X-Git-Url: http://git.archive.openwrt.org/?p=project%2Ffirewall3.git;a=blobdiff_plain;f=rules.c;h=7f748ebb043fb96028d3598fc5f93c94ace3d137;hp=3ad2a6a42a05b72a91c6e8542fc2da78b1ddf21e;hb=78e134ba7cdc473e7cdf0422b863579ac700ac13;hpb=8fee8f9c520c58d07772cc6bd8f65d9eb1776a56 diff --git a/rules.c b/rules.c index 3ad2a6a..7f748eb 100644 --- a/rules.c +++ b/rules.c @@ -19,31 +19,47 @@ #include "rules.h" -static struct fw3_option rule_opts[] = { - FW3_OPT("name", string, rule, name), - FW3_OPT("family", family, rule, family), +const struct fw3_option fw3_rule_opts[] = { + FW3_OPT("enabled", bool, rule, enabled), - FW3_OPT("src", device, rule, src), - FW3_OPT("dest", device, rule, dest), + FW3_OPT("name", string, rule, name), + FW3_OPT("family", family, rule, family), - FW3_OPT("ipset", device, rule, ipset), + FW3_OPT("src", device, rule, src), + FW3_OPT("dest", device, rule, dest), - FW3_LIST("proto", protocol, rule, proto), + FW3_OPT("ipset", device, rule, ipset), - FW3_LIST("src_ip", address, rule, ip_src), - FW3_LIST("src_mac", mac, rule, mac_src), - FW3_LIST("src_port", port, rule, port_src), + FW3_LIST("proto", protocol, rule, proto), - FW3_LIST("dest_ip", address, rule, ip_dest), - FW3_LIST("dest_port", port, rule, port_dest), + FW3_LIST("src_ip", address, rule, ip_src), + FW3_LIST("src_mac", mac, rule, mac_src), + FW3_LIST("src_port", port, rule, port_src), - FW3_LIST("icmp_type", icmptype, rule, icmp_type), - FW3_OPT("extra", string, rule, extra), + FW3_LIST("dest_ip", address, rule, ip_dest), + FW3_LIST("dest_port", port, rule, port_dest), - FW3_OPT("limit", limit, rule, limit), - FW3_OPT("limit_burst", int, rule, limit.burst), + FW3_LIST("icmp_type", icmptype, rule, icmp_type), + FW3_OPT("extra", string, rule, extra), - FW3_OPT("target", target, rule, target), + FW3_OPT("limit", limit, rule, limit), + FW3_OPT("limit_burst", int, rule, limit.burst), + + FW3_OPT("utc_time", bool, rule, time.utc), + FW3_OPT("start_date", date, rule, time.datestart), + FW3_OPT("stop_date", date, rule, time.datestop), + FW3_OPT("start_time", time, rule, time.timestart), + FW3_OPT("stop_time", time, rule, time.timestop), + FW3_OPT("weekdays", weekdays, rule, time.weekdays), + FW3_OPT("monthdays", monthdays, rule, time.monthdays), + + FW3_OPT("mark", mark, rule, mark), + FW3_OPT("set_mark", mark, rule, set_mark), + FW3_OPT("set_xmark", mark, rule, set_xmark), + + FW3_OPT("target", target, rule, target), + + { } }; @@ -81,7 +97,15 @@ fw3_load_rules(struct fw3_state *state, struct uci_package *p) INIT_LIST_HEAD(&rule->icmp_type); - fw3_parse_options(rule, rule_opts, ARRAY_SIZE(rule_opts), s); + rule->enabled = true; + + fw3_parse_options(rule, fw3_rule_opts, s); + + if (!rule->enabled) + { + fw3_free_rule(rule); + continue; + } if (rule->src.invert || rule->dest.invert) { @@ -112,37 +136,70 @@ fw3_load_rules(struct fw3_state *state, struct uci_package *p) else if (rule->ipset.set && !rule->ipset.any && !