add support for setting sysctls, remove tcp_westwood option, its not present on curre...
[project/firewall3.git] / options.c
1 /*
2  * firewall3 - 3rd OpenWrt UCI firewall implementation
3  *
4  *   Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
5  *
6  * Permission to use, copy, modify, and/or distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18
19 #include "options.h"
20
21 const char *fw3_flag_names[FW3_DEFAULT_DROP_INVALID + 1] = {
22         "filter",
23         "nat",
24         "mangle",
25         "raw",
26
27         "IPv4",
28         "IPv6",
29
30         "ACCEPT",
31         "REJECT",
32         "DROP",
33         "NOTRACK",
34         "DNAT",
35         "SNAT",
36 };
37
38 bool
39 fw3_parse_bool(void *ptr, const char *val)
40 {
41         if (!strcmp(val, "true") || !strcmp(val, "yes") || !strcmp(val, "1"))
42                 *((bool *)ptr) = true;
43         else
44                 *((bool *)ptr) = false;
45
46         return true;
47 }
48
49 bool
50 fw3_parse_int(void *ptr, const char *val)
51 {
52         int n = strtol(val, NULL, 10);
53
54         if (errno == ERANGE || errno == EINVAL)
55                 return false;
56
57         *((int *)ptr) = n;
58
59         return true;
60 }
61
62 bool
63 fw3_parse_string(void *ptr, const char *val)
64 {
65         *((char **)ptr) = (char *)val;
66         return true;
67 }
68
69 bool
70 fw3_parse_target(void *ptr, const char *val)
71 {
72         if (!strcmp(val, "ACCEPT"))
73         {
74                 *((enum fw3_target *)ptr) = FW3_TARGET_ACCEPT;
75                 return true;
76         }
77         else if (!strcmp(val, "REJECT"))
78         {
79                 *((enum fw3_target *)ptr) = FW3_TARGET_REJECT;
80                 return true;
81         }
82         else if (!strcmp(val, "DROP"))
83         {
84                 *((enum fw3_target *)ptr) = FW3_TARGET_DROP;
85                 return true;
86         }
87         else if (!strcmp(val, "NOTRACK"))
88         {
89                 *((enum fw3_target *)ptr) = FW3_TARGET_NOTRACK;
90                 return true;
91         }
92         else if (!strcmp(val, "DNAT"))
93         {
94                 *((enum fw3_target *)ptr) = FW3_TARGET_DNAT;
95                 return true;
96         }
97         else if (!strcmp(val, "SNAT"))
98         {
99                 *((enum fw3_target *)ptr) = FW3_TARGET_SNAT;
100                 return true;
101         }
102
103         return false;
104 }
105
106 bool
107 fw3_parse_limit(void *ptr, const char *val)
108 {
109         struct fw3_limit *limit = ptr;
110         enum fw3_limit_unit u = FW3_LIMIT_UNIT_SECOND;
111         char *e;
112         int n;
113
114         if (*val == '!')
115         {
116                 limit->invert = true;
117                 while (isspace(*++val));
118         }
119
120         n = strtol(val, &e, 10);
121
122         if (errno == ERANGE || errno == EINVAL)
123                 return false;
124
125         if (*e && *e++ != '/')
126                 return false;
127
128         if (!strlen(e))
129                 return false;
130
131         if (!strncmp(e, "second", strlen(e)))
132                 u = FW3_LIMIT_UNIT_SECOND;
133         else if (!strncmp(e, "minute", strlen(e)))
134                 u = FW3_LIMIT_UNIT_MINUTE;
135         else if (!strncmp(e, "hour", strlen(e)))
136                 u = FW3_LIMIT_UNIT_HOUR;
137         else if (!strncmp(e, "day", strlen(e)))
138                 u = FW3_LIMIT_UNIT_DAY;
139         else
140                 return false;
141
142         limit->rate = n;
143         limit->unit = u;
144
145         return true;
146 }
147
148 bool
149 fw3_parse_device(void *ptr, const char *val)
150 {
151         struct fw3_device *dev = ptr;
152
153         if (*val == '*')
154         {
155                 dev->set = true;
156                 dev->any = true;
157                 return true;
158         }
159
160         if (*val == '!')
