options.c

   1 /*
   2  * firewall3 - 3rd OpenWrt UCI firewall implementation
   3  *
   4  *   Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
   5  *
   6  * Permission to use, copy, modify, and/or distribute this software for any
   7  * purpose with or without fee is hereby granted, provided that the above
   8  * copyright notice and this permission notice appear in all copies.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17  */
  18
  19 #include "options.h"
  20
  21 const char *fw3_flag_names[FW3_DEFAULT_DROP_INVALID + 1] = {
  22         "filter",
  23         "nat",
  24         "mangle",
  25         "raw",
  26
  27         "IPv4",
  28         "IPv6",
  29
  30         "ACCEPT",
  31         "REJECT",
  32         "DROP",
  33         "NOTRACK",
  34         "DNAT",
  35         "SNAT",
  36 };
  37
  38 bool
  39 fw3_parse_bool(void *ptr, const char *val)
  40 {
  41         if (!strcmp(val, "true") || !strcmp(val, "yes") || !strcmp(val, "1"))
  42                 *((bool *)ptr) = true;
  43         else
  44                 *((bool *)ptr) = false;
  45
  46         return true;
  47 }
  48
  49 bool
  50 fw3_parse_int(void *ptr, const char *val)
  51 {
  52         int n = strtol(val, NULL, 10);
  53
  54         if (errno == ERANGE || errno == EINVAL)
  55                 return false;
  56
  57         *((int *)ptr) = n;
  58
  59         return true;
  60 }
  61
  62 bool
  63 fw3_parse_string(void *ptr, const char *val)
  64 {
  65         *((char **)ptr) = (char *)val;
  66         return true;
  67 }
  68
  69 bool
  70 fw3_parse_target(void *ptr, const char *val)
  71 {
  72         if (!strcmp(val, "ACCEPT"))
  73         {
  74                 *((enum fw3_target *)ptr) = FW3_TARGET_ACCEPT;
  75                 return true;
  76         }
  77         else if (!strcmp(val, "REJECT"))
  78         {
  79                 *((enum fw3_target *)ptr) = FW3_TARGET_REJECT;
  80                 return true;
  81         }
  82         else if (!strcmp(val, "DROP"))
  83         {
  84                 *((enum fw3_target *)ptr) = FW3_TARGET_DROP;
  85                 return true;
  86         }
  87         else if (!strcmp(val, "NOTRACK"))
  88         {
  89                 *((enum fw3_target *)ptr) = FW3_TARGET_NOTRACK;
  90                 return true;
  91         }
  92         else if (!strcmp(val, "DNAT"))
  93         {
  94                 *((enum fw3_target *)ptr) = FW3_TARGET_DNAT;
  95                 return true;
  96         }
  97         else if (!strcmp(val, "SNAT"))
  98         {
  99                 *((enum fw3_target *)ptr) = FW3_TARGET_SNAT;
 100                 return true;
 101         }
 102
 103         return false;
 104 }
 105
 106 bool
 107 fw3_parse_limit(void *ptr, const char *val)
 108 {
 109         struct fw3_limit *limit = ptr;
 110         enum fw3_limit_unit u = FW3_LIMIT_UNIT_SECOND;
 111         char *e;
 112         int n;
 113
 114         if (*val == '!')
 115         {
 116                 limit->invert = true;
 117                 while (isspace(*++val));
 118         }
 119
 120         n = strtol(val, &e, 10);
 121
 122         if (errno == ERANGE || errno == EINVAL)
 123                 return false;
 124
 125         if (*e && *e++ != '/')
 126                 return false;
 127
 128         if (!strlen(e))
 129                 return false;
 130
 131         if (!strncmp(e, "second", strlen(e)))
 132                 u = FW3_LIMIT_UNIT_SECOND;
 133         else if (!strncmp(e, "minute", strlen(e)))
 134                 u = FW3_LIMIT_UNIT_MINUTE;
 135         else if (!strncmp(e, "hour", strlen(e)))
 136                 u = FW3_LIMIT_UNIT_HOUR;
 137         else if (!strncmp(e, "day", strlen(e)))
 138                 u = FW3_LIMIT_UNIT_DAY;
 139         else
 140                 return false;
 141
 142         limit->rate = n;
 143         limit->unit = u;
 144
 145         return true;
 146 }
 147
 148 bool
 149 fw3_parse_device(void *ptr, const char *val)
 150 {
 151         struct fw3_device *dev = ptr;
 152
 153         if (*val == '*')
 154         {
 155                 dev->set = true;
 156                 dev->any = true;
 157                 return true;
 158         }
 159
 160         if (*val == '!')
