redirects.c

   1 /*
   2  * firewall3 - 3rd OpenWrt UCI firewall implementation
   3  *
   4  *   Copyright (C) 2013-2018 Jo-Philipp Wich <jo@mein.io>
   5  *
   6  * Permission to use, copy, modify, and/or distribute this software for any
   7  * purpose with or without fee is hereby granted, provided that the above
   8  * copyright notice and this permission notice appear in all copies.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17  */
  18
  19 #include "redirects.h"
  20
  21
  22 const struct fw3_option fw3_redirect_opts[] = {
  23         FW3_OPT("enabled",             bool,      redirect,     enabled),
  24
  25         FW3_OPT("name",                string,    redirect,     name),
  26         FW3_OPT("family",              family,    redirect,     family),
  27
  28         FW3_OPT("src",                 device,    redirect,     src),
  29         FW3_OPT("dest",                device,    redirect,     dest),
  30
  31         FW3_OPT("ipset",               setmatch,  redirect,     ipset),
  32         FW3_OPT("helper",              cthelper,  redirect,     helper),
  33
  34         FW3_LIST("proto",              protocol,  redirect,     proto),
  35
  36         FW3_OPT("src_ip",              network,   redirect,     ip_src),
  37         FW3_LIST("src_mac",            mac,       redirect,     mac_src),
  38         FW3_OPT("src_port",            port,      redirect,     port_src),
  39
  40         FW3_OPT("src_dip",             network,   redirect,     ip_dest),
  41         FW3_OPT("src_dport",           port,      redirect,     port_dest),
  42
  43         FW3_OPT("dest_ip",             network,   redirect,     ip_redir),
  44         FW3_OPT("dest_port",           port,      redirect,     port_redir),
  45
  46         FW3_OPT("extra",               string,    redirect,     extra),
  47
  48         FW3_OPT("limit",               limit,     redirect,     limit),
  49         FW3_OPT("limit_burst",         int,       redirect,     limit.burst),
  50
  51         FW3_OPT("utc_time",            bool,      redirect,     time.utc),
  52         FW3_OPT("start_date",          date,      redirect,     time.datestart),
  53         FW3_OPT("stop_date",           date,      redirect,     time.datestop),
  54         FW3_OPT("start_time",          time,      redirect,     time.timestart),
  55         FW3_OPT("stop_time",           time,      redirect,     time.timestop),
  56         FW3_OPT("weekdays",            weekdays,  redirect,     time.weekdays),
  57         FW3_OPT("monthdays",           monthdays, redirect,     time.monthdays),
  58
  59         FW3_OPT("mark",                mark,      redirect,     mark),
  60
  61         FW3_OPT("reflection",          bool,      redirect,     reflection),
  62         FW3_OPT("reflection_src",      reflection_source,
  63                                                   redirect,     reflection_src),
  64
  65         FW3_OPT("target",              target,    redirect,     target),
  66
  67         { }
  68 };
  69
  70
  71 static bool
  72 check_families(struct uci_element *e, struct fw3_redirect *r)
  73 {
  74         if (r->family == FW3_FAMILY_ANY)
  75                 return true;
  76
  77         if (r->_src && r->_src->family && r->_src->family != r->family)
  78         {
  79                 warn_elem(e, "refers to source zone with different family");
  80                 return false;
  81         }
  82
  83         if (r->_dest && r->_dest->family && r->_dest->family != r->family)
  84         {
  85                 warn_elem(e, "refers to destination zone with different family");
  86                 return false;
  87         }
  88
  89         if (r->ipset.ptr && r->ipset.ptr->family &&
  90             r->ipset.ptr->family != r->family)
  91         {
  92                 warn_elem(e, "refers to ipset with different family");
  93                 return false;
  94         }
  95
  96         if (r->helper.ptr && r->helper.ptr->family &&
  97             r->helper.ptr->family != r->family)
  98         {
  99                 warn_elem(e, "refers to CT helper not supporting family");
 100                 return false;
 101         }
 102
 103         if (r->ip_src.family && r->ip_src.family != r->family)
 104         {
 105                 warn_elem(e, "uses source ip with different family");
