options.c

   1 /*
   2  * firewall3 - 3rd OpenWrt UCI firewall implementation
   3  *
   4  *   Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
   5  *
   6  * Permission to use, copy, modify, and/or distribute this software for any
   7  * purpose with or without fee is hereby granted, provided that the above
   8  * copyright notice and this permission notice appear in all copies.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17  */
  18
  19 #include "options.h"
  20
  21 bool
  22 fw3_parse_bool(void *ptr, const char *val)
  23 {
  24         if (!strcmp(val, "true") || !strcmp(val, "yes") || !strcmp(val, "1"))
  25                 *((bool *)ptr) = true;
  26         else
  27                 *((bool *)ptr) = false;
  28
  29         return true;
  30 }
  31
  32 bool
  33 fw3_parse_int(void *ptr, const char *val)
  34 {
  35         int n = strtol(val, NULL, 10);
  36
  37         if (errno == ERANGE || errno == EINVAL)
  38                 return false;
  39
  40         *((int *)ptr) = n;
  41
  42         return true;
  43 }
  44
  45 bool
  46 fw3_parse_string(void *ptr, const char *val)
  47 {
  48         *((char **)ptr) = (char *)val;
  49         return true;
  50 }
  51
  52 bool
  53 fw3_parse_target(void *ptr, const char *val)
  54 {
  55         if (!strcmp(val, "ACCEPT"))
  56         {
  57                 *((enum fw3_target *)ptr) = FW3_TARGET_ACCEPT;
  58                 return true;
  59         }
  60         else if (!strcmp(val, "REJECT"))
  61         {
  62                 *((enum fw3_target *)ptr) = FW3_TARGET_REJECT;
  63                 return true;
  64         }
  65         else if (!strcmp(val, "DROP"))
  66         {
  67                 *((enum fw3_target *)ptr) = FW3_TARGET_DROP;
  68                 return true;
  69         }
  70         else if (!strcmp(val, "NOTRACK"))
  71         {
  72                 *((enum fw3_target *)ptr) = FW3_TARGET_NOTRACK;
  73                 return true;
  74         }
  75         else if (!strcmp(val, "DNAT"))
  76         {
  77                 *((enum fw3_target *)ptr) = FW3_TARGET_DNAT;
  78                 return true;
  79         }
  80         else if (!strcmp(val, "SNAT"))
  81         {
  82                 *((enum fw3_target *)ptr) = FW3_TARGET_SNAT;
  83                 return true;
  84         }
  85
  86         return false;
  87 }
  88
  89 bool
  90 fw3_parse_limit(void *ptr, const char *val)
  91 {
  92         struct fw3_limit *limit = ptr;
  93         enum fw3_limit_unit u = FW3_LIMIT_UNIT_SECOND;
  94         char *e;
  95         int n;
  96
  97         if (*val == '!')
  98         {
  99                 limit->invert = true;
 100                 while (isspace(*++val));
 101         }
 102
 103         n = strtol(val, &e, 10);
 104
 105         if (errno == ERANGE || errno == EINVAL)
 106                 return false;
 107
 108         if (*e && *e++ != '/')
 109                 return false;
 110
 111         if (!strlen(e))
 112                 return false;
 113
 114         if (!strncmp(e, "second", strlen(e)))
 115                 u = FW3_LIMIT_UNIT_SECOND;
 116         else if (!strncmp(e, "minute", strlen(e)))
 117                 u = FW3_LIMIT_UNIT_MINUTE;
 118         else if (!strncmp(e, "hour", strlen(e)))
 119                 u = FW3_LIMIT_UNIT_HOUR;
 120         else if (!strncmp(e, "day", strlen(e)))
 121                 u = FW3_LIMIT_UNIT_DAY;
 122         else
 123                 return false;
 124
 125         limit->rate = n;
 126         limit->unit = u;
 127
 128         return true;
 129 }
 130
 131 bool
 132 fw3_parse_device(void *ptr, const char *val)
 133 {
 134         struct fw3_device *dev = ptr;
 135
 136         if (*val == '*')
 137         {
 138                 dev->set = true;
 139                 dev->any = true;
 140                 return true;
 141         }
 142
 143         if (*val == '!')
