X-Git-Url: http://git.archive.openwrt.org/?p=project%2Ffirewall3.git;a=blobdiff_plain;f=main.c;h=58975882308aee80da2da69d67a0d617c0cc5b3f;hp=fc2eb7230552798912f9f44fea1aa8cb3c1fcf7c;hb=4ecfb8f6fe4920fd1c6904b1ca8730e746111b00;hpb=964b303f7784fac1ab453c96117bb7485daccc9b diff --git a/main.c b/main.c index fc2eb72..5897588 100644 --- a/main.c +++ b/main.c @@ -28,9 +28,10 @@ #include "ipsets.h" #include "includes.h" #include "ubus.h" +#include "iptables.h" -static bool print_rules = false; +static enum fw3_family print_family = FW3_FAMILY_ANY; static struct fw3_state *run_state = NULL; static struct fw3_state *cfg_state = NULL; @@ -139,25 +140,6 @@ free_state(struct fw3_state *state) static bool -restore_pipe(enum fw3_family family, bool silent) -{ - const char *cmd; - - cmd = (family == FW3_FAMILY_V4) ? "iptables-restore" : "ip6tables-restore"; - - if (print_rules) - return fw3_stdout_pipe(); - - if (!fw3_command_pipe(silent, cmd, "--lenient", "--noflush")) - { - warn("Unable to execute %s", cmd); - return false; - } - - return true; -} - -static bool family_running(enum fw3_family family) { return (run_state && has(run_state->defaults.flags, family, family)); @@ -176,24 +158,24 @@ family_set(struct fw3_state *state, enum fw3_family family, bool set) } static int -stop(bool complete, bool reload) +stop(bool complete) { FILE *ct; int rv = 1; enum fw3_family family; enum fw3_table table; + struct fw3_ipt_handle *handle; if (!complete && !run_state) { - if (!reload) - warn("The firewall appears to be stopped. " - "Use the 'flush' command to forcefully purge all rules."); + warn("The firewall appears to be stopped. " + "Use the 'flush' command to forcefully purge all rules."); return rv; } - if (!print_rules && run_state) + if (!print_family && run_state) fw3_hotplug_zones(run_state, false); for (family = FW3_FAMILY_V4; family <= FW3_FAMILY_V6; family++) @@ -201,52 +183,38 @@ stop(bool complete, bool reload) if (!complete && !family_running(family)) continue; - if (!restore_pipe(family, true)) - continue; - for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++) { if (!fw3_has_table(family == FW3_FAMILY_V6, fw3_flag_names[table])) continue; + if (!(handle = fw3_ipt_open(family, table))) + continue; + info(" * %sing %s %s table", complete ? "Flush" : "Clear", fw3_flag_names[family], fw3_flag_names[table]); - fw3_pr("*%s\n", fw3_flag_names[table]); - if (complete) { - fw3_flush_all(table); + fw3_flush_all(handle); } else if (run_state) { - /* pass 1 */ - fw3_flush_rules(run_state, family, table, reload, false); - fw3_flush_zones(run_state, family, table, reload, false); - - /* pass 2 */ - fw3_flush_rules(run_state, family, table, reload, true); - fw3_flush_zones(run_state, family, table, reload, true); + fw3_flush_rules(handle, run_state, false); + fw3_flush_zones(handle, run_state, false); } - fw3_pr("COMMIT\n"); + fw3_ipt_commit(handle); } - fw3_command_close(); family_set(run_state, family, false); family_set(cfg_state, family, false); rv = 0; } - if (!reload && run_state) - { - if (fw3_command_pipe(false, "ipset", "-exist", "-")) - { - fw3_destroy_ipsets(run_state); - fw3_command_close(); - } - } + if (run_state) + fw3_destroy_ipsets(run_state); if (complete && (ct = fopen("/proc/net/nf_conntrack", "w")) != NULL) { @@ -263,27 +231,25 @@ stop(bool complete, bool reload) } static int -start(bool reload) +start(void) { int rv = 1; enum fw3_family family; enum fw3_table table; + struct fw3_ipt_handle *handle; - if (!print_rules && !reload) - { - if (fw3_command_pipe(false, "ipset", "-exist", "-")) - { - fw3_create_ipsets(cfg_state); - fw3_command_close(); - } - } + if (!print_family) + fw3_create_ipsets(cfg_state); for (family = FW3_FAMILY_V4; family <= FW3_FAMILY_V6; family++) { if (family == FW3_FAMILY_V6 && cfg_state->defaults.disable_ipv6) continue; - if (!print_rules && !reload && family_running(family)) + if (print_family && family != print_family) + continue; + + if (!print_family && family_running(family)) { warn("The %s firewall appears to be started already. " "If it is indeed empty, remove the %s file and retry.", @@ -292,32 +258,33 @@ start(bool reload) continue; } - if (!restore_pipe(family, false)) - continue; - for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++) { if (!fw3_has_table(family == FW3_FAMILY_V6, fw3_flag_names[table])) continue; + if (!