X-Git-Url: http://git.archive.openwrt.org/?p=project%2Ffirewall3.git;a=blobdiff_plain;f=main.c;h=58975882308aee80da2da69d67a0d617c0cc5b3f;hp=e9179639b1a0264887858bd467ff6e930497bb4f;hb=4ecfb8f6fe4920fd1c6904b1ca8730e746111b00;hpb=608e5b8957d7134f0d6bdd7754de788081b3179a;ds=sidebyside diff --git a/main.c b/main.c index e917963..5897588 100644 --- a/main.c +++ b/main.c @@ -28,20 +28,21 @@ #include "ipsets.h" #include "includes.h" #include "ubus.h" +#include "iptables.h" -static bool print_rules = false; -static enum fw3_family use_family = FW3_FAMILY_ANY; +static enum fw3_family print_family = FW3_FAMILY_ANY; +static struct fw3_state *run_state = NULL; +static struct fw3_state *cfg_state = NULL; -static struct fw3_state * -build_state(void) + +static bool +build_state(bool runtime) { struct fw3_state *state = NULL; struct uci_package *p = NULL; - - if (!fw3_ubus_connect()) - error("Failed to connect to ubus"); + FILE *sf; state = malloc(sizeof(*state)); @@ -54,20 +55,47 @@ build_state(void) if (!state->uci) error("Out of memory"); - if (uci_load(state->uci, "firewall", &p)) + if (runtime) { - uci_perror(state->uci, NULL); - error("Failed to load /etc/config/firewall"); - } + sf = fopen(FW3_STATEFILE, "r"); - if (!fw3_find_command("ipset")) - { - warn("Unable to locate ipset utility, disabling ipset support"); - state->disable_ipsets = true; + if (sf) + { + uci_import(state->uci, sf, "fw3_state", &p, true); + fclose(sf); + } + + if (!p) + { + uci_free_context(state->uci); + free(state); + + return false; + } + + state->statefile = true; + + run_state = state; } + else + { + if (!fw3_ubus_connect()) + error("Failed to connect to ubus"); + + if (uci_load(state->uci, "firewall", &p)) + { + uci_perror(state->uci, NULL); + error("Failed to load /etc/config/firewall"); + } - INIT_LIST_HEAD(&state->running_zones); - INIT_LIST_HEAD(&state->running_ipsets); + if (!fw3_find_command("ipset")) + { + warn("Unable to locate ipset utility, disabling ipset support"); + state->disable_ipsets = true; + } + + cfg_state = state; + } fw3_load_defaults(state, p); fw3_load_ipsets(state, p); @@ -77,9 +105,7 @@ build_state(void) fw3_load_forwards(state, p); fw3_load_includes(state, p); - state->statefile = fw3_read_statefile(state); - - return state; + return true; } static void @@ -114,145 +140,116 @@ free_state(struct fw3_state *state) static bool -restore_pipe(enum fw3_family family, bool silent) -{ - const char *cmd; - - cmd = (family == FW3_FAMILY_V4) ? "iptables-restore" : "ip6tables-restore"; - - if (print_rules) - return fw3_stdout_pipe(); - - if (!fw3_command_pipe(silent, cmd, "--lenient", "--noflush")) - { - warn("Unable to execute %s", cmd); - return false; - } - - return true; -} - -static bool -family_running(struct fw3_state *state, enum fw3_family family) -{ - return hasbit(state->running_defaults.flags, family); -} - -static bool -family_used(enum fw3_family family) -{ - return (use_family == FW3_FAMILY_ANY) || (use_family == family); -} - -static bool -family_loaded(struct fw3_state *state, enum fw3_family family) +family_running(enum fw3_family family) { - return hasbit(state->defaults.flags, family); + return (run_state && has(run_state->defaults.flags, family, family)); } static void family_set(struct fw3_state *state, enum fw3_family family, bool set) { + if (!state) + return; + if (set) - setbit(state->defaults.flags, family); + set(state->defaults.flags, family, family); else - delbit(state->defaults.flags, family); + del(state->defaults.flags, family, family); } static int -stop(struct fw3_state *state, bool complete, bool restart) +stop(bool