main.c

   1 /*
   2  * firewall3 - 3rd OpenWrt UCI firewall implementation
   3  *
   4  *   Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
   5  *
   6  * Permission to use, copy, modify, and/or distribute this software for any
   7  * purpose with or without fee is hereby granted, provided that the above
   8  * copyright notice and this permission notice appear in all copies.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17  */
  18
  19 #include <stdio.h>
  20 #include <unistd.h>
  21
  22 #include "options.h"
  23 #include "defaults.h"
  24 #include "zones.h"
  25 #include "rules.h"
  26 #include "redirects.h"
  27 #include "forwards.h"
  28 #include "ipsets.h"
  29 #include "ubus.h"
  30
  31
  32 static bool print_rules = false;
  33 static enum fw3_family use_family = FW3_FAMILY_ANY;
  34
  35
  36 static struct fw3_state *
  37 build_state(void)
  38 {
  39         struct fw3_state *state = NULL;
  40         struct uci_package *p = NULL;
  41
  42         state = malloc(sizeof(*state));
  43
  44         if (!state)
  45                 error("Out of memory");
  46
  47         memset(state, 0, sizeof(*state));
  48         state->uci = uci_alloc_context();
  49
  50         if (!state->uci)
  51                 error("Out of memory");
  52
  53         if (uci_load(state->uci, "firewall", &p))
  54         {
  55                 uci_perror(state->uci, NULL);
  56                 error("Failed to load /etc/config/firewall");
  57         }
  58
  59         if (!fw3_find_command("ipset"))
  60         {
  61                 warn("Unable to locate ipset utility, disabling ipset support");
  62                 state->disable_ipsets = true;
  63         }
  64
  65         INIT_LIST_HEAD(&state->running_zones);
  66         INIT_LIST_HEAD(&state->running_ipsets);
  67
  68         fw3_load_defaults(state, p);
  69         fw3_load_ipsets(state, p);
  70         fw3_load_zones(state, p);
  71         fw3_load_rules(state, p);
  72         fw3_load_redirects(state, p);
  73         fw3_load_forwards(state, p);
  74
  75         state->statefile = fw3_read_statefile(state);
  76
  77         return state;
  78 }
  79
  80 static void
  81 free_state(struct fw3_state *state)
  82 {
  83         struct list_head *cur, *tmp;
  84
  85         list_for_each_safe(cur, tmp, &state->zones)
  86                 fw3_free_zone((struct fw3_zone *)cur);
  87
  88         list_for_each_safe(cur, tmp, &state->rules)
  89                 fw3_free_rule((struct fw3_rule *)cur);
  90
  91         list_for_each_safe(cur, tmp, &state->redirects)
  92                 fw3_free_redirect((struct fw3_redirect *)cur);
  93
  94         list_for_each_safe(cur, tmp, &state->forwards)
  95                 fw3_free_forward((struct fw3_forward *)cur);
  96
  97         list_for_each_safe(cur, tmp, &state->ipsets)
  98                 fw3_free_ipset((struct fw3_ipset *)cur);
  99
 100         uci_free_context(state->uci);
 101
 102         free(state);
 103
 104         fw3_ubus_disconnect();
 105 }
 106
 107
 108 static bool
 109 restore_pipe(enum fw3_family family, bool silent)
 110 {
 111         const char *cmd;
 112
 113         cmd = (family == FW3_FAMILY_V4) ? "iptables-restore" : "ip6tables-restore";
 114
 115         if (print_rules)
 116                 return fw3_stdout_pipe();
 117
 118         if (!fw3_command_pipe(silent, cmd, "--lenient", "--noflush"))
 119         {
 120                 warn("Unable to execute %s", cmd);
 121                 return false;
 122         }
 123
 124         return true;
 125 }
 126
 127 static bool
 128 family_running(struct fw3_state *state, enum fw3_family family)
 129 {
 130         return hasbit(state->running_defaults.flags, family);
 131 }
 132
 133 static bool
 134 family_used(enum fw3_family family)
 135 {
 136         return (use_family == FW3_FAMILY_ANY) || (use_family == family);
 137 }
 138
 139 static bool
 140 family_loaded(struct fw3_state *state, enum fw3_family family)
 141 {
 142         return hasbit(state->defaults.flags, family);
 143 }
 144
 145 static void
 146 family_set(struct fw3_state *state, enum fw3_family family, bool set)
 147 {
 148         if (set)
 149                 setbit(state->defaults.flags, family);
 150         else
 151                 delbit(state->defaults.flags, family);
 152 }
 153
 154 static int
 155 stop(struct fw3_state *state, bool complete, bool restart)
 156 {
 157         int rv = 1;
 158         enum fw3_family family;
 159         enum fw3_table table;
 160
 161         if (!complete && !state->statefile)
 162         {
 163                 if (!restart)
 164                         warn("The firewall appears to be stopped. "
