X-Git-Url: http://git.archive.openwrt.org/?p=project%2Ffirewall3.git;a=blobdiff_plain;f=zones.c;h=846e43015d7b41e8980f2139dd1589236fb32d61;hp=9595c37a2f44fe3f630d821719515a7b12761c0f;hb=ff9d5e13c9150c62fe698e4bc5541e6f92b241d0;hpb=3968e2a659324a24bb1bd8d461c8bb83c5db7f72

diff --git a/zones.c b/zones.c
index 9595c37..846e430 100644
--- a/zones.c
+++ b/zones.c
@@ -20,38 +20,54 @@
 #include "ubus.h"
 
 
-#define C(f, tbl, tgt, name) \
-	{ FW3_FAMILY_##f, FW3_TABLE_##tbl, FW3_TARGET_##tgt, name }
-
-struct chain {
-	enum fw3_family family;
-	enum fw3_table table;
-	enum fw3_target target;
-	const char *name;
-};
+#define C(f, tbl, tgt, fmt) \
+	{ FW3_FAMILY_##f, FW3_TABLE_##tbl, FW3_FLAG_##tgt, fmt }
+
+static const struct fw3_rule_spec zone_chains[] = {
+	C(ANY, FILTER, UNSPEC,        "zone_%1$s_input"),
+	C(ANY, FILTER, UNSPEC,        "zone_%1$s_output"),
+	C(ANY, FILTER, UNSPEC,        "zone_%1$s_forward"),
+
+	C(ANY, FILTER, SRC_ACCEPT,    "zone_%1$s_src_ACCEPT"),
+	C(ANY, FILTER, SRC_REJECT,    "zone_%1$s_src_REJECT"),
+	C(ANY, FILTER, SRC_DROP,      "zone_%1$s_src_DROP"),
+
+	C(ANY, FILTER, ACCEPT,        "zone_%1$s_dest_ACCEPT"),
+	C(ANY, FILTER, REJECT,        "zone_%1$s_dest_REJECT"),
+	C(ANY, FILTER, DROP,          "zone_%1$s_dest_DROP"),
+
+	C(V4,  NAT,    SNAT,          "zone_%1$s_postrouting"),
+	C(V4,  NAT,    DNAT,          "zone_%1$s_prerouting"),
+
+	C(ANY, FILTER, CUSTOM_CHAINS, "input_%1$s_rule"),
+	C(ANY, FILTER, CUSTOM_CHAINS, "output_%1$s_rule"),
+	C(ANY, FILTER, CUSTOM_CHAINS, "forwarding_%1$s_rule"),
 
-static const struct chain src_chains[] = {
-	C(ANY, FILTER, UNSPEC,  "zone_%s_input"),
-	C(ANY, FILTER, UNSPEC,  "zone_%s_output"),
-	C(ANY, FILTER, UNSPEC,  "zone_%s_forward"),
+	C(V4,  NAT,    CUSTOM_CHAINS, "prerouting_%1$s_rule"),
+	C(V4,  NAT,    CUSTOM_CHAINS, "postrouting_%1$s_rule"),
 
-	C(ANY, FILTER, ACCEPT,  "zone_%s_src_ACCEPT"),
-	C(ANY, FILTER, REJECT,  "zone_%s_src_REJECT"),
-	C(ANY, FILTER, DROP,    "zone_%s_src_DROP"),
+	{ }
 };
 
-static const struct chain dst_chains[] = {
-	C(ANY, FILTER, ACCEPT,  "zone_%s_dest_ACCEPT"),
-	C(ANY, FILTER, REJECT,  "zone_%s_dest_REJECT"),
-	C(ANY, FILTER, DROP,    "zone_%s_dest_DROP"),
 
-	C(V4,  NAT,    SNAT,    "zone_%s_postrouting"),
-	C(V4,  NAT,    DNAT,    "zone_%s_prerouting"),
+#define R(dir1, dir2) \
+	"zone_%1$s_" #dir1 " -m comment --comment \"user chain for %1$s " \
+	#dir2 "\" -j " #dir2 "_%1$s_rule"
 
-	C(ANY, RAW,    NOTRACK, "zone_%s_notrack"),
+static const struct fw3_rule_spec zone_rules[] = {
+	C(ANY, FILTER, CUSTOM_CHAINS, R(input, input)),
+	C(ANY, FILTER, CUSTOM_CHAINS, R(output, output)),
+	C(ANY, FILTER, CUSTOM_CHAINS, R(forward, forwarding)),
+
+	C(V4,  NAT,    CUSTOM_CHAINS, R(prerouting, prerouting)),
+	C(V4,  NAT,    CUSTOM_CHAINS, R(postrouting, postrouting)),
+
+	{ }
 };
 
