30c6463ff05a73e73fb9a99b2812f738577f7f86
[project/firewall3.git] / ipsets.c
1 /*
2  * firewall3 - 3rd OpenWrt UCI firewall implementation
3  *
4  *   Copyright (C) 2013 Jo-Philipp Wich <jo@mein.io>
5  *
6  * Permission to use, copy, modify, and/or distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18
19 #include "ipsets.h"
20
21
22 const struct fw3_option fw3_ipset_opts[] = {
23         FW3_OPT("enabled",       bool,           ipset,     enabled),
24
25         FW3_OPT("name",          string,         ipset,     name),
26         FW3_OPT("family",        family,         ipset,     family),
27
28         FW3_OPT("storage",       ipset_method,   ipset,     method),
29         FW3_LIST("match",        ipset_datatype, ipset,     datatypes),
30
31         FW3_OPT("iprange",       address,        ipset,     iprange),
32         FW3_OPT("portrange",     port,           ipset,     portrange),
33
34         FW3_OPT("netmask",       int,            ipset,     netmask),
35         FW3_OPT("maxelem",       int,            ipset,     maxelem),
36         FW3_OPT("hashsize",      int,            ipset,     hashsize),
37         FW3_OPT("timeout",       int,            ipset,     timeout),
38
39         FW3_OPT("external",      string,         ipset,     external),
40
41         { }
42 };
43
44 #define T(m, t1, t2, t3, r, o) \
45         { FW3_IPSET_METHOD_##m, \
46           FW3_IPSET_TYPE_##t1 | (FW3_IPSET_TYPE_##t2 << 8) | (FW3_IPSET_TYPE_##t3 << 16), \
47           r, o }
48
49 enum ipset_optflag {
50         OPT_IPRANGE   = (1 << 0),
51         OPT_PORTRANGE = (1 << 1),
52         OPT_NETMASK   = (1 << 2),
53         OPT_HASHSIZE  = (1 << 3),
54         OPT_MAXELEM   = (1 << 4),
55         OPT_FAMILY    = (1 << 5),
56 };
57
58 struct ipset_type {
59         enum fw3_ipset_method method;
60         uint32_t types;
61         uint8_t required;
62         uint8_t optional;
63 };
64
65 static struct ipset_type ipset_types[] = {
66         T(BITMAP, IP,   UNSPEC, UNSPEC, OPT_IPRANGE, OPT_NETMASK),
67         T(BITMAP, IP,   MAC,    UNSPEC, OPT_IPRANGE, 0),
68         T(BITMAP, PORT, UNSPEC, UNSPEC, OPT_PORTRANGE, 0),
69
70         T(HASH,   IP,   UNSPEC, UNSPEC, 0,
71           OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM | OPT_NETMASK),
72         T(HASH,   NET,  UNSPEC, UNSPEC, 0,
73           OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM),
74         T(HASH,   IP,   PORT,   UNSPEC, 0,
75           OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM),
76         T(HASH,   NET,  PORT,   UNSPEC, 0,
77           OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM),
78         T(HASH,   IP,   PORT,   IP,     0,
79           OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM),
80         T(HASH,   IP,   PORT,   NET,    0,
81           OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM),
82
83         T(LIST,   SET,  UNSPEC, UNSPEC, 0, OPT_MAXELEM),
84 };
85
86
87 static bool
88 check_types(struct uci_element *e, struct fw3_ipset *ipset)
89 {
90         int i = 0;
91         uint32_t typelist = 0;
92         struct fw3_ipset_datatype *type;
93
94         list_for_each_entry(type, &ipset->datatypes, list)
95         {
96                 if (i >= 3)
97                 {
98                         warn_section("ipset", ipset, e, "must not have more than 3 datatypes assigned");
99                         return false;
100                 }
101
102                 typelist |= (type->type << (i++ * 8));
103         }
104
105         /* find a suitable storage method if none specified */
106         if (ipset->method == FW3_IPSET_METHOD_UNSPEC)
107         {
108                 for (i = 0; i < ARRAY_SIZE(ipset_types); i++)
109                 {
110                         /* skip type for v6 if it does not support family */
111                         if (ipset->family != FW3_FAMILY_V4 &&
112                             !(ipset_types[i].optional & OPT_FAMILY))
113                                 continue;
114
115                         if (ipset_types[i].types == typelist)
116                         {
117                                 ipset->method = ipset_types[i].method;
118
119                                 warn_section("ipset", ipset, e, "defines no storage method, assuming '%s'",
120                                         fw3_ipset_method_names[ipset->method]);
121