 161         {
 162                 dev->invert = true;
 163                 while (isspace(*++val));
 164         }
 165
 166         if (*val)
 167                 snprintf(dev->name, sizeof(dev->name), "%s", val);
 168         else
 169                 return false;
 170
 171         dev->set = true;
 172         return true;
 173 }
 174
 175 bool
 176 fw3_parse_address(void *ptr, const char *val)
 177 {
 178         struct fw3_address *addr = ptr;
 179         struct in_addr v4;
 180         struct in6_addr v6;
 181         char *p, *s, *e;
 182         int i, m = -1;
 183
 184         if (*val == '!')
 185         {
 186                 addr->invert = true;
 187                 while (isspace(*++val));
 188         }
 189
 190         s = strdup(val);
 191
 192         if (!s)
 193                 return false;
 194
 195         if ((p = strchr(s, '/')) != NULL)
 196         {
 197                 *p++ = 0;
 198                 m = strtoul(p, &e, 10);
 199
 200                 if ((e == p) || (*e != 0))
 201                 {
 202                         if (strchr(s, ':') || !inet_pton(AF_INET, p, &v4))
 203                         {
 204                                 free(s);
 205                                 return false;
 206                         }
 207
 208                         for (i = 0, m = 32; !(v4.s_addr & 1) && (i < 32); i++)
 209                         {
 210                                 m--;
 211                                 v4.s_addr >>= 1;
 212                         }
 213                 }
 214         }
 215         else if ((p = strchr(s, '-')) != NULL)
 216         {
 217                 *p++ = 0;
 218
 219                 if (inet_pton(AF_INET6, p, &v6))
 220                 {
 221                         addr->family = FW3_FAMILY_V6;
 222                         addr->address2.v6 = v6;
 223                         addr->range = true;
 224                 }
 225                 else if (inet_pton(AF_INET, p, &v4))
 226                 {
 227                         addr->family = FW3_FAMILY_V4;
 228                         addr->address2.v4 = v4;
 229                         addr->range = true;
 230                 }
 231                 else
 232                 {
 233                         free(s);
 234                         return false;
 235                 }
 236         }
 237
 238         if (inet_pton(AF_INET6, s, &v6))
 239         {
 240                 addr->family = FW3_FAMILY_V6;
 241                 addr->address.v6 = v6;
 242                 addr->mask = (m >= 0) ? m : 128;
 243         }
 244         else if (inet_pton(AF_INET, s, &v4))
 245         {
 246                 addr->family = FW3_FAMILY_V4;
 247                 addr->address.v4 = v4;
 248                 addr->mask = (m >= 0) ? m : 32;
 249         }
 250         else
 251         {
 252                 free(s);
 253                 return false;
 254         }
 255
 256         free(s);
 257         addr->set = true;
 258         return true;
 259 }
 260
 261 bool
 262 fw3_parse_mac(void *ptr, const char *val)
 263 {
 264         struct fw3_mac *addr = ptr;
 265         struct ether_addr *mac;
 266
 267         if (*val == '!')
 268         {
 269                 addr->invert = true;
 270                 while (isspace(*++val));
 271         }
 272
 273         if ((mac = ether_aton(val)) != NULL)
 274         {
 275                 addr->mac = *mac;
 276                 addr->set = true;
 277                 return true;
 278         }
 279
 280         return false;
 281 }
 282
 283 bool
 284 fw3_parse_port(void *ptr, const char *val)
 285 {
 286         struct fw3_port *range = ptr;
 287         uint16_t n;
 288         uint16_t m;
 289         char *p;
 290
 291         if (*val == '!')
