main.c

   1 /*
   2  * firewall3 - 3rd OpenWrt UCI firewall implementation
   3  *
   4  *   Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
   5  *
   6  * Permission to use, copy, modify, and/or distribute this software for any
   7  * purpose with or without fee is hereby granted, provided that the above
   8  * copyright notice and this permission notice appear in all copies.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17  */
  18
  19 #include <stdio.h>
  20 #include <unistd.h>
  21
  22 #include "options.h"
  23 #include "defaults.h"
  24 #include "zones.h"
  25 #include "rules.h"
  26 #include "redirects.h"
  27 #include "forwards.h"
  28 #include "ipsets.h"
  29 #include "includes.h"
  30 #include "ubus.h"
  31
  32
  33 static bool print_rules = false;
  34 static enum fw3_family use_family = FW3_FAMILY_ANY;
  35
  36
  37 static struct fw3_state *
  38 build_state(void)
  39 {
  40         struct fw3_state *state = NULL;
  41         struct uci_package *p = NULL;
  42
  43         state = malloc(sizeof(*state));
  44
  45         if (!state)
  46                 error("Out of memory");
  47
  48         memset(state, 0, sizeof(*state));
  49         state->uci = uci_alloc_context();
  50
  51         if (!state->uci)
  52                 error("Out of memory");
  53
  54         if (uci_load(state->uci, "firewall", &p))
  55         {
  56                 uci_perror(state->uci, NULL);
  57                 error("Failed to load /etc/config/firewall");
  58         }
  59
  60         if (!fw3_find_command("ipset"))
  61         {
  62                 warn("Unable to locate ipset utility, disabling ipset support");
  63                 state->disable_ipsets = true;
  64         }
  65
  66         INIT_LIST_HEAD(&state->running_zones);
  67         INIT_LIST_HEAD(&state->running_ipsets);
  68
  69         fw3_load_defaults(state, p);
  70         fw3_load_ipsets(state, p);
  71         fw3_load_zones(state, p);
  72         fw3_load_rules(state, p);
  73         fw3_load_redirects(state, p);
  74         fw3_load_forwards(state, p);
  75         fw3_load_includes(state, p);
  76
  77         state->statefile = fw3_read_statefile(state);
  78
  79         return state;
  80 }
  81
  82 static void
  83 free_state(struct fw3_state *state)
  84 {
  85         struct list_head *cur, *tmp;
  86
  87         list_for_each_safe(cur, tmp, &state->zones)
  88                 fw3_free_zone((struct fw3_zone *)cur);
  89
  90         list_for_each_safe(cur, tmp, &state->rules)
  91                 fw3_free_rule((struct fw3_rule *)cur);
  92
  93         list_for_each_safe(cur, tmp, &state->redirects)
  94                 fw3_free_redirect((struct fw3_redirect *)cur);
  95
  96         list_for_each_safe(cur, tmp, &state->forwards)
  97                 fw3_free_forward((struct fw3_forward *)cur);
  98
  99         list_for_each_safe(cur, tmp, &state->ipsets)
 100                 fw3_free_ipset((struct fw3_ipset *)cur);
 101
 102         list_for_each_safe(cur, tmp, &state->includes)
 103                 fw3_free_include((struct fw3_include *)cur);
 104
 105         uci_free_context(state->uci);
 106
 107         free(state);
 108
 109         fw3_ubus_disconnect();
 110 }
 111
 112
 113 static bool
 114 restore_pipe(enum fw3_family family, bool silent)
 115 {
 116         const char *cmd;
 117
 118         cmd = (family == FW3_FAMILY_V4) ? "iptables-restore" : "ip6tables-restore";
 119
 120         if (print_rules)
 121                 return fw3_stdout_pipe();
 122
 123         if (!fw3_command_pipe(silent, cmd, "--lenient", "--noflush"))
 124         {
 125                 warn("Unable to execute %s", cmd);
 126                 return false;
 127         }
 128
 129         return true;
 130 }
 131
 132 static bool
 133 family_running(struct fw3_state *state, enum fw3_family family)
 134 {
 135         return hasbit(state->running_defaults.flags, family);
 136 }
 137
 138 static bool
 139 family_used(enum fw3_family family)
 140 {
 141         return (use_family == FW3_FAMILY_ANY) || (use_family == family);
 142 }
 143
 144 static bool
 145 family_loaded(struct fw3_state *state, enum fw3_family family)
 146 {
 147         return hasbit(state->defaults.flags, family);
 148 }
 149
 150 static void
 151 family_set(struct fw3_state *state, enum fw3_family family, bool set)
 152 {
 153         if (set)
 154                 setbit(state->defaults.flags, family);
 155         else
 156                 delbit(state->defaults.flags, family);
 157 }
 158
 159 static int
 160 stop(struct fw3_state *state, bool complete, bool restart)
 161 {
 162         int rv = 1;
 163         enum fw3_family family;
 164         enum fw3_table table;
 165
 166         if (!complete && !state->statefile)
