ipsets.c

   1 /*
   2  * firewall3 - 3rd OpenWrt UCI firewall implementation
   3  *
   4  *   Copyright (C) 2013 Jo-Philipp Wich <jo@mein.io>
   5  *
   6  * Permission to use, copy, modify, and/or distribute this software for any
   7  * purpose with or without fee is hereby granted, provided that the above
   8  * copyright notice and this permission notice appear in all copies.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17  */
  18
  19 #include "ipsets.h"
  20
  21
  22 const struct fw3_option fw3_ipset_opts[] = {
  23         FW3_OPT("enabled",       bool,           ipset,     enabled),
  24
  25         FW3_OPT("name",          string,         ipset,     name),
  26         FW3_OPT("family",        family,         ipset,     family),
  27
  28         FW3_OPT("storage",       ipset_method,   ipset,     method),
  29         FW3_LIST("match",        ipset_datatype, ipset,     datatypes),
  30
  31         FW3_OPT("iprange",       address,        ipset,     iprange),
  32         FW3_OPT("portrange",     port,           ipset,     portrange),
  33
  34         FW3_OPT("netmask",       int,            ipset,     netmask),
  35         FW3_OPT("maxelem",       int,            ipset,     maxelem),
  36         FW3_OPT("hashsize",      int,            ipset,     hashsize),
  37         FW3_OPT("timeout",       int,            ipset,     timeout),
  38
  39         FW3_OPT("external",      string,         ipset,     external),
  40
  41         { }
  42 };
  43
  44 #define T(m, t1, t2, t3, r, o) \
  45         { FW3_IPSET_METHOD_##m, \
  46           FW3_IPSET_TYPE_##t1 | (FW3_IPSET_TYPE_##t2 << 8) | (FW3_IPSET_TYPE_##t3 << 16), \
  47           r, o }
  48
  49 enum ipset_optflag {
  50         OPT_IPRANGE   = (1 << 0),
  51         OPT_PORTRANGE = (1 << 1),
  52         OPT_NETMASK   = (1 << 2),
  53         OPT_HASHSIZE  = (1 << 3),
  54         OPT_MAXELEM   = (1 << 4),
  55         OPT_FAMILY    = (1 << 5),
  56 };
  57
  58 struct ipset_type {
  59         enum fw3_ipset_method method;
  60         uint32_t types;
  61         uint8_t required;
  62         uint8_t optional;
  63 };
  64
  65 static struct ipset_type ipset_types[] = {
  66         T(BITMAP, IP,   UNSPEC, UNSPEC, OPT_IPRANGE, OPT_NETMASK),
  67         T(BITMAP, IP,   MAC,    UNSPEC, OPT_IPRANGE, 0),
  68         T(BITMAP, PORT, UNSPEC, UNSPEC, OPT_PORTRANGE, 0),
  69
  70         T(HASH,   IP,   UNSPEC, UNSPEC, 0,
  71           OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM | OPT_NETMASK),
  72         T(HASH,   NET,  UNSPEC, UNSPEC, 0,
  73           OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM),
  74         T(HASH,   IP,   PORT,   UNSPEC, 0,
  75           OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM),
  76         T(HASH,   NET,  PORT,   UNSPEC, 0,
  77           OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM),
  78         T(HASH,   IP,   PORT,   IP,     0,
  79           OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM),
  80         T(HASH,   IP,   PORT,   NET,    0,
  81           OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM),
  82
  83         T(LIST,   SET,  UNSPEC, UNSPEC, 0, OPT_MAXELEM),
  84 };
  85
  86
  87 static bool
  88 check_types(struct uci_element *e, struct fw3_ipset *ipset)
  89 {
  90         int i = 0;
  91         uint32_t typelist = 0;
  92         struct fw3_ipset_datatype *type;
  93
  94         list_for_each_entry(type, &ipset->datatypes, list)
  95         {
  96                 if (i >= 3)
  97                 {
  98                         warn_section("ipset", ipset, e, "must not have more than 3 datatypes assigned");
  99                         return false;
 100                 }
 101
 102                 typelist |= (type->type << (i++ * 8));
 103         }
 104
 105         /* find a suitable storage method if none specified */
 106         if (ipset->method == FW3_IPSET_METHOD_UNSPEC)
 107         {
 108                 for (i = 0; i < ARRAY_SIZE(ipset_types); i++)
 109                 {
 110                         /* skip type for v6 if it does not support family */
 111                         if (ipset->family != FW3_FAMILY_V4 &&
 112                             !(ipset_types[i].optional & OPT_FAMILY))
 113                                 continue;
 114
 115                         if (ipset_types[i].types == typelist)
 116                         {
 117                                 ipset->method = ipset_types[i].method;
 118
 119                                 warn_section("ipset", ipset, e, "defines no storage method, assuming '%s'",