161         {
162                 dev->invert = true;
163                 while (isspace(*++val));
164         }
165
166         if (*val)
167                 snprintf(dev->name, sizeof(dev->name), "%s", val);
168         else
169                 return false;
170
171         dev->set = true;
172         return true;
173 }
174
175 bool
176 fw3_parse_address(void *ptr, const char *val)
177 {
178         struct fw3_address *addr = ptr;
179         struct in_addr v4;
180         struct in6_addr v6;
181         char *p, *s, *e;
182         int i, m = -1;
183
184         if (*val == '!')
185         {
186                 addr->invert = true;
187                 while (isspace(*++val));
188         }
189
190         s = strdup(val);
191
192         if (!s)
193                 return false;
194
195         if ((p = strchr(s, '/')) != NULL)
196         {
197                 *p++ = 0;
198                 m = strtoul(p, &e, 10);
199
200                 if ((e == p) || (*e != 0))
201                 {
202                         if (strchr(s, ':') || !inet_pton(AF_INET, p, &v4))
203                         {
204                                 free(s);
205                                 return false;
206                         }
207
208                         for (i = 0, m = 32; !(v4.s_addr & 1) && (i < 32); i++)
209                         {
210                                 m--;
211                                 v4.s_addr >>= 1;
212                         }
213                 }
214         }
215         else if ((p = strchr(s, '-')) != NULL)
216         {
217                 *p++ = 0;
218
219                 if (inet_pton(AF_INET6, p, &v6))
220                 {
221                         addr->family = FW3_FAMILY_V6;
222                         addr->address2.v6 = v6;
223                         addr->range = true;
224                 }
225                 else if (inet_pton(AF_INET, p, &v4))
226                 {
227                         addr->family = FW3_FAMILY_V4;
228                         addr->address2.v4 = v4;
229                         addr->range = true;
230                 }
231                 else
232                 {
233                         free(s);
234                         return false;
235                 }
236         }
237
238         if (inet_pton(AF_INET6, s, &v6))
239         {
240                 addr->family = FW3_FAMILY_V6;
241                 addr->address.v6 = v6;
242                 addr->mask = (m >= 0) ? m : 128;
243         }
244         else if (inet_pton(AF_INET, s, &v4))
245         {
246                 addr->family = FW3_FAMILY_V4;
247                 addr->address.v4 = v4;
248                 addr->mask = (m >= 0) ? m : 32;
249         }
250         else
251         {
252                 free(s);
253                 return false;
254         }
255
256         free(s);
257         addr->set = true;
258         return true;
259 }
260
261 bool
262 fw3_parse_mac(void *ptr, const char *val)
263 {
264         struct fw3_mac *addr = ptr;
265         struct ether_addr *mac;
266
267         if (*val == '!')
268         {
269                 addr->invert = true;
270                 while (isspace(*++val));
271         }
272
273         if ((mac = ether_aton(val)) != NULL)
274         {
275                 addr->mac = *mac;
276                 addr->set = true;
277                 return true;
278         }
279
280         return false;
281 }
282
283 bool
284 fw3_parse_port(void *ptr, const char *val)
285 {
286         struct fw3_port *range = ptr;
287         uint16_t n;
288         uint16_t m;
289         char *p;
290
291         if (*val == '!')
