add support for per-zone user chains
[project/firewall3.git] / redirects.c
1 /*
2  * firewall3 - 3rd OpenWrt UCI firewall implementation
3  *
4  *   Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
5  *
6  * Permission to use, copy, modify, and/or distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18
19 #include "redirects.h"
20
21
22 const struct fw3_option fw3_redirect_opts[] = {
23         FW3_OPT("enabled",             bool,      redirect,     enabled),
24
25         FW3_OPT("name",                string,    redirect,     name),
26         FW3_OPT("family",              family,    redirect,     family),
27
28         FW3_OPT("src",                 device,    redirect,     src),
29         FW3_OPT("dest",                device,    redirect,     dest),
30
31         FW3_OPT("ipset",               device,    redirect,     ipset),
32
33         FW3_LIST("proto",              protocol,  redirect,     proto),
34
35         FW3_OPT("src_ip",              address,   redirect,     ip_src),
36         FW3_LIST("src_mac",            mac,       redirect,     mac_src),
37         FW3_OPT("src_port",            port,      redirect,     port_src),
38
39         FW3_OPT("src_dip",             address,   redirect,     ip_dest),
40         FW3_OPT("src_dport",           port,      redirect,     port_dest),
41
42         FW3_OPT("dest_ip",             address,   redirect,     ip_redir),
43         FW3_OPT("dest_port",           port,      redirect,     port_redir),
44
45         FW3_OPT("extra",               string,    redirect,     extra),
46
47         FW3_OPT("utc_time",            bool,      redirect,     time.utc),
48         FW3_OPT("start_date",          date,      redirect,     time.datestart),
49         FW3_OPT("stop_date",           date,      redirect,     time.datestop),
50         FW3_OPT("start_time",          time,      redirect,     time.timestart),
51         FW3_OPT("stop_time",           time,      redirect,     time.timestop),
52         FW3_OPT("weekdays",            weekdays,  redirect,     time.weekdays),
53         FW3_OPT("monthdays",           monthdays, redirect,     time.monthdays),
54
55         FW3_OPT("reflection",          bool,      redirect,     reflection),
56
57         FW3_OPT("target",              target,    redirect,     target),
58
59         { }
60 };
61
62
63 static bool
64 check_families(struct uci_element *e, struct fw3_redirect *r)
65 {
66         if (r->family == FW3_FAMILY_ANY)
67                 return true;
68
69         if (r->_src && r->_src->family && r->_src->family != r->family)
70         {
71                 warn_elem(e, "refers to source zone with different family");
72                 return false;
73         }
74
75         if (r->_dest && r->_dest->family && r->_dest->family != r->family)
76         {
77                 warn_elem(e, "refers to destination zone with different family");
78                 return false;
79         }
80
81         if (r->_ipset && r->_ipset->family && r->_ipset->family != r->family)
82         {
83                 warn_elem(e, "refers to ipset with different family");
84                 return false;
85         }
86
87         if (r->ip_src.family && r->ip_src.family != r->family)
88         {
89                 warn_elem(e, "uses source ip with different family");
90                 return false;
91         }
92
93         if (r->ip_dest.family && r->ip_dest.family != r->family)
94         {
95                 warn_elem(e, "uses destination ip with different family");
96                 return false;
97         }
98
99         if (r->ip_redir.family && r->ip_redir.family != r->family)
100         {
101                 warn_elem(e, "uses redirect ip with different family");
102                 return false;
103         }
104
105         return true;
106 }
107
108 void
109 fw3_load_redirects(struct fw3_state *state, struct uci_package *p)
110 {
111         struct uci_section *s;
112         struct uci_element *e;
113         struct fw3_redirect *redir;
114
115         bool valid = false;
116
117         INIT_LIST_HEAD(&state->redirects);
118
119         uci_foreach_element(&p->sections, e)
120         {
121                 s = uci_to_section(e);
122
123                 if (strcmp(s->type, "redirect"))
124                         continue;
125
126                 redir = malloc(sizeof(*redir));
127
128                 if (!redir)
129                         continue;
130
131                 memset(redir, 0, sizeof(*redir));
132
133                 INIT_LIST_HEAD(&redir->proto);
134                 INIT_LIST_HEAD(&redir->mac_src);
135
136                 redir->enabled = true;
137                 redir->reflection = true;
138
139                 fw3_parse_options(redir, fw3_redirect_opts, s);
140
141                 if (!redir->enabled)
142                 {
143                         fw3_free_redirect(redir);
144                         continue;
145                 }
146
147                 if (redir->src.invert)
