zones: add interface/subnet bound LOG rules

[project/firewall3.git] / zones.c

diff --git a/zones.c b/zones.c
index 7638443..505ab20 100644 (file)
--- a/zones.c
+++ b/zones.c
@@ -53,6 +53,11 @@ static const struct fw3_chain_spec zone_chains[] = {
        { }
 };
 
+enum fw3_zone_logmask {
+       FW3_ZONE_LOG_FILTER = (1 << 0),
+       FW3_ZONE_LOG_MANGLE = (1 << 1),
+};
+
 const struct fw3_option fw3_zone_opts[] = {
        FW3_OPT("enabled",             bool,     zone,     enabled),
 
@@ -79,7 +84,7 @@ const struct fw3_option fw3_zone_opts[] = {
        FW3_OPT("mtu_fix",             bool,     zone,     mtu_fix),
        FW3_OPT("custom_chains",       bool,     zone,     custom_chains),
 
-       FW3_OPT("log",                 bool,     zone,     log),
+       FW3_OPT("log",                 int,      zone,     log),
        FW3_OPT("log_limit",           limit,    zone,     log_limit),
 
        FW3_OPT("auto_helper",         bool,     zone,     auto_helper),
@@ -376,7 +381,7 @@ print_zone_chain(struct fw3_ipt_handle *handle, struct fw3_state *state,
                        for (i = 0; i < sizeof(flt_chains)/sizeof(flt_chains[0]); i += 2)
                        {
                                r = fw3_ipt_rule_new(handle);
-                               fw3_ipt_rule_comment(r, "user chain for %s", flt_chains[i+1]);
+                               fw3_ipt_rule_comment(r, "Custom %s %s rule chain", zone->name, flt_chains[i+1]);
                                fw3_ipt_rule_target(r, "%s_%s_rule", flt_chains[i+1], zone->name);
                                fw3_ipt_rule_append(r, "zone_%s_%s", zone->name, flt_chains[i]);
                        }
@@ -386,7 +391,7 @@ print_zone_chain(struct fw3_ipt_handle *handle, struct fw3_state *state,
                        for (i = 0; i < sizeof(nat_chains)/sizeof(nat_chains[0]); i += 2)
                        {
                                r = fw3_ipt_rule_new(handle);
-                               fw3_ipt_rule_comment(r, "user chain for %s", nat_chains[i+1]);
+                               fw3_ipt_rule_comment(r, "Custom %s %s rule chain", zone->name, nat_chains[i+1]);
                                fw3_ipt_rule_target(r, "%s_%s_rule", nat_chains[i+1], zone->name);
                                fw3_ipt_rule_append(r, "zone_%s_%s", zone->name, nat_chains[i]);
                        }
@@ -422,6 +427,37 @@ print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
        {
                for (t = FW3_FLAG_ACCEPT; t <= FW3_FLAG_DROP; t++)
                {
+                       if (t > FW3_FLAG_ACCEPT && zone->log & FW3_ZONE_LOG_FILTER)
+                       {
+                               if (has(zone->flags, handle->family, fw3_to_src_target(t)))
+                               {
+                                       r = fw3_ipt_rule_create(handle, NULL, dev, NULL, sub, NULL);
+
+                                       snprintf(buf, sizeof(buf) - 1, "%s %s in: ",
+                                                fw3_flag_names[t], zone->name);
+
+                                       fw3_ipt_rule_limit(r, &zone->log_limit);
+                                       fw3_ipt_rule_target(r, "LOG");
+                                       fw3_ipt_rule_addarg(r, false, "--log-prefix", buf);
+                                       fw3_ipt_rule_replace(r, "zone_%s_src_%s",
+                                                            zone->name, fw3_flag_names[t]);
+                               }
+
+                               if (has(zone->flags, handle->family, t))
+                               {
+                                       r = fw3_ipt_rule_create(handle, NULL, NULL, dev, NULL, sub);
+
+                                       snprintf(buf, sizeof(buf) - 1, "%s %s out: ",
+                                                fw3_flag_names[t], zone->name);
+
+                                       fw3_ipt_rule_limit(r, &zone->log_limit);
+                                       fw3_ipt_rule_target(r, "LOG");
+                                       fw3_ipt_rule_addarg(r, false, "--log-prefix", buf);
+                                       fw3_ipt_rule_replace(r, "zone_%s_dest_%s",
+                                                            zone->name, fw3_flag_names[t]);
+                               }
+                       }
+
                        if (has(zone->flags, handle->family, fw3_to_src_target(t)))
                        {
                                r = fw3_ipt_rule_create(handle, NULL, dev, NULL, sub, NULL);
@@ -496,15 +532,15 @@ print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
        {
                if (zone->mtu_fix)
                {
-                       if (zone->log)
+                       if (zone->log & FW3_ZONE_LOG_MANGLE)
                        {
-                               snprintf(buf, sizeof(buf) - 1, "MSSFIX(%s): ", zone->name);
+                               snprintf(buf, sizeof(buf) - 1, "MSSFIX %s out: ", zone->name);
 