292         {
293                 range->invert = true;
294                 while (isspace(*++val));
295         }
296
297         n = strtoul(val, &p, 10);
298
299         if (errno == ERANGE || errno == EINVAL)
300                 return false;
301
302         if (*p && *p != '-' && *p != ':')
303                 return false;
304
305         if (*p)
306         {
307                 m = strtoul(++p, NULL, 10);
308
309                 if (errno == ERANGE || errno == EINVAL || m < n)
310                         return false;
311
312                 range->port_min = n;
313                 range->port_max = m;
314         }
315         else
316         {
317                 range->port_min = n;
318                 range->port_max = n;
319         }
320
321         range->set = true;
322         return true;
323 }
324
325 bool
326 fw3_parse_family(void *ptr, const char *val)
327 {
328         if (!strcmp(val, "any"))
329                 *((enum fw3_family *)ptr) = FW3_FAMILY_ANY;
330         else if (!strcmp(val, "inet") || strrchr(val, '4'))
331                 *((enum fw3_family *)ptr) = FW3_FAMILY_V4;
332         else if (!strcmp(val, "inet6") || strrchr(val, '6'))
333                 *((enum fw3_family *)ptr) = FW3_FAMILY_V6;
334         else
335                 return false;
336
337         return true;
338 }
339
340 bool
341 fw3_parse_icmptype(void *ptr, const char *val)
342 {
343         struct fw3_icmptype *icmp = ptr;
344         bool v4 = false;
345         bool v6 = false;
346         char *p;
347         int i;
348
349         for (i = 0; i < ARRAY_SIZE(fw3_icmptype_list_v4); i++)
350         {
351                 if (!strcmp(val, fw3_icmptype_list_v4[i].name))
352                 {
353                         icmp->type     = fw3_icmptype_list_v4[i].type;
354                         icmp->code_min = fw3_icmptype_list_v4[i].code_min;
355                         icmp->code_max = fw3_icmptype_list_v4[i].code_max;
356
357                         v4 = true;
358                         break;
359                 }
360         }
361
362         for (i = 0; i < ARRAY_SIZE(fw3_icmptype_list_v6); i++)
363         {
364                 if (!strcmp(val, fw3_icmptype_list_v6[i].name))
365                 {
366                         icmp->type6     = fw3_icmptype_list_v6[i].type;
367                         icmp->code6_min = fw3_icmptype_list_v6[i].code_min;
368                         icmp->code6_max = fw3_icmptype_list_v6[i].code_max;
369
370                         v6 = true;
371                         break;
372                 }
373         }
374
375         if (!v4 && !v6)
376         {
377                 i = strtoul(val, &p, 10);
378
379                 if ((p == val) || (*p != '/' && *p != 0) || (i > 0xFF))
380                         return false;
381
382                 icmp->type = i;
383
384                 if (*p == '/')
385                 {
386                         val = ++p;
387                         i = strtoul(val, &p, 10);
388
389                         if ((p == val) || (*p != 0) || (i > 0xFF))
390                                 return false;
391
392                         icmp->code_min = i;
393                         icmp->code_max = i;
394                 }
395                 else
396                 {
397                         icmp->code_min = 0;
398                         icmp->code_max = 0xFF;
399                 }
400
401                 icmp->type6     = icmp->type;
402                 icmp->code6_min = icmp->code_max;
403                 icmp->code6_max = icmp->code_max;
404
405                 v4 = true;
406                 v6 = true;
407         }
408
409         icmp->family = (v4 && v6) ? FW3_FAMILY_ANY
410                                   : (v6 ? FW3_FAMILY_V6 : FW3_FAMILY_V4);
411
412         return true;
413 }
414
415 bool
416 fw3_parse_protocol(void *ptr, const char *val)
417 {
418         struct fw3_protocol *proto = ptr;
419         struct protoent *ent;
420
421         if (*val == '!')
