ruleset: reuse zone-jump.uc template for notrack and helper chain jumps

[project/firewall4.git] / root / usr / share / firewall4 / templates / ruleset.uc

diff --git a/root/usr/share/firewall4/templates/ruleset.uc b/root/usr/share/firewall4/templates/ruleset.uc
index b4023157bf2dc8578d3edfcc46dcc4fe19343795..d37498447a99a368370cb8cfcfff68e1685564e0 100644 (file)
--- a/root/usr/share/firewall4/templates/ruleset.uc
+++ b/root/usr/share/firewall4/templates/ruleset.uc
@@ -1,4 +1,7 @@
-{% let flowtable_devices = fw4.resolve_offload_devices(); -%}
+{%
+       let flowtable_devices = fw4.resolve_offload_devices();
+       let available_helpers = filter(fw4.helpers(), h => h.available);
+-%}
 
 table inet fw4
 flush table inet fw4
@@ -20,6 +23,21 @@ table inet fw4 {
 {% endif %}
        }
 
+{% endif %}
+{% if (length(available_helpers)): %}
+       #
+       # CT helper definitions
+       #
+
+{%  for (let helper in available_helpers): %}
+{%   for (let proto in helper.proto): %}
+       ct helper {{ helper.name }} {
+               type {{ fw4.quote(helper.name, true) }} protocol {{ proto.name }};
+       }
+
+{%   endfor %}
+{%  endfor %}
+
 {% endif %}
        #
        # Set definitions
@@ -36,6 +54,7 @@ table inet fw4 {
 {% endif %}
 {%  if (set.interval): %}
                flags interval
+               auto-merge
 {%  endif %}
 {%  fw4.print_setentries(set) %}
        }
@@ -122,23 +141,47 @@ table inet fw4 {
 {% for (let rule in fw4.rules("output")): %}
                {%+ include("rule.uc", { fw4, rule }) %}
 {% endfor %}
-{% for (let zone in fw4.zones()): for (let rule in zone.match_rules): %}
+{% for (let zone in fw4.zones()): %}
+{%  for (let rule in zone.match_rules): %}
+{%   if (zone.dflags.helper): %}
+{%    let devices_pos = fw4.filter_loopback_devs(rule.devices_pos, true); %}
+{%    let subnets_pos = fw4.filter_loopback_addrs(rule.subnets_pos, true); %}
+{%    if (devices_pos || subnets_pos): %}
+               {%+ include("zone-jump.uc", { fw4, zone, rule: { ...rule, devices_pos, subnets_pos }, direction: "helper" }) %}
+{%    endif %}
+{%   endif %}
                {%+ include("zone-jump.uc", { fw4, zone, rule, direction: "output" }) %}
-{% endfor; endfor %}
+{%  endfor %}
+{% endfor %}
 {% if (fw4.output_policy() == "reject"): %}
                jump handle_reject
 {% endif %}
        }
 
+       chain prerouting {
+               type filter hook prerouting priority filter; policy accept;
+{% for (let zone in fw4.zones()): %}
+{%  if (zone.dflags.helper): %}
+{%   for (let rule in zone.match_rules): %}
+{%    let devices_pos = fw4.filter_loopback_devs(rule.devices_pos, false); %}
+{%    let subnets_pos = fw4.filter_loopback_addrs(rule.subnets_pos, false); %}
+{%    if (rule.devices_neg || rule.subnets_neg || devices_pos || subnets_pos): %}
+               {%+ include("zone-jump.uc", { fw4, zone, rule: { ...rule, devices_pos, subnets_pos }, direction: "helper" }) %}
+{%    endif %}
+{%   endfor %}
+{%  endif %}
+{% endfor %}
+       }
+
        chain handle_reject {
                meta l4proto tcp reject with {{
                        (fw4.default_option("tcp_reject_code") != "tcp-reset")
-                               ? "icmpx type " + fw4.default_option("tcp_reject_code")
+                               ? `icmpx type ${fw4.default_option("tcp_reject_code")}`
                                : "tcp reset"
                }} comment "!fw4: Reject TCP traffic"
                reject with {{
                        (fw4.default_option("any_reject_code") != "tcp-reset")
-                               ? "icmpx type " + fw4.default_option("any_reject_code")
+                               ? `icmpx type ${fw4.default_option("any_reject_code")}`
                                : "tcp reset"
                }} comment "!fw4: Reject any other traffic"
        }
@@ -156,7 +199,7 @@ table inet fw4 {
 {% endif %}
 {% for (let zone in fw4.zones()): %}
        chain input_{{ zone.name }} {
-{%  for (let rule in fw4.rules("input_"+zone.name)): %}
+{%  for (let rule in fw4.rules(`input_${zone.name}`)): %}
                {%+ include("rule.uc", { fw4, rule }) %}
 {%  endfor %}
 {%  if (zone.dflags.dnat): %}
@@ -166,14 +209,14 @@ table inet fw4 {
        }
 
