From: Jo-Philipp Wich Date: Mon, 11 Mar 2013 11:46:32 +0000 (+0100) Subject: Rework zone flush logic X-Git-Url: https://git.librecmc.org/?a=commitdiff_plain;h=16037f5d804ef952d61f93d09d7f9f0060072401;p=oweals%2Ffirewall3.git Rework zone flush logic --- diff --git a/defaults.c b/defaults.c index 7c04f10..8bf1aa3 100644 --- a/defaults.c +++ b/defaults.c @@ -33,10 +33,10 @@ static const struct chain default_chains[] = { C(ANY, FILTER, UNSPEC, "delegate_input"), C(ANY, FILTER, UNSPEC, "delegate_output"), C(ANY, FILTER, UNSPEC, "delegate_forward"), + C(ANY, FILTER, UNSPEC, "reject"), C(ANY, FILTER, CUSTOM_CHAINS, "input_rule"), C(ANY, FILTER, CUSTOM_CHAINS, "output_rule"), C(ANY, FILTER, CUSTOM_CHAINS, "forwarding_rule"), - C(ANY, FILTER, UNSPEC, "reject"), C(ANY, FILTER, SYN_FLOOD, "syn_flood"), C(V4, NAT, UNSPEC, "delegate_prerouting"), @@ -88,11 +88,15 @@ const struct fw3_option fw3_default_opts[] = { static bool print_chains(enum fw3_table table, enum fw3_family family, - const char *fmt, uint32_t flags, + const char *fmt, uint32_t *flags, uint32_t mask, const struct chain *chains, int n) { bool rv = false; const struct chain *c; + uint32_t f = flags ? flags[family == FW3_FAMILY_V6] : 0; + + if (mask) + f &= mask; for (c = chains; n > 0; c++, n--) { @@ -102,7 +106,7 @@ print_chains(enum fw3_table table, enum fw3_family family, if (c->table != table) continue; - if ((c->flag != FW3_DEFAULT_UNSPEC) && !hasbit(flags, c->flag)) + if ((c->flag != FW3_DEFAULT_UNSPEC) && !hasbit(f, c->flag)) continue; fw3_pr(fmt, c->name); @@ -143,8 +147,6 @@ fw3_load_defaults(struct fw3_state *state, struct uci_package *p) defs->tcp_window_scaling = true; defs->custom_chains = true; - setbit(defs->flags, FW3_FAMILY_V4); - uci_foreach_element(&p->sections, e) { s = uci_to_section(e); @@ -163,28 +165,23 @@ fw3_load_defaults(struct fw3_state *state, struct uci_package *p) check_policy(e, &defs->policy_input, "input"); check_policy(e, &defs->policy_output, "output"); check_policy(e, &defs->policy_forward, "forward"); - - if (!defs->disable_ipv6) - setbit(defs->flags, FW3_FAMILY_V6); - - if (defs->custom_chains) - setbit(defs->flags, FW3_DEFAULT_CUSTOM_CHAINS); - - if (defs->syn_flood) - setbit(defs->flags, FW3_DEFAULT_SYN_FLOOD); } } void fw3_print_default_chains(enum fw3_table table, enum fw3_family family, - struct fw3_state *state) + bool reload, struct fw3_state *state) { + bool rv; struct fw3_defaults *defs = &state->defaults; uint32_t custom_mask = ~0; #define policy(t) \ ((t == FW3_TARGET_REJECT) ? "DROP" : fw3_flag_names[t]) + if (family == FW3_FAMILY_V6 && defs->disable_ipv6) + return; + if (table == FW3_TABLE_FILTER) { fw3_pr(":INPUT %s [0:0]\n", policy(defs->policy_input)); @@ -192,17 +189,26 @@ fw3_print_default_chains(enum fw3_table table, enum fw3_family family, fw3_pr(":OUTPUT %s [0:0]\n", policy(defs->policy_output)); } - /* user chains already loaded, don't create again */ - if (hasbit(state->defaults.running_flags, FW3_DEFAULT_CUSTOM_CHAINS)) + /* Don't touch user chains on reload */ + if (reload) delbit(custom_mask, FW3_DEFAULT_CUSTOM_CHAINS); - print_chains(table, family, ":%s - [0:0]\n", defs->flags & custom_mask, - default_chains, ARRAY_SIZE(default_chains)); + if (defs->custom_chains) + set(defs->flags, family, FW3_DEFAULT_CUSTOM_CHAINS); + + if (defs->syn_flood) + set(defs->flags, family, FW3_DEFAULT_SYN_FLOOD); + + rv = print_chains(table, family, ":%s - [0:0]\n", defs->flags, custom_mask, + default_chains, ARRAY_SIZE(default_chains)); + + if (rv) + set(defs->flags, family, table); } void fw3_print_default_head_rules(enum fw3_table table, enum fw3_family family, - struct fw3_state *state) + bool reload, struct fw3_state *state) { int i; struct fw3_defaults *defs = &state->defaults; @@ -212,7 +218,7 @@ fw3_print_default_head_rules(enum fw3_table table, enum fw3_family family, "forward", "forwarding", }; - print_chains(table, family, "-A %s\n", 0, + print_chains(table, family, "-A %s\n", NULL, 0, toplevel_rules, ARRAY_SIZE(toplevel_rules)); switch (table) @@ -278,7 +284,7 @@ fw3_print_default_head_rules(enum fw3_table table, enum fw3_family family, void fw3_print_default_tail_rules(enum fw3_table table, enum fw3_family family, - struct fw3_state *state) + bool reload, struct fw3_state *state) { struct fw3_defaults *defs = &state->defaults; @@ -336,36 +342,37 @@ reset_policy(enum fw3_table table, enum fw3_target policy) void fw3_flush_rules(enum fw3_table table, enum fw3_family family, - bool pass2, struct fw3_state *state, enum fw3_target policy) + bool pass2, bool reload, struct fw3_state *state) { struct fw3_defaults *defs = &state->defaults; uint32_t custom_mask = ~0; - if (!hasbit(defs->running_flags, family)) + if (!has(defs->flags, family, table)) return; /* don't touch user chains on selective stop */ - delbit(custom_mask, FW3_DEFAULT_CUSTOM_CHAINS); + if (reload) + delbit(custom_mask, FW3_DEFAULT_CUSTOM_CHAINS); if (!pass2) { - reset_policy(table, policy); + reset_policy(table, reload ? FW3_TARGET_DROP : FW3_TARGET_ACCEPT); print_chains(table, family, "-D %s\n", - defs->running_flags & custom_mask, + defs->flags, custom_mask, toplevel_rules, ARRAY_SIZE(toplevel_rules)); print_chains(table, family, "-F %s\n", - defs->running_flags & custom_mask, + defs->flags, custom_mask, default_chains, ARRAY_SIZE(default_chains)); } else { print_chains(table, family, "-X %s\n", - defs->running_flags & custom_mask, + defs->flags, custom_mask, default_chains, ARRAY_SIZE(default_chains)); - delbit(defs->flags, family); + del(defs->flags, family, table); } } diff --git a/defaults.h b/defaults.h index 9547ace..00144db 100644 --- a/defaults.h +++ b/defaults.h @@ -26,19 +26,18 @@ extern const struct fw3_option fw3_default_opts[]; void fw3_load_defaults(struct fw3_state *state, struct uci_package *p); void fw3_print_default_chains(enum fw3_table table, enum fw3_family family, - struct fw3_state *state); + bool reload, struct fw3_state *state); void fw3_print_default_head_rules(enum fw3_table table, enum fw3_family family, - struct fw3_state *state); + bool reload, struct fw3_state *state); void fw3_print_default_tail_rules(enum fw3_table table, enum fw3_family family, - struct fw3_state *state); + bool reload, struct fw3_state *state); void fw3_set_defaults(struct fw3_state *state); void fw3_flush_rules(enum fw3_table table, enum fw3_family family, - bool pass2, struct fw3_state *state, - enum fw3_target policy); + bool pass2, bool reload, struct fw3_state *state); void fw3_flush_all(enum fw3_table table); diff --git a/forwards.c b/forwards.c index babf5e8..b7e056f 100644 --- a/forwards.c +++ b/forwards.c @@ -86,9 +86,11 @@ fw3_load_forwards(struct fw3_state *state, struct uci_package *p) continue; } + /* NB: forward family... */ if (forward->_dest) { - setbit(forward->_dest->flags, FW3_TARGET_ACCEPT); + setbit(forward->_dest->flags[0], FW3_TARGET_ACCEPT); + setbit(forward->_dest->flags[1], FW3_TARGET_ACCEPT); if (forward->_src && (forward->_src->conntrack || forward->_dest->conntrack)) diff --git a/ipsets.c b/ipsets.c index 74706ff..48aaa9c 100644 --- a/ipsets.c +++ b/ipsets.c @@ -379,9 +379,9 @@ fw3_destroy_ipsets(struct fw3_state *state, enum fw3_family family) list_for_each_entry_safe(s, tmp, &state->running_ipsets, running_list) { - delbit(s->running_flags, family); + del(s->flags, family, family); - if (fw3_no_family(s->running_flags)) + if (fw3_no_family(s->flags[family == FW3_FAMILY_V6])) { info(" * Deleting ipset %s", s->name); diff --git a/main.c b/main.c index 47951e6..c1f6505 100644 --- a/main.c +++ b/main.c @@ -135,7 +135,7 @@ restore_pipe(enum fw3_family family, bool silent) static bool family_running(struct fw3_state *state, enum fw3_family family) { - return hasbit(state->defaults.running_flags, family); + return has(state->defaults.flags, family, family); } static bool @@ -144,19 +144,13 @@ family_used(enum fw3_family family) return (use_family == FW3_FAMILY_ANY) || (use_family == family); } -static bool -family_loaded(struct fw3_state *state, enum fw3_family family) -{ - return hasbit(state->defaults.flags, family); -} - static void family_set(struct fw3_state *state, enum fw3_family family, bool set) { if (set) - setbit(state->defaults.flags, family); + set(state->defaults.flags, family, family); else - delbit(state->defaults.flags, family); + del(state->defaults.flags, family, family); } static int @@ -167,7 +161,6 @@ stop(struct fw3_state *state, bool complete, bool reload) int rv = 1; enum fw3_family family; enum fw3_table table; - enum fw3_target policy = reload ? FW3_TARGET_DROP : FW3_TARGET_ACCEPT; if (!complete && !state->statefile) { @@ -203,11 +196,11 @@ stop(struct fw3_state *state, bool complete, bool reload) else { /* pass 1 */ - fw3_flush_rules(table, family, false, state, policy); + fw3_flush_rules(table, family, false, reload, state); fw3_flush_zones(table, family, false, reload, state); /* pass 2 */ - fw3_flush_rules(table, family, true, state, policy); + fw3_flush_rules(table, family, true, reload, state); fw3_flush_zones(table, family, true, reload, state); } @@ -274,7 +267,7 @@ start(struct fw3_state *state, bool reload) continue; } - if (!family_loaded(state, family) || !restore_pipe(family, false)) + if (!restore_pipe(family, false)) continue; for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++) @@ -286,14 +279,14 @@ start(struct fw3_state *state, bool reload) fw3_flag_names[family], fw3_flag_names[table]); fw3_pr("*%s\n", fw3_flag_names[table]); - fw3_print_default_chains(table, family, state); - fw3_print_zone_chains(table, family, state); - fw3_print_default_head_rules(table, family, state); + fw3_print_default_chains(table, family, reload, state); + fw3_print_zone_chains(table, family, reload, state); + fw3_print_default_head_rules(table, family, reload, state); fw3_print_rules(table, family, state); fw3_print_redirects(table, family, state); fw3_print_forwards(table, family, state); - fw3_print_zone_rules(table, family, state); - fw3_print_default_tail_rules(table, family, state); + fw3_print_zone_rules(table, family, reload, state); + fw3_print_default_tail_rules(table, family, reload, state); fw3_pr("COMMIT\n"); } diff --git a/options.h b/options.h index 0bfb3e8..9422f81 100644 --- a/options.h +++ b/options.h @@ -73,17 +73,16 @@ enum fw3_target FW3_TARGET_SRC_ACCEPT = 12, FW3_TARGET_SRC_REJECT = 13, FW3_TARGET_SRC_DROP = 14, - FW3_TARGET_CUSTOM_CNS_V4 = 15, - FW3_TARGET_CUSTOM_CNS_V6 = 16, + FW3_TARGET_CUSTOM_CHAINS = 15, }; enum fw3_default { FW3_DEFAULT_UNSPEC = 0, - FW3_DEFAULT_CUSTOM_CHAINS = 17, - FW3_DEFAULT_SYN_FLOOD = 18, - FW3_DEFAULT_MTU_FIX = 19, - FW3_DEFAULT_DROP_INVALID = 20, + FW3_DEFAULT_CUSTOM_CHAINS = 16, + FW3_DEFAULT_SYN_FLOOD = 17, + FW3_DEFAULT_MTU_FIX = 18, + FW3_DEFAULT_DROP_INVALID = 19, }; extern const char *fw3_flag_names[FW3_DEFAULT_DROP_INVALID + 1]; @@ -242,8 +241,7 @@ struct fw3_defaults bool disable_ipv6; - uint32_t flags; - uint32_t running_flags; + uint32_t flags[2]; }; struct fw3_zone @@ -279,8 +277,7 @@ struct fw3_zone bool custom_chains; - uint32_t flags; - uint32_t running_flags; + uint32_t flags[2]; }; struct fw3_rule @@ -398,8 +395,7 @@ struct fw3_ipset const char *external; - uint32_t flags; - uint32_t running_flags; + uint32_t flags[2]; }; struct fw3_include diff --git a/redirects.c b/redirects.c index 23dc034..7cd26c8 100644 --- a/redirects.c +++ b/redirects.c @@ -203,16 +203,16 @@ fw3_load_redirects(struct fw3_state *state, struct uci_package *p) warn_elem(e, "has no source specified"); else { - setbit(redir->_src->flags, redir->target); + set(redir->_src->flags, FW3_FAMILY_V4, redir->target); redir->_src->conntrack = true; valid = true; } if (redir->reflection && redir->_dest && redir->_src->masq) { - setbit(redir->_dest->flags, FW3_TARGET_ACCEPT); - setbit(redir->_dest->flags, FW3_TARGET_DNAT); - setbit(redir->_dest->flags, FW3_TARGET_SNAT); + set(redir->_dest->flags, FW3_FAMILY_V4, FW3_TARGET_ACCEPT); + set(redir->_dest->flags, FW3_FAMILY_V4, FW3_TARGET_DNAT); + set(redir->_dest->flags, FW3_FAMILY_V4, FW3_TARGET_SNAT); } } else @@ -225,7 +225,7 @@ fw3_load_redirects(struct fw3_state *state, struct uci_package *p) warn_elem(e, "has no src_dip option specified"); else { - setbit(redir->_dest->flags, redir->target); + set(redir->_dest->flags, FW3_FAMILY_V4, redir->target); redir->_dest->conntrack = true; valid = true; } @@ -357,7 +357,7 @@ print_redirect(enum fw3_table