 167         {
 168                 if (!restart)
 169                         warn("The firewall appears to be stopped. "
 170                                  "Use the 'flush' command to forcefully purge all rules.");
 171
 172                 return rv;
 173         }
 174
 175         for (family = FW3_FAMILY_V4; family <= FW3_FAMILY_V6; family++)
 176         {
 177                 if (!complete && !family_running(state, family))
 178                         continue;
 179
 180                 if (!family_used(family) || !restore_pipe(family, true))
 181                         continue;
 182
 183                 info("Removing %s rules ...", fw3_flag_names[family]);
 184
 185                 for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++)
 186                 {
 187                         if (!fw3_has_table(family == FW3_FAMILY_V6, fw3_flag_names[table]))
 188                                 continue;
 189
 190                         info(" * %sing %s table",
 191                              complete ? "Flush" : "Clear", fw3_flag_names[table]);
 192
 193                         fw3_pr("*%s\n", fw3_flag_names[table]);
 194
 195                         if (complete)
 196                         {
 197                                 fw3_flush_all(table);
 198                         }
 199                         else
 200                         {
 201                                 /* pass 1 */
 202                                 fw3_flush_rules(table, family, false, state);
 203                                 fw3_flush_zones(table, family, false, state);
 204
 205                                 /* pass 2 */
 206                                 fw3_flush_rules(table, family, true, state);
 207                                 fw3_flush_zones(table, family, true, state);
 208                         }
 209
 210                         fw3_pr("COMMIT\n");
 211                 }
 212
 213                 fw3_command_close();
 214
 215                 if (!restart)
 216                         family_set(state, family, false);
 217
 218                 rv = 0;
 219         }
 220
 221         if (!restart && fw3_command_pipe(false, "ipset", "-exist", "-"))
 222         {
 223                 fw3_destroy_ipsets(state);
 224                 fw3_command_close();
 225         }
 226
 227         if (!rv)
 228                 fw3_write_statefile(state);
 229
 230         return rv;
 231 }
 232
 233 static int
 234 start(struct fw3_state *state, bool restart)
 235 {
 236         int rv = 1;
 237         enum fw3_family family;
 238         enum fw3_table table;
 239
 240         if (!print_rules && !restart &&
 241             fw3_command_pipe(false, "ipset", "-exist", "-"))
 242         {
 243                 fw3_create_ipsets(state);
 244                 fw3_command_close();
 245         }
 246
 247         for (family = FW3_FAMILY_V4; family <= FW3_FAMILY_V6; family++)
 248         {
 249                 if (!family_used(family))
 250                         continue;
 251
 252                 if (!print_rules && !restart && family_running(state, family))
 253                 {
 254                         warn("The %s firewall appears to be started already. "
 255                              "If it is indeed empty, remove the %s file and retry.",
 256                              fw3_flag_names[family], FW3_STATEFILE);
 257
 258                         continue;
 259                 }
 260
 261                 if (!family_loaded(state, family) || !restore_pipe(family, false))
 262                         continue;
 263
 264                 info("Constructing %s rules ...", fw3_flag_names[family]);
 265
 266                 for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++)
 267                 {
 268                         if (!fw3_has_table(family == FW3_FAMILY_V6, fw3_flag_names[table]))
 269                                 continue;
 270
 271                         info(" * Populating %s table", fw3_flag_names[table]);
 272
 273                         fw3_pr("*%s\n", fw3_flag_names[table]);
 274                         fw3_print_default_chains(table, family, state);
 275                         fw3_print_zone_chains(table, family, state);
 276                         fw3_print_default_head_rules(table, family, state);
 277                         fw3_print_rules(table, family, state);
 278                         fw3_print_redirects(table, family, state);
 279                         fw3_print_forwards(table, family, state);
 280                         fw3_print_zone_rules(table, family, state);
 281                         fw3_print_default_tail_rules(table, family, state);
 282                         fw3_pr("COMMIT\n");
 283                 }
