X-Git-Url: http://git.archive.openwrt.org/?p=project%2Ffirewall3.git;a=blobdiff_plain;f=options.c;h=d990cada687277c12a92efb26817785b21001975;hp=25668fcec9ef4addd3f5012b4d894b00211a6d91;hb=f50a524847a0ac74ef8cc74011d3cc46e9269c6b;hpb=7db01c8b2fda897c596ee7befbead66c31285590 diff --git a/options.c b/options.c index 25668fc..d990cad 100644 --- a/options.c +++ b/options.c @@ -1,7 +1,7 @@ /* * firewall3 - 3rd OpenWrt UCI firewall implementation * - * Copyright (C) 2013-2014 Jo-Philipp Wich + * Copyright (C) 2013-2014 Jo-Philipp Wich * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -75,6 +75,7 @@ const char *fw3_flag_names[__FW3_FLAG_MAX] = { "REJECT", "DROP", "NOTRACK", + "HELPER", "MARK", "DNAT", "SNAT", @@ -244,8 +245,8 @@ fw3_parse_address(void *ptr, const char *val, bool is_list) struct fw3_address addr = { }; struct in_addr v4; struct in6_addr v6; - char *p, *s, *e; - int i, m = -1; + char *p = NULL, *m = NULL, *s, *e; + int bits = -1; if (*val == '!') { @@ -258,71 +259,82 @@ fw3_parse_address(void *ptr, const char *val, bool is_list) if (!s) return false; - if ((p = strchr(s, '/')) != NULL) - { + if ((m = strchr(s, '/')) != NULL) + *m++ = 0; + else if ((p = strchr(s, '-')) != NULL) *p++ = 0; - m = strtoul(p, &e, 10); - if ((e == p) || (*e != 0)) + if (inet_pton(AF_INET6, s, &v6)) + { + addr.family = FW3_FAMILY_V6; + addr.address.v6 = v6; + + if (m) { - if (strchr(s, ':') || !inet_pton(AF_INET, p, &v4)) + if (!inet_pton(AF_INET6, m, &v6)) { - free(s); - return false; - } + bits = strtol(m, &e, 10); - for (i = 0, m = 32; !(v4.s_addr & 1) && (i < 32); i++) - { - m--; - v4.s_addr >>= 1; + if ((*e != 0) || !fw3_bitlen2netmask(addr.family, bits, &v6)) + goto fail; } - } - } - else if ((p = strchr(s, '-')) != NULL) - { - *p++ = 0; - if (inet_pton(AF_INET6, p, &v6)) - { - addr.family = FW3_FAMILY_V6; - addr.address2.v6 = v6; - addr.range = true; + addr.mask.v6 = v6; } - else if (inet_pton(AF_INET, p, &v4)) + else if (p) { - addr.family = FW3_FAMILY_V4; - addr.address2.v4 = v4; + if (!inet_pton(AF_INET6, p, &addr.mask.v6)) + goto fail; + addr.range = true; } else { - free(s); - return false; + memset(addr.mask.v6.s6_addr, 0xFF, 16); } } - - if (inet_pton(AF_INET6, s, &v6)) - { - addr.family = FW3_FAMILY_V6; - addr.address.v6 = v6; - addr.mask = (m >= 0) ? m : 128; - } else if (inet_pton(AF_INET, s, &v4)) { addr.family = FW3_FAMILY_V4; addr.address.v4 = v4; - addr.mask = (m >= 0) ? m : 32; + + if (m) + { + if (!inet_pton(AF_INET, m, &v4)) + { + bits = strtol(m, &e, 10); + + if ((*e != 0) || !fw3_bitlen2netmask(addr.family, bits, &v4)) + goto fail; + } + + addr.mask.v4 = v4; + } + else if (p) + { + if (!inet_pton(AF_INET, p, &addr.mask.v4)) + goto fail; + + addr.range = true; + } + else + { + addr.mask.v4.s_addr = 0xFFFFFFFF; + } } else { - free(s); - return false; + goto fail; } free(s); addr.set = true; put_value(ptr, &addr, sizeof(addr), is_list); return true; + +fail: + free(s); + return false; } bool @@ -331,19 +343,31 @@ fw3_parse_network(void *ptr, const char *val, bool is_list) struct fw3_device dev = { }; struct fw3_address *addr, *tmp; LIST_HEAD(addr_list); + int n_addrs; if (!fw3_parse_address(ptr, val, is_list)) { if (!fw3_parse_device(&dev, val, false)) return false; - fw3_ubus_address(&addr_list, dev.name); + n_addrs = fw3_ubus_address(&addr_list, dev.name); + list_for_each_entry(addr, &addr_list, list) { addr->invert = dev.invert; addr->resolved = true; } + /* add an empty address member with .set = false, .resolved = true + * to signal resolving failure to callers */ + if (n_addrs == 0) + { + tmp = fw3_alloc(sizeof(*tmp)); + tmp->resolved = true; + + list_add_tail(&tmp->list, &addr_list); + } + if (is_list) { list_splice_tail(&addr_list, ptr); @@ -431,7 +455,7 @@ fw3_parse_port(void *ptr, const char *val, bool is_list) bool fw3_parse_family(void *ptr, const char *val, bool is_list) { - if (!strcmp(val, "any")) + if (!strcmp(val, "any") || !strcmp(val, "*")) *((enum fw3_family *)ptr) = FW3_FAMILY_ANY; else if (!strcmp(val, "inet") || strrchr(val, '4')) *((enum fw3_family *)ptr) = FW3_FAMILY_V4; @@ -532,7 +556,7 @@ fw3_parse_protocol(void *ptr, const char *val, bool is_list) while (isspace(*++val)); } - if (!strcmp(val, "all")) + if (!strcmp(val, "all") || !strcmp(val, "any") || !strcmp(val, "*")) { proto.any = true; put_value(ptr, &proto, sizeof(proto), is_list); @@ -707,7 +731,7 @@ fw3_parse_weekdays(void *ptr, const char *val, bool is_list) if (*val == '!') { - setbit(*(uint8_t *)ptr, 0); + fw3_setbit(*(uint8_t *)ptr, 0); while (isspace(*++val)); } @@ -727,7 +751,7 @@ fw3_parse_weekdays(void *ptr, const char *val, bool is_list) } } - setbit(*(uint8_t *)ptr, w); + fw3_setbit(*(uint8_t *)ptr, w); } free(s); @@ -742,7 +766,7 @@ fw3_parse_monthdays(void *ptr, const char *val, bool is_list) if (*val == '!') { - setbit(*(uint32_t *)ptr, 0); + fw3_setbit(*(uint32_t *)ptr, 0); while (isspace(*++val)); } @@ -759,7 +783,7 @@ fw3_parse_monthdays(void *ptr, const char *val, bool is_list) return false; } - setbit(*(uint32_t *)ptr, d); + fw3_setbit(*(uint32_t *)ptr, d); } free(s); @@ -874,13 +898,35 @@ fw3_parse_direction(void *ptr, const char *val, bool is_list) return valid; } +bool +fw3_parse_cthelper(void *ptr, const char *val, bool is_list) +{ + struct fw3_cthelpermatch m = { }; + + if (*val == '!') + { + m.invert = true; + while (isspace(*++val)); + } + + if (*val) + { + m.set = true; + strncpy(m.name, val, sizeof(m.name) - 1); + put_value(ptr, &m, sizeof(m), is_list); + return true; + } + + return false; +} + bool fw3_parse_options(void *s, const struct fw3_option *opts, struct uci_section *section) { char *p, *v; - bool known; + bool known, inv; struct uci_element *e, *l; struct uci_option *o; const struct fw3_option *opt; @@ -942,10 +988,30 @@ fw3_parse_options(void *s, const struct fw3_option *opts, } else { + inv = false; dest = (struct list_head *)((char *)s + opt->offset); for (p = strtok(v, " \t"); p != NULL; p = strtok(NULL, " \t")) { + /* If we encounter a sole "!" token, assume that it + * is meant to be part of the next token, so silently + * skip it and remember the state... */ + if (!strcmp(p, "!")) + { + inv = true; + continue; + } + + /* The previous token was a sole "!", rewind pointer + * back by one byte to precede the value with an + * exclamation