X-Git-Url: http://git.archive.openwrt.org/?p=project%2Ffirewall3.git;a=blobdiff_plain;f=rules.c;h=8452a402a7e740b432819b98c3dd585b1a5db789;hp=bc983a6a7b8177b58118f6d656009aaa0184f335;hb=ff9d5e13c9150c62fe698e4bc5541e6f92b241d0;hpb=df1bb55631c967aa0e4ee49cd29cf463fb86c85b diff --git a/rules.c b/rules.c index bc983a6..8452a40 100644 --- a/rules.c +++ b/rules.c @@ -19,31 +19,43 @@ #include "rules.h" -static struct fw3_option rule_opts[] = { - FW3_OPT("name", string, rule, name), - FW3_OPT("family", family, rule, family), +const struct fw3_option fw3_rule_opts[] = { + FW3_OPT("enabled", bool, rule, enabled), - FW3_OPT("src", device, rule, src), - FW3_OPT("dest", device, rule, dest), + FW3_OPT("name", string, rule, name), + FW3_OPT("family", family, rule, family), - FW3_OPT("ipset", device, rule, ipset), + FW3_OPT("src", device, rule, src), + FW3_OPT("dest", device, rule, dest), - FW3_LIST("proto", protocol, rule, proto), + FW3_OPT("ipset", device, rule, ipset), - FW3_LIST("src_ip", address, rule, ip_src), - FW3_LIST("src_mac", mac, rule, mac_src), - FW3_LIST("src_port", port, rule, port_src), + FW3_LIST("proto", protocol, rule, proto), - FW3_LIST("dest_ip", address, rule, ip_dest), - FW3_LIST("dest_port", port, rule, port_dest), + FW3_LIST("src_ip", address, rule, ip_src), + FW3_LIST("src_mac", mac, rule, mac_src), + FW3_LIST("src_port", port, rule, port_src), - FW3_LIST("icmp_type", icmptype, rule, icmp_type), - FW3_OPT("extra", string, rule, extra), + FW3_LIST("dest_ip", address, rule, ip_dest), + FW3_LIST("dest_port", port, rule, port_dest), - FW3_OPT("limit", limit, rule, limit), - FW3_OPT("limit_burst", int, rule, limit.burst), + FW3_LIST("icmp_type", icmptype, rule, icmp_type), + FW3_OPT("extra", string, rule, extra), - FW3_OPT("target", target, rule, target), + FW3_OPT("limit", limit, rule, limit), + FW3_OPT("limit_burst", int, rule, limit.burst), + + FW3_OPT("utc_time", bool, rule, time.utc), + FW3_OPT("start_date", date, rule, time.datestart), + FW3_OPT("stop_date", date, rule, time.datestop), + FW3_OPT("start_time", time, rule, time.timestart), + FW3_OPT("stop_time", time, rule, time.timestop), + FW3_OPT("weekdays", weekdays, rule, time.weekdays), + FW3_OPT("monthdays", monthdays, rule, time.monthdays), + + FW3_OPT("target", target, rule, target), + + { } }; @@ -81,7 +93,15 @@ fw3_load_rules(struct fw3_state *state, struct uci_package *p) INIT_LIST_HEAD(&rule->icmp_type); - fw3_parse_options(rule, rule_opts, ARRAY_SIZE(rule_opts), s); + rule->enabled = true; + + fw3_parse_options(rule, fw3_rule_opts, s); + + if (!rule->enabled) + { + fw3_free_rule(rule); + continue; + } if (rule->src.invert || rule->dest.invert) { @@ -90,14 +110,14 @@ fw3_load_rules(struct fw3_state *state, struct uci_package *p) continue; } else if (rule->src.set && !rule->src.any && - !(rule->_src = fw3_lookup_zone(state, rule->src.name))) + !(rule->_src = fw3_lookup_zone(state, rule->src.name, false))) { warn_elem(e, "refers to not existing zone '%s'", rule->src.name); fw3_free_rule(rule); continue; } else if (rule->dest.set && !rule->dest.any && - !(rule->_dest = fw3_lookup_zone(state, rule->dest.name))) + !(rule->_dest = fw3_lookup_zone(state, rule->dest.name, false))) { warn_elem(e, "refers to not existing zone '%s'", rule->dest.name); fw3_free_rule(rule); @@ -110,14 +130,14 @@ fw3_load_rules(struct fw3_state *state, struct uci_package *p) continue; } else if (rule->ipset.set && !rule->ipset.any && - !