options.c

   1 /*
   2  * firewall3 - 3rd OpenWrt UCI firewall implementation
   3  *
   4  *   Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
   5  *
   6  * Permission to use, copy, modify, and/or distribute this software for any
   7  * purpose with or without fee is hereby granted, provided that the above
   8  * copyright notice and this permission notice appear in all copies.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17  */
  18
  19 #include "options.h"
  20
  21 const char *fw3_flag_names[FW3_DEFAULT_DROP_INVALID + 1] = {
  22         "filter",
  23         "nat",
  24         "mangle",
  25         "raw",
  26
  27         "IPv4",
  28         "IPv6",
  29
  30         "ACCEPT",
  31         "REJECT",
  32         "DROP",
  33         "NOTRACK",
  34         "DNAT",
  35         "SNAT",
  36 };
  37
  38 bool
  39 fw3_parse_bool(void *ptr, const char *val)
  40 {
  41         if (!strcmp(val, "true") || !strcmp(val, "yes") || !strcmp(val, "1"))
  42                 *((bool *)ptr) = true;
  43         else
  44                 *((bool *)ptr) = false;
  45
  46         return true;
  47 }
  48
  49 bool
  50 fw3_parse_int(void *ptr, const char *val)
  51 {
  52         int n = strtol(val, NULL, 10);
  53
  54         if (errno == ERANGE || errno == EINVAL)
  55                 return false;
  56
  57         *((int *)ptr) = n;
  58
  59         return true;
  60 }
  61
  62 bool
  63 fw3_parse_string(void *ptr, const char *val)
  64 {
  65         *((char **)ptr) = (char *)val;
  66         return true;
  67 }
  68
  69 bool
  70 fw3_parse_target(void *ptr, const char *val)
  71 {
  72         if (!strcmp(val, "ACCEPT"))
  73         {
  74                 *((enum fw3_target *)ptr) = FW3_TARGET_ACCEPT;
  75                 return true;
  76         }
  77         else if (!strcmp(val, "REJECT"))
  78         {
  79                 *((enum fw3_target *)ptr) = FW3_TARGET_REJECT;
  80                 return true;
  81         }
  82         else if (!strcmp(val, "DROP"))
  83         {
  84                 *((enum fw3_target *)ptr) = FW3_TARGET_DROP;
  85                 return true;
  86         }
  87         else if (!strcmp(val, "NOTRACK"))
  88         {
  89                 *((enum fw3_target *)ptr) = FW3_TARGET_NOTRACK;
  90                 return true;
  91         }
  92         else if (!strcmp(val, "DNAT"))
  93         {
  94                 *((enum fw3_target *)ptr) = FW3_TARGET_DNAT;
  95                 return true;
  96         }
  97         else if (!strcmp(val, "SNAT"))
  98         {
  99                 *((enum fw3_target *)ptr) = FW3_TARGET_SNAT;
 100                 return true;
 101         }
 102
 103         return false;
 104 }
 105
 106 bool
 107 fw3_parse_limit(void *ptr, const char *val)
 108 {
 109         struct fw3_limit *limit = ptr;
 110         enum fw3_limit_unit u = FW3_LIMIT_UNIT_SECOND;
 111         char *e;
 112         int n;
 113
 114         if (*val == '!')
 115         {
 116                 limit->invert = true;
 117                 while (isspace(*++val));
 118         }
 119
 120         n = strtol(val, &e, 10);
 121
 122         if (errno == ERANGE || errno == EINVAL)
 123                 return false;
 124
 125         if (*e && *e++ != '/')
 126                 return false;
 127
 128         if (!strlen(e))
 129                 return false;
 130
 131         if (!strncmp(e, "second", strlen(e)))
 132                 u = FW3_LIMIT_UNIT_SECOND;
 133         else if (!strncmp(e, "minute", strlen(e)))
 134                 u = FW3_LIMIT_UNIT_MINUTE;
 135         else if (!strncmp(e, "hour", strlen(e)))
 136                 u = FW3_LIMIT_UNIT_HOUR;
 137         else if (!strncmp(e, "day", strlen(e)))
 138                 u = FW3_LIMIT_UNIT_DAY;
 139         else
 140                 return false;
 141
 142         limit->rate = n;
 143         limit->unit = u;
 144
 145         return true;
 146 }
 147
 148 bool
 149 fw3_parse_device(void *ptr, const char *val)
 150 {
 151         struct fw3_device *dev = ptr;
 152
 153         if (*val == '*')
 154         {
 155                 dev->set = true;
 156                 dev->any = true;
 157                 return true;
 158         }
 159
 160         if (*val == '!')