(rule->_ipset = fw3_lookup_ipset(state, rule->ipset.name))) { - warn_elem(e, "refers to not declared ipset '%s'", rule->ipset.name); + warn_elem(e, "refers to unknown ipset '%s'", rule->ipset.name); fw3_free_rule(rule); continue; } - if (!rule->_src && rule->target == FW3_TARGET_NOTRACK) + if (!rule->_src && rule->target == FW3_FLAG_NOTRACK) { warn_elem(e, "is set to target NOTRACK but has no source assigned"); fw3_free_rule(rule); continue; } + if (!rule->set_mark.set && !rule->set_xmark.set && + rule->target == FW3_FLAG_MARK) + { + warn_elem(e, "is set to target MARK but specifies neither " + "'set_mark' nor 'set_xmark' option"); + fw3_free_rule(rule); + continue; + } + + if (rule->_dest && rule->target == FW3_FLAG_MARK) + { + warn_elem(e, "must not specify 'dest' for MARK target"); + fw3_free_rule(rule); + continue; + } + + if (rule->set_mark.invert || rule->set_xmark.invert) + { + warn_elem(e, "must not have inverted 'set_mark' or 'set_xmark'"); + fw3_free_rule(rule); + continue; + } + if (!rule->_src && !rule->_dest && !rule->src.any && !rule->dest.any) { warn_elem(e, "has neither a source nor a destination zone assigned " "- assuming an output rule"); } - if (rule->target == FW3_TARGET_UNSPEC) + if (list_empty(&rule->proto)) + { + warn_elem(e, "does not specify a protocol, assuming TCP+UDP"); + fw3_parse_protocol(&rule->proto, "tcpudp", true); + } + + if (rule->target == FW3_FLAG_UNSPEC) { warn_elem(e, "has no target specified, defaulting to REJECT"); - rule->target = FW3_TARGET_REJECT; + rule->target = FW3_FLAG_REJECT; } - else if (rule->target > FW3_TARGET_NOTRACK) + else if (rule->target > FW3_FLAG_MARK) { warn_elem(e, "has invalid target specified, defaulting to REJECT"); - rule->target = FW3_TARGET_REJECT; + rule->target = FW3_FLAG_REJECT; } + /* NB: rule family... */ if (rule->_dest) - rule->_dest->has_dest_target[rule->target] = true; + { + setbit(rule->_dest->flags[0], rule->target); + setbit(rule->_dest->flags[1], rule->target); + } list_add_tail(&rule->list, &state->rules); continue; @@ -157,10 +214,14 @@ print_chain(struct fw3_rule *rule) sprintf(chain, "delegate_output"); - if (rule->target == FW3_TARGET_NOTRACK) + if (rule->target == FW3_FLAG_NOTRACK) { sprintf(chain, "zone_%s_notrack", rule->src.name); } + else if (rule->target == FW3_FLAG_MARK) + { + sprintf(chain, "fwmark"); + } else { if (rule->src.set) @@ -190,47 +251,57 @@ print_chain(struct fw3_rule *rule) static void print_target(struct fw3_rule *rule) { - char target[256]; + const char *target; switch(rule->target) { - case FW3_TARGET_ACCEPT: - sprintf(target, "ACCEPT"); - break; - - case FW3_TARGET_DROP: - sprintf(target, "DROP"); - break; + case FW3_FLAG_MARK: + if (rule->set_mark.set) + fw3_pr(" -j MARK --set-mark 0x%x/0x%x\n", + rule->set_mark.mark, rule->set_mark.mask); + else + fw3_pr(" -j MARK --set-xmark 0x%x/0x%x\n", + rule->set_xmark.mark, rule->set_xmark.mask); + return; - case FW3_TARGET_NOTRACK: - sprintf(target, "NOTRACK"); + case FW3_FLAG_ACCEPT: + case FW3_FLAG_DROP: + case FW3_FLAG_NOTRACK: + target = fw3_flag_names[rule->target]; break; default: - sprintf(target, "REJECT"); + target = fw3_flag_names[FW3_FLAG_REJECT]; break; } if (rule->dest.set && !rule->dest.any) fw3_pr(" -j zone_%s_dest_%s\n", rule->dest.name, target); - else if (!strcmp(target, "REJECT")) + else if (rule->target == FW3_FLAG_REJECT) fw3_pr(" -j reject\n"); else fw3_pr(" -j %s\n", target); } static void -print_rule(enum fw3_table table, enum fw3_family family, - struct fw3_rule *rule, struct fw3_protocol *proto, +print_rule(struct fw3_state *state, enum fw3_family family, + enum fw3_table table, struct fw3_rule *rule, + struct