-static struct fw3_option zone_opts[] = {
+const struct fw3_option fw3_zone_opts[] = {
+	FW3_OPT("enabled",             bool,     zone,     enabled),
+
 	FW3_OPT("name",                string,   zone,     name),
 	FW3_OPT("family",              family,   zone,     family),
 
@@ -77,48 +93,21 @@ static struct fw3_option zone_opts[] = {
 
 	FW3_OPT("log",                 bool,     zone,     log),
 	FW3_OPT("log_limit",           limit,    zone,     log_limit),
-};
-
 
-static bool
-print_chains(enum fw3_table table, enum fw3_family family,
-             const char *fmt, const char *name, uint16_t targets,
-             const struct chain *chains, int n)
-{
-	bool rv = false;
-	char cn[128] = { 0 };
-	const struct chain *c;
-
-	for (c = chains; n > 0; c++, n--)
-	{
-		if (!fw3_is_family(c, family))
-			continue;
-
-		if (c->table != table)
-			continue;
-
-		if ((c->target != FW3_TARGET_UNSPEC) && !hasbit(targets, c->target))
-			continue;
-
-		snprintf(cn, sizeof(cn), c->name, name);
-		fw3_pr(fmt, cn);
-
-		rv = true;
-	}
+	{ }
+};
 
-	return rv;
-}
 
 static void
-check_policy(struct uci_element *e, enum fw3_target *pol, enum fw3_target def,
+check_policy(struct uci_element *e, enum fw3_flag *pol, enum fw3_flag def,
              const char *name)
 {
-	if (*pol == FW3_TARGET_UNSPEC)
+	if (*pol == FW3_FLAG_UNSPEC)
 	{
 		warn_elem(e, "has no %s policy specified, using default", name);
 		*pol = def;
 	}
-	else if (*pol > FW3_TARGET_DROP)
+	else if (*pol > FW3_FLAG_DROP)
 	{
 		warn_elem(e, "has invalid %s policy, using default", name);
 		*pol = def;
@@ -140,10 +129,39 @@ resolve_networks(struct uci_element *e, struct fw3_zone *zone)
 			continue;
 		}
 
+		tmp->network = net;
 		list_add_tail(&tmp->list, &zone->devices);
 	}
 }
 
+struct fw3_zone *
+fw3_alloc_zone(void)
+{
+	struct fw3_zone *zone;
+
+	zone = malloc(sizeof(*zone));
+
+	if (!zone)
+		return NULL;
+
+	memset(zone, 0, sizeof(*zone));
+
+	INIT_LIST_HEAD(&zone->networks);
+	INIT_LIST_HEAD(&zone->devices);
+	INIT_LIST_HEAD(&zone->subnets);
+	INIT_LIST_HEAD(&zone->masq_src);
+	INIT_LIST_HEAD(&zone->masq_dest);
+
+	INIT_LIST_HEAD(&zone->running_networks);
+	INIT_LIST_HEAD(&zone->running_devices);
+
+	zone->enabled = true;
+	zone->custom_chains = true;
+	zone->log_limit.rate = 10;
+
+	return zone;
+}
+
 void
 fw3_load_zones(struct fw3_state *state, struct uci_package *p)
 {
@@ -161,26 +179,25 @@ fw3_load_zones(struct fw3_state *state, struct uci_package *p)
 		if (strcmp(s->type, "zone"))
 			continue;
 
-		zone = malloc(sizeof(*zone));
+		zone = fw3_alloc_zone();
 
 		if (!zone)
 			continue;
 
-		memset(zone, 0, sizeof(*zone));
-
-		INIT_LIST_HEAD(&zone->networks);
-		INIT_LIST_HEAD(&zone->devices);
-		INIT_LIST_HEAD(&zone->subnets);
-		INIT_LIST_HEAD(&zone->masq_src);
-		INIT_LIST_HEAD(&zone->masq_dest);
-
-		zone->log_limit.rate = 10;
+		fw3_parse_options(zone, fw3_zone_opts, s);
 
-		fw3_parse_options(zone, zone_opts, ARRAY_SIZE(zone_opts), s);
+		if (!zone->enabled)
+		{
+			fw3_free_zone(zone);
+			continue;
+		}
 
 		if (!zone->extra_dest)
 			zone->extra_dest = zone->extra_src;
 