 161         {
 162                 dev->invert = true;
 163                 while (isspace(*++val));
 164         }
 165
 166         if (*val)
 167                 snprintf(dev->name, sizeof(dev->name), "%s", val);
 168         else
 169                 return false;
 170
 171         dev->set = true;
 172         return true;
 173 }
 174
 175 bool
 176 fw3_parse_address(void *ptr, const char *val)
 177 {
 178         struct fw3_address *addr = ptr;
 179         struct in_addr v4;
 180         struct in6_addr v6;
 181         char *p, *s, *e;
 182         int i, m = -1;
 183
 184         if (*val == '!')
 185         {
 186                 addr->invert = true;
 187                 while (isspace(*++val));
 188         }
 189
 190         s = strdup(val);
 191
 192         if (!s)
 193                 return false;
 194
 195         if ((p = strchr(s, '/')) != NULL)
 196         {
 197                 *p++ = 0;
 198                 m = strtoul(p, &e, 10);
 199
 200                 if ((e == p) || (*e != 0))
 201                 {
 202                         if (strchr(s, ':') || !inet_pton(AF_INET, p, &v4))
 203                         {
 204                                 free(s);
 205                                 return false;
 206                         }
 207
 208                         for (i = 0, m = 32; !(v4.s_addr & 1) && (i < 32); i++)
 209                         {
 210                                 m--;
 211                                 v4.s_addr >>= 1;
 212                         }
 213                 }
 214         }
 215         else if ((p = strchr(s, '-')) != NULL)
 216         {
 217                 *p++ = 0;
 218
 219                 if (inet_pton(AF_INET6, p, &v6))
 220                 {
 221                         addr->family = FW3_FAMILY_V6;
 222                         addr->address2.v6 = v6;
 223                         addr->range = true;
 224                 }
 225                 else if (inet_pton(AF_INET, p, &v4))
 226                 {
 227                         addr->family = FW3_FAMILY_V4;
 228                         addr->address2.v4 = v4;
 229                         addr->range = true;
 230                 }
 231                 else
 232                 {
 233                         free(s);
 234                         return false;
 235                 }
 236         }
 237
 238         if (inet_pton(AF_INET6, s, &v6))
 239         {
 240                 addr->family = FW3_FAMILY_V6;
 241                 addr->address.v6 = v6;
 242                 addr->mask = (m >= 0) ? m : 128;
 243         }
 244         else if (inet_pton(AF_INET, s, &v4))
 245         {
 246                 addr->family = FW3_FAMILY_V4;
 247                 addr->address.v4 = v4;
 248                 addr->mask = (m >= 0) ? m : 32;
 249         }
 250         else
 251         {
 252                 free(s);
 253                 return false;
 254         }
 255
 256         free(s);
 257         addr->set = true;
 258         return true;
 259 }
 260
 261 bool
 262 fw3_parse_mac(void *ptr, const char *val)
 263 {
 264         struct fw3_mac *addr = ptr;
 265         struct ether_addr *mac;
 266
 267         if (*val == '!')
 268         {
 269                 addr->invert = true;
 270                 while (isspace(*++val));
 271         }
 272
 273         if ((mac = ether_aton(val)) != NULL)
 274         {
 275                 addr->mac = *mac;
 276                 addr->set = true;
 277                 return true;
 278         }
 279
 280         return false;
 281 }
 282
 283 bool
 284 fw3_parse_port(void *ptr, const char *val)
 285 {
 286         struct fw3_port *range = ptr;
 287         uint16_t n;
 288         uint16_t m;
 289         char *p;
 290
 291         if (*val == '!')
