/*
* firewall3 - 3rd OpenWrt UCI firewall implementation
*
- * Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
+ * Copyright (C) 2013 Jo-Philipp Wich <jo@mein.io>
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
{ FW3_FAMILY_##f, FW3_TABLE_##tbl, FW3_FLAG_##def, fmt }
static const struct fw3_chain_spec default_chains[] = {
- C(ANY, FILTER, UNSPEC, "delegate_input"),
- C(ANY, FILTER, UNSPEC, "delegate_output"),
- C(ANY, FILTER, UNSPEC, "delegate_forward"),
C(ANY, FILTER, UNSPEC, "reject"),
C(ANY, FILTER, CUSTOM_CHAINS, "input_rule"),
C(ANY, FILTER, CUSTOM_CHAINS, "output_rule"),
C(ANY, FILTER, CUSTOM_CHAINS, "forwarding_rule"),
C(ANY, FILTER, SYN_FLOOD, "syn_flood"),
- C(V4, NAT, UNSPEC, "delegate_prerouting"),
- C(V4, NAT, UNSPEC, "delegate_postrouting"),
C(V4, NAT, CUSTOM_CHAINS, "prerouting_rule"),
C(V4, NAT, CUSTOM_CHAINS, "postrouting_rule"),
- C(ANY, MANGLE, UNSPEC, "mssfix"),
- C(ANY, MANGLE, UNSPEC, "fwmark"),
-
- C(ANY, RAW, UNSPEC, "notrack"),
-
{ }
};
FW3_OPT("synflood_burst", int, defaults, syn_flood_rate.burst),
FW3_OPT("tcp_syncookies", bool, defaults, tcp_syncookies),
- FW3_OPT("tcp_ecn", bool, defaults, tcp_ecn),
+ FW3_OPT("tcp_ecn", int, defaults, tcp_ecn),
FW3_OPT("tcp_window_scaling", bool, defaults, tcp_window_scaling),
FW3_OPT("accept_redirects", bool, defaults, accept_redirects),
FW3_OPT("accept_source_route", bool, defaults, accept_source_route),
+ FW3_OPT("auto_helper", bool, defaults, auto_helper),
FW3_OPT("custom_chains", bool, defaults, custom_chains),
FW3_OPT("disable_ipv6", bool, defaults, disable_ipv6),
defs->tcp_syncookies = true;
defs->tcp_window_scaling = true;
defs->custom_chains = true;
+ defs->auto_helper = true;
uci_foreach_element(&p->sections, e)
{
continue;
}
- fw3_parse_options(&state->defaults, fw3_flag_opts, s);
+ if(!fw3_parse_options(&state->defaults, fw3_flag_opts, s))
+ warn_elem(e, "has invalid options");
check_policy(e, &defs->policy_input, "input");
check_policy(e, &defs->policy_output, "output");
continue;
if (c->flag &&
- !hasbit(defs->flags[handle->family == FW3_FAMILY_V6], c->flag))
+ !fw3_hasbit(defs->flags[handle->family == FW3_FAMILY_V6], c->flag))
continue;
fw3_ipt_create_chain(handle, c->format);
set(defs->flags, handle->family, handle->table);
}
-
-struct toplevel_rule {
- enum fw3_table table;
- const char *chain;
- const char *target;
-};
-
void
fw3_print_default_head_rules(struct fw3_ipt_handle *handle,
struct fw3_state *state, bool reload)
struct fw3_device lodev = { .set = true };
struct fw3_protocol tcp = { .protocol = 6 };
struct fw3_ipt_rule *r;
- struct toplevel_rule *tr;
const char *chains[] = {
- "delegate_input", "input",
- "delegate_output", "output",
- "delegate_forward", "forwarding",
- };
-
- struct toplevel_rule rules[] = {
- { FW3_TABLE_FILTER, "INPUT", "delegate_input" },
