#include "defaults.h"
-static struct fw3_option default_opts[] = {
+#define C(f, tbl, def, name) \
+ { FW3_FAMILY_##f, FW3_TABLE_##tbl, FW3_DEFAULT_##def, name }
+
+struct chain {
+ enum fw3_family family;
+ enum fw3_table table;
+ enum fw3_default flag;
+ const char *name;
+};
+
+static const struct chain default_chains[] = {
+ C(ANY, FILTER, UNSPEC, "delegate_input"),
+ C(ANY, FILTER, UNSPEC, "delegate_output"),
+ C(ANY, FILTER, UNSPEC, "delegate_forward"),
+ C(ANY, FILTER, CUSTOM_CHAINS, "input_rule"),
+ C(ANY, FILTER, CUSTOM_CHAINS, "output_rule"),
+ C(ANY, FILTER, CUSTOM_CHAINS, "forwarding_rule"),
+ C(ANY, FILTER, UNSPEC, "reject"),
+ C(ANY, FILTER, SYN_FLOOD, "syn_flood"),
+
+ C(V4, NAT, UNSPEC, "delegate_prerouting"),
+ C(V4, NAT, UNSPEC, "delegate_postrouting"),
+ C(V4, NAT, CUSTOM_CHAINS, "prerouting_rule"),
+ C(V4, NAT, CUSTOM_CHAINS, "postrouting_rule"),
+
+ C(ANY, MANGLE, UNSPEC, "mssfix"),
+ C(ANY, RAW, UNSPEC, "notrack"),
+};
+
+static const struct chain toplevel_rules[] = {
+ C(ANY, FILTER, UNSPEC, "INPUT -j delegate_input"),
+ C(ANY, FILTER, UNSPEC, "OUTPUT -j delegate_output"),
+ C(ANY, FILTER, UNSPEC, "FORWARD -j delegate_forward"),
+
+ C(V4, NAT, UNSPEC, "PREROUTING -j delegate_prerouting"),
+ C(V4, NAT, UNSPEC, "POSTROUTING -j delegate_postrouting"),
+
+ C(ANY, MANGLE, UNSPEC, "FORWARD -j mssfix"),
+ C(ANY, RAW, UNSPEC, "PREROUTING -j notrack"),
+};
+
+const struct fw3_option fw3_default_opts[] = {
FW3_OPT("input", target, defaults, policy_input),
FW3_OPT("forward", target, defaults, policy_forward),
FW3_OPT("output", target, defaults, policy_output),
FW3_OPT("custom_chains", bool, defaults, custom_chains),
FW3_OPT("disable_ipv6", bool, defaults, disable_ipv6),
+
+ { }
};
+static bool
+print_chains(enum fw3_table table, enum fw3_family family,
+ const char *fmt, uint16_t flags,
+ const struct chain *chains, int n)
+{
+ bool rv = false;
+ const struct chain *c;
+
+ for (c = chains; n > 0; c++, n--)
+ {
+ if (!fw3_is_family(c, family))
+ continue;
+
+ if (c->table != table)
+ continue;
+
+ if ((c->flag != FW3_DEFAULT_UNSPEC) && !hasbit(flags, c->flag))
+ continue;
+
+ fw3_pr(fmt, c->name);
+
+ rv = true;
+ }
+
+ return rv;
+}
+
static void
check_policy(struct uci_element *e, enum fw3_target *pol, const char *name)
{
defs->tcp_window_scaling = true;
defs->custom_chains = true;
+ setbit(defs->flags, FW3_FAMILY_V4);
+
uci_foreach_element(&p->sections, e)
{
s = uci_to_section(e);
continue;
}
- fw3_parse_options(&state->defaults,
- default_opts, ARRAY_SIZE(default_opts), s);
+ fw3_parse_options(&state->defaults, fw3_default_opts, s);
check_policy(e, &defs->policy_input, "input");
check_policy(e, &defs->policy_output, "output");
check_policy(e, &defs->policy_forward, "forward");
+
+ if (!defs->disable_ipv6)
+ setbit(defs->flags, FW3_FAMILY_V6);
+
+ if (defs->custom_chains)
+ setbit(defs->flags, FW3_DEFAULT_CUSTOM_CHAINS);
+
+ if (defs->syn_flood)
+ setbit(defs->flags, FW3_DEFAULT_SYN_FLOOD);
}
}
struct fw3_state *state)
{
struct fw3_defaults *defs = &state->defaults;
- const char *policy[] = {
- "(bug)",
- "ACCEPT",
- "DROP",
- "DROP",
- "(bug)",
- "(bug)",
- "(bug)",
- };
+ uint16_t mask = ~0;
