X-Git-Url: https://git.archive.openwrt.org/?p=project%2Fluci.git;a=blobdiff_plain;f=libs%2Fsys%2Fluasrc%2Fsys%2Fiptparser.lua;h=38970145151ae484c993572cab01c030769c52c8;hp=c11fb5d5646764fd7466c60be086effdc6c49057;hb=b477dae3079294c592f156e67e89579bea742800;hpb=e3c8b9a10b383138ba1a5ed7bea51fd3694f596d
diff --git a/libs/sys/luasrc/sys/iptparser.lua b/libs/sys/luasrc/sys/iptparser.lua
index c11fb5d56..389701451 100644
--- a/libs/sys/luasrc/sys/iptparser.lua
+++ b/libs/sys/luasrc/sys/iptparser.lua
@@ -19,7 +19,7 @@ luci.util = require "luci.util"
luci.sys = require "luci.sys"
luci.ip = require "luci.ip"
-local tonumber, ipairs = tonumber, ipairs
+local tonumber, ipairs, table = tonumber, ipairs, table
--- LuCI iptables parser and query library
-- @cstyle instance
@@ -28,12 +28,25 @@ module("luci.sys.iptparser")
--- Create a new iptables parser object.
-- @class function
-- @name IptParser
+-- @param family Number specifying the address family. 4 for IPv4, 6 for IPv6
-- @return IptParser instance
IptParser = luci.util.class()
-function IptParser.__init__( self, ... )
- self._rules = { }
- self._chain = nil
+function IptParser.__init__( self, family )
+ self._family = (tonumber(family) == 6) and 6 or 4
+ self._rules = { }
+ self._chains = { }
+
+ if self._family == 4 then
+ self._nulladdr = "0.0.0.0/0"
+ self._tables = { "filter", "nat", "mangle", "raw" }
+ self._command = "iptables -t %s --line-numbers -nxvL"
+ else
+ self._nulladdr = "::/0"
+ self._tables = { "filter", "mangle", "raw" }
+ self._command = "ip6tables -t %s --line-numbers -nxvL"
+ end
+
self:_parse_rules()
end
@@ -49,9 +62,9 @@ end
-- protocol - Match rules that match the given protocol, rules with
-- protocol "all" are always matched
-- source - Match rules with the given source, rules with source
--- "0.0.0.0/0" are always matched
+-- "0.0.0.0/0" (::/0) are always matched
-- destination - Match rules with the given destination, rules with
--- destination "0.0.0.0/0" are always matched
+-- destination "0.0.0.0/0" (::/0) are always matched
-- inputif - Match rules with the given input interface, rules
-- with input interface "*" (=all) are always matched
-- outputif - Match rules with the given output interface, rules
@@ -76,8 +89,8 @@ end
-- or "*" for all interfaces
-- outputif - Output interface of the rule,e.g. "eth0.0"
-- or "*" for all interfaces
--- source - The source ip range, e.g. "0.0.0.0/0"
--- destination - The destination ip range, e.g. "0.0.0.0/0"
+-- source - The source ip range, e.g. "0.0.0.0/0" (::/0)
+-- destination - The destination ip range, e.g. "0.0.0.0/0" (::/0)
-- options - A list of specific options of the rule,
-- e.g. { "reject-with", "tcp-reset" }
-- packets - The number of packets matched by the rule
@@ -102,14 +115,14 @@ function IptParser.find( self, args )
local args = args or { }
local rv = { }
- args.source = args.source and luci.ip.IPv4(args.source)
- args.destination = args.destination and luci.ip.IPv4(args.destination)
+ args.source = args.source and self:_parse_addr(args.source)
+ args.destination = args.destination and self:_parse_addr(args.destination)
for i, rule in ipairs(self._rules) do
local match = true
-- match table
- if not ( not args.table or args.table == rule.table ) then
+ if not ( not args.table or args.table:lower() == rule.table ) then
match = false
end
@@ -122,7 +135,7 @@ function IptParser.find( self, args )
-- match target
if not ( match == true and (
- not args.target or args.target:upper() == rule.target
+ not args.target or args.target == rule.target
) ) then
match = false
end
@@ -137,16 +150,16 @@ function IptParser.find( self, args )
-- match source
if not ( match == true and (
- not args.source or rule.source == "0.0.0.0/0" or
- luci.ip.IPv4(rule.source):contains(args.source)
+ not args.source or rule.source == self._nulladdr or
+ self:_parse_addr(rule.source):contains(args.source)
) ) then
match = false
end
-- match destination
if not ( match == true and (
- not args.destination or rule.destination == "0.0.0.0/0" or
- luci.ip.IPv4(rule.destination):contains(args.destination)
+ not args.destination or rule.destination == self._nulladdr or
+ self:_parse_addr(rule.destination):contains(args.destination)
) ) then
match = false
end
@@ -202,16 +215,85 @@ function IptParser.resync( self )
end
+--- Find the names of all chains within the given table name.