 120                                         fw3_ipset_method_names[ipset->method]);
 121
 122                                 break;
 123                         }
 124                 }
 125         }
 126
 127         //typelist |= ipset->method;
 128
 129         for (i = 0; i < ARRAY_SIZE(ipset_types); i++)
 130         {
 131                 if (ipset_types[i].method == ipset->method &&
 132                     ipset_types[i].types == typelist)
 133                 {
 134                         if (!ipset->external)
 135                         {
 136                                 if ((ipset_types[i].required & OPT_IPRANGE) &&
 137                                         !ipset->iprange.set)
 138                                 {
 139                                         warn_section("ipset", ipset, e, "requires an ip range");
 140                                         return false;
 141                                 }
 142
 143                                 if ((ipset_types[i].required & OPT_PORTRANGE) &&
 144                                     !ipset->portrange.set)
 145                                 {
 146                                         warn_section("ipset", ipset, e, "requires a port range");
 147                                         return false;
 148                                 }
 149
 150                                 if (!(ipset_types[i].required & OPT_IPRANGE) &&
 151                                     ipset->iprange.set)
 152                                 {
 153                                         warn_section("ipset", ipset, e, "iprange ignored");
 154                                         ipset->iprange.set = false;
 155                                 }
 156
 157                                 if (!(ipset_types[i].required & OPT_PORTRANGE) &&
 158                                     ipset->portrange.set)
 159                                 {
 160                                         warn_section("ipset", ipset, e, "portrange ignored");
 161                                         ipset->portrange.set = false;
 162                                 }
 163
 164                                 if (!(ipset_types[i].optional & OPT_NETMASK) &&
 165                                     ipset->netmask > 0)
 166                                 {
 167                                         warn_section("ipset", ipset, e, "netmask ignored");
 168                                         ipset->netmask = 0;
 169                                 }
 170
 171                                 if (!(ipset_types[i].optional & OPT_HASHSIZE) &&
 172                                     ipset->hashsize > 0)
 173                                 {
 174                                         warn_section("ipset", ipset, e, "hashsize ignored");
 175                                         ipset->hashsize = 0;
 176                                 }
 177
 178                                 if (!(ipset_types[i].optional & OPT_MAXELEM) &&
 179                                     ipset->maxelem > 0)
 180                                 {
 181                                         warn_section("ipset", ipset, e, "maxelem ignored");
 182                                         ipset->maxelem = 0;
 183                                 }
 184
 185                                 if (!(ipset_types[i].optional & OPT_FAMILY) &&
 186                                     ipset->family != FW3_FAMILY_V4)
 187                                 {
 188                                         warn_section("ipset", ipset, e, "family ignored");
 189                                         ipset->family = FW3_FAMILY_V4;
 190                                 }
 191                         }
 192
 193                         return true;
 194                 }
 195         }
 196
 197         warn_section("ipset", ipset, e, "has an invalid combination of storage method and matches");
 198         return false;
 199 }
 200
 201 static bool
 202 check_ipset(struct fw3_state *state, struct fw3_ipset *ipset, struct uci_element *e)
 203 {
 204         if (ipset->external)
 205         {
 206                 if (!*ipset->external)
 207                         ipset->external = NULL;
 208                 else if (!ipset->name)
 209                         ipset->name = ipset->external;
 210         }
 211
 212         if (!ipset->name || !*ipset->name)
 213         {
 214                 warn_section("ipset", ipset, e, "ipset must have a name assigned");