complete) { + FILE *ct; + int rv = 1; enum fw3_family family; enum fw3_table table; + struct fw3_ipt_handle *handle; - if (!complete && !state->statefile) + if (!complete && !run_state) { - if (!restart) - warn("The firewall appears to be stopped. " - "Use the 'flush' command to forcefully purge all rules."); + warn("The firewall appears to be stopped. " + "Use the 'flush' command to forcefully purge all rules."); return rv; } + if (!print_family && run_state) + fw3_hotplug_zones(run_state, false); + for (family = FW3_FAMILY_V4; family <= FW3_FAMILY_V6; family++) { - if (!complete && !family_running(state, family)) + if (!complete && !family_running(family)) continue; - if (!family_used(family) || !restore_pipe(family, true)) - continue; - - info("Removing %s rules ...", fw3_flag_names[family]); - for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++) { if (!fw3_has_table(family == FW3_FAMILY_V6, fw3_flag_names[table])) continue; - info(" * %sing %s table", - complete ? "Flush" : "Clear", fw3_flag_names[table]); + if (!(handle = fw3_ipt_open(family, table))) + continue; - fw3_pr("*%s\n", fw3_flag_names[table]); + info(" * %sing %s %s table", complete ? "Flush" : "Clear", + fw3_flag_names[family], fw3_flag_names[table]); if (complete) { - fw3_flush_all(table); + fw3_flush_all(handle); } - else + else if (run_state) { - /* pass 1 */ - fw3_flush_rules(table, family, false, state); - fw3_flush_zones(table, family, false, state); - - /* pass 2 */ - fw3_flush_rules(table, family, true, state); - fw3_flush_zones(table, family, true, state); + fw3_flush_rules(handle, run_state, false); + fw3_flush_zones(handle, run_state, false); } - fw3_pr("COMMIT\n"); + fw3_ipt_commit(handle); } - fw3_command_close(); - - if (!restart) - family_set(state, family, false); + family_set(run_state, family, false); + family_set(cfg_state, family, false); rv = 0; } - if (!restart && fw3_command_pipe(false, "ipset", "-exist", "-")) + if (run_state) + fw3_destroy_ipsets(run_state); + + if (complete && (ct = fopen("/proc/net/nf_conntrack", "w")) != NULL) { - fw3_destroy_ipsets(state); - fw3_command_close(); + info(" * Flushing conntrack table ..."); + + fwrite("f\n", 2, 1, ct); + fclose(ct); } - if (!rv) - fw3_write_statefile(state); + if (!rv && run_state) + fw3_write_statefile(run_state); return rv; } static int -start(struct fw3_state *state, bool restart) +start(void) { int rv = 1; enum fw3_family family; enum fw3_table table; + struct fw3_ipt_handle *handle; - if (!print_rules && !restart && - fw3_command_pipe(false, "ipset", "-exist", "-")) - { - fw3_create_ipsets(state); - fw3_command_close(); - } + if (!print_family) + fw3_create_ipsets(cfg_state); for (family = FW3_FAMILY_V4; family <= FW3_FAMILY_V6; family++) { - if (!family_used(family)) + if (family == FW3_FAMILY_V6 && cfg_state->defaults.disable_ipv6) + continue; + + if (print_family && family != print_family) continue; - if (!print_rules && !restart && family_running(state, family)) + if (!print_family && family_running(family)) { warn("The %s firewall appears to be started already. " "If it is indeed empty, remove the %s file and retry.", @@ -261,49 +258,145 @@ start(struct fw3_state *state, bool restart) continue; } - if (!family_loaded(state, family) || !restore_pipe(family, false)) - continue; + for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++) + { + if (!fw3_has_table(family == FW3_FAMILY_V6, fw3_flag_names[table])) + continue; + + if (!