 292         {
 293                 range->invert = true;
 294                 while (isspace(*++val));
 295         }
 296
 297         n = strtoul(val, &p, 10);
 298
 299         if (errno == ERANGE || errno == EINVAL)
 300                 return false;
 301
 302         if (*p && *p != '-' && *p != ':')
 303                 return false;
 304
 305         if (*p)
 306         {
 307                 m = strtoul(++p, NULL, 10);
 308
 309                 if (errno == ERANGE || errno == EINVAL || m < n)
 310                         return false;
 311
 312                 range->port_min = n;
 313                 range->port_max = m;
 314         }
 315         else
 316         {
 317                 range->port_min = n;
 318                 range->port_max = n;
 319         }
 320
 321         range->set = true;
 322         return true;
 323 }
 324
 325 bool
 326 fw3_parse_family(void *ptr, const char *val)
 327 {
 328         if (!strcmp(val, "any"))
 329                 *((enum fw3_family *)ptr) = FW3_FAMILY_ANY;
 330         else if (!strcmp(val, "inet") || strrchr(val, '4'))
 331                 *((enum fw3_family *)ptr) = FW3_FAMILY_V4;
 332         else if (!strcmp(val, "inet6") || strrchr(val, '6'))
 333                 *((enum fw3_family *)ptr) = FW3_FAMILY_V6;
 334         else
 335                 return false;
 336
 337         return true;
 338 }
 339
 340 bool
 341 fw3_parse_icmptype(void *ptr, const char *val)
 342 {
 343         struct fw3_icmptype *icmp = ptr;
 344         bool v4 = false;
 345         bool v6 = false;
 346         char *p;
 347         int i;
 348
 349         for (i = 0; i < ARRAY_SIZE(fw3_icmptype_list_v4); i++)
 350         {
 351                 if (!strcmp(val, fw3_icmptype_list_v4[i].name))
 352                 {
 353                         icmp->type     = fw3_icmptype_list_v4[i].type;
 354                         icmp->code_min = fw3_icmptype_list_v4[i].code_min;
 355                         icmp->code_max = fw3_icmptype_list_v4[i].code_max;
 356
 357                         v4 = true;
 358                         break;
 359                 }
 360         }
 361
 362         for (i = 0; i < ARRAY_SIZE(fw3_icmptype_list_v6); i++)
 363         {
 364                 if (!strcmp(val, fw3_icmptype_list_v6[i].name))
 365                 {
 366                         icmp->type6     = fw3_icmptype_list_v6[i].type;
 367                         icmp->code6_min = fw3_icmptype_list_v6[i].code_min;
 368                         icmp->code6_max = fw3_icmptype_list_v6[i].code_max;
 369
 370                         v6 = true;
 371                         break;
 372                 }
 373         }
 374
 375         if (!v4 && !v6)
 376         {
 377                 i = strtoul(val, &p, 10);
 378
 379                 if ((p == val) || (*p != '/' && *p != 0) || (i > 0xFF))
 380                         return false;
 381
 382                 icmp->type = i;
 383
 384                 if (*p == '/')
 385                 {
 386                         val = ++p;
 387                         i = strtoul(val, &p, 10);
 388
 389                         if ((p == val) || (*p != 0) || (i > 0xFF))
 390                                 return false;
 391
 392                         icmp->code_min = i;
 393                         icmp->code_max = i;
 394                 }
 395                 else
 396                 {
 397                         icmp->code_min = 0;
 398                         icmp->code_max = 0xFF;
 399                 }
 400
 401                 icmp->type6     = icmp->type;
 402                 icmp->code6_min = icmp->code_max;
 403                 icmp->code6_max = icmp->code_max;
 404
 405                 v4 = true;
 406                 v6 = true;
 407         }
 408
 409         icmp->family = (v4 && v6) ? FW3_FAMILY_ANY
 410                                   : (v6 ? FW3_FAMILY_V6 : FW3_FAMILY_V4);
 411
 412         return true;
 413 }
 414
 415 bool
 416 fw3_parse_protocol(void *ptr, const char *val)
 417 {
 418         struct fw3_protocol *proto = ptr;
 419         struct protoent *ent;
 420
 421         if (*val == '!')