 144         {
 145                 dev->invert = true;
 146                 while (isspace(*++val));
 147         }
 148
 149         if (*val)
 150                 snprintf(dev->name, sizeof(dev->name), "%s", val);
 151         else
 152                 return false;
 153
 154         dev->set = true;
 155         return true;
 156 }
 157
 158 bool
 159 fw3_parse_address(void *ptr, const char *val)
 160 {
 161         struct fw3_address *addr = ptr;
 162         struct in_addr v4;
 163         struct in6_addr v6;
 164         char *p, *s, *e;
 165         int i, m = -1;
 166
 167         if (*val == '!')
 168         {
 169                 addr->invert = true;
 170                 while (isspace(*++val));
 171         }
 172
 173         s = strdup(val);
 174
 175         if (!s)
 176                 return false;
 177
 178         if ((p = strchr(s, '/')) != NULL)
 179         {
 180                 *p++ = 0;
 181                 m = strtoul(p, &e, 10);
 182
 183                 if ((e == p) || (*e != 0))
 184                 {
 185                         if (strchr(s, ':') || !inet_pton(AF_INET, p, &v4))
 186                         {
 187                                 free(s);
 188                                 return false;
 189                         }
 190
 191                         for (i = 0, m = 32; !(v4.s_addr & 1) && (i < 32); i++)
 192                         {
 193                                 m--;
 194                                 v4.s_addr >>= 1;
 195                         }
 196                 }
 197         }
 198
 199         if (inet_pton(AF_INET6, s, &v6))
 200         {
 201                 addr->family = FW3_FAMILY_V6;
 202                 addr->address.v6 = v6;
 203                 addr->mask = (m >= 0) ? m : 128;
 204         }
 205         else if (inet_pton(AF_INET, s, &v4))
 206         {
 207                 addr->family = FW3_FAMILY_V4;
 208                 addr->address.v4 = v4;
 209                 addr->mask = (m >= 0) ? m : 32;
 210         }
 211         else
 212         {
 213                 free(s);
 214                 return false;
 215         }
 216
 217         free(s);
 218         addr->set = true;
 219         return true;
 220 }
 221
 222 bool
 223 fw3_parse_mac(void *ptr, const char *val)
 224 {
 225         struct fw3_mac *addr = ptr;
 226         struct ether_addr *mac;
 227
 228         if (*val == '!')
 229         {
 230                 addr->invert = true;
 231                 while (isspace(*++val));
 232         }
 233
 234         if ((mac = ether_aton(val)) != NULL)
 235         {
 236                 addr->mac = *mac;
 237                 addr->set = true;
 238                 return true;
 239         }
 240
 241         return false;
 242 }
 243
 244 bool
 245 fw3_parse_port(void *ptr, const char *val)
 246 {
 247         struct fw3_port *range = ptr;
 248         uint16_t n;
 249         uint16_t m;
 250         char *p;
 251
 252         if (*val == '!')