- switch (table)
- {
- case FW3_TABLE_FILTER:
- fw3_pr(":INPUT %s [0:0]\n", policy[defs->policy_input]);
- fw3_pr(":FORWARD %s [0:0]\n", policy[defs->policy_forward]);
- fw3_pr(":OUTPUT %s [0:0]\n", policy[defs->policy_output]);
-
- if (defs->custom_chains)
- {
- fw3_pr(":input_rule - [0:0]\n");
- fw3_pr(":output_rule - [0:0]\n");
- fw3_pr(":forwarding_rule - [0:0]\n");
- }
-
- fw3_pr(":delegate_input - [0:0]\n");
- fw3_pr(":delegate_output - [0:0]\n");
- fw3_pr(":delegate_forward - [0:0]\n");
- fw3_pr(":reject - [0:0]\n");
- fw3_pr(":syn_flood - [0:0]\n");
- break;
+#define policy(t) \
+ ((t == FW3_TARGET_REJECT) ? "DROP" : fw3_flag_names[t])
- case FW3_TABLE_NAT:
- if (defs->custom_chains)
- {
- fw3_pr(":prerouting_rule - [0:0]\n");
- fw3_pr(":postrouting_rule - [0:0]\n");
- }
- break;
+ if (table == FW3_TABLE_FILTER)
+ {
+ fw3_pr(":INPUT %s [0:0]\n", policy(defs->policy_input));
+ fw3_pr(":FORWARD %s [0:0]\n", policy(defs->policy_forward));
+ fw3_pr(":OUTPUT %s [0:0]\n", policy(defs->policy_output));
+ }
- case FW3_TABLE_MANGLE:
- fw3_pr(":mssfix - [0:0]\n");
- break;
+ /* user chains already loaded, don't create again */
+ if (hasbit(state->running_defaults.flags, FW3_DEFAULT_CUSTOM_CHAINS))
+ delbit(mask, FW3_DEFAULT_CUSTOM_CHAINS);
- case FW3_TABLE_RAW:
- if (!defs->drop_invalid)
- fw3_pr(":notrack - [0:0]\n");
- break;
- }
+ print_chains(table, family, ":%s - [0:0]\n", defs->flags & mask,
+ default_chains, ARRAY_SIZE(default_chains));
}
void
-fw3_print_default_rules(enum fw3_table table, enum fw3_family family,
- struct fw3_state *state)
+fw3_print_default_head_rules(enum fw3_table table, enum fw3_family family,
+ struct fw3_state *state)
{
int i;
struct fw3_defaults *defs = &state->defaults;
const char *chains[] = {
- "INPUT",
- "OUTPUT",
- "FORWARD",
+ "input",
+ "output",
+ "forward",
};
+ print_chains(table, family, "-A %s\n", 0,
+ toplevel_rules, ARRAY_SIZE(toplevel_rules));
+
switch (table)
{
case FW3_TABLE_FILTER:
- fw3_pr("-A INPUT -i lo -j ACCEPT\n");
- fw3_pr("-A OUTPUT -o lo -j ACCEPT\n");
+ fw3_pr("-A delegate_input -i lo -j ACCEPT\n");
+ fw3_pr("-A delegate_output -o lo -j ACCEPT\n");
+
+ if (defs->custom_chains)
+ {
+ fw3_pr("-A delegate_input -j input_rule\n");
+ fw3_pr("-A delegate_output -j output_rule\n");
+ fw3_pr("-A delegate_forward -j forwarding_rule\n");
+ }
for (i = 0; i < ARRAY_SIZE(chains); i++)
{
- fw3_pr("-A %s -m conntrack --ctstate RELATED,ESTABLISHED "
+ fw3_pr("-A delegate_%s -m conntrack --ctstate RELATED,ESTABLISHED "
"-j ACCEPT\n", chains[i]);
if (defs->drop_invalid)
{
- fw3_pr("-A %s -m conntrack --ctstate INVALID -j DROP\n",
+ fw3_pr("-A delegate_%s -m conntrack --ctstate INVALID -j DROP\n",
chains[i]);
}
}
fw3_pr(" -j RETURN\n");
fw3_pr("-A syn_flood -j DROP\n");
- fw3_pr("-A INPUT -p tcp --syn -j syn_flood\n");
- }
-
- if (defs->custom_chains)
- {
- fw3_pr("-A INPUT -j input_rule\n");
- fw3_pr("-A OUTPUT -j output_rule\n");
- fw3_pr("-A FORWARD -j forwarding_rule\n");
+ fw3_pr("-A delegate_input -p tcp --syn -j syn_flood\n");
}
- fw3_pr("-A INPUT -j delegate_input\n");
- fw3_pr("-A OUTPUT -j delegate_output\n");
- fw3_pr("-A FORWARD -j delegate_forward\n");
-
