X-Git-Url: http://git.archive.openwrt.org/?p=project%2Ffirewall3.git;a=blobdiff_plain;f=zones.c;h=c47391ca6b8cd7a9a64d29898d7afa86858e3daa;hp=576ad423823ce1c1628319032967dfe48dc8b334;hb=cfd25cee8cec398d93b24ff79c2aba0ea81b1670;hpb=5df8137ebc5db2bc9c6e71b2d154a5f77679d9d8

diff --git a/zones.c b/zones.c
index 576ad42..c47391c 100644
--- a/zones.c
+++ b/zones.c
@@ -31,27 +31,54 @@ struct chain {
 };
 
 static const struct chain src_chains[] = {
-	C(ANY, FILTER, UNSPEC,  "zone_%s_input"),
-	C(ANY, FILTER, UNSPEC,  "zone_%s_output"),
-	C(ANY, FILTER, UNSPEC,  "zone_%s_forward"),
+	C(ANY, FILTER, UNSPEC,  "zone_%1$s_input"),
+	C(ANY, FILTER, UNSPEC,  "zone_%1$s_output"),
+	C(ANY, FILTER, UNSPEC,  "zone_%1$s_forward"),
 
-	C(ANY, FILTER, ACCEPT,  "zone_%s_src_ACCEPT"),
-	C(ANY, FILTER, REJECT,  "zone_%s_src_REJECT"),
-	C(ANY, FILTER, DROP,    "zone_%s_src_DROP"),
+	C(ANY, FILTER, SRC_ACCEPT, "zone_%1$s_src_ACCEPT"),
+	C(ANY, FILTER, SRC_REJECT, "zone_%1$s_src_REJECT"),
+	C(ANY, FILTER, SRC_DROP,   "zone_%1$s_src_DROP"),
 };
 
 static const struct chain dst_chains[] = {
-	C(ANY, FILTER, ACCEPT,  "zone_%s_dest_ACCEPT"),
-	C(ANY, FILTER, REJECT,  "zone_%s_dest_REJECT"),
-	C(ANY, FILTER, DROP,    "zone_%s_dest_DROP"),
+	C(ANY, FILTER, ACCEPT,  "zone_%1$s_dest_ACCEPT"),
+	C(ANY, FILTER, REJECT,  "zone_%1$s_dest_REJECT"),
+	C(ANY, FILTER, DROP,    "zone_%1$s_dest_DROP"),
+
+	C(V4,  NAT,    SNAT,    "zone_%1$s_postrouting"),
+	C(V4,  NAT,    DNAT,    "zone_%1$s_prerouting"),
+
+	C(ANY, FILTER, CUSTOM_CNS_V4, "input_%1$s_rule"),
+	C(ANY, FILTER, CUSTOM_CNS_V4, "output_%1$s_rule"),
+	C(ANY, FILTER, CUSTOM_CNS_V4, "forwarding_%1$s_rule"),
+	C(ANY, FILTER, CUSTOM_CNS_V6, "input_%1$s_rule"),
+	C(ANY, FILTER, CUSTOM_CNS_V6, "output_%1$s_rule"),
+	C(ANY, FILTER, CUSTOM_CNS_V6, "forwarding_%1$s_rule"),
+
+	C(V4,  NAT,    CUSTOM_CNS_V4, "prerouting_%1$s_rule"),
+	C(V4,  NAT,    CUSTOM_CNS_V4, "postrouting_%1$s_rule"),
+};
+
+
+#define R(dir1, dir2) \
+	"zone_%1$s_" #dir1 " -m comment --comment \"user chain for %1$s " \
+	#dir2 "\" -j " #dir2 "_%1$s_rule"
 
-	C(V4,  NAT,    SNAT,    "zone_%s_postrouting"),
-	C(V4,  NAT,    DNAT,    "zone_%s_prerouting"),
+static const struct chain def_rules[] = {
+	C(ANY, FILTER, CUSTOM_CNS_V4, R(input, input)),
+	C(ANY, FILTER, CUSTOM_CNS_V4, R(output, output)),
+	C(ANY, FILTER, CUSTOM_CNS_V4, R(forward, forwarding)),
+	C(ANY, FILTER, CUSTOM_CNS_V6, R(input, input)),
+	C(ANY, FILTER, CUSTOM_CNS_V6, R(output, output)),
+	C(ANY, FILTER, CUSTOM_CNS_V6, R(forward, forwarding)),
 
-	C(ANY, RAW,    NOTRACK, "zone_%s_notrack"),
+	C(V4,  NAT,    CUSTOM_CNS_V4, R(prerouting, prerouting)),
+	C(V4,  NAT,    CUSTOM_CNS_V4, R(postrouting, postrouting)),
 };
 
 const struct fw3_option fw3_zone_opts[] = {
+	FW3_OPT("enabled",             bool,     zone,     enabled),
+
 	FW3_OPT("name",                string,   zone,     name),
 	FW3_OPT("family",              family,   zone,     family),
 
