X-Git-Url: http://git.archive.openwrt.org/?p=project%2Ffirewall3.git;a=blobdiff_plain;f=ipsets.c;h=b73c3d28c64d99d7769f44ca9ad0da6a19241111;hp=06aafb77ecab50be9b5ffbdb8f917183e9b176b9;hb=35b3e74a184b709b8ddfaaa094919a656a6ec059;hpb=9767873f92a53e996cc90fd8ff56d72dd3026567 diff --git a/ipsets.c b/ipsets.c index 06aafb7..b73c3d2 100644 --- a/ipsets.c +++ b/ipsets.c @@ -1,7 +1,7 @@ /* * firewall3 - 3rd OpenWrt UCI firewall implementation * - * Copyright (C) 2013 Jo-Philipp Wich + * Copyright (C) 2013 Jo-Philipp Wich * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -38,6 +38,9 @@ const struct fw3_option fw3_ipset_opts[] = { FW3_OPT("external", string, ipset, external), + FW3_LIST("entry", setentry, ipset, entries), + FW3_OPT("loadfile", string, ipset, loadfile), + { } }; @@ -95,7 +98,7 @@ check_types(struct uci_element *e, struct fw3_ipset *ipset) { if (i >= 3) { - warn_elem(e, "must not have more than 3 datatypes assigned"); + warn_section("ipset", ipset, e, "must not have more than 3 datatypes assigned"); return false; } @@ -107,12 +110,17 @@ check_types(struct uci_element *e, struct fw3_ipset *ipset) { for (i = 0; i < ARRAY_SIZE(ipset_types); i++) { + /* skip type for v6 if it does not support family */ + if (ipset->family != FW3_FAMILY_V4 && + !(ipset_types[i].optional & OPT_FAMILY)) + continue; + if (ipset_types[i].types == typelist) { ipset->method = ipset_types[i].method; - warn_elem(e, "defines no storage method, assuming '%s'", - fw3_ipset_method_names[ipset->method]); + warn_section("ipset", ipset, e, "defines no storage method, assuming '%s'", + fw3_ipset_method_names[ipset->method]); break; } @@ -131,56 +139,56 @@ check_types(struct uci_element *e, struct fw3_ipset *ipset) if ((ipset_types[i].required & OPT_IPRANGE) && !ipset->iprange.set) { - warn_elem(e, "requires an ip range"); + warn_section("ipset", ipset, e, "requires an ip range"); return false; } if ((ipset_types[i].required & OPT_PORTRANGE) && !ipset->portrange.set) { - warn_elem(e, "requires a port range"); + warn_section("ipset", ipset, e, "requires a port range"); return false; } if (!(ipset_types[i].required & OPT_IPRANGE) && ipset->iprange.set) { - warn_elem(e, "iprange ignored"); + warn_section("ipset", ipset, e, "iprange ignored"); ipset->iprange.set = false; } if (!(ipset_types[i].required & OPT_PORTRANGE) && ipset->portrange.set) { - warn_elem(e, "portrange ignored"); + warn_section("ipset", ipset, e, "portrange ignored"); ipset->portrange.set = false; } if (!(ipset_types[i].optional & OPT_NETMASK) && ipset->netmask > 0) { - warn_elem(e, "netmask ignored"); + warn_section("ipset", ipset, e, "netmask ignored"); ipset->netmask = 0; } if (!(ipset_types[i].optional & OPT_HASHSIZE) && ipset->hashsize > 0) { - warn_elem(e, "hashsize ignored"); + warn_section("ipset", ipset, e, "hashsize ignored"); ipset->hashsize = 0; } if (!(ipset_types[i].optional & OPT_MAXELEM) && ipset->maxelem > 0) { - warn_elem(e, "maxelem ignored"); + warn_section("ipset", ipset, e, "maxelem ignored"); ipset->maxelem = 0; } if (!(ipset_types[i].optional & OPT_FAMILY) && ipset->family != FW3_FAMILY_V4) { - warn_elem(e, "family ignored"); + warn_section("ipset", ipset, e, "family ignored"); ipset->family = FW3_FAMILY_V4; } } @@ -189,96 +197,160 @@ check_types(struct uci_element *e, struct fw3_ipset *ipset) } } - warn_elem(e, "has an invalid combination of storage method and matches"); + warn_section("ipset", ipset, e, "has an invalid combination of storage method and matches"); return false; } -struct fw3_ipset * -fw3_alloc_ipset(void) +static bool +check_ipset(struct fw3_state *state, struct fw3_ipset *ipset, struct uci_element *e) { - struct fw3_ipset *ipset; + if (ipset->external) + { + if (!*ipset->external) + ipset->external = NULL; + else if (!ipset->name) + ipset->name = ipset->external; + } - ipset = malloc(sizeof(*ipset)); + if (!ipset->name || !