Also add comments for unnamed rules
[project/firewall3.git] / defaults.c
index 95a9e22..d1c5e2c 100644 (file)
 #include "defaults.h"
 
 
-#define C(f, tbl, def, name) \
-       { FW3_FAMILY_##f, FW3_TABLE_##tbl, FW3_DEFAULT_##def, name }
+#define C(f, tbl, def, fmt) \
+       { FW3_FAMILY_##f, FW3_TABLE_##tbl, FW3_FLAG_##def, fmt }
 
-struct chain {
-       enum fw3_family family;
-       enum fw3_table table;
-       enum fw3_default flag;
-       const char *name;
-};
-
-static const struct chain default_chains[] = {
+static const struct fw3_chain_spec default_chains[] = {
        C(ANY, FILTER, UNSPEC,        "delegate_input"),
        C(ANY, FILTER, UNSPEC,        "delegate_output"),
        C(ANY, FILTER, UNSPEC,        "delegate_forward"),
+       C(ANY, FILTER, UNSPEC,        "reject"),
        C(ANY, FILTER, CUSTOM_CHAINS, "input_rule"),
        C(ANY, FILTER, CUSTOM_CHAINS, "output_rule"),
        C(ANY, FILTER, CUSTOM_CHAINS, "forwarding_rule"),
-       C(ANY, FILTER, UNSPEC,        "reject"),
        C(ANY, FILTER, SYN_FLOOD,     "syn_flood"),
 
        C(V4,  NAT,    UNSPEC,        "delegate_prerouting"),
@@ -45,22 +38,14 @@ static const struct chain default_chains[] = {
        C(V4,  NAT,    CUSTOM_CHAINS, "postrouting_rule"),
 
        C(ANY, MANGLE, UNSPEC,        "mssfix"),
-       C(ANY, RAW,    UNSPEC,        "notrack"),
-};
+       C(ANY, MANGLE, UNSPEC,        "fwmark"),
 
-static const struct chain toplevel_rules[] = {
-       C(ANY, FILTER, UNSPEC,        "INPUT -j delegate_input"),
-       C(ANY, FILTER, UNSPEC,        "OUTPUT -j delegate_output"),
-       C(ANY, FILTER, UNSPEC,        "FORWARD -j delegate_forward"),
-
-       C(V4,  NAT,    UNSPEC,        "PREROUTING -j delegate_prerouting"),
-       C(V4,  NAT,    UNSPEC,        "POSTROUTING -j delegate_postrouting"),
+       C(ANY, RAW,    UNSPEC,        "notrack"),
 
-       C(ANY, MANGLE, UNSPEC,        "FORWARD -j mssfix"),
-       C(ANY, RAW,    UNSPEC,        "PREROUTING -j notrack"),
+       { }
 };
 
-const struct fw3_option fw3_default_opts[] = {
+const struct fw3_option fw3_flag_opts[] = {
        FW3_OPT("input",               target,   defaults, policy_input),
        FW3_OPT("forward",             target,   defaults, policy_forward),
        FW3_OPT("output",              target,   defaults, policy_output),
@@ -82,49 +67,25 @@ const struct fw3_option fw3_default_opts[] = {
        FW3_OPT("custom_chains",       bool,     defaults, custom_chains),
        FW3_OPT("disable_ipv6",        bool,     defaults, disable_ipv6),
 
+       FW3_OPT("__flags_v4",          int,      defaults, flags[0]),
+       FW3_OPT("__flags_v6",          int,      defaults, flags[1]),
+
        { }
 };
 
 
-static bool
-print_chains(enum fw3_table table, enum fw3_family family,
-             const char *fmt, uint32_t flags,
-             const struct chain *chains, int n)
-{
-       bool rv = false;
-       const struct chain *c;
-
-       for (c = chains; n > 0; c++, n--)
-       {
-               if (!fw3_is_family(c, family))
-                       continue;
-
-               if (c->table != table)
-                       continue;
-
-               if ((c->flag != FW3_DEFAULT_UNSPEC) && !hasbit(flags, c->flag))
-                       continue;
-
-               fw3_pr(fmt, c->name);
-
-               rv = true;
-       }
-
-       return rv;
-}
-
 static void
-check_policy(struct uci_element *e, enum fw3_target *pol, const char *name)
+check_policy(struct uci_element *e, enum fw3_flag *pol, const char *name)
 {
-       if (*pol == FW3_TARGET_UNSPEC)
+       if (*pol == FW3_FLAG_UNSPEC)
        {
                warn_elem(e, "has no %s policy specified, defaulting to DROP", name);
-               *pol = FW3_TARGET_DROP;
+               *pol = FW3_FLAG_DROP;
        }
-       else if (*pol > FW3_TARGET_DROP)
+       else if (*pol > FW3_FLAG_DROP)
        {
                warn_elem(e, "has invalid %s policy, defaulting to DROP", name);
-               *pol = FW3_TARGET_DROP;
+               *pol = FW3_FLAG_DROP;
        }
 }
 