422         {
423                 proto->invert = true;
424                 while (isspace(*++val));
425         }
426
427         if (!strcmp(val, "all"))
428         {
429                 proto->any = true;
430                 return true;
431         }
432         else if (!strcmp(val, "icmpv6"))
433         {
434                 val = "ipv6-icmp";
435         }
436
437         ent = getprotobyname(val);
438
439         if (ent)
440         {
441                 proto->protocol = ent->p_proto;
442                 return true;
443         }
444
445         proto->protocol = strtoul(val, NULL, 10);
446         return (errno != ERANGE && errno != EINVAL);
447 }
448
449 bool
450 fw3_parse_ipset_method(void *ptr, const char *val)
451 {
452         if (!strncmp(val, "bitmap", strlen(val)))
453         {
454                 *((enum fw3_ipset_method *)ptr) = FW3_IPSET_METHOD_BITMAP;
455                 return true;
456         }
457         else if (!strncmp(val, "hash", strlen(val)))
458         {
459                 *((enum fw3_ipset_method *)ptr) = FW3_IPSET_METHOD_HASH;
460                 return true;
461         }
462         else if (!strncmp(val, "list", strlen(val)))
463         {
464                 *((enum fw3_ipset_method *)ptr) = FW3_IPSET_METHOD_LIST;
465                 return true;
466         }
467
468         return false;
469 }
470
471 bool
472 fw3_parse_ipset_datatype(void *ptr, const char *val)
473 {
474         struct fw3_ipset_datatype *type = ptr;
475
476         if (!strncmp(val, "dest_", 5))
477         {
478                 val += 5;
479                 type->dest = true;
480         }
481         else if (!strncmp(val, "dst_", 4))
482         {
483                 val += 4;
484                 type->dest = true;
485         }
486         else if (!strncmp(val, "src_", 4))
487         {
488                 val += 4;
489                 type->dest = false;
490         }
491
492         if (!strncmp(val, "ip", strlen(val)))
493         {
494                 type->type = FW3_IPSET_TYPE_IP;
495                 return true;
496         }
497         else if (!strncmp(val, "port", strlen(val)))
498         {
499                 type->type = FW3_IPSET_TYPE_PORT;
500                 return true;
501         }
502         else if (!strncmp(val, "mac", strlen(val)))
503         {
504                 type->type = FW3_IPSET_TYPE_MAC;
505                 return true;
506         }
507         else if (!strncmp(val, "net", strlen(val)))
508         {
509                 type->type = FW3_IPSET_TYPE_NET;
510                 return true;
511         }
512         else if (!strncmp(val, "set", strlen(val)))
513         {
514                 type->type = FW3_IPSET_TYPE_SET;
515                 return true;
516         }
517
518         return false;
519 }
520
521 bool
522 fw3_parse_date(void *ptr, const char *val)
523 {
524         unsigned int year = 1970, mon = 1, day = 1, hour = 0, min = 0, sec = 0;
525         struct tm tm = { 0 };
526         char *p;
527
528         year = strtoul(val, &p, 10);
529         if ((*p != '-' && *p) || year < 1970 || year > 2038)
530                 goto fail;
531         else if (!*p)
532                 goto ret;
533
534         mon = strtoul(++p, &p, 10);
535         if ((*p != '-' && *p) || mon > 12)
536                 goto fail;
537         else if (!*p)
538                 goto ret;
539
540         day = strtoul(++p, &p, 10);
541         if ((*p != 'T' && *p) || day > 31)
542                 goto fail;
543         else if (!*p)
544                 goto ret;
545
546         hour = strtoul(++p, &p, 10);
547         if ((*p != ':' && *p) || hour > 23)
548                 goto fail;
549         else if (!*p)
550                 goto ret;
551
552         min = strtoul(++p, &p, 10);
553         if ((*p != ':' && *p) || min > 59)
554                 goto fail;
555         else if (!*p)
556                 goto ret;
557
558         sec = strtoul(++p, &p, 10);
559         if (*p || sec > 59)
560                 goto fail;
561
562 ret:
563         tm.tm_year = year - 1900;
564         tm.tm_mon  = mon - 1;
565         tm.tm_mday = day;
566         tm.tm_hour = hour;
567         tm.tm_min  = min;
568         tm.tm_sec  = sec;
569
570         if (mktime(&tm) >= 0)
571         {
572                 *((struct tm *)ptr) = tm;
573                 return true;
574         }
575
576 fail:
577         return false;
578 }
579
580 bool
581 fw3_parse_time(void *ptr, const char *val)
582 {
583         unsigned int hour = 0, min = 0, sec = 0;
584         char *p;
585
586         hour = strtoul(val, &p, 10);
587         if (*p != ':' || hour > 23)
588                 goto fail;
589
590         min = strtoul(++p, &p, 10);
591         if ((*p != ':' && *p) || min > 59)
592                 goto fail;
593         else if (!*p)
594                 goto ret;
595
596         sec = strtoul(++p, &p, 10);
597         if (*p || sec > 59)
598                 goto fail;
599
600 ret:
601         *((int *)ptr) = 60 * 60 * hour + 60 * min + sec;
602         return true;
603
604 fail:
605         return false;
606 }
607
608 bool
609 fw3_parse_weekdays(void *ptr, const char *val)
610 {
611         unsigned int w;
612         char *p;
613
614         if (*val == '!')
