X-Git-Url: http://git.archive.openwrt.org/?p=project%2Ffirewall3.git;a=blobdiff_plain;f=defaults.c;h=556d3b9eae398007b17e7822ea2de5e4f84d4808;hp=498e5d5bbd40c4cae244089472d9a5a39e04747e;hb=5b051a66fad3c208380d69b4b13d09929fcfe101;hpb=8fee8f9c520c58d07772cc6bd8f65d9eb1776a56

diff --git a/defaults.c b/defaults.c
index 498e5d5..556d3b9 100644
--- a/defaults.c
+++ b/defaults.c
@@ -19,6 +19,47 @@
 #include "defaults.h"
 
 
+#define C(f, tbl, def, name) \
+	{ FW3_FAMILY_##f, FW3_TABLE_##tbl, FW3_DEFAULT_##def, name }
+
+struct chain {
+	enum fw3_family family;
+	enum fw3_table table;
+	enum fw3_default flag;
+	const char *name;
+};
+
+static const struct chain default_chains[] = {
+	C(ANY, FILTER, UNSPEC,        "delegate_input"),
+	C(ANY, FILTER, UNSPEC,        "delegate_output"),
+	C(ANY, FILTER, UNSPEC,        "delegate_forward"),
+	C(ANY, FILTER, CUSTOM_CHAINS, "input_rule"),
+	C(ANY, FILTER, CUSTOM_CHAINS, "output_rule"),
+	C(ANY, FILTER, CUSTOM_CHAINS, "forwarding_rule"),
+	C(ANY, FILTER, UNSPEC,        "reject"),
+	C(ANY, FILTER, SYN_FLOOD,     "syn_flood"),
+
+	C(V4,  NAT,    UNSPEC,        "delegate_prerouting"),
+	C(V4,  NAT,    UNSPEC,        "delegate_postrouting"),
+	C(V4,  NAT,    CUSTOM_CHAINS, "prerouting_rule"),
+	C(V4,  NAT,    CUSTOM_CHAINS, "postrouting_rule"),
+
+	C(ANY, MANGLE, UNSPEC,        "mssfix"),
+	C(ANY, RAW,    UNSPEC,        "notrack"),
+};
+
+static const struct chain toplevel_rules[] = {
+	C(ANY, FILTER, UNSPEC,        "INPUT -j delegate_input"),
+	C(ANY, FILTER, UNSPEC,        "OUTPUT -j delegate_output"),
+	C(ANY, FILTER, UNSPEC,        "FORWARD -j delegate_forward"),
+
+	C(V4,  NAT,    UNSPEC,        "PREROUTING -j delegate_prerouting"),
+	C(V4,  NAT,    UNSPEC,        "POSTROUTING -j delegate_postrouting"),
+
+	C(ANY, MANGLE, UNSPEC,        "FORWARD -j mssfix"),
+	C(ANY, RAW,    UNSPEC,        "PREROUTING -j notrack"),
+};
+
 static struct fw3_option default_opts[] = {
 	FW3_OPT("input",               target,   defaults, policy_input),
 	FW3_OPT("forward",             target,   defaults, policy_forward),
@@ -44,6 +85,33 @@ static struct fw3_option default_opts[] = {
 };
 
 
+static bool
+print_chains(enum fw3_table table, enum fw3_family family,
+             const char *fmt, uint8_t flags,
+             const struct chain *chains, int n)
+{
+	bool rv = false;
+	const struct chain *c;
+
+	for (c = chains; n > 0; c++, n--)
+	{
+		if (!fw3_is_family(c, family))
+			continue;
+
+		if (c->table != table)
+			continue;
+
+		if ((c->flag != FW3_DEFAULT_UNSPEC) && !(flags & (1 << c->flag)))
+			continue;
+
+		fw3_pr(fmt, c->name);
+
+		rv = true;
+	}
+
+	return rv;
+}
+
 static void
 check_policy(struct uci_element *e, enum fw3_target *pol, const char *name)
 {
@@ -74,6 +142,8 @@ fw3_load_defaults(struct fw3_state *state, struct uci_package *p)
 	defs->tcp_window_scaling   = true;
 	defs->custom_chains        = true;
 
+	defs->has_flag = (1 << FW3_DEFAULT_IPV4_LOADED);
+
 	uci_foreach_element(&p->sections, e)
 	{
 		s = uci_to_section(e);
@@ -93,6 +163,15 @@ fw3_load_defaults(struct fw3_state *state, struct uci_package *p)
 		check_policy(e, &defs->policy_input, "input");
 		check_policy(e, &defs->policy_output, "output");
 		check_policy(e, &defs->policy_forward, "forward");
+
+		if (!defs->disable_ipv6)
+			setbit(defs->has_flag, FW3_DEFAULT_IPV6_LOADED);
+
+		if (defs->custom_chains)
+			setbit(defs->has_flag, FW3_DEFAULT_CUSTOM_CHAINS);
+
+		if (defs->syn_flood)
+			setbit(defs->has_flag, FW3_DEFAULT_SYN_FLOOD);
 	}
 }
 