@@ -143,8 +104,6 @@ fw3_load_defaults(struct fw3_state *state, struct uci_package *p)
        defs->tcp_window_scaling   = true;
        defs->custom_chains        = true;
 
-       setbit(defs->flags, FW3_FAMILY_V4);
-
        uci_foreach_element(&p->sections, e)
        {
                s = uci_to_section(e);
@@ -158,116 +117,195 @@ fw3_load_defaults(struct fw3_state *state, struct uci_package *p)
                        continue;
                }
 
-               fw3_parse_options(&state->defaults, fw3_default_opts, s);
+               fw3_parse_options(&state->defaults, fw3_flag_opts, s);
 
                check_policy(e, &defs->policy_input, "input");
                check_policy(e, &defs->policy_output, "output");
                check_policy(e, &defs->policy_forward, "forward");
-
-               if (!defs->disable_ipv6)
-                       setbit(defs->flags, FW3_FAMILY_V6);
-
-               if (defs->custom_chains)
-                       setbit(defs->flags, FW3_DEFAULT_CUSTOM_CHAINS);
-
-               if (defs->syn_flood)
-                       setbit(defs->flags, FW3_DEFAULT_SYN_FLOOD);
        }
 }
 
 void
-fw3_print_default_chains(enum fw3_table table, enum fw3_family family,
-                         struct fw3_state *state)
+fw3_print_default_chains(struct fw3_ipt_handle *handle, struct fw3_state *state,
+                         bool reload)
 {
        struct fw3_defaults *defs = &state->defaults;
-       uint32_t custom_mask = ~0;
+       const struct fw3_chain_spec *c;
 
 #define policy(t) \
-       ((t == FW3_TARGET_REJECT) ? "DROP" : fw3_flag_names[t])
+       ((t == FW3_FLAG_REJECT) ? FW3_FLAG_DROP : t)
 
-       if (table == FW3_TABLE_FILTER)
+       if (handle->family == FW3_FAMILY_V6 && defs->disable_ipv6)
+               return;
+
+       if (handle->table == FW3_TABLE_FILTER)
        {
-               fw3_pr(":INPUT %s [0:0]\n", policy(defs->policy_input));
-               fw3_pr(":FORWARD %s [0:0]\n", policy(defs->policy_forward));
-               fw3_pr(":OUTPUT %s [0:0]\n", policy(defs->policy_output));
+               fw3_ipt_set_policy(handle, "INPUT",   policy(defs->policy_input));
+               fw3_ipt_set_policy(handle, "OUTPUT",  policy(defs->policy_output));
+               fw3_ipt_set_policy(handle, "FORWARD", policy(defs->policy_forward));
        }
 
-       /* user chains already loaded, don't create again */
-       if (hasbit(state->running_defaults.flags, FW3_DEFAULT_CUSTOM_CHAINS))
-               delbit(custom_mask, FW3_DEFAULT_CUSTOM_CHAINS);
+       if (defs->custom_chains)
+               set(defs->flags, handle->family, FW3_FLAG_CUSTOM_CHAINS);
+
+       if (defs->syn_flood)
+               set(defs->flags, handle->family, FW3_FLAG_SYN_FLOOD);
+
+       for (c = default_chains; c->format; c++)
+       {
+               /* don't touch user chains on selective stop */
+               if (reload && c->flag == FW3_FLAG_CUSTOM_CHAINS)
+                       continue;
+
+               if (!fw3_is_family(c, handle->family))
+                       continue;
+
+               if (c->table != handle->table)
+                       continue;
+
+               if (c->flag &&
+                   !hasbit(defs->flags[handle->family == FW3_FAMILY_V6], c->flag))
+                       continue;
+
+               fw3_ipt_create_chain(handle, c->format);
+       }
 
-       print_chains(table, family, ":%s - [0:0]\n", defs->flags & custom_mask,
-                    default_chains, ARRAY_SIZE(default_chains));
+       set(defs->flags, handle->family, handle->table);
 }
 
