknown");
 883         }
 884 }
 885
 886
 887 void
 888 fw3_format_in_out(struct fw3_device *in, struct fw3_device *out)
 889 {
 890         if (in && !in->any)
 891                 fw3_pr(" %s-i %s", in->invert ? "! " : "", in->name);
 892
 893         if (out && !out->any)
 894                 fw3_pr(" %s-o %s", out->invert ? "! " : "", out->name);
 895 }
 896
 897 const char *
 898 fw3_address_to_string(struct fw3_address *address, bool allow_invert)
 899 {
 900         char *p, ip[INET6_ADDRSTRLEN];
 901         static char buf[INET6_ADDRSTRLEN * 2 + 2];
 902
 903         p = buf;
 904
 905         if (address->invert && allow_invert)
 906                 p += sprintf(p, "!");
 907
 908         inet_ntop(address->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
 909                   &address->address.v4, ip, sizeof(ip));
 910
 911         p += sprintf(p, "%s", ip);
 912
 913         if (address->range)
 914         {
 915                 inet_ntop(address->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
 916                           &address->address2.v4, ip, sizeof(ip));
 917
 918                 p += sprintf(p, "-%s", ip);
 919         }
 920         else
 921         {
 922                 p += sprintf(p, "/%u", address->mask);
 923         }
 924
 925         return buf;
 926 }
 927
 928 void
 929 fw3_format_src_dest(struct fw3_address *src, struct fw3_address *dest)
 930 {
 931         if ((src && src->range) || (dest && dest->range))
 932                 fw3_pr(" -m iprange");
 933
 934         if (src && src->set)
 935         {
 936                 fw3_pr(" %s%s %s", src->invert ? "! " : "",
 937                                    src->range ? "--src-range" : "-s",
 938                                    fw3_address_to_string(src, false));
 939         }
 940
 941         if (dest && dest->set)
 942         {
 943                 fw3_pr(" %s%s %s", dest->invert ? "! " : "",
 944                                    dest->range ? "--dst-range" : "-d",
 945                                    fw3_address_to_string(dest, false));
 946         }
 947 }
 948
 949 void
 950 fw3_format_sport_dport(struct fw3_port *sp, struct fw3_port *dp)
 951 {
 952         if (sp && sp->set)
 953         {
 954                 if (sp->port_min == sp->port_max)
 955                         fw3_pr(" %s--sport %u", sp->invert ? "! " : "", sp->port_min);
 956                 else
 957                         fw3_pr(" %s--sport %u:%u",
 958                                sp->invert ? "! " : "", sp->port_min, sp->port_max);
 959         }
 960
 961         if (dp && dp->set)
 962         {
 963                 if (dp->port_min == dp->port_max)
 964                         fw3_pr(" %s--dport %u", dp->invert ? "! " : "", dp->port_min);
 965                 else
 966                         fw3_pr(" %s--dport %u:%u",
 967                                dp->invert ? "! " : "", dp->port_min, dp->port_max);
 968         }
 969 }
 970
 971 void
 972 fw3_format_mac(struct fw3_mac *mac)
 973 {
 974         if (!mac)
 975                 return;
 976
 977         fw3_pr(" -m mac %s--mac-source %s",
 978                mac->invert ? "! " : "", ether_ntoa(&mac->mac));
 979 }
 980
 981 void
 982 fw3_format_protocol(struct fw3_protocol *proto, enum fw3_family family)
 983 {
 984         uint16_t pr;
 985
 986         if (!proto)
 987                 return;
 988
 989         pr = proto->protocol;
 990
 991         if (pr == 1 && family == FW3_FAMILY_V6)
 992                 pr = 58;
 993
 994         if (proto->any)
 995                 fw3_pr(" -p all");
 996         else
 997                 fw3_pr(" %s-p %u", proto->invert ? "! " : "", pr);
 998 }
 999
1000 void
1001 fw3_format_icmptype(struct fw3_icmptype *icmp, enum fw3_family family)
1002 {
1003         if (!icmp)
1004                 return;
1005
1006         if (family != FW3_FAMILY_V6)
1007         {
1008                 if (icmp->code_min == 0 && icmp->code_max == 0xFF)
1009                         fw3_pr(" %s--icmp-type %u", icmp->invert ? "! " : "", icmp->type);
1010                 else
1011                         fw3_pr(" %s--icmp-type %u/%u",
1012                                    icmp->invert ? "! " : "", icmp->type, icmp->code_min);
1013         }
1014         else
1015         {
1016                 if (icmp->code6_min == 0 && icmp->code6_max == 0xFF)
1017                         fw3_pr(" %s--icmpv6-type %u", icmp->invert ? "! " : "", icmp->type6);
1018                 else
1019                         fw3_pr(" %s--icmpv6-type %u/%u",
1020                                    icmp->invert ? "! " : "", icmp->type6, icmp->code6_min);
1021         }
1022 }
1023
1024 void
1025 fw3_format_limit(struct fw3_limit *limit)
1026 {
1027         if (!limit)
1028                 return;
1029
1030         if (limit->rate > 0)
1031         {
1032                 fw3_pr(" -m limit %s--limit %u/%s",
1033                        limit->invert ? "! " : "",
1034                        limit->rate, limit_units[limit->unit]);
1035
1036                 if (limit->burst > 0)
1037                         fw3_pr(" --limit-burst %u", limit->burst);
1038         }
1039 }
