X-Git-Url: http://git.archive.openwrt.org/?p=project%2Ffirewall3.git;a=blobdiff_plain;f=defaults.c;h=ec95ec918e7e116bfdf0e5338690e5c06795d1bc;hp=10b11637c81482e0018d1ae68609161ea2425413;hb=e7b6234df3d34d82b909f1e7367a89d322f87814;hpb=ab591095d650bc3e997bad12aa7662e49d5cd9d5

diff --git a/defaults.c b/defaults.c
index 10b1163..ec95ec9 100644
--- a/defaults.c
+++ b/defaults.c
@@ -22,7 +22,7 @@
 #define C(f, tbl, def, fmt) \
 	{ FW3_FAMILY_##f, FW3_TABLE_##tbl, FW3_FLAG_##def, fmt }
 
-static const struct fw3_rule_spec default_chains[] = {
+static const struct fw3_chain_spec default_chains[] = {
 	C(ANY, FILTER, UNSPEC,        "delegate_input"),
 	C(ANY, FILTER, UNSPEC,        "delegate_output"),
 	C(ANY, FILTER, UNSPEC,        "delegate_forward"),
@@ -38,21 +38,9 @@ static const struct fw3_rule_spec default_chains[] = {
 	C(V4,  NAT,    CUSTOM_CHAINS, "postrouting_rule"),
 
 	C(ANY, MANGLE, UNSPEC,        "mssfix"),
-	C(ANY, RAW,    UNSPEC,        "notrack"),
-
-	{ }
-};
-
-static const struct fw3_rule_spec toplevel_rules[] = {
-	C(ANY, FILTER, UNSPEC,        "INPUT -j delegate_input"),
-	C(ANY, FILTER, UNSPEC,        "OUTPUT -j delegate_output"),
-	C(ANY, FILTER, UNSPEC,        "FORWARD -j delegate_forward"),
+	C(ANY, MANGLE, UNSPEC,        "fwmark"),
 
-	C(V4,  NAT,    UNSPEC,        "PREROUTING -j delegate_prerouting"),
-	C(V4,  NAT,    UNSPEC,        "POSTROUTING -j delegate_postrouting"),
-
-	C(ANY, MANGLE, UNSPEC,        "FORWARD -j mssfix"),
-	C(ANY, RAW,    UNSPEC,        "PREROUTING -j notrack"),
+	C(ANY, RAW,    UNSPEC,        "notrack"),
 
 	{ }
 };
@@ -79,6 +67,9 @@ const struct fw3_option fw3_flag_opts[] = {
 	FW3_OPT("custom_chains",       bool,     defaults, custom_chains),
 	FW3_OPT("disable_ipv6",        bool,     defaults, disable_ipv6),
 
+	FW3_OPT("__flags_v4",          int,      defaults, flags[0]),
+	FW3_OPT("__flags_v6",          int,      defaults, flags[1]),
+
 	{ }
 };
 
@@ -135,110 +126,186 @@ fw3_load_defaults(struct fw3_state *state, struct uci_package *p)
 }
 
 void
-fw3_print_default_chains(struct fw3_state *state, enum fw3_family family,
-                         enum fw3_table table, bool reload)
+fw3_print_default_chains(struct fw3_ipt_handle *handle, struct fw3_state *state,
+                         bool reload)
 {
-	bool rv;
 	struct fw3_defaults *defs = &state->defaults;
-	uint32_t custom_mask = ~0;
+	const struct fw3_chain_spec *c;
 
 #define policy(t) \
-	((t == FW3_FLAG_REJECT) ? "DROP" : fw3_flag_names[t])
+	((t == FW3_FLAG_REJECT) ? FW3_FLAG_DROP : t)
 
-	if (family == FW3_FAMILY_V6 && defs->disable_ipv6)
+	if (handle->family == FW3_FAMILY_V6 && defs->disable_ipv6)
 		return;
 
-	if (table == FW3_TABLE_FILTER)
+	if (handle->table == FW3_TABLE_FILTER)
 	{
-		fw3_pr(":INPUT %s [0:0]\n", policy(defs->policy_input));
-		fw3_pr(":FORWARD %s [0:0]\n", policy(defs->policy_forward));
-		fw3_pr(":OUTPUT %s [0:0]\n", policy(defs->policy_output));
+		fw3_ipt_set_policy(handle, "INPUT",   policy(defs->policy_input));
+		fw3_ipt_set_policy(handle, "OUTPUT",  policy(defs->policy_output));
+		fw3_ipt_set_policy(handle, "FORWARD", policy(defs->policy_forward));
 	}
 