+
+struct toplevel_rule {
+       enum fw3_table table;
+       const char *chain;
+       const char *target;
+};
+
 void
-fw3_print_default_head_rules(enum fw3_table table, enum fw3_family family,
-                             struct fw3_state *state)
+fw3_print_default_head_rules(struct fw3_ipt_handle *handle,
+                             struct fw3_state *state, bool reload)
 {
        int i;
        struct fw3_defaults *defs = &state->defaults;
+       struct fw3_device lodev = { .set = true };
+       struct fw3_protocol tcp = { .protocol = 6 };
+       struct fw3_ipt_rule *r;
+       struct toplevel_rule *tr;
+
        const char *chains[] = {
-               "input", "input",
-               "output", "output",
-               "forward", "forwarding",
+               "delegate_input", "input",
+               "delegate_output", "output",
+               "delegate_forward", "forwarding",
        };
 
-       print_chains(table, family, "-A %s\n", 0,
-                    toplevel_rules, ARRAY_SIZE(toplevel_rules));
+       struct toplevel_rule rules[] = {
+               { FW3_TABLE_FILTER, "INPUT",       "delegate_input" },
+               { FW3_TABLE_FILTER, "OUTPUT",      "delegate_output" },
+               { FW3_TABLE_FILTER, "FORWARD",     "delegate_forward" },
+
+               { FW3_TABLE_NAT,    "PREROUTING",  "delegate_prerouting" },
+               { FW3_TABLE_NAT,    "POSTROUTING", "delegate_postrouting" },
+
+               { FW3_TABLE_MANGLE, "FORWARD",     "mssfix" },
+               { FW3_TABLE_MANGLE, "PREROUTING",  "fwmark" },
+
+               { FW3_TABLE_RAW,    "PREROUTING",  "notrack" },
 
-       switch (table)
+               { 0, NULL },
+       };
+
+       for (tr = rules; tr->chain; tr++)
+       {
+               if (tr->table != handle->table)
+                       continue;
+
+               r = fw3_ipt_rule_new(handle);
+               fw3_ipt_rule_target(r, tr->target);
+               fw3_ipt_rule_append(r, tr->chain);
+       }
+
+       switch (handle->table)
        {
        case FW3_TABLE_FILTER:
-               fw3_pr("-A delegate_input -i lo -j ACCEPT\n");
-               fw3_pr("-A delegate_output -o lo -j ACCEPT\n");
+
+               sprintf(lodev.name, "lo");
+
+               r = fw3_ipt_rule_create(handle, NULL, &lodev, NULL, NULL, NULL);
+               fw3_ipt_rule_target(r, "ACCEPT");
+               fw3_ipt_rule_append(r, "delegate_input");
+
+               r = fw3_ipt_rule_create(handle, NULL, NULL, &lodev, NULL, NULL);
+               fw3_ipt_rule_target(r, "ACCEPT");
+               fw3_ipt_rule_append(r, "delegate_output");
 
                if (defs->custom_chains)
                {
                        for (i = 0; i < ARRAY_SIZE(chains); i += 2)
                        {
-                               fw3_pr("-A delegate_%s -m comment "
-                                      "--comment \"user chain for %s\" -j %s_rule\n",
-                                          chains[i], chains[i+1], chains[i+1]);
+                               r = fw3_ipt_rule_new(handle);
+                               fw3_ipt_rule_comment(r, "user chain for %s", chains[i+1]);
+                               fw3_ipt_rule_target(r, chains[i+1]);
+                               fw3_ipt_rule_append(r, chains[i]);
                        }
                }
 
                for (i = 0; i < ARRAY_SIZE(chains); i += 2)
                {
-                       fw3_pr("-A delegate_%s -m conntrack --ctstate RELATED,ESTABLISHED "
-                              "-j ACCEPT\n", chains[i]);
+                       r = fw3_ipt_rule_new(handle);
+                       fw3_ipt_rule_extra(r, "-m conntrack --ctstate RELATED,ESTABLISHED");
+                       fw3_ipt_rule_target(r, "ACCEPT");
+                       fw3_ipt_rule_append(r, chains[i]);
 