+-- @param table String containing the table name
+-- @return Table of chain names in the order they occur.
+function IptParser.chains( self, table )
+ local lookup = { }
+ local chains = { }
+ for _, r in ipairs(self:find({table=table})) do
+ if not lookup[r.chain] then
+ lookup[r.chain] = true
+ chains[#chains+1] = r.chain
+ end
+ end
+ return chains
+end
+
+
+--- Return the given firewall chain within the given table name.
+-- @param table String containing the table name
+-- @param chain String containing the chain name
+-- @return Table containing the fields "policy", "packets", "bytes"
+-- and "rules". The "rules" field is a table of rule tables.
+function IptParser.chain( self, table, chain )
+ return self._chains[table:lower()] and self._chains[table:lower()][chain]
+end
+
+
+--- Test whether the given target points to a custom chain.
+-- @param target String containing the target action
+-- @return Boolean indicating whether target is a custom chain.
+function IptParser.is_custom_target( self, target )
+ for _, r in ipairs(self._rules) do
+ if r.chain == target then
+ return true
+ end
+ end
+ return false
+end
+
+
+-- [internal] Parse address according to family.
+function IptParser._parse_addr( self, addr )
+ if self._family == 4 then
+ return luci.ip.IPv4(addr)
+ else
+ return luci.ip.IPv6(addr)
+ end
+end
+
-- [internal] Parse iptables output from all tables.
function IptParser._parse_rules( self )
- for i, tbl in ipairs({ "filter", "nat", "mangle" }) do
+ for i, tbl in ipairs(self._tables) do
+
+ self._chains[tbl] = { }
- for i, rule in ipairs(luci.util.execl("iptables -t " .. tbl .. " --line-numbers -nxvL")) do
+ for i, rule in ipairs(luci.util.execl(self._command % tbl)) do
- if rule:find( "Chain " ) == 1 then
+ if rule:find( "^Chain " ) == 1 then
- self._chain = rule:gsub("Chain ([^%s]*) .*", "%1")
+ local crefs
+ local cname, cpol, cpkt, cbytes = rule:match(
+ "^Chain ([^%s]*) %(policy (%w+) " ..
+ "(%d+) packets, (%d+) bytes%)"
+ )
+
+ if not cname then
+ cname, crefs = rule:match(
+ "^Chain ([^%s]*) %((%d+) references%)"
+ )
+ end
+
+ self._chain = cname
+ self._chains[tbl][cname] = {
+ policy = cpol,
+ packets = tonumber(cpkt or 0),
+ bytes = tonumber(cbytes or 0),
+ references = tonumber(crefs or 0),
+ rules = { }
+ }
else
if rule:find("%d") == 1 then
@@ -219,6 +301,11 @@ function IptParser._parse_rules( self )
local rule_parts = luci.util.split( rule, "%s+", nil, true )
local rule_details = { }
+ -- cope with rules that have no target assigned
+ if rule:match("^%d+%s+%d+%s+%d+%s%s") then
+ table.insert(rule_parts, 4, nil)
+ end
+
rule_details["table"] = tbl
rule_details["chain"] = self._chain
rule_details["index"] = tonumber(rule_parts[1])
@@ -238,6 +325,10 @@ function IptParser._parse_rules( self )
end
self._rules[#self._rules+1] = rule_details
+
+ self._chains[tbl][self._chain].rules[
+ #self._chains[tbl][self._chain].rules + 1
+ ] = rule_details
end
end
end