• source navigation  • diff markup  • identifier search  • freetext search  • 

Sources/firewall3/zones.c

  1 /*
  2  * firewall3 - 3rd OpenWrt UCI firewall implementation
  3  *
  4  *   Copyright (C) 2013 Jo-Philipp Wich <jo@mein.io>
  5  *
  6  * Permission to use, copy, modify, and/or distribute this software for any
  7  * purpose with or without fee is hereby granted, provided that the above
  8  * copyright notice and this permission notice appear in all copies.
  9  *
 10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 17  */
 18 
 19 #include "zones.h"
 20 #include "ubus.h"
 21 #include "helpers.h"
 22 
 23 
 24 #define C(f, tbl, tgt, fmt) \
 25         { FW3_FAMILY_##f, FW3_TABLE_##tbl, FW3_FLAG_##tgt, fmt }
 26 
 27 static const struct fw3_chain_spec zone_chains[] = {
 28         C(ANY, FILTER, UNSPEC,        "zone_%s_input"),
 29         C(ANY, FILTER, UNSPEC,        "zone_%s_output"),
 30         C(ANY, FILTER, UNSPEC,        "zone_%s_forward"),
 31 
 32         C(ANY, FILTER, SRC_ACCEPT,    "zone_%s_src_ACCEPT"),
 33         C(ANY, FILTER, SRC_REJECT,    "zone_%s_src_REJECT"),
 34         C(ANY, FILTER, SRC_DROP,      "zone_%s_src_DROP"),
 35 
 36         C(ANY, FILTER, ACCEPT,        "zone_%s_dest_ACCEPT"),
 37         C(ANY, FILTER, REJECT,        "zone_%s_dest_REJECT"),
 38         C(ANY, FILTER, DROP,          "zone_%s_dest_DROP"),
 39 
 40         C(V4,  NAT,    SNAT,          "zone_%s_postrouting"),
 41         C(V4,  NAT,    DNAT,          "zone_%s_prerouting"),
 42 
 43         C(ANY, RAW,    HELPER,        "zone_%s_helper"),
 44         C(ANY, RAW,    NOTRACK,       "zone_%s_notrack"),
 45 
 46         C(ANY, FILTER, CUSTOM_CHAINS, "input_%s_rule"),
 47         C(ANY, FILTER, CUSTOM_CHAINS, "output_%s_rule"),
 48         C(ANY, FILTER, CUSTOM_CHAINS, "forwarding_%s_rule"),
 49 
 50         C(V4,  NAT,    CUSTOM_CHAINS, "prerouting_%s_rule"),
 51         C(V4,  NAT,    CUSTOM_CHAINS, "postrouting_%s_rule"),
 52 
 53         { }
 54 };
 55 
 56 enum fw3_zone_logmask {
 57         FW3_ZONE_LOG_FILTER = (1 << 0),
 58         FW3_ZONE_LOG_MANGLE = (1 << 1),
 59 };
 60 
 61 const struct fw3_option fw3_zone_opts[] = {
 62         FW3_OPT("enabled",             bool,     zone,     enabled),
 63 
 64         FW3_OPT("name",                string,   zone,     name),
 65         FW3_OPT("family",              family,   zone,     family),
 66 
 67         FW3_LIST("network",            device,   zone,     networks),
 68         FW3_LIST("device",             device,   zone,     devices),
 69         FW3_LIST("subnet",             network,  zone,     subnets),
 70 
 71         FW3_OPT("input",               target,   zone,     policy_input),
 72         FW3_OPT("forward",             target,   zone,     policy_forward),
 73         FW3_OPT("output",              target,   zone,     policy_output),
 74 
 75         FW3_OPT("masq",                bool,     zone,     masq),
 76         FW3_OPT("masq_allow_invalid",  bool,     zone,     masq_allow_invalid),
 77         FW3_LIST("masq_src",           network,  zone,     masq_src),
 78         FW3_LIST("masq_dest",          network,  zone,     masq_dest),
 79 
 80         FW3_OPT("extra",               string,   zone,     extra_src),
 81         FW3_OPT("extra_src",           string,   zone,     extra_src),
 82         FW3_OPT("extra_dest",          string,   zone,     extra_dest),
 83 
 84         FW3_OPT("mtu_fix",             bool,     zone,     mtu_fix),
 85         FW3_OPT("custom_chains",       bool,     zone,     custom_chains),
 86 
 87         FW3_OPT("log",                 int,      zone,     log),
 88         FW3_OPT("log_limit",           limit,    zone,     log_limit),
 89 
 90         FW3_OPT("auto_helper",         bool,     zone,     auto_helper),
 91         FW3_LIST("helper",             cthelper, zone,     cthelpers),
 92 
 93         FW3_OPT("__flags_v4",          int,      zone,     flags[0]),
 94         FW3_OPT("__flags_v6",          int,      zone,     flags[1]),
 95 
 96         FW3_LIST("__addrs",            address,  zone,     old_addrs),
 97 
 98         { }
 99 };
100 
101 static void
102 check_policy(struct uci_element *e, enum fw3_flag *pol, enum fw3_flag def,
103              const char *name)
104 {
105         if (*pol == FW3_FLAG_UNSPEC)
106         {
107                 warn_elem(e, "has no %s policy specified, using default", name);
108                 *pol = def;
109         }
110         else if (*pol > FW3_FLAG_DROP)
111         {
112                 warn_elem(e, "has invalid %s policy, using default", name);