@@ -111,72 +190,53 @@ fw3_print_default_chains(enum fw3_table table, enum fw3_family family,
 		"(bug)",
 	};
 
-	switch (table)
+	if (table == FW3_TABLE_FILTER)
 	{
-	case FW3_TABLE_FILTER:
 		fw3_pr(":INPUT %s [0:0]\n", policy[defs->policy_input]);
 		fw3_pr(":FORWARD %s [0:0]\n", policy[defs->policy_forward]);
 		fw3_pr(":OUTPUT %s [0:0]\n", policy[defs->policy_output]);
-
-		if (defs->custom_chains)
-		{
-			fw3_pr(":input_rule - [0:0]\n");
-			fw3_pr(":output_rule - [0:0]\n");
-			fw3_pr(":forwarding_rule - [0:0]\n");
-		}
-
-		fw3_pr(":delegate_input - [0:0]\n");
-		fw3_pr(":delegate_output - [0:0]\n");
-		fw3_pr(":delegate_forward - [0:0]\n");
-		fw3_pr(":reject - [0:0]\n");
-		fw3_pr(":syn_flood - [0:0]\n");
-		break;
-
-	case FW3_TABLE_NAT:
-		if (defs->custom_chains)
-		{
-			fw3_pr(":prerouting_rule - [0:0]\n");
-			fw3_pr(":postrouting_rule - [0:0]\n");
-		}
-		break;
-
-	case FW3_TABLE_MANGLE:
-		fw3_pr(":mssfix - [0:0]\n");
-		break;
-
-	case FW3_TABLE_RAW:
-		if (!defs->drop_invalid)
-			fw3_pr(":notrack - [0:0]\n");
-		break;
 	}
+
+	print_chains(table, family, ":%s - [0:0]\n", defs->has_flag,
+	             default_chains, ARRAY_SIZE(default_chains));
 }
 
 void
-fw3_print_default_rules(enum fw3_table table, enum fw3_family family,
-                        struct fw3_state *state)
+fw3_print_default_head_rules(enum fw3_table table, enum fw3_family family,
+                             struct fw3_state *state)
 {
 	int i;
 	struct fw3_defaults *defs = &state->defaults;
 	const char *chains[] = {
-		"INPUT",
-		"OUTPUT",
-		"FORWARD",
+		"input",
+		"output",
+		"forward",
 	};
 
+	print_chains(table, family, "-A %s\n", 0,
+	             toplevel_rules, ARRAY_SIZE(toplevel_rules));
+
 	switch (table)
 	{
 	case FW3_TABLE_FILTER:
-		fw3_pr("-A INPUT -i lo -j ACCEPT\n");
-		fw3_pr("-A OUTPUT -o lo -j ACCEPT\n");
+		fw3_pr("-A delegate_input -i lo -j ACCEPT\n");
+		fw3_pr("-A delegate_output -o lo -j ACCEPT\n");
+
+		if (defs->custom_chains)
+		{
+			fw3_pr("-A delegate_input -j input_rule\n");
+			fw3_pr("-A delegate_output -j output_rule\n");
+			fw3_pr("-A delegate_forward -j forwarding_rule\n");
+		}
 
 		for (i = 0; i < ARRAY_SIZE(chains); i++)
 		{
-			fw3_pr("-A %s -m conntrack --ctstate RELATED,ESTABLISHED "
+			fw3_pr("-A delegate_%s -m conntrack --ctstate RELATED,ESTABLISHED "
 			       "-j ACCEPT\n", chains[i]);
 
 			if (defs->drop_invalid)
 			{
-				fw3_pr("-A %s -m conntrack --ctstate INVALID -j DROP\n",
+				fw3_pr("-A delegate_%s -m conntrack --ctstate INVALID -j DROP\n",
 				       chains[i]);
 			}
 		}
@@ -188,96 +248,91 @@ fw3_print_default_rules(enum fw3_table table, enum fw3_family family,
 			fw3_pr(" -j RETURN\n");
 
 			fw3_pr("-A syn_flood -j DROP\n");
-			fw3_pr("-A INPUT -p tcp --syn -j syn_flood\n");
-		}
-
-		if (defs->custom_chains)
-		{
-			fw3_pr("-A INPUT -j input_rule\n");
-			fw3_pr("-A OUTPUT -j output_rule\n");
-			fw3_pr("-A FORWARD -j forwarding_rule\n");
+			fw3_pr("-A delegate_input -p tcp --syn -j syn_flood\n");
 		}
 
