add debug flag to monitor fw3_pr() calls, set policies to drop during reload

[project/firewall3.git] / zones.c

diff --git a/zones.c b/zones.c
index edd875a..576ad42 100644 (file)
--- a/zones.c
+++ b/zones.c
@@ -51,7 +51,7 @@ static const struct chain dst_chains[] = {
        C(ANY, RAW,    NOTRACK, "zone_%s_notrack"),
 };
 
-static struct fw3_option zone_opts[] = {
+const struct fw3_option fw3_zone_opts[] = {
        FW3_OPT("name",                string,   zone,     name),
        FW3_OPT("family",              family,   zone,     family),
 
@@ -77,6 +77,8 @@ static struct fw3_option zone_opts[] = {
 
        FW3_OPT("log",                 bool,     zone,     log),
        FW3_OPT("log_limit",           limit,    zone,     log_limit),
+
+       { }
 };
 
 
@@ -144,6 +146,29 @@ resolve_networks(struct uci_element *e, struct fw3_zone *zone)
        }
 }
 
+struct fw3_zone *
+fw3_alloc_zone(void)
+{
+       struct fw3_zone *zone;
+
+       zone = malloc(sizeof(*zone));
+
+       if (!zone)
+               return NULL;
+
+       memset(zone, 0, sizeof(*zone));
+
+       INIT_LIST_HEAD(&zone->networks);
+       INIT_LIST_HEAD(&zone->devices);
+       INIT_LIST_HEAD(&zone->subnets);
+       INIT_LIST_HEAD(&zone->masq_src);
+       INIT_LIST_HEAD(&zone->masq_dest);
+
+       zone->log_limit.rate = 10;
+
+       return zone;
+}
+
 void
 fw3_load_zones(struct fw3_state *state, struct uci_package *p)
 {
@@ -161,22 +186,12 @@ fw3_load_zones(struct fw3_state *state, struct uci_package *p)
                if (strcmp(s->type, "zone"))
                        continue;
 
-               zone = malloc(sizeof(*zone));
+               zone = fw3_alloc_zone();
 
                if (!zone)
                        continue;
 
-               memset(zone, 0, sizeof(*zone));
-
-               INIT_LIST_HEAD(&zone->networks);
-               INIT_LIST_HEAD(&zone->devices);
-               INIT_LIST_HEAD(&zone->subnets);
-               INIT_LIST_HEAD(&zone->masq_src);
-               INIT_LIST_HEAD(&zone->masq_dest);
-
-               zone->log_limit.rate = 10;
-
-               fw3_parse_options(zone, zone_opts, ARRAY_SIZE(zone_opts), s);
+               fw3_parse_options(zone, fw3_zone_opts, s);
 
                if (!zone->extra_dest)
                        zone->extra_dest = zone->extra_src;
@@ -217,14 +232,16 @@ fw3_load_zones(struct fw3_state *state, struct uci_package *p)
 
 static void
 print_zone_chain(enum fw3_table table, enum fw3_family family,
-                 struct fw3_zone *zone, bool disable_notrack)
+                 struct fw3_zone *zone, struct fw3_state *state)
 {
        bool s, d;
 
        if (!fw3_is_family(zone, family))
                return;
 
-       if (!zone->conntrack && !disable_notrack)
+       setbit(zone->dst_flags, family);
+
+       if (!zone->conntrack && !state->defaults.drop_invalid)
                setbit(zone->dst_flags, FW3_TARGET_NOTRACK);
 
        s = print_chains(table, family, ":%s - [0:0]\n", zone->name,
@@ -234,7 +251,10 @@ print_zone_chain(enum fw3_table table, enum fw3_family family,
                         zone->dst_flags, dst_chains, ARRAY_SIZE(dst_chains));
 
        if (s || d)
+       {
                info("   * Zone '%s'", zone->name);
+               fw3_set_running(zone, &state->running_zones);
+       }
 }
 
 static void
@@ -440,7 +460,7 @@ fw3_print_zone_chains(enum fw3_table table, enum fw3_family family,
        struct fw3_zone *zone;
 
        list_for_each_entry(zone, &state->zones, list)
-               print_zone_chain(table, family, zone, state->defaults.drop_invalid);
+               print_zone_chain(table, family, zone, state);
 }
 
 void
@@ -455,25 +475,34 @@ fw3_print_zone_rules(enum fw3_table table, enum fw3_family family,
 
 void
 fw3_flush_zones(enum fw3_table table, enum fw3_family family,
-                           bool pass2, struct list_head *statefile)
+                           bool pass2, struct fw3_state *state)
 {
-       struct fw3_statefile_entry *e;
+       struct fw3_zone *z, *tmp;
+       int mask = (1 << FW3_FAMILY_V4) | (1 << FW3_FAMILY_V6);
 
-       list_for_each_entry(e, statefile, list)
+       list_for_each_entry_safe(z, tmp, &state->running_zones, running_list)
        {
-               if (e->type != FW3_TYPE_ZONE)
+               if (!hasbit(z->dst_flags, family))
                        continue;
 
                print_chains(table, family, pass2 ? "-X %s\n" : "-F %s\n",
-                            e->name, e->flags[0], src_chains, ARRAY_SIZE(src_chains));
+                            z->name, z->src_flags, src_chains, ARRAY_SIZE(src_chains));
 
                print_chains(table, family, pass2 ? "-X %s\n" : "-F %s\n",
-                            e->name, e->flags[1], dst_chains, ARRAY_SIZE(dst_chains));
+                            z->name, z->dst_flags, dst_chains, ARRAY_SIZE(dst_chains));
+
+               if (pass2)
+               {
+                       delbit(z->dst_flags, family);
+
+                       if (!(z->dst_flags & mask))
+                               fw3_set_running(z, NULL);
+               }
        }
 }
 
 struct fw3_zone *
-fw3_lookup_zone(struct fw3_state *state, const char *name)
+fw3_lookup_zone(struct fw3_state *state, const char *name, bool running)
 {
        struct fw3_zone *z;
 
@@ -481,21 +510,15 @@ fw3_lookup_zone(struct fw3_state *state, const char *name)
                return NULL;
 
        list_for_each_entry(z, &state->zones, list)
-               if (!strcmp(z->name, name))
-                       return z;
-
-       return NULL;
-}
+       {
+               if (strcmp(z->name, name))
+                       continue;
 
-void
-fw3_free_zone(struct fw3_zone *zone)
-{
-       fw3_free_list(&zone->networks);
-       fw3_free_list(&zone->devices);
-       fw3_free_list(&zone->subnets);
+               if (!running || z->running_list.next)
+                       return z;
 
-       fw3_free_list(&zone->masq_src);
-       fw3_free_list(&zone->masq_dest);
+               break;
+       }
 
-       free(zone);
+       return NULL;
 }