 253         {
 254                 range->invert = true;
 255                 while (isspace(*++val));
 256         }
 257
 258         n = strtoul(val, &p, 10);
 259
 260         if (errno == ERANGE || errno == EINVAL)
 261                 return false;
 262
 263         if (*p && *p != '-' && *p != ':')
 264                 return false;
 265
 266         if (*p)
 267         {
 268                 m = strtoul(++p, NULL, 10);
 269
 270                 if (errno == ERANGE || errno == EINVAL || m < n)
 271                         return false;
 272
 273                 range->port_min = n;
 274                 range->port_max = m;
 275         }
 276         else
 277         {
 278                 range->port_min = n;
 279                 range->port_max = n;
 280         }
 281
 282         range->set = true;
 283         return true;
 284 }
 285
 286 bool
 287 fw3_parse_family(void *ptr, const char *val)
 288 {
 289         if (!strcmp(val, "any"))
 290                 *((enum fw3_family *)ptr) = FW3_FAMILY_ANY;
 291         else if (!strcmp(val, "inet") || strrchr(val, '4'))
 292                 *((enum fw3_family *)ptr) = FW3_FAMILY_V4;
 293         else if (!strcmp(val, "inet6") || strrchr(val, '6'))
 294                 *((enum fw3_family *)ptr) = FW3_FAMILY_V6;
 295         else
 296                 return false;
 297
 298         return true;
 299 }
 300
 301 bool
 302 fw3_parse_icmptype(void *ptr, const char *val)
 303 {
 304         struct fw3_icmptype *icmp = ptr;
 305         bool v4 = false;
 306         bool v6 = false;
 307         char *p;
 308         int i;
 309
 310         for (i = 0; i < ARRAY_SIZE(fw3_icmptype_list_v4); i++)
 311         {
 312                 if (!strcmp(val, fw3_icmptype_list_v4[i].name))
 313                 {
 314                         icmp->type     = fw3_icmptype_list_v4[i].type;
 315                         icmp->code_min = fw3_icmptype_list_v4[i].code_min;
 316                         icmp->code_max = fw3_icmptype_list_v4[i].code_max;
 317
 318                         v4 = true;
 319                         break;
 320                 }
 321         }
 322
 323         for (i = 0; i < ARRAY_SIZE(fw3_icmptype_list_v6); i++)
 324         {
 325                 if (!strcmp(val, fw3_icmptype_list_v6[i].name))
 326                 {
 327                         icmp->type6     = fw3_icmptype_list_v6[i].type;
 328                         icmp->code6_min = fw3_icmptype_list_v6[i].code_min;
 329                         icmp->code6_max = fw3_icmptype_list_v6[i].code_max;
 330
 331                         v6 = true;
 332                         break;
 333                 }
 334         }
 335
 336         if (!v4 && !v6)
 337         {
 338                 i = strtoul(val, &p, 10);
 339
 340                 if ((p == val) || (*p != '/' && *p != 0) || (i > 0xFF))
 341                         return false;
 342
 343                 icmp->type = i;
 344
 345                 if (*p == '/')
 346                 {
 347                         val = ++p;
 348                         i = strtoul(val, &p, 10);
 349
 350                         if ((p == val) || (*p != 0) || (i > 0xFF))
 351                                 return false;
 352
 353                         icmp->code_min = i;
 354                         icmp->code_max = i;
 355                 }
 356                 else
 357                 {
 358                         icmp->code_min = 0;
 359                         icmp->code_max = 0xFF;
 360                 }
 361
 362                 icmp->type6     = icmp->type;
 363                 icmp->code6_min = icmp->code_max;
 364                 icmp->code6_max = icmp->code_max;
 365
 366                 v4 = true;
 367                 v6 = true;
 368         }
 369
 370         icmp->family = (v4 && v6) ? FW3_FAMILY_ANY
 371                                   : (v6 ? FW3_FAMILY_V6 : FW3_FAMILY_V4);
 372
 373         return true;
 374 }
 375
 376 bool
 377 fw3_parse_protocol(void *ptr, const char *val)
 378 {
 379         struct fw3_protocol *proto = ptr;
 380         struct protoent *ent;
 381
 382         if (*val == '!')
