};
function to_mask(bits, v6) {
- let m = [];
+ let m = [], n = false;
- if (bits < 0 || bits > (v6 ? 128 : 32))
+ if (bits < 0) {
+ n = true;
+ bits = -bits;
+ }
+
+ if (bits > (v6 ? 128 : 32))
return null;
for (let i = 0; i < (v6 ? 16 : 4); i++) {
let b = (bits < 8) ? bits : 8;
- m[i] = (0xff << (8 - b)) & 0xff;
+ m[i] = (n ? ~(0xff << (8 - b)) : (0xff << (8 - b))) & 0xff;
bits -= b;
}
switch (t) {
case 'ipv4_addr':
- fields[i] = `ip ${dir}saddr`;
+ fields[i] = `ip ${dir}addr`;
break;
case 'ipv6_addr':
- fields[i] = `ip6 ${dir}saddr`;
+ fields[i] = `ip6 ${dir}addr`;
break;
case 'ether_addr':
return fields;
}
-function resolve_lower_devices(devstatus, devname) {
+function resolve_lower_devices(devstatus, devname, require_hwoffload) {
let dir = fs.opendir(`/sys/class/net/${devname}`);
let devs = [];
if (dir) {
- if (!devstatus || devstatus[devname]?.["hw-tc-offload"]) {
- push(devs, devname);
- }
- else {
+ switch (devstatus[devname]?.devtype) {
+ case 'vlan':
+ case 'bridge':
let e;
while ((e = dir.read()) != null)
if (index(e, "lower_") === 0)
- push(devs, ...resolve_lower_devices(devstatus, substr(e, 6)));
+ push(devs, ...resolve_lower_devices(devstatus, substr(e, 6), require_hwoffload));
+
+ break;
+
+ default:
+ if (!require_hwoffload || devstatus[devname]?.["hw-tc-offload"])
+ push(devs, devname);
+
+ break;
}
dir.close();
let devstatus = null;
let devices = [];
+ let bus = ubus.connect();
- if (this.default_option("flow_offloading_hw")) {
- let bus = ubus.connect();
-
- if (bus) {
- devstatus = bus.call("network.device", "status") || {};
- bus.disconnect();
- }
+ if (bus) {
+ devstatus = bus.call("network.device", "status") || {};
+ bus.disconnect();
+ }
+ if (this.default_option("flow_offloading_hw")) {
for (let zone in this.zones())
for (let device in zone.related_physdevs)
- push(devices, ...resolve_lower_devices(devstatus, device));
+ push(devices, ...resolve_lower_devices(devstatus, device, true));
- devices = uniq(devices);
+ devices = sort(uniq(devices));
- if (nft_try_hw_offload(devices))
+ if (length(devices) && nft_try_hw_offload(devices))
return devices;
this.warn('Hardware flow offloading unavailable, falling back to software offloading');
}
for (let zone in this.zones())
- for (let device in zone.match_devices)
- push(devices, ...resolve_lower_devices(null, device));
+ for (let device in zone.related_physdevs)
+ push(devices, ...resolve_lower_devices(devstatus, device, false));
- return uniq(devices);
+ return sort(uniq(devices));
},
check_set_types: function() {
return null;
m = to_mask(b, length(a) == 16);
+ b = max(-1, b);
}
return [{
},
parse_date: function(val) {
- let m = match(val, /^([0-9-]+)T([0-9:]+)$/);
- let d = m ? match(m[1], /^([0-9]{1,4})(-([0-9]{1,2})(-([0-9]{1,2}))?)?$/) : null;
- let t = this.parse_time(m[2]);
-
- d[3] ||= 1;
- d[5] ||= 1;
+ let d = match(val, /^([0-9]{4})(-([0-9]{1,2})(-([0-9]{1,2})(T([0-9:]+))?)?)?$/);
- if (d == null || d[1] < 1970 || d[1] > 2038 || d[3] < 1 || d[3] > 12 || d[5] < 1 || d[5] > 31)
+ if (d == null || d[1] < 1970 || d[1] > 2038 || d[3] > 12 || d[5] > 31)
return null;
- if (m[2] && !t)
+ let t = this.parse_time(d[7] ?? "0");
+
+ if (t == null)
return null;
return {
year: +d[1],
- month: +d[3],
- day: +d[5],
- hour: t ? +t[1] : 0,
- min: t ? +t[3] : 0,
- sec: t ? +t[5] : 0
+ month: +d[3] || 1,
+ day: +d[5] || 1,
+ ...t
};
},
return sprintf('"%04d-%02d-%02d"', stamp.year, stamp.month, stamp.day);
},
+ datestamp: function(stamp) {
+ return exists(stamp, 'hour') ? this.datetime(stamp) : this.date(stamp);
+ },
+
time: function(stamp) {
return sprintf('"%02d:%02d:%02d"', stamp.hour, stamp.min, stamp.sec);
},
this.warn_section(data, "is disabled, ignoring section");
return;
}
- else if (zone.helper && !zone.helper.available) {
- this.warn_section(data, `uses unavailable ct helper '${zone.helper.name}', ignoring section`);
- return;
+
+ for (let helper in zone.helper) {
+ if (!helper.available) {
+ this.warn_section(data, `uses unavailable ct helper '${zone.helper.name}', ignoring section`);
+ return;
+ }
}
if (zone.mtu_fix && this.kernel < 0x040a0000) {
push(related_ubus_networks, { invert: false, device: name });
}
- for (let e in [ ...to_array(zone.network), ...related_ubus_networks ]) {
+ zone.network = [ ...to_array(zone.network), ...related_ubus_networks ];
+
+ for (let e in zone.network) {
if (exists(this.state.networks, e.device)) {
let net = this.state.networks[e.device];
proto: { any: true }
};
- f.name ||= `Accept ${fwd.src.any ? "any" : fwd.src.zone.name} to ${fwd.dest.any ? "any" : fwd.dest.zone.name} forwarding`;
+ f.name ||= `Accept ${fwd.src.any ? "any" : fwd.src.zone.name} to ${fwd.dest.any ? "any" : fwd.dest.zone.name} ${family ? `${this.nfproto(family, true)} ` : ''}forwarding`;
f.chain = fwd.src.any ? "forward" : `forward_${fwd.src.zone.name}`;
if (fwd.dest.any)
};
- let family = fwd.family;
-
/* inherit family restrictions from related zones */
- if (family === 0 || family === null) {
- let f1 = fwd.src.zone ? fwd.src.zone.family : 0;
- let f2 = fwd.dest.zone ? fwd.dest.zone.family : 0;
-
- if (f1 && f2 && f1 != f2) {
- this.warn_section(data,
- `references src ${fwd.src.zone.name} restricted to ${this.nfproto(f1, true)} and dest ${fwd.dest.zone.name} restricted to ${this.nfproto(f2, true)}, ignoring forwarding`);
-
- return;
- }
- else if (f1) {
- this.warn_section(data,
- `inheriting ${this.nfproto(f1, true)} restriction from src ${fwd.src.zone.name}`);
-
- family = f1;
- }
- else if (f2) {
- this.warn_section(data,
- `inheriting ${this.nfproto(f2, true)} restriction from dest ${fwd.dest.zone.name}`);
+ let family = infer_family(fwd.family, [
+ fwd.src?.zone, "source zone",
+ fwd.dest?.zone, "destination zone"
+ ]);
- family = f2;
- }
+ if (type(family) == "string") {
+ this.warn_section(data, `${family}, skipping`);
+ return;
}
add_rule(family, fwd);
projects / project / firewall4.git / blobdiff