+		if (!defs->custom_chains && zone->custom_chains)
+			zone->custom_chains = false;
+
 		if (!zone->name || !*zone->name)
 		{
 			warn_elem(e, "has no name - ignoring");
@@ -202,13 +219,23 @@ fw3_load_zones(struct fw3_state *state, struct uci_package *p)
 
 		if (zone->masq)
 		{
-			setbit(zone->dst_flags, FW3_TARGET_SNAT);
+			setbit(zone->flags[0], FW3_FLAG_SNAT);
 			zone->conntrack = true;
 		}
 
-		setbit(zone->src_flags, zone->policy_input);
-		setbit(zone->dst_flags, zone->policy_output);
-		setbit(zone->dst_flags, zone->policy_forward);
+		if (zone->custom_chains)
+		{
+			setbit(zone->flags[0], FW3_FLAG_SNAT);
+			setbit(zone->flags[0], FW3_FLAG_DNAT);
+		}
+
+		setbit(zone->flags[0], fw3_to_src_target(zone->policy_input));
+		setbit(zone->flags[0], zone->policy_output);
+		setbit(zone->flags[0], zone->policy_forward);
+
+		setbit(zone->flags[1], fw3_to_src_target(zone->policy_input));
+		setbit(zone->flags[1], zone->policy_output);
+		setbit(zone->flags[1], zone->policy_forward);
 
 		list_add_tail(&zone->list, &state->zones);
 	}
@@ -217,43 +244,56 @@ fw3_load_zones(struct fw3_state *state, struct uci_package *p)
 
 static void
 print_zone_chain(enum fw3_table table, enum fw3_family family,
-                 struct fw3_zone *zone, bool disable_notrack)
+                 struct fw3_zone *zone, bool reload, struct fw3_state *state)
 {
-	bool s, d;
+	bool c, r;
+	uint32_t custom_mask = ~0;
 
 	if (!fw3_is_family(zone, family))
 		return;
 
-	setbit(zone->dst_flags, family);
+	set(zone->flags, family, table);
+
+	/* Don't touch user chains on reload */
+	if (reload)
+		delbit(custom_mask, FW3_FLAG_CUSTOM_CHAINS);
+
+	if (zone->custom_chains)
+		set(zone->flags, family, FW3_FLAG_CUSTOM_CHAINS);
 
-	if (!zone->conntrack && !disable_notrack)
-		setbit(zone->dst_flags, FW3_TARGET_NOTRACK);
+	if (!zone->conntrack && !state->defaults.drop_invalid)
+		set(zone->flags, family, FW3_FLAG_NOTRACK);
 
-	s = print_chains(table, family, ":%s - [0:0]\n", zone->name,
-	                 zone->src_flags, src_chains, ARRAY_SIZE(src_chains));
+	c = fw3_pr_rulespec(table, family, zone->flags, custom_mask, zone_chains,
+	                    ":%s - [0:0]\n", zone->name);
 
-	d = print_chains(table, family, ":%s - [0:0]\n", zone->name,
-	                 zone->dst_flags, dst_chains, ARRAY_SIZE(dst_chains));
+	r = fw3_pr_rulespec(table, family, zone->flags, 0, zone_rules,
+	                    "-A %s\n", zone->name);
 
-	if (s || d)
+	if (c || r)
+	{
 		info("   * Zone '%s'", zone->name);
+		fw3_set_running(zone, &state->running_zones);
+
+		set(zone->flags, family, table);
+	}
 }
 
 static void
 print_interface_rule(enum fw3_table table, enum fw3_family family,
                      struct fw3_zone *zone, struct fw3_device *dev,
-                     struct fw3_address *sub, bool disable_notrack)
+                     struct fw3_address *sub, bool reload, bool disable_notrack)
 {
-	enum fw3_target t;
+	enum fw3_flag t;
 
 #define jump_target(t) \
-	((t == FW3_TARGET_REJECT) ? "reject" : fw3_flag_names[t])
+	((t == FW3_FLAG_REJECT) ? "reject" : fw3_flag_names[t])
 
 	if (table == FW3_TABLE_FILTER)
 	{
-		for (t = FW3_TARGET_ACCEPT; t <= FW3_TARGET_DROP; t++)
+		for (t = FW3_FLAG_ACCEPT; t <= FW3_FLAG_DROP; t++)
 		{
-			if (hasbit(zone->src_flags, t))
+			if (has(zone->flags, family, fw3_to_src_target(t)))
 			{
 				fw3_pr("-A zone_%s_src_%s", zone->name, fw3_flag_names[t]);
 				fw3_format_in_out(dev, NULL);
@@ -262,7 +302,7 @@ print_interface_rule(enum fw3_table table, enum fw3_family family,
 				fw3_pr(" -j %s\n", jump_target(t));
 			}
 