 106                 return false;
 107         }
 108
 109         if (r->ip_dest.family && r->ip_dest.family != r->family)
 110         {
 111                 warn_elem(e, "uses destination ip with different family");
 112                 return false;
 113         }
 114
 115         if (r->ip_redir.family && r->ip_redir.family != r->family)
 116         {
 117                 warn_elem(e, "uses redirect ip with different family");
 118                 return false;
 119         }
 120
 121         return true;
 122 }
 123
 124 static bool
 125 compare_addr(struct fw3_address *a, struct fw3_address *b)
 126 {
 127         if (a->family != FW3_FAMILY_V4 || b->family != FW3_FAMILY_V4)
 128                 return false;
 129
 130         return ((a->address.v4.s_addr & a->mask.v4.s_addr) ==
 131                 (b->address.v4.s_addr & a->mask.v4.s_addr));
 132 }
 133
 134 static bool
 135 resolve_dest(struct uci_element *e, struct fw3_redirect *redir,
 136              struct fw3_state *state)
 137 {
 138         struct fw3_zone *zone;
 139         struct fw3_address *addr;
 140         struct list_head *addrs;
 141
 142         if (!redir->ip_redir.set)
 143                 return false;
 144
 145         list_for_each_entry(zone, &state->zones, list)
 146         {
 147                 addrs = fw3_resolve_zone_addresses(zone, NULL);
 148
 149                 if (!addrs)
 150                         continue;
 151
 152                 list_for_each_entry(addr, addrs, list)
 153                 {
 154                         if (!compare_addr(addr, &redir->ip_redir))
 155                                 continue;
 156
 157                         strncpy(redir->dest.name, zone->name, sizeof(redir->dest.name));
 158                         redir->dest.set = true;
 159                         redir->_dest = zone;
 160
 161                         break;
 162                 }
 163
 164                 fw3_free_list(addrs);
 165
 166                 if (redir->_dest)
 167                         return true;
 168         }
 169
 170         return false;
 171 }
 172
 173 static bool
 174 check_local(struct uci_element *e, struct fw3_redirect *redir,
 175             struct fw3_state *state)
 176 {
 177         if (redir->target != FW3_FLAG_DNAT)
 178                 return false;
 179
 180         if (!redir->ip_redir.set)
 181                 redir->local = true;
 182
 183         return redir->local;
 184 }
 185
 186 static void
 187 select_helper(struct fw3_state *state, struct fw3_redirect *redir)
 188 {
 189         struct fw3_protocol *proto;
 190         struct fw3_cthelper *helper;
 191         int n_matches = 0;
 192
 193         if (!state->defaults.auto_helper)
 194                 return;
 195
 196         if (!redir->_src || redir->target != FW3_FLAG_DNAT)
 197                 return;
 198
 199         if (!redir->port_redir.set || redir->port_redir.invert)
 200                 return;
 201
 202         if (redir->helper.set || redir->helper.ptr)
 203                 return;
 204
 205         if (list_empty(&redir->proto))
 206                 return;
 207
 208         list_for_each_entry(proto, &redir->proto, list)
 209         {
 210                 helper = fw3_lookup_cthelper_by_proto_port(state, proto, &redir->port_redir);
 211
 212                 if (helper)
 213                         n_matches++;
 214         }
 215
 216         if (n_matches != 1)
 217                 return;
 218
 219         /* store pointer to auto-selected helper but set ".set" flag to false,
 220          * to allow later code to decide between configured or auto-selected
 221          * helpers */
 222         redir->helper.set = false;
 223         redir->helper.ptr = helper;
 224
 225         set(redir->_src->flags, FW3_FAMILY_V4, FW3_FLAG_HELPER);
 226 }
 227
 228 static bool
 229 check_redirect(struct fw3_state *state, struct fw3_redirect *redir, struct uci_element *e)
 230 {
 231         bool valid;
 232
 233         if (!redir->enabled)
 234                 return false;
 235
 236         if (redir->src.invert)
 237         {
 238                 warn_section("redirect", redir, e, "must not have an inverted source");
 239                 return false;
 240         }
 241         else if (redir->src.set && !redir->src.any &&
