ipsets.c

   1 /*
   2  * firewall3 - 3rd OpenWrt UCI firewall implementation
   3  *
   4  *   Copyright (C) 2013 Jo-Philipp Wich <jo@mein.io>
   5  *
   6  * Permission to use, copy, modify, and/or distribute this software for any
   7  * purpose with or without fee is hereby granted, provided that the above
   8  * copyright notice and this permission notice appear in all copies.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17  */
  18
  19 #include "ipsets.h"
  20
  21
  22 const struct fw3_option fw3_ipset_opts[] = {
  23         FW3_OPT("enabled",       bool,           ipset,     enabled),
  24
  25         FW3_OPT("name",          string,         ipset,     name),
  26         FW3_OPT("family",        family,         ipset,     family),
  27
  28         FW3_OPT("storage",       ipset_method,   ipset,     method),
  29         FW3_LIST("match",        ipset_datatype, ipset,     datatypes),
  30
  31         FW3_OPT("iprange",       address,        ipset,     iprange),
  32         FW3_OPT("portrange",     port,           ipset,     portrange),
  33
  34         FW3_OPT("netmask",       int,            ipset,     netmask),
  35         FW3_OPT("maxelem",       int,            ipset,     maxelem),
  36         FW3_OPT("hashsize",      int,            ipset,     hashsize),
  37         FW3_OPT("timeout",       int,            ipset,     timeout),
  38
  39         FW3_OPT("external",      string,         ipset,     external),
  40
  41         FW3_LIST("entry",        setentry,       ipset,     entries),
  42         FW3_OPT("loadfile",      string,         ipset,     loadfile),
  43
  44         { }
  45 };
  46
  47 #define T(m, t1, t2, t3, r, o) \
  48         { FW3_IPSET_METHOD_##m, \
  49           FW3_IPSET_TYPE_##t1 | (FW3_IPSET_TYPE_##t2 << 8) | (FW3_IPSET_TYPE_##t3 << 16), \
  50           r, o }
  51
  52 enum ipset_optflag {
  53         OPT_IPRANGE   = (1 << 0),
  54         OPT_PORTRANGE = (1 << 1),
  55         OPT_NETMASK   = (1 << 2),
  56         OPT_HASHSIZE  = (1 << 3),
  57         OPT_MAXELEM   = (1 << 4),
  58         OPT_FAMILY    = (1 << 5),
  59 };
  60
  61 struct ipset_type {
  62         enum fw3_ipset_method method;
  63         uint32_t types;
  64         uint8_t required;
  65         uint8_t optional;
  66 };
  67
  68 static struct ipset_type ipset_types[] = {
  69         T(BITMAP, IP,   UNSPEC, UNSPEC, OPT_IPRANGE, OPT_NETMASK),
  70         T(BITMAP, IP,   MAC,    UNSPEC, OPT_IPRANGE, 0),
  71         T(BITMAP, PORT, UNSPEC, UNSPEC, OPT_PORTRANGE, 0),
  72
  73         T(HASH,   IP,   UNSPEC, UNSPEC, 0,
  74           OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM | OPT_NETMASK),
  75         T(HASH,   NET,  UNSPEC, UNSPEC, 0,
  76           OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM),
  77         T(HASH,   IP,   PORT,   UNSPEC, 0,
  78           OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM),
  79         T(HASH,   NET,  PORT,   UNSPEC, 0,
  80           OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM),
  81         T(HASH,   IP,   PORT,   IP,     0,
  82           OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM),
  83         T(HASH,   IP,   PORT,   NET,    0,
  84           OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM),
  85
  86         T(LIST,   SET,  UNSPEC, UNSPEC, 0, OPT_MAXELEM),
  87 };
  88
  89
  90 static bool
  91 check_types(struct uci_element *e, struct fw3_ipset *ipset)
  92 {
  93         int i = 0;
  94         uint32_t typelist = 0;
  95         struct fw3_ipset_datatype *type;
  96
  97         list_for_each_entry(type, &ipset->datatypes, list)
  98         {
  99                 if (i >= 3)
 100                 {
 101                         warn_section("ipset", ipset, e, "must not have more than 3 datatypes assigned");
 102                         return false;
 103                 }
 104
 105                 typelist |= (type->type << (i++ * 8));
 106         }
 107
 108         /* find a suitable storage method if none specified */
 109         if (ipset->method == FW3_IPSET_METHOD_UNSPEC)
 110         {
 111                 for (i = 0; i < ARRAY_SIZE(ipset_types); i++)
 112                 {
 113                         /* skip type for v6 if it does not support family */
 114                         if (ipset->family != FW3_FAMILY_V4 &&
 115                             !(ipset_types[i].optional & OPT_FAMILY))
 116                                 continue;
 117
 118                         if (ipset_types[i].types == typelist)
 119                         {
 120                                 ipset->method = ipset_types[i].method;
 121
 122                                 warn_section("ipset", ipset, e, "defines no storage method, assuming '%s'",
 123                                         fw3_ipset_method_names[ipset->method]);