148                 {
149                         warn_elem(e, "must not have an inverted source");
150                         fw3_free_redirect(redir);
151                         continue;
152                 }
153                 else if (redir->src.set && !redir->src.any &&
154                          !(redir->_src = fw3_lookup_zone(state, redir->src.name, false)))
155                 {
156                         warn_elem(e, "refers to not existing zone '%s'", redir->src.name);
157                         fw3_free_redirect(redir);
158                         continue;
159                 }
160                 else if (redir->dest.set && !redir->dest.any &&
161                          !(redir->_dest = fw3_lookup_zone(state, redir->dest.name, false)))
162                 {
163                         warn_elem(e, "refers to not existing zone '%s'", redir->dest.name);
164                         fw3_free_redirect(redir);
165                         continue;
166                 }
167                 else if (redir->ipset.set && state->disable_ipsets)
168                 {
169                         warn_elem(e, "skipped due to disabled ipset support");
170                         fw3_free_redirect(redir);
171                         continue;
172                 }
173                 else if (redir->ipset.set && !redir->ipset.any &&
174                          !(redir->_ipset = fw3_lookup_ipset(state, redir->ipset.name, false)))
175                 {
176                         warn_elem(e, "refers to unknown ipset '%s'", redir->ipset.name);
177                         fw3_free_redirect(redir);
178                         continue;
179                 }
180
181                 if (!check_families(e, redir))
182                 {
183                         fw3_free_redirect(redir);
184                         continue;
185                 }
186
187                 if (redir->target == FW3_TARGET_UNSPEC)
188                 {
189                         warn_elem(e, "has no target specified, defaulting to DNAT");
190                         redir->target = FW3_TARGET_DNAT;
191                 }
192                 else if (redir->target < FW3_TARGET_DNAT)
193                 {
194                         warn_elem(e, "has invalid target specified, defaulting to DNAT");
195                         redir->target = FW3_TARGET_DNAT;
196                 }
197
198                 if (redir->target == FW3_TARGET_DNAT)
199                 {
200                         if (redir->src.any)
201                                 warn_elem(e, "must not have source '*' for DNAT target");
202                         else if (!redir->_src)
203                                 warn_elem(e, "has no source specified");
204                         else
205                         {
206                                 setbit(redir->_src->dst_flags, redir->target);
207                                 redir->_src->conntrack = true;
208                                 valid = true;
209                         }
210
211                         if (redir->reflection && redir->_dest && redir->_src->masq)
212                         {
213                                 setbit(redir->_dest->dst_flags, FW3_TARGET_ACCEPT);
214                                 setbit(redir->_dest->dst_flags, FW3_TARGET_DNAT);
215                                 setbit(redir->_dest->dst_flags, FW3_TARGET_SNAT);
216                         }
217                 }
218                 else
219                 {
220                         if (redir->dest.any)
221                                 warn_elem(e, "must not have destination '*' for SNAT target");
222                         else if (!redir->_dest)
223                                 warn_elem(e, "has no destination specified");
224                         else if (!redir->ip_dest.set)
225                                 warn_elem(e, "has no src_dip option specified");
226                         else
227                         {
228                                 setbit(redir->_dest->dst_flags, redir->target);
229                                 redir->_dest->conntrack = true;
230                                 valid = true;
231                         }
232                 }
233
234                 if (!valid)
235                 {
236                         fw3_free_redirect(redir);
237                         continue;
238                 }
239
240                 if (!redir->port_redir.set)
241                         redir->port_redir = redir->port_dest;
242
243                 list_add_tail(&redir->list, &state->redirects);
244         }
245 }
246
247 static void
248 print_chain_nat(struct fw3_redirect *redir)
249 {
250         if (redir->target == FW3_TARGET_DNAT)
251                 fw3_pr("-A zone_%s_prerouting", redir->src.name);
252         else
253                 fw3_pr("-A zone_%s_postrouting", redir->dest.name);
254 }
255
256 static void
257 print_snat_dnat(enum fw3_target target,