 422         {
 423                 proto->invert = true;
 424                 while (isspace(*++val));
 425         }
 426
 427         if (!strcmp(val, "all"))
 428         {
 429                 proto->any = true;
 430                 return true;
 431         }
 432         else if (!strcmp(val, "icmpv6"))
 433         {
 434                 val = "ipv6-icmp";
 435         }
 436
 437         ent = getprotobyname(val);
 438
 439         if (ent)
 440         {
 441                 proto->protocol = ent->p_proto;
 442                 return true;
 443         }
 444
 445         proto->protocol = strtoul(val, NULL, 10);
 446         return (errno != ERANGE && errno != EINVAL);
 447 }
 448
 449 bool
 450 fw3_parse_ipset_method(void *ptr, const char *val)
 451 {
 452         if (!strncmp(val, "bitmap", strlen(val)))
 453         {
 454                 *((enum fw3_ipset_method *)ptr) = FW3_IPSET_METHOD_BITMAP;
 455                 return true;
 456         }
 457         else if (!strncmp(val, "hash", strlen(val)))
 458         {
 459                 *((enum fw3_ipset_method *)ptr) = FW3_IPSET_METHOD_HASH;
 460                 return true;
 461         }
 462         else if (!strncmp(val, "list", strlen(val)))
 463         {
 464                 *((enum fw3_ipset_method *)ptr) = FW3_IPSET_METHOD_LIST;
 465                 return true;
 466         }
 467
 468         return false;
 469 }
 470
 471 bool
 472 fw3_parse_ipset_datatype(void *ptr, const char *val)
 473 {
 474         struct fw3_ipset_datatype *type = ptr;
 475
 476         if (!strncmp(val, "dest_", 5))
 477         {
 478                 val += 5;
 479                 type->dest = true;
 480         }
 481         else if (!strncmp(val, "dst_", 4))
 482         {
 483                 val += 4;
 484                 type->dest = true;
 485         }
 486         else if (!strncmp(val, "src_", 4))
 487         {
 488                 val += 4;
 489                 type->dest = false;
 490         }
 491
 492         if (!strncmp(val, "ip", strlen(val)))
 493         {
 494                 type->type = FW3_IPSET_TYPE_IP;
 495                 return true;
 496         }
 497         else if (!strncmp(val, "port", strlen(val)))
 498         {
 499                 type->type = FW3_IPSET_TYPE_PORT;
 500                 return true;
 501         }
 502         else if (!strncmp(val, "mac", strlen(val)))
 503         {
 504                 type->type = FW3_IPSET_TYPE_MAC;
 505                 return true;
 506         }
 507         else if (!strncmp(val, "net", strlen(val)))
 508         {
 509                 type->type = FW3_IPSET_TYPE_NET;
 510                 return true;
 511         }
 512         else if (!strncmp(val, "set", strlen(val)))
 513         {
 514                 type->type = FW3_IPSET_TYPE_SET;
 515                 return true;
 516         }
 517
 518         return false;
 519 }
 520
 521 bool
 522 fw3_parse_date(void *ptr, const char *val)
 523 {
 524         unsigned int year = 1970, mon = 1, day = 1, hour = 0, min = 0, sec = 0;
 525         struct tm tm = { 0 };
 526         char *p;
 527
 528         year = strtoul(val, &p, 10);
 529         if ((*p != '-' && *p) || year < 1970 || year > 2038)
 530                 goto fail;
 531         else if (!*p)
 532                 goto ret;
 533
 534         mon = strtoul(++p, &p, 10);
 535         if ((*p != '-' && *p) || mon > 12)
 536                 goto fail;
 537         else if (!*p)
 538                 goto ret;
 539
 540         day = strtoul(++p, &p, 10);
 541         if ((*p != 'T' && *p) || day > 31)
 542                 goto fail;
 543         else if (!*p)
 544                 goto ret;
 545
 546         hour = strtoul(++p, &p, 10);
 547         if ((*p != ':' && *p) || hour > 23)
 548                 goto fail;
 549         else if (!*p)
 550                 goto ret;
 551
 552         min = strtoul(++p, &p, 10);
 553         if ((*p != ':' && *p) || min > 59)
 554                 goto fail;
 555         else if (!*p)
 556                 goto ret;
 557
 558         sec = strtoul(++p, &p, 10);
 559         if (*p || sec > 59)
 560                 goto fail;
 561
 562 ret:
 563         tm.tm_year = year - 1900;
 564         tm.tm_mon  = mon - 1;
 565         tm.tm_mday = day;
 566         tm.tm_hour = hour;
 567         tm.tm_min  = min;
 568         tm.tm_sec  = sec;
 569
 570         if (mktime(&tm) >= 0)
 571         {
 572                 *((struct tm *)ptr) = tm;
 573                 return true;
 574         }
 575
 576 fail:
 577         return false;
 578 }
 579
 580 bool
 581 fw3_parse_time(void *ptr, const char *val)
 582 {
 583         unsigned int hour = 0, min = 0, sec = 0;
 584         char *p;
 585
 586         hour = strtoul(val, &p, 10);
 587         if (*p != ':' || hour > 23)
 588                 goto fail;
 589
 590         min = strtoul(++p, &p, 10);
 591         if ((*p != ':' && *p) || min > 59)
 592                 goto fail;
 593         else if (!*p)
 594                 goto ret;
 595
 596         sec = strtoul(++p, &p, 10);
 597         if (*p || sec > 59)
 598                 goto fail;
 599
 600 ret:
 601         *((int *)ptr) = 60 * 60 * hour + 60 * min + sec;
 602         return true;
 603
 604 fail:
 605         return false;
 606 }
 607
 608 bool
 609 fw3_parse_weekdays(void *ptr, const char *val)
 610 {
 611         unsigned int w;
 612         char *p;
 613
 614         if (*val == '!')