 124
 125                                 break;
 126                         }
 127                 }
 128         }
 129
 130         //typelist |= ipset->method;
 131
 132         for (i = 0; i < ARRAY_SIZE(ipset_types); i++)
 133         {
 134                 if (ipset_types[i].method == ipset->method &&
 135                     ipset_types[i].types == typelist)
 136                 {
 137                         if (!ipset->external)
 138                         {
 139                                 if ((ipset_types[i].required & OPT_IPRANGE) &&
 140                                         !ipset->iprange.set)
 141                                 {
 142                                         warn_section("ipset", ipset, e, "requires an ip range");
 143                                         return false;
 144                                 }
 145
 146                                 if ((ipset_types[i].required & OPT_PORTRANGE) &&
 147                                     !ipset->portrange.set)
 148                                 {
 149                                         warn_section("ipset", ipset, e, "requires a port range");
 150                                         return false;
 151                                 }
 152
 153                                 if (!(ipset_types[i].required & OPT_IPRANGE) &&
 154                                     ipset->iprange.set)
 155                                 {
 156                                         warn_section("ipset", ipset, e, "iprange ignored");
 157                                         ipset->iprange.set = false;
 158                                 }
 159
 160                                 if (!(ipset_types[i].required & OPT_PORTRANGE) &&
 161                                     ipset->portrange.set)
 162                                 {
 163                                         warn_section("ipset", ipset, e, "portrange ignored");
 164                                         ipset->portrange.set = false;
 165                                 }
 166
 167                                 if (!(ipset_types[i].optional & OPT_NETMASK) &&
 168                                     ipset->netmask > 0)
 169                                 {
 170                                         warn_section("ipset", ipset, e, "netmask ignored");
 171                                         ipset->netmask = 0;
 172                                 }
 173
 174                                 if (!(ipset_types[i].optional & OPT_HASHSIZE) &&
 175                                     ipset->hashsize > 0)
 176                                 {
 177                                         warn_section("ipset", ipset, e, "hashsize ignored");
 178                                         ipset->hashsize = 0;
 179                                 }
 180
 181                                 if (!(ipset_types[i].optional & OPT_MAXELEM) &&
 182                                     ipset->maxelem > 0)
 183                                 {
 184                                         warn_section("ipset", ipset, e, "maxelem ignored");
 185                                         ipset->maxelem = 0;
 186                                 }
 187
 188                                 if (!(ipset_types[i].optional & OPT_FAMILY) &&
 189                                     ipset->family != FW3_FAMILY_V4)
 190                                 {
 191                                         warn_section("ipset", ipset, e, "family ignored");
 192                                         ipset->family = FW3_FAMILY_V4;
 193                                 }
 194                         }
 195
 196                         return true;
 197                 }
 198         }
 199
 200         warn_section("ipset", ipset, e, "has an invalid combination of storage method and matches");
 201         return false;
 202 }
 203
 204 static bool
 205 check_ipset(struct fw3_state *state, struct fw3_ipset *ipset, struct uci_element *e)
 206 {
 207         if (ipset->external)
 208         {
 209                 if (!*ipset->external)
 210                         ipset->external = NULL;
 211                 else if (!ipset->name)
 212                         ipset->name = ipset->external;
 213         }
 214
 215         if (!ipset->name || !*ipset->name)
 216         {
 217                 warn_section("ipset", ipset, e, "ipset must have a name assigned");
 218         }
 219         //else if (fw3_lookup_ipset(state, ipset->name) != NULL)
 220         //{
 221         //      warn_section("ipset", ipset, e, "has duplicated set name", ipset->name);
 222         //}
 223         else if (ipset->family == FW3_FAMILY_ANY)
 224         {
 225                 warn_section("ipset", ipset, e, "must not have family 'any'");
