X-Git-Url: http://git.archive.openwrt.org/?p=project%2Ffirewall3.git;a=blobdiff_plain;f=main.c;h=3654c1503842929c50cafe8f84f97f404176c49a;hp=3ef7243c33955f92ff54eb25c5a2e32d0d3f6182;hb=24e1ba98e43d44ad7ba5780afd0b98e19ee14570;hpb=2d73c2b436cc16d49ce706920802604150781dc9 diff --git a/main.c b/main.c index 3ef7243..3654c15 100644 --- a/main.c +++ b/main.c @@ -26,6 +26,7 @@ #include "redirects.h" #include "forwards.h" #include "ipsets.h" +#include "includes.h" #include "ubus.h" @@ -39,6 +40,9 @@ build_state(void) struct fw3_state *state = NULL; struct uci_package *p = NULL; + if (!fw3_ubus_connect()) + error("Failed to connect to ubus"); + state = malloc(sizeof(*state)); if (!state) @@ -62,12 +66,18 @@ build_state(void) state->disable_ipsets = true; } + INIT_LIST_HEAD(&state->running_zones); + INIT_LIST_HEAD(&state->running_ipsets); + fw3_load_defaults(state, p); fw3_load_ipsets(state, p); fw3_load_zones(state, p); fw3_load_rules(state, p); fw3_load_redirects(state, p); fw3_load_forwards(state, p); + fw3_load_includes(state, p); + + state->statefile = fw3_read_statefile(state); return state; } @@ -89,6 +99,12 @@ free_state(struct fw3_state *state) list_for_each_safe(cur, tmp, &state->forwards) fw3_free_forward((struct fw3_forward *)cur); + list_for_each_safe(cur, tmp, &state->ipsets) + fw3_free_ipset((struct fw3_ipset *)cur); + + list_for_each_safe(cur, tmp, &state->includes) + fw3_free_include((struct fw3_include *)cur); + uci_free_context(state->uci); free(state); @@ -117,22 +133,9 @@ restore_pipe(enum fw3_family family, bool silent) } static bool -family_running(struct list_head *statefile, enum fw3_family family) +family_running(struct fw3_state *state, enum fw3_family family) { - struct fw3_statefile_entry *e; - - if (statefile) - { - list_for_each_entry(e, statefile, list) - { - if (e->type != FW3_TYPE_DEFAULTS) - continue; - - return hasbit(e->flags[0], family); - } - } - - return false; + return hasbit(state->defaults.running_flags, family); } static bool @@ -157,17 +160,18 @@ family_set(struct fw3_state *state, enum fw3_family family, bool set) } static int -stop(struct fw3_state *state, bool complete, bool restart) +stop(struct fw3_state *state, bool complete, bool reload) { + FILE *ct; + int rv = 1; enum fw3_family family; enum fw3_table table; + enum fw3_target policy = reload ? FW3_TARGET_DROP : FW3_TARGET_ACCEPT; - struct list_head *statefile = fw3_read_statefile(); - - if (!complete && !statefile) + if (!complete && !state->statefile) { - if (!restart) + if (!reload) warn("The firewall appears to be stopped. " "Use the 'flush' command to forcefully purge all rules."); @@ -176,7 +180,7 @@ stop(struct fw3_state *state, bool complete, bool restart) for (family = FW3_FAMILY_V4; family <= FW3_FAMILY_V6; family++) { - if (!complete && !family_running(statefile, family)) + if (!complete && !family_running(state, family)) continue; if (!family_used(family) || !restore_pipe(family, true)) @@ -201,12 +205,12 @@ stop(struct fw3_state *state, bool complete, bool restart) else { /* pass 1 */ - fw3_flush_rules(table, family, false, statefile); - fw3_flush_zones(table, family, false, statefile); + fw3_flush_rules(table, family, false, state, policy); + fw3_flush_zones(table, family, false, reload, state); /* pass 2 */ - fw3_flush_rules(table, family, true, statefile); - fw3_flush_zones(table, family, true, statefile); + fw3_flush_rules(table, family, true, state, policy); + fw3_flush_zones(table, family, true, reload, state); } fw3_pr("COMMIT\n"); @@ -214,22 +218,27 @@ stop(struct fw3_state *state, bool complete, bool restart) fw3_command_close(); - if (!restart) + if (!reload) + { + if (fw3_command_pipe(false, "ipset", "-exist", "-")) + { + fw3_destroy_ipsets(state, family); + fw3_command_close(); + } + family_set(state, family, false); + } rv = 0; } - if (!restart && - !family_loaded(state, FW3_FAMILY_V4) && - !family_loaded(state, FW3_FAMILY_V6) && - fw3_command_pipe(false, "ipset", "-exist", "-")) + if (complete && (ct = fopen("/proc/net/nf_conntrack", "w")) != NULL) { - fw3_destroy_ipsets(statefile); - fw3_command_close(); - } + info("Flushing conntrack table ..."); - fw3_free_statefile(statefile); + fwrite("f\n", 2, 1, ct); + fclose(ct); + } if (!rv) fw3_write_statefile(state); @@ -238,19 +247,19 @@ stop(struct fw3_state *state, bool complete, bool restart) } static int -start(struct fw3_state *state, bool restart) +start(struct fw3_state *state, bool reload) { int rv = 1; enum fw3_family family; enum fw3_table table; - struct list_head *statefile = fw3_read_statefile(); - - if (!print_rules && !restart && - fw3_command_pipe(false, "ipset", "-exist", "-")) + if (!print_rules && !reload) { - fw3_create_ipsets(state); - fw3_command_close(); + if (fw3_command_pipe(false, "ipset", "-exist", "-")) + { + fw3_create_ipsets(state); + fw3_command_close(); + } } for (family = FW3_FAMILY_V4; family <= FW3_FAMILY_V6; family++) @@ -258,10 +267,7 @@ start(struct fw3_state *state, bool restart) if (!family_used(family)) continue; - if (!family_loaded(state, family) || !restore_pipe(family, false)) - continue; - - if (!print_rules && !restart && family_running(statefile, family)) + if (!print_rules && !reload && family_running(state, family)) { warn("The %s firewall appears to be started already. " "If it is indeed empty, remove the %s file and retry.", @@ -270,6 +276,9 @@ start(struct fw3_state *state, bool restart) continue; } + if (!family_loaded(state, family) || !restore_pipe(family, false)) + continue; + info("Constructing %s rules ...", fw3_flag_names[family]); for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++) @@ -291,16 +300,25 @@ start(struct fw3_state *state, bool restart) fw3_pr("COMMIT\n"); } + if (!reload) + fw3_print_includes(family, state); + fw3_command_close(); family_set(state, family, true); rv = 0; } - fw3_free_statefile(statefile); + if (!rv) + { + fw3_set_defaults(state); - if (!rv && !print_rules) - fw3_write_statefile(state); + if (!reload && !print_rules) + fw3_run_includes(state); + + if (!print_rules) + fw3_write_statefile(state); + } return rv; } @@ -350,7 +368,7 @@ lookup_device(struct fw3_state *state, const char *dev) static int usage(void) { - fprintf(stderr, "fw3 [-4] [-6] [-q] {start|stop|flush|restart|print}\n"); + fprintf(stderr, "fw3 [-4] [-6] [-q] {start|stop|flush|reload|restart|print}\n"); fprintf(stderr, "fw3 [-q] network {net}\n"); fprintf(stderr, "fw3 [-q] device {dev}\n"); @@ -364,7 +382,7 @@ int main(int argc, char **argv) struct fw3_state *state = NULL; struct fw3_defaults *defs = NULL; - while ((ch = getopt(argc, argv, "46qh")) != -1) + while ((ch = getopt(argc, argv, "46dqh")) != -1) { switch (ch) { @@ -376,6 +394,10 @@ int main(int argc, char **argv) use_family = FW3_FAMILY_V6; break; + case 'd': + fw3_pr_debug = true; + break; + case 'q': freopen("/dev/null", "w", stderr); break; @@ -386,9 +408,6 @@ int main(int argc, char **argv) } } - if (!fw3_ubus_connect()) - error("Failed to connect to ubus"); - state = build_state(); defs = &state->defaults; @@ -430,6 +449,14 @@ int main(int argc, char **argv) } else if (!strcmp(argv[optind], "restart")) { + stop(state, true, false); + free_state(state); + + state = build_state(); + rv = start(state, false); + } + else if (!strcmp(argv[optind], "reload")) + { rv = stop(state, false, true); rv = start(state, !rv); }