 615         {
 616                 setbit(*(uint8_t *)ptr, 0);
 617                 while (isspace(*++val));
 618         }
 619
 620         for (p = strtok((char *)val, " \t"); p; p = strtok(NULL, " \t"))
 621         {
 622                 if (!strncasecmp(p, "monday", strlen(p)))
 623                         w = 1;
 624                 else if (!strncasecmp(p, "tuesday", strlen(p)))
 625                         w = 2;
 626                 else if (!strncasecmp(p, "wednesday", strlen(p)))
 627                         w = 3;
 628                 else if (!strncasecmp(p, "thursday", strlen(p)))
 629                         w = 4;
 630                 else if (!strncasecmp(p, "friday", strlen(p)))
 631                         w = 5;
 632                 else if (!strncasecmp(p, "saturday", strlen(p)))
 633                         w = 6;
 634                 else if (!strncasecmp(p, "sunday", strlen(p)))
 635                         w = 7;
 636                 else
 637                 {
 638                         w = strtoul(p, &p, 10);
 639
 640                         if (*p || w < 1 || w > 7)
 641                                 return false;
 642                 }
 643
 644                 setbit(*(uint8_t *)ptr, w);
 645         }
 646
 647         return true;
 648 }
 649
 650 bool
 651 fw3_parse_monthdays(void *ptr, const char *val)
 652 {
 653         unsigned int d;
 654         char *p;
 655
 656         if (*val == '!')
 657         {
 658                 setbit(*(uint32_t *)ptr, 0);
 659                 while (isspace(*++val));
 660         }
 661
 662         for (p = strtok((char *)val, " \t"); p; p = strtok(NULL, " \t"))
 663         {
 664                 d = strtoul(p, &p, 10);
 665
 666                 if (*p || d < 1 || d > 31)
 667                         return false;
 668
 669                 setbit(*(uint32_t *)ptr, d);
 670         }
 671
 672         return true;
 673 }
 674
 675 bool
 676 fw3_parse_include_type(void *ptr, const char *val)
 677 {
 678         if (!strcmp(val, "script"))
 679                 *((enum fw3_include_type *)ptr) = FW3_INC_TYPE_SCRIPT;
 680         else if (!strcmp(val, "restore"))
 681                 *((enum fw3_include_type *)ptr) = FW3_INC_TYPE_RESTORE;
 682         else
 683                 return false;
 684
 685         return true;
 686 }
 687
 688
 689 void
 690 fw3_parse_options(void *s, const struct fw3_option *opts,
 691                   struct uci_section *section)
 692 {
 693         char *p;
 694         bool known;
 695         struct uci_element *e, *l;
 696         struct uci_option *o;
 697         const struct fw3_option *opt;
 698         struct list_head *item;
 699         struct list_head *dest;
 700
 701         uci_foreach_element(&section->options, e)
 702         {
 703                 o = uci_to_option(e);
 704                 known = false;
 705
 706                 for (opt = opts; opt->name; opt++)
 707                 {
 708                         if (!opt->parse)
 709                                 continue;
 710
 711                         if (strcmp(opt->name, e->name))
 712                                 continue;
 713
 714                         if (o->type == UCI_TYPE_LIST)
 715                         {
 716                                 if (!opt->elem_size)
 717                                 {
 718                                         warn_elem(e, "must not be a list");
 719                                 }
 720                                 else
 721                                 {
 722                                         uci_foreach_element(&o->v.list, l)
 723                                         {
 724                                                 if (!l->name)
 725                                                         continue;
 726
 727                                                 item = malloc(opt->elem_size);
 728
 729                                                 if (!item)
 730                                                         continue;
 731
 732                                                 memset(item, 0, opt->elem_size);
 733
 734                                                 if (!opt->parse(item, l->name))
 735                                                 {
 736                                                         warn_elem(e, "has invalid value '%s'", l->name);
 737                                                         free(item);