113                 *pol = def;
114         }
115 }
116 
117 static bool
118 check_masq_addrs(struct list_head *head)
119 {
120         struct fw3_address *addr;
121         int n_addr = 0, n_failed = 0;
122 
123         list_for_each_entry(addr, head, list)
124         {
125                 if (addr->invert)
126                         continue;
127 
128                 n_addr++;
129 
130                 if (!addr->set && addr->resolved)
131                         n_failed++;
132         }
133 
134         return (n_addr == 0 || n_failed < n_addr);
135 }
136 
137 static void
138 resolve_networks(struct uci_element *e, struct fw3_zone *zone)
139 {
140         struct fw3_device *net, *tmp;
141 
142         list_for_each_entry(net, &zone->networks, list)
143         {
144                 tmp = fw3_ubus_device(net->name);
145 
146                 if (!tmp)
147                 {
148                         warn_elem(e, "cannot resolve device of network '%s'", net->name);
149                         continue;
150                 }
151 
152                 snprintf(tmp->network, sizeof(tmp->network), "%s", net->name);
153                 list_add_tail(&tmp->list, &zone->devices);
154         }
155 }
156 
157 static void
158 resolve_cthelpers(struct fw3_state *s, struct uci_element *e, struct fw3_zone *zone)
159 {
160         struct fw3_cthelpermatch *match;
161 
162         if (list_empty(&zone->cthelpers))
163         {
164                 if (!zone->masq && zone->auto_helper)
165                 {
166                         fw3_setbit(zone->flags[0], FW3_FLAG_HELPER);
167                         fw3_setbit(zone->flags[1], FW3_FLAG_HELPER);
168                 }
169 
170                 return;
171         }
172 
173         list_for_each_entry(match, &zone->cthelpers, list)
174         {
175                 if (match->invert)
176                 {
177                         warn_elem(e, "must not use a negated helper match");
178                         continue;
179                 }
180 
181                 match->ptr = fw3_lookup_cthelper(s, match->name);
182 
183                 if (!match->ptr)
184                 {
185                         warn_elem(e, "refers to not existing helper '%s'", match->name);
186                         continue;
187                 }
188 
189                 if (fw3_is_family(match->ptr, FW3_FAMILY_V4))
190                         fw3_setbit(zone->flags[0], FW3_FLAG_HELPER);
191 
192                 if (fw3_is_family(match->ptr, FW3_FAMILY_V6))
193                         fw3_setbit(zone->flags[1], FW3_FLAG_HELPER);
194         }
195 }
196 
197 struct fw3_zone *
198 fw3_alloc_zone(void)
199 {
200         struct fw3_zone *zone;
201 
202         zone = calloc(1, sizeof(*zone));
203         if (!zone)
204                 return NULL;
205 
206         INIT_LIST_HEAD(&zone->networks);
207         INIT_LIST_HEAD(&zone->devices);
208         INIT_LIST_HEAD(&zone->subnets);
209         INIT_LIST_HEAD(&zone->masq_src);
210         INIT_LIST_HEAD(&zone->masq_dest);
211         INIT_LIST_HEAD(&zone->cthelpers);
212 
213         INIT_LIST_HEAD(&zone->old_addrs);
214 
215         zone->enabled = true;
216         zone->auto_helper = true;
217         zone->custom_chains = true;
218         zone->log_limit.rate = 10;
219 
220         return zone;
221 }
222 
223 void
224 fw3_load_zones(struct fw3_state *state, struct uci_package *p)
225 {
226         struct uci_section *s;
227         struct uci_element *e;
228         struct fw3_zone *zone;
229         struct fw3_defaults *defs = &state->defaults;
230 
231         INIT_LIST_HEAD(&state->zones);
232 
233         uci_foreach_element(&p->sections, e)
234         {
235                 s = uci_to_section(e);
236 
237                 if (strcmp(s->type, "zone"))
238                         continue;
239 
240                 zone = fw3_alloc_zone();
241 
242                 if (!zone)
243                         continue;
244 
245                 if (!fw3_parse_options(zone, fw3_zone_opts, s))
246                         warn_elem(e, "has invalid options");
247 
248                 if (!zone->enabled)
249                 {
250                         fw3_free_zone(zone);
251                         continue;
252                 }
253 
254                 if (!zone->extra_dest)
255                         zone->extra_dest = zone->extra_src;
256 
257                 if (!defs->custom_chains && zone->custom_chains)
258                         zone->custom_chains = false;
259 
260                 if (!defs->auto_helper && zone->auto_helper)
