iptables: rework extension loader

[project/firewall3.git] / zones.c

diff --git a/zones.c b/zones.c
index 66c70a5..a95e363 100644 (file)
--- a/zones.c
+++ b/zones.c
@@ -216,23 +216,23 @@ fw3_load_zones(struct fw3_state *state, struct uci_package *p)
 
                if (zone->masq)
                {
-                       setbit(zone->flags[0], FW3_FLAG_SNAT);
+                       fw3_setbit(zone->flags[0], FW3_FLAG_SNAT);
                        zone->conntrack = true;
                }
 
                if (zone->custom_chains)
                {
-                       setbit(zone->flags[0], FW3_FLAG_SNAT);
-                       setbit(zone->flags[0], FW3_FLAG_DNAT);
+                       fw3_setbit(zone->flags[0], FW3_FLAG_SNAT);
+                       fw3_setbit(zone->flags[0], FW3_FLAG_DNAT);
                }
 
-               setbit(zone->flags[0], fw3_to_src_target(zone->policy_input));
-               setbit(zone->flags[0], zone->policy_forward);
-               setbit(zone->flags[0], zone->policy_output);
+               fw3_setbit(zone->flags[0], fw3_to_src_target(zone->policy_input));
+               fw3_setbit(zone->flags[0], zone->policy_forward);
+               fw3_setbit(zone->flags[0], zone->policy_output);
 
-               setbit(zone->flags[1], fw3_to_src_target(zone->policy_input));
-               setbit(zone->flags[1], zone->policy_forward);
-               setbit(zone->flags[1], zone->policy_output);
+               fw3_setbit(zone->flags[1], fw3_to_src_target(zone->policy_input));
+               fw3_setbit(zone->flags[1], zone->policy_forward);
+               fw3_setbit(zone->flags[1], zone->policy_output);
 
                list_add_tail(&zone->list, &state->zones);
        }
@@ -284,7 +284,7 @@ print_zone_chain(struct fw3_ipt_handle *handle, struct fw3_state *state,
                        continue;
 
                if (c->flag &&
-                   !hasbit(zone->flags[handle->family == FW3_FAMILY_V6], c->flag))
+                   !fw3_hasbit(zone->flags[handle->family == FW3_FAMILY_V6], c->flag))
                        continue;
 
                fw3_ipt_create_chain(handle, c->format, zone->name);
@@ -348,6 +348,11 @@ print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
                                r = fw3_ipt_rule_create(handle, NULL, dev, NULL, sub, NULL);
                                fw3_ipt_rule_target(r, jump_target(t));
                                fw3_ipt_rule_extra(r, zone->extra_src);
+
+                               if (t == FW3_FLAG_ACCEPT && !state->defaults.drop_invalid)
+                                       fw3_ipt_rule_extra(r,
+                                                          "-m conntrack --ctstate NEW,UNTRACKED");
+
                                fw3_ipt_rule_replace(r, "zone_%s_src_%s", zone->name,
                                                     fw3_flag_names[t]);
                        }
@@ -357,6 +362,11 @@ print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
                                r = fw3_ipt_rule_create(handle, NULL, NULL, dev, NULL, sub);
                                fw3_ipt_rule_target(r, jump_target(t));
                                fw3_ipt_rule_extra(r, zone->extra_dest);
+
+                               if (t == FW3_FLAG_ACCEPT && !state->defaults.drop_invalid)
+                                       fw3_ipt_rule_extra(r,
+                                                          "-m conntrack --ctstate NEW,UNTRACKED");
+
                                fw3_ipt_rule_replace(r, "zone_%s_dest_%s", zone->name,
                                                     fw3_flag_names[t]);
                        }
@@ -456,11 +466,30 @@ print_interface_rules(struct fw3_ipt_handle *handle, struct fw3_state *state,
        }
 }
 