fw3_pr("-A reject -p tcp -j REJECT --reject-with tcp-reset\n");
fw3_pr("-A reject -j REJECT --reject-with port-unreach\n");
- if (defs->policy_input == FW3_TARGET_REJECT)
- fw3_pr("-A INPUT -j reject\n");
-
- if (defs->policy_output == FW3_TARGET_REJECT)
- fw3_pr("-A OUTPUT -j reject\n");
-
- if (defs->policy_forward == FW3_TARGET_REJECT)
- fw3_pr("-A FORWARD -j reject\n");
-
break;
case FW3_TABLE_NAT:
if (defs->custom_chains)
{
- fw3_pr("-A PREROUTING -j prerouting_rule\n");
- fw3_pr("-A POSTROUTING -j postrouting_rule\n");
+ fw3_pr("-A delegate_prerouting -j prerouting_rule\n");
+ fw3_pr("-A delegate_postrouting -j postrouting_rule\n");
}
break;
- case FW3_TABLE_MANGLE:
- fw3_pr("-A FORWARD -j mssfix\n");
- break;
-
- case FW3_TABLE_RAW:
- if (!defs->drop_invalid)
- fw3_pr("-A PREROUTING -j notrack\n");
+ default:
break;
}
}
void
-fw3_print_flush_rules(enum fw3_table table, enum fw3_family family,
- struct fw3_state *state, bool complete)
+fw3_print_default_tail_rules(enum fw3_table table, enum fw3_family family,
+ struct fw3_state *state)
{
- switch (table)
+ struct fw3_defaults *defs = &state->defaults;
+
+ if (table != FW3_TABLE_FILTER)
+ return;
+
+ if (defs->policy_input == FW3_TARGET_REJECT)
+ fw3_pr("-A delegate_input -j reject\n");
+
+ if (defs->policy_output == FW3_TARGET_REJECT)
+ fw3_pr("-A delegate_output -j reject\n");
+
+ if (defs->policy_forward == FW3_TARGET_REJECT)
+ fw3_pr("-A delegate_forward -j reject\n");
+}
+
+static void
+reset_policy(enum fw3_table table)
+{
+ if (table != FW3_TABLE_FILTER)
+ return;
+
+ fw3_pr(":INPUT ACCEPT [0:0]\n");
+ fw3_pr(":OUTPUT ACCEPT [0:0]\n");
+ fw3_pr(":FORWARD ACCEPT [0:0]\n");
+}
+
+void
+fw3_flush_rules(enum fw3_table table, enum fw3_family family,
+ bool pass2, struct fw3_state *state)
+{
+ struct fw3_defaults *d = &state->running_defaults;
+ uint16_t mask = ~0;
+
+ if (!hasbit(d->flags, family))
+ return;
+
+ /* don't touch user chains on selective stop */
+ delbit(mask, FW3_DEFAULT_CUSTOM_CHAINS);
+
+ if (!pass2)
{
- case FW3_TABLE_FILTER:
- fw3_pr(":INPUT ACCEPT [0:0]\n");
- fw3_pr(":OUTPUT ACCEPT [0:0]\n");
- fw3_pr(":FORWARD ACCEPT [0:0]\n");
- /* fall through */
+ reset_policy(table);
- case FW3_TABLE_NAT:
- fw3_pr("-F\n");
- fw3_pr("-X\n");
- break;
+ print_chains(table, family, "-D %s\n", d->flags & mask,
+ toplevel_rules, ARRAY_SIZE(toplevel_rules));
- case FW3_TABLE_MANGLE:
- if (complete)
- {
- fw3_pr("-F\n");
- fw3_pr("-X\n");
- }
- else
- {
- fw3_pr("-D FORWARD -j mssfix\n");
- fw3_pr("-F mssfix\n");
- fw3_pr("-X mssfix\n");
- }
- break;
+ print_chains(table, family, "-F %s\n", d->flags & mask,
+ default_chains, ARRAY_SIZE(default_chains));
+ }
+ else
+ {
+ print_chains(table, family, "-X %s\n", d->flags & mask,
+ default_chains, ARRAY_SIZE(default_chains));
- case FW3_TABLE_RAW:
- if (complete)
- {
- fw3_pr("-F\n");
- fw3_pr("-X\n");
- }
- else
- {
- fw3_pr("-D PREROUTING -j notrack\n");
- fw3_pr("-F notrack\n");
- fw3_pr("-X notrack\n");
- }
- break;
+ delbit(d->flags, family);
}
}
+
+void
+fw3_flush_all(enum fw3_table table)
+{
+ reset_policy(table);
+
+ fw3_pr("-F\n");
+ fw3_pr("-X\n");
+}
projects / project / firewall3.git / blobdiff