X-Git-Url: http://git.openwrt.org/?p=project%2Ffirewall3.git;a=blobdiff_plain;f=main.c;h=c4b82282b6c416112c51f3fe1f2efb9e37e73dcc;hp=27d5298191f9e7c894fbfdb6342720a85be2f0b6;hb=HEAD;hpb=e678dcbf0336c3ca10f9fe2fae8b19347b6c1d4d

diff --git a/main.c b/main.c
index 27d5298..7deb636 100644
--- a/main.c
+++ b/main.c
@@ -1,7 +1,7 @@
 /*
  * firewall3 - 3rd OpenWrt UCI firewall implementation
  *
- *   Copyright (C) 2013-2014 Jo-Philipp Wich <jow@openwrt.org>
+ *   Copyright (C) 2013-2014 Jo-Philipp Wich <jo@mein.io>
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -30,6 +30,7 @@
 #include "includes.h"
 #include "ubus.h"
 #include "iptables.h"
+#include "helpers.h"
 
 
 static enum fw3_family print_family = FW3_FAMILY_ANY;
@@ -45,12 +46,10 @@ build_state(bool runtime)
 	struct uci_package *p = NULL;
 	FILE *sf;
 
-	state = malloc(sizeof(*state));
-
+	state = calloc(1, sizeof(*state));
 	if (!state)
 		error("Out of memory");
 
-	memset(state, 0, sizeof(*state));
 	state->uci = uci_alloc_context();
 
 	if (!state->uci)
@@ -81,7 +80,7 @@ build_state(bool runtime)
 	else
 	{
 		if (!fw3_ubus_connect())
-			error("Failed to connect to ubus");
+			warn("Failed to connect to ubus");
 
 		if (uci_load(state->uci, "firewall", &p))
 		{
@@ -103,13 +102,14 @@ build_state(bool runtime)
 	fw3_ubus_rules(&b);
 
 	fw3_load_defaults(state, p);
-	fw3_load_ipsets(state, p);
+	fw3_load_cthelpers(state, p);
+	fw3_load_ipsets(state, p, b.head);
 	fw3_load_zones(state, p);
 	fw3_load_rules(state, p, b.head);
-	fw3_load_redirects(state, p);
+	fw3_load_redirects(state, p, b.head);
 	fw3_load_snats(state, p, b.head);
-	fw3_load_forwards(state, p);
-	fw3_load_includes(state, p);
+	fw3_load_forwards(state, p, b.head);
+	fw3_load_includes(state, p, b.head);
 
 	return true;
 }
@@ -140,6 +140,9 @@ free_state(struct fw3_state *state)
 	list_for_each_safe(cur, tmp, &state->includes)
 		fw3_free_include((struct fw3_include *)cur);
 
+	list_for_each_safe(cur, tmp, &state->cthelpers)
+		fw3_free_cthelper((struct fw3_cthelper *)cur);
+
 	uci_free_context(state->uci);
 
 	free(state);
@@ -169,8 +172,6 @@ family_set(struct fw3_state *state, enum fw3_family family, bool set)
 static int
 stop(bool complete)
 {
-	FILE *ct;
-
 	int rv = 1;
 	enum fw3_family family;
 	enum fw3_table table;
@@ -194,9 +195,6 @@ stop(bool complete)
 
 		for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++)
 		{
-			if (!fw3_has_table(family == FW3_FAMILY_V6, fw3_flag_names[table]))
-				continue;
-
 			if (!(handle = fw3_ipt_open(family, table)))
 				continue;
 
@@ -223,17 +221,14 @@ stop(bool complete)
 		rv = 0;
 	}
 
-	if (run_state)
-		fw3_destroy_ipsets(run_state);
-
-	if (complete && (ct = fopen("/proc/net/nf_conntrack", "w")) != NULL)
-	{
-		info(" * Flushing conntrack table ...");
-
-		fwrite("f\n", 2, 1, ct);
-		fclose(ct);
+	if (run_state) {
+		for (family = FW3_FAMILY_V4; family <= FW3_FAMILY_V6; family++)
+			fw3_destroy_ipsets(run_state, family, false);
 	}
 
+	if (complete)
+		fw3_flush_conntrack(NULL);
+
 	if (!rv && run_state)
 		fw3_write_statefile(run_state);
 
@@ -248,11 +243,11 @@ start(void)
 	enum fw3_table table;
 	struct fw3_ipt_handle *handle;
 
-	if (!print_family)
-		fw3_create_ipsets(cfg_state);
-
 	for (family = FW3_FAMILY_V4; family <= FW3_FAMILY_V6; family++)
 	{
+		if (!print_family)
+			fw3_create_ipsets(cfg_state, family, false);
+
 		if (family == FW3_FAMILY_V6 && cfg_state->defaults.disable_ipv6)
 			continue;
 
@@ -270,9 +265,6 @@ start(void)
 
 		for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++)
 		{
-			if (!fw3_has_table(family == FW3_FAMILY_V6, fw3_flag_names[table]))
-				continue;
-
 			if (!(handle = fw3_ipt_open(family, table)))
 				continue;
 
@@ -306,6 +298,7 @@ start(void)
 
 	if (!rv)
 	{
+		fw3_flush_conntrack(run_state);
 		fw3_set_defaults(cfg_state);
 
 		if (!print_family)
@@ -340,9 +333,6 @@ reload(void)
 
 		for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++)
 		{
-			if (!fw3_has_table(family == FW3_FAMILY_V6, fw3_flag_names[table]))
-				continue;
-
 			if (!(handle = fw3_ipt_open(family, table)))
 				continue;
 
