Infer destination zone of DNAT redirects from dest_ip option
[project/firewall3.git] / redirects.c
1 /*
2  * firewall3 - 3rd OpenWrt UCI firewall implementation
3  *
4  *   Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
5  *
6  * Permission to use, copy, modify, and/or distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18
19 #include "redirects.h"
20
21
22 const struct fw3_option fw3_redirect_opts[] = {
23         FW3_OPT("enabled",             bool,      redirect,     enabled),
24
25         FW3_OPT("name",                string,    redirect,     name),
26         FW3_OPT("family",              family,    redirect,     family),
27
28         FW3_OPT("src",                 device,    redirect,     src),
29         FW3_OPT("dest",                device,    redirect,     dest),
30
31         FW3_OPT("ipset",               device,    redirect,     ipset),
32
33         FW3_LIST("proto",              protocol,  redirect,     proto),
34
35         FW3_OPT("src_ip",              network,   redirect,     ip_src),
36         FW3_LIST("src_mac",            mac,       redirect,     mac_src),
37         FW3_OPT("src_port",            port,      redirect,     port_src),
38
39         FW3_OPT("src_dip",             network,   redirect,     ip_dest),
40         FW3_OPT("src_dport",           port,      redirect,     port_dest),
41
42         FW3_OPT("dest_ip",             network,   redirect,     ip_redir),
43         FW3_OPT("dest_port",           port,      redirect,     port_redir),
44
45         FW3_OPT("extra",               string,    redirect,     extra),
46
47         FW3_OPT("utc_time",            bool,      redirect,     time.utc),
48         FW3_OPT("start_date",          date,      redirect,     time.datestart),
49         FW3_OPT("stop_date",           date,      redirect,     time.datestop),
50         FW3_OPT("start_time",          time,      redirect,     time.timestart),
51         FW3_OPT("stop_time",           time,      redirect,     time.timestop),
52         FW3_OPT("weekdays",            weekdays,  redirect,     time.weekdays),
53         FW3_OPT("monthdays",           monthdays, redirect,     time.monthdays),
54
55         FW3_OPT("mark",                mark,      redirect,     mark),
56
57         FW3_OPT("reflection",          bool,      redirect,     reflection),
58         FW3_OPT("reflection_src",      reflection_source,
59                                                   redirect,     reflection_src),
60
61         FW3_OPT("target",              target,    redirect,     target),
62
63         { }
64 };
65
66
67 static bool
68 check_families(struct uci_element *e, struct fw3_redirect *r)
69 {
70         if (r->family == FW3_FAMILY_ANY)
71                 return true;
72
73         if (r->_src && r->_src->family && r->_src->family != r->family)
74         {
75                 warn_elem(e, "refers to source zone with different family");
76                 return false;
77         }
78
79         if (r->_dest && r->_dest->family && r->_dest->family != r->family)
80         {
81                 warn_elem(e, "refers to destination zone with different family");
82                 return false;
83         }
84
85         if (r->_ipset && r->_ipset->family && r->_ipset->family != r->family)
86         {
87                 warn_elem(e, "refers to ipset with different family");
88                 return false;
89         }
90
91         if (r->ip_src.family && r->ip_src.family != r->family)
92         {
93                 warn_elem(e, "uses source ip with different family");
94                 return false;
95         }
96
97         if (r->ip_dest.family && r->ip_dest.family != r->family)
98         {
99                 warn_elem(e, "uses destination ip with different family");
100                 return false;
101         }
102
103         if (r->ip_redir.family && r->ip_redir.family != r->family)
104         {
105                 warn_elem(e, "uses redirect ip with different family");
106                 return false;
107         }
108
109         return true;
110 }
111
112 static bool
113 compare_addr(struct fw3_address *a, struct fw3_address *b)
114 {
115         uint32_t mask;
116
117         if (a->family != FW3_FAMILY_V4)
118                 return false;
119
120         mask = ~((1 << (32 - a->mask)) - 1);
121
122         return ((a->address.v4.s_addr & mask) == (b->address.v4.s_addr & mask));
123 }
124
125 static bool
126 resolve_dest(struct uci_element *e, struct fw3_redirect *redir,
127              struct fw3_state *state)
128 {
129         struct fw3_zone *zone;
130         struct fw3_address *addr;
131         struct list_head *addrs;
132
133         if (!redir->ip_redir.set)
134                 return false;
135
136         list_for_each_entry(zone, &state->zones, list)
137         {
138                 addrs = fw3_resolve_zone_addresses(zone);
139
140                 if (!addrs)
141                         continue;
142
143                 list_for_each_entry(addr, addrs, list)
144                 {
145                         if (!compare_addr(addr, &redir->ip_redir))
146                                 continue;
147
148                         strncpy(redir->dest.name, zone->name, sizeof(redir->dest.name));
149                         redir->dest.set = true;
150                         redir->_dest = zone;
151
152                         break;
153                 }
154
155                 fw3_free_list(addrs);
156
157                 if (redir->_dest)
158                         return true;
159         }
160
161         return false;
162 }
163
164 void
165 fw3_load_redirects(struct fw3_state *state, struct uci_package *p)
166 {
167         struct uci_section *s;
168         struct uci_element *e;
169         struct fw3_redirect *redir;
170
171         bool valid;
172