-			if (hasbit(zone->dst_flags, t))
+			if (has(zone->flags, family, t))
 			{
 				fw3_pr("-A zone_%s_dest_%s", zone->name, fw3_flag_names[t]);
 				fw3_format_in_out(NULL, dev);
@@ -292,7 +332,7 @@ print_interface_rule(enum fw3_table table, enum fw3_family family,
 	}
 	else if (table == FW3_TABLE_NAT)
 	{
-		if (hasbit(zone->dst_flags, FW3_TARGET_DNAT))
+		if (has(zone->flags, family, FW3_FLAG_DNAT))
 		{
 			fw3_pr("-A delegate_prerouting");
 			fw3_format_in_out(dev, NULL);
@@ -301,7 +341,7 @@ print_interface_rule(enum fw3_table table, enum fw3_family family,
 			fw3_pr(" -j zone_%s_prerouting\n", zone->name);
 		}
 
-		if (hasbit(zone->dst_flags, FW3_TARGET_SNAT))
+		if (has(zone->flags, family, FW3_FLAG_SNAT))
 		{
 			fw3_pr("-A delegate_postrouting");
 			fw3_format_in_out(NULL, dev);
@@ -349,7 +389,7 @@ print_interface_rule(enum fw3_table table, enum fw3_family family,
 
 static void
 print_interface_rules(enum fw3_table table, enum fw3_family family,
-                      struct fw3_zone *zone, bool disable_notrack)
+                      struct fw3_zone *zone, bool reload, bool disable_notrack)
 {
 	struct fw3_device *dev;
 	struct fw3_address *sub;
@@ -363,18 +403,18 @@ print_interface_rules(enum fw3_table table, enum fw3_family family,
 		if (!dev && !sub)
 			continue;
 
-		print_interface_rule(table, family, zone, dev, sub, disable_notrack);
+		print_interface_rule(table, family, zone, dev, sub, reload, disable_notrack);
 	}
 }
 
 static void
 print_zone_rule(enum fw3_table table, enum fw3_family family,
-                struct fw3_zone *zone, bool disable_notrack)
+                struct fw3_zone *zone, bool reload, bool disable_notrack)
 {
 	struct fw3_address *msrc;
 	struct fw3_address *mdest;
 
-	enum fw3_target t;
+	enum fw3_flag t;
 
 	if (!fw3_is_family(zone, family))
 		return;
@@ -393,9 +433,9 @@ print_zone_rule(enum fw3_table table, enum fw3_family family,
 
 		if (zone->log)
 		{
-			for (t = FW3_TARGET_REJECT; t <= FW3_TARGET_DROP; t++)
+			for (t = FW3_FLAG_REJECT; t <= FW3_FLAG_DROP; t++)
 			{
-				if (hasbit(zone->src_flags, t))
+				if (has(zone->flags, family, fw3_to_src_target(t)))
 				{
 					fw3_pr("-A zone_%s_src_%s", zone->name, fw3_flag_names[t]);
 					fw3_format_limit(&zone->log_limit);
@@ -403,7 +443,7 @@ print_zone_rule(enum fw3_table table, enum fw3_family family,
 						   fw3_flag_names[t], zone->name);
 				}
 
-				if (hasbit(zone->dst_flags, t))
+				if (has(zone->flags, family, t))
 				{
 					fw3_pr("-A zone_%s_dest_%s", zone->name, fw3_flag_names[t]);
 					fw3_format_limit(&zone->log_limit);
@@ -432,53 +472,91 @@ print_zone_rule(enum fw3_table table, enum fw3_family family,
 		break;
 	}
 
