zones: add interface/subnet bound LOG rules

[project/firewall3.git] / iptables.c

diff --git a/iptables.c b/iptables.c
index 10bfea5..f8d4d46 100644 (file)
--- a/iptables.c
+++ b/iptables.c
@@ -40,6 +40,8 @@
 #include <libiptc/libip6tc.h>
 #include <xtables.h>
 
+#include <setjmp.h>
+
 #include "options.h"
 
 /* xtables interface */
@@ -73,15 +75,38 @@ struct fw3_ipt_rule {
 };
 
 static struct option base_opts[] = {
-       { .name = "match",  .has_arg = 1, .val = 'm' },
-       { .name = "jump",   .has_arg = 1, .val = 'j' },
+       { .name = "match",         .has_arg = 1, .val = 'm' },
+       { .name = "jump",          .has_arg = 1, .val = 'j' },
+       { .name = "in-interface",  .has_arg = 1, .val = 'i' },
+       { .name = "out-interface", .has_arg = 1, .val = 'o' },
+       { .name = "source",        .has_arg = 1, .val = 's' },
+       { .name = "destination",   .has_arg = 1, .val = 'd' },
        { NULL }
 };
 
+
+static jmp_buf fw3_ipt_error_jmp;
+
+static __attribute__((noreturn))
+void fw3_ipt_error_handler(enum xtables_exittype status,
+                           const char *fmt, ...)
+{
+       va_list args;
+
+       fprintf(stderr, "     ! Exception: ");
+
+       va_start(args, fmt);
+       vfprintf(stderr, fmt, args);
+       va_end(args);
+
+       longjmp(fw3_ipt_error_jmp, status);
+}
+
 static struct xtables_globals xtg = {
        .option_offset = 0,
        .program_version = "4",
        .orig_opts = base_opts,
+       .exit_err = fw3_ipt_error_handler,
 #if XTABLES_VERSION_CODE > 10
        .compat_rev = xtables_compatible_revision,
 #endif
@@ -91,6 +116,7 @@ static struct xtables_globals xtg6 = {
        .option_offset = 0,
        .program_version = "6",
        .orig_opts = base_opts,
+       .exit_err = fw3_ipt_error_handler,
 #if XTABLES_VERSION_CODE > 10
        .compat_rev = xtables_compatible_revision,
 #endif
@@ -1000,6 +1026,16 @@ fw3_ipt_rule_ipset(struct fw3_ipt_rule *r, struct fw3_setmatch *match)
 }
 
 void
+fw3_ipt_rule_helper(struct fw3_ipt_rule *r, struct fw3_cthelpermatch *match)
+{
+       if (!match || !match->set || !match->ptr)
+               return;
+
+       fw3_ipt_rule_addarg(r, false, "-m", "helper");
+       fw3_ipt_rule_addarg(r, match->invert, "--helper", match->ptr->name);
+}
+
+void
 fw3_ipt_rule_time(struct fw3_ipt_rule *r, struct fw3_time *time)
 {
        int i;
@@ -1387,7 +1423,7 @@ rule_mask(struct fw3_ipt_rule *r)
                        p += SZ(ip6t_entry_match) + m->match->size;
                }
 
-               memset(p, 0xFF, SZ(ip6t_entry_target) + (r->target) ? r->target->userspacesize : 0);
+               memset(p, 0xFF, SZ(ip6t_entry_target) + (r->target ? r->target->userspacesize : 0));
        }
        else
 #endif
@@ -1411,7 +1447,7 @@ rule_mask(struct fw3_ipt_rule *r)
                        p += SZ(ipt_entry_match) + m->match->size;
                }
 
-               memset(p, 0xFF, SZ(ipt_entry_target) + (r->target) ? r->target->userspacesize : 0);
+               memset(p, 0xFF, SZ(ipt_entry_target) + (r->target ? r->target->userspacesize : 0));
        }
 
        return mask;
@@ -1524,6 +1560,11 @@ __fw3_ipt_rule_append(struct fw3_ipt_rule *r, bool repl, const char *fmt, ...)
        struct xtables_target *et;
        struct xtables_globals *g;
 
+       struct fw3_device dev;
+       struct fw3_address addr;
+
+       enum xtables_exittype status;
+
        int i, optc;
        bool inv = false;
        char buf[32];
@@ -1539,9 +1580,17 @@ __fw3_ipt_rule_append(struct fw3_ipt_rule *r, bool repl, const char *fmt, ...)
        optind = 0;
        opterr = 0;
 
+       status = setjmp(fw3_ipt_error_jmp);
+
+       if (status > 0)
+       {
+               info("     ! Skipping due to previous exception (code %u)", status);
+               goto free;
+       }
+
        set_rule_tag(r);
 
-       while ((optc = getopt_long(r->argc, r->argv, "-:m:j:", g->opts,
+       while ((optc = getopt_long(r->argc, r->argv, "-:m:j:i:o:s:d:", g->opts,
                                   NULL)) != -1)
        {
                switch (optc)
@@ -1569,6 +1618,34 @@ __fw3_ipt_rule_append(struct fw3_ipt_rule *r, bool repl, const char *fmt, ...)
 
                        break;
 
+               case 'i':
+               case 'o':
+                       if (!fw3_parse_device(&dev, optarg, false) ||
+                           dev.any || dev.invert || *dev.network)
+                       {
+                               warn("fw3_ipt_rule_append(): Bad argument '%s'", optarg);
+                               goto free;
+                       }
+
+                       dev.invert = inv;
+                       fw3_ipt_rule_in_out(r, (optc == 'i') ? &dev : NULL,
+                                              (optc == 'o') ? &dev : NULL);
+                       break;
+
+               case 's':
+               case 'd':
+                       if (!fw3_parse_address(&addr, optarg, false) ||
+                           addr.range || addr.invert)
+                       {
+                               warn("fw3_ipt_rule_append(): Bad argument '%s'", optarg);
+                               goto free;
+                       }
+
+                       addr.invert = inv;
+                       fw3_ipt_rule_src_dest(r, (optc == 's') ? &addr : NULL,
+                                                (optc == 'd') ? &addr : NULL);
+                       break;
+
                case 1:
                        if ((optarg[0] == '!') && (optarg[1] == '\0'))
                        {