zones: allow untracked traffic as well

[project/firewall3.git] / zones.c

diff --git a/zones.c b/zones.c
index 2ddd7b4..a4458fe 100644 (file)
--- a/zones.c
+++ b/zones.c
@@ -1,7 +1,7 @@
 /*
  * firewall3 - 3rd OpenWrt UCI firewall implementation
  *
- *   Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
+ *   Copyright (C) 2013 Jo-Philipp Wich <jo@mein.io>
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -331,9 +331,9 @@ print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
        int i;
 
        const char *chains[] = {
-               "input",
-               "output",
-               "forward",
+               "input", "INPUT",
+               "output", "OUTPUT",
+               "forward", "FORWARD",
        };
 
 #define jump_target(t) \
@@ -348,6 +348,11 @@ print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
                                r = fw3_ipt_rule_create(handle, NULL, dev, NULL, sub, NULL);
                                fw3_ipt_rule_target(r, jump_target(t));
                                fw3_ipt_rule_extra(r, zone->extra_src);
+
+                               if (t == FW3_FLAG_ACCEPT && !state->defaults.drop_invalid)
+                                       fw3_ipt_rule_extra(r,
+                                                          "-m conntrack --ctstate NEW,UNTRACKED");
+
                                fw3_ipt_rule_replace(r, "zone_%s_src_%s", zone->name,
                                                     fw3_flag_names[t]);
                        }
@@ -357,12 +362,17 @@ print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
                                r = fw3_ipt_rule_create(handle, NULL, NULL, dev, NULL, sub);
                                fw3_ipt_rule_target(r, jump_target(t));
                                fw3_ipt_rule_extra(r, zone->extra_dest);
+
+                               if (t == FW3_FLAG_ACCEPT && !state->defaults.drop_invalid)
+                                       fw3_ipt_rule_extra(r,
+                                                          "-m conntrack --ctstate NEW,UNTRACKED");
+
                                fw3_ipt_rule_replace(r, "zone_%s_dest_%s", zone->name,
                                                     fw3_flag_names[t]);
                        }
                }
 
-               for (i = 0; i < sizeof(chains)/sizeof(chains[0]); i++)
+               for (i = 0; i < sizeof(chains)/sizeof(chains[0]); i += 2)
                {
                        if (*chains[i] == 'o')
                                r = fw3_ipt_rule_create(handle, NULL, NULL, dev, NULL, sub);
@@ -376,7 +386,7 @@ print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
                        else
                                fw3_ipt_rule_extra(r, zone->extra_src);
 
-                       fw3_ipt_rule_replace(r, "delegate_%s", chains[i]);
+                       fw3_ipt_rule_replace(r, chains[i + 1]);
                }
        }
        else if (handle->table == FW3_TABLE_NAT)
@@ -386,7 +396,7 @@ print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
                        r = fw3_ipt_rule_create(handle, NULL, dev, NULL, sub, NULL);
                        fw3_ipt_rule_target(r, "zone_%s_prerouting", zone->name);
                        fw3_ipt_rule_extra(r, zone->extra_src);
-                       fw3_ipt_rule_replace(r, "delegate_prerouting");
+                       fw3_ipt_rule_replace(r, "PREROUTING");
                }
 
                if (has(zone->flags, handle->family, FW3_FLAG_SNAT))
@@ -394,7 +404,7 @@ print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
                        r = fw3_ipt_rule_create(handle, NULL, NULL, dev, NULL, sub);
                        fw3_ipt_rule_target(r, "zone_%s_postrouting", zone->name);
                        fw3_ipt_rule_extra(r, zone->extra_dest);
-                       fw3_ipt_rule_replace(r, "delegate_postrouting");
+                       fw3_ipt_rule_replace(r, "POSTROUTING");
                }
        }
        else if (handle->table == FW3_TABLE_MANGLE)
@@ -412,7 +422,7 @@ print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
                                fw3_ipt_rule_comment(r, "%s (mtu_fix logging)", zone->name);
                                fw3_ipt_rule_target(r, "LOG");
                                fw3_ipt_rule_addarg(r, false, "--log-prefix", buf);
-                               fw3_ipt_rule_replace(r, "mssfix");
+                               fw3_ipt_rule_replace(r, "FORWARD");
                        }
 
                        r = fw3_ipt_rule_create(handle, &tcp, NULL, dev, NULL, sub);
@@ -421,7 +431,7 @@ print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
                        fw3_ipt_rule_comment(r, "%s (mtu_fix)", zone->name);
                        fw3_ipt_rule_target(r, "TCPMSS");
                        fw3_ipt_rule_addarg(r, false, "--clamp-mss-to-pmtu", NULL);
-                       fw3_ipt_rule_replace(r, "mssfix");
+                       fw3_ipt_rule_replace(r, "FORWARD");
                }
        }
        else if (handle->table == FW3_TABLE_RAW)
@@ -431,7 +441,7 @@ print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
                        r = fw3_ipt_rule_create(handle, NULL, dev, NULL, sub, NULL);
                        fw3_ipt_rule_target(r, "zone_%s_notrack", zone->name);
                        fw3_ipt_rule_extra(r, zone->extra_src);
-                       fw3_ipt_rule_replace(r, "delegate_notrack");
+                       fw3_ipt_rule_replace(r, "PREROUTING");
                }
        }
 }