+static struct fw3_address *
+next_addr(struct fw3_address *addr, struct list_head *list,
+                enum fw3_family family, bool invert)
+{
+       struct list_head *p;
+       struct fw3_address *rv;
+
+       for (p = addr ? addr->list.next : list->next; p != list; p = p->next)
+       {
+               rv = list_entry(p, struct fw3_address, list);
+
+               if (fw3_is_family(rv, family) && rv->invert == invert)
+                       return rv;
+       }
+
+       return NULL;
+}
+
 static void
 print_zone_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
                 bool reload, struct fw3_zone *zone)
 {
        bool disable_notrack = state->defaults.drop_invalid;
+       bool first_src, first_dest;
        struct fw3_address *msrc;
        struct fw3_address *mdest;
        struct fw3_ipt_rule *r;
@@ -542,17 +571,50 @@ print_zone_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
        case FW3_TABLE_NAT:
                if (zone->masq && handle->family == FW3_FAMILY_V4)
                {
-                       fw3_foreach(msrc, &zone->masq_src)
-                       fw3_foreach(mdest, &zone->masq_dest)
+                       /* for any negated masq_src ip, emit -s addr -j RETURN rules */
+                       for (msrc = NULL;
+                            (msrc = next_addr(msrc, &zone->masq_src,
+                                              handle->family, true)) != NULL; )
                        {
-                               if (!fw3_is_family(msrc, handle->family) ||
-                                   !fw3_is_family(mdest, handle->family))
-                                       continue;
+                               msrc->invert = false;
+                               r = fw3_ipt_rule_new(handle);
+                               fw3_ipt_rule_src_dest(r, msrc, NULL);
+                               fw3_ipt_rule_target(r, "RETURN");
+                               fw3_ipt_rule_append(r, "zone_%s_postrouting", zone->name);
+                               msrc->invert = true;
+                       }
 
+                       /* for any negated masq_dest ip, emit -d addr -j RETURN rules */
+                       for (mdest = NULL;
+                            (mdest = next_addr(mdest, &zone->masq_dest,
+                                               handle->family, true)) != NULL; )
+                       {
+                               mdest->invert = false;
                                r = fw3_ipt_rule_new(handle);
-                               fw3_ipt_rule_src_dest(r, msrc, mdest);
-                               fw3_ipt_rule_target(r, "MASQUERADE");
+                               fw3_ipt_rule_src_dest(r, NULL, mdest);
+                               fw3_ipt_rule_target(r, "RETURN");
                                fw3_ipt_rule_append(r, "zone_%s_postrouting", zone->name);
+                               mdest->invert = true;
+                       }
+
+                       /* emit masquerading entries for non-negated addresses
+                          and ensure that both src and dest loops run at least once,
+                          even if there are no relevant addresses */
+                       for (first_src = true, msrc = NULL;
+                            (msrc = next_addr(msrc, &zone->masq_src,
+                                                  handle->family, false)) || first_src;
+                            first_src = false)
+                       {
+                               for (first_dest = true, mdest = NULL;
+                                    (mdest = next_addr(mdest, &zone->masq_dest,
+                                                           handle->family, false)) || first_dest;
+                                    first_dest = false)
+                               {
+                                       r = fw3_ipt_rule_new(handle);
+                                       fw3_ipt_rule_src_dest(r, msrc, mdest);
+                                       fw3_ipt_rule_target(r, "MASQUERADE");
+                                       fw3_ipt_rule_append(r, "zone_%s_postrouting", zone->name);
+                               }
                        }
                }
                break;
@@ -645,15 +707,15 @@ fw3_hotplug_zones(struct fw3_state *state, bool add)
 
        list_for_each_entry(z, &state->zones, list)
        {
-               if (add != hasbit(z->flags[0], FW3_FLAG_HOTPLUG))
+               if (add != fw3_hasbit(z->flags[0], FW3_FLAG_HOTPLUG))
                {
                        list_for_each_entry(d, &z->devices, list)
                                fw3_hotplug(add, z, d);
 
                        if (add)
-                               setbit(z->flags[0], FW3_FLAG_HOTPLUG);
+                               fw3_setbit(z->flags[0], FW3_FLAG_HOTPLUG);
                        else
-                               delbit(z->flags[0], FW3_FLAG_HOTPLUG);
+                               fw3_delbit(z->flags[0], FW3_FLAG_HOTPLUG);
                }
        }
 }