 165                                  "Use the 'flush' command to forcefully purge all rules.");
 166
 167                 return rv;
 168         }
 169
 170         for (family = FW3_FAMILY_V4; family <= FW3_FAMILY_V6; family++)
 171         {
 172                 if (!complete && !family_running(state, family))
 173                         continue;
 174
 175                 if (!family_used(family) || !restore_pipe(family, true))
 176                         continue;
 177
 178                 info("Removing %s rules ...", fw3_flag_names[family]);
 179
 180                 for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++)
 181                 {
 182                         if (!fw3_has_table(family == FW3_FAMILY_V6, fw3_flag_names[table]))
 183                                 continue;
 184
 185                         info(" * %sing %s table",
 186                              complete ? "Flush" : "Clear", fw3_flag_names[table]);
 187
 188                         fw3_pr("*%s\n", fw3_flag_names[table]);
 189
 190                         if (complete)
 191                         {
 192                                 fw3_flush_all(table);
 193                         }
 194                         else
 195                         {
 196                                 /* pass 1 */
 197                                 fw3_flush_rules(table, family, false, state);
 198                                 fw3_flush_zones(table, family, false, state);
 199
 200                                 /* pass 2 */
 201                                 fw3_flush_rules(table, family, true, state);
 202                                 fw3_flush_zones(table, family, true, state);
 203                         }
 204
 205                         fw3_pr("COMMIT\n");
 206                 }
 207
 208                 fw3_command_close();
 209
 210                 if (!restart)
 211                         family_set(state, family, false);
 212
 213                 rv = 0;
 214         }
 215
 216         if (!restart && fw3_command_pipe(false, "ipset", "-exist", "-"))
 217         {
 218                 fw3_destroy_ipsets(state);
 219                 fw3_command_close();
 220         }
 221
 222         if (!rv)
 223                 fw3_write_statefile(state);
 224
 225         return rv;
 226 }
 227
 228 static int
 229 start(struct fw3_state *state, bool restart)
 230 {
 231         int rv = 1;
 232         enum fw3_family family;
 233         enum fw3_table table;
 234
 235         if (!print_rules && !restart &&
 236             fw3_command_pipe(false, "ipset", "-exist", "-"))
 237         {
 238                 fw3_create_ipsets(state);
 239                 fw3_command_close();
 240         }
 241
 242         for (family = FW3_FAMILY_V4; family <= FW3_FAMILY_V6; family++)
 243         {
 244                 if (!family_used(family))
 245                         continue;
 246
 247                 if (!print_rules && !restart && family_running(state, family))
 248                 {
 249                         warn("The %s firewall appears to be started already. "
 250                              "If it is indeed empty, remove the %s file and retry.",
 251                              fw3_flag_names[family], FW3_STATEFILE);
 252
 253                         continue;
 254                 }
 255
 256                 if (!family_loaded(state, family) || !restore_pipe(family, false))
 257                         continue;
 258
 259                 info("Constructing %s rules ...", fw3_flag_names[family]);
 260
 261                 for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++)
 262                 {
 263                         if (!fw3_has_table(family == FW3_FAMILY_V6, fw3_flag_names[table]))
 264                                 continue;
 265
 266                         info(" * Populating %s table", fw3_flag_names[table]);
 267
 268                         fw3_pr("*%s\n", fw3_flag_names[table]);
 269                         fw3_print_default_chains(table, family, state);
 270                         fw3_print_zone_chains(table, family, state);
 271                         fw3_print_default_head_rules(table, family, state);
 272                         fw3_print_rules(table, family, state);
 273                         fw3_print_redirects(table, family, state);
 274                         fw3_print_forwards(table, family, state);
 275                         fw3_print_zone_rules(table, family, state);
 276                         fw3_print_default_tail_rules(table, family, state);
 277                         fw3_pr("COMMIT\n");
 278                 }
 279
 280                 fw3_command_close();