261                         zone->auto_helper = false;
262 
263                 if (!zone->name || !*zone->name)
264                 {
265                         warn_elem(e, "has no name - ignoring");
266                         fw3_free_zone(zone);
267                         continue;
268                 }
269 
270                 if (strlen(zone->name) > FW3_ZONE_MAXNAMELEN)
271                 {
272                         warn_elem(e, "must not have a name longer than %u characters",
273                                      FW3_ZONE_MAXNAMELEN);
274                         fw3_free_zone(zone);
275                         continue;
276                 }
277 
278                 fw3_ubus_zone_devices(zone);
279 
280                 if (list_empty(&zone->networks) && list_empty(&zone->devices) &&
281                     list_empty(&zone->subnets) && !zone->extra_src)
282                 {
283                         warn_elem(e, "has no device, network, subnet or extra options");
284                 }
285 
286                 if (!check_masq_addrs(&zone->masq_src))
287                 {
288                         warn_elem(e, "has unresolved masq_src, disabling masq");
289                         zone->masq = false;
290                 }
291 
292                 if (!check_masq_addrs(&zone->masq_dest))
293                 {
294                         warn_elem(e, "has unresolved masq_dest, disabling masq");
295                         zone->masq = false;
296                 }
297 
298                 check_policy(e, &zone->policy_input, defs->policy_input, "input");
299                 check_policy(e, &zone->policy_output, defs->policy_output, "output");
300                 check_policy(e, &zone->policy_forward, defs->policy_forward, "forward");
301 
302                 resolve_networks(e, zone);
303 
304                 if (zone->masq)
305                 {
306                         fw3_setbit(zone->flags[0], FW3_FLAG_SNAT);
307                 }
308 
309                 if (zone->custom_chains)
310                 {
311                         fw3_setbit(zone->flags[0], FW3_FLAG_SNAT);
312                         fw3_setbit(zone->flags[0], FW3_FLAG_DNAT);
313                 }
314 
315                 resolve_cthelpers(state, e, zone);
316 
317                 fw3_setbit(zone->flags[0], fw3_to_src_target(zone->policy_input));
318                 fw3_setbit(zone->flags[0], zone->policy_forward);
319                 fw3_setbit(zone->flags[0], zone->policy_output);
320 
321                 fw3_setbit(zone->flags[1], fw3_to_src_target(zone->policy_input));
322                 fw3_setbit(zone->flags[1], zone->policy_forward);
323                 fw3_setbit(zone->flags[1], zone->policy_output);
324 
325                 list_add_tail(&zone->list, &state->zones);
326         }
327 }
328 
329 
330 static void
331 print_zone_chain(struct fw3_ipt_handle *handle, struct fw3_state *state,
332                  bool reload, struct fw3_zone *zone)
333 {
334         int i;
335         struct fw3_ipt_rule *r;
336         const struct fw3_chain_spec *c;
337 
338         const char *flt_chains[] = {
339                 "input",   "input",
340                 "output",  "output",
341                 "forward", "forwarding",
342         };
343 
344         const char *nat_chains[] = {
345                 "prerouting",  "prerouting",
346                 "postrouting", "postrouting",
347         };
348 
349         if (!fw3_is_family(zone, handle->family))
350                 return;
351 
352         set(zone->flags, handle->family, handle->table);
353 
354         if (zone->custom_chains)
355                 set(zone->flags, handle->family, FW3_FLAG_CUSTOM_CHAINS);
356 
357         for (c = zone_chains; c->format; c++)
358         {
359                 /* don't touch user chains on selective stop */
360                 if (reload && c->flag == FW3_FLAG_CUSTOM_CHAINS)
361                         continue;
362 
363                 if (!fw3_is_family(c, handle->family))
364                         continue;
365 
366                 if (c->table != handle->table)
367                         continue;
368 
369                 if (c->flag &&
370                     !fw3_hasbit(zone->flags[handle->family == FW3_FAMILY_V6], c->flag))
371                         continue;
372 
373                 fw3_ipt_create_chain(handle, c->format, zone->name);
374         }
375 
376         if (zone->custom_chains)
377         {
378                 if (handle->table == FW3_TABLE_FILTER)
379                 {
