X-Git-Url: http://git.archive.openwrt.org/?p=project%2Ffirewall3.git;a=blobdiff_plain;f=zones.c;h=ab656ef75381e82d8dec10b04a9593250547099b;hp=c81125f0eb71f8dd66636f64f689bd125ce21953;hb=24e1ba98e43d44ad7ba5780afd0b98e19ee14570;hpb=b2b2e69b19a20a46f3db6d717a899248fa24628c

diff --git a/zones.c b/zones.c
index c81125f..ab656ef 100644
--- a/zones.c
+++ b/zones.c
@@ -31,29 +31,49 @@ struct chain {
 };
 
 static const struct chain src_chains[] = {
-	C(ANY, FILTER, UNSPEC,  "zone_%s_input"),
-	C(ANY, FILTER, UNSPEC,  "zone_%s_output"),
-	C(ANY, FILTER, UNSPEC,  "zone_%s_forward"),
+	C(ANY, FILTER, UNSPEC,  "zone_%1$s_input"),
+	C(ANY, FILTER, UNSPEC,  "zone_%1$s_output"),
+	C(ANY, FILTER, UNSPEC,  "zone_%1$s_forward"),
 
-	C(ANY, FILTER, ACCEPT,  "zone_%s_src_ACCEPT"),
-	C(ANY, FILTER, REJECT,  "zone_%s_src_REJECT"),
-	C(ANY, FILTER, DROP,    "zone_%s_src_DROP"),
+	C(ANY, FILTER, SRC_ACCEPT, "zone_%1$s_src_ACCEPT"),
+	C(ANY, FILTER, SRC_REJECT, "zone_%1$s_src_REJECT"),
+	C(ANY, FILTER, SRC_DROP,   "zone_%1$s_src_DROP"),
 };
 
 static const struct chain dst_chains[] = {
-	C(ANY, FILTER, ACCEPT,  "zone_%s_dest_ACCEPT"),
-	C(ANY, FILTER, REJECT,  "zone_%s_dest_REJECT"),
-	C(ANY, FILTER, DROP,    "zone_%s_dest_DROP"),
+	C(ANY, FILTER, ACCEPT,  "zone_%1$s_dest_ACCEPT"),
+	C(ANY, FILTER, REJECT,  "zone_%1$s_dest_REJECT"),
+	C(ANY, FILTER, DROP,    "zone_%1$s_dest_DROP"),
+
+	C(V4,  NAT,    SNAT,    "zone_%1$s_postrouting"),
+	C(V4,  NAT,    DNAT,    "zone_%1$s_prerouting"),
+
+	C(ANY, FILTER, CUSTOM_CNS_V4, "input_%1$s_rule"),
+	C(ANY, FILTER, CUSTOM_CNS_V4, "output_%1$s_rule"),
+	C(ANY, FILTER, CUSTOM_CNS_V4, "forwarding_%1$s_rule"),
+	C(ANY, FILTER, CUSTOM_CNS_V6, "input_%1$s_rule"),
+	C(ANY, FILTER, CUSTOM_CNS_V6, "output_%1$s_rule"),
+	C(ANY, FILTER, CUSTOM_CNS_V6, "forwarding_%1$s_rule"),
+
+	C(V4,  NAT,    CUSTOM_CNS_V4, "prerouting_%1$s_rule"),
+	C(V4,  NAT,    CUSTOM_CNS_V4, "postrouting_%1$s_rule"),
+};
+
 
-	C(V4,  NAT,    SNAT,    "zone_%s_postrouting"),
-	C(V4,  NAT,    DNAT,    "zone_%s_prerouting"),
+#define R(dir1, dir2) \
+	"zone_%1$s_" #dir1 " -m comment --comment \"user chain for %1$s " \
+	#dir2 "\" -j " #dir2 "_%1$s_rule"
 
-	C(ANY, FILTER, CUSTOM_CHAINS, "input_%s_rule"),
-	C(ANY, FILTER, CUSTOM_CHAINS, "output_%s_rule"),
-	C(ANY, FILTER, CUSTOM_CHAINS, "forwarding_%s_rule"),
+static const struct chain def_rules[] = {
+	C(ANY, FILTER, CUSTOM_CNS_V4, R(input, input)),
+	C(ANY, FILTER, CUSTOM_CNS_V4, R(output, output)),
+	C(ANY, FILTER, CUSTOM_CNS_V4, R(forward, forwarding)),
+	C(ANY, FILTER, CUSTOM_CNS_V6, R(input, input)),
+	C(ANY, FILTER, CUSTOM_CNS_V6, R(output, output)),
+	C(ANY, FILTER, CUSTOM_CNS_V6, R(forward, forwarding)),
 