-	/* Don't touch user chains on reload */
-	if (reload)
-		delbit(custom_mask, FW3_FLAG_CUSTOM_CHAINS);
-
 	if (defs->custom_chains)
-		set(defs->flags, family, FW3_FLAG_CUSTOM_CHAINS);
+		set(defs->flags, handle->family, FW3_FLAG_CUSTOM_CHAINS);
 
 	if (defs->syn_flood)
-		set(defs->flags, family, FW3_FLAG_SYN_FLOOD);
+		set(defs->flags, handle->family, FW3_FLAG_SYN_FLOOD);
 
-	rv = fw3_pr_rulespec(table, family, defs->flags, custom_mask,
-	                     default_chains, ":%s - [0:0]\n");
+	for (c = default_chains; c->format; c++)
+	{
+		/* don't touch user chains on selective stop */
+		if (reload && c->flag == FW3_FLAG_CUSTOM_CHAINS)
+			continue;
 
-	if (rv)
-		set(defs->flags, family, table);
+		if (!fw3_is_family(c, handle->family))
+			continue;
+
+		if (c->table != handle->table)
+			continue;
+
+		if (c->flag &&
+		    !hasbit(defs->flags[handle->family == FW3_FAMILY_V6], c->flag))
+			continue;
+
+		fw3_ipt_create_chain(handle, c->format);
+	}
+
+	set(defs->flags, handle->family, handle->table);
 }
 
+
+struct toplevel_rule {
+	enum fw3_table table;
+	const char *chain;
+	const char *target;
+};
+
 void
-fw3_print_default_head_rules(struct fw3_state *state, enum fw3_family family,
-                             enum fw3_table table, bool reload)
+fw3_print_default_head_rules(struct fw3_ipt_handle *handle,
+                             struct fw3_state *state, bool reload)
 {
 	int i;
 	struct fw3_defaults *defs = &state->defaults;
+	struct fw3_device lodev = { .set = true };
+	struct fw3_protocol tcp = { .protocol = 6 };
+	struct fw3_ipt_rule *r;
+	struct toplevel_rule *tr;
+
 	const char *chains[] = {
-		"input", "input",
-		"output", "output",
-		"forward", "forwarding",
+		"delegate_input", "input",
+		"delegate_output", "output",
+		"delegate_forward", "forwarding",
 	};
 
-	fw3_pr_rulespec(table, family, NULL, 0, toplevel_rules, "-A %s\n");
+	struct toplevel_rule rules[] = {
+		{ FW3_TABLE_FILTER, "INPUT",       "delegate_input" },
+		{ FW3_TABLE_FILTER, "OUTPUT",      "delegate_output" },
+		{ FW3_TABLE_FILTER, "FORWARD",     "delegate_forward" },
 
-	switch (table)
+		{ FW3_TABLE_NAT,    "PREROUTING",  "delegate_prerouting" },
+		{ FW3_TABLE_NAT,    "POSTROUTING", "delegate_postrouting" },
+
+		{ FW3_TABLE_MANGLE, "FORWARD",     "mssfix" },
+		{ FW3_TABLE_MANGLE, "PREROUTING",  "fwmark" },
+
+		{ FW3_TABLE_RAW,    "PREROUTING",  "notrack" },
+
+		{ 0, NULL },
+	};
+
+	for (tr = rules; tr->chain; tr++)
+	{
+		if (tr->table != handle->table)
+			continue;
+
+		r = fw3_ipt_rule_new(handle);
+		fw3_ipt_rule_target(r, tr->target);
+		fw3_ipt_rule_append(r, tr->chain);
+	}
+
+	switch (handle->table)
 	{
 	case FW3_TABLE_FILTER:
-		fw3_pr("-A delegate_input -i lo -j ACCEPT\n");
-		fw3_pr("-A delegate_output -o lo -j ACCEPT\n");
+
+		sprintf(lodev.name, "lo");
+
+		r = fw3_ipt_rule_create(handle, NULL, &lodev, NULL, NULL, NULL);
+		fw3_ipt_rule_target(r, "ACCEPT");
+		fw3_ipt_rule_append(r, "delegate_input");
+
+		r = fw3_ipt_rule_create(handle, NULL, NULL, &lodev, NULL, NULL);
+		fw3_ipt_rule_target(r, "ACCEPT");
+		fw3_ipt_rule_append(r, "delegate_output");
 
 		if (defs->custom_chains)
 		{
 			for (i = 0; i < ARRAY_SIZE(chains); i += 2)
 			{
-				fw3_pr("-A delegate_%s -m comment "
-				       "--comment \"user chain for %s\" -j %s_rule\n",
-					   chains[i], chains[i+1], chains[i+1]);
+				r = fw3_ipt_rule_new(handle);
+				fw3_ipt_rule_comment(r, "user chain for %s", chains[i+1]);
+				fw3_ipt_rule_target(r, "%s_rule", chains[i+1]);
+				fw3_ipt_rule_append(r, chains[i]);
 			}
 		}
 