        chain output_{{ zone.name }} {
-{%  for (let rule in fw4.rules("output_"+zone.name)): %}
+{%  for (let rule in fw4.rules(`output_${zone.name}`)): %}
                {%+ include("rule.uc", { fw4, rule }) %}
 {%  endfor %}
                jump {{ zone.output }}_to_{{ zone.name }}
        }
 
        chain forward_{{ zone.name }} {
-{%  for (let rule in fw4.rules("forward_"+zone.name)): %}
+{%  for (let rule in fw4.rules(`forward_${zone.name}`)): %}
                {%+ include("rule.uc", { fw4, rule }) %}
 {%  endfor %}
 {%  if (zone.dflags.dnat): %}
@@ -182,6 +225,14 @@ table inet fw4 {
                jump {{ zone.forward }}_to_{{ zone.name }}
        }
 
+{%  if (zone.dflags.helper): %}
+       chain helper_{{ zone.name }} {
+{%   for (let rule in fw4.rules(`helper_${zone.name}`)): %}
+               {%+ include("rule.uc", { fw4, rule }) %}
+{%   endfor %}
+       }
+
+{%  endif %}
 {%  for (let verdict in ["accept", "reject", "drop"]): %}
 {%   if (zone.sflags[verdict]): %}
        chain {{ verdict }}_from_{{ zone.name }} {
@@ -234,7 +285,7 @@ table inet fw4 {
 {% for (let zone in fw4.zones()): %}
 {%  if (zone.dflags.dnat): %}
        chain dstnat_{{ zone.name }} {
-{%   for (let redirect in fw4.redirects("dstnat_"+zone.name)): %}
+{%   for (let redirect in fw4.redirects(`dstnat_${zone.name}`)): %}
                {%+ include("redirect.uc", { fw4, redirect }) %}
 {%   endfor %}
        }
@@ -242,7 +293,7 @@ table inet fw4 {
 {%  endif %}
 {%  if (zone.dflags.snat): %}
        chain srcnat_{{ zone.name }} {
-{%   for (let redirect in fw4.redirects("srcnat_"+zone.name)): %}
+{%   for (let redirect in fw4.redirects(`srcnat_${zone.name}`)): %}
                {%+ include("redirect.uc", { fw4, redirect }) %}
 {%   endfor %}
 {%   if (zone.masq): %}
@@ -265,74 +316,48 @@ table inet fw4 {
 {% endfor %}
 