table, enum fw3_family family, return; } - setbit(redir->_ipset->flags, family); + set(redir->_ipset->flags, family, family); } fw3_foreach(proto, &redir->proto) diff --git a/rules.c b/rules.c index 77fe998..de6ddc9 100644 --- a/rules.c +++ b/rules.c @@ -161,8 +161,12 @@ fw3_load_rules(struct fw3_state *state, struct uci_package *p) rule->target = FW3_TARGET_REJECT; } + /* NB: rule family... */ if (rule->_dest) - setbit(rule->_dest->flags, rule->target); + { + setbit(rule->_dest->flags[0], rule->target); + setbit(rule->_dest->flags[1], rule->target); + } list_add_tail(&rule->list, &state->rules); continue; @@ -312,7 +316,7 @@ expand_rule(enum fw3_table table, enum fw3_family family, return; } - setbit(rule->_ipset->flags, family); + set(rule->_ipset->flags, family, family); } list_for_each_entry(proto, &rule->proto, list) diff --git a/utils.c b/utils.c index ab1d68b..7f2dd64 100644 --- a/utils.c +++ b/utils.c @@ -356,7 +356,7 @@ fw3_read_statefile(void *state) char line[128]; const char *p, *name; - uint32_t flags; + uint32_t flags[2]; struct fw3_state *s = state; struct fw3_zone *zone; @@ -380,17 +380,21 @@ fw3_read_statefile(void *state) if (!name) continue; - p = strtok(NULL, " \t\n"); + if (!(p = strtok(NULL, " \t\n"))) + continue; - if (!p) + flags[0] = strtoul(p, NULL, 16); + + if (!(p = strtok(NULL, " \t\n"))) continue; - flags = strtoul(p, NULL, 16); + flags[1] = strtoul(p, NULL, 16); switch (type) { case FW3_TYPE_DEFAULTS: - s->defaults.running_flags = flags; + s->defaults.flags[0] = flags[0]; + s->defaults.flags[1] = flags[1]; break; case FW3_TYPE_ZONE: @@ -405,7 +409,8 @@ fw3_read_statefile(void *state) list_add_tail(&zone->list, &s->zones); } - zone->running_flags = flags; + zone->flags[0] = flags[0]; + zone->flags[1] = flags[1]; list_add_tail(&zone->running_list, &s->running_zones); break; @@ -421,7 +426,8 @@ fw3_read_statefile(void *state) list_add_tail(&ipset->list, &s->ipsets); } - ipset->running_flags = flags; + ipset->flags[0] = flags[0]; + ipset->flags[1] = flags[1]; list_add_tail(&ipset->running_list, &s->running_ipsets); break; } @@ -441,7 +447,7 @@ fw3_write_statefile(void *state) struct fw3_zone *z; struct fw3_ipset *i; - if (fw3_no_family(d->flags)) + if (fw3_no_table(d->flags[0]) && fw3_no_table(d->flags[1])) { if (unlink(FW3_STATEFILE)) warn("Unable to remove state %s: %s", @@ -458,16 +464,24 @@ fw3_write_statefile(void *state) return; } - fprintf(sf, "%x - %x\n", FW3_TYPE_DEFAULTS, d->flags); + fprintf(sf, "%x - %x %x\n", FW3_TYPE_DEFAULTS, d->flags[0], d->flags[1]); list_for_each_entry(z, &s->running_zones, running_list) { - fprintf(sf, "%x %s %x\n", FW3_TYPE_ZONE, z->name, z->flags); + if (!fw3_no_table(z->flags[0]) || !fw3_no_table(z->flags[1])) + { + fprintf(sf, "%x %s %x %x\n", + FW3_TYPE_ZONE, z->name, z->flags[0], z->flags[1]); + } } list_for_each_entry(i, &s->running_ipsets, running_list) { - fprintf(sf, "%x %s %x\n", FW3_TYPE_IPSET, i->name, i->flags); + if (!fw3_no_family(i->flags[0]) || !fw3_no_family(i->flags[1])) + { + fprintf(sf, "%x %s %x %x\n", + FW3_TYPE_IPSET, i->name, i->flags[0], i->flags[1]); + } } fclose(sf); diff --git a/utils.h b/utils.h index c3dc974..77d0d73 100644 --- a/utils.h +++ b/utils.h @@ -46,6 +46,10 @@ void info(const char *format, ...); #define delbit(field, flag) field &= ~(1 << (flag)) #define hasbit(field, flag) (field & (1 << (flag))) +#define set(field, family, flag) setbit(field[family == FW3_FAMILY_V6], flag) +#define del(field, family, flag) delbit(field[family == FW3_FAMILY_V6], flag) +#define has(field, family, flag) hasbit(field[family == FW3_FAMILY_V6], flag) + #define fw3_foreach(p, h) \ for (p = list_empty(h) ? NULL : list_first_entry(h, typeof(*p), list); \ list_empty(h) ? (p == NULL) : (&p->list != (h)); \ @@ -58,6 +62,11 @@ void info(const char *format, ...); #define fw3_no_family(flags) \ (!(flags & ((1 << FW3_FAMILY_V4) | (1 << FW3_FAMILY_V6)))) +#define fw3_no_table(flags) \ + (!(flags & ((1< 0; c++, n--) { @@ -126,7 +122,7 @@ print_chains(enum fw3_table table, enum fw3_family family, if (c->table != table) continue; - if ((c->target != FW3_TARGET_UNSPEC) && !hasbit(targets, c->target)) + if ((c->target != FW3_TARGET_UNSPEC) && !hasbit(t, c->target)) continue; snprintf(cn, sizeof(cn), c->name, name); @@ -255,19 +251,23 @@ fw3_load_zones(struct fw3_state *state, struct uci_package *p) if (zone->masq) { - setbit(zone->flags, FW3_TARGET_SNAT); + setbit(zone->flags[0], FW3_TARGET_SNAT); zone->conntrack = true; } if (zone->custom_chains) { - setbit(zone->flags, FW3_TARGET_SNAT); - setbit(zone->flags, FW3_TARGET_DNAT); + setbit(zone->flags[0], FW3_TARGET_SNAT); + setbit(zone->flags[0], FW3_TARGET_DNAT); } - setbit(zone->flags, fw3_to_src_target(zone->policy_input)); - setbit(zone->flags, zone->policy_output); - setbit(zone->flags, zone->policy_forward); + setbit(zone->flags[0], fw3_to_src_target(zone->policy_input)); + setbit(zone->flags[0], zone->policy_output); + setbit(zone->flags[0], zone->policy_forward); + + setbit(zone->flags[1], fw3_to_src_target(zone->policy_input)); + setbit(zone->flags[1], zone->policy_output); + setbit(zone->flags[1], zone->policy_forward); list_add_tail(&zone->list, &state->zones); } @@ -276,52 +276,47 @@ fw3_load_zones(struct fw3_state *state, struct uci_package *p) static void print_zone_chain(enum fw3_table table, enum fw3_family family, - struct fw3_zone *zone, struct fw3_state *state) + struct fw3_zone *zone, bool reload, struct fw3_state *state) { - bool s, d, r; - enum fw3_target f; + bool c, r; uint32_t custom_mask = ~0; if (!fw3_is_family(zone, family)) return; - setbit(zone->flags, family); + set(zone->flags, family, table); - /* user chains already loaded, don't create again */ - for (f = FW3_TARGET_CUSTOM_CNS_V4; f <= FW3_TARGET_CUSTOM_CNS_V6; f++) - if (hasbit(zone->running_flags, f)) - delbit(custom_mask, f); + /* Don't touch user chains on reload */ + if (reload) + delbit(custom_mask, FW3_TARGET_CUSTOM_CHAINS); if (zone->custom_chains) - setbit(zone->flags, (family == FW3_FAMILY_V4) ? - FW3_TARGET_CUSTOM_CNS_V4 : FW3_TARGET_CUSTOM_CNS_V6); + set(zone->flags, family, FW3_TARGET_CUSTOM_CHAINS); if (!zone->conntrack && !state->defaults.drop_invalid) - setbit(zone->flags, FW3_TARGET_NOTRACK); - - s = print_chains(table, family, ":%s - [0:0]\n", zone->name, - zone->flags, - src_chains, ARRAY_SIZE(src_chains)); + set(zone->flags, family, FW3_TARGET_NOTRACK); - d = print_chains(table, family, ":%s - [0:0]\n", zone->name, - zone->flags & custom_mask, - dst_chains, ARRAY_SIZE(dst_chains)); + c = print_chains(table, family, ":%s - [0:0]\n", zone->name, + zone->flags, custom_mask, + zone_chains, ARRAY_SIZE(zone_chains)); r = print_chains(table, family, "-A %s\n", zone->name, - zone->flags, - def_rules, ARRAY_SIZE(def_rules)); + zone->flags, 0, + zone_rules, ARRAY_SIZE(zone_rules)); - if (s || d || r) + if (c || r) { info(" * Zone '%s'", zone->name); fw3_set_running(zone, &state->running_zones); + + set(zone->flags, family, table); } } static void print_interface_rule(enum fw3_table table, enum fw3_family family, struct fw3_zone *zone, struct fw3_device *dev, - struct fw3_address *sub, bool disable_notrack) + struct fw3_address *sub, bool reload, bool disable_notrack) { enum fw3_target t; @@ -332,7 +327,7 @@ print_interface_rule(enum fw3_table table, enum fw3_family family, { for (t = FW3_TARGET_ACCEPT; t <= FW3_TARGET_DROP; t++) { - if (hasbit(zone->flags, fw3_to_src_target(t))) + if (has(zone->flags, family, fw3_to_src_target(t))) { fw3_pr("-A zone_%s_src_%s", zone->name, fw3_flag_names[t]); fw3_format_in_out(dev, NULL); @@ -341,7 +336,7 @@ print_interface_rule(enum fw3_table table, enum fw3_family family, fw3_pr(" -j %s\n", jump_target(t)); } - if (hasbit(zone->flags, t)) + if (has(zone->flags, family, t)) { fw3_pr("-A zone_%s_dest_%s", zone->name, fw3_flag_names[t]); fw3_format_in_out(NULL, dev); @@ -371,7 +366,7 @@ print_interface_rule(enum fw3_table table, enum fw3_family family, } else if (table == FW3_TABLE_NAT) { - if (hasbit(zone->flags, FW3_TARGET_DNAT)) + if (has(zone->flags, family, FW3_TARGET_DNAT)) { fw3_pr("-A delegate_prerouting"); fw3_format_in_out(dev, NULL); @@ -380,7 +375,7 @@ print_interface_rule(enum fw3_table table, enum fw3_family family, fw3_pr(" -j zone_%s_prerouting\n", zone->name); } - if (hasbit(zone->flags, FW3_TARGET_SNAT)) + if (has(zone->flags, family, FW3_TARGET_SNAT)) { fw3_pr("-A delegate_postrouting"); fw3_format_in_out(NULL, dev); @@ -428,7 +423,7 @@ print_interface_rule(enum fw3_table table, enum fw3_family family, static void print_interface_rules(enum fw3_table table, enum fw3_family family, - struct fw3_zone *zone, bool disable_notrack) + struct fw3_zone *zone, bool reload, bool disable_notrack) { struct fw3_device *dev; struct fw3_address *sub; @@ -442,13 +437,13 @@ print_interface_rules(enum fw3_table table, enum fw3_family family, if (!dev && !sub) continue; - print_interface_rule(table, family, zone, dev, sub, disable_notrack); + print_interface_rule(table, family, zone, dev, sub, reload, disable_notrack); } } static void print_zone_rule(enum fw3_table table, enum fw3_family family, - struct fw3_zone *zone, bool disable_notrack) + struct fw3_zone *zone, bool reload, bool disable_notrack) { struct fw3_address *msrc; struct fw3_address *mdest; @@ -474,7 +469,7 @@ print_zone_rule(enum fw3_table table, enum fw3_family family, { for (t = FW3_TARGET_REJECT; t <= FW3_TARGET_DROP; t++) { - if (hasbit(zone->flags, fw3_to_src_target(t))) + if (has(zone->flags, family, fw3_to_src_target(t))) { fw3_pr("-A zone_%s_src_%s", zone->name, fw3_flag_names[t]); fw3_format_limit(&zone->log_limit); @@ -482,7 +477,7 @@ print_zone_rule(enum fw3_table table, enum fw3_family family, fw3_flag_names[t], zone->name); } - if (hasbit(zone->flags, t)) + if (has(zone->flags, family, t)) { fw3_pr("-A zone_%s_dest_%s", zone->name, fw3_flag_names[t]); fw3_format_limit(&zone->log_limit); @@ -511,27 +506,27 @@ print_zone_rule(enum fw3_table table, enum fw3_family family, break; } - print_interface_rules(table, family, zone, disable_notrack); + print_interface_rules(table, family, zone, reload, disable_notrack); } void fw3_print_zone_chains(enum fw3_table table, enum fw3_family family, - struct fw3_state *state) + bool reload, struct fw3_state *state) { struct fw3_zone *zone; list_for_each_entry(zone, &state->zones, list) - print_zone_chain(table, family, zone, state); + print_zone_chain(table, family, zone, reload, state); } void fw3_print_zone_rules(enum fw3_table table, enum fw3_family family, - struct fw3_state *state) + bool reload, struct fw3_state *state) { struct fw3_zone *zone; list_for_each_entry(zone, &state->zones, list) - print_zone_rule(table, family, zone, state->defaults.drop_invalid); + print_zone_rule(table, family, zone, reload, state->defaults.drop_invalid); } void @@ -543,30 +538,20 @@ fw3_flush_zones(enum fw3_table table, enum fw3_family family, /* don't touch user chains on selective stop */ if (reload) - { - delbit(custom_mask, FW3_TARGET_CUSTOM_CNS_V4); - delbit(custom_mask, FW3_TARGET_CUSTOM_CNS_V6); - } + delbit(custom_mask, FW3_TARGET_CUSTOM_CHAINS); list_for_each_entry_safe(z, tmp, &state->running_zones, running_list) { - if (!hasbit(z->flags, family)) + if (!has(z->flags, family, table)) continue; print_chains(table, family, pass2 ? "-X %s\n" : "-F %s\n", - z->name, z->running_flags, - src_chains, ARRAY_SIZE(src_chains)); - - print_chains(table, family, pass2 ? "-X %s\n" : "-F %s\n", - z->name, z->running_flags & custom_mask, - dst_chains, ARRAY_SIZE(dst_chains)); + z->name, z->flags, custom_mask, + zone_chains, ARRAY_SIZE(zone_chains)); if (pass2) { - delbit(z->running_flags, family); - - if (fw3_no_family(z->running_flags)) - fw3_set_running(z, NULL); + del(z->flags, family, table); } } } diff --git a/zones.h b/zones.h index 7fd8e4c..c84897b 100644 --- a/zones.h +++ b/zones.h @@ -28,10 +28,10 @@ struct fw3_zone * fw3_alloc_zone(void); void fw3_load_zones(struct fw3_state *state, struct uci_package *p); void fw3_print_zone_chains(enum fw3_table table, enum fw3_family family, - struct fw3_state *state); + bool reload, struct fw3_state *state); void fw3_print_zone_rules(enum fw3_table table, enum fw3_family family, - struct fw3_state *state); + bool reload, struct fw3_state *state); void fw3_flush_zones(enum fw3_table table, enum fw3_family family, bool pass2, bool reload, struct fw3_state *state);