@@ -84,11 +111,11 @@ const struct fw3_option fw3_zone_opts[] = {
 
 static bool
 print_chains(enum fw3_table table, enum fw3_family family,
-             const char *fmt, const char *name, uint16_t targets,
+             const char *fmt, const char *name, uint32_t targets,
              const struct chain *chains, int n)
 {
 	bool rv = false;
-	char cn[128] = { 0 };
+	char cn[256] = { 0 };
 	const struct chain *c;
 
 	for (c = chains; n > 0; c++, n--)
@@ -164,6 +191,8 @@ fw3_alloc_zone(void)
 	INIT_LIST_HEAD(&zone->masq_src);
 	INIT_LIST_HEAD(&zone->masq_dest);
 
+	zone->enabled = true;
+	zone->custom_chains = true;
 	zone->log_limit.rate = 10;
 
 	return zone;
@@ -193,9 +222,18 @@ fw3_load_zones(struct fw3_state *state, struct uci_package *p)
 
 		fw3_parse_options(zone, fw3_zone_opts, s);
 
+		if (!zone->enabled)
+		{
+			fw3_free_zone(zone);
+			continue;
+		}
+
 		if (!zone->extra_dest)
 			zone->extra_dest = zone->extra_src;
 
+		if (!defs->custom_chains && zone->custom_chains)
+			zone->custom_chains = false;
+
 		if (!zone->name || !*zone->name)
 		{
 			warn_elem(e, "has no name - ignoring");
@@ -217,13 +255,19 @@ fw3_load_zones(struct fw3_state *state, struct uci_package *p)
 
 		if (zone->masq)
 		{
-			setbit(zone->dst_flags, FW3_TARGET_SNAT);
+			setbit(zone->flags, FW3_TARGET_SNAT);
 			zone->conntrack = true;
 		}
 
-		setbit(zone->src_flags, zone->policy_input);
-		setbit(zone->dst_flags, zone->policy_output);
-		setbit(zone->dst_flags, zone->policy_forward);
+		if (zone->custom_chains)
+		{
+			setbit(zone->flags, FW3_TARGET_SNAT);
+			setbit(zone->flags, FW3_TARGET_DNAT);
+		}
+
+		setbit(zone->flags, fw3_to_src_target(zone->policy_input));
+		setbit(zone->flags, zone->policy_output);
+		setbit(zone->flags, zone->policy_forward);
 
 		list_add_tail(&zone->list, &state->zones);
 	}
@@ -234,23 +278,40 @@ static void
 print_zone_chain(enum fw3_table table, enum fw3_family family,
                  struct fw3_zone *zone, struct fw3_state *state)
 {
-	bool s, d;
+	bool s, d, r;
+	enum fw3_target f;
+	uint32_t custom_mask = ~0;
 
 	if (!fw3_is_family(zone, family))
 		return;
 
-	setbit(zone->dst_flags, family);
+	setbit(zone->flags, family);
+
+	/* user chains already loaded, don't create again */
+	for (f = FW3_TARGET_CUSTOM_CNS_V4; f <= FW3_TARGET_CUSTOM_CNS_V6; f++)
+		if (hasbit(zone->running_flags, f))
+			delbit(custom_mask, f);
+
+	if (zone->custom_chains)
+		setbit(zone->flags, (family == FW3_FAMILY_V4) ?
+		       FW3_TARGET_CUSTOM_CNS_V4 : FW3_TARGET_CUSTOM_CNS_V6);
 
 	if (!zone->conntrack && !state->defaults.drop_invalid)
-		setbit(zone->dst_flags, FW3_TARGET_NOTRACK);
+		setbit(zone->flags, FW3_TARGET_NOTRACK);
 
 	s = print_chains(table, family, ":%s - [0:0]\n", zone->name,
-	                 zone->src_flags, src_chains, ARRAY_SIZE(src_chains));
+	                 zone->flags,
+	                 src_chains, ARRAY_SIZE(src_chains));
 
 	d = print_chains(table, family, ":%s - [0:0]\n", zone->name,
-	                 zone->dst_flags, dst_chains, ARRAY_SIZE(dst_chains));
+	                 zone->flags & custom_mask,
+	                 dst_chains, ARRAY_SIZE(dst_chains));
 
