firewall3: check the return value of fw3_parse_options()
[project/firewall3.git] / main.c
1 /*
2  * firewall3 - 3rd OpenWrt UCI firewall implementation
3  *
4  *   Copyright (C) 2013-2014 Jo-Philipp Wich <jo@mein.io>
5  *
6  * Permission to use, copy, modify, and/or distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18
19 #include <stdio.h>
20 #include <unistd.h>
21
22 #include "options.h"
23 #include "defaults.h"
24 #include "zones.h"
25 #include "rules.h"
26 #include "redirects.h"
27 #include "snats.h"
28 #include "forwards.h"
29 #include "ipsets.h"
30 #include "includes.h"
31 #include "ubus.h"
32 #include "iptables.h"
33
34
35 static enum fw3_family print_family = FW3_FAMILY_ANY;
36
37 static struct fw3_state *run_state = NULL;
38 static struct fw3_state *cfg_state = NULL;
39
40
41 static bool
42 build_state(bool runtime)
43 {
44         struct fw3_state *state = NULL;
45         struct uci_package *p = NULL;
46         FILE *sf;
47
48         state = calloc(1, sizeof(*state));
49         if (!state)
50                 error("Out of memory");
51
52         state->uci = uci_alloc_context();
53
54         if (!state->uci)
55                 error("Out of memory");
56
57         if (runtime)
58         {
59                 sf = fopen(FW3_STATEFILE, "r");
60
61                 if (sf)
62                 {
63                         uci_import(state->uci, sf, "fw3_state", &p, true);
64                         fclose(sf);
65                 }
66
67                 if (!p)
68                 {
69                         uci_free_context(state->uci);
70                         free(state);
71
72                         return false;
73                 }
74
75                 state->statefile = true;
76
77                 run_state = state;
78         }
79         else
80         {
81                 if (!fw3_ubus_connect())
82                         warn("Failed to connect to ubus");
83
84                 if (uci_load(state->uci, "firewall", &p))
85                 {
86                         uci_perror(state->uci, NULL);
87                         error("Failed to load /etc/config/firewall");
88                 }
89
90                 if (!fw3_find_command("ipset"))
91                 {
92                         warn("Unable to locate ipset utility, disabling ipset support");
93                         state->disable_ipsets = true;
94                 }
95
96                 cfg_state = state;
97         }
98
99
100         struct blob_buf b = {NULL, NULL, 0, NULL};
101         fw3_ubus_rules(&b);
102
103         fw3_load_defaults(state, p);
104         fw3_load_ipsets(state, p);
105         fw3_load_zones(state, p);
106         fw3_load_rules(state, p, b.head);
107         fw3_load_redirects(state, p);
108         fw3_load_snats(state, p, b.head);
109         fw3_load_forwards(state, p);
110         fw3_load_includes(state, p);
111
112         return true;
113 }
114
115 static void
116 free_state(struct fw3_state *state)
117 {
118         struct list_head *cur, *tmp;
119
120         list_for_each_safe(cur, tmp, &state->zones)
121                 fw3_free_zone((struct fw3_zone *)cur);
122
123         list_for_each_safe(cur, tmp, &state->rules)
124                 fw3_free_rule((struct fw3_rule *)cur);
125
126         list_for_each_safe(cur, tmp, &state->redirects)
127                 fw3_free_redirect((struct fw3_redirect *)cur);
128
129         list_for_each_safe(cur, tmp, &state->snats)
130                 fw3_free_snat((struct fw3_snat *)cur);
131
132         list_for_each_safe(cur, tmp, &state->forwards)
133                 fw3_free_forward((struct fw3_forward *)cur);
134
135         list_for_each_safe(cur, tmp, &state->ipsets)
136                 fw3_free_ipset((struct fw3_ipset *)cur);
137
138         list_for_each_safe(cur, tmp, &state->includes)
139                 fw3_free_include((struct fw3_include *)cur);
140
141         uci_free_context(state->uci);
142
143         free(state);
144
145         fw3_ubus_disconnect();
146 }
147
148
149 static bool
150 family_running(enum fw3_family family)
151 {
152         return (run_state && has(run_state->defaults.flags, family, family));
153 }
154
155 static void
156 family_set(struct fw3_state *state, enum fw3_family family, bool set)
157 {
158         if (!state)
159                 return;
160
161         if (set)
162                 set(state->defaults.flags, family, family);
163         else
164                 del(state->defaults.flags, family, family);
165 }
166
167 static int
168 stop(bool complete)
169 {
170         int rv = 1;
171         enum fw3_family family;
172         enum fw3_table table;
173         struct fw3_ipt_handle *handle;
174
175         if (!complete && !run_state)
176         {
177                 warn("The firewall appears to be stopped. "
178                          "Use the 'flush' command to forcefully purge all rules.");
179
180                 return rv;
181         }
182
183         if (!print_family && run_state)
184                 fw3_hotplug_zones(run_state, false);
185
186         for (family = FW3_FAMILY_V4; family <= FW3_FAMILY_V6; family++)
187         {
188                 if (!complete && !family_running(family))
189                         continue;
190
191                 for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++)