 242                         !(redir->_src = fw3_lookup_zone(state, redir->src.name)))
 243         {
 244                 warn_section("redirect", redir, e, "refers to not existing zone '%s'",
 245                                 redir->src.name);
 246                 return false;
 247         }
 248         else if (redir->dest.set && !redir->dest.any &&
 249                         !(redir->_dest = fw3_lookup_zone(state, redir->dest.name)))
 250         {
 251                 warn_section("redirect", redir, e, "refers to not existing zone '%s'",
 252                                 redir->dest.name);
 253                 return false;
 254         }
 255         else if (redir->ipset.set && state->disable_ipsets)
 256         {
 257                 warn_section("redirect", redir, e, "skipped due to disabled ipset support",
 258                                 redir->name);
 259                 return false;
 260         }
 261         else if (redir->ipset.set &&
 262                         !(redir->ipset.ptr = fw3_lookup_ipset(state, redir->ipset.name)))
 263         {
 264                 warn_section("redirect", redir, e, "refers to unknown ipset '%s'", redir->name,
 265                                 redir->ipset.name);
 266                 return false;
 267         }
 268         else if (redir->helper.set &&
 269                  !(redir->helper.ptr = fw3_lookup_cthelper(state, redir->helper.name)))
 270         {
 271                 warn_section("redirect", redir, e, "refers to unknown CT helper '%s'",
 272                              redir->helper.name);
 273                 return false;
 274         }
 275
 276         if (!check_families(e, redir))
 277                 return false;
 278
 279         if (redir->target == FW3_FLAG_UNSPEC)
 280         {
 281                 warn_section("redirect", redir, e, "has no target specified, defaulting to DNAT");
 282                 redir->target = FW3_FLAG_DNAT;
 283         }
 284         else if (redir->target < FW3_FLAG_DNAT || redir->target > FW3_FLAG_SNAT)
 285         {
 286                 warn_section("redirect", redir, e, "has invalid target specified, defaulting to DNAT");
 287                 redir->target = FW3_FLAG_DNAT;
 288         }
 289
 290         valid = false;
 291
 292         if (redir->target == FW3_FLAG_DNAT)
 293         {
 294                 if (redir->src.any)
 295                         warn_section("redirect", redir, e, "must not have source '*' for DNAT target");
 296                 else if (!redir->_src)
 297                         warn_section("redirect", redir, e, "has no source specified");
 298                 else if (redir->helper.invert)
 299                         warn_section("redirect", redir, e, "must not use a negated helper match");
 300                 else
 301                 {
 302                         set(redir->_src->flags, FW3_FAMILY_V4, redir->target);
 303                         valid = true;
 304
 305                         if (!check_local(e, redir, state) && !redir->dest.set &&
 306                                         resolve_dest(e, redir, state))
 307                         {
 308                                 warn_section("redirect", redir, e,
 309                                                 "does not specify a destination, assuming '%s'",
 310                                                 redir->dest.name);
 311                         }
 312
 313                         if (redir->reflection && redir->_dest && redir->_src->masq)
 314                         {
 315                                 set(redir->_dest->flags, FW3_FAMILY_V4, FW3_FLAG_ACCEPT);
 316                                 set(redir->_dest->flags, FW3_FAMILY_V4, FW3_FLAG_DNAT);
 317                                 set(redir->_dest->flags, FW3_FAMILY_V4, FW3_FLAG_SNAT);
 318                         }
 319
 320                         if (redir->helper.ptr)
 321                                 set(redir->_src->flags, FW3_FAMILY_V4, FW3_FLAG_HELPER);
 322                 }
 323         }
 324         else
 325         {
 326                 if (redir->dest.any)
 327                         warn_section("redirect", redir, e,
 328                                         "must not have destination '*' for SNAT target");