- { FW3_TABLE_FILTER, "OUTPUT", "delegate_output" },
- { FW3_TABLE_FILTER, "FORWARD", "delegate_forward" },
-
- { FW3_TABLE_NAT, "PREROUTING", "delegate_prerouting" },
- { FW3_TABLE_NAT, "POSTROUTING", "delegate_postrouting" },
-
- { FW3_TABLE_MANGLE, "FORWARD", "mssfix" },
- { FW3_TABLE_MANGLE, "PREROUTING", "fwmark" },
-
- { FW3_TABLE_RAW, "PREROUTING", "notrack" },
-
- { 0, NULL },
+ "INPUT", "input",
+ "OUTPUT", "output",
+ "FORWARD", "forwarding",
};
- for (tr = rules; tr->chain; tr++)
- {
- if (tr->table != handle->table)
- continue;
-
- r = fw3_ipt_rule_new(handle);
- fw3_ipt_rule_target(r, tr->target);
- fw3_ipt_rule_replace(r, tr->chain);
- }
-
switch (handle->table)
{
case FW3_TABLE_FILTER:
r = fw3_ipt_rule_create(handle, NULL, &lodev, NULL, NULL, NULL);
fw3_ipt_rule_target(r, "ACCEPT");
- fw3_ipt_rule_append(r, "delegate_input");
+ fw3_ipt_rule_append(r, "INPUT");
r = fw3_ipt_rule_create(handle, NULL, NULL, &lodev, NULL, NULL);
fw3_ipt_rule_target(r, "ACCEPT");
- fw3_ipt_rule_append(r, "delegate_output");
+ fw3_ipt_rule_append(r, "OUTPUT");
if (defs->custom_chains)
{
r = fw3_ipt_rule_create(handle, &tcp, NULL, NULL, NULL, NULL);
fw3_ipt_rule_extra(r, "--syn");
fw3_ipt_rule_target(r, "syn_flood");
- fw3_ipt_rule_append(r, "delegate_input");
+ fw3_ipt_rule_append(r, "INPUT");
}
r = fw3_ipt_rule_create(handle, &tcp, NULL, NULL, NULL, NULL);
r = fw3_ipt_rule_new(handle);
fw3_ipt_rule_comment(r, "user chain for prerouting");
fw3_ipt_rule_target(r, "prerouting_rule");
- fw3_ipt_rule_append(r, "delegate_prerouting");
+ fw3_ipt_rule_append(r, "PREROUTING");
r = fw3_ipt_rule_new(handle);
fw3_ipt_rule_comment(r, "user chain for postrouting");
fw3_ipt_rule_target(r, "postrouting_rule");
- fw3_ipt_rule_append(r, "delegate_postrouting");
+ fw3_ipt_rule_append(r, "POSTROUTING");
}
break;
return;
fw3_ipt_rule_target(r, "reject");
- fw3_ipt_rule_append(r, "delegate_input");
+ fw3_ipt_rule_append(r, "INPUT");
}
if (defs->policy_output == FW3_FLAG_REJECT)
return;
fw3_ipt_rule_target(r, "reject");
- fw3_ipt_rule_append(r, "delegate_output");
+ fw3_ipt_rule_append(r, "OUTPUT");
}
if (defs->policy_forward == FW3_FLAG_REJECT)
return;
fw3_ipt_rule_target(r, "reject");
- fw3_ipt_rule_append(r, "delegate_forward");
+ fw3_ipt_rule_append(r, "FORWARD");
}
}
static void
-set_default(const char *name, bool set)
+set_default(const char *name, int set)
{
FILE *f;
char path[sizeof("/proc/sys/net/ipv4/tcp_window_scaling\0")];
fw3_ipt_set_policy(handle, "FORWARD", policy);
}
+ fw3_ipt_delete_id_rules(handle, "INPUT");
+ fw3_ipt_delete_id_rules(handle, "OUTPUT");
+ fw3_ipt_delete_id_rules(handle, "FORWARD");
+ fw3_ipt_delete_id_rules(handle, "PREROUTING");
+ fw3_ipt_delete_id_rules(handle, "POSTROUTING");
+
for (c = default_chains; c->format; c++)
{
/* don't touch user chains on selective stop */