diff options
Diffstat (limited to 'fw/src/rules.c')
| -rw-r--r-- | fw/src/rules.c | 39 |
1 files changed, 21 insertions, 18 deletions
diff --git a/fw/src/rules.c b/fw/src/rules.c index 55de9cb..b5992b0 100644 --- a/fw/src/rules.c +++ b/fw/src/rules.c @@ -397,44 +397,47 @@ fmthits(char *buf, long nbuf) return p - buf; } -char* -matchrule(int verb, char *proto, uchar *ip, int anyip, int port, int lport, Rule **rp) +int +matchrule(Match *m) { uchar net[IPaddrlen], rnet[IPaddrlen]; - static char err[128]; Rule *r; - if(rp != nil) - *rp = nil; + m->nr = 0; + m->log = 0; lock(&rulelock); for(r = rules; r != nil; r = r->next){ - if(r->verb != Vany && r->verb != verb) + if(r->verb != Vany && r->verb != m->verb) continue; - if(r->proto != nil && (proto == nil || strcmp(r->proto, proto) != 0)) + if(r->proto != nil + && (m->proto == nil || strcmp(r->proto, m->proto) != 0)) continue; - if(r->port >= 0 && r->port != port) + if(r->port >= 0 && r->port != m->port) continue; - if(r->lport >= 0 && r->lport != lport) + if(r->lport >= 0 && r->lport != m->lport) continue; if(!r->anyip){ - if(anyip) /* a wildcard request cannot match a specific rule */ + if(m->anyip) /* a wildcard request cannot match a specific rule */ continue; - maskip(ip, r->mask, net); + maskip(m->ip, r->mask, net); maskip(r->ip, r->mask, rnet); if(ipcmp(net, rnet) != 0) continue; } - if(rp != nil) - *rp = r; - r->hits++; + m->nr = r->nr; + m->log = r->log; + if(m->count) + r->hits++; if(r->allow){ unlock(&rulelock); - return nil; + m->err[0] = '\0'; + return 1; } - snprint(err, sizeof err, "denied by rule %d", r->nr); unlock(&rulelock); - return err; + snprint(m->err, sizeof m->err, "denied by rule %d", r->nr); + return 0; } unlock(&rulelock); - return "denied, no rule matched"; + snprint(m->err, sizeof m->err, "denied, no rule matched"); + return 0; } |