-	print_interface_rules(table, family, zone, disable_notrack);
+	print_interface_rules(table, family, zone, reload, disable_notrack);
 }
 
 void
 fw3_print_zone_chains(enum fw3_table table, enum fw3_family family,
-                      struct fw3_state *state)
+                      bool reload, struct fw3_state *state)
 {
 	struct fw3_zone *zone;
 
 	list_for_each_entry(zone, &state->zones, list)
-		print_zone_chain(table, family, zone, state->defaults.drop_invalid);
+		print_zone_chain(table, family, zone, reload, state);
 }
 
 void
 fw3_print_zone_rules(enum fw3_table table, enum fw3_family family,
-                     struct fw3_state *state)
+                     bool reload, struct fw3_state *state)
 {
 	struct fw3_zone *zone;
 
 	list_for_each_entry(zone, &state->zones, list)
-		print_zone_rule(table, family, zone, state->defaults.drop_invalid);
+		print_zone_rule(table, family, zone, reload, state->defaults.drop_invalid);
 }
 
 void
 fw3_flush_zones(enum fw3_table table, enum fw3_family family,
-			    bool pass2, struct list_head *statefile)
+			    bool pass2, bool reload, struct fw3_state *state)
 {
-	struct fw3_statefile_entry *e;
+	struct fw3_zone *z, *tmp;
+	uint32_t custom_mask = ~0;
 
-	list_for_each_entry(e, statefile, list)
+	/* don't touch user chains on selective stop */
+	if (reload)
+		delbit(custom_mask, FW3_FLAG_CUSTOM_CHAINS);
+
+	list_for_each_entry_safe(z, tmp, &state->running_zones, running_list)
 	{
-		if (e->type != FW3_TYPE_ZONE)
+		if (!has(z->flags, family, table))
 			continue;
 
-		if (!hasbit(e->flags[1], family))
-			continue;
+		fw3_pr_rulespec(table, family, z->flags, custom_mask, zone_chains,
+		                pass2 ? "-X %s\n" : "-F %s\n", z->name);
 
-		print_chains(table, family, pass2 ? "-X %s\n" : "-F %s\n",
-		             e->name, e->flags[0], src_chains, ARRAY_SIZE(src_chains));
+		if (pass2)
+		{
+			del(z->flags, family, table);
+		}
+	}
+}
 
-		print_chains(table, family, pass2 ? "-X %s\n" : "-F %s\n",
-		             e->name, e->flags[1], dst_chains, ARRAY_SIZE(dst_chains));
+void
+fw3_hotplug_zones(bool add, struct fw3_state *state)
+{
+	struct fw3_zone *z;
+	struct fw3_device *d;
+
+	if (add)
+	{
+		list_for_each_entry(z, &state->running_zones, running_list)
+		{
+			if (!hasbit(z->flags[0], FW3_FLAG_HOTPLUG))
+			{
+				list_for_each_entry(d, &z->devices, list)
+					fw3_hotplug(add, z, d);
+
+				setbit(z->flags[0], FW3_FLAG_HOTPLUG);
+			}
+		}
+	}
+	else
+	{
+		list_for_each_entry(z, &state->running_zones, running_list)
+		{
+			if (hasbit(z->flags[0], FW3_FLAG_HOTPLUG))
+			{
+				list_for_each_entry(d, &z->running_devices, list)
+					fw3_hotplug(add, z, d);
+
+				delbit(z->flags[0], FW3_FLAG_HOTPLUG);
+			}
+		}
 	}
 }
 
 struct fw3_zone *
-fw3_lookup_zone(struct fw3_state *state, const char *name)
+fw3_lookup_zone(struct fw3_state *state, const char *name, bool running)
 {
 	struct fw3_zone *z;
 
@@ -486,21 +564,35 @@ fw3_lookup_zone(struct fw3_state *state, const char *name)
 		return NULL;
 
 	list_for_each_entry(z, &state->zones, list)
-		if (!strcmp(z->name, name))
+	{
+		if (strcmp(z->name, name))
+			continue;
+
+		if (!running || z->running_list.next)
 			return z;
 
+		break;
+	}
+
 	return NULL;
 }
 
 void
 fw3_free_zone(struct fw3_zone *zone)
 {
-	fw3_free_list(&zone->networks);
-	fw3_free_list(&zone->devices);
-	fw3_free_list(&zone->subnets);
+	struct fw3_device *dev, *tmp;
 
-	fw3_free_list(&zone->masq_src);
-	fw3_free_list(&zone->masq_dest);
+	list_for_each_entry_safe(dev, tmp, &zone->running_devices, list)
+	{
+		list_del(&dev->list);
+		free(dev);
+	}
+
+	list_for_each_entry_safe(dev, tmp, &zone->running_networks, list)
+	{
+		list_del(&dev->list);
+		free(dev);
+	}
 
-	free(zone);
+	fw3_free_object(zone, fw3_zone_opts);
 }