 226         }
 227         else if (ipset->iprange.set && ipset->family != ipset->iprange.family)
 228         {
 229                 warn_section("ipset", ipset, e, "has iprange of wrong address family");
 230         }
 231         else if (list_empty(&ipset->datatypes))
 232         {
 233                 warn_section("ipset", ipset, e, "has no datatypes assigned");
 234         }
 235         else if (check_types(e, ipset))
 236         {
 237                 return true;
 238         }
 239
 240         return false;
 241 }
 242
 243 static struct fw3_ipset *
 244 fw3_alloc_ipset(struct fw3_state *state)
 245 {
 246         struct fw3_ipset *ipset;
 247
 248         ipset = calloc(1, sizeof(*ipset));
 249         if (!ipset)
 250                 return NULL;
 251
 252         INIT_LIST_HEAD(&ipset->datatypes);
 253         INIT_LIST_HEAD(&ipset->entries);
 254
 255         ipset->enabled = true;
 256         ipset->family  = FW3_FAMILY_V4;
 257
 258         list_add_tail(&ipset->list, &state->ipsets);
 259
 260         return ipset;
 261 }
 262
 263 void
 264 fw3_load_ipsets(struct fw3_state *state, struct uci_package *p,
 265                 struct blob_attr *a)
 266 {
 267         struct uci_section *s;
 268         struct uci_element *e;
 269         struct fw3_ipset *ipset;
 270         struct blob_attr *entry;
 271         unsigned rem;
 272
 273         INIT_LIST_HEAD(&state->ipsets);
 274
 275         if (state->disable_ipsets)
 276                 return;
 277
 278         blob_for_each_attr(entry, a, rem)
 279         {
 280                 const char *type;
 281                 const char *name = "ubus ipset";
 282
 283                 if (!fw3_attr_parse_name_type(entry, &name, &type))
 284                         continue;
 285
 286                 if (strcmp(type, "ipset"))
 287                         continue;
 288
 289                 ipset = fw3_alloc_ipset(state);
 290                 if (!ipset)
 291                         continue;
 292
 293                 if (!fw3_parse_blob_options(ipset, fw3_ipset_opts, entry, name))
 294                 {
 295                         warn_section("ipset", ipset, NULL, "skipped due to invalid options");
 296                         fw3_free_ipset(ipset);
 297                         continue;
 298                 }
 299
 300                 if (!check_ipset(state, ipset, NULL))
 301                         fw3_free_ipset(ipset);
 302         }
 303
 304         uci_foreach_element(&p->sections, e)
 305         {
 306                 s = uci_to_section(e);
 307
 308                 if (strcmp(s->type, "ipset"))
 309                         continue;
 310
 311                 ipset = fw3_alloc_ipset(state);
 312
 313                 if (!ipset)
 314                         continue;
 315
 316                 if (!fw3_parse_options(ipset, fw3_ipset_opts, s))
 317                         warn_elem(e, "has invalid options");
 318
 319                 if (!check_ipset(state, ipset, e))
 320                         fw3_free_ipset(ipset);
 321         }
 322 }
 323
 324
 325 static void
 326 load_file(struct fw3_ipset *ipset)
 327 {
 328         FILE *f;
 329         char line[128];
 330
 331         if (!ipset->loadfile)
 332                 return;
 333
 334         info("   * Loading file %s", ipset->loadfile);
 335
 336         f = fopen(ipset->loadfile, "r");
 337
 338         if (!f) {
 339                 info("     ! Skipping due to open error: %s", strerror(errno));
 340                 return;
 341         }
 342
 343         while (fgets(line, sizeof(line), f))
 344                 fw3_pr("add %s %s", ipset->name, line);
 345
 346         fclose(f);
 347 }
 348
 349 static void
 350 create_ipset(struct fw3_ipset *ipset, struct fw3_state *state)
 351 {
 352         bool first = true;
 353         struct fw3_setentry *entry;
 354         struct fw3_ipset_datatype *type;
 355
 356         info(" * Creating ipset %s", ipset->name);
 357
 358         first = true;
 359         fw3_pr("create %s %s", ipset->name, fw3_ipset_method_names[ipset->method]);
 360
 361         list_for_each_entry(type, &ipset->datatypes, list)
 362         {
 363                 fw3_pr("%c%s", first ? ':' : ',', fw3_ipset_type_names[type->type]);
 364                 first = false;
 365         }
 366
 367         if (ipset->method == FW3_IPSET_METHOD_HASH)
 368                 fw3_pr(" family inet%s", (ipset->family == FW3_FAMILY_V4) ? "" : "6");
 369
 370         if (ipset->iprange.set)
 371         {
 372                 fw3_pr(" range %s", fw3_address_to_string(&ipset->iprange, false, true));
 373         }
 374         else if (ipset->portrange.set)
 375         {
 376                 fw3_pr(" range %u-%u",
