X-Git-Url: http://git.archive.openwrt.org/?p=project%2Ffirewall3.git;a=blobdiff_plain;f=iptables.c;h=f8d4d46ec7717fca1f38f77c23092342b576e3c6;hp=10bfea5e084333cf7b2db28ebda23acaa1c0dc2e;hb=HEAD;hpb=82ccd9e34fe87d31d9909fed754950b2c75bc6ac

diff --git a/iptables.c b/iptables.c
index 10bfea5..f8d4d46 100644
--- a/iptables.c
+++ b/iptables.c
@@ -40,6 +40,8 @@
 #include <libiptc/libip6tc.h>
 #include <xtables.h>
 
+#include <setjmp.h>
+
 #include "options.h"
 
 /* xtables interface */
@@ -73,15 +75,38 @@ struct fw3_ipt_rule {
 };
 
 static struct option base_opts[] = {
-	{ .name = "match",  .has_arg = 1, .val = 'm' },
-	{ .name = "jump",   .has_arg = 1, .val = 'j' },
+	{ .name = "match",         .has_arg = 1, .val = 'm' },
+	{ .name = "jump",          .has_arg = 1, .val = 'j' },
+	{ .name = "in-interface",  .has_arg = 1, .val = 'i' },
+	{ .name = "out-interface", .has_arg = 1, .val = 'o' },
+	{ .name = "source",        .has_arg = 1, .val = 's' },
+	{ .name = "destination",   .has_arg = 1, .val = 'd' },
 	{ NULL }
 };
 
+
+static jmp_buf fw3_ipt_error_jmp;
+
+static __attribute__((noreturn))
+void fw3_ipt_error_handler(enum xtables_exittype status,
+                           const char *fmt, ...)
+{
+	va_list args;
+
+	fprintf(stderr, "     ! Exception: ");
+
+	va_start(args, fmt);
+	vfprintf(stderr, fmt, args);
+	va_end(args);
+
+	longjmp(fw3_ipt_error_jmp, status);
+}
+
 static struct xtables_globals xtg = {
 	.option_offset = 0,
 	.program_version = "4",
 	.orig_opts = base_opts,
+	.exit_err = fw3_ipt_error_handler,
 #if XTABLES_VERSION_CODE > 10
 	.compat_rev = xtables_compatible_revision,
 #endif
@@ -91,6 +116,7 @@ static struct xtables_globals xtg6 = {
 	.option_offset = 0,
 	.program_version = "6",
 	.orig_opts = base_opts,
+	.exit_err = fw3_ipt_error_handler,
 #if XTABLES_VERSION_CODE > 10
 	.compat_rev = xtables_compatible_revision,
 #endif
@@ -1000,6 +1026,16 @@ fw3_ipt_rule_ipset(struct fw3_ipt_rule *r, struct fw3_setmatch *match)
 }
 
 void
+fw3_ipt_rule_helper(struct fw3_ipt_rule *r, struct fw3_cthelpermatch *match)
+{
+	if (!match || !match->set || !match->ptr)
+		return;
+
+	fw3_ipt_rule_addarg(r, false, "-m", "helper");
+	fw3_ipt_rule_addarg(r, match->invert, "--helper", match->ptr->name);
+}
+
+void
 fw3_ipt_rule_time(struct fw3_ipt_rule *r, struct fw3_time *time)
 {
 	int i;
@@ -1387,7 +1423,7 @@ rule_mask(struct fw3_ipt_rule *r)
 			p += SZ(ip6t_entry_match) + m->match->size;
 		}
 
-		memset(p, 0xFF, SZ(ip6t_entry_target) + (r->target) ? r->target->userspacesize : 0);
+		memset(p, 0xFF, SZ(ip6t_entry_target) + (r->target ? r->target->userspacesize : 0));
 	}
 	else
 #endif
@@ -1411,7 +1447,7 @@ rule_mask(struct fw3_ipt_rule *r)
 			p += SZ(ipt_entry_match) + m->match->size;
 		}
 
-		memset(p, 0xFF, SZ(ipt_entry_target) + (r->target) ? r->target->userspacesize : 0);
+		memset(p, 0xFF, SZ(ipt_entry_target) + (r->target ? r->target->userspacesize : 0));
 	}
 
 	return mask;
@@ -1524,6 +1560,11 @@ __fw3_ipt_rule_append(struct fw3_ipt_rule *r, bool repl, const char *fmt, ...)
 	struct xtables_target *et;
 	struct xtables_globals *g;
 
+	struct fw3_device dev;
+	struct fw3_address addr;
+
+	enum xtables_exittype status;
+
 	int i, optc;
 	bool inv = false;
 	char buf[32];
@@ -1539,9 +1580,17 @@ __fw3_ipt_rule_append(struct fw3_ipt_rule *r, bool repl, const char *fmt, ...)
 	optind = 0;
 	opterr = 0;
 
+	status = setjmp(fw3_ipt_error_jmp);
+
+	if (status > 0)
+	{
+		info("     ! Skipping due to previous exception (code %u)", status);
+		goto free;
+	}
+
 	set_rule_tag(r);
 
-	while ((optc = getopt_long(r->argc, r->argv, "-:m:j:", g->opts,
+	while ((optc = getopt_long(r->argc, r->argv, "-:m:j:i:o:s:d:", g->opts,
 	                           NULL)) != -1)
 	{
 		switch (optc)
@@ -1569,6 +1618,34 @@ __fw3_ipt_rule_append(struct fw3_ipt_rule *r, bool repl, const char *fmt, ...)
 
 			break;
 
+		case 'i':
+		case 'o':
+			if (!fw3_parse_device(&dev, optarg, false) ||
+			    dev.any || dev.invert || *dev.network)
+			{
+				warn("fw3_ipt_rule_append(): Bad argument '%s'", optarg);
+				goto free;
+			}
+
+			dev.invert = inv;
+			fw3_ipt_rule_in_out(r, (optc == 'i') ? &dev : NULL,
+			                       (optc == 'o') ? &dev : NULL);
+			break;
+
+		case 's':
+		case 'd':
+			if (!fw3_parse_address(&addr, optarg, false) ||
+			    addr.range || addr.invert)
+			{
+				warn("fw3_ipt_rule_append(): Bad argument '%s'", optarg);
+				goto free;
+			}
+
+			addr.invert = inv;
+			fw3_ipt_rule_src_dest(r, (optc == 's') ? &addr : NULL,
+			                         (optc == 'd') ? &addr : NULL);
+			break;
+
 		case 1:
 			if ((optarg[0] == '!') && (optarg[1] == '\0'))
 			{