 		for (i = 0; i < ARRAY_SIZE(chains); i += 2)
 		{
-			fw3_pr("-A delegate_%s -m conntrack --ctstate RELATED,ESTABLISHED "
-			       "-j ACCEPT\n", chains[i]);
+			r = fw3_ipt_rule_new(handle);
+			fw3_ipt_rule_extra(r, "-m conntrack --ctstate RELATED,ESTABLISHED");
+			fw3_ipt_rule_target(r, "ACCEPT");
+			fw3_ipt_rule_append(r, chains[i]);
 
 			if (defs->drop_invalid)
 			{
-				fw3_pr("-A delegate_%s -m conntrack --ctstate INVALID -j DROP\n",
-				       chains[i]);
+				r = fw3_ipt_rule_new(handle);
+				fw3_ipt_rule_extra(r, "-m conntrack --ctstate INVALID");
+				fw3_ipt_rule_target(r, "DROP");
+				fw3_ipt_rule_append(r, chains[i]);
 			}
 		}
 
 		if (defs->syn_flood)
 		{
-			fw3_pr("-A syn_flood -p tcp --syn");
-			fw3_format_limit(&defs->syn_flood_rate);
-			fw3_pr(" -j RETURN\n");
-
-			fw3_pr("-A syn_flood -j DROP\n");
-			fw3_pr("-A delegate_input -p tcp --syn -j syn_flood\n");
+			r = fw3_ipt_rule_create(handle, &tcp, NULL, NULL, NULL, NULL);
+			fw3_ipt_rule_extra(r, "--syn");
+			fw3_ipt_rule_limit(r, &defs->syn_flood_rate);
+			fw3_ipt_rule_target(r, "RETURN");
+			fw3_ipt_rule_append(r, "syn_flood");
+
+			r = fw3_ipt_rule_new(handle);
+			fw3_ipt_rule_target(r, "DROP");
+			fw3_ipt_rule_append(r, "syn_flood");
+
+			r = fw3_ipt_rule_create(handle, &tcp, NULL, NULL, NULL, NULL);
+			fw3_ipt_rule_extra(r, "--syn");
+			fw3_ipt_rule_target(r, "syn_flood");
+			fw3_ipt_rule_append(r, "delegate_input");
 		}
 
-		fw3_pr("-A reject -p tcp -j REJECT --reject-with tcp-reset\n");
-		fw3_pr("-A reject -j REJECT --reject-with port-unreach\n");
+		r = fw3_ipt_rule_create(handle, &tcp, NULL, NULL, NULL, NULL);
+		fw3_ipt_rule_target(r, "REJECT");
+		fw3_ipt_rule_addarg(r, false, "--reject-with", "tcp-reset");
+		fw3_ipt_rule_append(r, "reject");
+
+		r = fw3_ipt_rule_new(handle);
+		fw3_ipt_rule_target(r, "REJECT");
+		fw3_ipt_rule_addarg(r, false, "--reject-with", "port-unreach");
+		fw3_ipt_rule_append(r, "reject");
 
 		break;
 
 	case FW3_TABLE_NAT:
 		if (defs->custom_chains)
 		{
-			fw3_pr("-A delegate_prerouting "
-			       "-m comment --comment \"user chain for prerouting\" "
-			       "-j prerouting_rule\n");
-
-			fw3_pr("-A delegate_postrouting "
-			       "-m comment --comment \"user chain for postrouting\" "
-			       "-j postrouting_rule\n");
+			r = fw3_ipt_rule_new(handle);
+			fw3_ipt_rule_comment(r, "user chain for prerouting");
+			fw3_ipt_rule_target(r, "prerouting_rule");
+			fw3_ipt_rule_append(r, "delegate_prerouting");
+
+			r = fw3_ipt_rule_new(handle);
+			fw3_ipt_rule_comment(r, "user chain for postrouting");
+			fw3_ipt_rule_target(r, "postrouting_rule");
+			fw3_ipt_rule_append(r, "delegate_postrouting");
 		}
 		break;
 
@@ -248,22 +315,47 @@ fw3_print_default_head_rules(struct fw3_state *state, enum fw3_family family,
 }
 
 void
-fw3_print_default_tail_rules(struct fw3_state *state, enum fw3_family family,
-                             enum fw3_table table, bool reload)
+fw3_print_default_tail_rules(struct fw3_ipt_handle *handle,
+                             struct fw3_state *state, bool reload)
 {
 	struct fw3_defaults *defs = &state->defaults;
+	struct fw3_ipt_rule *r;
 