380                         for (i = 0; i < sizeof(flt_chains)/sizeof(flt_chains[0]); i += 2)
381                         {
382                                 r = fw3_ipt_rule_new(handle);
383                                 fw3_ipt_rule_comment(r, "Custom %s %s rule chain", zone->name, flt_chains[i+1]);
384                                 fw3_ipt_rule_target(r, "%s_%s_rule", flt_chains[i+1], zone->name);
385                                 fw3_ipt_rule_append(r, "zone_%s_%s", zone->name, flt_chains[i]);
386                         }
387                 }
388                 else if (handle->table == FW3_TABLE_NAT)
389                 {
390                         for (i = 0; i < sizeof(nat_chains)/sizeof(nat_chains[0]); i += 2)
391                         {
392                                 r = fw3_ipt_rule_new(handle);
393                                 fw3_ipt_rule_comment(r, "Custom %s %s rule chain", zone->name, nat_chains[i+1]);
394                                 fw3_ipt_rule_target(r, "%s_%s_rule", nat_chains[i+1], zone->name);
395                                 fw3_ipt_rule_append(r, "zone_%s_%s", zone->name, nat_chains[i]);
396                         }
397                 }
398         }
399 
400         set(zone->flags, handle->family, handle->table);
401 }
402 
403 static void
404 print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
405                                          bool reload, struct fw3_zone *zone,
406                      struct fw3_device *dev, struct fw3_address *sub)
407 {
408         struct fw3_protocol tcp = { .protocol = 6 };
409         struct fw3_ipt_rule *r;
410         enum fw3_flag t;
411 
412         char buf[32];
413 
414         int i;
415 
416         const char *chains[] = {
417                 "input", "INPUT",
418                 "output", "OUTPUT",
419                 "forward", "FORWARD",
420         };
421 
422 #define jump_target(t) \
423         ((t == FW3_FLAG_REJECT) ? "reject" : fw3_flag_names[t])
424 
425         if (handle->table == FW3_TABLE_FILTER)
426         {
427                 for (t = FW3_FLAG_ACCEPT; t <= FW3_FLAG_DROP; t++)
428                 {
429                         if (t > FW3_FLAG_ACCEPT && zone->log & FW3_ZONE_LOG_FILTER)
430                         {
431                                 if (has(zone->flags, handle->family, fw3_to_src_target(t)))
432                                 {
433                                         r = fw3_ipt_rule_create(handle, NULL, dev, NULL, sub, NULL);
434 
435                                         snprintf(buf, sizeof(buf) - 1, "%s %s in: ",
436                                                  fw3_flag_names[t], zone->name);
437 
438                                         fw3_ipt_rule_limit(r, &zone->log_limit);
439                                         fw3_ipt_rule_target(r, "LOG");
440                                         fw3_ipt_rule_addarg(r, false, "--log-prefix", buf);
441                                         fw3_ipt_rule_replace(r, "zone_%s_src_%s",
442                                                              zone->name, fw3_flag_names[t]);
443                                 }
444 
445                                 if (has(zone->flags, handle->family, t))
446                                 {
447                                         r = fw3_ipt_rule_create(handle, NULL, NULL, dev, NULL, sub);
448 
449                                         snprintf(buf, sizeof(buf) - 1, "%s %s out: ",
450                                                  fw3_flag_names[t], zone->name);
451 
452                                         fw3_ipt_rule_limit(r, &zone->log_limit);
453                                         fw3_ipt_rule_target(r, "LOG");
454                                         fw3_ipt_rule_addarg(r, false, "--log-prefix", buf);
455                                         fw3_ipt_rule_replace(r, "zone_%s_dest_%s",
456                                                              zone->name, fw3_flag_names[t]);
457                                 }
458                         }
459 
460                         if (has(zone->flags, handle->family, fw3_to_src_target(t)))
461                         {
462                                 r = fw3_ipt_rule_create(handle, NULL, dev, NULL, sub, NULL);
463                                 fw3_ipt_rule_target(r, jump_target(t));
464                                 fw3_ipt_rule_extra(r, zone->extra_src);
465 
466                                 if (t == FW3_FLAG_ACCEPT && !state->defaults.drop_invalid)