 329                 else if (!redir->_dest)
 330                         warn_section("redirect", redir, e, "has no destination specified");
 331                 else if (!redir->ip_dest.set)
 332                         warn_section("redirect", redir, e, "has no src_dip option specified");
 333                 else if (!list_empty(&redir->mac_src))
 334                         warn_section("redirect", redir, e, "must not use 'src_mac' option for SNAT target");
 335                 else if (redir->helper.set)
 336                         warn_section("redirect", redir, e, "must not use 'helper' option for SNAT target");
 337                 else
 338                 {
 339                         set(redir->_dest->flags, FW3_FAMILY_V4, redir->target);
 340                         valid = true;
 341                 }
 342         }
 343
 344         if (list_empty(&redir->proto))
 345         {
 346                 warn_section("redirect", redir, e, "does not specify a protocol, assuming TCP+UDP");
 347                 fw3_parse_protocol(&redir->proto, "tcpudp", true);
 348         }
 349
 350         if (!valid)
 351                 return false;
 352
 353         if (!redir->port_redir.set)
 354                 redir->port_redir = redir->port_dest;
 355
 356         return true;
 357 }
 358
 359 static struct fw3_redirect *
 360 fw3_alloc_redirect(struct fw3_state *state)
 361 {
 362         struct fw3_redirect *redir;
 363
 364         redir = calloc(1, sizeof(*redir));
 365         if (!redir)
 366                 return NULL;
 367
 368         INIT_LIST_HEAD(&redir->proto);
 369         INIT_LIST_HEAD(&redir->mac_src);
 370
 371         redir->enabled = true;
 372         redir->reflection = true;
 373
 374         list_add_tail(&redir->list, &state->redirects);
 375
 376         return redir;
 377 }
 378
 379 void
 380 fw3_load_redirects(struct fw3_state *state, struct uci_package *p,
 381                 struct blob_attr *a)
 382 {
 383         struct uci_section *s;
 384         struct uci_element *e;
 385         struct fw3_redirect *redir;
 386         struct blob_attr *entry;
 387         unsigned rem;
 388
 389         INIT_LIST_HEAD(&state->redirects);
 390
 391         blob_for_each_attr(entry, a, rem)
 392         {
 393                 const char *type;
 394                 const char *name = "ubus redirect";
 395
 396                 if (!fw3_attr_parse_name_type(entry, &name, &type))
 397                         continue;
 398
 399                 if (strcmp(type, "redirect"))
 400                         continue;
 401
 402                 redir = fw3_alloc_redirect(state);
 403                 if (!redir)
 404                         continue;
 405
 406                 if (!fw3_parse_blob_options(redir, fw3_redirect_opts, entry, name))
 407                 {
 408                         warn_section("redirect", redir, NULL, "skipped due to invalid options");
 409                         fw3_free_redirect(redir);
 410                         continue;
 411                 }
 412
 413                 if (!check_redirect(state, redir, NULL)) {
 414                         fw3_free_redirect(redir);
 415                         continue;
 416                 }
 417
 418                 select_helper(state, redir);
 419         }
 420
 421         uci_foreach_element(&p->sections, e)
 422         {
 423                 s = uci_to_section(e);
 424
 425                 if (strcmp(s->type, "redirect"))
 426                         continue;
 427
 428                 redir = fw3_alloc_redirect(state);
 429                 if (!redir)
 430                         continue;
 431
 432                 if (!fw3_parse_options(redir, fw3_redirect_opts, s))
 433                 {
 434                         warn_elem(e, "skipped due to invalid options");
 435                         fw3_free_redirect(redir);
 436                         continue;
 437                 }
 438
 439                 if (!check_redirect(state, redir, e)) {
 440                         fw3_free_redirect(redir);
 441                         continue;
 442                 }
 443
 444                 select_helper(state, redir);
 445         }
 446 }
 447
 448 static void
 449 append_chain_nat(struct fw3_ipt_rule *r, struct fw3_redirect *redir)
 450 {
 451         if (redir->target == FW3_FLAG_DNAT)