 383         {
 384                 proto->invert = true;
 385                 while (isspace(*++val));
 386         }
 387
 388         if (!strcmp(val, "all"))
 389         {
 390                 proto->any = true;
 391                 return true;
 392         }
 393         else if (!strcmp(val, "icmpv6"))
 394         {
 395                 val = "ipv6-icmp";
 396         }
 397
 398         ent = getprotobyname(val);
 399
 400         if (ent)
 401         {
 402                 proto->protocol = ent->p_proto;
 403                 return true;
 404         }
 405
 406         proto->protocol = strtoul(val, NULL, 10);
 407         return (errno != ERANGE && errno != EINVAL);
 408 }
 409
 410 bool
 411 fw3_parse_ipset_method(void *ptr, const char *val)
 412 {
 413         if (!strncmp(val, "bitmap", strlen(val)))
 414         {
 415                 *((enum fw3_ipset_method *)ptr) = FW3_IPSET_METHOD_BITMAP;
 416                 return true;
 417         }
 418         else if (!strncmp(val, "hash", strlen(val)))
 419         {
 420                 *((enum fw3_ipset_method *)ptr) = FW3_IPSET_METHOD_HASH;
 421                 return true;
 422         }
 423         else if (!strncmp(val, "list", strlen(val)))
 424         {
 425                 *((enum fw3_ipset_method *)ptr) = FW3_IPSET_METHOD_LIST;
 426                 return true;
 427         }
 428
 429         return false;
 430 }
 431
 432 bool
 433 fw3_parse_ipset_datatype(void *ptr, const char *val)
 434 {
 435         struct fw3_ipset_datatype *type = ptr;
 436
 437         if (!strncmp(val, "dest_", 5))
 438         {
 439                 val += 5;
 440                 type->dest = true;
 441         }
 442         else if (!strncmp(val, "dst_", 4))
 443         {
 444                 val += 4;
 445                 type->dest = true;
 446         }
 447         else if (!strncmp(val, "src_", 4))
 448         {
 449                 val += 4;
 450                 type->dest = false;
 451         }
 452
 453         if (!strncmp(val, "ip", strlen(val)))
 454         {
 455                 type->type = FW3_IPSET_TYPE_IP;
 456                 return true;
 457         }
 458         else if (!strncmp(val, "port", strlen(val)))
 459         {
 460                 type->type = FW3_IPSET_TYPE_PORT;
 461                 return true;
 462         }
 463         else if (!strncmp(val, "mac", strlen(val)))
 464         {
 465                 type->type = FW3_IPSET_TYPE_MAC;
 466                 return true;
 467         }
 468         else if (!strncmp(val, "net", strlen(val)))
 469         {
 470                 type->type = FW3_IPSET_TYPE_NET;
 471                 return true;
 472         }
 473         else if (!strncmp(val, "set", strlen(val)))
 474         {
 475                 type->type = FW3_IPSET_TYPE_SET;
 476                 return true;
 477         }
 478
 479         return false;
 480 }
 481
 482
 483 void
 484 fw3_parse_options(void *s,
 485                   struct fw3_option *opts, int n,
 486                   struct uci_section *section)
 487 {
 488         int i;
 489         char *p;
 490         bool known;
 491         struct uci_element *e, *l;
 492         struct uci_option *o;
 493         struct fw3_option *opt;
 494         struct list_head *item;
 495         struct list_head *dest;
 496
 497         uci_foreach_element(&section->options, e)
 498         {
 499                 o = uci_to_option(e);
 500                 known = false;
 501
 502                 for (i = 0; i < n; i++)
 503                 {
 504                         opt = &opts[i];
 505
 506                         if (!opt->parse || !opt->name)
 507                                 continue;
 508
 509                         if (strcmp(opt->name, e->name))
 510                                 continue;
 511
 512                         if (o->type == UCI_TYPE_LIST)
 513                         {
 514                                 if (!opt->elem_size)
 515                                 {
 516                                         warn_elem(e, "must not be a list");
 517                                 }
 518                                 else
 519                                 {
 520                                         uci_foreach_element(&o->v.list, l)
 521                                         {
 522                                                 if (!l->name)
 523                                                         continue;
 524
 525                                                 item = malloc(opt->elem_size);
 526
 527                                                 if (!item)
 528                                                         continue;
 529
 530                                                 memset(item, 0, opt->elem_size);
