X-Git-Url: http://git.archive.openwrt.org/?p=project%2Ffirewall3.git;a=blobdiff_plain;f=main.c;h=71463aec6a3840b547291de8fbae5ece5f9939c3;hp=8305f9f28330cf7e1d6884fad7ee4c9bf0440a1d;hb=c03e20d7f594058ff223f30cf34de1b5e8210b8d;hpb=28df94a5e01fe3309eb664cae419a6fd4e5eab40 diff --git a/main.c b/main.c index 8305f9f..71463ae 100644 --- a/main.c +++ b/main.c @@ -1,7 +1,7 @@ /* * firewall3 - 3rd OpenWrt UCI firewall implementation * - * Copyright (C) 2013 Jo-Philipp Wich + * Copyright (C) 2013-2014 Jo-Philipp Wich * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -24,6 +24,7 @@ #include "zones.h" #include "rules.h" #include "redirects.h" +#include "snats.h" #include "forwards.h" #include "ipsets.h" #include "includes.h" @@ -44,12 +45,10 @@ build_state(bool runtime) struct uci_package *p = NULL; FILE *sf; - state = malloc(sizeof(*state)); - + state = calloc(1, sizeof(*state)); if (!state) error("Out of memory"); - memset(state, 0, sizeof(*state)); state->uci = uci_alloc_context(); if (!state->uci) @@ -97,11 +96,16 @@ build_state(bool runtime) cfg_state = state; } + + struct blob_buf b = {NULL, NULL, 0, NULL}; + fw3_ubus_rules(&b); + fw3_load_defaults(state, p); fw3_load_ipsets(state, p); fw3_load_zones(state, p); - fw3_load_rules(state, p); + fw3_load_rules(state, p, b.head); fw3_load_redirects(state, p); + fw3_load_snats(state, p, b.head); fw3_load_forwards(state, p); fw3_load_includes(state, p); @@ -122,6 +126,9 @@ free_state(struct fw3_state *state) list_for_each_safe(cur, tmp, &state->redirects) fw3_free_redirect((struct fw3_redirect *)cur); + list_for_each_safe(cur, tmp, &state->snats) + fw3_free_snat((struct fw3_snat *)cur); + list_for_each_safe(cur, tmp, &state->forwards) fw3_free_forward((struct fw3_forward *)cur); @@ -160,8 +167,6 @@ family_set(struct fw3_state *state, enum fw3_family family, bool set) static int stop(bool complete) { - FILE *ct; - int rv = 1; enum fw3_family family; enum fw3_table table; @@ -205,6 +210,7 @@ stop(bool complete) } fw3_ipt_commit(handle); + fw3_ipt_close(handle); } family_set(run_state, family, false); @@ -216,13 +222,8 @@ stop(bool complete) if (run_state) fw3_destroy_ipsets(run_state); - if (complete && (ct = fopen("/proc/net/nf_conntrack", "w")) != NULL) - { - info(" * Flushing conntrack table ..."); - - fwrite("f\n", 2, 1, ct); - fclose(ct); - } + if (complete) + fw3_flush_conntrack(NULL); if (!rv && run_state) fw3_write_statefile(run_state); @@ -274,12 +275,15 @@ start(void) fw3_print_default_head_rules(handle, cfg_state, false); fw3_print_rules(handle, cfg_state); fw3_print_redirects(handle, cfg_state); + fw3_print_snats(handle, cfg_state); fw3_print_forwards(handle, cfg_state); fw3_print_zone_rules(handle, cfg_state, false); fw3_print_default_tail_rules(handle, cfg_state, false); if (!print_family) fw3_ipt_commit(handle); + + fw3_ipt_close(handle); } if (!print_family) @@ -293,6 +297,7 @@ start(void) if (!rv) { + fw3_flush_conntrack(run_state); fw3_set_defaults(cfg_state); if (!print_family) @@ -315,8 +320,10 @@ reload(void) enum fw3_table table; struct fw3_ipt_handle *handle; - if (!print_family && run_state) - fw3_hotplug_zones(run_state, false); + if (!run_state) + return start(); + + fw3_hotplug_zones(run_state, false); for (family = FW3_FAMILY_V4; family <= FW3_FAMILY_V6; family++) { @@ -334,13 +341,10 @@ reload(void) info(" * Clearing %s %s table", fw3_flag_names[family], fw3_flag_names[table]); - if (run_state) - { - fw3_flush_rules(handle, run_state, true); - fw3_flush_zones(handle, run_state, true); - } - + fw3_flush_rules(handle, run_state, true); + fw3_flush_zones(handle, run_state, true); fw3_ipt_commit(handle); + fw3_ipt_close(handle); } family_set(run_state, family, false); @@ -366,11 +370,13 @@ start: fw3_print_default_head_rules(handle, cfg_state, true); fw3_print_rules(handle, cfg_state); fw3_print_redirects(handle, cfg_state); + fw3_print_snats(handle, cfg_state); fw3_print_forwards(handle, cfg_state); fw3_print_zone_rules(handle, cfg_state, true); fw3_print_default_tail_rules(handle, cfg_state, true); fw3_ipt_commit(handle); + fw3_ipt_close(handle); } fw3_print_includes(cfg_state, family, true); @@ -383,14 +389,12 @@ start: if (!rv) { - fw3_set_defaults(cfg_state); + fw3_flush_conntrack(run_state); - if (!print_family) - { - fw3_run_includes(cfg_state, true); - fw3_hotplug_zones(cfg_state, true); - fw3_write_statefile(cfg_state); - } + fw3_set_defaults(cfg_state); + fw3_run_includes(cfg_state, true); + fw3_hotplug_zones(cfg_state, true); + fw3_write_statefile(cfg_state); } return rv; @@ -439,12 +443,42 @@ lookup_device(const char *dev) } static int +lookup_zone(const char *zone, const char *device) +{ + struct fw3_zone *z; + struct fw3_device *d; + + list_for_each_entry(z, &cfg_state->zones, list) + { + if (strcmp(z->name, zone)) + continue; + + list_for_each_entry(d, &z->devices, list) + { + if (device && strcmp(device, d->name)) + continue; + + printf("%s\n", d->name); + + if (device) + return 0; + } + + if (!device) + return 0; + } + + return 1; +} + +static int usage(void) { fprintf(stderr, "fw3 [-4] [-6] [-q] print\n"); fprintf(stderr, "fw3 [-q] {start|stop|flush|reload|restart}\n"); fprintf(stderr, "fw3 [-q] network {net}\n"); fprintf(stderr, "fw3 [-q] device {dev}\n"); + fprintf(stderr, "fw3 [-q] zone {zone} [dev]\n"); return 1; } @@ -453,6 +487,7 @@ usage(void) int main(int argc, char **argv) { int ch, rv = 1; + enum fw3_family family = FW3_FAMILY_ANY; struct fw3_defaults *defs = NULL; while ((ch = getopt(argc, argv, "46dqh")) != -1) @@ -460,11 +495,11 @@ int main(int argc, char **argv) switch (ch) { case '4': - print_family = FW3_FAMILY_V4; + family = FW3_FAMILY_V4; break; case '6': - print_family = FW3_FAMILY_V6; + family = FW3_FAMILY_V6; break; case 'd': @@ -472,7 +507,7 @@ int main(int argc, char **argv) break; case 'q': - freopen("/dev/null", "w", stderr); + if (freopen("/dev/null", "w", stderr)) {} break; case 'h': @@ -493,14 +528,24 @@ int main(int argc, char **argv) if (!strcmp(argv[optind], "print")) { - if (print_family == FW3_FAMILY_ANY) - print_family = FW3_FAMILY_V4; - else if (print_family == FW3_FAMILY_V6 && defs->disable_ipv6) - warn("IPv6 rules globally disabled in configuration"); + if (family == FW3_FAMILY_ANY) + { + family = FW3_FAMILY_V4; + } + else if (family == FW3_FAMILY_V6) + { + if (defs->disable_ipv6) + warn("IPv6 rules globally disabled in configuration"); +#ifdef DISABLE_IPV6 + else + warn("IPv6 support is not compiled in"); +#endif + } - freopen("/dev/null", "w", stderr); + if (freopen("/dev/null", "w", stderr)) {}; cfg_state->disable_ipsets = true; + print_family = family; fw3_pr_debug = true; rv = start(); @@ -554,6 +599,10 @@ int main(int argc, char **argv) { rv = lookup_device(argv[optind + 1]); } + else if (!strcmp(argv[optind], "zone") && (optind + 1) < argc) + { + rv = lookup_zone(argv[optind + 1], argv[optind + 2]); + } else { rv = usage();