467                                         fw3_ipt_rule_extra(r,
468                                                            "-m conntrack --ctstate NEW,UNTRACKED");
469 
470                                 fw3_ipt_rule_replace(r, "zone_%s_src_%s", zone->name,
471                                                      fw3_flag_names[t]);
472                         }
473 
474                         if (has(zone->flags, handle->family, t))
475                         {
476                                 if (t == FW3_FLAG_ACCEPT &&
477                                     zone->masq && !zone->masq_allow_invalid)
478                                 {
479                                         r = fw3_ipt_rule_create(handle, NULL, NULL, dev, NULL, sub);
480                                         fw3_ipt_rule_extra(r, "-m conntrack --ctstate INVALID");
481                                         fw3_ipt_rule_comment(r, "Prevent NAT leakage");
482                                         fw3_ipt_rule_target(r, fw3_flag_names[FW3_FLAG_DROP]);
483                                         fw3_ipt_rule_replace(r, "zone_%s_dest_%s", zone->name,
484                                                              fw3_flag_names[t]);
485                                 }
486 
487                                 r = fw3_ipt_rule_create(handle, NULL, NULL, dev, NULL, sub);
488                                 fw3_ipt_rule_target(r, jump_target(t));
489                                 fw3_ipt_rule_extra(r, zone->extra_dest);
490                                 fw3_ipt_rule_replace(r, "zone_%s_dest_%s", zone->name,
491                                                      fw3_flag_names[t]);
492                         }
493                 }
494 
495                 for (i = 0; i < sizeof(chains)/sizeof(chains[0]); i += 2)
496                 {
497                         if (*chains[i] == 'o')
498                                 r = fw3_ipt_rule_create(handle, NULL, NULL, dev, NULL, sub);
499                         else
500                                 r = fw3_ipt_rule_create(handle, NULL, dev, NULL, sub, NULL);
501 
502                         fw3_ipt_rule_target(r, "zone_%s_%s", zone->name, chains[i]);
503 
504                         if (*chains[i] == 'o')
505                                 fw3_ipt_rule_extra(r, zone->extra_dest);
506                         else
507                                 fw3_ipt_rule_extra(r, zone->extra_src);
508 
509                         fw3_ipt_rule_replace(r, chains[i + 1]);
510                 }
511         }
512         else if (handle->table == FW3_TABLE_NAT)
513         {
514                 if (has(zone->flags, handle->family, FW3_FLAG_DNAT))
515                 {
516                         r = fw3_ipt_rule_create(handle, NULL, dev, NULL, sub, NULL);
517                         fw3_ipt_rule_target(r, "zone_%s_prerouting", zone->name);
518                         fw3_ipt_rule_extra(r, zone->extra_src);
519                         fw3_ipt_rule_replace(r, "PREROUTING");
520                 }
521 
522                 if (has(zone->flags, handle->family, FW3_FLAG_SNAT))
523                 {
524                         r = fw3_ipt_rule_create(handle, NULL, NULL, dev, NULL, sub);
525                         fw3_ipt_rule_target(r, "zone_%s_postrouting", zone->name);
526                         fw3_ipt_rule_extra(r, zone->extra_dest);
527                         fw3_ipt_rule_replace(r, "POSTROUTING");
528                 }
529         }
530         else if (handle->table == FW3_TABLE_MANGLE)
531         {
532                 if (zone->mtu_fix)
533                 {
534                         if (zone->log & FW3_ZONE_LOG_MANGLE)
535                         {
536                                 snprintf(buf, sizeof(buf) - 1, "MSSFIX %s out: ", zone->name);
537 
538                                 r = fw3_ipt_rule_create(handle, &tcp, NULL, dev, NULL, sub);
539                                 fw3_ipt_rule_addarg(r, false, "--tcp-flags", "SYN,RST");
540                                 fw3_ipt_rule_addarg(r, false, "SYN", NULL);
541                                 fw3_ipt_rule_limit(r, &zone->log_limit);
542                                 fw3_ipt_rule_comment(r, "Zone %s MTU fix logging", zone->name);
543                                 fw3_ipt_rule_target(r, "LOG");
544                                 fw3_ipt_rule_addarg(r, false, "--log-prefix", buf);
545                                 fw3_ipt_rule_replace(r, "FORWARD");
546                         }
547 
548                         r = fw3_ipt_rule_create(handle, &tcp, NULL, dev, NULL, sub);
