add support for setting sysctls, remove tcp_westwood option, its not present on curre...
[project/firewall3.git] / ipsets.c
1 /*
2  * firewall3 - 3rd OpenWrt UCI firewall implementation
3  *
4  *   Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
5  *
6  * Permission to use, copy, modify, and/or distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18
19 #include "ipsets.h"
20
21
22 const struct fw3_option fw3_ipset_opts[] = {
23         FW3_OPT("name",          string,         ipset,     name),
24         FW3_OPT("family",        family,         ipset,     family),
25
26         FW3_OPT("storage",       ipset_method,   ipset,     method),
27         FW3_LIST("match",        ipset_datatype, ipset,     datatypes),
28
29         FW3_OPT("iprange",       address,        ipset,     iprange),
30         FW3_OPT("portrange",     port,           ipset,     portrange),
31
32         FW3_OPT("netmask",       int,            ipset,     netmask),
33         FW3_OPT("maxelem",       int,            ipset,     maxelem),
34         FW3_OPT("hashsize",      int,            ipset,     hashsize),
35         FW3_OPT("timeout",       int,            ipset,     timeout),
36
37         FW3_OPT("external",      string,         ipset,     external),
38
39         { }
40 };
41
42 #define T(m, t1, t2, t3, r, o) \
43         { FW3_IPSET_METHOD_##m, \
44           FW3_IPSET_TYPE_##t1 | (FW3_IPSET_TYPE_##t2 << 8) | (FW3_IPSET_TYPE_##t3 << 16), \
45           r, o }
46
47 enum ipset_optflag {
48         OPT_IPRANGE   = (1 << 0),
49         OPT_PORTRANGE = (1 << 1),
50         OPT_NETMASK   = (1 << 2),
51         OPT_HASHSIZE  = (1 << 3),
52         OPT_MAXELEM   = (1 << 4),
53         OPT_FAMILY    = (1 << 5),
54 };
55
56 struct ipset_type {
57         enum fw3_ipset_method method;
58         uint32_t types;
59         uint8_t required;
60         uint8_t optional;
61 };
62
63 static struct ipset_type ipset_types[] = {
64         T(BITMAP, IP,   UNSPEC, UNSPEC, OPT_IPRANGE, OPT_NETMASK),
65         T(BITMAP, IP,   MAC,    UNSPEC, OPT_IPRANGE, 0),
66         T(BITMAP, PORT, UNSPEC, UNSPEC, OPT_PORTRANGE, 0),
67
68         T(HASH,   IP,   UNSPEC, UNSPEC, 0,
69           OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM | OPT_NETMASK),
70         T(HASH,   NET,  UNSPEC, UNSPEC, 0,
71           OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM),
72         T(HASH,   IP,   PORT,   UNSPEC, 0,
73           OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM),
74         T(HASH,   NET,  PORT,   UNSPEC, 0,
75           OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM),
76         T(HASH,   IP,   PORT,   IP,     0,
77           OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM),
78         T(HASH,   IP,   PORT,   NET,    0,
79           OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM),
80
81         T(LIST,   SET,  UNSPEC, UNSPEC, 0, OPT_MAXELEM),
82 };
83
84
85 static bool
86 check_types(struct uci_element *e, struct fw3_ipset *ipset)
87 {
88         int i = 0;
89         uint32_t typelist = 0;
90         struct fw3_ipset_datatype *type;
91
92         const char *methods[] = {
93                 "(bug)",
94                 "bitmap",
95                 "hash",
96                 "list",
97         };
98
99         typelist = 0;
100
101         list_for_each_entry(type, &ipset->datatypes, list)
102         {
103                 if (i >= 3)
104                 {
105                         warn_elem(e, "must not have more than 3 datatypes assigned");
106                         return false;
107                 }
108
109                 typelist |= (type->type << (i++ * 8));
110         }
111
112         /* find a suitable storage method if none specified */
113         if (ipset->method == FW3_IPSET_METHOD_UNSPEC)
114         {
115                 for (i = 0; i < ARRAY_SIZE(ipset_types); i++)
116                 {
117                         if (ipset_types[i].types == typelist)
118                         {
119                                 ipset->method = ipset_types[i].method;
120
121                                 warn_elem(e, "defines no storage method, assuming '%s'",
122                                           methods[ipset->method]);
123
124                                 break;
125                         }
126                 }
127         }
128
129         //typelist |= ipset->method;
130
131         for (i = 0; i < ARRAY_SIZE(ipset_types); i++)
132         {
133                 if (ipset_types[i].method == ipset->method &&
134                     ipset_types[i].types == typelist)
135                 {
136                         if (!ipset->external || !*ipset->external)
137                         {
138                                 if ((ipset_types[i].required & OPT_IPRANGE) &&
139                                         !ipset->iprange.set)