192                 {
193                         if (!fw3_has_table(family == FW3_FAMILY_V6, fw3_flag_names[table]))
194                                 continue;
195
196                         if (!(handle = fw3_ipt_open(family, table)))
197                                 continue;
198
199                         info(" * %sing %s %s table", complete ? "Flush" : "Clear",
200                              fw3_flag_names[family], fw3_flag_names[table]);
201
202                         if (complete)
203                         {
204                                 fw3_flush_all(handle);
205                         }
206                         else if (run_state)
207                         {
208                                 fw3_flush_rules(handle, run_state, false);
209                                 fw3_flush_zones(handle, run_state, false);
210                         }
211
212                         fw3_ipt_commit(handle);
213                         fw3_ipt_close(handle);
214                 }
215
216                 family_set(run_state, family, false);
217                 family_set(cfg_state, family, false);
218
219                 rv = 0;
220         }
221
222         if (run_state)
223                 fw3_destroy_ipsets(run_state);
224
225         if (complete)
226                 fw3_flush_conntrack(NULL);
227
228         if (!rv && run_state)
229                 fw3_write_statefile(run_state);
230
231         return rv;
232 }
233
234 static int
235 start(void)
236 {
237         int rv = 1;
238         enum fw3_family family;
239         enum fw3_table table;
240         struct fw3_ipt_handle *handle;
241
242         if (!print_family)
243                 fw3_create_ipsets(cfg_state);
244
245         for (family = FW3_FAMILY_V4; family <= FW3_FAMILY_V6; family++)
246         {
247                 if (family == FW3_FAMILY_V6 && cfg_state->defaults.disable_ipv6)
248                         continue;
249
250                 if (print_family && family != print_family)
251                         continue;
252
253                 if (!print_family && family_running(family))
254                 {
255                         warn("The %s firewall appears to be started already. "
256                              "If it is indeed empty, remove the %s file and retry.",
257                              fw3_flag_names[family], FW3_STATEFILE);
258
259                         continue;
260                 }
261
262                 for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++)
263                 {
264                         if (!fw3_has_table(family == FW3_FAMILY_V6, fw3_flag_names[table]))
265                                 continue;
266
267                         if (!(handle = fw3_ipt_open(family, table)))
268                                 continue;
269
270                         info(" * Populating %s %s table",
271                              fw3_flag_names[family], fw3_flag_names[table]);
272
273                         fw3_print_default_chains(handle, cfg_state, false);
274                         fw3_print_zone_chains(handle, cfg_state, false);
275                         fw3_print_default_head_rules(handle, cfg_state, false);
276                         fw3_print_rules(handle, cfg_state);
277                         fw3_print_redirects(handle, cfg_state);
278                         fw3_print_snats(handle, cfg_state);
279                         fw3_print_forwards(handle, cfg_state);
280                         fw3_print_zone_rules(handle, cfg_state, false);
281                         fw3_print_default_tail_rules(handle, cfg_state, false);
282
283                         if (!print_family)
284                                 fw3_ipt_commit(handle);
285
286                         fw3_ipt_close(handle);
287                 }
288
289                 if (!print_family)
290                         fw3_print_includes(cfg_state, family, false);
291
292                 family_set(run_state, family, true);
293                 family_set(cfg_state, family, true);
294
295                 rv = 0;
296         }
297
298         if (!rv)
299         {
300                 fw3_flush_conntrack(run_state);
301                 fw3_set_defaults(cfg_state);
302
303                 if (!print_family)
304                 {
305                         fw3_run_includes(cfg_state, false);
306                         fw3_hotplug_zones(cfg_state, true);
307                         fw3_write_statefile(cfg_state);
308                 }
309         }
310
311         return rv;
312 }
313
314
315 static int
316 reload(void)
317 {
318         int rv = 1;
319         enum fw3_family family;
320         enum fw3_table table;
321         struct fw3_ipt_handle *handle;
322
323         if (!run_state)
324                 return start();
325
326         fw3_hotplug_zones(run_state, false);
327
328         for (family = FW3_FAMILY_V4; family <= FW3_FAMILY_V6; family++)
329         {
330                 if (!family_running(family))
331                         goto start;
332
333                 for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++)
334                 {
335                         if (!fw3_has_table(family == FW3_FAMILY_V6, fw3_flag_names[table]))
336                                 continue;
337