 292         {
 293                 range->invert = true;
 294                 while (isspace(*++val));
 295         }
 296
 297         n = strtoul(val, &p, 10);
 298
 299         if (errno == ERANGE || errno == EINVAL)
 300                 return false;
 301
 302         if (*p && *p != '-' && *p != ':')
 303                 return false;
 304
 305         if (*p)
 306         {
 307                 m = strtoul(++p, NULL, 10);
 308
 309                 if (errno == ERANGE || errno == EINVAL || m < n)
 310                         return false;
 311
 312                 range->port_min = n;
 313                 range->port_max = m;
 314         }
 315         else
 316         {
 317                 range->port_min = n;
 318                 range->port_max = n;
 319         }
 320
 321         range->set = true;
 322         return true;
 323 }
 324
 325 bool
 326 fw3_parse_family(void *ptr, const char *val)
 327 {
 328         if (!strcmp(val, "any"))
 329                 *((enum fw3_family *)ptr) = FW3_FAMILY_ANY;
 330         else if (!strcmp(val, "inet") || strrchr(val, '4'))
 331                 *((enum fw3_family *)ptr) = FW3_FAMILY_V4;
 332         else if (!strcmp(val, "inet6") || strrchr(val, '6'))
 333                 *((enum fw3_family *)ptr) = FW3_FAMILY_V6;
 334         else
 335                 return false;
 336
 337         return true;
 338 }
 339
 340 bool
 341 fw3_parse_icmptype(void *ptr, const char *val)
 342 {
 343         struct fw3_icmptype *icmp = ptr;
 344         bool v4 = false;
 345         bool v6 = false;
 346         char *p;
 347         int i;
 348
 349         for (i = 0; i < ARRAY_SIZE(fw3_icmptype_list_v4); i++)
 350         {
 351                 if (!strcmp(val, fw3_icmptype_list_v4[i].name))
 352                 {
 353                         icmp->type     = fw3_icmptype_list_v4[i].type;
 354                         icmp->code_min = fw3_icmptype_list_v4[i].code_min;
 355                         icmp->code_max = fw3_icmptype_list_v4[i].code_max;
 356
 357                         v4 = true;
 358                         break;
 359                 }
 360         }
 361
 362         for (i = 0; i < ARRAY_SIZE(fw3_icmptype_list_v6); i++)
 363         {
 364                 if (!strcmp(val, fw3_icmptype_list_v6[i].name))
 365                 {
 366                         icmp->type6     = fw3_icmptype_list_v6[i].type;
 367                         icmp->code6_min = fw3_icmptype_list_v6[i].code_min;
 368                         icmp->code6_max = fw3_icmptype_list_v6[i].code_max;
 369
 370                         v6 = true;
 371                         break;
 372                 }
 373         }
 374
 375         if (!v4 && !v6)
 376         {
 377                 i = strtoul(val, &p, 10);
 378
 379                 if ((p == val) || (*p != '/' && *p != 0) || (i > 0xFF))
 380                         return false;
 381
 382                 icmp->type = i;
 383
 384                 if (*p == '/')
 385                 {
 386                         val = ++p;
 387                         i = strtoul(val, &p, 10);
 388
 389                         if ((p == val) || (*p != 0) || (i > 0xFF))
 390                                 return false;
 391
 392                         icmp->code_min = i;
 393                         icmp->code_max = i;
 394                 }
 395                 else
 396                 {
 397                         icmp->code_min = 0;
 398                         icmp->code_max = 0xFF;
 399                 }
 400
 401                 icmp->type6     = icmp->type;
 402                 icmp->code6_min = icmp->code_max;
 403                 icmp->code6_max = icmp->code_max;
 404
 405                 v4 = true;
 406                 v6 = true;
 407         }
 408
 409         icmp->family = (v4 && v6) ? FW3_FAMILY_ANY
 410                                   : (v6 ? FW3_FAMILY_V6 : FW3_FAMILY_V4);
 411
 412         return true;
 413 }
 414
 415 bool
 416 fw3_parse_protocol(void *ptr, const char *val)
 417 {
 418         struct fw3_protocol *proto = ptr;
 419         struct protoent *ent;
 420
 421         if (*val == '!')
