X-Git-Url: http://git.archive.openwrt.org/?p=project%2Ffirewall3.git;a=blobdiff_plain;f=ipsets.c;h=713b34378dd0551c2a1860c120f10438610bd1cb;hp=e2c857568c058174ed90341860bc6e30de84367b;hb=9ce8ca5ec9d28f6e5449c6ce138648cbaf99b438;hpb=5df8137ebc5db2bc9c6e71b2d154a5f77679d9d8 diff --git a/ipsets.c b/ipsets.c index e2c8575..713b343 100644 --- a/ipsets.c +++ b/ipsets.c @@ -20,13 +20,15 @@ const struct fw3_option fw3_ipset_opts[] = { + FW3_OPT("enabled", bool, ipset, enabled), + FW3_OPT("name", string, ipset, name), FW3_OPT("family", family, ipset, family), FW3_OPT("storage", ipset_method, ipset, method), FW3_LIST("match", ipset_datatype, ipset, datatypes), - FW3_LIST("iprange", address, ipset, iprange), + FW3_OPT("iprange", address, ipset, iprange), FW3_OPT("portrange", port, ipset, portrange), FW3_OPT("netmask", int, ipset, netmask), @@ -89,15 +91,6 @@ check_types(struct uci_element *e, struct fw3_ipset *ipset) uint32_t typelist = 0; struct fw3_ipset_datatype *type; - const char *methods[] = { - "(bug)", - "bitmap", - "hash", - "list", - }; - - typelist = 0; - list_for_each_entry(type, &ipset->datatypes, list) { if (i >= 3) @@ -119,7 +112,7 @@ check_types(struct uci_element *e, struct fw3_ipset *ipset) ipset->method = ipset_types[i].method; warn_elem(e, "defines no storage method, assuming '%s'", - methods[ipset->method]); + fw3_ipset_method_names[ipset->method]); break; } @@ -136,7 +129,7 @@ check_types(struct uci_element *e, struct fw3_ipset *ipset) if (!ipset->external || !*ipset->external) { if ((ipset_types[i].required & OPT_IPRANGE) && - list_empty(&ipset->iprange)) + !ipset->iprange.set) { warn_elem(e, "requires an ip range"); return false; @@ -150,17 +143,17 @@ check_types(struct uci_element *e, struct fw3_ipset *ipset) } if (!(ipset_types[i].required & OPT_IPRANGE) && - !list_empty(&ipset->iprange)) + ipset->iprange.set) { warn_elem(e, "iprange ignored"); - fw3_free_list(&ipset->iprange); + ipset->iprange.set = false; } if (!(ipset_types[i].required & OPT_PORTRANGE) && ipset->portrange.set) { warn_elem(e, "portrange ignored"); - memset(&ipset->portrange, 0, sizeof(ipset->portrange)); + ipset->portrange.set = false; } if (!(ipset_types[i].optional & OPT_NETMASK) && @@ -213,7 +206,8 @@ fw3_alloc_ipset(void) memset(ipset, 0, sizeof(*ipset)); INIT_LIST_HEAD(&ipset->datatypes); - INIT_LIST_HEAD(&ipset->iprange); + + ipset->enabled = true; return ipset; } @@ -271,67 +265,26 @@ static void create_ipset(struct fw3_ipset *ipset, struct fw3_state *state) { bool first = true; - char s[INET6_ADDRSTRLEN]; struct fw3_ipset_datatype *type; - struct fw3_address *a1, *a2; - - const char *methods[] = { - "(bug)", - "bitmap", - "hash", - "list", - }; - - const char *types[] = { - "(bug)", - "ip", - "port", - "mac", - "net", - "set", - }; if (ipset->external && *ipset->external) return; - info("Creating ipset %s", ipset->name); + info(" * Creating ipset %s", ipset->name); first = true; - fw3_pr("create %s %s", ipset->name, methods[ipset->method]); + fw3_pr("create %s %s", ipset->name, fw3_ipset_method_names[ipset->method]); list_for_each_entry(type, &ipset->datatypes, list) { - fw3_pr("%c%s", first ? ':' : ',', types[type->type]); + fw3_pr("%c%s", first ? ':' : ',', fw3_ipset_type_names[type->type]); first = false; } - if (!list_empty(&ipset->iprange)) + if (ipset->iprange.set) { - a1 = list_first_entry(&ipset->iprange, struct fw3_address, list); - a2 = list_last_entry(&ipset->iprange, struct fw3_address, list); - - if (a1 == a2) - { - inet_ntop(a1->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6, - &a1->address.v6, s, sizeof(s)); - - fw3_pr(" range %s/%u", s, a1->mask); - } - else if (a1->family == a2->family && - fw3_is_family(ipset, a1->family) && - fw3_is_family(ipset, a2->family)) - { - inet_ntop(a1->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6, - &a1->address.v6, s, sizeof(s)); - - fw3_pr(" range %s", s); - - inet_ntop(a2->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6, - &a2->address.v6, s, sizeof(s)); - - fw3_pr("-%s", s); - } + fw3_pr(" range %s", fw3_address_to_string(&ipset->iprange, false)); } else if (ipset->portrange.set) { @@ -355,8 +308,6 @@ create_ipset(struct fw3_ipset *ipset, struct fw3_state *state) fw3_pr(" hashsize %u", ipset->hashsize); fw3_pr("\n"); - - fw3_set_running(ipset, &state->running_ipsets); } void @@ -368,8 +319,7 @@ fw3_create_ipsets(struct fw3_state *state) return; list_for_each_entry(ipset, &state->ipsets, list) - if (!fw3_lookup_ipset(state, ipset->name, true)) - create_ipset(ipset, state); + create_ipset(ipset, state); fw3_pr("quit\n"); } @@ -377,31 +327,21 @@ fw3_create_ipsets(struct fw3_state *state) void fw3_destroy_ipsets(struct fw3_state *state) { - struct fw3_ipset *s, *tmp; - int mask = (1 << FW3_FAMILY_V4) | (1 << FW3_FAMILY_V6); + struct fw3_ipset *s; - list_for_each_entry_safe(s, tmp, &state->running_ipsets, running_list) + list_for_each_entry(s, &state->ipsets, list) { - if (!hasbit(state->defaults.flags, FW3_FAMILY_V4)) - delbit(s->flags, FW3_FAMILY_V4); - - if (!hasbit(state->defaults.flags, FW3_FAMILY_V6)) - delbit(s->flags, FW3_FAMILY_V6); - - if (!(s->flags & mask)) - { - info("Deleting ipset %s", s->name); - - fw3_pr("flush %s\n", s->name); - fw3_pr("destroy %s\n", s->name); + info(" * Deleting ipset %s", s->name); - fw3_set_running(s, NULL); - } + fw3_pr("flush %s\n", s->name); + fw3_pr("destroy %s\n", s->name); } + + fw3_pr("quit\n"); } struct fw3_ipset * -fw3_lookup_ipset(struct fw3_state *state, const char *name, bool running) +fw3_lookup_ipset(struct fw3_state *state, const char *name) { struct fw3_ipset *s; @@ -413,10 +353,7 @@ fw3_lookup_ipset(struct fw3_state *state, const char *name, bool running) if (strcmp(s->name, name)) continue; - if (!running || s->running_list.next) - return s; - - break; + return s; } return NULL;