 738                                                         continue;
 739                                                 }
 740
 741                                                 dest = (struct list_head *)((char *)s + opt->offset);
 742                                                 list_add_tail(item, dest);
 743                                         }
 744                                 }
 745                         }
 746                         else
 747                         {
 748                                 if (!o->v.string)
 749                                         continue;
 750
 751                                 if (!opt->elem_size)
 752                                 {
 753                                         if (!opt->parse((char *)s + opt->offset, o->v.string))
 754                                                 warn_elem(e, "has invalid value '%s'", o->v.string);
 755                                 }
 756                                 else
 757                                 {
 758                                         for (p = strtok(o->v.string, " \t");
 759                                              p != NULL;
 760                                              p = strtok(NULL, " \t"))
 761                                         {
 762                                                 item = malloc(opt->elem_size);
 763
 764                                                 if (!item)
 765                                                         continue;
 766
 767                                                 memset(item, 0, opt->elem_size);
 768
 769                                                 if (!opt->parse(item, p))
 770                                                 {
 771                                                         warn_elem(e, "has invalid value '%s'", p);
 772                                                         free(item);
 773                                                         continue;
 774                                                 }
 775
 776                                                 dest = (struct list_head *)((char *)s + opt->offset);
 777                                                 list_add_tail(item, dest);
 778                                         }
 779                                 }
 780                         }
 781
 782                         known = true;
 783                         break;
 784                 }
 785
 786                 if (!known)
 787                         warn_elem(e, "is unknown");
 788         }
 789 }
 790
 791
 792 void
 793 fw3_format_in_out(struct fw3_device *in, struct fw3_device *out)
 794 {
 795         if (in && !in->any)
 796                 fw3_pr(" %s-i %s", in->invert ? "! " : "", in->name);
 797
 798         if (out && !out->any)
 799                 fw3_pr(" %s-o %s", out->invert ? "! " : "", out->name);
 800 }
 801
 802 void
 803 fw3_format_src_dest(struct fw3_address *src, struct fw3_address *dest)
 804 {
 805         char s[INET6_ADDRSTRLEN];
 806
 807         if ((src && src->range) || (dest && dest->range))
 808                 fw3_pr(" -m iprange");
 809
 810         if (src && src->set)
 811         {
 812                 if (src->range)
 813                 {
 814                         inet_ntop(src->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
 815                                           &src->address.v4, s, sizeof(s));
 816
 817                         fw3_pr(" %s--src-range %s", src->invert ? "! " : "", s);
 818
 819                         inet_ntop(src->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
 820                                           &src->address2.v4, s, sizeof(s));
 821
 822                         fw3_pr("-%s", s);
 823                 }
 824                 else
 825                 {
 826                         inet_ntop(src->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
 827                                           &src->address.v4, s, sizeof(s));
 828
 829                         fw3_pr(" %s-s %s/%u", src->invert ? "! " : "", s, src->mask);
 830                 }
 831         }
 832
 833         if (dest && dest->set)
 834         {
 835                 if (dest->range)
 836                 {
 837                         inet_ntop(dest->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
 838                                           &dest->address.v4, s, sizeof(s));