615         {
616                 setbit(*(uint8_t *)ptr, 0);
617                 while (isspace(*++val));
618         }
619
620         for (p = strtok((char *)val, " \t"); p; p = strtok(NULL, " \t"))
621         {
622                 if (!strncasecmp(p, "monday", strlen(p)))
623                         w = 1;
624                 else if (!strncasecmp(p, "tuesday", strlen(p)))
625                         w = 2;
626                 else if (!strncasecmp(p, "wednesday", strlen(p)))
627                         w = 3;
628                 else if (!strncasecmp(p, "thursday", strlen(p)))
629                         w = 4;
630                 else if (!strncasecmp(p, "friday", strlen(p)))
631                         w = 5;
632                 else if (!strncasecmp(p, "saturday", strlen(p)))
633                         w = 6;
634                 else if (!strncasecmp(p, "sunday", strlen(p)))
635                         w = 7;
636                 else
637                 {
638                         w = strtoul(p, &p, 10);
639
640                         if (*p || w < 1 || w > 7)
641                                 return false;
642                 }
643
644                 setbit(*(uint8_t *)ptr, w);
645         }
646
647         return true;
648 }
649
650 bool
651 fw3_parse_monthdays(void *ptr, const char *val)
652 {
653         unsigned int d;
654         char *p;
655
656         if (*val == '!')
657         {
658                 setbit(*(uint32_t *)ptr, 0);
659                 while (isspace(*++val));
660         }
661
662         for (p = strtok((char *)val, " \t"); p; p = strtok(NULL, " \t"))
663         {
664                 d = strtoul(p, &p, 10);
665
666                 if (*p || d < 1 || d > 31)
667                         return false;
668
669                 setbit(*(uint32_t *)ptr, d);
670         }
671
672         return true;
673 }
674
675 bool
676 fw3_parse_include_type(void *ptr, const char *val)
677 {
678         if (!strcmp(val, "script"))
679                 *((enum fw3_include_type *)ptr) = FW3_INC_TYPE_SCRIPT;
680         else if (!strcmp(val, "restore"))
681                 *((enum fw3_include_type *)ptr) = FW3_INC_TYPE_RESTORE;
682         else
683                 return false;
684
685         return true;
686 }
687
688
689 void
690 fw3_parse_options(void *s, const struct fw3_option *opts,
691                   struct uci_section *section)
692 {
693         char *p;
694         bool known;
695         struct uci_element *e, *l;
696         struct uci_option *o;
697         const struct fw3_option *opt;
698         struct list_head *item;
699         struct list_head *dest;
700
701         uci_foreach_element(&section->options, e)
702         {
703                 o = uci_to_option(e);
704                 known = false;
705
706                 for (opt = opts; opt->name; opt++)
707                 {
708                         if (!opt->parse)
709                                 continue;
710
711                         if (strcmp(opt->name, e->name))
712                                 continue;
713
714                         if (o->type == UCI_TYPE_LIST)
715                         {
716                                 if (!opt->elem_size)
717                                 {
718                                         warn_elem(e, "must not be a list");
719                                 }
720                                 else
721                                 {
722                                         uci_foreach_element(&o->v.list, l)
723                                         {
724                                                 if (!l->name)
725                                                         continue;
726
727                                                 item = malloc(opt->elem_size);
728
729                                                 if (!item)
730                                                         continue;
731
732                                                 memset(item, 0, opt->elem_size);
733
734                                                 if (!opt->parse(item, l->name))
735                                                 {
736                                                         warn_elem(e, "has invalid value '%s'", l->name);
737                                                         free(item);