549                         fw3_ipt_rule_addarg(r, false, "--tcp-flags", "SYN,RST");
550                         fw3_ipt_rule_addarg(r, false, "SYN", NULL);
551                         fw3_ipt_rule_comment(r, "Zone %s MTU fixing", zone->name);
552                         fw3_ipt_rule_target(r, "TCPMSS");
553                         fw3_ipt_rule_addarg(r, false, "--clamp-mss-to-pmtu", NULL);
554                         fw3_ipt_rule_replace(r, "FORWARD");
555                 }
556         }
557         else if (handle->table == FW3_TABLE_RAW)
558         {
559                 bool loopback_dev = (dev != NULL && !dev->any &&
560                                      !dev->invert && fw3_check_loopback_dev(dev->name));
561                 char *chain = loopback_dev || (sub != NULL && !sub->invert && fw3_check_loopback_addr(sub)) ?
562                               "OUTPUT" : "PREROUTING";
563 
564                 if (has(zone->flags, handle->family, FW3_FLAG_HELPER))
565                 {
566                         r = fw3_ipt_rule_create(handle, NULL, loopback_dev ? NULL : dev, NULL, sub, NULL);
567                         fw3_ipt_rule_comment(r, "%s CT helper assignment", zone->name);
568                         fw3_ipt_rule_target(r, "zone_%s_helper", zone->name);
569                         fw3_ipt_rule_extra(r, zone->extra_src);
570                         fw3_ipt_rule_replace(r, chain);
571                 }
572 
573                 if (has(zone->flags, handle->family, FW3_FLAG_NOTRACK))
574                 {
575                         r = fw3_ipt_rule_create(handle, NULL, loopback_dev ? NULL : dev, NULL, sub, NULL);
576                         fw3_ipt_rule_comment(r, "%s CT bypass", zone->name);
577                         fw3_ipt_rule_target(r, "zone_%s_notrack", zone->name);
578                         fw3_ipt_rule_extra(r, zone->extra_src);
579                         fw3_ipt_rule_replace(r, chain);
580                 }
581         }
582 }
583 
584 static void
585 print_interface_rules(struct fw3_ipt_handle *handle, struct fw3_state *state,
586                       bool reload, struct fw3_zone *zone)
587 {
588         struct fw3_device *dev;
589         struct fw3_address *sub;
590 
591         fw3_foreach(dev, &zone->devices)
592         fw3_foreach(sub, &zone->subnets)
593         {
594                 if (!fw3_is_family(sub, handle->family))
595                         continue;
596 
597                 if (!dev && !sub && !zone->extra_src && !zone->extra_dest)
598                         continue;
599 
600                 print_interface_rule(handle, state, reload, zone, dev, sub);
601         }
602 }
603 
604 static struct fw3_address *
605 next_addr(struct fw3_address *addr, struct list_head *list,
606                 enum fw3_family family, bool invert)
607 {
608         struct list_head *p;
609         struct fw3_address *rv;
610 
611         for (p = addr ? addr->list.next : list->next; p != list; p = p->next)
612         {
613                 rv = list_entry(p, struct fw3_address, list);
614 
615                 if (fw3_is_family(rv, family) && rv->set && rv->invert == invert)
616                         return rv;
617         }
618 
619         return NULL;
620 }
621 
622 static void
623 print_zone_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
624                 bool reload, struct fw3_zone *zone)
625 {
626         bool first_src, first_dest;
627         struct fw3_address *msrc;
628         struct fw3_address *mdest;
629         struct fw3_ipt_rule *r;
630 
631         if (!fw3_is_family(zone, handle->family))
632                 return;
633 
634         info("   * Zone '%s'", zone->name);
635 
636         switch (handle->table)
637         {
638         case FW3_TABLE_FILTER:
639                 if (has(zone->flags, handle->family, FW3_FLAG_DNAT))
640                 {
641                         r = fw3_ipt_rule_new(handle);
642                         fw3_ipt_rule_extra(r, "-m conntrack --ctstate DNAT");
643                         fw3_ipt_rule_comment(r, "Accept port redirections");
644                         fw3_ipt_rule_target(r, fw3_flag_names[FW3_FLAG_ACCEPT]);
645                         fw3_ipt_rule_append(r, "zone_%s_input", zone->name);
646 
647                         r = fw3_ipt_rule_new(handle);
648                         fw3_ipt_rule_extra(r, "-m conntrack --ctstate DNAT");
649                         fw3_ipt_rule_comment(r, "Accept port forwards");
650                         fw3_ipt_rule_target(r, fw3_flag_names[FW3_FLAG_ACCEPT]);
