forwards.c

   1 /*
   2  * firewall3 - 3rd OpenWrt UCI firewall implementation
   3  *
   4  *   Copyright (C) 2013 Jo-Philipp Wich <jo@mein.io>
   5  *
   6  * Permission to use, copy, modify, and/or distribute this software for any
   7  * purpose with or without fee is hereby granted, provided that the above
   8  * copyright notice and this permission notice appear in all copies.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17  */
  18
  19 #include "forwards.h"
  20
  21
  22 const struct fw3_option fw3_forward_opts[] = {
  23         FW3_OPT("enabled",             bool,     forward,     enabled),
  24
  25         FW3_OPT("name",                string,   forward,     name),
  26         FW3_OPT("family",              family,   forward,     family),
  27
  28         FW3_OPT("src",                 device,   forward,     src),
  29         FW3_OPT("dest",                device,   forward,     dest),
  30
  31         { }
  32 };
  33
  34
  35 void
  36 fw3_load_forwards(struct fw3_state *state, struct uci_package *p)
  37 {
  38         struct uci_section *s;
  39         struct uci_element *e;
  40         struct fw3_forward *forward;
  41         bool changed;
  42
  43         INIT_LIST_HEAD(&state->forwards);
  44
  45         uci_foreach_element(&p->sections, e)
  46         {
  47                 s = uci_to_section(e);
  48
  49                 if (strcmp(s->type, "forwarding"))
  50                         continue;
  51
  52                 forward = calloc(1, sizeof(*forward));
  53                 if (!forward)
  54                         continue;
  55
  56                 forward->enabled = true;
  57
  58                 fw3_parse_options(forward, fw3_forward_opts, s);
  59
  60                 if (!forward->enabled)
  61                 {
  62                         fw3_free_forward(forward);
  63                         continue;
  64                 }
  65
  66                 if (forward->src.invert || forward->dest.invert)
  67                 {
  68                         warn_elem(e, "must not have inverted 'src' or 'dest' options");
  69                         fw3_free_forward(forward);
  70                         continue;
  71                 }
  72                 else if (forward->src.set && !forward->src.any &&
  73                          !(forward->_src = fw3_lookup_zone(state, forward->src.name)))
  74                 {
  75                         warn_elem(e, "refers to not existing zone '%s'", forward->src.name);
  76                         fw3_free_forward(forward);
  77                         continue;
  78                 }
  79                 else if (forward->dest.set && !forward->dest.any &&
  80                          !(forward->_dest = fw3_lookup_zone(state, forward->dest.name)))
  81                 {
  82                         warn_elem(e, "refers to not existing zone '%s'", forward->dest.name);
  83                         fw3_free_forward(forward);
  84                         continue;
  85                 }
  86
  87                 list_add_tail(&forward->list, &state->forwards);
  88                 continue;
  89         }
  90
  91         /* Propagate conntrack requirement flag into all zones connected through
  92            forwarding entries and repeat until all zones are normalized */
  93         do {
  94                 changed = false;
  95
  96                 list_for_each_entry(forward, &state->forwards, list)
  97                 {
  98                         /* NB: forward family... */
  99                         if (forward->_dest)
 100                         {
 101                                 fw3_setbit(forward->_dest->flags[0], FW3_FLAG_ACCEPT);
 102                                 fw3_setbit(forward->_dest->flags[1], FW3_FLAG_ACCEPT);
 103
 104                                 if (forward->_src &&
 105                                     (forward->_src->conntrack != forward->_dest->conntrack))
 106                                 {
 107                                         forward->_src->conntrack = true;
 108                                         forward->_dest->conntrack = true;
 109                                         changed = true;
 110                                 }
 111                         }
 112                 }
 113         }
 114         while (changed);
 115 }
 116
 117
 118 static void
 119 append_chain(struct fw3_ipt_rule *r, struct fw3_forward *forward)
 120 {
 121         if (forward->src.any || !forward->src.set)
 122                 fw3_ipt_rule_append(r, "FORWARD");
 123         else
 124                 fw3_ipt_rule_append(r, "zone_%s_forward", forward->src.name);
 125 }
 126
 127 static void set_target(struct fw3_ipt_rule *r, struct fw3_forward *forward)
 128 {
 129         if (forward->dest.any || !forward->dest.set)
 130                 fw3_ipt_rule_target(r, "ACCEPT");
 131         else
 132                 fw3_ipt_rule_target(r, "zone_%s_dest_ACCEPT", forward->dest.name);
 133 }
 134
 135 static void
 136 print_forward(struct fw3_ipt_handle *handle, struct fw3_forward *forward)
 137 {
 138         const char *s, *d;
 139         struct fw3_ipt_rule *r;
 140
 141         if (handle->table != FW3_TABLE_FILTER)
 142                 return;
 143
 144         if (!fw3_is_family(forward, handle->family))
 145                 return;
 146
 147         s = forward->_src  ? forward->_src->name  : "*";
 148         d = forward->_dest ? forward->_dest->name : "*";
 149
 150         info("   * Forward '%s' -> '%s'", s, d);
 151
 152         if (!fw3_is_family(forward->_src, handle->family) ||
 153             !fw3_is_family(forward->_dest, handle->family))
 154         {
 155                 info("     ! Skipping due to different family of zone");
 156                 return;
 157         }
 158
 159         r = fw3_ipt_rule_new(handle);
 160         fw3_ipt_rule_comment(r, "forwarding %s -> %s", s, d);
 161         set_target(r, forward);
 162         append_chain(r, forward);
 163 }
 164
 165 void
 166 fw3_print_forwards(struct fw3_ipt_handle *handle, struct fw3_state *state)
 167 {
 168         struct fw3_forward *forward;
 169
 170         list_for_each_entry(forward, &state->forwards, list)
 171                 print_forward(handle, forward);
 172 }