(handle = fw3_ipt_open(family, table))) + continue; + + info(" * Populating %s %s table", + fw3_flag_names[family], fw3_flag_names[table]); - info("Constructing %s rules ...", fw3_flag_names[family]); + fw3_print_default_chains(handle, cfg_state, false); + fw3_print_zone_chains(handle, cfg_state, false); + fw3_print_default_head_rules(handle, cfg_state, false); + fw3_print_rules(handle, cfg_state); + fw3_print_redirects(handle, cfg_state); + fw3_print_forwards(handle, cfg_state); + fw3_print_zone_rules(handle, cfg_state, false); + fw3_print_default_tail_rules(handle, cfg_state, false); + + if (!print_family) + fw3_ipt_commit(handle); + } + + if (!print_family) + fw3_print_includes(cfg_state, family, false); + + family_set(run_state, family, true); + family_set(cfg_state, family, true); + + rv = 0; + } + + if (!rv) + { + fw3_set_defaults(cfg_state); + + if (!print_family) + { + fw3_run_includes(cfg_state, false); + fw3_hotplug_zones(cfg_state, true); + fw3_write_statefile(cfg_state); + } + } + + return rv; +} + + +static int +reload(void) +{ + int rv = 1; + enum fw3_family family; + enum fw3_table table; + struct fw3_ipt_handle *handle; + + if (!run_state) + return start(); + + fw3_hotplug_zones(run_state, false); + + for (family = FW3_FAMILY_V4; family <= FW3_FAMILY_V6; family++) + { + if (!family_running(family)) + goto start; for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++) { if (!fw3_has_table(family == FW3_FAMILY_V6, fw3_flag_names[table])) continue; - info(" * Populating %s table", fw3_flag_names[table]); - - fw3_pr("*%s\n", fw3_flag_names[table]); - fw3_print_default_chains(table, family, state); - fw3_print_zone_chains(table, family, state); - fw3_print_default_head_rules(table, family, state); - fw3_print_rules(table, family, state); - fw3_print_redirects(table, family, state); - fw3_print_forwards(table, family, state); - fw3_print_zone_rules(table, family, state); - fw3_print_default_tail_rules(table, family, state); - fw3_pr("COMMIT\n"); + if (!(handle = fw3_ipt_open(family, table))) + continue; + + info(" * Clearing %s %s table", + fw3_flag_names[family], fw3_flag_names[table]); + + fw3_flush_rules(handle, run_state, true); + fw3_flush_zones(handle, run_state, true); + fw3_ipt_commit(handle); } - fw3_command_close(); - family_set(state, family, true); + family_set(run_state, family, false); + family_set(cfg_state, family, false); + +start: + if (family == FW3_FAMILY_V6 && cfg_state->defaults.disable_ipv6) + continue; + + for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++) + { + if (!fw3_has_table(family == FW3_FAMILY_V6, fw3_flag_names[table])) + continue; + + if (!(handle = fw3_ipt_open(family, table))) + continue; + + info(" * Populating %s %s table", + fw3_flag_names[family], fw3_flag_names[table]); + + fw3_print_default_chains(handle, cfg_state, true); + fw3_print_zone_chains(handle, cfg_state, true); + fw3_print_default_head_rules(handle, cfg_state, true); + fw3_print_rules(handle, cfg_state); + fw3_print_redirects(handle, cfg_state); + fw3_print_forwards(handle, cfg_state); + fw3_print_zone_rules(handle, cfg_state, true); + fw3_print_default_tail_rules(handle, cfg_state, true); + + fw3_ipt_commit(handle); + } + + fw3_print_includes(cfg_state, family, true); + + family_set(run_state, family, true); + family_set(cfg_state, family, true); rv = 0; } - if (!rv && !print_rules) - fw3_write_statefile(state); + if (!rv) + { + fw3_set_defaults(cfg_state); + fw3_run_includes(cfg_state, true); + fw3_hotplug_zones(cfg_state, true); + fw3_write_statefile(cfg_state); + } return rv; } static int -lookup_network(struct fw3_state *state, const char *net) +lookup_network(const char *net) { struct fw3_zone *z; struct fw3_device *d; - list_for_each_entry(z, &state->zones, list) + list_for_each_entry(z, &cfg_state->zones, list) { list_for_each_entry(d, &z->networks, list) { @@ -319,12 +412,12 @@ lookup_network(struct fw3_state *state, const char *net) } static int -lookup_device(struct fw3_state *state, const char *dev) +lookup_device(const char *dev) { struct fw3_zone *z; struct fw3_device *d; - list_for_each_entry(z, &state->zones, list) + list_for_each_entry(z, &cfg_state->zones, list) { list_for_each_entry(d, &z->devices, list) { @@ -342,7 +435,8 @@ lookup_device(struct fw3_state *state, const char *dev) static int usage(void) { - fprintf(stderr, "fw3 [-4] [-6] [-q] {start|stop|flush|reload|restart|print}\n"); + fprintf(stderr, "fw3 [-4] [-6] [-q] print\n"); + fprintf(stderr, "fw3 [-q] {start|stop|flush|reload|restart}\n"); fprintf(stderr, "fw3 [-q] network {net}\n"); fprintf(stderr, "fw3 [-q] device {dev}\n"); @@ -353,19 +447,23 @@ usage(void) int main(int argc, char **argv) { int ch, rv = 1; - struct fw3_state *state = NULL; + enum fw3_family family = FW3_FAMILY_ANY; struct fw3_defaults *defs = NULL; - while ((ch = getopt(argc, argv, "46qh")) != -1) + while ((ch = getopt(argc, argv, "46dqh")) != -1) { switch (ch) { case '4': - use_family = FW3_FAMILY_V4; + family = FW3_FAMILY_V4; break; case '6': - use_family = FW3_FAMILY_V6; + family = FW3_FAMILY_V6; + break; + + case 'd': + fw3_pr_debug = true; break; case 'q': @@ -378,11 +476,9 @@ int main(int argc, char **argv) } } - state = build_state(); - defs = &state->defaults; - - if (!fw3_lock()) - goto out; + build_state(false); + build_state(true); + defs = &cfg_state->defaults; if (optind >= argc) { @@ -390,53 +486,69 @@ int main(int argc, char **argv) goto out; } - if (use_family == FW3_FAMILY_V6 && defs->disable_ipv6) - warn("IPv6 rules globally disabled in configuration"); - if (!strcmp(argv[optind], "print")) { - if (use_family == FW3_FAMILY_ANY) - use_family = FW3_FAMILY_V4; + if (family == FW3_FAMILY_ANY) + family = FW3_FAMILY_V4; + else if (family == FW3_FAMILY_V6 && defs->disable_ipv6) + warn("IPv6 rules globally disabled in configuration"); freopen("/dev/null", "w", stderr); - state->disable_ipsets = true; - print_rules = true; + cfg_state->disable_ipsets = true; + print_family = family; + fw3_pr_debug = true; - rv = start(state, false); + rv = start(); } else if (!strcmp(argv[optind], "start")) { - rv = start(state, false); + if (fw3_lock()) + { + rv = start(); + fw3_unlock(); + } } else if (!strcmp(argv[optind], "stop")) { - rv = stop(state, false, false); + if (fw3_lock()) + { + rv = stop(false); + fw3_unlock(); + } } else if (!strcmp(argv[optind], "flush")) { - rv = stop(state, true, false); + if (fw3_lock()) + { + rv = stop(true); + fw3_unlock(); + } } else if (!strcmp(argv[optind], "restart")) { - stop(state, true, false); - free_state(state); - - state = build_state(); - rv = start(state, false); + if (fw3_lock()) + { + stop(true); + rv = start(); + fw3_unlock(); + } } else if (!strcmp(argv[optind], "reload")) { - rv = stop(state, false, true); - rv = start(state, !rv); + if (fw3_lock()) + { + rv = reload(); + fw3_unlock(); + } } else if (!strcmp(argv[optind], "network") && (optind + 1) < argc) { - rv = lookup_network(state, argv[optind + 1]); + rv = lookup_network(argv[optind + 1]); } else if (!strcmp(argv[optind], "device") && (optind + 1) < argc) { - rv = lookup_device(state, argv[optind + 1]); + rv = lookup_device(argv[optind + 1]); } else { @@ -444,10 +556,11 @@ int main(int argc, char **argv) } out: - if (state) - free_state(state); + if (cfg_state) + free_state(cfg_state); - fw3_unlock(); + if (run_state) + free_state(run_state); return rv; }