 422         {
 423                 proto->invert = true;
 424                 while (isspace(*++val));
 425         }
 426
 427         if (!strcmp(val, "all"))
 428         {
 429                 proto->any = true;
 430                 return true;
 431         }
 432         else if (!strcmp(val, "icmpv6"))
 433         {
 434                 val = "ipv6-icmp";
 435         }
 436
 437         ent = getprotobyname(val);
 438
 439         if (ent)
 440         {
 441                 proto->protocol = ent->p_proto;
 442                 return true;
 443         }
 444
 445         proto->protocol = strtoul(val, NULL, 10);
 446         return (errno != ERANGE && errno != EINVAL);
 447 }
 448
 449 bool
 450 fw3_parse_ipset_method(void *ptr, const char *val)
 451 {
 452         if (!strncmp(val, "bitmap", strlen(val)))
 453         {
 454                 *((enum fw3_ipset_method *)ptr) = FW3_IPSET_METHOD_BITMAP;
 455                 return true;
 456         }
 457         else if (!strncmp(val, "hash", strlen(val)))
 458         {
 459                 *((enum fw3_ipset_method *)ptr) = FW3_IPSET_METHOD_HASH;
 460                 return true;
 461         }
 462         else if (!strncmp(val, "list", strlen(val)))
 463         {
 464                 *((enum fw3_ipset_method *)ptr) = FW3_IPSET_METHOD_LIST;
 465                 return true;
 466         }
 467
 468         return false;
 469 }
 470
 471 bool
 472 fw3_parse_ipset_datatype(void *ptr, const char *val)
 473 {
 474         struct fw3_ipset_datatype *type = ptr;
 475
 476         if (!strncmp(val, "dest_", 5))
 477         {
 478                 val += 5;
 479                 type->dest = true;
 480         }
 481         else if (!strncmp(val, "dst_", 4))
 482         {
 483                 val += 4;
 484                 type->dest = true;
 485         }
 486         else if (!strncmp(val, "src_", 4))
 487         {
 488                 val += 4;
 489                 type->dest = false;
 490         }
 491
 492         if (!strncmp(val, "ip", strlen(val)))
 493         {
 494                 type->type = FW3_IPSET_TYPE_IP;
 495                 return true;
 496         }
 497         else if (!strncmp(val, "port", strlen(val)))
 498         {
 499                 type->type = FW3_IPSET_TYPE_PORT;
 500                 return true;
 501         }
 502         else if (!strncmp(val, "mac", strlen(val)))
 503         {
 504                 type->type = FW3_IPSET_TYPE_MAC;
 505                 return true;
 506         }
 507         else if (!strncmp(val, "net", strlen(val)))
 508         {
 509                 type->type = FW3_IPSET_TYPE_NET;
 510                 return true;
 511         }
 512         else if (!strncmp(val, "set", strlen(val)))
 513         {
 514                 type->type = FW3_IPSET_TYPE_SET;
 515                 return true;
 516         }
 517
 518         return false;
 519 }
 520
 521
 522 void
 523 fw3_parse_options(void *s, const struct fw3_option *opts,
 524                   struct uci_section *section)
 525 {
 526         char *p;
 527         bool known;
 528         struct uci_element *e, *l;
 529         struct uci_option *o;
 530         const struct fw3_option *opt;
 531         struct list_head *item;
 532         struct list_head *dest;
 533
 534         uci_foreach_element(&section->options, e)
 535         {
 536                 o = uci_to_option(e);
 537                 known = false;
 538
 539                 for (opt = opts; opt->name; opt++)
 540                 {
 541                         if (!opt->parse)
 542                                 continue;
 543
 544                         if (strcmp(opt->name, e->name))
 545                                 continue;
 546
 547                         if (o->type == UCI_TYPE_LIST)
 548                         {
 549                                 if (!opt->elem_size)
 550                                 {
 551                                         warn_elem(e, "must not be a list");
 552                                 }
 553                                 else
 554                                 {
 555                                         uci_foreach_element(&o->v.list, l)
 556                                         {
 557                                                 if (!l->name)
 558                                                         continue;
 559
 560                                                 item = malloc(opt->elem_size);
 561
 562                                                 if (!item)
 563                                                         continue;
 564
 565                                                 memset(item, 0, opt->elem_size);
 566
 567                                                 if (!opt->parse(item, l->name))
 568                                                 {
 569                                                         warn_elem(e, "has invalid value '%s'", l->name);
 570                                                         free(item);
 571                                                         continue;
 572                                                 }
 573
 574                                                 dest = (struct list_head *)((char *)s + opt->offset);