258                 struct fw3_address *addr, struct fw3_port *port)
259 {
260         const char *t;
261         char s[sizeof("255.255.255.255 ")];
262
263         if (target == FW3_TARGET_DNAT)
264                 t = "DNAT --to-destination";
265         else
266                 t = "SNAT --to-source";
267
268         inet_ntop(AF_INET, &addr->address.v4, s, sizeof(s));
269
270         fw3_pr(" -j %s %s", t, s);
271
272         if (port && port->set)
273         {
274                 if (port->port_min == port->port_max)
275                         fw3_pr(":%u", port->port_min);
276                 else
277                         fw3_pr(":%u-%u", port->port_min, port->port_max);
278         }
279
280         fw3_pr("\n");
281 }
282
283 static void
284 print_target_nat(struct fw3_redirect *redir)
285 {
286         if (redir->target == FW3_TARGET_DNAT)
287                 print_snat_dnat(redir->target, &redir->ip_redir, &redir->port_redir);
288         else
289                 print_snat_dnat(redir->target, &redir->ip_dest, &redir->port_dest);
290 }
291
292 static void
293 print_chain_filter(struct fw3_redirect *redir)
294 {
295         if (redir->target == FW3_TARGET_DNAT)
296         {
297                 /* XXX: check for local ip */
298                 if (!redir->ip_redir.set)
299                         fw3_pr("-A zone_%s_input", redir->src.name);
300                 else
301                         fw3_pr("-A zone_%s_forward", redir->src.name);
302         }
303         else
304         {
305                 if (redir->src.set && !redir->src.any)
306                         fw3_pr("-A zone_%s_forward", redir->src.name);
307                 else
308                         fw3_pr("-A delegate_forward");
309         }
310 }
311
312 static void
313 print_target_filter(struct fw3_redirect *redir)
314 {
315         /* XXX: check for local ip */
316         if (redir->target == FW3_TARGET_DNAT && !redir->ip_redir.set)
317                 fw3_pr(" -m conntrack --ctstate DNAT -j ACCEPT\n");
318         else
319                 fw3_pr(" -j ACCEPT\n");
320 }
321
322 static void
323 print_redirect(enum fw3_table table, enum fw3_family family,
324                struct fw3_redirect *redir, int num)
325 {
326         struct list_head *ext_addrs, *int_addrs;
327         struct fw3_address *ext_addr, *int_addr;
328         struct fw3_device *ext_net, *int_net;
329         struct fw3_protocol *proto;
330         struct fw3_mac *mac;
331
332         if (redir->name)
333                 info("   * Redirect '%s'", redir->name);
334         else
335                 info("   * Redirect #%u", num);
336
337         if (!fw3_is_family(redir->_src, family) ||
338                 !fw3_is_family(redir->_dest, family))
339         {
340                 info("     ! Skipping due to different family of zone");
341                 return;
342         }
343
344         if (!fw3_is_family(&redir->ip_src, family) ||
345             !fw3_is_family(&redir->ip_dest, family) ||
346                 !fw3_is_family(&redir->ip_redir, family))
347         {
348                 info("     ! Skipping due to different family of ip address");
349                 return;
350         }
351
352         if (redir->_ipset)
353         {
354                 if (!fw3_is_family(redir->_ipset, family))
355                 {
356                         info("     ! Skipping due to different family in ipset");
357                         return;
358                 }
359
360                 setbit(redir->_ipset->flags, family);
361         }
362
363         fw3_foreach(proto, &redir->proto)
364         fw3_foreach(mac, &redir->mac_src)
365         {
366                 if (table == FW3_TABLE_NAT)
367                 {
368                         print_chain_nat(redir);
369                         fw3_format_ipset(redir->_ipset, redir->ipset.invert);
370                         fw3_format_protocol(proto, family);
371
372                         if (redir->target == FW3_TARGET_DNAT)
373                         {
374                                 fw3_format_src_dest(&redir->ip_src, &redir->ip_dest);
375                                 fw3_format_sport_dport(&redir->port_src, &redir->port_dest);
376                         }
377                         else
378                         {
379                                 fw3_format_src_dest(&redir->ip_src, &redir->ip_redir);
380                                 fw3_format_sport_dport(&redir->port_src, &redir->port_redir);
381                         }
382
383                         fw3_format_mac(mac);
384                         fw3_format_time(&redir->time);
385                         fw3_format_extra(redir->extra);
386                         fw3_format_comment(redir->name);
387                         print_target_nat(redir);
388                 }
389                 else if (table == FW3_TABLE_FILTER)
390                 {
391                         print_chain_filter(redir);