 452                 fw3_ipt_rule_append(r, "zone_%s_prerouting", redir->src.name);
 453         else
 454                 fw3_ipt_rule_append(r, "zone_%s_postrouting", redir->dest.name);
 455 }
 456
 457 static void
 458 set_redirect(struct fw3_ipt_rule *r, struct fw3_port *port)
 459 {
 460         char buf[sizeof("65535-65535\0")];
 461
 462         fw3_ipt_rule_target(r, "REDIRECT");
 463
 464         if (port && port->set)
 465         {
 466                 if (port->port_min == port->port_max)
 467                         sprintf(buf, "%u", port->port_min);
 468                 else
 469                         sprintf(buf, "%u-%u", port->port_min, port->port_max);
 470
 471                 fw3_ipt_rule_addarg(r, false, "--to-ports", buf);
 472         }
 473 }
 474
 475 static void
 476 set_snat_dnat(struct fw3_ipt_rule *r, enum fw3_flag target,
 477               struct fw3_address *addr, struct fw3_port *port)
 478 {
 479         char buf[sizeof("255.255.255.255:65535-65535\0")];
 480
 481         buf[0] = '\0';
 482
 483         if (addr && addr->set)
 484         {
 485                 inet_ntop(AF_INET, &addr->address.v4, buf, sizeof(buf));
 486         }
 487
 488         if (port && port->set)
 489         {
 490                 if (port->port_min == port->port_max)
 491                         sprintf(buf + strlen(buf), ":%u", port->port_min);
 492                 else
 493                         sprintf(buf + strlen(buf), ":%u-%u",
 494                                 port->port_min, port->port_max);
 495         }
 496
 497         if (target == FW3_FLAG_DNAT)
 498         {
 499                 fw3_ipt_rule_target(r, "DNAT");
 500                 fw3_ipt_rule_addarg(r, false, "--to-destination", buf);
 501         }
 502         else
 503         {
 504                 fw3_ipt_rule_target(r, "SNAT");
 505                 fw3_ipt_rule_addarg(r, false, "--to-source", buf);
 506         }
 507 }
 508
 509 static void
 510 set_target_nat(struct fw3_ipt_rule *r, struct fw3_redirect *redir)
 511 {
 512         if (redir->local)
 513                 set_redirect(r, &redir->port_redir);
 514         else if (redir->target == FW3_FLAG_DNAT)
 515                 set_snat_dnat(r, redir->target, &redir->ip_redir, &redir->port_redir);
 516         else
 517                 set_snat_dnat(r, redir->target, &redir->ip_dest, &redir->port_dest);
 518 }
 519
 520 static void
 521 set_comment(struct fw3_ipt_rule *r, const char *name, int num, const char *suffix)
 522 {
 523         if (name)
 524         {
 525                 if (suffix)
 526                         fw3_ipt_rule_comment(r, "%s (%s)", name, suffix);
 527                 else
 528                         fw3_ipt_rule_comment(r, name);
 529         }
 530         else
 531         {
 532                 if (suffix)
 533                         fw3_ipt_rule_comment(r, "@redirect[%u] (%s)", num, suffix);
 534                 else
 535                         fw3_ipt_rule_comment(r, "@redirect[%u]", num);
 536         }
 537 }
 538
 539 static void
 540 print_redirect(struct fw3_ipt_handle *h, struct fw3_state *state,
 541                struct fw3_redirect *redir, int num,
 542                struct fw3_protocol *proto, struct fw3_mac *mac)
 543 {
 544         struct fw3_ipt_rule *r;
 545         struct fw3_address *src, *dst;
 546         struct fw3_port *spt, *dpt;
 547
 548         switch (h->table)
 549         {
 550         case FW3_TABLE_NAT:
 551                 src = &redir->ip_src;
 552                 dst = &redir->ip_dest;
 553                 spt = &redir->port_src;
 554                 dpt = &redir->port_dest;
 555
 556                 if (redir->target == FW3_FLAG_SNAT)
 557                 {
 558                         dst = &redir->ip_redir;
 559                         dpt = &redir->port_redir;
 560                 }
 561
 562                 r = fw3_ipt_rule_create(h, proto, NULL, NULL, src, dst);
 563                 fw3_ipt_rule_sport_dport(r, spt, dpt);
 564                 fw3_ipt_rule_mac(r, mac);
 565                 fw3_ipt_rule_ipset(r, &redir->ipset);
 566                 fw3_ipt_rule_helper(r, &redir->helper);
 567                 fw3_ipt_rule_limit(r, &redir->limit);
 568                 fw3_ipt_rule_time(r, &redir->time);
