X-Git-Url: http://git.archive.openwrt.org/?p=project%2Ffirewall3.git;a=blobdiff_plain;f=rules.c;h=1037d2f92be7afd3cce5a5bdc8473de230c97eff;hp=ab094bb40537e63299e91442d34659d51fedda18;hb=8374bbbf1f5b3ebc9546503b49b595e6536ed1dd;hpb=5df8137ebc5db2bc9c6e71b2d154a5f77679d9d8 diff --git a/rules.c b/rules.c index ab094bb..1037d2f 100644 --- a/rules.c +++ b/rules.c @@ -20,30 +20,40 @@ const struct fw3_option fw3_rule_opts[] = { - FW3_OPT("name", string, rule, name), - FW3_OPT("family", family, rule, family), + FW3_OPT("enabled", bool, rule, enabled), - FW3_OPT("src", device, rule, src), - FW3_OPT("dest", device, rule, dest), + FW3_OPT("name", string, rule, name), + FW3_OPT("family", family, rule, family), - FW3_OPT("ipset", device, rule, ipset), + FW3_OPT("src", device, rule, src), + FW3_OPT("dest", device, rule, dest), - FW3_LIST("proto", protocol, rule, proto), + FW3_OPT("ipset", device, rule, ipset), - FW3_LIST("src_ip", address, rule, ip_src), - FW3_LIST("src_mac", mac, rule, mac_src), - FW3_LIST("src_port", port, rule, port_src), + FW3_LIST("proto", protocol, rule, proto), - FW3_LIST("dest_ip", address, rule, ip_dest), - FW3_LIST("dest_port", port, rule, port_dest), + FW3_LIST("src_ip", address, rule, ip_src), + FW3_LIST("src_mac", mac, rule, mac_src), + FW3_LIST("src_port", port, rule, port_src), - FW3_LIST("icmp_type", icmptype, rule, icmp_type), - FW3_OPT("extra", string, rule, extra), + FW3_LIST("dest_ip", address, rule, ip_dest), + FW3_LIST("dest_port", port, rule, port_dest), - FW3_OPT("limit", limit, rule, limit), - FW3_OPT("limit_burst", int, rule, limit.burst), + FW3_LIST("icmp_type", icmptype, rule, icmp_type), + FW3_OPT("extra", string, rule, extra), - FW3_OPT("target", target, rule, target), + FW3_OPT("limit", limit, rule, limit), + FW3_OPT("limit_burst", int, rule, limit.burst), + + FW3_OPT("utc_time", bool, rule, time.utc), + FW3_OPT("start_date", date, rule, time.datestart), + FW3_OPT("stop_date", date, rule, time.datestop), + FW3_OPT("start_time", time, rule, time.timestart), + FW3_OPT("stop_time", time, rule, time.timestop), + FW3_OPT("weekdays", weekdays, rule, time.weekdays), + FW3_OPT("monthdays", monthdays, rule, time.monthdays), + + FW3_OPT("target", target, rule, target), { } }; @@ -83,8 +93,16 @@ fw3_load_rules(struct fw3_state *state, struct uci_package *p) INIT_LIST_HEAD(&rule->icmp_type); + rule->enabled = true; + fw3_parse_options(rule, fw3_rule_opts, s); + if (!rule->enabled) + { + fw3_free_rule(rule); + continue; + } + if (rule->src.invert || rule->dest.invert) { warn_elem(e, "must not have inverted 'src' or 'dest' options"); @@ -119,7 +137,7 @@ fw3_load_rules(struct fw3_state *state, struct uci_package *p) continue; } - if (!rule->_src && rule->target == FW3_TARGET_NOTRACK) + if (!rule->_src && rule->target == FW3_FLAG_NOTRACK) { warn_elem(e, "is set to target NOTRACK but has no source assigned"); fw3_free_rule(rule); @@ -132,19 +150,29 @@ fw3_load_rules(struct fw3_state *state, struct uci_package *p) "- assuming an output rule"); } - if (rule->target == FW3_TARGET_UNSPEC) + if (list_empty(&rule->proto)) + { + warn_elem(e, "does not specify a protocol, assuming TCP+UDP"); + fw3_parse_protocol(&rule->proto, "tcpudp", true); + } + + if (rule->target == FW3_FLAG_UNSPEC) { warn_elem(e, "has no target specified, defaulting to REJECT"); - rule->target = FW3_TARGET_REJECT; + rule->target = FW3_FLAG_REJECT; } - else if (rule->target > FW3_TARGET_NOTRACK) + else if (rule->target > FW3_FLAG_NOTRACK) { warn_elem(e, "has invalid target specified, defaulting to REJECT"); - rule->target = FW3_TARGET_REJECT; + rule->target = FW3_FLAG_REJECT; } + /* NB: rule family... */ if (rule->_dest) - setbit(rule->_dest->dst_flags, rule->target); + { + setbit(rule->_dest->flags[0], rule->target); + setbit(rule->_dest->flags[1], rule->target); + } list_add_tail(&rule->list, &state->rules); continue; @@ -159,7 +187,7 @@ print_chain(struct fw3_rule *rule) sprintf(chain, "delegate_output"); - if (rule->target == FW3_TARGET_NOTRACK) + if (rule->target == FW3_FLAG_NOTRACK) { sprintf(chain, "zone_%s_notrack", rule->src.name); } @@ -196,28 +224,29 @@ static void print_target(struct fw3_rule *rule) switch(rule->target) { - case FW3_TARGET_ACCEPT: - case FW3_TARGET_DROP: - case FW3_TARGET_NOTRACK: + case FW3_FLAG_ACCEPT: + case FW3_FLAG_DROP: + case FW3_FLAG_NOTRACK: target = fw3_flag_names[rule->target]; break; default: - target = fw3_flag_names[FW3_TARGET_REJECT]; + target = fw3_flag_names[FW3_FLAG_REJECT]; break; } if (rule->dest.set && !rule->dest.any) fw3_pr(" -j zone_%s_dest_%s\n", rule->dest.name, target); - else if (rule->target == FW3_TARGET_REJECT) + else if (rule->target == FW3_FLAG_REJECT) fw3_pr(" -j reject\n"); else fw3_pr(" -j %s\n", target); } static void -print_rule(enum fw3_table table, enum fw3_family family, - struct fw3_rule *rule, struct fw3_protocol *proto, +print_rule(struct fw3_state *state, enum fw3_family family, + enum fw3_table table, struct fw3_rule *rule, + struct fw3_protocol *proto, struct fw3_address *sip, struct fw3_address *dip, struct fw3_port *sport, struct fw3_port *dport, struct fw3_mac *mac, struct fw3_icmptype *icmptype) @@ -242,14 +271,15 @@ print_rule(enum fw3_table table, enum fw3_family family, fw3_format_icmptype(icmptype, family); fw3_format_mac(mac); fw3_format_limit(&rule->limit); + fw3_format_time(&rule->time); fw3_format_extra(rule->extra); fw3_format_comment(rule->name); print_target(rule); } static void -expand_rule(enum fw3_table table, enum fw3_family family, - struct fw3_rule *rule, int num) +expand_rule(struct fw3_state *state, enum fw3_family family, + enum fw3_table table, struct fw3_rule *rule, int num) { struct fw3_protocol *proto; struct fw3_address *sip; @@ -269,7 +299,7 @@ expand_rule(enum fw3_table table, enum fw3_family family, if (!fw3_is_family(rule, family)) return; - if ((table == FW3_TABLE_RAW && rule->target != FW3_TARGET_NOTRACK) || + if ((table == FW3_TABLE_RAW && rule->target != FW3_FLAG_NOTRACK) || (table != FW3_TABLE_FILTER)) return; @@ -293,7 +323,7 @@ expand_rule(enum fw3_table table, enum fw3_family family, return; } - setbit(rule->_ipset->flags, family); + set(rule->_ipset->flags, family, family); } list_for_each_entry(proto, &rule->proto, list) @@ -318,18 +348,18 @@ expand_rule(enum fw3_table table, enum fw3_family family, fw3_foreach(dport, dports) fw3_foreach(mac, &rule->mac_src) fw3_foreach(icmptype, icmptypes) - print_rule(table, family, rule, proto, sip, dip, sport, dport, - mac, icmptype); + print_rule(state, family, table, rule, proto, sip, dip, + sport, dport, mac, icmptype); } } void -fw3_print_rules(enum fw3_table table, enum fw3_family family, - struct fw3_state *state) +fw3_print_rules(struct fw3_state *state, enum fw3_family family, + enum fw3_table table) { int num = 0; struct fw3_rule *rule; list_for_each_entry(rule, &state->rules, list) - expand_rule(table, family, rule, num++); + expand_rule(state, family, table, rule, num++); }