 281                 family_set(state, family, true);
 282
 283                 rv = 0;
 284         }
 285
 286         if (!rv && !print_rules)
 287                 fw3_write_statefile(state);
 288
 289         return rv;
 290 }
 291
 292 static int
 293 lookup_network(struct fw3_state *state, const char *net)
 294 {
 295         struct fw3_zone *z;
 296         struct fw3_device *d;
 297
 298         list_for_each_entry(z, &state->zones, list)
 299         {
 300                 list_for_each_entry(d, &z->networks, list)
 301                 {
 302                         if (!strcmp(d->name, net))
 303                         {
 304                                 printf("%s\n", z->name);
 305                                 return 0;
 306                         }
 307                 }
 308         }
 309
 310         return 1;
 311 }
 312
 313 static int
 314 lookup_device(struct fw3_state *state, const char *dev)
 315 {
 316         struct fw3_zone *z;
 317         struct fw3_device *d;
 318
 319         list_for_each_entry(z, &state->zones, list)
 320         {
 321                 list_for_each_entry(d, &z->devices, list)
 322                 {
 323                         if (!strcmp(d->name, dev))
 324                         {
 325                                 printf("%s\n", z->name);
 326                                 return 0;
 327                         }
 328                 }
 329         }
 330
 331         return 1;
 332 }
 333
 334 static int
 335 usage(void)
 336 {
 337         fprintf(stderr, "fw3 [-4] [-6] [-q] {start|stop|flush|restart|print}\n");
 338         fprintf(stderr, "fw3 [-q] network {net}\n");
 339         fprintf(stderr, "fw3 [-q] device {dev}\n");
 340
 341         return 1;
 342 }
 343
 344
 345 int main(int argc, char **argv)
 346 {
 347         int ch, rv = 1;
 348         struct fw3_state *state = NULL;
 349         struct fw3_defaults *defs = NULL;
 350
 351         while ((ch = getopt(argc, argv, "46qh")) != -1)
 352         {
 353                 switch (ch)
 354                 {
 355                 case '4':
 356                         use_family = FW3_FAMILY_V4;
 357                         break;
 358
 359                 case '6':
 360                         use_family = FW3_FAMILY_V6;
 361                         break;
 362
 363                 case 'q':
 364                         freopen("/dev/null", "w", stderr);
 365                         break;
 366
 367                 case 'h':
 368                         rv = usage();
 369                         goto out;
 370                 }
 371         }
 372
 373         if (!fw3_ubus_connect())
 374                 error("Failed to connect to ubus");
 375
 376         state = build_state();
 377         defs = &state->defaults;
 378
 379         if (!fw3_lock())
 380                 goto out;
 381
 382         if (optind >= argc)
 383         {
 384                 rv = usage();
 385                 goto out;
 386         }
 387
 388         if (use_family == FW3_FAMILY_V6 && defs->disable_ipv6)
 389                 warn("IPv6 rules globally disabled in configuration");
 390
 391         if (!strcmp(argv[optind], "print"))
 392         {
 393                 if (use_family == FW3_FAMILY_ANY)
 394                         use_family = FW3_FAMILY_V4;
 395
 396                 freopen("/dev/null", "w", stderr);
 397
 398                 state->disable_ipsets = true;
 399                 print_rules = true;
 400
 401                 rv = start(state, false);
 402         }
 403         else if (!strcmp(argv[optind], "start"))
 404         {
 405                 rv = start(state, false);
 406         }
 407         else if (!strcmp(argv[optind], "stop"))
 408         {
 409                 rv = stop(state, false, false);
 410         }
 411         else if (!strcmp(argv[optind], "flush"))
 412         {
 413                 rv = stop(state, true, false);
 414         }
 415         else if (!strcmp(argv[optind], "restart"))
 416         {
 417                 rv = stop(state, false, true);
 418                 rv = start(state, !rv);
 419         }
 420         else if (!strcmp(argv[optind], "network") && (optind + 1) < argc)
 421         {
 422                 rv = lookup_network(state, argv[optind + 1]);
 423         }
 424         else if (!strcmp(argv[optind], "device") && (optind + 1) < argc)
 425         {
 426                 rv = lookup_device(state, argv[optind + 1]);
 427         }
 428         else
 429         {
 430                 rv = usage();
 431         }
 432
 433 out:
 434         if (state)
 435                 free_state(state);
 436
 437         fw3_unlock();
 438
 439         return rv;
 440 }