cmake: Find uci.h

[project/firewall3.git] / zones.c

diff --git a/zones.c b/zones.c
index ebc4a2a..66c70a5 100644 (file)
--- a/zones.c
+++ b/zones.c
@@ -1,7 +1,7 @@
 /*
  * firewall3 - 3rd OpenWrt UCI firewall implementation
  *
- *   Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
+ *   Copyright (C) 2013 Jo-Philipp Wich <jo@mein.io>
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -83,6 +83,8 @@ const struct fw3_option fw3_zone_opts[] = {
        FW3_OPT("__flags_v4",          int,      zone,     flags[0]),
        FW3_OPT("__flags_v6",          int,      zone,     flags[1]),
 
+       FW3_LIST("__addrs",            address,  zone,     old_addrs),
+
        { }
 };
 
@@ -138,6 +140,8 @@ fw3_alloc_zone(void)
        INIT_LIST_HEAD(&zone->masq_src);
        INIT_LIST_HEAD(&zone->masq_dest);
 
+       INIT_LIST_HEAD(&zone->old_addrs);
+
        zone->enabled = true;
        zone->custom_chains = true;
        zone->log_limit.rate = 10;
@@ -327,9 +331,9 @@ print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
        int i;
 
        const char *chains[] = {
-               "input",
-               "output",
-               "forward",
+               "input", "INPUT",
+               "output", "OUTPUT",
+               "forward", "FORWARD",
        };
 
 #define jump_target(t) \
@@ -358,7 +362,7 @@ print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
                        }
                }
 
-               for (i = 0; i < sizeof(chains)/sizeof(chains[0]); i++)
+               for (i = 0; i < sizeof(chains)/sizeof(chains[0]); i += 2)
                {
                        if (*chains[i] == 'o')
                                r = fw3_ipt_rule_create(handle, NULL, NULL, dev, NULL, sub);
@@ -372,7 +376,7 @@ print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
                        else
                                fw3_ipt_rule_extra(r, zone->extra_src);
 
-                       fw3_ipt_rule_replace(r, "delegate_%s", chains[i]);
+                       fw3_ipt_rule_replace(r, chains[i + 1]);
                }
        }
        else if (handle->table == FW3_TABLE_NAT)
@@ -382,7 +386,7 @@ print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
                        r = fw3_ipt_rule_create(handle, NULL, dev, NULL, sub, NULL);
                        fw3_ipt_rule_target(r, "zone_%s_prerouting", zone->name);
                        fw3_ipt_rule_extra(r, zone->extra_src);
-                       fw3_ipt_rule_replace(r, "delegate_prerouting");
+                       fw3_ipt_rule_replace(r, "PREROUTING");
                }
 
                if (has(zone->flags, handle->family, FW3_FLAG_SNAT))
@@ -390,7 +394,7 @@ print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
                        r = fw3_ipt_rule_create(handle, NULL, NULL, dev, NULL, sub);
                        fw3_ipt_rule_target(r, "zone_%s_postrouting", zone->name);
                        fw3_ipt_rule_extra(r, zone->extra_dest);
-                       fw3_ipt_rule_replace(r, "delegate_postrouting");
+                       fw3_ipt_rule_replace(r, "POSTROUTING");
                }
        }
        else if (handle->table == FW3_TABLE_MANGLE)
@@ -408,7 +412,7 @@ print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
                                fw3_ipt_rule_comment(r, "%s (mtu_fix logging)", zone->name);
                                fw3_ipt_rule_target(r, "LOG");
                                fw3_ipt_rule_addarg(r, false, "--log-prefix", buf);
-                               fw3_ipt_rule_replace(r, "mssfix");
+                               fw3_ipt_rule_replace(r, "FORWARD");
                        }
 
                        r = fw3_ipt_rule_create(handle, &tcp, NULL, dev, NULL, sub);
@@ -417,7 +421,7 @@ print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
                        fw3_ipt_rule_comment(r, "%s (mtu_fix)", zone->name);
                        fw3_ipt_rule_target(r, "TCPMSS");
                        fw3_ipt_rule_addarg(r, false, "--clamp-mss-to-pmtu", NULL);
-                       fw3_ipt_rule_replace(r, "mssfix");
+                       fw3_ipt_rule_replace(r, "FORWARD");
                }
        }
        else if (handle->table == FW3_TABLE_RAW)
@@ -427,7 +431,7 @@ print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
                        r = fw3_ipt_rule_create(handle, NULL, dev, NULL, sub, NULL);
                        fw3_ipt_rule_target(r, "zone_%s_notrack", zone->name);
                        fw3_ipt_rule_extra(r, zone->extra_src);
-                       fw3_ipt_rule_replace(r, "delegate_notrack");
+                       fw3_ipt_rule_replace(r, "PREROUTING");
                }
        }
 }
@@ -674,10 +678,10 @@ fw3_lookup_zone(struct fw3_state *state, const char *name)
 }
 
 struct list_head *
-fw3_resolve_zone_addresses(struct fw3_zone *zone)
+fw3_resolve_zone_addresses(struct fw3_zone *zone, struct fw3_address *addr)
 {
        struct fw3_device *net;
-       struct fw3_address *addr, *tmp;
+       struct fw3_address *cur, *tmp;
        struct list_head *all;
 
        all = calloc(1, sizeof(*all));
@@ -686,18 +690,31 @@ fw3_resolve_zone_addresses(struct fw3_zone *zone)
 
        INIT_LIST_HEAD(all);
 
-       list_for_each_entry(net, &zone->networks, list)
-               fw3_ubus_address(all, net->name);
-
-       list_for_each_entry(addr, &zone->subnets, list)
+       if (addr && addr->set)
        {
                tmp = malloc(sizeof(*tmp));
 
-               if (!tmp)
-                       continue;
+               if (tmp)
+               {
+                       *tmp = *addr;
+                       list_add_tail(&tmp->list, all);
+               }
+       }
+       else
+       {
+               list_for_each_entry(net, &zone->networks, list)
+                       fw3_ubus_address(all, net->name);
+
+               list_for_each_entry(cur, &zone->subnets, list)
+               {
+                       tmp = malloc(sizeof(*tmp));
 
-               memcpy(tmp, addr, sizeof(*tmp));
-               list_add_tail(&tmp->list, all);
+                       if (!tmp)
+                               continue;
+
+                       *tmp = *cur;
+                       list_add_tail(&tmp->list, all);
+               }
        }
 
        return all;