122                                 break;
123                         }
124                 }
125         }
126
127         //typelist |= ipset->method;
128
129         for (i = 0; i < ARRAY_SIZE(ipset_types); i++)
130         {
131                 if (ipset_types[i].method == ipset->method &&
132                     ipset_types[i].types == typelist)
133                 {
134                         if (!ipset->external)
135                         {
136                                 if ((ipset_types[i].required & OPT_IPRANGE) &&
137                                         !ipset->iprange.set)
138                                 {
139                                         warn_section("ipset", ipset, e, "requires an ip range");
140                                         return false;
141                                 }
142
143                                 if ((ipset_types[i].required & OPT_PORTRANGE) &&
144                                     !ipset->portrange.set)
145                                 {
146                                         warn_section("ipset", ipset, e, "requires a port range");
147                                         return false;
148                                 }
149
150                                 if (!(ipset_types[i].required & OPT_IPRANGE) &&
151                                     ipset->iprange.set)
152                                 {
153                                         warn_section("ipset", ipset, e, "iprange ignored");
154                                         ipset->iprange.set = false;
155                                 }
156
157                                 if (!(ipset_types[i].required & OPT_PORTRANGE) &&
158                                     ipset->portrange.set)
159                                 {
160                                         warn_section("ipset", ipset, e, "portrange ignored");
161                                         ipset->portrange.set = false;
162                                 }
163
164                                 if (!(ipset_types[i].optional & OPT_NETMASK) &&
165                                     ipset->netmask > 0)
166                                 {
167                                         warn_section("ipset", ipset, e, "netmask ignored");
168                                         ipset->netmask = 0;
169                                 }
170
171                                 if (!(ipset_types[i].optional & OPT_HASHSIZE) &&
172                                     ipset->hashsize > 0)
173                                 {
174                                         warn_section("ipset", ipset, e, "hashsize ignored");
175                                         ipset->hashsize = 0;
176                                 }
177
178                                 if (!(ipset_types[i].optional & OPT_MAXELEM) &&
179                                     ipset->maxelem > 0)
180                                 {
181                                         warn_section("ipset", ipset, e, "maxelem ignored");
182                                         ipset->maxelem = 0;
183                                 }
184
185                                 if (!(ipset_types[i].optional & OPT_FAMILY) &&
186                                     ipset->family != FW3_FAMILY_V4)
187                                 {
188                                         warn_section("ipset", ipset, e, "family ignored");
189                                         ipset->family = FW3_FAMILY_V4;
190                                 }
191                         }
192
193                         return true;
194                 }
195         }
196
197         warn_section("ipset", ipset, e, "has an invalid combination of storage method and matches");
198         return false;
199 }
200
201 static bool
202 check_ipset(struct fw3_state *state, struct fw3_ipset *ipset, struct uci_element *e)
203 {
204         if (ipset->external)
205         {
206                 if (!*ipset->external)
207                         ipset->external = NULL;
208                 else if (!ipset->name)
209                         ipset->name = ipset->external;
210         }
211
212         if (!ipset->name || !*ipset->name)
213         {
214                 warn_section("ipset", ipset, e, "ipset must have a name assigned");
215         }