338                         if (!(handle = fw3_ipt_open(family, table)))
339                                 continue;
340
341                         info(" * Clearing %s %s table",
342                              fw3_flag_names[family], fw3_flag_names[table]);
343
344                         fw3_flush_rules(handle, run_state, true);
345                         fw3_flush_zones(handle, run_state, true);
346                         fw3_ipt_commit(handle);
347                         fw3_ipt_close(handle);
348                 }
349
350                 family_set(run_state, family, false);
351                 family_set(cfg_state, family, false);
352
353 start:
354                 if (family == FW3_FAMILY_V6 && cfg_state->defaults.disable_ipv6)
355                         continue;
356
357                 for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++)
358                 {
359                         if (!fw3_has_table(family == FW3_FAMILY_V6, fw3_flag_names[table]))
360                                 continue;
361
362                         if (!(handle = fw3_ipt_open(family, table)))
363                                 continue;
364
365                         info(" * Populating %s %s table",
366                              fw3_flag_names[family], fw3_flag_names[table]);
367
368                         fw3_print_default_chains(handle, cfg_state, true);
369                         fw3_print_zone_chains(handle, cfg_state, true);
370                         fw3_print_default_head_rules(handle, cfg_state, true);
371                         fw3_print_rules(handle, cfg_state);
372                         fw3_print_redirects(handle, cfg_state);
373                         fw3_print_snats(handle, cfg_state);
374                         fw3_print_forwards(handle, cfg_state);
375                         fw3_print_zone_rules(handle, cfg_state, true);
376                         fw3_print_default_tail_rules(handle, cfg_state, true);
377
378                         fw3_ipt_commit(handle);
379                         fw3_ipt_close(handle);
380                 }
381
382                 fw3_print_includes(cfg_state, family, true);
383
384                 family_set(run_state, family, true);
385                 family_set(cfg_state, family, true);
386
387                 rv = 0;
388         }
389
390         if (!rv)
391         {
392                 fw3_flush_conntrack(run_state);
393
394                 fw3_set_defaults(cfg_state);
395                 fw3_run_includes(cfg_state, true);
396                 fw3_hotplug_zones(cfg_state, true);
397                 fw3_write_statefile(cfg_state);
398         }
399
400         return rv;
401 }
402
403 static int
404 gc(void)
405 {
406         enum fw3_family family;
407         enum fw3_table table;
408         struct fw3_ipt_handle *handle;
409
410         for (family = FW3_FAMILY_V4; family <= FW3_FAMILY_V6; family++)
411         {
412                 if (family == FW3_FAMILY_V6 && cfg_state->defaults.disable_ipv6)
413                         continue;
414
415                 for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++)
416                 {
417                         if (!fw3_has_table(family == FW3_FAMILY_V6, fw3_flag_names[table]))
418                                 continue;
419
420                         if (!(handle = fw3_ipt_open(family, table)))
421                                 continue;
422
423                         fw3_ipt_gc(handle);
424                         fw3_ipt_commit(handle);
425                         fw3_ipt_close(handle);
426                 }
427         }
428
429         return 0;
430 }
431
432 static int
433 lookup_network(const char *net)
434 {
435         struct fw3_zone *z;
436         struct fw3_device *d;
437
438         list_for_each_entry(z, &cfg_state->zones, list)
439         {
440                 list_for_each_entry(d, &z->networks, list)
441                 {
442                         if (!strcmp(d->name, net))
443                         {
444                                 printf("%s\n", z->name);
445                                 return 0;
446                         }
447                 }
448         }
449
450         return 1;
451 }
452
453 static int
454 lookup_device(const char *dev)
455 {
456         struct fw3_zone *z;
457         struct fw3_device *d;
458
459         list_for_each_entry(z, &cfg_state->zones, list)
460         {
461                 list_for_each_entry(d, &z->devices, list)
462                 {
463                         if (!strcmp(d->name, dev))
464                         {
465                                 printf("%s\n", z->name);
466                                 return 0;
467                         }
468                 }
469         }
470
471         return 1;
472 }
473
474 static int
475 lookup_zone(const char *zone, const char *device)
476 {
477         struct fw3_zone *z;
478         struct fw3_device *d;
479
480         list_for_each_entry(z, &cfg_state->zones, list)
481         {
482                 if (strcmp(z->name, zone))
483                         continue;
484
485                 list_for_each_entry(d, &z->devices, list)
486                 {
487                         if (device && strcmp(device, d->name))
488                                 continue;
489
490                         printf("%s\n", d->name);