 575                                                 list_add_tail(item, dest);
 576                                         }
 577                                 }
 578                         }
 579                         else
 580                         {
 581                                 if (!o->v.string)
 582                                         continue;
 583
 584                                 if (!opt->elem_size)
 585                                 {
 586                                         if (!opt->parse((char *)s + opt->offset, o->v.string))
 587                                                 warn_elem(e, "has invalid value '%s'", o->v.string);
 588                                 }
 589                                 else
 590                                 {
 591                                         for (p = strtok(o->v.string, " \t");
 592                                              p != NULL;
 593                                              p = strtok(NULL, " \t"))
 594                                         {
 595                                                 item = malloc(opt->elem_size);
 596
 597                                                 if (!item)
 598                                                         continue;
 599
 600                                                 memset(item, 0, opt->elem_size);
 601
 602                                                 if (!opt->parse(item, p))
 603                                                 {
 604                                                         warn_elem(e, "has invalid value '%s'", p);
 605                                                         free(item);
 606                                                         continue;
 607                                                 }
 608
 609                                                 dest = (struct list_head *)((char *)s + opt->offset);
 610                                                 list_add_tail(item, dest);
 611                                         }
 612                                 }
 613                         }
 614
 615                         known = true;
 616                         break;
 617                 }
 618
 619                 if (!known)
 620                         warn_elem(e, "is unknown");
 621         }
 622 }
 623
 624
 625 void
 626 fw3_format_in_out(struct fw3_device *in, struct fw3_device *out)
 627 {
 628         if (in && !in->any)
 629                 fw3_pr(" %s-i %s", in->invert ? "! " : "", in->name);
 630
 631         if (out && !out->any)
 632                 fw3_pr(" %s-o %s", out->invert ? "! " : "", out->name);
 633 }
 634
 635 void
 636 fw3_format_src_dest(struct fw3_address *src, struct fw3_address *dest)
 637 {
 638         char s[INET6_ADDRSTRLEN];
 639
 640         if ((src && src->range) || (dest && dest->range))
 641                 fw3_pr(" -m iprange");
 642
 643         if (src && src->set)
 644         {
 645                 if (src->range)
 646                 {
 647                         inet_ntop(src->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
 648                                           &src->address.v4, s, sizeof(s));
 649
 650                         fw3_pr(" %s--src-range %s", src->invert ? "! " : "", s);
 651
 652                         inet_ntop(src->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
 653                                           &src->address2.v4, s, sizeof(s));
 654
 655                         fw3_pr("-%s", s);
 656                 }
 657                 else
 658                 {
 659                         inet_ntop(src->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
 660                                           &src->address.v4, s, sizeof(s));
 661
 662                         fw3_pr(" %s-s %s/%u", src->invert ? "! " : "", s, src->mask);
 663                 }
 664         }
 665
 666         if (dest && dest->set)
 667         {
 668                 if (dest->range)
 669                 {
 670                         inet_ntop(dest->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
 671                                           &dest->address.v4, s, sizeof(s));
 672
 673                         fw3_pr(" %s--dst-range %s", dest->invert ? "! " : "", s);
 674
 675                         inet_ntop(dest->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
 676                                           &dest->address2.v4, s, sizeof(s));
 677
 678                         fw3_pr("-%s", s);
 679                 }
 680                 else
 681                 {
 682                         inet_ntop(dest->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
 683                                           &dest->address.v4, s, sizeof(s));
 684
 685                         fw3_pr(" %s-d %s/%u", dest->invert ? "! " : "", s, dest->mask);
 686                 }
 687         }
 688 }
 689
 690 void
 691 fw3_format_sport_dport(struct fw3_port *sp, struct fw3_port *dp)
 692 {
 693         if (sp && sp->set)
 694         {
 695                 if (sp->port_min == sp->port_max)
 696                         fw3_pr(" %s--sport %u", sp->invert ? "! " : "", sp->port_min);