(rule->_ipset = fw3_lookup_ipset(state, rule->ipset.name))) + !(rule->_ipset = fw3_lookup_ipset(state, rule->ipset.name, false))) { warn_elem(e, "refers to unknown ipset '%s'", rule->ipset.name); fw3_free_rule(rule); continue; } - if (!rule->_src && rule->target == FW3_TARGET_NOTRACK) + if (!rule->_src && rule->target == FW3_FLAG_NOTRACK) { warn_elem(e, "is set to target NOTRACK but has no source assigned"); fw3_free_rule(rule); @@ -130,19 +150,23 @@ fw3_load_rules(struct fw3_state *state, struct uci_package *p) "- assuming an output rule"); } - if (rule->target == FW3_TARGET_UNSPEC) + if (rule->target == FW3_FLAG_UNSPEC) { warn_elem(e, "has no target specified, defaulting to REJECT"); - rule->target = FW3_TARGET_REJECT; + rule->target = FW3_FLAG_REJECT; } - else if (rule->target > FW3_TARGET_NOTRACK) + else if (rule->target > FW3_FLAG_NOTRACK) { warn_elem(e, "has invalid target specified, defaulting to REJECT"); - rule->target = FW3_TARGET_REJECT; + rule->target = FW3_FLAG_REJECT; } + /* NB: rule family... */ if (rule->_dest) - setbit(rule->_dest->dst_flags, rule->target); + { + setbit(rule->_dest->flags[0], rule->target); + setbit(rule->_dest->flags[1], rule->target); + } list_add_tail(&rule->list, &state->rules); continue; @@ -157,7 +181,7 @@ print_chain(struct fw3_rule *rule) sprintf(chain, "delegate_output"); - if (rule->target == FW3_TARGET_NOTRACK) + if (rule->target == FW3_FLAG_NOTRACK) { sprintf(chain, "zone_%s_notrack", rule->src.name); } @@ -194,20 +218,20 @@ static void print_target(struct fw3_rule *rule) switch(rule->target) { - case FW3_TARGET_ACCEPT: - case FW3_TARGET_DROP: - case FW3_TARGET_NOTRACK: + case FW3_FLAG_ACCEPT: + case FW3_FLAG_DROP: + case FW3_FLAG_NOTRACK: target = fw3_flag_names[rule->target]; break; default: - target = fw3_flag_names[FW3_TARGET_REJECT]; + target = fw3_flag_names[FW3_FLAG_REJECT]; break; } if (rule->dest.set && !rule->dest.any) fw3_pr(" -j zone_%s_dest_%s\n", rule->dest.name, target); - else if (rule->target == FW3_TARGET_REJECT) + else if (rule->target == FW3_FLAG_REJECT) fw3_pr(" -j reject\n"); else fw3_pr(" -j %s\n", target); @@ -240,6 +264,7 @@ print_rule(enum fw3_table table, enum fw3_family family, fw3_format_icmptype(icmptype, family); fw3_format_mac(mac); fw3_format_limit(&rule->limit); + fw3_format_time(&rule->time); fw3_format_extra(rule->extra); fw3_format_comment(rule->name); print_target(rule); @@ -267,7 +292,7 @@ expand_rule(enum fw3_table table, enum fw3_family family, if (!fw3_is_family(rule, family)) return; - if ((table == FW3_TABLE_RAW && rule->target != FW3_TARGET_NOTRACK) || + if ((table == FW3_TABLE_RAW && rule->target != FW3_FLAG_NOTRACK) || (table != FW3_TABLE_FILTER)) return; @@ -291,7 +316,7 @@ expand_rule(enum fw3_table table, enum fw3_family family, return; } - setbit(rule->_ipset->flags, family); + set(rule->_ipset->flags, family, family); } list_for_each_entry(proto, &rule->proto, list) @@ -331,20 +356,3 @@ fw3_print_rules(enum fw3_table table, enum fw3_family family, list_for_each_entry(rule, &state->rules, list) expand_rule(table, family, rule, num++); } - -void -fw3_free_rule(struct fw3_rule *rule) -{ - fw3_free_list(&rule->proto); - - fw3_free_list(&rule->ip_src); - fw3_free_list(&rule->mac_src); - fw3_free_list(&rule->port_dest); - - fw3_free_list(&rule->ip_dest); - fw3_free_list(&rule->port_dest); - - fw3_free_list(&rule->icmp_type); - - free(rule); -}