/*
* firewall3 - 3rd OpenWrt UCI firewall implementation
*
- * Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
+ * Copyright (C) 2013-2014 Jo-Philipp Wich <jo@mein.io>
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
#include <netdb.h>
#include <arpa/inet.h>
#include <sys/socket.h>
+#define _LINUX_IN_H
+#define _LINUX_IN6_H
#include <netinet/in.h>
#include <netinet/ether.h>
#include <libubox/list.h>
#include <libubox/utils.h>
+#include <libubox/blobmsg.h>
#include "icmp_codes.h"
#include "utils.h"
FW3_FLAG_MARK = 10,
FW3_FLAG_DNAT = 11,
FW3_FLAG_SNAT = 12,
- FW3_FLAG_SRC_ACCEPT = 13,
- FW3_FLAG_SRC_REJECT = 14,
- FW3_FLAG_SRC_DROP = 15,
- FW3_FLAG_CUSTOM_CHAINS = 16,
- FW3_FLAG_SYN_FLOOD = 17,
- FW3_FLAG_MTU_FIX = 18,
- FW3_FLAG_DROP_INVALID = 19,
- FW3_FLAG_HOTPLUG = 20,
+ FW3_FLAG_MASQUERADE = 13,
+ FW3_FLAG_SRC_ACCEPT = 14,
+ FW3_FLAG_SRC_REJECT = 15,
+ FW3_FLAG_SRC_DROP = 16,
+ FW3_FLAG_CUSTOM_CHAINS = 17,
+ FW3_FLAG_SYN_FLOOD = 18,
+ FW3_FLAG_MTU_FIX = 19,
+ FW3_FLAG_DROP_INVALID = 20,
+ FW3_FLAG_HOTPLUG = 21,
__FW3_FLAG_MAX
};
bool invert;
bool resolved;
enum fw3_family family;
- int mask;
union {
struct in_addr v4;
struct in6_addr v6;
struct in_addr v4;
struct in6_addr v6;
struct ether_addr mac;
- } address2;
+ } mask;
};
struct fw3_mac
struct fw3_limit syn_flood_rate;
bool tcp_syncookies;
- bool tcp_ecn;
+ int tcp_ecn;
bool tcp_window_scaling;
bool accept_redirects;
const char *extra_dest;
bool masq;
+ bool masq_allow_invalid;
struct list_head masq_src;
struct list_head masq_dest;
- bool conntrack;
bool mtu_fix;
bool log;
bool custom_chains;
uint32_t flags[2];
+
+ struct list_head old_addrs;
};
struct fw3_rule
struct fw3_zone *_src;
struct fw3_zone *_dest;
+ const char *device;
+ bool direction_out;
+
struct fw3_device src;
struct fw3_device dest;
struct fw3_setmatch ipset;
enum fw3_reflection_source reflection_src;
};
+struct fw3_snat
+{
+ struct list_head list;
+
+ bool enabled;
+ const char *name;
+
+ enum fw3_family family;
+
+ struct fw3_zone *_src;
+
+ struct fw3_device src;
+ struct fw3_setmatch ipset;
+ const char *device;
+
+ struct list_head proto;
+
+ struct fw3_address ip_src;
+ struct fw3_port port_src;
+
+ struct fw3_address ip_dest;
+ struct fw3_port port_dest;
+
+ struct fw3_address ip_snat;
+ struct fw3_port port_snat;
+
+ struct fw3_limit limit;
+ struct fw3_time time;
+ struct fw3_mark mark;
+ bool connlimit_ports;
+
+ enum fw3_flag target;
+
+ const char *extra;
+};
+
struct fw3_forward
{
struct list_head list;
struct list_head zones;
struct list_head rules;
struct list_head redirects;
+ struct list_head snats;
struct list_head forwards;
struct list_head ipsets;
struct list_head includes;
bool fw3_parse_monthdays(void *ptr, const char *val, bool is_list);
bool fw3_parse_mark(void *ptr, const char *val, bool is_list);
bool fw3_parse_setmatch(void *ptr, const char *val, bool is_list);
+bool fw3_parse_direction(void *ptr, const char *val, bool is_list);
-void fw3_parse_options(void *s, const struct fw3_option *opts,
+bool fw3_parse_options(void *s, const struct fw3_option *opts,
struct uci_section *section);
+bool fw3_parse_blob_options(void *s, const struct fw3_option *opts,
+ struct blob_attr *a, const char *name);
const char * fw3_address_to_string(struct fw3_address *address,
- bool allow_invert);
+ bool allow_invert, bool as_cidr);
#endif