 215         }
 216         //else if (fw3_lookup_ipset(state, ipset->name) != NULL)
 217         //{
 218         //      warn_section("ipset", ipset, e, "has duplicated set name", ipset->name);
 219         //}
 220         else if (ipset->family == FW3_FAMILY_ANY)
 221         {
 222                 warn_section("ipset", ipset, e, "must not have family 'any'");
 223         }
 224         else if (ipset->iprange.set && ipset->family != ipset->iprange.family)
 225         {
 226                 warn_section("ipset", ipset, e, "has iprange of wrong address family");
 227         }
 228         else if (list_empty(&ipset->datatypes))
 229         {
 230                 warn_section("ipset", ipset, e, "has no datatypes assigned");
 231         }
 232         else if (check_types(e, ipset))
 233         {
 234                 return true;
 235         }
 236
 237         return false;
 238 }
 239
 240 static struct fw3_ipset *
 241 fw3_alloc_ipset(struct fw3_state *state)
 242 {
 243         struct fw3_ipset *ipset;
 244
 245         ipset = calloc(1, sizeof(*ipset));
 246         if (!ipset)
 247                 return NULL;
 248
 249         INIT_LIST_HEAD(&ipset->datatypes);
 250
 251         ipset->enabled = true;
 252         ipset->family  = FW3_FAMILY_V4;
 253
 254         list_add_tail(&ipset->list, &state->ipsets);
 255
 256         return ipset;
 257 }
 258
 259 void
 260 fw3_load_ipsets(struct fw3_state *state, struct uci_package *p,
 261                 struct blob_attr *a)
 262 {
 263         struct uci_section *s;
 264         struct uci_element *e;
 265         struct fw3_ipset *ipset;
 266         struct blob_attr *entry;
 267         unsigned rem;
 268
 269         INIT_LIST_HEAD(&state->ipsets);
 270
 271         if (state->disable_ipsets)
 272                 return;
 273
 274         blob_for_each_attr(entry, a, rem)
 275         {
 276                 const char *type;
 277                 const char *name = "ubus ipset";
 278
 279                 if (!fw3_attr_parse_name_type(entry, &name, &type))
 280                         continue;
 281
 282                 if (strcmp(type, "ipset"))
 283                         continue;
 284
 285                 ipset = fw3_alloc_ipset(state);
 286                 if (!ipset)
 287                         continue;
 288
 289                 if (!fw3_parse_blob_options(ipset, fw3_ipset_opts, entry, name))
 290                 {
 291                         warn_section("ipset", ipset, NULL, "skipped due to invalid options");
 292                         fw3_free_ipset(ipset);
 293                         continue;
 294                 }
 295
 296                 if (!check_ipset(state, ipset, NULL))
 297                         fw3_free_ipset(ipset);
 298         }
 299
 300         uci_foreach_element(&p->sections, e)
 301         {
 302                 s = uci_to_section(e);
 303
 304                 if (strcmp(s->type, "ipset"))
 305                         continue;
 306
 307                 ipset = fw3_alloc_ipset(state);
 308
 309                 if (!ipset)
 310                         continue;
 311
 312                 if (!fw3_parse_options(ipset, fw3_ipset_opts, s))
 313                         warn_elem(e, "has invalid options");
 314
 315                 if (!check_ipset(state, ipset, e))
 316                         fw3_free_ipset(ipset);
 317         }
 318 }
 319
 320
 321 static void
 322 create_ipset(struct fw3_ipset *ipset, struct fw3_state *state)
 323 {
 324         bool first = true;
 325
 326         struct fw3_ipset_datatype *type;
 327
 328         info(" * Creating ipset %s", ipset->name);
 329
 330         first = true;
 331         fw3_pr("create %s %s", ipset->name, fw3_ipset_method_names[ipset->method]);
 332
 333         list_for_each_entry(type, &ipset->datatypes, list)
 334         {
 335                 fw3_pr("%c%s", first ? ':' : ',', fw3_ipset_type_names[type->type]);
 336                 first = false;
 337         }
 338
 339         if (ipset->method == FW3_IPSET_METHOD_HASH)
 340                 fw3_pr(" family inet%s", (ipset->family == FW3_FAMILY_V4) ? "" : "6");
 341
 342         if (ipset->iprange.set)
 343         {
 344                 fw3_pr(" range %s", fw3_address_to_string(&ipset->iprange, false, true));
 345         }
 346         else if (ipset->portrange.set)
 347         {
 348                 fw3_pr(" range %u-%u",
 349                        ipset->portrange.port_min, ipset->portrange.port_max);
 350         }
 351
