X-Git-Url: http://git.archive.openwrt.org/?p=project%2Ffirewall3.git;a=blobdiff_plain;f=ipsets.c;h=b73c3d28c64d99d7769f44ca9ad0da6a19241111;hp=03259444b564c30e582189836d1fe1e36154bbb5;hb=f742ba7d20cb07f6306ebacedbb165b3fc7064ad;hpb=be8ead27f625b3e4ed383f270dcfee2d158231ec diff --git a/ipsets.c b/ipsets.c index 0325944..b73c3d2 100644 --- a/ipsets.c +++ b/ipsets.c @@ -38,6 +38,9 @@ const struct fw3_option fw3_ipset_opts[] = { FW3_OPT("external", string, ipset, external), + FW3_LIST("entry", setentry, ipset, entries), + FW3_OPT("loadfile", string, ipset, loadfile), + { } }; @@ -95,7 +98,7 @@ check_types(struct uci_element *e, struct fw3_ipset *ipset) { if (i >= 3) { - warn_elem(e, "must not have more than 3 datatypes assigned"); + warn_section("ipset", ipset, e, "must not have more than 3 datatypes assigned"); return false; } @@ -116,8 +119,8 @@ check_types(struct uci_element *e, struct fw3_ipset *ipset) { ipset->method = ipset_types[i].method; - warn_elem(e, "defines no storage method, assuming '%s'", - fw3_ipset_method_names[ipset->method]); + warn_section("ipset", ipset, e, "defines no storage method, assuming '%s'", + fw3_ipset_method_names[ipset->method]); break; } @@ -136,56 +139,56 @@ check_types(struct uci_element *e, struct fw3_ipset *ipset) if ((ipset_types[i].required & OPT_IPRANGE) && !ipset->iprange.set) { - warn_elem(e, "requires an ip range"); + warn_section("ipset", ipset, e, "requires an ip range"); return false; } if ((ipset_types[i].required & OPT_PORTRANGE) && !ipset->portrange.set) { - warn_elem(e, "requires a port range"); + warn_section("ipset", ipset, e, "requires a port range"); return false; } if (!(ipset_types[i].required & OPT_IPRANGE) && ipset->iprange.set) { - warn_elem(e, "iprange ignored"); + warn_section("ipset", ipset, e, "iprange ignored"); ipset->iprange.set = false; } if (!(ipset_types[i].required & OPT_PORTRANGE) && ipset->portrange.set) { - warn_elem(e, "portrange ignored"); + warn_section("ipset", ipset, e, "portrange ignored"); ipset->portrange.set = false; } if (!(ipset_types[i].optional & OPT_NETMASK) && ipset->netmask > 0) { - warn_elem(e, "netmask ignored"); + warn_section("ipset", ipset, e, "netmask ignored"); ipset->netmask = 0; } if (!(ipset_types[i].optional & OPT_HASHSIZE) && ipset->hashsize > 0) { - warn_elem(e, "hashsize ignored"); + warn_section("ipset", ipset, e, "hashsize ignored"); ipset->hashsize = 0; } if (!(ipset_types[i].optional & OPT_MAXELEM) && ipset->maxelem > 0) { - warn_elem(e, "maxelem ignored"); + warn_section("ipset", ipset, e, "maxelem ignored"); ipset->maxelem = 0; } if (!(ipset_types[i].optional & OPT_FAMILY) && ipset->family != FW3_FAMILY_V4) { - warn_elem(e, "family ignored"); + warn_section("ipset", ipset, e, "family ignored"); ipset->family = FW3_FAMILY_V4; } } @@ -194,12 +197,51 @@ check_types(struct uci_element *e, struct fw3_ipset *ipset) } } - warn_elem(e, "has an invalid combination of storage method and matches"); + warn_section("ipset", ipset, e, "has an invalid combination of storage method and matches"); return false; } -struct fw3_ipset * -fw3_alloc_ipset(void) +static bool +check_ipset(struct fw3_state *state, struct fw3_ipset *ipset, struct uci_element *e) +{ + if (ipset->external) + { + if (!*ipset->external) + ipset->external = NULL; + else if (!ipset->name) + ipset->name = ipset->external; + } + + if (!ipset->name || !