 569                 fw3_ipt_rule_mark(r, &redir->mark);
 570                 set_target_nat(r, redir);
 571                 fw3_ipt_rule_extra(r, redir->extra);
 572                 set_comment(r, redir->name, num, NULL);
 573                 append_chain_nat(r, redir);
 574                 break;
 575
 576         case FW3_TABLE_RAW:
 577                 if (redir->target == FW3_FLAG_DNAT && redir->helper.ptr)
 578                 {
 579                         if (redir->helper.ptr->proto.protocol != proto->protocol)
 580                         {
 581                                 info("     ! Skipping protocol %s since helper '%s' does not support it",
 582                                      fw3_protoname(proto), redir->helper.ptr->name);
 583                                 return;
 584                         }
 585
 586                         if (!redir->helper.set)
 587                                 info("     - Auto-selected conntrack helper '%s' based on proto/port",
 588                                      redir->helper.ptr->name);
 589
 590                         r = fw3_ipt_rule_create(h, proto, NULL, NULL, &redir->ip_src, &redir->ip_redir);
 591                         fw3_ipt_rule_sport_dport(r, &redir->port_src, &redir->port_redir);
 592                         fw3_ipt_rule_mac(r, mac);
 593                         fw3_ipt_rule_ipset(r, &redir->ipset);
 594                         fw3_ipt_rule_limit(r, &redir->limit);
 595                         fw3_ipt_rule_time(r, &redir->time);
 596                         fw3_ipt_rule_mark(r, &redir->mark);
 597                         fw3_ipt_rule_addarg(r, false, "-m", "conntrack");
 598                         fw3_ipt_rule_addarg(r, false, "--ctstate", "DNAT");
 599                         fw3_ipt_rule_target(r, "CT");
 600                         fw3_ipt_rule_addarg(r, false, "--helper", redir->helper.ptr->name);
 601                         set_comment(r, redir->name, num, "CT helper");
 602                         fw3_ipt_rule_append(r, "zone_%s_helper", redir->_src->name);
 603                 }
 604                 break;
 605
 606         default:
 607                 break;
 608         }
 609 }
 610
 611 static void
 612 print_reflection(struct fw3_ipt_handle *h, struct fw3_state *state,
 613                  struct fw3_redirect *redir, int num,
 614                  struct fw3_protocol *proto, struct fw3_address *ra,
 615                  struct fw3_address *ia, struct fw3_address *ea)
 616 {
 617         struct fw3_ipt_rule *r;
 618
 619         switch (h->table)
 620         {
 621         case FW3_TABLE_NAT:
 622                 r = fw3_ipt_rule_create(h, proto, NULL, NULL, ia, ea);
 623                 fw3_ipt_rule_sport_dport(r, NULL, &redir->port_dest);
 624                 fw3_ipt_rule_limit(r, &redir->limit);
 625                 fw3_ipt_rule_time(r, &redir->time);
 626                 set_comment(r, redir->name, num, "reflection");
 627                 set_snat_dnat(r, FW3_FLAG_DNAT, &redir->ip_redir, &redir->port_redir);
 628                 fw3_ipt_rule_replace(r, "zone_%s_prerouting", redir->dest.name);
 629
 630                 r = fw3_ipt_rule_create(h, proto, NULL, NULL, ia, &redir->ip_redir);
 631                 fw3_ipt_rule_sport_dport(r, NULL, &redir->port_redir);
 632                 fw3_ipt_rule_limit(r, &redir->limit);
 633                 fw3_ipt_rule_time(r, &redir->time);
 634                 set_comment(r, redir->name, num, "reflection");
 635                 set_snat_dnat(r, FW3_FLAG_SNAT, ra, NULL);
 636                 fw3_ipt_rule_replace(r, "zone_%s_postrouting", redir->dest.name);
 637                 break;
 638
 639         default:
 640                 break;
 641         }
 642 }
 643
 644 static void
 645 expand_redirect(struct fw3_ipt_handle *handle, struct fw3_state *state,
 646                 struct fw3_redirect *redir, int num)
 647 {
 648         struct list_head *ext_addrs, *int_addrs;
 649         struct fw3_address *ext_addr, *int_addr, ref_addr;
 650         struct fw3_protocol *proto;
 651         struct fw3_mac *mac;
 652
 653         if (redir->name)
 654                 info("   * Redirect '%s'", redir->name);
 655         else
 656                 info("   * Redirect #%u", num);
 657
 658         if (!fw3_is_family(redir->_src, handle->family) ||