 839
 840                         fw3_pr(" %s--dst-range %s", dest->invert ? "! " : "", s);
 841
 842                         inet_ntop(dest->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
 843                                           &dest->address2.v4, s, sizeof(s));
 844
 845                         fw3_pr("-%s", s);
 846                 }
 847                 else
 848                 {
 849                         inet_ntop(dest->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
 850                                           &dest->address.v4, s, sizeof(s));
 851
 852                         fw3_pr(" %s-d %s/%u", dest->invert ? "! " : "", s, dest->mask);
 853                 }
 854         }
 855 }
 856
 857 void
 858 fw3_format_sport_dport(struct fw3_port *sp, struct fw3_port *dp)
 859 {
 860         if (sp && sp->set)
 861         {
 862                 if (sp->port_min == sp->port_max)
 863                         fw3_pr(" %s--sport %u", sp->invert ? "! " : "", sp->port_min);
 864                 else
 865                         fw3_pr(" %s--sport %u:%u",
 866                                sp->invert ? "! " : "", sp->port_min, sp->port_max);
 867         }
 868
 869         if (dp && dp->set)
 870         {
 871                 if (dp->port_min == dp->port_max)
 872                         fw3_pr(" %s--dport %u", dp->invert ? "! " : "", dp->port_min);
 873                 else
 874                         fw3_pr(" %s--dport %u:%u",
 875                                dp->invert ? "! " : "", dp->port_min, dp->port_max);
 876         }
 877 }
 878
 879 void
 880 fw3_format_mac(struct fw3_mac *mac)
 881 {
 882         if (!mac)
 883                 return;
 884
 885         fw3_pr(" -m mac %s--mac-source %s",
 886                mac->invert ? "! " : "", ether_ntoa(&mac->mac));
 887 }
 888
 889 void
 890 fw3_format_protocol(struct fw3_protocol *proto, enum fw3_family family)
 891 {
 892         uint16_t pr;
 893
 894         if (!proto)
 895                 return;
 896
 897         pr = proto->protocol;
 898
 899         if (pr == 1 && family == FW3_FAMILY_V6)
 900                 pr = 58;
 901
 902         if (proto->any)
 903                 fw3_pr(" -p all");
 904         else
 905                 fw3_pr(" %s-p %u", proto->invert ? "! " : "", pr);
 906 }
 907
 908 void
 909 fw3_format_icmptype(struct fw3_icmptype *icmp, enum fw3_family family)
 910 {
 911         if (!icmp)
 912                 return;
 913
 914         if (family != FW3_FAMILY_V6)
 915         {
 916                 if (icmp->code_min == 0 && icmp->code_max == 0xFF)
 917                         fw3_pr(" %s--icmp-type %u", icmp->invert ? "! " : "", icmp->type);
 918                 else
 919                         fw3_pr(" %s--icmp-type %u/%u",
 920                                    icmp->invert ? "! " : "", icmp->type, icmp->code_min);
 921         }
 922         else
 923         {
 924                 if (icmp->code6_min == 0 && icmp->code6_max == 0xFF)
 925                         fw3_pr(" %s--icmpv6-type %u", icmp->invert ? "! " : "", icmp->type6);
 926                 else
 927                         fw3_pr(" %s--icmpv6-type %u/%u",
 928                                    icmp->invert ? "! " : "", icmp->type6, icmp->code6_min);
 929         }
 930 }
 931
 932 void
 933 fw3_format_limit(struct fw3_limit *limit)
 934 {
 935         if (!limit)
 936                 return;
 937
 938         const char *units[] = {
 939                 [FW3_LIMIT_UNIT_SECOND] = "second",
 940                 [FW3_LIMIT_UNIT_MINUTE] = "minute",
 941                 [FW3_LIMIT_UNIT_HOUR]   = "hour",
 942                 [FW3_LIMIT_UNIT_DAY]    = "day",
 943         };
 944
 945         if (limit->rate > 0)
 946         {
 947                 fw3_pr(" -m limit %s--limit %u/%s",
 948                        limit->invert ? "! " : "", limit->rate, units[limit->unit]);
 949
 950                 if (limit->burst > 0)
 951                         fw3_pr(" --limit-burst %u", limit->burst);
 952         }
 953 }
 954
 955 void
 956 fw3_format_ipset(struct fw3_ipset *ipset, bool invert)
 957 {
 958         bool first = true;
 959         const char *name = NULL;
 960         struct fw3_ipset_datatype *type;
 961
 962         if (!ipset)
 963                 return;
 964
 965         if (ipset->external && *ipset->external)
 966                 name = ipset->external;
 967         else
 968                 name = ipset->name;