216         //else if (fw3_lookup_ipset(state, ipset->name) != NULL)
217         //{
218         //      warn_section("ipset", ipset, e, "has duplicated set name", ipset->name);
219         //}
220         else if (ipset->family == FW3_FAMILY_ANY)
221         {
222                 warn_section("ipset", ipset, e, "must not have family 'any'");
223         }
224         else if (ipset->iprange.set && ipset->family != ipset->iprange.family)
225         {
226                 warn_section("ipset", ipset, e, "has iprange of wrong address family");
227         }
228         else if (list_empty(&ipset->datatypes))
229         {
230                 warn_section("ipset", ipset, e, "has no datatypes assigned");
231         }
232         else if (check_types(e, ipset))
233         {
234                 return true;
235         }
236
237         return false;
238 }
239
240 static struct fw3_ipset *
241 fw3_alloc_ipset(struct fw3_state *state)
242 {
243         struct fw3_ipset *ipset;
244
245         ipset = calloc(1, sizeof(*ipset));
246         if (!ipset)
247                 return NULL;
248
249         INIT_LIST_HEAD(&ipset->datatypes);
250
251         ipset->enabled = true;
252         ipset->family  = FW3_FAMILY_V4;
253
254         list_add_tail(&ipset->list, &state->ipsets);
255
256         return ipset;
257 }
258
259 void
260 fw3_load_ipsets(struct fw3_state *state, struct uci_package *p,
261                 struct blob_attr *a)
262 {
263         struct uci_section *s;
264         struct uci_element *e;
265         struct fw3_ipset *ipset;
266         struct blob_attr *entry;
267         unsigned rem;
268
269         INIT_LIST_HEAD(&state->ipsets);
270
271         if (state->disable_ipsets)
272                 return;
273
274         blob_for_each_attr(entry, a, rem)
275         {
276                 const char *type;
277                 const char *name = "ubus ipset";
278
279                 if (!fw3_attr_parse_name_type(entry, &name, &type))
280                         continue;
281
282                 if (strcmp(type, "ipset"))
283                         continue;
284
285                 ipset = fw3_alloc_ipset(state);
286                 if (!ipset)
287                         continue;
288
289                 if (!fw3_parse_blob_options(ipset, fw3_ipset_opts, entry, name))
290                 {
291                         warn_section("ipset", ipset, NULL, "skipped due to invalid options");
292                         fw3_free_ipset(ipset);
293                         continue;
294                 }
295
296                 if (!check_ipset(state, ipset, NULL))
297                         fw3_free_ipset(ipset);
298         }
299
300         uci_foreach_element(&p->sections, e)
301         {
302                 s = uci_to_section(e);
303
304                 if (strcmp(s->type, "ipset"))
305                         continue;
306
307                 ipset = fw3_alloc_ipset(state);
308
309                 if (!ipset)
310                         continue;
311
312                 if (!fw3_parse_options(ipset, fw3_ipset_opts, s))
313                         warn_elem(e, "has invalid options");
314
315                 if (!check_ipset(state, ipset, e))
316                         fw3_free_ipset(ipset);
317         }
318 }
319
320
321 static void
322 create_ipset(struct fw3_ipset *ipset, struct fw3_state *state)
323 {
324         bool first = true;
325
326         struct fw3_ipset_datatype *type;
327
328         info(" * Creating ipset %s", ipset->name);
329
330         first = true;
331         fw3_pr("create %s %s", ipset->name, fw3_ipset_method_names[ipset->method]);
332
333         list_for_each_entry(type, &ipset->datatypes, list)
334         {
335                 fw3_pr("%c%s", first ? ':' : ',', fw3_ipset_type_names[type->type]);
336                 first = false;
337         }
338
339         if (ipset->method == FW3_IPSET_METHOD_HASH)
340                 fw3_pr(" family inet%s", (ipset->family == FW3_FAMILY_V4) ? "" : "6");
341
342         if (ipset->iprange.set)
343         {
344                 fw3_pr(" range %s", fw3_address_to_string(&ipset->iprange, false, true));
345         }
346         else if (ipset->portrange.set)
347         {
348                 fw3_pr(" range %u-%u",
349                        ipset->portrange.port_min, ipset->portrange.port_max);
350         }
351
352         if (ipset->timeout > 0)
