X-Git-Url: http://git.openwrt.org/?a=blobdiff_plain;f=main.c;h=5985e73b21dd8d06e91525d9efe5e717ecdce952;hb=50979cc9c3805a72145440299b5c78e1be25c473;hp=32ff87dbf1d42d2a54b02b2f3b26f18e23f595f2;hpb=cecf523b7bc055cb38ac66844f6ec039d88023ca;p=project%2Ffirewall3.git diff --git a/main.c b/main.c index 32ff87d..5985e73 100644 --- a/main.c +++ b/main.c @@ -1,7 +1,7 @@ /* * firewall3 - 3rd OpenWrt UCI firewall implementation * - * Copyright (C) 2013 Jo-Philipp Wich + * Copyright (C) 2013-2014 Jo-Philipp Wich * * Permission to use, copy, modify, and/or distribute this software for any * purpose with or without fee is hereby granted, provided that the above @@ -24,11 +24,13 @@ #include "zones.h" #include "rules.h" #include "redirects.h" +#include "snats.h" #include "forwards.h" #include "ipsets.h" #include "includes.h" #include "ubus.h" #include "iptables.h" +#include "helpers.h" static enum fw3_family print_family = FW3_FAMILY_ANY; @@ -44,12 +46,10 @@ build_state(bool runtime) struct uci_package *p = NULL; FILE *sf; - state = malloc(sizeof(*state)); - + state = calloc(1, sizeof(*state)); if (!state) error("Out of memory"); - memset(state, 0, sizeof(*state)); state->uci = uci_alloc_context(); if (!state->uci) @@ -80,7 +80,7 @@ build_state(bool runtime) else { if (!fw3_ubus_connect()) - error("Failed to connect to ubus"); + warn("Failed to connect to ubus"); if (uci_load(state->uci, "firewall", &p)) { @@ -97,13 +97,19 @@ build_state(bool runtime) cfg_state = state; } + + struct blob_buf b = {NULL, NULL, 0, NULL}; + fw3_ubus_rules(&b); + fw3_load_defaults(state, p); - fw3_load_ipsets(state, p); + fw3_load_cthelpers(state, p); + fw3_load_ipsets(state, p, b.head); fw3_load_zones(state, p); - fw3_load_rules(state, p); - fw3_load_redirects(state, p); - fw3_load_forwards(state, p); - fw3_load_includes(state, p); + fw3_load_rules(state, p, b.head); + fw3_load_redirects(state, p, b.head); + fw3_load_snats(state, p, b.head); + fw3_load_forwards(state, p, b.head); + fw3_load_includes(state, p, b.head); return true; } @@ -122,6 +128,9 @@ free_state(struct fw3_state *state) list_for_each_safe(cur, tmp, &state->redirects) fw3_free_redirect((struct fw3_redirect *)cur); + list_for_each_safe(cur, tmp, &state->snats) + fw3_free_snat((struct fw3_snat *)cur); + list_for_each_safe(cur, tmp, &state->forwards) fw3_free_forward((struct fw3_forward *)cur); @@ -131,6 +140,9 @@ free_state(struct fw3_state *state) list_for_each_safe(cur, tmp, &state->includes) fw3_free_include((struct fw3_include *)cur); + list_for_each_safe(cur, tmp, &state->cthelpers) + fw3_free_cthelper((struct fw3_cthelper *)cur); + uci_free_context(state->uci); free(state); @@ -160,8 +172,6 @@ family_set(struct fw3_state *state, enum fw3_family family, bool set) static int stop(bool complete) { - FILE *ct; - int rv = 1; enum fw3_family family; enum fw3_table table; @@ -185,9 +195,6 @@ stop(bool complete) for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++) { - if (!fw3_has_table(family == FW3_FAMILY_V6, fw3_flag_names[table])) - continue; - if (!(handle = fw3_ipt_open(family, table))) continue; @@ -214,17 +221,14 @@ stop(bool complete) rv = 0; } - if (run_state) - fw3_destroy_ipsets(run_state); - - if (complete && (ct = fopen("/proc/net/nf_conntrack", "w")) != NULL) - { - info(" * Flushing conntrack table ..."); - - fwrite("f\n", 2, 1, ct); - fclose(ct); + if (run_state) { + for (family = FW3_FAMILY_V4; family <= FW3_FAMILY_V6; family++) + fw3_destroy_ipsets(run_state, family, false); } + if (complete) + fw3_flush_conntrack(NULL); + if (!rv && run_state) fw3_write_statefile(run_state); @@ -239,11 +243,11 @@ start(void) enum fw3_table table; struct fw3_ipt_handle *handle; - if (!print_family) - fw3_create_ipsets(cfg_state); - for (family = FW3_FAMILY_V4; family <= FW3_FAMILY_V6; family++) { + if (!print_family) + fw3_create_ipsets(cfg_state, family, false); + if (family == FW3_FAMILY_V6 && cfg_state->defaults.disable_ipv6) continue; @@ -259,11 +263,19 @@ start(void) continue; } + /* Linux 5.15+: make sure the tables are loaded and + * /proc/net/ip{,6}_tables_names are thus populated. + */ for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++) { - if (!fw3_has_table(family == FW3_FAMILY_V6, fw3_flag_names[table])) + if (!(handle = fw3_ipt_open(family, table))) continue; + fw3_ipt_close(handle); + } + + for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++) + { if (!