                        if (defs->drop_invalid)
                        {
-                               fw3_pr("-A delegate_%s -m conntrack --ctstate INVALID -j DROP\n",
-                                      chains[i]);
+                               r = fw3_ipt_rule_new(handle);
+                               fw3_ipt_rule_extra(r, "-m conntrack --ctstate INVALID");
+                               fw3_ipt_rule_target(r, "DROP");
+                               fw3_ipt_rule_append(r, chains[i]);
                        }
                }
 
                if (defs->syn_flood)
                {
-                       fw3_pr("-A syn_flood -p tcp --syn");
-                       fw3_format_limit(&defs->syn_flood_rate);
-                       fw3_pr(" -j RETURN\n");
-
-                       fw3_pr("-A syn_flood -j DROP\n");
-                       fw3_pr("-A delegate_input -p tcp --syn -j syn_flood\n");
+                       r = fw3_ipt_rule_create(handle, &tcp, NULL, NULL, NULL, NULL);
+                       fw3_ipt_rule_extra(r, "--syn");
+                       fw3_ipt_rule_limit(r, &defs->syn_flood_rate);
+                       fw3_ipt_rule_target(r, "RETURN");
+                       fw3_ipt_rule_append(r, "syn_flood");
+
+                       r = fw3_ipt_rule_new(handle);
+                       fw3_ipt_rule_target(r, "DROP");
+                       fw3_ipt_rule_append(r, "syn_flood");
+
+                       r = fw3_ipt_rule_create(handle, &tcp, NULL, NULL, NULL, NULL);
+                       fw3_ipt_rule_extra(r, "--syn");
+                       fw3_ipt_rule_target(r, "syn_flood");
+                       fw3_ipt_rule_append(r, "delegate_input");
                }
 
-               fw3_pr("-A reject -p tcp -j REJECT --reject-with tcp-reset\n");
-               fw3_pr("-A reject -j REJECT --reject-with port-unreach\n");
+               r = fw3_ipt_rule_create(handle, &tcp, NULL, NULL, NULL, NULL);
+               fw3_ipt_rule_target(r, "REJECT");
+               fw3_ipt_rule_addarg(r, false, "--reject-with", "tcp-reset");
+               fw3_ipt_rule_append(r, "reject");
+
+               r = fw3_ipt_rule_new(handle);
+               fw3_ipt_rule_target(r, "REJECT");
+               fw3_ipt_rule_addarg(r, false, "--reject-with", "port-unreach");
+               fw3_ipt_rule_append(r, "reject");
 
                break;
 
        case FW3_TABLE_NAT:
                if (defs->custom_chains)
                {
-                       fw3_pr("-A delegate_prerouting "
-                              "-m comment --comment \"user chain for prerouting\" "
-                              "-j prerouting_rule\n");
-
-                       fw3_pr("-A delegate_postrouting "
-                              "-m comment --comment \"user chain for postrouting\" "
-                              "-j postrouting_rule\n");
+                       r = fw3_ipt_rule_new(handle);
+                       fw3_ipt_rule_comment(r, "user chain for prerouting");
+                       fw3_ipt_rule_target(r, "prerouting_rule");
+                       fw3_ipt_rule_append(r, "delegate_prerouting");
+
+                       r = fw3_ipt_rule_new(handle);
+                       fw3_ipt_rule_comment(r, "user chain for postrouting");
+                       fw3_ipt_rule_target(r, "postrouting_rule");
+                       fw3_ipt_rule_append(r, "delegate_postrouting");
                }
                break;
 
@@ -277,22 +315,47 @@ fw3_print_default_head_rules(enum fw3_table table, enum fw3_family family,
 }
 
 void
-fw3_print_default_tail_rules(enum fw3_table table, enum fw3_family family,
-                             struct fw3_state *state)
+fw3_print_default_tail_rules(struct fw3_ipt_handle *handle,
+                             struct fw3_state *state, bool reload)
 {
        struct fw3_defaults *defs = &state->defaults;
+       struct fw3_ipt_rule *r;
 
-       if (table != FW3_TABLE_FILTER)
+       if (handle->table != FW3_TABLE_FILTER)
                return;
 
-       if (defs->policy_input == FW3_TARGET_REJECT)
-               fw3_pr("-A delegate_input -j reject\n");
+       if (defs->policy_input == FW3_FLAG_REJECT)
+       {
+               r = fw3_ipt_rule_new(handle);
+
+               if (!r)
+                       return;
 
-       if (defs->policy_output == FW3_TARGET_REJECT)
-               fw3_pr("-A delegate_output -j reject\n");
+               fw3_ipt_rule_target(r, "reject");
+               fw3_ipt_rule_append(r, "delegate_input");
+       }
+
+       if (defs->policy_output == FW3_FLAG_REJECT)
+       {
+               r = fw3_ipt_rule_new(handle);
+
+               if (!r)
+                       return;
+
+               fw3_ipt_rule_target(r, "reject");
+               fw3_ipt_rule_append(r, "delegate_output");
+       }
 
-       if (defs->policy_forward == FW3_TARGET_REJECT)
-               fw3_pr("-A delegate_forward -j reject\n");
+       if (defs->policy_forward == FW3_FLAG_REJECT)
+       {
+               r = fw3_ipt_rule_new(handle);
+
+               if (!r)
+                       return;
+
+               fw3_ipt_rule_target(r, "reject");
+               fw3_ipt_rule_append(r, "delegate_forward");
+       }
 }
 
 static void
@@ -318,61 +381,61 @@ set_default(const char *name, bool set)
 void
 fw3_set_defaults(struct fw3_state *state)
 {
-       info("Setting sysctl values");
-
        set_default("ecn",            state->defaults.tcp_ecn);
        set_default("syncookies",     state->defaults.tcp_syncookies);
        set_default("window_scaling", state->defaults.tcp_window_scaling);
 }
 
-static void
-reset_policy(enum fw3_table table, enum fw3_target policy)
-{
-       if (table != FW3_TABLE_FILTER)
-               return;
-
-       fw3_pr(":INPUT %s [0:0]\n", fw3_flag_names[policy]);
-       fw3_pr(":OUTPUT %s [0:0]\n", fw3_flag_names[policy]);
-       fw3_pr(":FORWARD %s [0:0]\n", fw3_flag_names[policy]);
-}
-
 void
-fw3_flush_rules(enum fw3_table table, enum fw3_family family,
-                bool pass2, struct fw3_state *state, enum fw3_target policy)
+fw3_flush_rules(struct fw3_ipt_handle *handle, struct fw3_state *state,
+                bool reload)
 {
-       struct fw3_defaults *d = &state->running_defaults;
-       uint32_t custom_mask = ~0;
+       enum fw3_flag policy = reload ? FW3_FLAG_DROP : FW3_FLAG_ACCEPT;
+       struct fw3_defaults *defs = &state->defaults;
+       const struct fw3_chain_spec *c;
 
-       if (!hasbit(d->flags, family))
+       if (!has(defs->flags, handle->family, handle->table))
                return;
 
-       /* don't touch user chains on selective stop */
-       delbit(custom_mask, FW3_DEFAULT_CUSTOM_CHAINS);
+       if (handle->table == FW3_TABLE_FILTER)
+       {
+               fw3_ipt_set_policy(handle, "INPUT",   policy);
+               fw3_ipt_set_policy(handle, "OUTPUT",  policy);
+               fw3_ipt_set_policy(handle, "FORWARD", policy);
+       }
 
-       if (!pass2)
+       for (c = default_chains; c->format; c++)
        {
-               reset_policy(table, policy);
+               /* don't touch user chains on selective stop */
+               if (reload && c->flag == FW3_FLAG_CUSTOM_CHAINS)
+                       continue;
 
-               print_chains(table, family, "-D %s\n", d->flags & custom_mask,
-                                        toplevel_rules, ARRAY_SIZE(toplevel_rules));
+               if (!fw3_is_family(c, handle->family))
+                       continue;
 
-               print_chains(table, family, "-F %s\n", d->flags & custom_mask,
-                                        default_chains, ARRAY_SIZE(default_chains));
-       }
-       else
-       {
-               print_chains(table, family, "-X %s\n", d->flags & custom_mask,
-                                        default_chains, ARRAY_SIZE(default_chains));
+               if (c->table != handle->table)
+                       continue;
+
+               if (c->flag &&
+                   !hasbit(defs->flags[handle->family == FW3_FAMILY_V6], c->flag))
+                       continue;
 
-               delbit(d->flags, family);
+               fw3_ipt_delete_rules(handle, c->format);
+               fw3_ipt_delete_chain(handle, c->format);
        }
+
+       del(defs->flags, handle->family, handle->table);
 }
 
 void
-fw3_flush_all(enum fw3_table table)
+fw3_flush_all(struct fw3_ipt_handle *handle)
 {
-       reset_policy(table, FW3_TARGET_ACCEPT);
+       if (handle->table == FW3_TABLE_FILTER)
+       {
+               fw3_ipt_set_policy(handle, "INPUT",   FW3_FLAG_ACCEPT);
+               fw3_ipt_set_policy(handle, "OUTPUT",  FW3_FLAG_ACCEPT);
+               fw3_ipt_set_policy(handle, "FORWARD", FW3_FLAG_ACCEPT);
+       }
 
-       fw3_pr("-F\n");
-       fw3_pr("-X\n");
+       fw3_ipt_flush(handle);
 }