mark which effectively turns + * ("!", "foo") into ("!foo") */ + if (inv) + { + *--p = '!'; + inv = false; + } + if (!opt->parse(dest, p, true)) { warn_elem(e, "has invalid value '%s'", p); @@ -953,6 +1019,14 @@ fw3_parse_options(void *s, const struct fw3_option *opts, continue; } } + + /* The last token was a sole "!" without any subsequent + * text, so pass it to the option parser as-is. */ + if (inv && !opt->parse(dest, "!", true)) + { + warn_elem(e, "has invalid value '%s'", p); + valid = false; + } } } @@ -970,7 +1044,7 @@ fw3_parse_options(void *s, const struct fw3_option *opts, bool fw3_parse_blob_options(void *s, const struct fw3_option *opts, - struct blob_attr *a) + struct blob_attr *a, const char *name) { char *p, *v, buf[16]; bool known; @@ -996,7 +1070,9 @@ fw3_parse_blob_options(void *s, const struct fw3_option *opts, { if (!opt->elem_size) { - fprintf(stderr, "%s must not be a list\n", opt->name); + fprintf(stderr, "%s: '%s' must not be a list\n", + name, opt->name); + valid = false; } else @@ -1014,7 +1090,8 @@ fw3_parse_blob_options(void *s, const struct fw3_option *opts, if (!opt->parse(dest, v, true)) { - fprintf(stderr, "%s has invalid value '%s'\n", opt->name, v); + fprintf(stderr, "%s: '%s' has invalid value '%s'\n", + name, opt->name, v); valid = false; continue; } @@ -1037,7 +1114,8 @@ fw3_parse_blob_options(void *s, const struct fw3_option *opts, { if (!opt->parse((char *)s + opt->offset, v, false)) { - fprintf(stderr, "%s has invalid value '%s'\n", opt->name, v); + fprintf(stderr, "%s: '%s' has invalid value '%s'\n", + name, opt->name, v); valid = false; } } @@ -1049,7 +1127,8 @@ fw3_parse_blob_options(void *s, const struct fw3_option *opts, { if (!opt->parse(dest, p, true)) { - fprintf(stderr, "%s has invalid value '%s'\n", opt->name, p); + fprintf(stderr, "%s: '%s' has invalid value '%s'\n", + name, opt->name, p); valid = false; continue; } @@ -1061,8 +1140,8 @@ fw3_parse_blob_options(void *s, const struct fw3_option *opts, break; } - if (!known) - fprintf(stderr, "%s is unknown\n", blobmsg_name(o)); + if (!known && strcmp(blobmsg_name(o), "type")) + fprintf(stderr, "%s: '%s' is unknown\n", name, blobmsg_name(o)); } return valid; @@ -1070,7 +1149,7 @@ fw3_parse_blob_options(void *s, const struct fw3_option *opts, const char * -fw3_address_to_string(struct fw3_address *address, bool allow_invert) +fw3_address_to_string(struct fw3_address *address, bool allow_invert, bool as_cidr) { char *p, ip[INET6_ADDRSTRLEN]; static char buf[INET6_ADDRSTRLEN * 2 + 2]; @@ -1088,13 +1167,21 @@ fw3_address_to_string(struct fw3_address *address, bool allow_invert) if (address->range) { inet_ntop(address->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6, - &address->address2.v4, ip, sizeof(ip)); + &address->mask.v4, ip, sizeof(ip)); p += sprintf(p, "-%s", ip); } + else if (!as_cidr) + { + inet_ntop(address->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6, + &address->mask.v4, ip, sizeof(ip)); + + p += sprintf(p, "/%s", ip); + } else { - p += sprintf(p, "/%u", address->mask); + p += sprintf(p, "/%u", fw3_netmask2bitlen(address->family, + &address->mask.v6)); } return buf;