-	C(V4,  NAT,    CUSTOM_CHAINS, "prerouting_%s_rule"),
-	C(V4,  NAT,    CUSTOM_CHAINS, "postrouting_%s_rule"),
+	C(V4,  NAT,    CUSTOM_CNS_V4, R(prerouting, prerouting)),
+	C(V4,  NAT,    CUSTOM_CNS_V4, R(postrouting, postrouting)),
 };
 
 const struct fw3_option fw3_zone_opts[] = {
@@ -91,11 +111,11 @@ const struct fw3_option fw3_zone_opts[] = {
 
 static bool
 print_chains(enum fw3_table table, enum fw3_family family,
-             const char *fmt, const char *name, uint16_t targets,
+             const char *fmt, const char *name, uint32_t targets,
              const struct chain *chains, int n)
 {
 	bool rv = false;
-	char cn[128] = { 0 };
+	char cn[256] = { 0 };
 	const struct chain *c;
 
 	for (c = chains; n > 0; c++, n--)
@@ -235,19 +255,19 @@ fw3_load_zones(struct fw3_state *state, struct uci_package *p)
 
 		if (zone->masq)
 		{
-			setbit(zone->dst_flags, FW3_TARGET_SNAT);
+			setbit(zone->flags, FW3_TARGET_SNAT);
 			zone->conntrack = true;
 		}
 
 		if (zone->custom_chains)
 		{
-			setbit(zone->dst_flags, FW3_TARGET_SNAT);
-			setbit(zone->dst_flags, FW3_TARGET_DNAT);
+			setbit(zone->flags, FW3_TARGET_SNAT);
+			setbit(zone->flags, FW3_TARGET_DNAT);
 		}
 
-		setbit(zone->src_flags, zone->policy_input);
-		setbit(zone->dst_flags, zone->policy_output);
-		setbit(zone->dst_flags, zone->policy_forward);
+		setbit(zone->flags, fw3_to_src_target(zone->policy_input));
+		setbit(zone->flags, zone->policy_output);
+		setbit(zone->flags, zone->policy_forward);
 
 		list_add_tail(&zone->list, &state->zones);
 	}
@@ -258,61 +278,40 @@ static void
 print_zone_chain(enum fw3_table table, enum fw3_family family,
                  struct fw3_zone *zone, struct fw3_state *state)
 {
-	bool s, d;
-	uint16_t mask = ~0;
+	bool s, d, r;
+	enum fw3_target f;
+	uint32_t custom_mask = ~0;
 
 	if (!fw3_is_family(zone, family))
 		return;
 
-	setbit(zone->dst_flags, family);
+	setbit(zone->flags, family);
 
 	/* user chains already loaded, don't create again */
-	if (hasbit(zone->dst_flags, FW3_TARGET_CUSTOM_CHAINS))
-		delbit(mask, FW3_TARGET_CUSTOM_CHAINS);
+	for (f = FW3_TARGET_CUSTOM_CNS_V4; f <= FW3_TARGET_CUSTOM_CNS_V6; f++)
+		if (hasbit(zone->running_flags, f))
+			delbit(custom_mask, f);
 
 	if (zone->custom_chains)
-		setbit(zone->dst_flags, FW3_TARGET_CUSTOM_CHAINS);
+		setbit(zone->flags, (family == FW3_FAMILY_V4) ?
+		       FW3_TARGET_CUSTOM_CNS_V4 : FW3_TARGET_CUSTOM_CNS_V6);
 
 	if (!zone->conntrack && !state->defaults.drop_invalid)
-		setbit(zone->dst_flags, FW3_TARGET_NOTRACK);
+		setbit(zone->flags, FW3_TARGET_NOTRACK);
 
 	s = print_chains(table, family, ":%s - [0:0]\n", zone->name,
-	                 zone->src_flags & mask,
+	                 zone->flags,
 	                 src_chains, ARRAY_SIZE(src_chains));
 
 	d = print_chains(table, family, ":%s - [0:0]\n", zone->name,
-	                 zone->dst_flags & mask,
+	                 zone->flags & custom_mask,
 	                 dst_chains, ARRAY_SIZE(dst_chains));
 
-	if (zone->custom_chains)
-	{
-		if (table == FW3_TABLE_FILTER)
-		{
-			fw3_pr("-A zone_%s_input -j input_%s_rule "
-				   "-m comment --comment \"user chain for %s input\"\n",
-			       zone->name, zone->name, zone->name);
-
-			fw3_pr("-A zone_%s_output -j output_%s_rule "
-				   "-m comment --comment \"user chain for %s output\"\n",
-			       zone->name, zone->name, zone->name);
-
-			fw3_pr("-A zone_%s_forward -j forwarding_%s_rule "
-				   "-m comment --comment \"user chain for %s forwarding\"\n",
-			       zone->name, zone->name, zone->name);
-		}
-		else if (table == FW3_TABLE_NAT)
-		{
-			fw3_pr("-A zone_%s_prerouting -j prerouting_%s_rule "
-			       "-m comment --comment \"user chain for %s prerouting\"\n",
-			       zone->name, zone->name, zone->name);
+	r = print_chains(table, family, "-A %s\n", zone->name,
+	                 zone->flags,
+	                 def_rules, ARRAY_SIZE(def_rules));
 