-	if (table != FW3_TABLE_FILTER)
+	if (handle->table != FW3_TABLE_FILTER)
 		return;
 
 	if (defs->policy_input == FW3_FLAG_REJECT)
-		fw3_pr("-A delegate_input -j reject\n");
+	{
+		r = fw3_ipt_rule_new(handle);
+
+		if (!r)
+			return;
+
+		fw3_ipt_rule_target(r, "reject");
+		fw3_ipt_rule_append(r, "delegate_input");
+	}
 
 	if (defs->policy_output == FW3_FLAG_REJECT)
-		fw3_pr("-A delegate_output -j reject\n");
+	{
+		r = fw3_ipt_rule_new(handle);
+
+		if (!r)
+			return;
+
+		fw3_ipt_rule_target(r, "reject");
+		fw3_ipt_rule_append(r, "delegate_output");
+	}
 
 	if (defs->policy_forward == FW3_FLAG_REJECT)
-		fw3_pr("-A delegate_forward -j reject\n");
+	{
+		r = fw3_ipt_rule_new(handle);
+
+		if (!r)
+			return;
+
+		fw3_ipt_rule_target(r, "reject");
+		fw3_ipt_rule_append(r, "delegate_forward");
+	}
 }
 
 static void
@@ -294,55 +386,55 @@ fw3_set_defaults(struct fw3_state *state)
 	set_default("window_scaling", state->defaults.tcp_window_scaling);
 }
 
-static void
-reset_policy(enum fw3_table table, enum fw3_flag policy)
-{
-	if (table != FW3_TABLE_FILTER)
-		return;
-
-	fw3_pr(":INPUT %s [0:0]\n", fw3_flag_names[policy]);
-	fw3_pr(":OUTPUT %s [0:0]\n", fw3_flag_names[policy]);
-	fw3_pr(":FORWARD %s [0:0]\n", fw3_flag_names[policy]);
-}
-
 void
-fw3_flush_rules(struct fw3_state *state, enum fw3_family family,
-                enum fw3_table table, bool reload, bool pass2)
+fw3_flush_rules(struct fw3_ipt_handle *handle, struct fw3_state *state,
+                bool reload)
 {
+	enum fw3_flag policy = reload ? FW3_FLAG_DROP : FW3_FLAG_ACCEPT;
 	struct fw3_defaults *defs = &state->defaults;
-	uint32_t custom_mask = ~0;
+	const struct fw3_chain_spec *c;
 
-	if (!has(defs->flags, family, table))
+	if (!has(defs->flags, handle->family, handle->table))
 		return;
 
-	/* don't touch user chains on selective stop */
-	if (reload)
-		delbit(custom_mask, FW3_FLAG_CUSTOM_CHAINS);
+	if (handle->table == FW3_TABLE_FILTER)
+	{
+		fw3_ipt_set_policy(handle, "INPUT",   policy);
+		fw3_ipt_set_policy(handle, "OUTPUT",  policy);
+		fw3_ipt_set_policy(handle, "FORWARD", policy);
+	}
 
-	if (!pass2)
+	for (c = default_chains; c->format; c++)
 	{
-		reset_policy(table, reload ? FW3_FLAG_DROP : FW3_FLAG_ACCEPT);
+		/* don't touch user chains on selective stop */
+		if (reload && c->flag == FW3_FLAG_CUSTOM_CHAINS)
+			continue;
 
-		fw3_pr_rulespec(table, family, defs->flags, custom_mask,
-		                toplevel_rules, "-D %s\n");
+		if (!fw3_is_family(c, handle->family))
+			continue;
 
-		fw3_pr_rulespec(table, family, defs->flags, custom_mask,
-		                default_chains, "-F %s\n");
-	}
-	else
-	{
-		fw3_pr_rulespec(table, family, defs->flags, custom_mask,
-		                default_chains, "-X %s\n");
+		if (c->table != handle->table)
+			continue;
+
+		if (c->flag && !has(defs->flags, handle->family, c->flag))
+			continue;
 
-		del(defs->flags, family, table);
+		fw3_ipt_delete_rules(handle, c->format);
+		fw3_ipt_delete_chain(handle, c->format);
 	}
+
+	del(defs->flags, handle->family, handle->table);
 }
 
 void
-fw3_flush_all(enum fw3_table table)
+fw3_flush_all(struct fw3_ipt_handle *handle)
 {
-	reset_policy(table, FW3_FLAG_ACCEPT);
+	if (handle->table == FW3_TABLE_FILTER)
+	{
+		fw3_ipt_set_policy(handle, "INPUT",   FW3_FLAG_ACCEPT);
+		fw3_ipt_set_policy(handle, "OUTPUT",  FW3_FLAG_ACCEPT);
+		fw3_ipt_set_policy(handle, "FORWARD", FW3_FLAG_ACCEPT);
+	}
 
-	fw3_pr("-F\n");
-	fw3_pr("-X\n");
+	fw3_ipt_flush(handle);
 }