140                                 {
141                                         warn_elem(e, "requires an ip range");
142                                         return false;
143                                 }
144
145                                 if ((ipset_types[i].required & OPT_PORTRANGE) &&
146                                     !ipset->portrange.set)
147                                 {
148                                         warn_elem(e, "requires a port range");
149                                         return false;
150                                 }
151
152                                 if (!(ipset_types[i].required & OPT_IPRANGE) &&
153                                     ipset->iprange.set)
154                                 {
155                                         warn_elem(e, "iprange ignored");
156                                         ipset->iprange.set = false;
157                                 }
158
159                                 if (!(ipset_types[i].required & OPT_PORTRANGE) &&
160                                     ipset->portrange.set)
161                                 {
162                                         warn_elem(e, "portrange ignored");
163                                         ipset->portrange.set = false;
164                                 }
165
166                                 if (!(ipset_types[i].optional & OPT_NETMASK) &&
167                                     ipset->netmask > 0)
168                                 {
169                                         warn_elem(e, "netmask ignored");
170                                         ipset->netmask = 0;
171                                 }
172
173                                 if (!(ipset_types[i].optional & OPT_HASHSIZE) &&
174                                     ipset->hashsize > 0)
175                                 {
176                                         warn_elem(e, "hashsize ignored");
177                                         ipset->hashsize = 0;
178                                 }
179
180                                 if (!(ipset_types[i].optional & OPT_MAXELEM) &&
181                                     ipset->maxelem > 0)
182                                 {
183                                         warn_elem(e, "maxelem ignored");
184                                         ipset->maxelem = 0;
185                                 }
186
187                                 if (!(ipset_types[i].optional & OPT_FAMILY) &&
188                                     ipset->family != FW3_FAMILY_ANY)
189                                 {
190                                         warn_elem(e, "family ignored");
191                                         ipset->family = FW3_FAMILY_ANY;
192                                 }
193                         }
194
195                         return true;
196                 }
197         }
198
199         warn_elem(e, "has an invalid combination of storage method and matches");
200         return false;
201 }
202
203 struct fw3_ipset *
204 fw3_alloc_ipset(void)
205 {
206         struct fw3_ipset *ipset;
207
208         ipset = malloc(sizeof(*ipset));
209
210         if (!ipset)
211                 return NULL;
212
213         memset(ipset, 0, sizeof(*ipset));
214
215         INIT_LIST_HEAD(&ipset->datatypes);
216
217         return ipset;
218 }
219
220 void
221 fw3_load_ipsets(struct fw3_state *state, struct uci_package *p)
222 {
223         struct uci_section *s;
224         struct uci_element *e;
225         struct fw3_ipset *ipset;
226
227         INIT_LIST_HEAD(&state->ipsets);
228
229         if (state->disable_ipsets)
230                 return;
231
232         uci_foreach_element(&p->sections, e)
233         {
234                 s = uci_to_section(e);
235
236                 if (strcmp(s->type, "ipset"))
237                         continue;
238
239                 ipset = fw3_alloc_ipset();
240
241                 if (!ipset)
242                         continue;
243
244                 fw3_parse_options(ipset, fw3_ipset_opts, s);
245
246                 if (!ipset->name || !*ipset->name)
247                 {
248                         warn_elem(e, "must have a name assigned");
249                 }
250                 //else if (fw3_lookup_ipset(state, ipset->name) != NULL)
251                 //{
252                 //      warn_elem(e, "has duplicated set name '%s'", ipset->name);
253                 //}
254                 else if (list_empty(&ipset->datatypes))
255                 {
256                         warn_elem(e, "has no datatypes assigned");
257                 }
258                 else if (check_types(e, ipset))
259                 {
260                         list_add_tail(&ipset->list, &state->ipsets);