491
492                         if (device)
493                                 return 0;
494                 }
495
496                 if (!device)
497                         return 0;
498         }
499
500         return 1;
501 }
502
503 static int
504 usage(void)
505 {
506         fprintf(stderr, "fw3 [-4] [-6] [-q] print\n");
507         fprintf(stderr, "fw3 [-q] {start|stop|flush|reload|restart}\n");
508         fprintf(stderr, "fw3 [-q] network {net}\n");
509         fprintf(stderr, "fw3 [-q] device {dev}\n");
510         fprintf(stderr, "fw3 [-q] zone {zone} [dev]\n");
511
512         return 1;
513 }
514
515
516 int main(int argc, char **argv)
517 {
518         int ch, rv = 1;
519         enum fw3_family family = FW3_FAMILY_ANY;
520         struct fw3_defaults *defs = NULL;
521
522         while ((ch = getopt(argc, argv, "46dqh")) != -1)
523         {
524                 switch (ch)
525                 {
526                 case '4':
527                         family = FW3_FAMILY_V4;
528                         break;
529
530                 case '6':
531                         family = FW3_FAMILY_V6;
532                         break;
533
534                 case 'd':
535                         fw3_pr_debug = true;
536                         break;
537
538                 case 'q':
539                         if (freopen("/dev/null", "w", stderr)) {}
540                         break;
541
542                 case 'h':
543                         rv = usage();
544                         goto out;
545                 }
546         }
547
548         build_state(false);
549         defs = &cfg_state->defaults;
550
551         if (optind >= argc)
552         {
553                 rv = usage();
554                 goto out;
555         }
556
557         if (!strcmp(argv[optind], "print"))
558         {
559                 if (family == FW3_FAMILY_ANY)
560                 {
561                         family = FW3_FAMILY_V4;
562                 }
563                 else if (family == FW3_FAMILY_V6)
564                 {
565                         if (defs->disable_ipv6)
566                                 warn("IPv6 rules globally disabled in configuration");
567 #ifdef DISABLE_IPV6
568                         else
569                                 warn("IPv6 support is not compiled in");
570 #endif
571                 }
572
573                 if (freopen("/dev/null", "w", stderr)) {};
574
575                 cfg_state->disable_ipsets = true;
576                 print_family = family;
577                 fw3_pr_debug = true;
578
579                 if (fw3_lock())
580                 {
581                         build_state(true);
582                         rv = start();
583                         fw3_unlock();
584                 }
585         }
586         else if (!strcmp(argv[optind], "start"))
587         {
588                 if (fw3_lock())
589                 {
590                         build_state(true);
591                         rv = start();
592                         fw3_unlock();
593                 }
594         }
595         else if (!strcmp(argv[optind], "stop"))
596         {
597                 if (fw3_lock())
598                 {
599                         build_state(true);
600                         rv = stop(false);
601                         fw3_unlock();
602                 }
603         }
604         else if (!strcmp(argv[optind], "flush"))
605         {
606                 if (fw3_lock())
607                 {
608                         build_state(true);
609                         rv = stop(true);
610                         fw3_unlock();
611                 }
612         }
613         else if (!strcmp(argv[optind], "restart"))
614         {
615                 if (fw3_lock())
616                 {
617                         build_state(true);
618                         stop(true);
619                         rv = start();
620                         fw3_unlock();
621                 }
622         }
623         else if (!strcmp(argv[optind], "reload"))
624         {
625                 if (fw3_lock())
626                 {
627                         build_state(true);
628                         rv = reload();
629                         fw3_unlock();
630                 }
631         }
632         else if (!strcmp(argv[optind], "gc"))
633         {
634                 if (fw3_lock())
635                 {
636                         rv = gc();
637                         fw3_unlock();
638                 }
639         }
640         else if (!strcmp(argv[optind], "network") && (optind + 1) < argc)
641         {
642                 rv = lookup_network(argv[optind + 1]);
643         }
644         else if (!strcmp(argv[optind], "device") && (optind + 1) < argc)
645         {
646                 rv = lookup_device(argv[optind + 1]);
647         }
648         else if (!strcmp(argv[optind], "zone") && (optind + 1) < argc)
649         {
650                 rv = lookup_zone(argv[optind + 1], argv[optind + 2]);
651         }
652         else
653         {
654                 rv = usage();
655         }
656
657 out:
658         if (cfg_state)
659                 free_state(cfg_state);
660
661         if (run_state)
662                 free_state(run_state);
663
664         return rv;
665 }