-			fw3_pr("-A zone_%s_postrouting -j postrouting_%s_rule "
-			       "-m comment --comment \"user chain for %s postrouting\"\n",
-			       zone->name, zone->name, zone->name);
-		}
-	}
-
-	if (s || d)
+	if (s || d || r)
 	{
 		info("   * Zone '%s'", zone->name);
 		fw3_set_running(zone, &state->running_zones);
@@ -333,7 +332,7 @@ print_interface_rule(enum fw3_table table, enum fw3_family family,
 	{
 		for (t = FW3_TARGET_ACCEPT; t <= FW3_TARGET_DROP; t++)
 		{
-			if (hasbit(zone->src_flags, t))
+			if (hasbit(zone->flags, fw3_to_src_target(t)))
 			{
 				fw3_pr("-A zone_%s_src_%s", zone->name, fw3_flag_names[t]);
 				fw3_format_in_out(dev, NULL);
@@ -342,7 +341,7 @@ print_interface_rule(enum fw3_table table, enum fw3_family family,
 				fw3_pr(" -j %s\n", jump_target(t));
 			}
 
-			if (hasbit(zone->dst_flags, t))
+			if (hasbit(zone->flags, t))
 			{
 				fw3_pr("-A zone_%s_dest_%s", zone->name, fw3_flag_names[t]);
 				fw3_format_in_out(NULL, dev);
@@ -372,7 +371,7 @@ print_interface_rule(enum fw3_table table, enum fw3_family family,
 	}
 	else if (table == FW3_TABLE_NAT)
 	{
-		if (hasbit(zone->dst_flags, FW3_TARGET_DNAT))
+		if (hasbit(zone->flags, FW3_TARGET_DNAT))
 		{
 			fw3_pr("-A delegate_prerouting");
 			fw3_format_in_out(dev, NULL);
@@ -381,7 +380,7 @@ print_interface_rule(enum fw3_table table, enum fw3_family family,
 			fw3_pr(" -j zone_%s_prerouting\n", zone->name);
 		}
 
-		if (hasbit(zone->dst_flags, FW3_TARGET_SNAT))
+		if (hasbit(zone->flags, FW3_TARGET_SNAT))
 		{
 			fw3_pr("-A delegate_postrouting");
 			fw3_format_in_out(NULL, dev);
@@ -475,7 +474,7 @@ print_zone_rule(enum fw3_table table, enum fw3_family family,
 		{
 			for (t = FW3_TARGET_REJECT; t <= FW3_TARGET_DROP; t++)
 			{
-				if (hasbit(zone->src_flags, t))
+				if (hasbit(zone->flags, fw3_to_src_target(t)))
 				{
 					fw3_pr("-A zone_%s_src_%s", zone->name, fw3_flag_names[t]);
 					fw3_format_limit(&zone->log_limit);
@@ -483,7 +482,7 @@ print_zone_rule(enum fw3_table table, enum fw3_family family,
 						   fw3_flag_names[t], zone->name);
 				}
 
-				if (hasbit(zone->dst_flags, t))
+				if (hasbit(zone->flags, t))
 				{
 					fw3_pr("-A zone_%s_dest_%s", zone->name, fw3_flag_names[t]);
 					fw3_format_limit(&zone->log_limit);
@@ -540,31 +539,33 @@ fw3_flush_zones(enum fw3_table table, enum fw3_family family,
 			    bool pass2, bool reload, struct fw3_state *state)
 {
 	struct fw3_zone *z, *tmp;
-	uint16_t mask = ~0;
-	uint16_t families = (1 << FW3_FAMILY_V4) | (1 << FW3_FAMILY_V6);
+	uint32_t custom_mask = ~0;
 
 	/* don't touch user chains on selective stop */
 	if (reload)
-		delbit(mask, FW3_DEFAULT_CUSTOM_CHAINS);
+	{
+		delbit(custom_mask, FW3_TARGET_CUSTOM_CNS_V4);
+		delbit(custom_mask, FW3_TARGET_CUSTOM_CNS_V6);
+	}
 
 	list_for_each_entry_safe(z, tmp, &state->running_zones, running_list)
 	{
-		if (!hasbit(z->dst_flags, family))
+		if (!hasbit(z->flags, family))
 			continue;
 
 		print_chains(table, family, pass2 ? "-X %s\n" : "-F %s\n",
-		             z->name, z->src_flags & mask,
+		             z->name, z->running_flags,
 		             src_chains, ARRAY_SIZE(src_chains));
 
 		print_chains(table, family, pass2 ? "-X %s\n" : "-F %s\n",
-		             z->name, z->dst_flags & mask,
+		             z->name, z->running_flags & custom_mask,
 		             dst_chains, ARRAY_SIZE(dst_chains));
 
 		if (pass2)
 		{
-			delbit(z->dst_flags, family);
+			delbit(z->flags, family);
 
-			if (!(z->dst_flags & families))
+			if (fw3_no_family(z))
 				fw3_set_running(z, NULL);
 		}
 	}