Add drop target for FirewallRule

Use an enum for the target list

Signed-off-by: Etienne CHAMPETIER <etienne.champetier@free.fr>

Author: champtar

src/conf.c

@@ -467,7 +467,7 @@ static int
 _parse_firewall_rule(const char *ruleset, char *leftover)
 {
 	int i;
-	int block_allow = 0; /**< 0 == block, 1 == allow, 2 == log, 3 == ulog */
+	t_firewall_target target = TARGET_REJECT; /**< firewall target */
 	int all_nums = 1; /**< If 0, port contained non-numerics */
 	int finished = 0; /**< reached end of line */
 	char *token = NULL; /**< First word */
@@ -491,16 +491,18 @@ _parse_firewall_rule(const char *ruleset, char *leftover)
 
 	/* Parse token */
 	if (!strcasecmp(token, "block") || finished) {
-		block_allow = 0;
+		target = TARGET_REJECT;
+	} else if (!strcasecmp(token, "drop")) {
+		target = TARGET_DROP;
 	} else if (!strcasecmp(token, "allow")) {
-		block_allow = 1;
+		target = TARGET_ACCEPT;
 	} else if (!strcasecmp(token, "log")) {
-		block_allow = 2;
+		target = TARGET_LOG;
 	} else if (!strcasecmp(token, "ulog")) {
-		block_allow = 3;
+		target = TARGET_ULOG;
 	} else {
 		debug(LOG_ERR, "Invalid rule type %s, expecting "
-				"\"block\",\"allow\",\"log\" or \"ulog\"", token);
+				"\"block\",\"drop\",\"allow\",\"log\" or \"ulog\"", token);
 		return -1;
 	}
 
@@ -556,7 +558,7 @@ _parse_firewall_rule(const char *ruleset, char *leftover)
 	/* Generate rule record */
 	tmp = safe_malloc(sizeof(t_firewall_rule));
 	memset((void *)tmp, 0, sizeof(t_firewall_rule));
-	tmp->block_allow = block_allow;
+	tmp->target = target;
 	if (protocol != NULL)
 		tmp->protocol = safe_strdup(protocol);
 	if (port != NULL)

src/conf.h

@@ -89,11 +89,22 @@ typedef struct _auth_serv_t {
     struct _auth_serv_t *next;
 } t_auth_serv;
 
+/**
+ * Firewall targets
+ */
+typedef enum {
+    TARGET_DROP,
+    TARGET_REJECT,
+    TARGET_ACCEPT,
+    TARGET_LOG,
+    TARGET_ULOG
+} t_firewall_target;
+
 /**
  * Firewall rules
  */
 typedef struct _firewall_rule_t {
-    int block_allow;		/**< @brief 0 = Block rule, 1 = Allow rule, 2 = Log Rule, 3 = Ulog Rule */
+    t_firewall_target target;	/**< @brief t_firewall_target */
     char *protocol;		/**< @brief tcp, udp, etc ... */
     char *port;			/**< @brief Port to block/allow */
     char *mask;			/**< @brief Mask for the rule *destination* */

src/fw_iptables.c

@@ -141,14 +141,22 @@ iptables_compile(const char * table, const char *chain, const t_firewall_rule *r
 
 	memset(command, 0, MAX_BUF);
 
-	if (rule->block_allow == 1) {
+	switch (rule->target){
+	case TARGET_DROP:
+		mode = safe_strdup("DROP");
+		break;
+	case TARGET_REJECT:
+		mode = safe_strdup("REJECT");
+		break;
+	case TARGET_ACCEPT:
 		mode = safe_strdup("ACCEPT");
-	} else if (rule->block_allow == 2) {
+		break;
+	case TARGET_LOG:
 		mode = safe_strdup("LOG");
-	} else if (rule->block_allow == 3) {
+		break;
+	case TARGET_ULOG:
 		mode = safe_strdup("ULOG");
-	} else {
-		mode = safe_strdup("REJECT");
+		break;
 	}
 
 	snprintf(command, sizeof(command),  "-t %s -A %s ",table, chain);

wifidog.conf

@@ -182,6 +182,10 @@ ClientTimeout 5
 # 
 # Used for rules to be applied to all other rulesets except locked.
 FirewallRuleSet global {
+
+    # FirewallRule syntax:
+    # FirewallRule (block|drop|allow|log|ulog) [(tcp|udp|icmp) [port X]] [to IP/CIDR]
+
     ## To block SMTP out, as it's a tech support nightmare, and a legal liability
     #FirewallRule block tcp port 25