738                                                         continue;
739                                                 }
740
741                                                 dest = (struct list_head *)((char *)s + opt->offset);
742                                                 list_add_tail(item, dest);
743                                         }
744                                 }
745                         }
746                         else
747                         {
748                                 if (!o->v.string)
749                                         continue;
750
751                                 if (!opt->elem_size)
752                                 {
753                                         if (!opt->parse((char *)s + opt->offset, o->v.string))
754                                                 warn_elem(e, "has invalid value '%s'", o->v.string);
755                                 }
756                                 else
757                                 {
758                                         for (p = strtok(o->v.string, " \t");
759                                              p != NULL;
760                                              p = strtok(NULL, " \t"))
761                                         {
762                                                 item = malloc(opt->elem_size);
763
764                                                 if (!item)
765                                                         continue;
766
767                                                 memset(item, 0, opt->elem_size);
768
769                                                 if (!opt->parse(item, p))
770                                                 {
771                                                         warn_elem(e, "has invalid value '%s'", p);
772                                                         free(item);
773                                                         continue;
774                                                 }
775
776                                                 dest = (struct list_head *)((char *)s + opt->offset);
777                                                 list_add_tail(item, dest);
778                                         }
779                                 }
780                         }
781
782                         known = true;
783                         break;
784                 }
785
786                 if (!known)
787                         warn_elem(e, "is unknown");
788         }
789 }
790
791
792 void
793 fw3_format_in_out(struct fw3_device *in, struct fw3_device *out)
794 {
795         if (in && !in->any)
796                 fw3_pr(" %s-i %s", in->invert ? "! " : "", in->name);
797
798         if (out && !out->any)
799                 fw3_pr(" %s-o %s", out->invert ? "! " : "", out->name);
800 }
801
802 void
803 fw3_format_src_dest(struct fw3_address *src, struct fw3_address *dest)
804 {
805         char s[INET6_ADDRSTRLEN];
806
807         if ((src && src->range) || (dest && dest->range))
808                 fw3_pr(" -m iprange");
809
810         if (src && src->set)
811         {
812                 if (src->range)
813                 {
814                         inet_ntop(src->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
815                                           &src->address.v4, s, sizeof(s));
816
817                         fw3_pr(" %s--src-range %s", src->invert ? "! " : "", s);
818
819                         inet_ntop(src->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
820                                           &src->address2.v4, s, sizeof(s));
821
822                         fw3_pr("-%s", s);
823                 }
824                 else
825                 {
826                         inet_ntop(src->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
827                                           &src->address.v4, s, sizeof(s));
828
829                         fw3_pr(" %s-s %s/%u", src->invert ? "! " : "", s, src->mask);
830                 }
831         }
832
833         if (dest && dest->set)
834         {
835                 if (dest->range)
836                 {
837                         inet_ntop(dest->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
838                                           &dest->address.v4, s, sizeof(s));
839