 531
 532                                                 if (!opt->parse(item, l->name))
 533                                                 {
 534                                                         warn_elem(e, "has invalid value '%s'", l->name);
 535                                                         free(item);
 536                                                         continue;
 537                                                 }
 538
 539                                                 dest = (struct list_head *)((char *)s + opt->offset);
 540                                                 list_add_tail(item, dest);
 541                                         }
 542                                 }
 543                         }
 544                         else
 545                         {
 546                                 if (!o->v.string)
 547                                         continue;
 548
 549                                 if (!opt->elem_size)
 550                                 {
 551                                         if (!opt->parse((char *)s + opt->offset, o->v.string))
 552                                                 warn_elem(e, "has invalid value '%s'", o->v.string);
 553                                 }
 554                                 else
 555                                 {
 556                                         for (p = strtok(o->v.string, " \t");
 557                                              p != NULL;
 558                                              p = strtok(NULL, " \t"))
 559                                         {
 560                                                 item = malloc(opt->elem_size);
 561
 562                                                 if (!item)
 563                                                         continue;
 564
 565                                                 memset(item, 0, opt->elem_size);
 566
 567                                                 if (!opt->parse(item, p))
 568                                                 {
 569                                                         warn_elem(e, "has invalid value '%s'", p);
 570                                                         free(item);
 571                                                         continue;
 572                                                 }
 573
 574                                                 dest = (struct list_head *)((char *)s + opt->offset);
 575                                                 list_add_tail(item, dest);
 576                                         }
 577                                 }
 578                         }
 579
 580                         known = true;
 581                         break;
 582                 }
 583
 584                 if (!known)
 585                         warn_elem(e, "is unknown");
 586         }
 587 }
 588
 589
 590 void
 591 fw3_format_in_out(struct fw3_device *in, struct fw3_device *out)
 592 {
 593         if (in && !in->any)
 594                 fw3_pr(" %s-i %s", in->invert ? "! " : "", in->name);
 595
 596         if (out && !out->any)
 597                 fw3_pr(" %s-o %s", out->invert ? "! " : "", out->name);
 598 }
 599
 600 void
 601 fw3_format_src_dest(struct fw3_address *src, struct fw3_address *dest)
 602 {
 603         char s[INET6_ADDRSTRLEN];
 604
 605         if (src && src->set)
 606         {
 607                 inet_ntop(src->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
 608                           &src->address.v4, s, sizeof(s));
 609
 610                 fw3_pr(" %s-s %s/%u", src->invert ? "! " : "", s, src->mask);
 611         }
 612
 613         if (dest && dest->set)
 614         {
 615                 inet_ntop(dest->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
 616                           &dest->address.v4, s, sizeof(s));
 617
 618                 fw3_pr(" %s-d %s/%u", dest->invert ? "! " : "", s, dest->mask);
 619         }
 620 }
 621
 622 void
 623 fw3_format_sport_dport(struct fw3_port *sp, struct fw3_port *dp)
 624 {
 625         if (sp && sp->set)
 626         {
 627                 if (sp->port_min == sp->port_max)
 628                         fw3_pr(" %s--sport %u", sp->invert ? "! " : "", sp->port_min);
 629                 else
 630                         fw3_pr(" %s--sport %u:%u",
 631                                sp->invert ? "! " : "", sp->port_min, sp->port_max);
 632         }
 633
 634         if (dp && dp->set)
 635         {
 636                 if (dp->port_min == dp->port_max)
 637                         fw3_pr(" %s--dport %u", dp->invert ? "! " : "", dp->port_min);
 638                 else
 639                         fw3_pr(" %s--dport %u:%u",