261                         continue;
262                 }
263
264                 fw3_free_ipset(ipset);
265         }
266 }
267
268
269 static void
270 create_ipset(struct fw3_ipset *ipset, struct fw3_state *state)
271 {
272         bool first = true;
273         char s[INET6_ADDRSTRLEN];
274
275         struct fw3_ipset_datatype *type;
276         struct fw3_address *a;
277
278         const char *methods[] = {
279                 "(bug)",
280                 "bitmap",
281                 "hash",
282                 "list",
283         };
284
285         const char *types[] = {
286                 "(bug)",
287                 "ip",
288                 "port",
289                 "mac",
290                 "net",
291                 "set",
292         };
293
294         if (ipset->external && *ipset->external)
295                 return;
296
297         info("Creating ipset %s", ipset->name);
298
299         first = true;
300         fw3_pr("create %s %s", ipset->name, methods[ipset->method]);
301
302         list_for_each_entry(type, &ipset->datatypes, list)
303         {
304                 fw3_pr("%c%s", first ? ':' : ',', types[type->type]);
305                 first = false;
306         }
307
308         if (ipset->iprange.set)
309         {
310                 a = &ipset->iprange;
311
312                 if (!a->range)
313                 {
314                         inet_ntop(a->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
315                                   &a->address.v6, s, sizeof(s));
316
317                         fw3_pr(" range %s/%u", s, a->mask);
318                 }
319                 else
320                 {
321                         inet_ntop(a->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
322                                   &a->address.v6, s, sizeof(s));
323
324                         fw3_pr(" range %s", s);
325
326                         inet_ntop(a->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
327                                   &a->address2.v6, s, sizeof(s));
328
329                         fw3_pr("-%s", s);
330                 }
331         }
332         else if (ipset->portrange.set)
333         {
334                 fw3_pr(" range %u-%u",
335                        ipset->portrange.port_min, ipset->portrange.port_max);
336         }
337
338         if (ipset->family != FW3_FAMILY_ANY)
339                 fw3_pr(" family inet%s", (ipset->family == FW3_FAMILY_V4) ? "" : "6");
340
341         if (ipset->timeout > 0)
342                 fw3_pr(" timeout %u", ipset->timeout);
343
344         if (ipset->maxelem > 0)
345                 fw3_pr(" maxelem %u", ipset->maxelem);
346
347         if (ipset->netmask > 0)
348                 fw3_pr(" netmask %u", ipset->netmask);
349
350         if (ipset->hashsize > 0)
351                 fw3_pr(" hashsize %u", ipset->hashsize);
352
353         fw3_pr("\n");
354
355         fw3_set_running(ipset, &state->running_ipsets);
356 }
357
358 void
359 fw3_create_ipsets(struct fw3_state *state)
360 {
361         struct fw3_ipset *ipset;
362
363         if (state->disable_ipsets)
364                 return;
365
366         list_for_each_entry(ipset, &state->ipsets, list)
367                 if (!fw3_lookup_ipset(state, ipset->name, true))
368                         create_ipset(ipset, state);
369
370         fw3_pr("quit\n");
371 }
372
373 void
374 fw3_destroy_ipsets(struct fw3_state *state)
375 {
376         struct fw3_ipset *s, *tmp;
377         int mask = (1 << FW3_FAMILY_V4) | (1 << FW3_FAMILY_V6);
378
379         list_for_each_entry_safe(s, tmp, &state->running_ipsets, running_list)
380         {
381                 if (!hasbit(state->defaults.flags, FW3_FAMILY_V4))
382                         delbit(s->flags, FW3_FAMILY_V4);
383
384                 if (!hasbit(state->defaults.flags, FW3_FAMILY_V6))
385                         delbit(s->flags, FW3_FAMILY_V6);
386
387                 if (!(s->flags & mask))
388                 {
389                         info("Deleting ipset %s", s->name);
390
391                         fw3_pr("flush %s\n", s->name);
392                         fw3_pr("destroy %s\n", s->name);
393
394                         fw3_set_running(s, NULL);
395                 }
396         }
397 }
398
399 struct fw3_ipset *
400 fw3_lookup_ipset(struct fw3_state *state, const char *name, bool running)
401 {
402         struct fw3_ipset *s;
403
404         if (list_empty(&state->ipsets))
405                 return NULL;
406
407         list_for_each_entry(s, &state->ipsets, list)
408         {
409                 if (strcmp(s->name, name))
410                         continue;
411
412                 if (!running || s->running_list.next)
413                         return s;
414
415                 break;
416         }
417
418         return NULL;
419 }