 659                 !fw3_is_family(redir->_dest, handle->family))
 660         {
 661                 info("     ! Skipping due to different family of zone");
 662                 return;
 663         }
 664
 665         if (!fw3_is_family(&redir->ip_src, handle->family) ||
 666             !fw3_is_family(&redir->ip_dest, handle->family) ||
 667                 !fw3_is_family(&redir->ip_redir, handle->family))
 668         {
 669                 if (!redir->ip_src.resolved ||
 670                     !redir->ip_dest.resolved ||
 671                     !redir->ip_redir.resolved)
 672                         info("     ! Skipping due to different family of ip address");
 673
 674                 return;
 675         }
 676
 677         if (redir->ipset.ptr)
 678         {
 679                 if (!fw3_is_family(redir->ipset.ptr, handle->family))
 680                 {
 681                         info("     ! Skipping due to different family in ipset");
 682                         return;
 683                 }
 684
 685                 if (!fw3_check_ipset(redir->ipset.ptr))
 686                 {
 687                         info("     ! Skipping due to missing ipset '%s'",
 688                              redir->ipset.ptr->external ?
 689                                         redir->ipset.ptr->external : redir->ipset.ptr->name);
 690                         return;
 691                 }
 692
 693                 set(redir->ipset.ptr->flags, handle->family, handle->family);
 694         }
 695
 696         fw3_foreach(proto, &redir->proto)
 697         fw3_foreach(mac, &redir->mac_src)
 698                 print_redirect(handle, state, redir, num, proto, mac);
 699
 700         /* reflection rules */
 701         if (redir->target != FW3_FLAG_DNAT || !redir->reflection || redir->local)
 702                 return;
 703
 704         if (!redir->_dest || !redir->_src->masq)
 705                 return;
 706
 707         ext_addrs = fw3_resolve_zone_addresses(redir->_src, &redir->ip_dest);
 708         int_addrs = fw3_resolve_zone_addresses(redir->_dest, NULL);
 709
 710         if (!ext_addrs || !int_addrs)
 711                 goto out;
 712
 713         list_for_each_entry(ext_addr, ext_addrs, list)
 714         {
 715                 if (!fw3_is_family(ext_addr, handle->family))
 716                         continue;
 717
 718                 list_for_each_entry(int_addr, int_addrs, list)
 719                 {
 720                         if (!fw3_is_family(int_addr, handle->family))
 721                                 continue;
 722
 723                         fw3_foreach(proto, &redir->proto)
 724                         {
 725                                 if (!proto)
 726                                         continue;
 727
 728                                 if (redir->reflection_src == FW3_REFLECTION_INTERNAL)
 729                                         ref_addr = *int_addr;
 730                                 else
 731                                         ref_addr = *ext_addr;
 732
 733                                 ref_addr.mask.v4.s_addr = 0xFFFFFFFF;
 734                                 ext_addr->mask.v4.s_addr = 0xFFFFFFFF;
 735
 736                                 print_reflection(handle, state, redir, num, proto,
 737                                                                  &ref_addr, int_addr, ext_addr);
 738                         }
 739                 }
 740         }
 741
 742 out:
 743         fw3_free_list(ext_addrs);
 744         fw3_free_list(int_addrs);
 745 }
 746
 747 void
 748 fw3_print_redirects(struct fw3_ipt_handle *handle, struct fw3_state *state)
 749 {
 750         int num = 0;
 751         struct fw3_redirect *redir;
 752
 753         if (handle->family == FW3_FAMILY_V6)
 754                 return;
 755
 756         if (handle->table != FW3_TABLE_FILTER &&
 757             handle->table != FW3_TABLE_NAT &&
 758             handle->table != FW3_TABLE_RAW)
 759                 return;
 760
 761         list_for_each_entry(redir, &state->redirects, list)
 762         {
 763                 if (handle->table == FW3_TABLE_RAW && !redir->helper.ptr)
 764                         continue;
 765
 766                 expand_redirect(handle, state, redir, num++);
 767         }
 768 }