(handle = fw3_ipt_open(family, table))) + continue; + info(" * Populating %s %s table", fw3_flag_names[family], fw3_flag_names[table]); - fw3_pr("*%s\n", fw3_flag_names[table]); - fw3_print_default_chains(cfg_state, family, table, reload); - fw3_print_zone_chains(cfg_state, family, table, reload); - fw3_print_default_head_rules(cfg_state, family, table, reload); - fw3_print_rules(cfg_state, family, table); - fw3_print_redirects(cfg_state, family, table); - fw3_print_forwards(cfg_state, family, table); - fw3_print_zone_rules(cfg_state, family, table, reload); - fw3_print_default_tail_rules(cfg_state, family, table, reload); - fw3_pr("COMMIT\n"); + fw3_print_default_chains(handle, cfg_state, false); + fw3_print_zone_chains(handle, cfg_state, false); + fw3_print_default_head_rules(handle, cfg_state, false); + fw3_print_rules(handle, cfg_state); + fw3_print_redirects(handle, cfg_state); + fw3_print_forwards(handle, cfg_state); + fw3_print_zone_rules(handle, cfg_state, false); + fw3_print_default_tail_rules(handle, cfg_state, false); + + if (!print_family) + fw3_ipt_commit(handle); } - fw3_print_includes(cfg_state, family, reload); + if (!print_family) + fw3_print_includes(cfg_state, family, false); - fw3_command_close(); family_set(run_state, family, true); family_set(cfg_state, family, true); @@ -328,9 +295,9 @@ start(bool reload) { fw3_set_defaults(cfg_state); - if (!print_rules) + if (!print_family) { - fw3_run_includes(cfg_state, reload); + fw3_run_includes(cfg_state, false); fw3_hotplug_zones(cfg_state, true); fw3_write_statefile(cfg_state); } @@ -339,6 +306,90 @@ start(bool reload) return rv; } + +static int +reload(void) +{ + int rv = 1; + enum fw3_family family; + enum fw3_table table; + struct fw3_ipt_handle *handle; + + if (!run_state) + return start(); + + fw3_hotplug_zones(run_state, false); + + for (family = FW3_FAMILY_V4; family <= FW3_FAMILY_V6; family++) + { + if (!family_running(family)) + goto start; + + for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++) + { + if (!fw3_has_table(family == FW3_FAMILY_V6, fw3_flag_names[table])) + continue; + + if (!(handle = fw3_ipt_open(family, table))) + continue; + + info(" * Clearing %s %s table", + fw3_flag_names[family], fw3_flag_names[table]); + + fw3_flush_rules(handle, run_state, true); + fw3_flush_zones(handle, run_state, true); + fw3_ipt_commit(handle); + } + + family_set(run_state, family, false); + family_set(cfg_state, family, false); + +start: + if (family == FW3_FAMILY_V6 && cfg_state->defaults.disable_ipv6) + continue; + + for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++) + { + if (!fw3_has_table(family == FW3_FAMILY_V6, fw3_flag_names[table])) + continue; + + if (!(handle = fw3_ipt_open(family, table))) + continue; + + info(" * Populating %s %s table", + fw3_flag_names[family], fw3_flag_names[table]); + + fw3_print_default_chains(handle, cfg_state, true); + fw3_print_zone_chains(handle, cfg_state, true); + fw3_print_default_head_rules(handle, cfg_state, true); + fw3_print_rules(handle, cfg_state); + fw3_print_redirects(handle, cfg_state); + fw3_print_forwards(handle, cfg_state); + fw3_print_zone_rules(handle, cfg_state, true); + fw3_print_default_tail_rules(handle, cfg_state, true); + + fw3_ipt_commit(handle); + } + + fw3_print_includes(cfg_state, family, true); + + family_set(run_state, family, true); + family_set(cfg_state, family, true); + + rv = 0; + } + + if (!rv) + { + fw3_set_defaults(cfg_state); + fw3_run_includes(cfg_state, true); + fw3_hotplug_zones(cfg_state, true); + fw3_write_statefile(cfg_state); + } + + return rv; +} + static int lookup_network(const char *net) { @@ -396,19 +447,19 @@ usage(void) int main(int argc, char **argv) { int ch, rv = 1; + enum fw3_family family = FW3_FAMILY_ANY; struct fw3_defaults *defs = NULL; - enum fw3_family use_family = FW3_FAMILY_ANY; while ((ch = getopt(argc, argv, "46dqh")) != -1) { switch (ch) { case '4': - use_family = FW3_FAMILY_V4; + family = FW3_FAMILY_V4; break; case '6': - use_family = FW3_FAMILY_V6; + family = FW3_FAMILY_V6; break; case 'd': @@ -437,23 +488,24 @@ int main(int argc, char **argv) if (!strcmp(argv[optind], "print")) { - if (use_family == FW3_FAMILY_ANY) - use_family = FW3_FAMILY_V4; - else if (use_family == FW3_FAMILY_V6 && defs->disable_ipv6) + if (family == FW3_FAMILY_ANY) + family = FW3_FAMILY_V4; + else if (family == FW3_FAMILY_V6 && defs->disable_ipv6) warn("IPv6 rules globally disabled in configuration"); freopen("/dev/null", "w", stderr); cfg_state->disable_ipsets = true; - print_rules = true; + print_family = family; + fw3_pr_debug = true; - rv = start(false); + rv = start(); } else if (!strcmp(argv[optind], "start")) { if (fw3_lock()) { - rv = start(false); + rv = start(); fw3_unlock(); } } @@ -461,7 +513,7 @@ int main(int argc, char **argv) { if (fw3_lock()) { - rv = stop(false, false); + rv = stop(false); fw3_unlock(); } } @@ -469,7 +521,7 @@ int main(int argc, char **argv) { if (fw3_lock()) { - rv = stop(true, false); + rv = stop(true); fw3_unlock(); } } @@ -477,9 +529,8 @@ int main(int argc, char **argv) { if (fw3_lock()) { - stop(true, false); - rv = start(false); - + stop(true); + rv = start(); fw3_unlock(); } } @@ -487,9 +538,7 @@ int main(int argc, char **argv) { if (fw3_lock()) { - rv = stop(false, true); - rv = start(!rv); - + rv = reload(); fw3_unlock(); } }