*ipset->name) + { + warn_section("ipset", ipset, e, "ipset must have a name assigned"); + } + //else if (fw3_lookup_ipset(state, ipset->name) != NULL) + //{ + // warn_section("ipset", ipset, e, "has duplicated set name", ipset->name); + //} + else if (ipset->family == FW3_FAMILY_ANY) + { + warn_section("ipset", ipset, e, "must not have family 'any'"); + } + else if (ipset->iprange.set && ipset->family != ipset->iprange.family) + { + warn_section("ipset", ipset, e, "has iprange of wrong address family"); + } + else if (list_empty(&ipset->datatypes)) + { + warn_section("ipset", ipset, e, "has no datatypes assigned"); + } + else if (check_types(e, ipset)) + { + return true; + } + + return false; +} + +static struct fw3_ipset * +fw3_alloc_ipset(struct fw3_state *state) { struct fw3_ipset *ipset; @@ -208,83 +250,107 @@ fw3_alloc_ipset(void) return NULL; INIT_LIST_HEAD(&ipset->datatypes); + INIT_LIST_HEAD(&ipset->entries); ipset->enabled = true; ipset->family = FW3_FAMILY_V4; + list_add_tail(&ipset->list, &state->ipsets); + return ipset; } void -fw3_load_ipsets(struct fw3_state *state, struct uci_package *p) +fw3_load_ipsets(struct fw3_state *state, struct uci_package *p, + struct blob_attr *a) { struct uci_section *s; struct uci_element *e; struct fw3_ipset *ipset; + struct blob_attr *entry; + unsigned rem; INIT_LIST_HEAD(&state->ipsets); if (state->disable_ipsets) return; - uci_foreach_element(&p->sections, e) + blob_for_each_attr(entry, a, rem) { - s = uci_to_section(e); + const char *type; + const char *name = "ubus ipset"; - if (strcmp(s->type, "ipset")) + if (!fw3_attr_parse_name_type(entry, &name, &type)) continue; - ipset = fw3_alloc_ipset(); + if (strcmp(type, "ipset")) + continue; + ipset = fw3_alloc_ipset(state); if (!ipset) continue; - fw3_parse_options(ipset, fw3_ipset_opts, s); - - if (ipset->external) + if (!fw3_parse_blob_options(ipset, fw3_ipset_opts, entry, name)) { - if (!*ipset->external) - ipset->external = NULL; - else if (!ipset->name) - ipset->name = ipset->external; + warn_section("ipset", ipset, NULL, "skipped due to invalid options"); + fw3_free_ipset(ipset); + continue; } - if (!ipset->name || !*ipset->name) - { - warn_elem(e, "must have a name assigned"); - } - //else if (fw3_lookup_ipset(state, ipset->name) != NULL) - //{ - // warn_elem(e, "has duplicated set name '%s'", ipset->name); - //} - else if (ipset->family == FW3_FAMILY_ANY) - { - warn_elem(e, "must not have family 'any'"); - } - else if (ipset->iprange.set && ipset->family != ipset->iprange.family) - { - warn_elem(e, "has iprange of wrong address family"); - } - else if (list_empty(&ipset->datatypes)) - { - warn_elem(e, "has no datatypes assigned"); - } - else if (check_types(e, ipset)) - { - list_add_tail(&ipset->list, &state->ipsets); + if (!check_ipset(state, ipset, NULL)) + fw3_free_ipset(ipset); + } + + uci_foreach_element(&p->sections, e) + { + s = uci_to_section(e); + + if (strcmp(s->type, "ipset")) continue; - } - fw3_free_ipset(ipset); + ipset = fw3_alloc_ipset(state); + + if (!ipset) + continue; + + if (!fw3_parse_options(ipset, fw3_ipset_opts, s)) + warn_elem(e, "has invalid options"); + + if (!check_ipset(state, ipset, e)) + fw3_free_ipset(ipset); } } static void +load_file(struct fw3_ipset *ipset) +{ + FILE *f; + char line[128]; + + if (!ipset->loadfile) + return; + + info(" * Loading file %s", ipset->loadfile); + + f = fopen(ipset->loadfile, "r"); + + if (!f) { + info(" ! Skipping due to open error: %s", strerror(errno)); + return; + } + + while (fgets(line, sizeof(line), f)) + fw3_pr("add %s %s", ipset->name, line); + + fclose(f); +} + +static void create_ipset(struct fw3_ipset *ipset, struct fw3_state *state) { bool first = true; - + struct fw3_setentry *entry; struct fw3_ipset_datatype *type; info(" * Creating ipset %s", ipset->name); @@ -324,6 +390,11 @@ create_ipset(struct fw3_ipset *ipset, struct fw3_state *state) fw3_pr(" hashsize %u", ipset->hashsize); fw3_pr("\n"); + + list_for_each_entry(entry, &ipset->entries, list) + fw3_pr("add %s %s\n", ipset->name, entry->value); + + load_file(ipset); } void