840                         fw3_pr(" %s--dst-range %s", dest->invert ? "! " : "", s);
841
842                         inet_ntop(dest->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
843                                           &dest->address2.v4, s, sizeof(s));
844
845                         fw3_pr("-%s", s);
846                 }
847                 else
848                 {
849                         inet_ntop(dest->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
850                                           &dest->address.v4, s, sizeof(s));
851
852                         fw3_pr(" %s-d %s/%u", dest->invert ? "! " : "", s, dest->mask);
853                 }
854         }
855 }
856
857 void
858 fw3_format_sport_dport(struct fw3_port *sp, struct fw3_port *dp)
859 {
860         if (sp && sp->set)
861         {
862                 if (sp->port_min == sp->port_max)
863                         fw3_pr(" %s--sport %u", sp->invert ? "! " : "", sp->port_min);
864                 else
865                         fw3_pr(" %s--sport %u:%u",
866                                sp->invert ? "! " : "", sp->port_min, sp->port_max);
867         }
868
869         if (dp && dp->set)
870         {
871                 if (dp->port_min == dp->port_max)
872                         fw3_pr(" %s--dport %u", dp->invert ? "! " : "", dp->port_min);
873                 else
874                         fw3_pr(" %s--dport %u:%u",
875                                dp->invert ? "! " : "", dp->port_min, dp->port_max);
876         }
877 }
878
879 void
880 fw3_format_mac(struct fw3_mac *mac)
881 {
882         if (!mac)
883                 return;
884
885         fw3_pr(" -m mac %s--mac-source %s",
886                mac->invert ? "! " : "", ether_ntoa(&mac->mac));
887 }
888
889 void
890 fw3_format_protocol(struct fw3_protocol *proto, enum fw3_family family)
891 {
892         uint16_t pr;
893
894         if (!proto)
895                 return;
896
897         pr = proto->protocol;
898
899         if (pr == 1 && family == FW3_FAMILY_V6)
900                 pr = 58;
901
902         if (proto->any)
903                 fw3_pr(" -p all");
904         else
905                 fw3_pr(" %s-p %u", proto->invert ? "! " : "", pr);
906 }
907
908 void
909 fw3_format_icmptype(struct fw3_icmptype *icmp, enum fw3_family family)
910 {
911         if (!icmp)
912                 return;
913
914         if (family != FW3_FAMILY_V6)
915         {
916                 if (icmp->code_min == 0 && icmp->code_max == 0xFF)
917                         fw3_pr(" %s--icmp-type %u", icmp->invert ? "! " : "", icmp->type);
918                 else
919                         fw3_pr(" %s--icmp-type %u/%u",
920                                    icmp->invert ? "! " : "", icmp->type, icmp->code_min);
921         }
922         else
923         {
924                 if (icmp->code6_min == 0 && icmp->code6_max == 0xFF)
925                         fw3_pr(" %s--icmpv6-type %u", icmp->invert ? "! " : "", icmp->type6);
926                 else
927                         fw3_pr(" %s--icmpv6-type %u/%u",
928                                    icmp->invert ? "! " : "", icmp->type6, icmp->code6_min);
929         }
930 }
931
932 void
933 fw3_format_limit(struct fw3_limit *limit)
934 {
935         if (!limit)
936                 return;
937
938         const char *units[] = {
939                 [FW3_LIMIT_UNIT_SECOND] = "second",
940                 [FW3_LIMIT_UNIT_MINUTE] = "minute",
941                 [FW3_LIMIT_UNIT_HOUR]   = "hour",
942                 [FW3_LIMIT_UNIT_DAY]    = "day",
943         };
944
945         if (limit->rate > 0)
946         {
947                 fw3_pr(" -m limit %s--limit %u/%s",
948                        limit->invert ? "! " : "", limit->rate, units[limit->unit]);
949
950                 if (limit->burst > 0)
951                         fw3_pr(" --limit-burst %u", limit->burst);
952         }
953 }
954
955 void
956 fw3_format_ipset(struct fw3_ipset *ipset, bool invert)
957 {
958         bool first = true;
959         const char *name = NULL;
960         struct fw3_ipset_datatype *type;
961
962         if (!ipset)
963                 return;
964
965         if (ipset->external && *ipset->external)
966                 name = ipset->external;
967         else
968                 name = ipset->name;
969
970         fw3_pr(" -m set %s--match-set %s", invert ? "! " : "", name);