651                         fw3_ipt_rule_append(r, "zone_%s_forward", zone->name);
652                 }
653 
654                 r = fw3_ipt_rule_new(handle);
655                 fw3_ipt_rule_target(r, "zone_%s_src_%s", zone->name,
656                                      fw3_flag_names[zone->policy_input]);
657                 fw3_ipt_rule_append(r, "zone_%s_input", zone->name);
658 
659                 r = fw3_ipt_rule_new(handle);
660                 fw3_ipt_rule_target(r, "zone_%s_dest_%s", zone->name,
661                                      fw3_flag_names[zone->policy_forward]);
662                 fw3_ipt_rule_append(r, "zone_%s_forward", zone->name);
663 
664                 r = fw3_ipt_rule_new(handle);
665                 fw3_ipt_rule_target(r, "zone_%s_dest_%s", zone->name,
666                                      fw3_flag_names[zone->policy_output]);
667                 fw3_ipt_rule_append(r, "zone_%s_output", zone->name);
668 
669                 break;
670 
671         case FW3_TABLE_NAT:
672                 if (zone->masq && handle->family == FW3_FAMILY_V4)
673                 {
674                         /* for any negated masq_src ip, emit -s addr -j RETURN rules */
675                         for (msrc = NULL;
676                              (msrc = next_addr(msrc, &zone->masq_src,
677                                                handle->family, true)) != NULL; )
678                         {
679                                 msrc->invert = false;
680                                 r = fw3_ipt_rule_new(handle);
681                                 fw3_ipt_rule_src_dest(r, msrc, NULL);
682                                 fw3_ipt_rule_target(r, "RETURN");
683                                 fw3_ipt_rule_append(r, "zone_%s_postrouting", zone->name);
684                                 msrc->invert = true;
685                         }
686 
687                         /* for any negated masq_dest ip, emit -d addr -j RETURN rules */
688                         for (mdest = NULL;
689                              (mdest = next_addr(mdest, &zone->masq_dest,
690                                                 handle->family, true)) != NULL; )
691                         {
692                                 mdest->invert = false;
693                                 r = fw3_ipt_rule_new(handle);
694                                 fw3_ipt_rule_src_dest(r, NULL, mdest);
695                                 fw3_ipt_rule_target(r, "RETURN");
696                                 fw3_ipt_rule_append(r, "zone_%s_postrouting", zone->name);
697                                 mdest->invert = true;
698                         }
699 
700                         /* emit masquerading entries for non-negated addresses
701                            and ensure that both src and dest loops run at least once,
702                            even if there are no relevant addresses */
703                         for (first_src = true, msrc = NULL;
704                              (msrc = next_addr(msrc, &zone->masq_src,
705                                                    handle->family, false)) || first_src;
706                              first_src = false)
707                         {
708                                 for (first_dest = true, mdest = NULL;
709                                      (mdest = next_addr(mdest, &zone->masq_dest,
710                                                             handle->family, false)) || first_dest;
711                                      first_dest = false)
712                                 {
713                                         r = fw3_ipt_rule_new(handle);
714                                         fw3_ipt_rule_src_dest(r, msrc, mdest);
715                                         fw3_ipt_rule_target(r, "MASQUERADE");
716                                         fw3_ipt_rule_append(r, "zone_%s_postrouting", zone->name);
717                                 }
718                         }
719                 }
720                 break;
721 
722         case FW3_TABLE_RAW:
723                 fw3_print_cthelpers(handle, state, zone);
724                 break;
725 
726         case FW3_TABLE_MANGLE:
727                 break;
728         }
729 
730         print_interface_rules(handle, state, reload, zone);
731 }
732 
733 void
734 fw3_print_zone_chains(struct fw3_ipt_handle *handle, struct fw3_state *state,
735                       bool reload)
736 {
737         struct fw3_zone *zone;
738 
739         list_for_each_entry(zone, &state->zones, list)