 377                        ipset->portrange.port_min, ipset->portrange.port_max);
 378         }
 379
 380         if (ipset->timeout > 0)
 381                 fw3_pr(" timeout %u", ipset->timeout);
 382
 383         if (ipset->maxelem > 0)
 384                 fw3_pr(" maxelem %u", ipset->maxelem);
 385
 386         if (ipset->netmask > 0)
 387                 fw3_pr(" netmask %u", ipset->netmask);
 388
 389         if (ipset->hashsize > 0)
 390                 fw3_pr(" hashsize %u", ipset->hashsize);
 391
 392         fw3_pr("\n");
 393
 394         list_for_each_entry(entry, &ipset->entries, list)
 395                 fw3_pr("add %s %s\n", ipset->name, entry->value);
 396
 397         load_file(ipset);
 398 }
 399
 400 void
 401 fw3_create_ipsets(struct fw3_state *state)
 402 {
 403         int tries;
 404         bool exec = false;
 405         struct fw3_ipset *ipset;
 406
 407         if (state->disable_ipsets)
 408                 return;
 409
 410         /* spawn ipsets */
 411         list_for_each_entry(ipset, &state->ipsets, list)
 412         {
 413                 if (ipset->external)
 414                         continue;
 415
 416                 if (!exec)
 417                 {
 418                         exec = fw3_command_pipe(false, "ipset", "-exist", "-");
 419
 420                         if (!exec)
 421                                 return;
 422                 }
 423
 424                 create_ipset(ipset, state);
 425         }
 426
 427         if (exec)
 428         {
 429                 fw3_pr("quit\n");
 430                 fw3_command_close();
 431         }
 432
 433         /* wait for ipsets to appear */
 434         list_for_each_entry(ipset, &state->ipsets, list)
 435         {
 436                 if (ipset->external)
 437                         continue;
 438
 439                 for (tries = 0; !fw3_check_ipset(ipset) && tries < 10; tries++)
 440                         usleep(50000);
 441         }
 442 }
 443
 444 void
 445 fw3_destroy_ipsets(struct fw3_state *state)
 446 {
 447         int tries;
 448         bool exec = false;
 449         struct fw3_ipset *ipset;
 450
 451         /* destroy ipsets */
 452         list_for_each_entry(ipset, &state->ipsets, list)
 453         {
 454                 if (!exec)
 455                 {
 456                         exec = fw3_command_pipe(false, "ipset", "-exist", "-");
 457
 458                         if (!exec)
 459                                 return;
 460                 }
 461
 462                 info(" * Deleting ipset %s", ipset->name);
 463
 464                 fw3_pr("flush %s\n", ipset->name);
 465                 fw3_pr("destroy %s\n", ipset->name);
 466         }
 467
 468         if (exec)
 469         {
 470                 fw3_pr("quit\n");
 471                 fw3_command_close();
 472         }
 473
 474         /* wait for ipsets to disappear */
 475         list_for_each_entry(ipset, &state->ipsets, list)
 476         {
 477                 if (ipset->external)
 478                         continue;
 479
 480                 for (tries = 0; fw3_check_ipset(ipset) && tries < 10; tries++)
 481                         usleep(50000);
 482         }
 483 }
 484
 485 struct fw3_ipset *
 486 fw3_lookup_ipset(struct fw3_state *state, const char *name)
 487 {
 488         struct fw3_ipset *s;
 489
 490         if (list_empty(&state->ipsets))
 491                 return NULL;
 492
 493         list_for_each_entry(s, &state->ipsets, list)
 494         {
 495                 if (strcmp(s->name, name))
 496                         continue;
 497
 498                 return s;
 499         }
 500
 501         return NULL;
 502 }
 503
 504 bool
 505 fw3_check_ipset(struct fw3_ipset *set)
 506 {
 507         bool rv = false;
 508
 509         socklen_t sz;
 510         int s = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
 511         struct ip_set_req_version req_ver;
 512         struct ip_set_req_get_set req_name;
 513
 514         if (s < 0 || fcntl(s, F_SETFD, FD_CLOEXEC))
 515                 goto out;
 516
 517         sz = sizeof(req_ver);
 518         req_ver.op = IP_SET_OP_VERSION;
 519
 520         if (getsockopt(s, SOL_IP, SO_IP_SET, &req_ver, &sz))
 521                 goto out;
 522
 523         sz = sizeof(req_name);
 524         req_name.op = IP_SET_OP_GET_BYNAME;
 525         req_name.version = req_ver.version;
 526         snprintf(req_name.set.name, IPSET_MAXNAMELEN - 1, "%s",
 527                  set->external ? set->external : set->name);
 528
 529         if (getsockopt(s, SOL_IP, SO_IP_SET, &req_name, &sz))
 530                 goto out;
 531
 532         rv = ((sz == sizeof(req_name)) && (req_name.set.index != IPSET_INVALID_ID));
 533
 534 out:
 535         if (s >= 0)
 536                 close(s);
 537
 538         return rv;
 539 }