fw3_protocol *proto, struct fw3_address *sip, struct fw3_address *dip, struct fw3_port *sport, struct fw3_port *dport, struct fw3_mac *mac, struct fw3_icmptype *icmptype) { if (!fw3_is_family(sip, family) || !fw3_is_family(dip, family)) + { + info(" ! Skipping due to different family of ip address"); return; + } if (proto->protocol == 58 && family == FW3_FAMILY_V4) + { + info(" ! Skipping due to different family of protocol"); return; + } print_chain(rule); fw3_format_ipset(rule->_ipset, rule->ipset.invert); @@ -240,14 +311,16 @@ print_rule(enum fw3_table table, enum fw3_family family, fw3_format_icmptype(icmptype, family); fw3_format_mac(mac); fw3_format_limit(&rule->limit); + fw3_format_time(&rule->time); + fw3_format_mark(&rule->mark); fw3_format_extra(rule->extra); fw3_format_comment(rule->name); print_target(rule); } static void -expand_rule(enum fw3_table table, enum fw3_family family, - struct fw3_rule *rule, int num) +expand_rule(struct fw3_state *state, enum fw3_family family, + enum fw3_table table, struct fw3_rule *rule, int num) { struct fw3_protocol *proto; struct fw3_address *sip; @@ -267,8 +340,9 @@ expand_rule(enum fw3_table table, enum fw3_family family, if (!fw3_is_family(rule, family)) return; - if ((table == FW3_TABLE_RAW && rule->target != FW3_TARGET_NOTRACK) || - (table != FW3_TABLE_FILTER)) + if ((rule->target == FW3_FLAG_NOTRACK && table != FW3_TABLE_RAW) || + (rule->target == FW3_FLAG_MARK && table != FW3_TABLE_MANGLE) || + (rule->target < FW3_FLAG_NOTRACK && table != FW3_TABLE_FILTER)) return; if (rule->name) @@ -276,6 +350,32 @@ expand_rule(enum fw3_table table, enum fw3_family family, else info(" * Rule #%u", num); + if (!fw3_is_family(rule->_src, family) || + !fw3_is_family(rule->_dest, family)) + { + info(" ! Skipping due to different family of zone"); + return; + } + + if (rule->_ipset) + { + if (!fw3_is_family(rule->_ipset, family)) + { + info(" ! Skipping due to different family in ipset"); + return; + } + + if (!fw3_check_ipset(rule->_ipset)) + { + info(" ! Skipping due to missing ipset '%s'", + rule->_ipset->external + ? rule->_ipset->external : rule->_ipset->name); + return; + } + + set(rule->_ipset->flags, family, family); + } + list_for_each_entry(proto, &rule->proto, list) { /* icmp / ipv6-icmp */ @@ -298,35 +398,18 @@ expand_rule(enum fw3_table table, enum fw3_family family, fw3_foreach(dport, dports) fw3_foreach(mac, &rule->mac_src) fw3_foreach(icmptype, icmptypes) - print_rule(table, family, rule, proto, sip, dip, sport, dport, - mac, icmptype); + print_rule(state, family, table, rule, proto, sip, dip, + sport, dport, mac, icmptype); } } void -fw3_print_rules(enum fw3_table table, enum fw3_family family, - struct fw3_state *state) +fw3_print_rules(struct fw3_state *state, enum fw3_family family, + enum fw3_table table) { int num = 0; struct fw3_rule *rule; list_for_each_entry(rule, &state->rules, list) - expand_rule(table, family, rule, num++); -} - -void -fw3_free_rule(struct fw3_rule *rule) -{ - fw3_free_list(&rule->proto); - - fw3_free_list(&rule->ip_src); - fw3_free_list(&rule->mac_src); - fw3_free_list(&rule->port_dest); - - fw3_free_list(&rule->ip_dest); - fw3_free_list(&rule->port_dest); - - fw3_free_list(&rule->icmp_type); - - free(rule); + expand_rule(state, family, table, rule, num++); }