392                         fw3_format_ipset(redir->_ipset, redir->ipset.invert);
393                         fw3_format_protocol(proto, family);
394                         fw3_format_src_dest(&redir->ip_src, &redir->ip_redir);
395                         fw3_format_sport_dport(&redir->port_src, &redir->port_redir);
396                         fw3_format_mac(mac);
397                         fw3_format_time(&redir->time);
398                         fw3_format_extra(redir->extra);
399                         fw3_format_comment(redir->name);
400                         print_target_filter(redir);
401                 }
402         }
403
404         /* reflection rules */
405         if (redir->target != FW3_TARGET_DNAT || !redir->reflection)
406                 return;
407
408         if (!redir->_dest || !redir->_src->masq)
409                 return;
410
411         list_for_each_entry(ext_net, &redir->_src->networks, list)
412         {
413                 ext_addrs = fw3_ubus_address(ext_net->name);
414
415                 if (!ext_addrs || list_empty(ext_addrs))
416                         continue;
417
418                 list_for_each_entry(int_net, &redir->_dest->networks, list)
419                 {
420                         int_addrs = fw3_ubus_address(int_net->name);
421
422                         if (!int_addrs || list_empty(int_addrs))
423                                 continue;
424
425                         fw3_foreach(ext_addr, ext_addrs)
426                         fw3_foreach(int_addr, int_addrs)
427                         fw3_foreach(proto, &redir->proto)
428                         {
429                                 if (!fw3_is_family(int_addr, family) ||
430                                     !fw3_is_family(ext_addr, family))
431                                         continue;
432
433                                 if (!proto || (proto->protocol != 6 && proto->protocol != 17))
434                                         continue;
435
436                                 ext_addr->mask = 32;
437
438                                 if (table == FW3_TABLE_NAT)
439                                 {
440                                         fw3_pr("-A zone_%s_prerouting", redir->dest.name);
441                                         fw3_format_protocol(proto, family);
442                                         fw3_format_src_dest(int_addr, ext_addr);
443                                         fw3_format_sport_dport(NULL, &redir->port_dest);
444                                         fw3_format_time(&redir->time);
445                                         fw3_format_comment(redir->name, " (reflection)");
446                                         print_snat_dnat(FW3_TARGET_DNAT,
447                                                         &redir->ip_redir, &redir->port_redir);
448
449                                         fw3_pr("-A zone_%s_postrouting", redir->dest.name);
450                                         fw3_format_protocol(proto, family);
451                                         fw3_format_src_dest(int_addr, &redir->ip_redir);
452                                         fw3_format_sport_dport(NULL, &redir->port_redir);
453                                         fw3_format_time(&redir->time);
454                                         fw3_format_comment(redir->name, " (reflection)");
455                                         print_snat_dnat(FW3_TARGET_SNAT, ext_addr, NULL);
456                                 }
457                                 else if (table == FW3_TABLE_FILTER)
458                                 {
459                                         fw3_pr("-A zone_%s_forward", redir->dest.name);
460                                         fw3_format_protocol(proto, family);
461                                         fw3_format_src_dest(int_addr, &redir->ip_redir);
462                                         fw3_format_sport_dport(NULL, &redir->port_redir);
463                                         fw3_format_time(&redir->time);
464                                         fw3_format_comment(redir->name, " (reflection)");
465                                         fw3_pr(" -j zone_%s_dest_ACCEPT\n", redir->dest.name);
466                                 }
467                         }
468
469                         fw3_ubus_address_free(int_addrs);
470                 }
471
472                 fw3_ubus_address_free(ext_addrs);
473         }
474 }
475
476 void
477 fw3_print_redirects(enum fw3_table table, enum fw3_family family,
478                     struct fw3_state *state)
479 {
480         int num = 0;
481         struct fw3_redirect *redir;
482
483         if (family == FW3_FAMILY_V6)
484                 return;
485
486         if (table != FW3_TABLE_FILTER && table != FW3_TABLE_NAT)
487                 return;
488
489         list_for_each_entry(redir, &state->redirects, list)
490                 print_redirect(table, family, redir, num++);
491 }