-	if (s || d)
+	r = print_chains(table, family, "-A %s\n", zone->name,
+	                 zone->flags,
+	                 def_rules, ARRAY_SIZE(def_rules));
+
+	if (s || d || r)
 	{
 		info("   * Zone '%s'", zone->name);
 		fw3_set_running(zone, &state->running_zones);
@@ -271,7 +332,7 @@ print_interface_rule(enum fw3_table table, enum fw3_family family,
 	{
 		for (t = FW3_TARGET_ACCEPT; t <= FW3_TARGET_DROP; t++)
 		{
-			if (hasbit(zone->src_flags, t))
+			if (hasbit(zone->flags, fw3_to_src_target(t)))
 			{
 				fw3_pr("-A zone_%s_src_%s", zone->name, fw3_flag_names[t]);
 				fw3_format_in_out(dev, NULL);
@@ -280,7 +341,7 @@ print_interface_rule(enum fw3_table table, enum fw3_family family,
 				fw3_pr(" -j %s\n", jump_target(t));
 			}
 
-			if (hasbit(zone->dst_flags, t))
+			if (hasbit(zone->flags, t))
 			{
 				fw3_pr("-A zone_%s_dest_%s", zone->name, fw3_flag_names[t]);
 				fw3_format_in_out(NULL, dev);
@@ -310,7 +371,7 @@ print_interface_rule(enum fw3_table table, enum fw3_family family,
 	}
 	else if (table == FW3_TABLE_NAT)
 	{
-		if (hasbit(zone->dst_flags, FW3_TARGET_DNAT))
+		if (hasbit(zone->flags, FW3_TARGET_DNAT))
 		{
 			fw3_pr("-A delegate_prerouting");
 			fw3_format_in_out(dev, NULL);
@@ -319,7 +380,7 @@ print_interface_rule(enum fw3_table table, enum fw3_family family,
 			fw3_pr(" -j zone_%s_prerouting\n", zone->name);
 		}
 
-		if (hasbit(zone->dst_flags, FW3_TARGET_SNAT))
+		if (hasbit(zone->flags, FW3_TARGET_SNAT))
 		{
 			fw3_pr("-A delegate_postrouting");
 			fw3_format_in_out(NULL, dev);
@@ -413,7 +474,7 @@ print_zone_rule(enum fw3_table table, enum fw3_family family,
 		{
 			for (t = FW3_TARGET_REJECT; t <= FW3_TARGET_DROP; t++)
 			{
-				if (hasbit(zone->src_flags, t))
+				if (hasbit(zone->flags, fw3_to_src_target(t)))
 				{
 					fw3_pr("-A zone_%s_src_%s", zone->name, fw3_flag_names[t]);
 					fw3_format_limit(&zone->log_limit);
@@ -421,7 +482,7 @@ print_zone_rule(enum fw3_table table, enum fw3_family family,
 						   fw3_flag_names[t], zone->name);
 				}
 
-				if (hasbit(zone->dst_flags, t))
+				if (hasbit(zone->flags, t))
 				{
 					fw3_pr("-A zone_%s_dest_%s", zone->name, fw3_flag_names[t]);
 					fw3_format_limit(&zone->log_limit);
@@ -475,27 +536,37 @@ fw3_print_zone_rules(enum fw3_table table, enum fw3_family family,
 
 void
 fw3_flush_zones(enum fw3_table table, enum fw3_family family,
-			    bool pass2, struct fw3_state *state)
+			    bool pass2, bool reload, struct fw3_state *state)
 {
 	struct fw3_zone *z, *tmp;
-	int mask = (1 << FW3_FAMILY_V4) | (1 << FW3_FAMILY_V6);
+	uint32_t custom_mask = ~0;
+	uint32_t family_mask = (1 << FW3_FAMILY_V4) | (1 << FW3_FAMILY_V6);
+
+	/* don't touch user chains on selective stop */
+	if (reload)
+	{
+		delbit(custom_mask, FW3_TARGET_CUSTOM_CNS_V4);
+		delbit(custom_mask, FW3_TARGET_CUSTOM_CNS_V6);
+	}
 
 	list_for_each_entry_safe(z, tmp, &state->running_zones, running_list)
 	{
-		if (!hasbit(z->dst_flags, family))
+		if (!hasbit(z->flags, family))
 			continue;
 
 		print_chains(table, family, pass2 ? "-X %s\n" : "-F %s\n",
-		             z->name, z->src_flags, src_chains, ARRAY_SIZE(src_chains));
+		             z->name, z->running_flags,
+		             src_chains, ARRAY_SIZE(src_chains));
 
 		print_chains(table, family, pass2 ? "-X %s\n" : "-F %s\n",
-		             z->name, z->dst_flags, dst_chains, ARRAY_SIZE(dst_chains));
+		             z->name, z->running_flags & custom_mask,
+		             dst_chains, ARRAY_SIZE(dst_chains));
 
 		if (pass2)
 		{
-			delbit(z->dst_flags, family);
+			delbit(z->flags, family);
 
-			if (!(z->dst_flags & mask))
+			if (!(z->flags & family_mask))
 				fw3_set_running(z, NULL);
 		}
 	}