@@ -355,6 +345,9 @@ reload(void)
 			fw3_ipt_close(handle);
 		}
 
+		fw3_ipsets_update_run_state(family, run_state, cfg_state);
+		fw3_destroy_ipsets(run_state, family, true);
+
 		family_set(run_state, family, false);
 		family_set(cfg_state, family, false);
 
@@ -362,11 +355,10 @@ start:
 		if (family == FW3_FAMILY_V6 && cfg_state->defaults.disable_ipv6)
 			continue;
 
+		fw3_create_ipsets(cfg_state, family, true);
+
 		for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++)
 		{
-			if (!fw3_has_table(family == FW3_FAMILY_V6, fw3_flag_names[table]))
-				continue;
-
 			if (!(handle = fw3_ipt_open(family, table)))
 				continue;
 
@@ -397,6 +389,8 @@ start:
 
 	if (!rv)
 	{
+		fw3_flush_conntrack(run_state);
+
 		fw3_set_defaults(cfg_state);
 		fw3_run_includes(cfg_state, true);
 		fw3_hotplug_zones(cfg_state, true);
@@ -406,6 +400,32 @@ start:
 	return rv;
 }
 
+static int
+gc(void)
+{
+	enum fw3_family family;
+	enum fw3_table table;
+	struct fw3_ipt_handle *handle;
+
+	for (family = FW3_FAMILY_V4; family <= FW3_FAMILY_V6; family++)
+	{
+		if (family == FW3_FAMILY_V6 && cfg_state->defaults.disable_ipv6)
+			continue;
+
+		for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++)
+		{
+			if (!(handle = fw3_ipt_open(family, table)))
+				continue;
+
+			fw3_ipt_gc(handle);
+			fw3_ipt_commit(handle);
+			fw3_ipt_close(handle);
+		}
+	}
+
+	return 0;
+}
+
 static int
 lookup_network(const char *net)
 {
@@ -448,6 +468,35 @@ lookup_device(const char *dev)
 	return 1;
 }
 
+static int
+lookup_zone(const char *zone, const char *device)
+{
+	struct fw3_zone *z;
+	struct fw3_device *d;
+
+	list_for_each_entry(z, &cfg_state->zones, list)
+	{
+		if (strcmp(z->name, zone))
+			continue;
+
+		list_for_each_entry(d, &z->devices, list)
+		{
+			if (device && strcmp(device, d->name))
+				continue;
+
+			printf("%s\n", d->name);
+
+			if (device)
+				return 0;
+		}
+
+		if (!device)
+			return 0;
+	}
+
+	return 1;
+}
+
 static int
 usage(void)
 {
@@ -455,6 +504,7 @@ usage(void)
 	fprintf(stderr, "fw3 [-q] {start|stop|flush|reload|restart}\n");
 	fprintf(stderr, "fw3 [-q] network {net}\n");
 	fprintf(stderr, "fw3 [-q] device {dev}\n");
+	fprintf(stderr, "fw3 [-q] zone {zone} [dev]\n");
 
 	return 1;
 }
@@ -493,7 +543,6 @@ int main(int argc, char **argv)
 	}
 
 	build_state(false);
-	build_state(true);
 	defs = &cfg_state->defaults;
 
 	if (optind >= argc)
@@ -524,12 +573,18 @@ int main(int argc, char **argv)
 		print_family = family;
 		fw3_pr_debug = true;
 
-		rv = start();
+		if (fw3_lock())
+		{
+			build_state(true);
+			rv = start();
+			fw3_unlock();
+		}
 	}
 	else if (!strcmp(argv[optind], "start"))
 	{
 		if (fw3_lock())
 		{
+			build_state(true);
 			rv = start();
 			fw3_unlock();
 		}
@@ -538,6 +593,7 @@ int main(int argc, char **argv)
 	{
 		if (fw3_lock())
 		{
+			build_state(true);
 			rv = stop(false);
 			fw3_unlock();
 		}
@@ -546,6 +602,7 @@ int main(int argc, char **argv)
 	{
 		if (fw3_lock())
 		{
+			build_state(true);
 			rv = stop(true);
 			fw3_unlock();
 		}
@@ -554,6 +611,7 @@ int main(int argc, char **argv)
 	{
 		if (fw3_lock())
 		{
+			build_state(true);
 			stop(true);
 			rv = start();
 			fw3_unlock();
@@ -563,10 +621,19 @@ int main(int argc, char **argv)
 	{
 		if (fw3_lock())
 		{
+			build_state(true);
 			rv = reload();
 			fw3_unlock();
 		}
 	}
+	else if (!strcmp(argv[optind], "gc"))
+	{
+		if (fw3_lock())
+		{
+			rv = gc();
+			fw3_unlock();
+		}
+	}
 	else if (!strcmp(argv[optind], "network") && (optind + 1) < argc)
 	{
 		rv = lookup_network(argv[optind + 1]);
@@ -575,6 +642,10 @@ int main(int argc, char **argv)
 	{
 		rv = lookup_device(argv[optind + 1]);
 	}
+	else if (!strcmp(argv[optind], "zone") && (optind + 1) < argc)
+	{
+		rv = lookup_zone(argv[optind + 1], argv[optind + 2]);
+	}
 	else
 	{
 		rv = usage();