740                 print_zone_chain(handle, state, reload, zone);
741 }
742 
743 void
744 fw3_print_zone_rules(struct fw3_ipt_handle *handle, struct fw3_state *state,
745                      bool reload)
746 {
747         struct fw3_zone *zone;
748 
749         list_for_each_entry(zone, &state->zones, list)
750                 print_zone_rule(handle, state, reload, zone);
751 }
752 
753 void
754 fw3_flush_zones(struct fw3_ipt_handle *handle, struct fw3_state *state,
755                 bool reload)
756 {
757         struct fw3_zone *z, *tmp;
758         const struct fw3_chain_spec *c;
759         char chain[32];
760 
761         list_for_each_entry_safe(z, tmp, &state->zones, list)
762         {
763                 if (!has(z->flags, handle->family, handle->table))
764                         continue;
765 
766                 for (c = zone_chains; c->format; c++)
767                 {
768                         /* don't touch user chains on selective stop */
769                         if (reload && c->flag == FW3_FLAG_CUSTOM_CHAINS)
770                                 continue;
771 
772                         if (!fw3_is_family(c, handle->family))
773                                 continue;
774 
775                         if (c->table != handle->table)
776                                 continue;
777 
778                         if (c->flag && !has(z->flags, handle->family, c->flag))
779                                 continue;
780 
781                         snprintf(chain, sizeof(chain), c->format, z->name);
782                         fw3_ipt_flush_chain(handle, chain);
783 
784                         /* keep certain basic chains that do not depend on any settings to
785                            avoid purging unrelated user rules pointing to them */
786                         if (reload && !c->flag)
787                                 continue;
788 
789                         fw3_ipt_delete_chain(handle, chain);
790                 }
791 
792                 del(z->flags, handle->family, handle->table);
793         }
794 }
795 
796 void
797 fw3_hotplug_zones(struct fw3_state *state, bool add)
798 {
799         struct fw3_zone *z;
800         struct fw3_device *d;
801 
802         list_for_each_entry(z, &state->zones, list)
803         {
804                 if (add != fw3_hasbit(z->flags[0], FW3_FLAG_HOTPLUG))
805                 {
806                         list_for_each_entry(d, &z->devices, list)
807                                 fw3_hotplug(add, z, d);
808 
809                         if (add)
810                                 fw3_setbit(z->flags[0], FW3_FLAG_HOTPLUG);
811                         else
812                                 fw3_delbit(z->flags[0], FW3_FLAG_HOTPLUG);
813                 }
814         }
815 }
816 
817 struct fw3_zone *
818 fw3_lookup_zone(struct fw3_state *state, const char *name)
819 {
820         struct fw3_zone *z;
821 
822         if (list_empty(&state->zones))
823                 return NULL;
824 
825         list_for_each_entry(z, &state->zones, list)
826         {
827                 if (strcmp(z->name, name))
828                         continue;
829 
830                 return z;
831         }
832 
833         return NULL;
834 }
835 
836 struct list_head *
837 fw3_resolve_zone_addresses(struct fw3_zone *zone, struct fw3_address *addr)
838 {
839         struct fw3_device *net;
840         struct fw3_address *cur, *tmp;
841         struct list_head *all;
842 
843         all = calloc(1, sizeof(*all));
844         if (!all)
845                 return NULL;
846 
847         INIT_LIST_HEAD(all);
848 
849         if (addr && addr->set)
850         {
851                 tmp = malloc(sizeof(*tmp));
852 
853                 if (tmp)
854                 {
855                         *tmp = *addr;
856                         list_add_tail(&tmp->list, all);
857                 }
858         }
859         else
860         {
861                 list_for_each_entry(net, &zone->networks, list)
862                         fw3_ubus_address(all, net->name);
863 
864                 list_for_each_entry(cur, &zone->subnets, list)
865                 {
866                         tmp = malloc(sizeof(*tmp));
867 
868                         if (!tmp)
869                                 continue;
870 
871                         *tmp = *cur;
872                         list_add_tail(&tmp->list, all);
873                 }
874         }
875 
876         return all;
877 }
878 

This page was automatically generated by LXR 0.3.1.  •  OpenWrt