*ipset->name) + { + warn_section("ipset", ipset, e, "ipset must have a name assigned"); + } + //else if (fw3_lookup_ipset(state, ipset->name) != NULL) + //{ + // warn_section("ipset", ipset, e, "has duplicated set name", ipset->name); + //} + else if (ipset->family == FW3_FAMILY_ANY) + { + warn_section("ipset", ipset, e, "must not have family 'any'"); + } + else if (ipset->iprange.set && ipset->family != ipset->iprange.family) + { + warn_section("ipset", ipset, e, "has iprange of wrong address family"); + } + else if (list_empty(&ipset->datatypes)) + { + warn_section("ipset", ipset, e, "has no datatypes assigned"); + } + else if (check_types(e, ipset)) + { + return true; + } + return false; +} + +static struct fw3_ipset * +fw3_alloc_ipset(struct fw3_state *state) +{ + struct fw3_ipset *ipset; + + ipset = calloc(1, sizeof(*ipset)); if (!ipset) return NULL; - memset(ipset, 0, sizeof(*ipset)); - INIT_LIST_HEAD(&ipset->datatypes); + INIT_LIST_HEAD(&ipset->entries); ipset->enabled = true; ipset->family = FW3_FAMILY_V4; + list_add_tail(&ipset->list, &state->ipsets); + return ipset; } void -fw3_load_ipsets(struct fw3_state *state, struct uci_package *p) +fw3_load_ipsets(struct fw3_state *state, struct uci_package *p, + struct blob_attr *a) { struct uci_section *s; struct uci_element *e; struct fw3_ipset *ipset; + struct blob_attr *entry; + unsigned rem; INIT_LIST_HEAD(&state->ipsets); if (state->disable_ipsets) return; - uci_foreach_element(&p->sections, e) + blob_for_each_attr(entry, a, rem) { - s = uci_to_section(e); + const char *type; + const char *name = "ubus ipset"; - if (strcmp(s->type, "ipset")) + if (!fw3_attr_parse_name_type(entry, &name, &type)) continue; - ipset = fw3_alloc_ipset(); + if (strcmp(type, "ipset")) + continue; + ipset = fw3_alloc_ipset(state); if (!ipset) continue; - fw3_parse_options(ipset, fw3_ipset_opts, s); - - if (ipset->external) + if (!fw3_parse_blob_options(ipset, fw3_ipset_opts, entry, name)) { - if (!*ipset->external) - ipset->external = NULL; - else if (!ipset->name) - ipset->name = ipset->external; + warn_section("ipset", ipset, NULL, "skipped due to invalid options"); + fw3_free_ipset(ipset); + continue; } - if (!ipset->name || !*ipset->name) - { - warn_elem(e, "must have a name assigned"); - } - //else if (fw3_lookup_ipset(state, ipset->name) != NULL) - //{ - // warn_elem(e, "has duplicated set name '%s'", ipset->name); - //} - else if (ipset->family == FW3_FAMILY_ANY) - { - warn_elem(e, "must not have family 'any'"); - } - else if (list_empty(&ipset->datatypes)) - { - warn_elem(e, "has no datatypes assigned"); - } - else if (check_types(e, ipset)) - { - list_add_tail(&ipset->list, &state->ipsets); + if (!check_ipset(state, ipset, NULL)) + fw3_free_ipset(ipset); + } + + uci_foreach_element(&p->sections, e) + { + s = uci_to_section(e); + + if (strcmp(s->type, "ipset")) continue; - } - fw3_free_ipset(ipset); + ipset = fw3_alloc_ipset(state); + + if (!ipset) + continue; + + if (!fw3_parse_options(ipset, fw3_ipset_opts, s)) + warn_elem(e, "has invalid options"); + + if (!check_ipset(state, ipset, e)) + fw3_free_ipset(ipset); } } static void +load_file(struct fw3_ipset *ipset) +{ + FILE *f; + char line[128]; + + if (!ipset->loadfile) + return; + + info(" * Loading file %s", ipset->loadfile); + + f = fopen(ipset->loadfile, "r"); + + if (!f) { + info(" ! Skipping due to open error: %s", strerror(errno)); + return; + } + + while (fgets(line, sizeof(line), f)) + fw3_pr("add %s %s", ipset->name, line); + + fclose(f); +} + +static void create_ipset(struct fw3_ipset *ipset, struct fw3_state *state) { bool first = true; - + struct fw3_setentry *entry; struct fw3_ipset_datatype *type; info(" * Creating ipset %s", ipset->name); @@ -292,9 +364,12 @@ create_ipset(struct fw3_ipset *ipset, struct fw3_state *state) first = false; } + if (ipset->method == FW3_IPSET_METHOD_HASH) + fw3_pr(" family inet%s", (ipset->family == FW3_FAMILY_V4) ? "" : "6"); + if (ipset->iprange.set) { - fw3_pr(" range %s", fw3_address_to_string(&ipset->iprange, false)); + fw3_pr(" range %s", fw3_address_to_string(&ipset->iprange, false, true)); } else if (ipset->portrange.set) { @@ -302,8 +377,6 @@ create_ipset(struct fw3_ipset *ipset, struct fw3_state *state) ipset->portrange.port_min, ipset->portrange.port_max); } - fw3_pr(" family inet%s", (ipset->family == FW3_FAMILY_V4) ? "" : "6"); - if (ipset->timeout > 0) fw3_pr(" timeout %u", ipset->timeout); @@ -317,6 +390,11 @@ create_ipset(struct fw3_ipset *ipset, struct fw3_state *state) fw3_pr(" hashsize %u", ipset->hashsize); fw3_pr("\n"); + + list_for_each_entry(entry, &ipset->entries, list) + fw3_pr("add %s %s\n", ipset->name, entry->value); + + load_file(ipset); } void