X-Git-Url: http://git.archive.openwrt.org/?p=project%2Ffirewall3.git;a=blobdiff_plain;f=defaults.c;h=11fbf0dd8f74a51e4b2d95fd0bb7e742d65cd8f4;hp=ccd320c7d6f11bf85b118ad6557d12610435dd7f;hb=30463d08056db8f03d17c0569581aef96418c38d;hpb=410cff5e62db45e8415bf25bf50395b4e7e22482 diff --git a/defaults.c b/defaults.c index ccd320c..11fbf0d 100644 --- a/defaults.c +++ b/defaults.c @@ -1,7 +1,7 @@ /* * firewall3 - 3rd OpenWrt UCI firewall implementation * - * Copyright (C) 2013 Jo-Philipp Wich + * Copyright (C) 2013 Jo-Philipp Wich * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -23,25 +23,15 @@ { FW3_FAMILY_##f, FW3_TABLE_##tbl, FW3_FLAG_##def, fmt } static const struct fw3_chain_spec default_chains[] = { - //C(ANY, FILTER, UNSPEC, "delegate_input"), - //C(ANY, FILTER, UNSPEC, "delegate_output"), - //C(ANY, FILTER, UNSPEC, "delegate_forward"), C(ANY, FILTER, UNSPEC, "reject"), C(ANY, FILTER, CUSTOM_CHAINS, "input_rule"), C(ANY, FILTER, CUSTOM_CHAINS, "output_rule"), C(ANY, FILTER, CUSTOM_CHAINS, "forwarding_rule"), C(ANY, FILTER, SYN_FLOOD, "syn_flood"), - //C(V4, NAT, UNSPEC, "delegate_prerouting"), - //C(V4, NAT, UNSPEC, "delegate_postrouting"), C(V4, NAT, CUSTOM_CHAINS, "prerouting_rule"), C(V4, NAT, CUSTOM_CHAINS, "postrouting_rule"), - //C(ANY, MANGLE, UNSPEC, "mssfix"), - //C(ANY, MANGLE, UNSPEC, "fwmark"), - - //C(ANY, RAW, UNSPEC, "delegate_notrack"), - { } }; @@ -64,8 +54,11 @@ const struct fw3_option fw3_flag_opts[] = { FW3_OPT("accept_redirects", bool, defaults, accept_redirects), FW3_OPT("accept_source_route", bool, defaults, accept_source_route), + FW3_OPT("auto_helper", bool, defaults, auto_helper), FW3_OPT("custom_chains", bool, defaults, custom_chains), FW3_OPT("disable_ipv6", bool, defaults, disable_ipv6), + FW3_OPT("flow_offloading", bool, defaults, flow_offloading), + FW3_OPT("flow_offloading_hw", bool, defaults, flow_offloading_hw), FW3_OPT("__flags_v4", int, defaults, flags[0]), FW3_OPT("__flags_v6", int, defaults, flags[1]), @@ -89,6 +82,26 @@ check_policy(struct uci_element *e, enum fw3_flag *pol, const char *name) } } +static void +check_offloading(struct uci_element *e, bool *offloading) +{ + FILE *f; + + if (!*offloading) + return; + + f = fopen("/sys/module/xt_FLOWOFFLOAD/refcnt", "r"); + + if (f) + { + fclose(f); + return; + } + + warn_elem(e, "enables offloading but missing kernel support, disabling"); + *offloading = false; +} + void fw3_load_defaults(struct fw3_state *state, struct uci_package *p) { @@ -103,6 +116,7 @@ fw3_load_defaults(struct fw3_state *state, struct uci_package *p) defs->tcp_syncookies = true; defs->tcp_window_scaling = true; defs->custom_chains = true; + defs->auto_helper = true; uci_foreach_element(&p->sections, e) { @@ -117,11 +131,14 @@ fw3_load_defaults(struct fw3_state *state, struct uci_package *p) continue; } - fw3_parse_options(&state->defaults, fw3_flag_opts, s); + if(!fw3_parse_options(&state->defaults, fw3_flag_opts, s)) + warn_elem(e, "has invalid options"); check_policy(e, &defs->policy_input, "input"); check_policy(e, &defs->policy_output, "output"); check_policy(e, &defs->policy_forward, "forward"); + + check_offloading(e, &defs->flow_offloading); } } @@ -164,7 +181,7 @@ fw3_print_default_chains(struct fw3_ipt_handle *handle, struct fw3_state *state, continue; if (c->flag && - !hasbit(defs->flags[handle->family == FW3_FAMILY_V6], c->flag)) + !fw3_hasbit(defs->flags[handle->family == FW3_FAMILY_V6], c->flag)) continue; fw3_ipt_create_chain(handle, c->format); @@ -173,13 +190,6 @@ fw3_print_default_chains(struct fw3_ipt_handle *handle, struct fw3_state *state, set(defs->flags, handle->family, handle->table); } - -struct toplevel_rule { - enum fw3_table table; - const char *chain; - const char *target; -}; - void fw3_print_default_head_rules(struct fw3_ipt_handle *handle, struct fw3_state *state, bool reload) @@ -189,7 +199,6 @@ fw3_print_default_head_rules(struct fw3_ipt_handle *handle, struct fw3_device lodev = { .set = true }; struct fw3_protocol tcp = { .protocol = 6 }; struct fw3_ipt_rule *r; - //struct toplevel_rule *tr; const char *chains[] = { "INPUT", "input", @@ -197,32 +206,6 @@ fw3_print_default_head_rules(struct fw3_ipt_handle *handle, "FORWARD", "forwarding", }; - //struct toplevel_rule rules[] = { - // { FW3_TABLE_FILTER, "INPUT", "delegate_input" }, - // { FW3_TABLE_FILTER, "OUTPUT", "delegate_output" }, - // { FW3_TABLE_FILTER, "FORWARD", "delegate_forward" }, - // - // { FW3_TABLE_NAT, "PREROUTING", "delegate_prerouting" }, - // { FW3_TABLE_NAT, "POSTROUTING", "delegate_postrouting" }, - // - // { FW3_TABLE_MANGLE, "FORWARD", "mssfix" }, - // { FW3_TABLE_MANGLE, "PREROUTING", "fwmark" }, - // - // { FW3_TABLE_RAW, "PREROUTING", "delegate_notrack" }, - // - // { 0, NULL }, - //}; - // - //for (tr = rules; tr->chain; tr++) - //{ - // if (tr->table != handle->table) - // continue; - // - // r = fw3_ipt_rule_new(handle); - // fw3_ipt_rule_target(r, tr->target); - // fw3_ipt_rule_replace(r, tr->chain); - //} - switch (handle->table) { case FW3_TABLE_FILTER: @@ -242,12 +225,23 @@ fw3_print_default_head_rules(struct fw3_ipt_handle *handle, for (i = 0; i < ARRAY_SIZE(chains); i += 2) { r = fw3_ipt_rule_new(handle); - fw3_ipt_rule_comment(r, "user chain for %s", chains[i+1]); + fw3_ipt_rule_comment(r, "Custom %s rule chain", chains[i+1]); fw3_ipt_rule_target(r, "%s_rule", chains[i+1]); fw3_ipt_rule_append(r, chains[i]); } } + if (defs->flow_offloading) + { + r = fw3_ipt_rule_new(handle); + fw3_ipt_rule_comment(r, "Traffic offloading"); + fw3_ipt_rule_extra(r, "-m conntrack --ctstate RELATED,ESTABLISHED"); + fw3_ipt_rule_target(r, "FLOWOFFLOAD"); + if (defs->flow_offloading_hw) + fw3_ipt_rule_addarg(r, false, "--hw", NULL); + fw3_ipt_rule_append(r, "FORWARD"); + } + for (i = 0; i < ARRAY_SIZE(chains); i += 2) { r = fw3_ipt_rule_new(handle); @@ -298,12 +292,12 @@ fw3_print_default_head_rules(struct fw3_ipt_handle *handle, if (defs->custom_chains) { r = fw3_ipt_rule_new(handle); - fw3_ipt_rule_comment(r, "user chain for prerouting"); + fw3_ipt_rule_comment(r, "Custom prerouting rule chain"); fw3_ipt_rule_target(r, "prerouting_rule"); fw3_ipt_rule_append(r, "PREROUTING"); r = fw3_ipt_rule_new(handle); - fw3_ipt_rule_comment(r, "user chain for postrouting"); + fw3_ipt_rule_comment(r, "Custom postrouting rule chain"); fw3_ipt_rule_target(r, "postrouting_rule"); fw3_ipt_rule_append(r, "POSTROUTING"); }