-		fw3_pr("-A INPUT -j delegate_input\n");
-		fw3_pr("-A OUTPUT -j delegate_output\n");
-		fw3_pr("-A FORWARD -j delegate_forward\n");
-
 		fw3_pr("-A reject -p tcp -j REJECT --reject-with tcp-reset\n");
 		fw3_pr("-A reject -j REJECT --reject-with port-unreach\n");
 
-		if (defs->policy_input == FW3_TARGET_REJECT)
-			fw3_pr("-A INPUT -j reject\n");
-
-		if (defs->policy_output == FW3_TARGET_REJECT)
-			fw3_pr("-A OUTPUT -j reject\n");
-
-		if (defs->policy_forward == FW3_TARGET_REJECT)
-			fw3_pr("-A FORWARD -j reject\n");
-
 		break;
 
 	case FW3_TABLE_NAT:
 		if (defs->custom_chains)
 		{
-			fw3_pr("-A PREROUTING -j prerouting_rule\n");
-			fw3_pr("-A POSTROUTING -j postrouting_rule\n");
+			fw3_pr("-A delegate_prerouting -j prerouting_rule\n");
+			fw3_pr("-A delegate_postrouting -j postrouting_rule\n");
 		}
 		break;
 
-	case FW3_TABLE_MANGLE:
-		fw3_pr("-A FORWARD -j mssfix\n");
-		break;
-
-	case FW3_TABLE_RAW:
-		if (!defs->drop_invalid)
-			fw3_pr("-A PREROUTING -j notrack\n");
+	default:
 		break;
 	}
 }
 
 void
-fw3_print_flush_rules(enum fw3_table table, enum fw3_family family,
-					  struct fw3_state *state, bool complete)
+fw3_print_default_tail_rules(enum fw3_table table, enum fw3_family family,
+                             struct fw3_state *state)
 {
-	switch (table)
-	{
-	case FW3_TABLE_FILTER:
-		fw3_pr(":INPUT ACCEPT [0:0]\n");
-		fw3_pr(":OUTPUT ACCEPT [0:0]\n");
-		fw3_pr(":FORWARD ACCEPT [0:0]\n");
-		/* fall through */
+	struct fw3_defaults *defs = &state->defaults;
 
-	case FW3_TABLE_NAT:
-		fw3_pr("-F\n");
-		fw3_pr("-X\n");
-		break;
+	if (table != FW3_TABLE_FILTER)
+		return;
 
-	case FW3_TABLE_MANGLE:
-		if (complete)
-		{
-			fw3_pr("-F\n");
-			fw3_pr("-X\n");
-		}
-		else
-		{
-			fw3_pr("-D FORWARD -j mssfix\n");
-			fw3_pr("-F mssfix\n");
-			fw3_pr("-X mssfix\n");
-		}
-		break;
+	if (defs->policy_input == FW3_TARGET_REJECT)
+		fw3_pr("-A delegate_input -j reject\n");
+
+	if (defs->policy_output == FW3_TARGET_REJECT)
+		fw3_pr("-A delegate_output -j reject\n");
+
+	if (defs->policy_forward == FW3_TARGET_REJECT)
+		fw3_pr("-A delegate_forward -j reject\n");
+}
+
+static void
+reset_policy(enum fw3_table table)
+{
+	if (table != FW3_TABLE_FILTER)
+		return;
+
+	fw3_pr(":INPUT ACCEPT [0:0]\n");
+	fw3_pr(":OUTPUT ACCEPT [0:0]\n");
+	fw3_pr(":FORWARD ACCEPT [0:0]\n");
+}
+
+void
+fw3_flush_rules(enum fw3_table table, enum fw3_family family,
+                bool pass2, struct list_head *statefile)
+{
+	struct fw3_statefile_entry *e;
+
+	list_for_each_entry(e, statefile, list)
+	{
+		if (e->type != FW3_TYPE_DEFAULTS)
+			continue;
 
-	case FW3_TABLE_RAW:
-		if (complete)
+		if (!pass2)
 		{
-			fw3_pr("-F\n");
-			fw3_pr("-X\n");
+			reset_policy(table);
+
+			print_chains(table, family, "-D %s\n", e->flags[0],
+			             toplevel_rules, ARRAY_SIZE(toplevel_rules));
+
+			print_chains(table, family, "-F %s\n", e->flags[0],
+			             default_chains, ARRAY_SIZE(default_chains));
 		}
 		else
 		{
-			fw3_pr("-D PREROUTING -j notrack\n");
-			fw3_pr("-F notrack\n");
-			fw3_pr("-X notrack\n");
+			print_chains(table, family, "-X %s\n", e->flags[0],
+			             default_chains, ARRAY_SIZE(default_chains));
 		}
-		break;
 	}
 }
+
+void
+fw3_flush_all(enum fw3_table table)
+{
+	reset_policy(table);
+
+	fw3_pr("-F\n");
+	fw3_pr("-X\n");
+}