 352         if (ipset->timeout > 0)
 353                 fw3_pr(" timeout %u", ipset->timeout);
 354
 355         if (ipset->maxelem > 0)
 356                 fw3_pr(" maxelem %u", ipset->maxelem);
 357
 358         if (ipset->netmask > 0)
 359                 fw3_pr(" netmask %u", ipset->netmask);
 360
 361         if (ipset->hashsize > 0)
 362                 fw3_pr(" hashsize %u", ipset->hashsize);
 363
 364         fw3_pr("\n");
 365 }
 366
 367 void
 368 fw3_create_ipsets(struct fw3_state *state)
 369 {
 370         int tries;
 371         bool exec = false;
 372         struct fw3_ipset *ipset;
 373
 374         if (state->disable_ipsets)
 375                 return;
 376
 377         /* spawn ipsets */
 378         list_for_each_entry(ipset, &state->ipsets, list)
 379         {
 380                 if (ipset->external)
 381                         continue;
 382
 383                 if (!exec)
 384                 {
 385                         exec = fw3_command_pipe(false, "ipset", "-exist", "-");
 386
 387                         if (!exec)
 388                                 return;
 389                 }
 390
 391                 create_ipset(ipset, state);
 392         }
 393
 394         if (exec)
 395         {
 396                 fw3_pr("quit\n");
 397                 fw3_command_close();
 398         }
 399
 400         /* wait for ipsets to appear */
 401         list_for_each_entry(ipset, &state->ipsets, list)
 402         {
 403                 if (ipset->external)
 404                         continue;
 405
 406                 for (tries = 0; !fw3_check_ipset(ipset) && tries < 10; tries++)
 407                         usleep(50000);
 408         }
 409 }
 410
 411 void
 412 fw3_destroy_ipsets(struct fw3_state *state)
 413 {
 414         int tries;
 415         bool exec = false;
 416         struct fw3_ipset *ipset;
 417
 418         /* destroy ipsets */
 419         list_for_each_entry(ipset, &state->ipsets, list)
 420         {
 421                 if (!exec)
 422                 {
 423                         exec = fw3_command_pipe(false, "ipset", "-exist", "-");
 424
 425                         if (!exec)
 426                                 return;
 427                 }
 428
 429                 info(" * Deleting ipset %s", ipset->name);
 430
 431                 fw3_pr("flush %s\n", ipset->name);
 432                 fw3_pr("destroy %s\n", ipset->name);
 433         }
 434
 435         if (exec)
 436         {
 437                 fw3_pr("quit\n");
 438                 fw3_command_close();
 439         }
 440
 441         /* wait for ipsets to disappear */
 442         list_for_each_entry(ipset, &state->ipsets, list)
 443         {
 444                 if (ipset->external)
 445                         continue;
 446
 447                 for (tries = 0; fw3_check_ipset(ipset) && tries < 10; tries++)
 448                         usleep(50000);
 449         }
 450 }
 451
 452 struct fw3_ipset *
 453 fw3_lookup_ipset(struct fw3_state *state, const char *name)
 454 {
 455         struct fw3_ipset *s;
 456
 457         if (list_empty(&state->ipsets))
 458                 return NULL;
 459
 460         list_for_each_entry(s, &state->ipsets, list)
 461         {
 462                 if (strcmp(s->name, name))
 463                         continue;
 464
 465                 return s;
 466         }
 467
 468         return NULL;
 469 }
 470
 471 bool
 472 fw3_check_ipset(struct fw3_ipset *set)
 473 {
 474         bool rv = false;
 475
 476         socklen_t sz;
 477         int s = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
 478         struct ip_set_req_version req_ver;
 479         struct ip_set_req_get_set req_name;
 480
 481         if (s < 0 || fcntl(s, F_SETFD, FD_CLOEXEC))
 482                 goto out;
 483
 484         sz = sizeof(req_ver);
 485         req_ver.op = IP_SET_OP_VERSION;
 486
 487         if (getsockopt(s, SOL_IP, SO_IP_SET, &req_ver, &sz))
 488                 goto out;
 489
 490         sz = sizeof(req_name);
 491         req_name.op = IP_SET_OP_GET_BYNAME;
 492         req_name.version = req_ver.version;
 493         snprintf(req_name.set.name, IPSET_MAXNAMELEN - 1, "%s",
 494                  set->external ? set->external : set->name);
 495
 496         if (getsockopt(s, SOL_IP, SO_IP_SET, &req_name, &sz))
 497                 goto out;
 498
 499         rv = ((sz == sizeof(req_name)) && (req_name.set.index != IPSET_INVALID_ID));
 500
 501 out:
 502         if (s >= 0)
 503                 close(s);
 504
 505         return rv;
 506 }