(handle = fw3_ipt_open(family, table))) continue; @@ -275,6 +287,7 @@ start(void) fw3_print_default_head_rules(handle, cfg_state, false); fw3_print_rules(handle, cfg_state); fw3_print_redirects(handle, cfg_state); + fw3_print_snats(handle, cfg_state); fw3_print_forwards(handle, cfg_state); fw3_print_zone_rules(handle, cfg_state, false); fw3_print_default_tail_rules(handle, cfg_state, false); @@ -296,6 +309,7 @@ start(void) if (!rv) { + fw3_flush_conntrack(run_state); fw3_set_defaults(cfg_state); if (!print_family) @@ -330,9 +344,6 @@ reload(void) for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++) { - if (!fw3_has_table(family == FW3_FAMILY_V6, fw3_flag_names[table])) - continue; - if (!(handle = fw3_ipt_open(family, table))) continue; @@ -345,6 +356,9 @@ reload(void) fw3_ipt_close(handle); } + fw3_ipsets_update_run_state(family, run_state, cfg_state); + fw3_destroy_ipsets(run_state, family, true); + family_set(run_state, family, false); family_set(cfg_state, family, false); @@ -352,11 +366,10 @@ start: if (family == FW3_FAMILY_V6 && cfg_state->defaults.disable_ipv6) continue; + fw3_create_ipsets(cfg_state, family, true); + for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++) { - if (!fw3_has_table(family == FW3_FAMILY_V6, fw3_flag_names[table])) - continue; - if (!(handle = fw3_ipt_open(family, table))) continue; @@ -368,6 +381,7 @@ start: fw3_print_default_head_rules(handle, cfg_state, true); fw3_print_rules(handle, cfg_state); fw3_print_redirects(handle, cfg_state); + fw3_print_snats(handle, cfg_state); fw3_print_forwards(handle, cfg_state); fw3_print_zone_rules(handle, cfg_state, true); fw3_print_default_tail_rules(handle, cfg_state, true); @@ -386,6 +400,8 @@ start: if (!rv) { + fw3_flush_conntrack(run_state); + fw3_set_defaults(cfg_state); fw3_run_includes(cfg_state, true); fw3_hotplug_zones(cfg_state, true); @@ -395,6 +411,32 @@ start: return rv; } +static int +gc(void) +{ + enum fw3_family family; + enum fw3_table table; + struct fw3_ipt_handle *handle; + + for (family = FW3_FAMILY_V4; family <= FW3_FAMILY_V6; family++) + { + if (family == FW3_FAMILY_V6 && cfg_state->defaults.disable_ipv6) + continue; + + for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++) + { + if (!(handle = fw3_ipt_open(family, table))) + continue; + + fw3_ipt_gc(handle); + fw3_ipt_commit(handle); + fw3_ipt_close(handle); + } + } + + return 0; +} + static int lookup_network(const char *net) { @@ -437,6 +479,35 @@ lookup_device(const char *dev) return 1; } +static int +lookup_zone(const char *zone, const char *device) +{ + struct fw3_zone *z; + struct fw3_device *d; + + list_for_each_entry(z, &cfg_state->zones, list) + { + if (strcmp(z->name, zone)) + continue; + + list_for_each_entry(d, &z->devices, list) + { + if (device && strcmp(device, d->name)) + continue; + + printf("%s\n", d->name); + + if (device) + return 0; + } + + if (!device) + return 0; + } + + return 1; +} + static int usage(void) { @@ -444,6 +515,7 @@ usage(void) fprintf(stderr, "fw3 [-q] {start|stop|flush|reload|restart}\n"); fprintf(stderr, "fw3 [-q] network {net}\n"); fprintf(stderr, "fw3 [-q] device {dev}\n"); + fprintf(stderr, "fw3 [-q] zone {zone} [dev]\n"); return 1; } @@ -472,7 +544,7 @@ int main(int argc, char **argv) break; case 'q': - freopen("/dev/null", "w", stderr); + if (freopen("/dev/null", "w", stderr)) {} break; case 'h': @@ -482,7 +554,6 @@ int main(int argc, char **argv) } build_state(false); - build_state(true); defs = &cfg_state->defaults; if (optind >= argc) @@ -507,18 +578,24 @@ int main(int argc, char **argv) #endif } - freopen("/dev/null", "w", stderr); + if (freopen("/dev/null", "w", stderr)) {}; cfg_state->disable_ipsets = true; print_family = family; fw3_pr_debug = true; - rv = start(); + if (fw3_lock()) + { + build_state(true); + rv = start(); + fw3_unlock(); + } } else if (!strcmp(argv[optind], "start")) { if (fw3_lock()) { + build_state(true); rv = start(); fw3_unlock(); } @@ -527,6 +604,7 @@ int main(int argc, char **argv) { if (fw3_lock()) { + build_state(true); rv = stop(false); fw3_unlock(); } @@ -535,6 +613,7 @@ int main(int argc, char **argv) { if (fw3_lock()) { + build_state(true); rv = stop(true); fw3_unlock(); } @@ -543,6 +622,7 @@ int main(int argc, char **argv) { if (fw3_lock()) { + build_state(true); stop(true); rv = start(); fw3_unlock(); @@ -552,10 +632,19 @@ int main(int argc, char **argv) { if (fw3_lock()) { + build_state(true); rv = reload(); fw3_unlock(); } } + else if (!strcmp(argv[optind], "gc")) + { + if (fw3_lock()) + { + rv = gc(); + fw3_unlock(); + } + } else if (!strcmp(argv[optind], "network") && (optind + 1) < argc) { rv = lookup_network(argv[optind + 1]); @@ -564,6 +653,10 @@ int main(int argc, char **argv) { rv = lookup_device(argv[optind + 1]); } + else if (!strcmp(argv[optind], "zone") && (optind + 1) < argc) + { + rv = lookup_zone(argv[optind + 1], argv[optind + 2]); + } else { rv = usage();