 697                 else
 698                         fw3_pr(" %s--sport %u:%u",
 699                                sp->invert ? "! " : "", sp->port_min, sp->port_max);
 700         }
 701
 702         if (dp && dp->set)
 703         {
 704                 if (dp->port_min == dp->port_max)
 705                         fw3_pr(" %s--dport %u", dp->invert ? "! " : "", dp->port_min);
 706                 else
 707                         fw3_pr(" %s--dport %u:%u",
 708                                dp->invert ? "! " : "", dp->port_min, dp->port_max);
 709         }
 710 }
 711
 712 void
 713 fw3_format_mac(struct fw3_mac *mac)
 714 {
 715         if (!mac)
 716                 return;
 717
 718         fw3_pr(" -m mac %s--mac-source %s",
 719                mac->invert ? "! " : "", ether_ntoa(&mac->mac));
 720 }
 721
 722 void
 723 fw3_format_protocol(struct fw3_protocol *proto, enum fw3_family family)
 724 {
 725         uint16_t pr;
 726
 727         if (!proto)
 728                 return;
 729
 730         pr = proto->protocol;
 731
 732         if (pr == 1 && family == FW3_FAMILY_V6)
 733                 pr = 58;
 734
 735         if (proto->any)
 736                 fw3_pr(" -p all");
 737         else
 738                 fw3_pr(" %s-p %u", proto->invert ? "! " : "", pr);
 739 }
 740
 741 void
 742 fw3_format_icmptype(struct fw3_icmptype *icmp, enum fw3_family family)
 743 {
 744         if (!icmp)
 745                 return;
 746
 747         if (family != FW3_FAMILY_V6)
 748         {
 749                 if (icmp->code_min == 0 && icmp->code_max == 0xFF)
 750                         fw3_pr(" %s--icmp-type %u", icmp->invert ? "! " : "", icmp->type);
 751                 else
 752                         fw3_pr(" %s--icmp-type %u/%u",
 753                                    icmp->invert ? "! " : "", icmp->type, icmp->code_min);
 754         }
 755         else
 756         {
 757                 if (icmp->code6_min == 0 && icmp->code6_max == 0xFF)
 758                         fw3_pr(" %s--icmpv6-type %u", icmp->invert ? "! " : "", icmp->type6);
 759                 else
 760                         fw3_pr(" %s--icmpv6-type %u/%u",
 761                                    icmp->invert ? "! " : "", icmp->type6, icmp->code6_min);
 762         }
 763 }
 764
 765 void
 766 fw3_format_limit(struct fw3_limit *limit)
 767 {
 768         if (!limit)
 769                 return;
 770
 771         const char *units[] = {
 772                 [FW3_LIMIT_UNIT_SECOND] = "second",
 773                 [FW3_LIMIT_UNIT_MINUTE] = "minute",
 774                 [FW3_LIMIT_UNIT_HOUR]   = "hour",
 775                 [FW3_LIMIT_UNIT_DAY]    = "day",
 776         };
 777
 778         if (limit->rate > 0)
 779         {
 780                 fw3_pr(" -m limit %s--limit %u/%s",
 781                        limit->invert ? "! " : "", limit->rate, units[limit->unit]);
 782
 783                 if (limit->burst > 0)
 784                         fw3_pr(" --limit-burst %u", limit->burst);
 785         }
 786 }
 787
 788 void
 789 fw3_format_ipset(struct fw3_ipset *ipset, bool invert)
 790 {
 791         bool first = true;
 792         const char *name = NULL;
 793         struct fw3_ipset_datatype *type;
 794
 795         if (!ipset)
 796                 return;
 797
 798         if (ipset->external && *ipset->external)
 799                 name = ipset->external;
 800         else
 801                 name = ipset->name;
 802
 803         fw3_pr(" -m set %s--match-set %s", invert ? "! " : "", name);
 804
 805         list_for_each_entry(type, &ipset->datatypes, list)
 806         {
 807                 fw3_pr("%c%s", first ? ' ' : ',', type->dest ? "dst" : "src");
 808                 first = false;
 809         }
 810 }
 811
 812 void
 813 __fw3_format_comment(const char *comment, ...)
 814 {
 815         va_list ap;
 816         int len = 0;
 817         const char *c;
 818
 819         if (!comment || !*comment)
 820                 return;
 821
 822         fw3_pr(" -m comment --comment \"");
 823
 824         c = comment;
 825
 826         va_start(ap, comment);
 827
 828         do
 829         {
 830                 while (*c)
 831                 {
 832                         switch (*c)
 833                         {
 834                         case '"':
 835                         case '$':
 836                         case '`':
 837                         case '\\':
 838                                 fw3_pr("\\");
 839                                 /* fall through */
 840
 841                         default:
 842                                 fw3_pr("%c", *c);
 843                                 break;
 844                         }
 845
 846                         c++;
 847
 848                         if (len++ >= 255)
 849                                 goto end;
 850                 }
 851
 852                 c = va_arg(ap, const char *);
 853         }
 854         while (c);
 855
 856 end:
 857         va_end(ap);
 858         fw3_pr("\"");
 859 }
 860
 861 void
 862 fw3_format_extra(const char *extra)
 863 {
 864         if (!extra || !*extra)
 865                 return;
 866
 867         fw3_pr(" %s", extra);
 868 }