 969
 970         fw3_pr(" -m set %s--match-set %s", invert ? "! " : "", name);
 971
 972         list_for_each_entry(type, &ipset->datatypes, list)
 973         {
 974                 fw3_pr("%c%s", first ? ' ' : ',', type->dest ? "dst" : "src");
 975                 first = false;
 976         }
 977 }
 978
 979 void
 980 fw3_format_time(struct fw3_time *time)
 981 {
 982         int i;
 983         struct tm empty = { 0 };
 984         char buf[sizeof("9999-99-99T23:59:59\0")];
 985         bool d1 = memcmp(&time->datestart, &empty, sizeof(empty));
 986         bool d2 = memcmp(&time->datestop, &empty, sizeof(empty));
 987         bool first;
 988
 989         if (!d1 && !d2 && !time->timestart && !time->timestop &&
 990             !(time->monthdays & 0xFFFFFFFE) && !(time->weekdays & 0xFE))
 991         {
 992                 return;
 993         }
 994
 995         fw3_pr(" -m time");
 996
 997         if (time->utc)
 998                 fw3_pr(" --utc");
 999
1000         if (d1)
1001         {
1002                 strftime(buf, sizeof(buf), "%Y-%m-%dT%H:%M:%S", &time->datestart);
1003                 fw3_pr(" --datestart %s", buf);
1004         }
1005
1006         if (d2)
1007         {
1008                 strftime(buf, sizeof(buf), "%Y-%m-%dT%H:%M:%S", &time->datestop);
1009                 fw3_pr(" --datestop %s", buf);
1010         }
1011
1012         if (time->timestart)
1013         {
1014                 fw3_pr(" --timestart %02d:%02d:%02d",
1015                        time->timestart / 3600,
1016                        time->timestart % 3600 / 60,
1017                        time->timestart % 60);
1018         }
1019
1020         if (time->timestop)
1021         {
1022                 fw3_pr(" --timestop %02d:%02d:%02d",
1023                        time->timestop / 3600,
1024                        time->timestop % 3600 / 60,
1025                        time->timestop % 60);
1026         }
1027
1028         if (time->monthdays & 0xFFFFFFFE)
1029         {
1030                 fw3_pr(" %s--monthdays", hasbit(time->monthdays, 0) ? "! " : "");
1031
1032                 for (i = 1, first = true; i < 32; i++)
1033                 {
1034                         if (hasbit(time->monthdays, i))
1035                         {
1036                                 fw3_pr("%c%u", first ? ' ' : ',', i);
1037                                 first = false;
1038                         }
1039                 }
1040         }
1041
1042         if (time->weekdays & 0xFE)
1043         {
1044                 fw3_pr(" %s--weekdays", hasbit(time->weekdays, 0) ? "! " : "");
1045
1046                 for (i = 1, first = true; i < 8; i++)
1047                 {
1048                         if (hasbit(time->weekdays, i))
1049                         {
1050                                 fw3_pr("%c%u", first ? ' ' : ',', i);
1051                                 first = false;
1052                         }
1053                 }
1054         }
1055 }
1056
1057 void
1058 __fw3_format_comment(const char *comment, ...)
1059 {
1060         va_list ap;
1061         int len = 0;
1062         const char *c;
1063
1064         if (!comment || !*comment)
1065                 return;
1066
1067         fw3_pr(" -m comment --comment \"");
1068
1069         c = comment;
1070
1071         va_start(ap, comment);
1072
1073         do
1074         {
1075                 while (*c)
1076                 {
1077                         switch (*c)
1078                         {
1079                         case '"':
1080                         case '$':
1081                         case '`':
1082                         case '\\':
1083                                 fw3_pr("\\");
1084                                 /* fall through */
1085
1086                         default:
1087                                 fw3_pr("%c", *c);
1088                                 break;
1089                         }
1090
1091                         c++;
1092
1093                         if (len++ >= 255)
1094                                 goto end;
1095                 }
1096
1097                 c = va_arg(ap, const char *);
1098         }
1099         while (c);
1100
1101 end:
1102         va_end(ap);
1103         fw3_pr("\"");
1104 }
1105
1106 void
1107 fw3_format_extra(const char *extra)
1108 {
1109         if (!extra || !*extra)
1110                 return;
1111
1112         fw3_pr(" %s", extra);
1113 }