1040
1041 void
1042 fw3_format_ipset(struct fw3_ipset *ipset, bool invert)
1043 {
1044         bool first = true;
1045         const char *name = NULL;
1046         struct fw3_ipset_datatype *type;
1047
1048         if (!ipset)
1049                 return;
1050
1051         if (ipset->external && *ipset->external)
1052                 name = ipset->external;
1053         else
1054                 name = ipset->name;
1055
1056         fw3_pr(" -m set %s--match-set %s", invert ? "! " : "", name);
1057
1058         list_for_each_entry(type, &ipset->datatypes, list)
1059         {
1060                 fw3_pr("%c%s", first ? ' ' : ',', type->dest ? "dst" : "src");
1061                 first = false;
1062         }
1063 }
1064
1065 void
1066 fw3_format_time(struct fw3_time *time)
1067 {
1068         int i;
1069         struct tm empty = { 0 };
1070         char buf[sizeof("9999-99-99T23:59:59\0")];
1071         bool d1 = memcmp(&time->datestart, &empty, sizeof(empty));
1072         bool d2 = memcmp(&time->datestop, &empty, sizeof(empty));
1073         bool first;
1074
1075         if (!d1 && !d2 && !time->timestart && !time->timestop &&
1076             !(time->monthdays & 0xFFFFFFFE) && !(time->weekdays & 0xFE))
1077         {
1078                 return;
1079         }
1080
1081         fw3_pr(" -m time");
1082
1083         if (time->utc)
1084                 fw3_pr(" --utc");
1085
1086         if (d1)
1087         {
1088                 strftime(buf, sizeof(buf), "%Y-%m-%dT%H:%M:%S", &time->datestart);
1089                 fw3_pr(" --datestart %s", buf);
1090         }
1091
1092         if (d2)
1093         {
1094                 strftime(buf, sizeof(buf), "%Y-%m-%dT%H:%M:%S", &time->datestop);
1095                 fw3_pr(" --datestop %s", buf);
1096         }
1097
1098         if (time->timestart)
1099         {
1100                 fw3_pr(" --timestart %02d:%02d:%02d",
1101                        time->timestart / 3600,
1102                        time->timestart % 3600 / 60,
1103                        time->timestart % 60);
1104         }
1105
1106         if (time->timestop)
1107         {
1108                 fw3_pr(" --timestop %02d:%02d:%02d",
1109                        time->timestop / 3600,
1110                        time->timestop % 3600 / 60,
1111                        time->timestop % 60);
1112         }
1113
1114         if (time->monthdays & 0xFFFFFFFE)
1115         {
1116                 fw3_pr(" %s--monthdays", hasbit(time->monthdays, 0) ? "! " : "");
1117
1118                 for (i = 1, first = true; i < 32; i++)
1119                 {
1120                         if (hasbit(time->monthdays, i))
1121                         {
1122                                 fw3_pr("%c%u", first ? ' ' : ',', i);
1123                                 first = false;
1124                         }
1125                 }
1126         }
1127
1128         if (time->weekdays & 0xFE)
1129         {
1130                 fw3_pr(" %s--weekdays", hasbit(time->weekdays, 0) ? "! " : "");
1131
1132                 for (i = 1, first = true; i < 8; i++)
1133                 {
1134                         if (hasbit(time->weekdays, i))
1135                         {
1136                                 fw3_pr("%c%u", first ? ' ' : ',', i);
1137                                 first = false;
1138                         }
1139                 }
1140         }
1141 }
1142
1143 void
1144 fw3_format_mark(struct fw3_mark *mark)
1145 {
1146         if (!mark->set)
1147                 return;
1148
1149         fw3_pr(" -m mark %s--mark 0x%x", mark->invert ? "! " : "", mark->mark);
1150
1151         if (mark->mask < 0xFFFFFFFF)
1152                 fw3_pr("/0x%x", mark->mask);
1153 }
1154
1155 void
1156 __fw3_format_comment(const char *comment, ...)
1157 {
1158         va_list ap;
1159         int len = 0;
1160         const char *c;
1161
1162         if (!comment || !*comment)
1163                 return;
1164
1165         fw3_pr(" -m comment --comment \"");
1166
1167         c = comment;
1168
1169         va_start(ap, comment);
1170
1171         do
1172         {
1173                 while (*c)
1174                 {
1175                         switch (*c)
1176                         {
1177                         case '"':
1178                         case '$':
1179                         case '`':
1180                         case '\\':
1181                                 fw3_pr("\\");
1182                                 /* fall through */
1183
1184                         default:
1185                                 fw3_pr("%c", *c);
1186                                 break;
1187                         }
1188
1189                         c++;
1190
1191                         if (len++ >= 255)
1192                                 goto end;
1193                 }
1194
1195                 c = va_arg(ap, const char *);
1196         }
1197         while (c);
1198
1199 end:
1200         va_end(ap);
1201         fw3_pr("\"");
1202 }
1203
1204 void
1205 fw3_format_extra(const char *extra)
1206 {
1207         if (!extra || !*extra)
1208                 return;
1209
1210         fw3_pr(" %s", extra);
1211 }