 640                                dp->invert ? "! " : "", dp->port_min, dp->port_max);
 641         }
 642 }
 643
 644 void
 645 fw3_format_mac(struct fw3_mac *mac)
 646 {
 647         if (!mac)
 648                 return;
 649
 650         fw3_pr(" -m mac %s--mac-source %s",
 651                mac->invert ? "! " : "", ether_ntoa(&mac->mac));
 652 }
 653
 654 void
 655 fw3_format_protocol(struct fw3_protocol *proto, enum fw3_family family)
 656 {
 657         uint16_t pr;
 658
 659         if (!proto)
 660                 return;
 661
 662         pr = proto->protocol;
 663
 664         if (pr == 1 && family == FW3_FAMILY_V6)
 665                 pr = 58;
 666
 667         if (proto->any)
 668                 fw3_pr(" -p all");
 669         else
 670                 fw3_pr(" %s-p %u", proto->invert ? "! " : "", pr);
 671 }
 672
 673 void
 674 fw3_format_icmptype(struct fw3_icmptype *icmp, enum fw3_family family)
 675 {
 676         if (!icmp)
 677                 return;
 678
 679         if (family != FW3_FAMILY_V6)
 680         {
 681                 if (icmp->code_min == 0 && icmp->code_max == 0xFF)
 682                         fw3_pr(" %s--icmp-type %u", icmp->invert ? "! " : "", icmp->type);
 683                 else
 684                         fw3_pr(" %s--icmp-type %u/%u",
 685                                    icmp->invert ? "! " : "", icmp->type, icmp->code_min);
 686         }
 687         else
 688         {
 689                 if (icmp->code6_min == 0 && icmp->code6_max == 0xFF)
 690                         fw3_pr(" %s--icmpv6-type %u", icmp->invert ? "! " : "", icmp->type6);
 691                 else
 692                         fw3_pr(" %s--icmpv6-type %u/%u",
 693                                    icmp->invert ? "! " : "", icmp->type6, icmp->code6_min);
 694         }
 695 }
 696
 697 void
 698 fw3_format_limit(struct fw3_limit *limit)
 699 {
 700         if (!limit)
 701                 return;
 702
 703         const char *units[] = {
 704                 [FW3_LIMIT_UNIT_SECOND] = "second",
 705                 [FW3_LIMIT_UNIT_MINUTE] = "minute",
 706                 [FW3_LIMIT_UNIT_HOUR]   = "hour",
 707                 [FW3_LIMIT_UNIT_DAY]    = "day",
 708         };
 709
 710         if (limit->rate > 0)
 711         {
 712                 fw3_pr(" -m limit %s--limit %u/%s",
 713                        limit->invert ? "! " : "", limit->rate, units[limit->unit]);
 714
 715                 if (limit->burst > 0)
 716                         fw3_pr(" --limit-burst %u", limit->burst);
 717         }
 718 }
 719
 720 void
 721 fw3_format_ipset(struct fw3_ipset *ipset, bool invert)
 722 {
 723         bool first = true;
 724         const char *name = NULL;
 725         struct fw3_ipset_datatype *type;
 726
 727         if (!ipset)
 728                 return;
 729
 730         if (ipset->external && *ipset->external)
 731                 name = ipset->external;
 732         else
 733                 name = ipset->name;
 734
 735         fw3_pr(" -m set %s--match-set %s", invert ? "! " : "", name);
 736
 737         list_for_each_entry(type, &ipset->datatypes, list)
 738         {
 739                 fw3_pr("%c%s", first ? ' ' : ',', type->dest ? "dst" : "src");
 740                 first = false;
 741         }
 742 }
 743
 744 void
 745 __fw3_format_comment(const char *comment, ...)
 746 {
 747         va_list ap;
 748         int len = 0;
 749         const char *c;
 750
 751         if (!comment || !*comment)
 752                 return;
 753
 754         fw3_pr(" -m comment --comment \"");
 755
 756         c = comment;
 757
 758         va_start(ap, comment);
 759
 760         do
 761         {
 762                 while (*c)
 763                 {
 764                         switch (*c)
 765                         {
 766                         case '"':
 767                         case '$':
 768                         case '`':
 769                         case '\\':
 770                                 fw3_pr("\\");
 771                                 /* fall through */
 772
 773                         default:
 774                                 fw3_pr("%c", *c);
 775                                 break;
 776                         }
 777
 778                         c++;
 779
 780                         if (len++ >= 255)
 781                                 goto end;
 782                 }
 783
 784                 c = va_arg(ap, const char *);
 785         }
 786         while (c);
 787
 788 end:
 789         va_end(ap);
 790         fw3_pr("\"");
 791 }
 792
 793 void
 794 fw3_format_extra(const char *extra)
 795 {
 796         if (!extra || !*extra)
 797                 return;
 798
 799         fw3_pr(" %s", extra);
 800 }