353                 fw3_pr(" timeout %u", ipset->timeout);
354
355         if (ipset->maxelem > 0)
356                 fw3_pr(" maxelem %u", ipset->maxelem);
357
358         if (ipset->netmask > 0)
359                 fw3_pr(" netmask %u", ipset->netmask);
360
361         if (ipset->hashsize > 0)
362                 fw3_pr(" hashsize %u", ipset->hashsize);
363
364         fw3_pr("\n");
365 }
366
367 void
368 fw3_create_ipsets(struct fw3_state *state)
369 {
370         int tries;
371         bool exec = false;
372         struct fw3_ipset *ipset;
373
374         if (state->disable_ipsets)
375                 return;
376
377         /* spawn ipsets */
378         list_for_each_entry(ipset, &state->ipsets, list)
379         {
380                 if (ipset->external)
381                         continue;
382
383                 if (!exec)
384                 {
385                         exec = fw3_command_pipe(false, "ipset", "-exist", "-");
386
387                         if (!exec)
388                                 return;
389                 }
390
391                 create_ipset(ipset, state);
392         }
393
394         if (exec)
395         {
396                 fw3_pr("quit\n");
397                 fw3_command_close();
398         }
399
400         /* wait for ipsets to appear */
401         list_for_each_entry(ipset, &state->ipsets, list)
402         {
403                 if (ipset->external)
404                         continue;
405
406                 for (tries = 0; !fw3_check_ipset(ipset) && tries < 10; tries++)
407                         usleep(50000);
408         }
409 }
410
411 void
412 fw3_destroy_ipsets(struct fw3_state *state)
413 {
414         int tries;
415         bool exec = false;
416         struct fw3_ipset *ipset;
417
418         /* destroy ipsets */
419         list_for_each_entry(ipset, &state->ipsets, list)
420         {
421                 if (!exec)
422                 {
423                         exec = fw3_command_pipe(false, "ipset", "-exist", "-");
424
425                         if (!exec)
426                                 return;
427                 }
428
429                 info(" * Deleting ipset %s", ipset->name);
430
431                 fw3_pr("flush %s\n", ipset->name);
432                 fw3_pr("destroy %s\n", ipset->name);
433         }
434
435         if (exec)
436         {
437                 fw3_pr("quit\n");
438                 fw3_command_close();
439         }
440
441         /* wait for ipsets to disappear */
442         list_for_each_entry(ipset, &state->ipsets, list)
443         {
444                 if (ipset->external)
445                         continue;
446
447                 for (tries = 0; fw3_check_ipset(ipset) && tries < 10; tries++)
448                         usleep(50000);
449         }
450 }
451
452 struct fw3_ipset *
453 fw3_lookup_ipset(struct fw3_state *state, const char *name)
454 {
455         struct fw3_ipset *s;
456
457         if (list_empty(&state->ipsets))
458                 return NULL;
459
460         list_for_each_entry(s, &state->ipsets, list)
461         {
462                 if (strcmp(s->name, name))
463                         continue;
464
465                 return s;
466         }
467
468         return NULL;
469 }
470
471 bool
472 fw3_check_ipset(struct fw3_ipset *set)
473 {
474         bool rv = false;
475
476         socklen_t sz;
477         int s = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
478         struct ip_set_req_version req_ver;
479         struct ip_set_req_get_set req_name;
480
481         if (s < 0 || fcntl(s, F_SETFD, FD_CLOEXEC))
482                 goto out;
483
484         sz = sizeof(req_ver);
485         req_ver.op = IP_SET_OP_VERSION;
486
487         if (getsockopt(s, SOL_IP, SO_IP_SET, &req_ver, &sz))
488                 goto out;
489
490         sz = sizeof(req_name);
491         req_name.op = IP_SET_OP_GET_BYNAME;
492         req_name.version = req_ver.version;
493         snprintf(req_name.set.name, IPSET_MAXNAMELEN - 1, "%s",
494                  set->external ? set->external : set->name);
495
496         if (getsockopt(s, SOL_IP, SO_IP_SET, &req_name, &sz))
497                 goto out;
498
499         rv = ((sz == sizeof(req_name)) && (req_name.set.index != IPSET_INVALID_ID));
500
501 out:
502         if (s >= 0)
503                 close(s);
504
505         return rv;
506 }