        #
-       # Raw rules (notrack & helper)
+       # Raw rules (notrack)
        #
 
        chain raw_prerouting {
                type filter hook prerouting priority raw; policy accept;
-{% for (let target in ["helper", "notrack"]): %}
-{%  for (let zone in fw4.zones()): %}
-{%   if (zone.dflags[target]): %}
-{%    for (let rule in zone.match_rules): %}
-{%     let devices_pos = fw4.filter_loopback_devs(rule.devices_pos, false); %}
-{%     let subnets_pos = fw4.filter_loopback_addrs(rule.subnets_pos, false); %}
-{%     if (rule.devices_neg || rule.subnets_neg || devices_pos || subnets_pos): %}
-               {%+ if (rule.family): -%}
-                       meta nfproto {{ fw4.nfproto(rule.family) }} {%+ endif -%}
-               {%+ include("zone-match.uc", { fw4, egress: false, rule: { ...rule, devices_pos, subnets_pos } }) -%}
-               jump {{ target }}_{{ zone.name }} comment "!fw4: {{ zone.name }} {{ fw4.nfproto(rule.family, true) }} {{
-                       (target == "helper") ? "CT helper assignment" : "CT bypass"
-               }}"
-{%     endif %}
-{%    endfor %}
-{%   endif %}
-{%  endfor %}
+{% for (let zone in fw4.zones()): %}
+{%  if (zone.dflags["notrack"]): %}
+{%   for (let rule in zone.match_rules): %}
+{%    let devices_pos = fw4.filter_loopback_devs(rule.devices_pos, false); %}
+{%    let subnets_pos = fw4.filter_loopback_addrs(rule.subnets_pos, false); %}
+{%    if (rule.devices_neg || rule.subnets_neg || devices_pos || subnets_pos): %}
+               {%+ include("zone-jump.uc", { fw4, zone, rule: { ...rule, devices_pos, subnets_pos }, direction: "notrack" }) %}
+{%    endif %}
+{%   endfor %}
+{%  endif %}
 {% endfor %}
        }
 
        chain raw_output {
                type filter hook output priority raw; policy accept;
-{% for (let target in ["helper", "notrack"]): %}
-{%  for (let zone in fw4.zones()): %}
-{%   if (zone.dflags[target]): %}
-{%    for (let rule in zone.match_rules): %}
-{%     let devices_pos = fw4.filter_loopback_devs(rule.devices_pos, true); %}
-{%     let subnets_pos = fw4.filter_loopback_addrs(rule.subnets_pos, true); %}
-{%     if (devices_pos || subnets_pos): %}
-               {%+ if (rule.family): -%}
-                       meta nfproto {{ fw4.nfproto(rule.family) }} {%+ endif -%}
-               {%+ include("zone-match.uc", { fw4, egress: false, rule: { ...rule, devices_pos, subnets_pos } }) -%}
-               jump {{ target }}_{{ zone.name }} comment "!fw4: {{ zone.name }} {{ fw4.nfproto(rule.family, true) }} {{
-                       (target == "helper") ? "CT helper assignment" : "CT bypass"
-               }}"
-{%     endif %}
-{%    endfor %}
-{%   endif %}
-{%  endfor %}
-{% endfor %}
-       }
-
-{% for (let helper in fw4.helpers()): %}
-{%  if (helper.available): %}
-{%   for (let proto in helper.proto): %}
-       ct helper {{ helper.name }} {
-               type {{ fw4.quote(helper.name, true) }} protocol {{ proto.name }};
-       }
-
+{% for (let zone in fw4.zones()): %}
+{%  if (zone.dflags["notrack"]): %}
+{%   for (let rule in zone.match_rules): %}
+{%    let devices_pos = fw4.filter_loopback_devs(rule.devices_pos, true); %}
+{%    let subnets_pos = fw4.filter_loopback_addrs(rule.subnets_pos, true); %}
+{%    if (devices_pos || subnets_pos): %}
+               {%+ include("zone-jump.uc", { fw4, zone, rule: { ...rule, devices_pos, subnets_pos }, direction: "notrack" }) %}
+{%    endif %}
 {%   endfor %}
 {%  endif %}
 {% endfor %}
-{% for (let target in ["helper", "notrack"]): %}
-{%  for (let zone in fw4.zones()): %}
-{%   if (zone.dflags[target]): %}
-       chain {{ target }}_{{ zone.name }} {
-{% for (let rule in fw4.rules(target+"_"+zone.name)): %}
+       }
+
+{% for (let zone in fw4.zones()): %}
+{%   if (zone.dflags.notrack): %}
+       chain notrack_{{ zone.name }} {
+{% for (let rule in fw4.rules(`notrack_${zone.name}`)): %}
                {%+ include("rule.uc", { fw4, rule }) %}
 {% endfor %}
        }
 
 {%   endif %}
-{%  endfor %}
 {% endfor %}
 
        #
@@ -361,7 +386,7 @@ table inet fw4 {
        }
 
        chain mangle_output {
-               type filter hook output priority mangle; policy accept;
+               type route hook output priority mangle; policy accept;
 {% for (let rule in fw4.rules("mangle_output")): %}
                {%+ include("rule.uc", { fw4, rule }) %}
 {% endfor %}