 284
 285                 fw3_command_close();
 286                 family_set(state, family, true);
 287
 288                 rv = 0;
 289         }
 290
 291         if (!rv && !print_rules)
 292                 fw3_write_statefile(state);
 293
 294         return rv;
 295 }
 296
 297 static int
 298 lookup_network(struct fw3_state *state, const char *net)
 299 {
 300         struct fw3_zone *z;
 301         struct fw3_device *d;
 302
 303         list_for_each_entry(z, &state->zones, list)
 304         {
 305                 list_for_each_entry(d, &z->networks, list)
 306                 {
 307                         if (!strcmp(d->name, net))
 308                         {
 309                                 printf("%s\n", z->name);
 310                                 return 0;
 311                         }
 312                 }
 313         }
 314
 315         return 1;
 316 }
 317
 318 static int
 319 lookup_device(struct fw3_state *state, const char *dev)
 320 {
 321         struct fw3_zone *z;
 322         struct fw3_device *d;
 323
 324         list_for_each_entry(z, &state->zones, list)
 325         {
 326                 list_for_each_entry(d, &z->devices, list)
 327                 {
 328                         if (!strcmp(d->name, dev))
 329                         {
 330                                 printf("%s\n", z->name);
 331                                 return 0;
 332                         }
 333                 }
 334         }
 335
 336         return 1;
 337 }
 338
 339 static int
 340 usage(void)
 341 {
 342         fprintf(stderr, "fw3 [-4] [-6] [-q] {start|stop|flush|restart|print}\n");
 343         fprintf(stderr, "fw3 [-q] network {net}\n");
 344         fprintf(stderr, "fw3 [-q] device {dev}\n");
 345
 346         return 1;
 347 }
 348
 349
 350 int main(int argc, char **argv)
 351 {
 352         int ch, rv = 1;
 353         struct fw3_state *state = NULL;
 354         struct fw3_defaults *defs = NULL;
 355
 356         while ((ch = getopt(argc, argv, "46qh")) != -1)
 357         {
 358                 switch (ch)
 359                 {
 360                 case '4':
 361                         use_family = FW3_FAMILY_V4;
 362                         break;
 363
 364                 case '6':
 365                         use_family = FW3_FAMILY_V6;
 366                         break;
 367
 368                 case 'q':
 369                         freopen("/dev/null", "w", stderr);
 370                         break;
 371
 372                 case 'h':
 373                         rv = usage();
 374                         goto out;
 375                 }
 376         }
 377
 378         if (!fw3_ubus_connect())
 379                 error("Failed to connect to ubus");
 380
 381         state = build_state();
 382         defs = &state->defaults;
 383
 384         if (!fw3_lock())
 385                 goto out;
 386
 387         if (optind >= argc)
 388         {
 389                 rv = usage();
 390                 goto out;
 391         }
 392
 393         if (use_family == FW3_FAMILY_V6 && defs->disable_ipv6)
 394                 warn("IPv6 rules globally disabled in configuration");
 395
 396         if (!strcmp(argv[optind], "print"))
 397         {
 398                 if (use_family == FW3_FAMILY_ANY)
 399                         use_family = FW3_FAMILY_V4;
 400
 401                 freopen("/dev/null", "w", stderr);
 402
 403                 state->disable_ipsets = true;
 404                 print_rules = true;
 405
 406                 rv = start(state, false);
 407         }
 408         else if (!strcmp(argv[optind], "start"))
 409         {
 410                 rv = start(state, false);
 411         }
 412         else if (!strcmp(argv[optind], "stop"))
 413         {
 414                 rv = stop(state, false, false);
 415         }
 416         else if (!strcmp(argv[optind], "flush"))
 417         {
 418                 rv = stop(state, true, false);
 419         }
 420         else if (!strcmp(argv[optind], "restart"))
 421         {
 422                 rv = stop(state, false, true);
 423                 rv = start(state, !rv);
 424         }
 425         else if (!strcmp(argv[optind], "network") && (optind + 1) < argc)
 426         {
 427                 rv = lookup_network(state, argv[optind + 1]);
 428         }
 429         else if (!strcmp(argv[optind], "device") && (optind + 1) < argc)
 430         {
 431                 rv = lookup_device(state, argv[optind + 1]);
 432         }
 433         else
 434         {
 435                 rv = usage();
 436         }
 437
 438 out:
 439         if (state)
 440                 free_state(state);
 441
 442         fw3_unlock();
 443
 444         return rv;
 445 }