                                r = fw3_ipt_rule_create(handle, &tcp, NULL, dev, NULL, sub);
                                fw3_ipt_rule_addarg(r, false, "--tcp-flags", "SYN,RST");
                                fw3_ipt_rule_addarg(r, false, "SYN", NULL);
                                fw3_ipt_rule_limit(r, &zone->log_limit);
-                               fw3_ipt_rule_comment(r, "%s (mtu_fix logging)", zone->name);
+                               fw3_ipt_rule_comment(r, "Zone %s MTU fix logging", zone->name);
                                fw3_ipt_rule_target(r, "LOG");
                                fw3_ipt_rule_addarg(r, false, "--log-prefix", buf);
                                fw3_ipt_rule_replace(r, "FORWARD");
@@ -513,7 +549,7 @@ print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
                        r = fw3_ipt_rule_create(handle, &tcp, NULL, dev, NULL, sub);
                        fw3_ipt_rule_addarg(r, false, "--tcp-flags", "SYN,RST");
                        fw3_ipt_rule_addarg(r, false, "SYN", NULL);
-                       fw3_ipt_rule_comment(r, "%s (mtu_fix)", zone->name);
+                       fw3_ipt_rule_comment(r, "Zone %s MTU fixing", zone->name);
                        fw3_ipt_rule_target(r, "TCPMSS");
                        fw3_ipt_rule_addarg(r, false, "--clamp-mss-to-pmtu", NULL);
                        fw3_ipt_rule_replace(r, "FORWARD");
@@ -588,9 +624,6 @@ print_zone_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
        struct fw3_address *mdest;
        struct fw3_ipt_rule *r;
 
-       enum fw3_flag t;
-       char buf[32];
-
        if (!fw3_is_family(zone, handle->family))
                return;
 
@@ -629,39 +662,6 @@ print_zone_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
                                     fw3_flag_names[zone->policy_output]);
                fw3_ipt_rule_append(r, "zone_%s_output", zone->name);
 
-               if (zone->log)
-               {
-                       for (t = FW3_FLAG_REJECT; t <= FW3_FLAG_DROP; t++)
-                       {
-                               if (has(zone->flags, handle->family, fw3_to_src_target(t)))
-                               {
-                                       r = fw3_ipt_rule_new(handle);
-
-                                       snprintf(buf, sizeof(buf) - 1, "%s(src %s)",
-                                                fw3_flag_names[t], zone->name);
-
-                                       fw3_ipt_rule_limit(r, &zone->log_limit);
-                                       fw3_ipt_rule_target(r, "LOG");
-                                       fw3_ipt_rule_addarg(r, false, "--log-prefix", buf);
-                                       fw3_ipt_rule_append(r, "zone_%s_src_%s",
-                                                           zone->name, fw3_flag_names[t]);
-                               }
-
-                               if (has(zone->flags, handle->family, t))
-                               {
-                                       r = fw3_ipt_rule_new(handle);
-
-                                       snprintf(buf, sizeof(buf) - 1, "%s(dest %s)",
-                                                fw3_flag_names[t], zone->name);
-
-                                       fw3_ipt_rule_limit(r, &zone->log_limit);
-                                       fw3_ipt_rule_target(r, "LOG");
-                                       fw3_ipt_rule_addarg(r, false, "--log-prefix", buf);
-                                       fw3_ipt_rule_append(r, "zone_%s_dest_%s",
-                                                           zone->name, fw3_flag_names[t]);
-                               }
-                       }
-               }
                break;
 
        case FW3_TABLE_NAT: