options.c

   1 /*
   2  * firewall3 - 3rd OpenWrt UCI firewall implementation
   3  *
   4  *   Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
   5  *
   6  * Permission to use, copy, modify, and/or distribute this software for any
   7  * purpose with or without fee is hereby granted, provided that the above
   8  * copyright notice and this permission notice appear in all copies.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17  */
  18
  19 #include "options.h"
  20
  21 const char *fw3_flag_names[FW3_DEFAULT_DROP_INVALID + 1] = {
  22         "filter",
  23         "nat",
  24         "mangle",
  25         "raw",
  26
  27         "IPv4",
  28         "IPv6",
  29
  30         "ACCEPT",
  31         "REJECT",
  32         "DROP",
  33         "NOTRACK",
  34         "DNAT",
  35         "SNAT",
  36 };
  37
  38 bool
  39 fw3_parse_bool(void *ptr, const char *val)
  40 {
  41         if (!strcmp(val, "true") || !strcmp(val, "yes") || !strcmp(val, "1"))
  42                 *((bool *)ptr) = true;
  43         else
  44                 *((bool *)ptr) = false;
  45
  46         return true;
  47 }
  48
  49 bool
  50 fw3_parse_int(void *ptr, const char *val)
  51 {
  52         int n = strtol(val, NULL, 10);
  53
  54         if (errno == ERANGE || errno == EINVAL)
  55                 return false;
  56
  57         *((int *)ptr) = n;
  58
  59         return true;
  60 }
  61
  62 bool
  63 fw3_parse_string(void *ptr, const char *val)
  64 {
  65         *((char **)ptr) = (char *)val;
  66         return true;
  67 }
  68
  69 bool
  70 fw3_parse_target(void *ptr, const char *val)
  71 {
  72         if (!strcmp(val, "ACCEPT"))
  73         {
  74                 *((enum fw3_target *)ptr) = FW3_TARGET_ACCEPT;
  75                 return true;
  76         }
  77         else if (!strcmp(val, "REJECT"))
  78         {
  79                 *((enum fw3_target *)ptr) = FW3_TARGET_REJECT;
  80                 return true;
  81         }
  82         else if (!strcmp(val, "DROP"))
  83         {
  84                 *((enum fw3_target *)ptr) = FW3_TARGET_DROP;
  85                 return true;
  86         }
  87         else if (!strcmp(val, "NOTRACK"))
  88         {
  89                 *((enum fw3_target *)ptr) = FW3_TARGET_NOTRACK;
  90                 return true;
  91         }
  92         else if (!strcmp(val, "DNAT"))
  93         {
  94                 *((enum fw3_target *)ptr) = FW3_TARGET_DNAT;
  95                 return true;
  96         }
  97         else if (!strcmp(val, "SNAT"))
  98         {
  99                 *((enum fw3_target *)ptr) = FW3_TARGET_SNAT;
 100                 return true;
 101         }
 102
 103         return false;
 104 }
 105
 106 bool
 107 fw3_parse_limit(void *ptr, const char *val)
 108 {
 109         struct fw3_limit *limit = ptr;
 110         enum fw3_limit_unit u = FW3_LIMIT_UNIT_SECOND;
 111         char *e;
 112         int n;
 113
 114         if (*val == '!')
 115         {
 116                 limit->invert = true;
 117                 while (isspace(*++val));
 118         }
 119
 120         n = strtol(val, &e, 10);
 121
 122         if (errno == ERANGE || errno == EINVAL)
 123                 return false;
 124
 125         if (*e && *e++ != '/')
 126                 return false;
 127
 128         if (!strlen(e))
 129                 return false;
 130
 131         if (!strncmp(e, "second", strlen(e)))
 132                 u = FW3_LIMIT_UNIT_SECOND;
 133         else if (!strncmp(e, "minute", strlen(e)))
 134                 u = FW3_LIMIT_UNIT_MINUTE;
 135         else if (!strncmp(e, "hour", strlen(e)))
 136                 u = FW3_LIMIT_UNIT_HOUR;
 137         else if (!strncmp(e, "day", strlen(e)))
 138                 u = FW3_LIMIT_UNIT_DAY;
 139         else
 140                 return false;
 141
 142         limit->rate = n;
 143         limit->unit = u;
 144
 145         return true;
 146 }
 147
 148 bool
 149 fw3_parse_device(void *ptr, const char *val)
 150 {
 151         struct fw3_device *dev = ptr;
 152
 153         if (*val == '*')
 154         {
 155                 dev->set = true;
 156                 dev->any = true;
 157                 return true;
 158         }
 159
 160         if (*val == '!')
 161         {
 162                 dev->invert = true;
 163                 while (isspace(*++val));
 164         }
 165
 166         if (*val)
 167                 snprintf(dev->name, sizeof(dev->name), "%s", val);
 168         else
 169                 return false;
 170
 171         dev->set = true;
 172         return true;
 173 }
 174
 175 bool
 176 fw3_parse_address(void *ptr, const char *val)
 177 {
 178         struct fw3_address *addr = ptr;
 179         struct in_addr v4;
 180         struct in6_addr v6;
 181         char *p, *s, *e;
 182         int i, m = -1;
 183
 184         if (*val == '!')
 185         {
 186                 addr->invert = true;
 187                 while (isspace(*++val));
 188         }
 189
 190         s = strdup(val);
 191
 192         if (!s)
 193                 return false;
 194
 195         if ((p = strchr(s, '/')) != NULL)
 196         {
 197                 *p++ = 0;
 198                 m = strtoul(p, &e, 10);
 199
 200                 if ((e == p) || (*e != 0))
 201                 {
 202                         if (strchr(s, ':') || !inet_pton(AF_INET, p, &v4))
 203                         {
 204                                 free(s);
 205                                 return false;
 206                         }
 207
 208                         for (i = 0, m = 32; !(v4.s_addr & 1) && (i < 32); i++)
 209                         {
 210                                 m--;
 211                                 v4.s_addr >>= 1;
 212                         }
 213                 }
 214         }
 215         else if ((p = strchr(s, '-')) != NULL)
 216         {
 217                 *p++ = 0;
 218
 219                 if (inet_pton(AF_INET6, p, &v6))
 220                 {
 221                         addr->family = FW3_FAMILY_V6;
 222                         addr->address2.v6 = v6;
 223                         addr->range = true;
 224                 }
 225                 else if (inet_pton(AF_INET, p, &v4))
 226                 {
 227                         addr->family = FW3_FAMILY_V4;
 228                         addr->address2.v4 = v4;
 229                         addr->range = true;
 230                 }
 231                 else
 232                 {
 233                         free(s);
 234                         return false;
 235                 }
 236         }
 237
 238         if (inet_pton(AF_INET6, s, &v6))
 239         {
 240                 addr->family = FW3_FAMILY_V6;
 241                 addr->address.v6 = v6;
 242                 addr->mask = (m >= 0) ? m : 128;
 243         }
 244         else if (inet_pton(AF_INET, s, &v4))
 245         {
 246                 addr->family = FW3_FAMILY_V4;
 247                 addr->address.v4 = v4;
 248                 addr->mask = (m >= 0) ? m : 32;
 249         }
 250         else
 251         {
 252                 free(s);
 253                 return false;
 254         }
 255
 256         free(s);
 257         addr->set = true;
 258         return true;
 259 }
 260
 261 bool
 262 fw3_parse_mac(void *ptr, const char *val)
 263 {
 264         struct fw3_mac *addr = ptr;
 265         struct ether_addr *mac;
 266
 267         if (*val == '!')
 268         {
 269                 addr->invert = true;
 270                 while (isspace(*++val));
 271         }
 272
 273         if ((mac = ether_aton(val)) != NULL)
 274         {
 275                 addr->mac = *mac;
 276                 addr->set = true;
 277                 return true;
 278         }
 279
 280         return false;
 281 }
 282
 283 bool
 284 fw3_parse_port(void *ptr, const char *val)
 285 {
 286         struct fw3_port *range = ptr;
 287         uint16_t n;
 288         uint16_t m;
 289         char *p;
 290
 291         if (*val == '!')
 292         {
 293                 range->invert = true;
 294                 while (isspace(*++val));
 295         }
 296
 297         n = strtoul(val, &p, 10);
 298
 299         if (errno == ERANGE || errno == EINVAL)
 300                 return false;
 301
 302         if (*p && *p != '-' && *p != ':')
 303                 return false;
 304
 305         if (*p)
 306         {
 307                 m = strtoul(++p, NULL, 10);
 308
 309                 if (errno == ERANGE || errno == EINVAL || m < n)
 310                         return false;
 311
 312                 range->port_min = n;
 313                 range->port_max = m;
 314         }
 315         else
 316         {
 317                 range->port_min = n;
 318                 range->port_max = n;
 319         }
 320
 321         range->set = true;
 322         return true;
 323 }
 324
 325 bool
 326 fw3_parse_family(void *ptr, const char *val)
 327 {
 328         if (!strcmp(val, "any"))
 329                 *((enum fw3_family *)ptr) = FW3_FAMILY_ANY;
 330         else if (!strcmp(val, "inet") || strrchr(val, '4'))
 331                 *((enum fw3_family *)ptr) = FW3_FAMILY_V4;
 332         else if (!strcmp(val, "inet6") || strrchr(val, '6'))
 333                 *((enum fw3_family *)ptr) = FW3_FAMILY_V6;
 334         else
 335                 return false;
 336
 337         return true;
 338 }
 339
 340 bool
 341 fw3_parse_icmptype(void *ptr, const char *val)
 342 {
 343         struct fw3_icmptype *icmp = ptr;
 344         bool v4 = false;
 345         bool v6 = false;
 346         char *p;
 347         int i;
 348
 349         for (i = 0; i < ARRAY_SIZE(fw3_icmptype_list_v4); i++)
 350         {
 351                 if (!strcmp(val, fw3_icmptype_list_v4[i].name))
 352                 {
 353                         icmp->type     = fw3_icmptype_list_v4[i].type;
 354                         icmp->code_min = fw3_icmptype_list_v4[i].code_min;
 355                         icmp->code_max = fw3_icmptype_list_v4[i].code_max;
 356
 357                         v4 = true;
 358                         break;
 359                 }
 360         }
 361
 362         for (i = 0; i < ARRAY_SIZE(fw3_icmptype_list_v6); i++)
 363         {
 364                 if (!strcmp(val, fw3_icmptype_list_v6[i].name))
 365                 {
 366                         icmp->type6     = fw3_icmptype_list_v6[i].type;
 367                         icmp->code6_min = fw3_icmptype_list_v6[i].code_min;
 368                         icmp->code6_max = fw3_icmptype_list_v6[i].code_max;
 369
 370                         v6 = true;
 371                         break;
 372                 }
 373         }
 374
 375         if (!v4 && !v6)
 376         {
 377                 i = strtoul(val, &p, 10);
 378
 379                 if ((p == val) || (*p != '/' && *p != 0) || (i > 0xFF))
 380                         return false;
 381
 382                 icmp->type = i;
 383
 384                 if (*p == '/')
 385                 {
 386                         val = ++p;
 387                         i = strtoul(val, &p, 10);
 388
 389                         if ((p == val) || (*p != 0) || (i > 0xFF))
 390                                 return false;
 391
 392                         icmp->code_min = i;
 393                         icmp->code_max = i;
 394                 }
 395                 else
 396                 {
 397                         icmp->code_min = 0;
 398                         icmp->code_max = 0xFF;
 399                 }
 400
 401                 icmp->type6     = icmp->type;
 402                 icmp->code6_min = icmp->code_max;
 403                 icmp->code6_max = icmp->code_max;
 404
 405                 v4 = true;
 406                 v6 = true;
 407         }
 408
 409         icmp->family = (v4 && v6) ? FW3_FAMILY_ANY
 410                                   : (v6 ? FW3_FAMILY_V6 : FW3_FAMILY_V4);
 411
 412         return true;
 413 }
 414
 415 bool
 416 fw3_parse_protocol(void *ptr, const char *val)
 417 {
 418         struct fw3_protocol *proto = ptr;
 419         struct protoent *ent;
 420
 421         if (*val == '!')
 422         {
 423                 proto->invert = true;
 424                 while (isspace(*++val));
 425         }
 426
 427         if (!strcmp(val, "all"))
 428         {
 429                 proto->any = true;
 430                 return true;
 431         }
 432         else if (!strcmp(val, "icmpv6"))
 433         {
 434                 val = "ipv6-icmp";
 435         }
 436
 437         ent = getprotobyname(val);
 438
 439         if (ent)
 440         {
 441                 proto->protocol = ent->p_proto;
 442                 return true;
 443         }
 444
 445         proto->protocol = strtoul(val, NULL, 10);
 446         return (errno != ERANGE && errno != EINVAL);
 447 }
 448
 449 bool
 450 fw3_parse_ipset_method(void *ptr, const char *val)
 451 {
 452         if (!strncmp(val, "bitmap", strlen(val)))
 453         {
 454                 *((enum fw3_ipset_method *)ptr) = FW3_IPSET_METHOD_BITMAP;
 455                 return true;
 456         }
 457         else if (!strncmp(val, "hash", strlen(val)))
 458         {
 459                 *((enum fw3_ipset_method *)ptr) = FW3_IPSET_METHOD_HASH;
 460                 return true;
 461         }
 462         else if (!strncmp(val, "list", strlen(val)))
 463         {
 464                 *((enum fw3_ipset_method *)ptr) = FW3_IPSET_METHOD_LIST;
 465                 return true;
 466         }
 467
 468         return false;
 469 }
 470
 471 bool
 472 fw3_parse_ipset_datatype(void *ptr, const char *val)
 473 {
 474         struct fw3_ipset_datatype *type = ptr;
 475
 476         if (!strncmp(val, "dest_", 5))
 477         {
 478                 val += 5;
 479                 type->dest = true;
 480         }
 481         else if (!strncmp(val, "dst_", 4))
 482         {
 483                 val += 4;
 484                 type->dest = true;
 485         }
 486         else if (!strncmp(val, "src_", 4))
 487         {
 488                 val += 4;
 489                 type->dest = false;
 490         }
 491
 492         if (!strncmp(val, "ip", strlen(val)))
 493         {
 494                 type->type = FW3_IPSET_TYPE_IP;
 495                 return true;
 496         }
 497         else if (!strncmp(val, "port", strlen(val)))
 498         {
 499                 type->type = FW3_IPSET_TYPE_PORT;
 500                 return true;
 501         }
 502         else if (!strncmp(val, "mac", strlen(val)))
 503         {
 504                 type->type = FW3_IPSET_TYPE_MAC;
 505                 return true;
 506         }
 507         else if (!strncmp(val, "net", strlen(val)))
 508         {
 509                 type->type = FW3_IPSET_TYPE_NET;
 510                 return true;
 511         }
 512         else if (!strncmp(val, "set", strlen(val)))
 513         {
 514                 type->type = FW3_IPSET_TYPE_SET;
 515                 return true;
 516         }
 517
 518         return false;
 519 }
 520
 521 bool
 522 fw3_parse_date(void *ptr, const char *val)
 523 {
 524         unsigned int year = 1970, mon = 1, day = 1, hour = 0, min = 0, sec = 0;
 525         struct tm tm = { 0 };
 526         char *p;
 527
 528         year = strtoul(val, &p, 10);
 529         if ((*p != '-' && *p) || year < 1970 || year > 2038)
 530                 goto fail;
 531         else if (!*p)
 532                 goto ret;
 533
 534         mon = strtoul(++p, &p, 10);
 535         if ((*p != '-' && *p) || mon > 12)
 536                 goto fail;
 537         else if (!*p)
 538                 goto ret;
 539
 540         day = strtoul(++p, &p, 10);
 541         if ((*p != 'T' && *p) || day > 31)
 542                 goto fail;
 543         else if (!*p)
 544                 goto ret;
 545
 546         hour = strtoul(++p, &p, 10);
 547         if ((*p != ':' && *p) || hour > 23)
 548                 goto fail;
 549         else if (!*p)
 550                 goto ret;
 551
 552         min = strtoul(++p, &p, 10);
 553         if ((*p != ':' && *p) || min > 59)
 554                 goto fail;
 555         else if (!*p)
 556                 goto ret;
 557
 558         sec = strtoul(++p, &p, 10);
 559         if (*p || sec > 59)
 560                 goto fail;
 561
 562 ret:
 563         tm.tm_year = year - 1900;
 564         tm.tm_mon  = mon - 1;
 565         tm.tm_mday = day;
 566         tm.tm_hour = hour;
 567         tm.tm_min  = min;
 568         tm.tm_sec  = sec;
 569
 570         if (mktime(&tm) >= 0)
 571         {
 572                 *((struct tm *)ptr) = tm;
 573                 return true;
 574         }
 575
 576 fail:
 577         return false;
 578 }
 579
 580 bool
 581 fw3_parse_time(void *ptr, const char *val)
 582 {
 583         unsigned int hour = 0, min = 0, sec = 0;
 584         char *p;
 585
 586         hour = strtoul(val, &p, 10);
 587         if (*p != ':' || hour > 23)
 588                 goto fail;
 589
 590         min = strtoul(++p, &p, 10);
 591         if ((*p != ':' && *p) || min > 59)
 592                 goto fail;
 593         else if (!*p)
 594                 goto ret;
 595
 596         sec = strtoul(++p, &p, 10);
 597         if (*p || sec > 59)
 598                 goto fail;
 599
 600 ret:
 601         *((int *)ptr) = 60 * 60 * hour + 60 * min + sec;
 602         return true;
 603
 604 fail:
 605         return false;
 606 }
 607
 608 bool
 609 fw3_parse_weekdays(void *ptr, const char *val)
 610 {
 611         unsigned int w;
 612         char *p;
 613
 614         if (*val == '!')
 615         {
 616                 setbit(*(uint8_t *)ptr, 0);
 617                 while (isspace(*++val));
 618         }
 619
 620         for (p = strtok((char *)val, " \t"); p; p = strtok(NULL, " \t"))
 621         {
 622                 if (!strncasecmp(p, "monday", strlen(p)))
 623                         w = 1;
 624                 else if (!strncasecmp(p, "tuesday", strlen(p)))
 625                         w = 2;
 626                 else if (!strncasecmp(p, "wednesday", strlen(p)))
 627                         w = 3;
 628                 else if (!strncasecmp(p, "thursday", strlen(p)))
 629                         w = 4;
 630                 else if (!strncasecmp(p, "friday", strlen(p)))
 631                         w = 5;
 632                 else if (!strncasecmp(p, "saturday", strlen(p)))
 633                         w = 6;
 634                 else if (!strncasecmp(p, "sunday", strlen(p)))
 635                         w = 7;
 636                 else
 637                 {
 638                         w = strtoul(p, &p, 10);
 639
 640                         if (*p || w < 1 || w > 7)
 641                                 return false;
 642                 }
 643
 644                 setbit(*(uint8_t *)ptr, w);
 645         }
 646
 647         return true;
 648 }
 649
 650 bool
 651 fw3_parse_monthdays(void *ptr, const char *val)
 652 {
 653         unsigned int d;
 654         char *p;
 655
 656         if (*val == '!')
 657         {
 658                 setbit(*(uint32_t *)ptr, 0);
 659                 while (isspace(*++val));
 660         }
 661
 662         for (p = strtok((char *)val, " \t"); p; p = strtok(NULL, " \t"))
 663         {
 664                 d = strtoul(p, &p, 10);
 665
 666                 if (*p || d < 1 || d > 31)
 667                         return false;
 668
 669                 setbit(*(uint32_t *)ptr, d);
 670         }
 671
 672         return true;
 673 }
 674
 675
 676 void
 677 fw3_parse_options(void *s, const struct fw3_option *opts,
 678                   struct uci_section *section)
 679 {
 680         char *p;
 681         bool known;
 682         struct uci_element *e, *l;
 683         struct uci_option *o;
 684         const struct fw3_option *opt;
 685         struct list_head *item;
 686         struct list_head *dest;
 687
 688         uci_foreach_element(&section->options, e)
 689         {
 690                 o = uci_to_option(e);
 691                 known = false;
 692
 693                 for (opt = opts; opt->name; opt++)
 694                 {
 695                         if (!opt->parse)
 696                                 continue;
 697
 698                         if (strcmp(opt->name, e->name))
 699                                 continue;
 700
 701                         if (o->type == UCI_TYPE_LIST)
 702                         {
 703                                 if (!opt->elem_size)
 704                                 {
 705                                         warn_elem(e, "must not be a list");
 706                                 }
 707                                 else
 708                                 {
 709                                         uci_foreach_element(&o->v.list, l)
 710                                         {
 711                                                 if (!l->name)
 712                                                         continue;
 713
 714                                                 item = malloc(opt->elem_size);
 715
 716                                                 if (!item)
 717                                                         continue;
 718
 719                                                 memset(item, 0, opt->elem_size);
 720
 721                                                 if (!opt->parse(item, l->name))
 722                                                 {
 723                                                         warn_elem(e, "has invalid value '%s'", l->name);
 724                                                         free(item);
 725                                                         continue;
 726                                                 }
 727
 728                                                 dest = (struct list_head *)((char *)s + opt->offset);
 729                                                 list_add_tail(item, dest);
 730                                         }
 731                                 }
 732                         }
 733                         else
 734                         {
 735                                 if (!o->v.string)
 736                                         continue;
 737
 738                                 if (!opt->elem_size)
 739                                 {
 740                                         if (!opt->parse((char *)s + opt->offset, o->v.string))
 741                                                 warn_elem(e, "has invalid value '%s'", o->v.string);
 742                                 }
 743                                 else
 744                                 {
 745                                         for (p = strtok(o->v.string, " \t");
 746                                              p != NULL;
 747                                              p = strtok(NULL, " \t"))
 748                                         {
 749                                                 item = malloc(opt->elem_size);
 750
 751                                                 if (!item)
 752                                                         continue;
 753
 754                                                 memset(item, 0, opt->elem_size);
 755
 756                                                 if (!opt->parse(item, p))
 757                                                 {
 758                                                         warn_elem(e, "has invalid value '%s'", p);
 759                                                         free(item);
 760                                                         continue;
 761                                                 }
 762
 763                                                 dest = (struct list_head *)((char *)s + opt->offset);
 764                                                 list_add_tail(item, dest);
 765                                         }
 766                                 }
 767                         }
 768
 769                         known = true;
 770                         break;
 771                 }
 772
 773                 if (!known)
 774                         warn_elem(e, "is unknown");
 775         }
 776 }
 777
 778
 779 void
 780 fw3_format_in_out(struct fw3_device *in, struct fw3_device *out)
 781 {
 782         if (in && !in->any)
 783                 fw3_pr(" %s-i %s", in->invert ? "! " : "", in->name);
 784
 785         if (out && !out->any)
 786                 fw3_pr(" %s-o %s", out->invert ? "! " : "", out->name);
 787 }
 788
 789 void
 790 fw3_format_src_dest(struct fw3_address *src, struct fw3_address *dest)
 791 {
 792         char s[INET6_ADDRSTRLEN];
 793
 794         if ((src && src->range) || (dest && dest->range))
 795                 fw3_pr(" -m iprange");
 796
 797         if (src && src->set)
 798         {
 799                 if (src->range)
 800                 {
 801                         inet_ntop(src->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
 802                                           &src->address.v4, s, sizeof(s));
 803
 804                         fw3_pr(" %s--src-range %s", src->invert ? "! " : "", s);
 805
 806                         inet_ntop(src->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
 807                                           &src->address2.v4, s, sizeof(s));
 808
 809                         fw3_pr("-%s", s);
 810                 }
 811                 else
 812                 {
 813                         inet_ntop(src->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
 814                                           &src->address.v4, s, sizeof(s));
 815
 816                         fw3_pr(" %s-s %s/%u", src->invert ? "! " : "", s, src->mask);
 817                 }
 818         }
 819
 820         if (dest && dest->set)
 821         {
 822                 if (dest->range)
 823                 {
 824                         inet_ntop(dest->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
 825                                           &dest->address.v4, s, sizeof(s));
 826
 827                         fw3_pr(" %s--dst-range %s", dest->invert ? "! " : "", s);
 828
 829                         inet_ntop(dest->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
 830                                           &dest->address2.v4, s, sizeof(s));
 831
 832                         fw3_pr("-%s", s);
 833                 }
 834                 else
 835                 {
 836                         inet_ntop(dest->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
 837                                           &dest->address.v4, s, sizeof(s));
 838
 839                         fw3_pr(" %s-d %s/%u", dest->invert ? "! " : "", s, dest->mask);
 840                 }
 841         }
 842 }
 843
 844 void
 845 fw3_format_sport_dport(struct fw3_port *sp, struct fw3_port *dp)
 846 {
 847         if (sp && sp->set)
 848         {
 849                 if (sp->port_min == sp->port_max)
 850                         fw3_pr(" %s--sport %u", sp->invert ? "! " : "", sp->port_min);
 851                 else
 852                         fw3_pr(" %s--sport %u:%u",
 853                                sp->invert ? "! " : "", sp->port_min, sp->port_max);
 854         }
 855
 856         if (dp && dp->set)
 857         {
 858                 if (dp->port_min == dp->port_max)
 859                         fw3_pr(" %s--dport %u", dp->invert ? "! " : "", dp->port_min);
 860                 else
 861                         fw3_pr(" %s--dport %u:%u",
 862                                dp->invert ? "! " : "", dp->port_min, dp->port_max);
 863         }
 864 }
 865
 866 void
 867 fw3_format_mac(struct fw3_mac *mac)
 868 {
 869         if (!mac)
 870                 return;
 871
 872         fw3_pr(" -m mac %s--mac-source %s",
 873                mac->invert ? "! " : "", ether_ntoa(&mac->mac));
 874 }
 875
 876 void
 877 fw3_format_protocol(struct fw3_protocol *proto, enum fw3_family family)
 878 {
 879         uint16_t pr;
 880
 881         if (!proto)
 882                 return;
 883
 884         pr = proto->protocol;
 885
 886         if (pr == 1 && family == FW3_FAMILY_V6)
 887                 pr = 58;
 888
 889         if (proto->any)
 890                 fw3_pr(" -p all");
 891         else
 892                 fw3_pr(" %s-p %u", proto->invert ? "! " : "", pr);
 893 }
 894
 895 void
 896 fw3_format_icmptype(struct fw3_icmptype *icmp, enum fw3_family family)
 897 {
 898         if (!icmp)
 899                 return;
 900
 901         if (family != FW3_FAMILY_V6)
 902         {
 903                 if (icmp->code_min == 0 && icmp->code_max == 0xFF)
 904                         fw3_pr(" %s--icmp-type %u", icmp->invert ? "! " : "", icmp->type);
 905                 else
 906                         fw3_pr(" %s--icmp-type %u/%u",
 907                                    icmp->invert ? "! " : "", icmp->type, icmp->code_min);
 908         }
 909         else
 910         {
 911                 if (icmp->code6_min == 0 && icmp->code6_max == 0xFF)
 912                         fw3_pr(" %s--icmpv6-type %u", icmp->invert ? "! " : "", icmp->type6);
 913                 else
 914                         fw3_pr(" %s--icmpv6-type %u/%u",
 915                                    icmp->invert ? "! " : "", icmp->type6, icmp->code6_min);
 916         }
 917 }
 918
 919 void
 920 fw3_format_limit(struct fw3_limit *limit)
 921 {
 922         if (!limit)
 923                 return;
 924
 925         const char *units[] = {
 926                 [FW3_LIMIT_UNIT_SECOND] = "second",
 927                 [FW3_LIMIT_UNIT_MINUTE] = "minute",
 928                 [FW3_LIMIT_UNIT_HOUR]   = "hour",
 929                 [FW3_LIMIT_UNIT_DAY]    = "day",
 930         };
 931
 932         if (limit->rate > 0)
 933         {
 934                 fw3_pr(" -m limit %s--limit %u/%s",
 935                        limit->invert ? "! " : "", limit->rate, units[limit->unit]);
 936
 937                 if (limit->burst > 0)
 938                         fw3_pr(" --limit-burst %u", limit->burst);
 939         }
 940 }
 941
 942 void
 943 fw3_format_ipset(struct fw3_ipset *ipset, bool invert)
 944 {
 945         bool first = true;
 946         const char *name = NULL;
 947         struct fw3_ipset_datatype *type;
 948
 949         if (!ipset)
 950                 return;
 951
 952         if (ipset->external && *ipset->external)
 953                 name = ipset->external;
 954         else
 955                 name = ipset->name;
 956
 957         fw3_pr(" -m set %s--match-set %s", invert ? "! " : "", name);
 958
 959         list_for_each_entry(type, &ipset->datatypes, list)
 960         {
 961                 fw3_pr("%c%s", first ? ' ' : ',', type->dest ? "dst" : "src");
 962                 first = false;
 963         }
 964 }
 965
 966 void
 967 fw3_format_time(struct fw3_time *time)
 968 {
 969         int i;
 970         struct tm empty = { 0 };
 971         char buf[sizeof("9999-99-99T23:59:59\0")];
 972         bool d1 = memcmp(&time->datestart, &empty, sizeof(empty));
 973         bool d2 = memcmp(&time->datestop, &empty, sizeof(empty));
 974         bool first;
 975
 976         if (!d1 && !d2 && !time->timestart && !time->timestop &&
 977             !(time->monthdays & 0xFFFFFFFE) && !(time->weekdays & 0xFE))
 978         {
 979                 return;
 980         }
 981
 982         fw3_pr(" -m time");
 983
 984         if (time->utc)
 985                 fw3_pr(" --utc");
 986
 987         if (d1)
 988         {
 989                 strftime(buf, sizeof(buf), "%Y-%m-%dT%H:%M:%S", &time->datestart);
 990                 fw3_pr(" --datestart %s", buf);
 991         }
 992
 993         if (d2)
 994         {
 995                 strftime(buf, sizeof(buf), "%Y-%m-%dT%H:%M:%S", &time->datestop);
 996                 fw3_pr(" --datestop %s", buf);
 997         }
 998
 999         if (time->timestart)
1000         {
1001                 fw3_pr(" --timestart %02d:%02d:%02d",
1002                        time->timestart / 3600,
1003                        time->timestart % 3600 / 60,
1004                        time->timestart % 60);
1005         }
1006
1007         if (time->timestop)
1008         {
1009                 fw3_pr(" --timestop %02d:%02d:%02d",
1010                        time->timestop / 3600,
1011                        time->timestop % 3600 / 60,
1012                        time->timestop % 60);
1013         }
1014
1015         if (time->monthdays & 0xFFFFFFFE)
1016         {
1017                 fw3_pr(" %s--monthdays", (time->monthdays & 1) ? "! " : "");
1018
1019                 for (i = 1, first = true; i < 32; i++)
1020                 {
1021                         if (hasbit(time->monthdays, i))
1022                         {
1023                                 fw3_pr("%c%u", first ? ' ' : ',', i);
1024                                 first = false;
1025                         }
1026                 }
1027         }
1028
1029         if (time->weekdays & 0xFE)
1030         {
1031                 fw3_pr(" %s--weekdays", (time->weekdays & 1) ? "! " : "");
1032
1033                 for (i = 1, first = true; i < 8; i++)
1034                 {
1035                         if (hasbit(time->weekdays, i))
1036                         {
1037                                 fw3_pr("%c%u", first ? ' ' : ',', i);
1038                                 first = false;
1039                         }
1040                 }
1041         }
1042 }
1043
1044 void
1045 __fw3_format_comment(const char *comment, ...)
1046 {
1047         va_list ap;
1048         int len = 0;
1049         const char *c;
1050
1051         if (!comment || !*comment)
1052                 return;
1053
1054         fw3_pr(" -m comment --comment \"");
1055
1056         c = comment;
1057
1058         va_start(ap, comment);
1059
1060         do
1061         {
1062                 while (*c)
1063                 {
1064                         switch (*c)
1065                         {
1066                         case '"':
1067                         case '$':
1068                         case '`':
1069                         case '\\':
1070                                 fw3_pr("\\");
1071                                 /* fall through */
1072
1073                         default:
1074                                 fw3_pr("%c", *c);
1075                                 break;
1076                         }
1077
1078                         c++;
1079
1080                         if (len++ >= 255)
1081                                 goto end;
1082                 }
1083
1084                 c = va_arg(ap, const char *);
1085         }
1086         while (c);
1087
1088 end:
1089         va_end(ap);
1090         fw3_pr("\"");
1091 }
1092
1093 void
1094 fw3_format_extra(const char *extra)
1095 {
1096         if (!extra || !*extra)
1097                 return;
1098
1099         fw3_pr(" %s", extra);
1100 }