971
972         list_for_each_entry(type, &ipset->datatypes, list)
973         {
974                 fw3_pr("%c%s", first ? ' ' : ',', type->dest ? "dst" : "src");
975                 first = false;
976         }
977 }
978
979 void
980 fw3_format_time(struct fw3_time *time)
981 {
982         int i;
983         struct tm empty = { 0 };
984         char buf[sizeof("9999-99-99T23:59:59\0")];
985         bool d1 = memcmp(&time->datestart, &empty, sizeof(empty));
986         bool d2 = memcmp(&time->datestop, &empty, sizeof(empty));
987         bool first;
988
989         if (!d1 && !d2 && !time->timestart && !time->timestop &&
990             !(time->monthdays & 0xFFFFFFFE) && !(time->weekdays & 0xFE))
991         {
992                 return;
993         }
994
995         fw3_pr(" -m time");
996
997         if (time->utc)
998                 fw3_pr(" --utc");
999
1000         if (d1)
1001         {
1002                 strftime(buf, sizeof(buf), "%Y-%m-%dT%H:%M:%S", &time->datestart);
1003                 fw3_pr(" --datestart %s", buf);
1004         }
1005
1006         if (d2)
1007         {
1008                 strftime(buf, sizeof(buf), "%Y-%m-%dT%H:%M:%S", &time->datestop);
1009                 fw3_pr(" --datestop %s", buf);
1010         }
1011
1012         if (time->timestart)
1013         {
1014                 fw3_pr(" --timestart %02d:%02d:%02d",
1015                        time->timestart / 3600,
1016                        time->timestart % 3600 / 60,
1017                        time->timestart % 60);
1018         }
1019
1020         if (time->timestop)
1021         {
1022                 fw3_pr(" --timestop %02d:%02d:%02d",
1023                        time->timestop / 3600,
1024                        time->timestop % 3600 / 60,
1025                        time->timestop % 60);
1026         }
1027
1028         if (time->monthdays & 0xFFFFFFFE)
1029         {
1030                 fw3_pr(" %s--monthdays", hasbit(time->monthdays, 0) ? "! " : "");
1031
1032                 for (i = 1, first = true; i < 32; i++)
1033                 {
1034                         if (hasbit(time->monthdays, i))
1035                         {
1036                                 fw3_pr("%c%u", first ? ' ' : ',', i);
1037                                 first = false;
1038                         }
1039                 }
1040         }
1041
1042         if (time->weekdays & 0xFE)
1043         {
1044                 fw3_pr(" %s--weekdays", hasbit(time->weekdays, 0) ? "! " : "");
1045
1046                 for (i = 1, first = true; i < 8; i++)
1047                 {
1048                         if (hasbit(time->weekdays, i))
1049                         {
1050                                 fw3_pr("%c%u", first ? ' ' : ',', i);
1051                                 first = false;
1052                         }
1053                 }
1054         }
1055 }
1056
1057 void
1058 __fw3_format_comment(const char *comment, ...)
1059 {
1060         va_list ap;
1061         int len = 0;
1062         const char *c;
1063
1064         if (!comment || !*comment)
1065                 return;
1066
1067         fw3_pr(" -m comment --comment \"");
1068
1069         c = comment;
1070
1071         va_start(ap, comment);
1072
1073         do
1074         {
1075                 while (*c)
1076                 {
1077                         switch (*c)
1078                         {
1079                         case '"':
1080                         case '$':
1081                         case '`':
1082                         case '\\':
1083                                 fw3_pr("\\");
1084                                 /* fall through */
1085
1086                         default:
1087                                 fw3_pr("%c", *c);
1088                                 break;
1089                         }
1090
1091                         c++;
1092
1093                         if (len++ >= 255)
1094                                 goto end;
1095                 }
1096
1097                 c = va_arg(ap, const char *);
1098         }
1099         while (c);
1100
1101 end:
1102         va_end(ap);
1103         fw3_pr("\"");
1104 }
1105
1106 void
1107 fw3_format_extra(const char *extra)
1108 {
1109         if (!extra || !*extra)
1110                 return;
1111
1112         fw3_pr(" %s", extra);
1113 }