173         INIT_LIST_HEAD(&state->redirects);
174
175         uci_foreach_element(&p->sections, e)
176         {
177                 s = uci_to_section(e);
178
179                 if (strcmp(s->type, "redirect"))
180                         continue;
181
182                 redir = malloc(sizeof(*redir));
183
184                 if (!redir)
185                         continue;
186
187                 memset(redir, 0, sizeof(*redir));
188
189                 INIT_LIST_HEAD(&redir->proto);
190                 INIT_LIST_HEAD(&redir->mac_src);
191
192                 redir->enabled = true;
193                 redir->reflection = true;
194
195                 valid = false;
196
197                 fw3_parse_options(redir, fw3_redirect_opts, s);
198
199                 if (!redir->enabled)
200                 {
201                         fw3_free_redirect(redir);
202                         continue;
203                 }
204
205                 if (redir->src.invert)
206                 {
207                         warn_elem(e, "must not have an inverted source");
208                         fw3_free_redirect(redir);
209                         continue;
210                 }
211                 else if (redir->src.set && !redir->src.any &&
212                          !(redir->_src = fw3_lookup_zone(state, redir->src.name)))
213                 {
214                         warn_elem(e, "refers to not existing zone '%s'", redir->src.name);
215                         fw3_free_redirect(redir);
216                         continue;
217                 }
218                 else if (redir->dest.set && !redir->dest.any &&
219                          !(redir->_dest = fw3_lookup_zone(state, redir->dest.name)))
220                 {
221                         warn_elem(e, "refers to not existing zone '%s'", redir->dest.name);
222                         fw3_free_redirect(redir);
223                         continue;
224                 }
225                 else if (redir->ipset.set && state->disable_ipsets)
226                 {
227                         warn_elem(e, "skipped due to disabled ipset support");
228                         fw3_free_redirect(redir);
229                         continue;
230                 }
231                 else if (redir->ipset.set && !redir->ipset.any &&
232                          !(redir->_ipset = fw3_lookup_ipset(state, redir->ipset.name)))
233                 {
234                         warn_elem(e, "refers to unknown ipset '%s'", redir->ipset.name);
235                         fw3_free_redirect(redir);
236                         continue;
237                 }
238
239                 if (!check_families(e, redir))
240                 {
241                         fw3_free_redirect(redir);
242                         continue;
243                 }
244
245                 if (redir->target == FW3_FLAG_UNSPEC)
246                 {
247                         warn_elem(e, "has no target specified, defaulting to DNAT");
248                         redir->target = FW3_FLAG_DNAT;
249                 }
250                 else if (redir->target < FW3_FLAG_DNAT)
251                 {
252                         warn_elem(e, "has invalid target specified, defaulting to DNAT");
253                         redir->target = FW3_FLAG_DNAT;
254                 }
255
256                 if (redir->target == FW3_FLAG_DNAT)
257                 {
258                         if (redir->src.any)
259                                 warn_elem(e, "must not have source '*' for DNAT target");
260                         else if (!redir->_src)
261                                 warn_elem(e, "has no source specified");
262                         else
263                         {
264                                 set(redir->_src->flags, FW3_FAMILY_V4, redir->target);
265                                 redir->_src->conntrack = true;
266                                 valid = true;
267                         }
268
269                         if (!redir->dest.set && resolve_dest(e, redir, state))
270                         {
271                                 warn_elem(e, "has no destination specified, assuming zone '%s'",
272                                           redir->dest.name);
273                         }
274
275                         if (redir->reflection && redir->_dest && redir->_src->masq)
276                         {
277                                 set(redir->_dest->flags, FW3_FAMILY_V4, FW3_FLAG_ACCEPT);
278                                 set(redir->_dest->flags, FW3_FAMILY_V4, FW3_FLAG_DNAT);
279                                 set(redir->_dest->flags, FW3_FAMILY_V4, FW3_FLAG_SNAT);
280                         }
281                 }
282                 else
283                 {
284                         if (redir->dest.any)
285                                 warn_elem(e, "must not have destination '*' for SNAT target");
286                         else if (!redir->_dest)
287                                 warn_elem(e, "has no destination specified");
288                         else if (!redir->ip_dest.set)
289                                 warn_elem(e, "has no src_dip option specified");
290                         else if (!list_empty(&redir->mac_src))
291                                 warn_elem(e, "must not use 'src_mac' option for SNAT target");
292                         else
293                         {
294                                 set(redir->_dest->flags, FW3_FAMILY_V4, redir->target);
295                                 redir->_dest->conntrack = true;
296                                 valid = true;
297                         }
298                 }
299
300                 if (list_empty(&redir->proto))
301                 {
302                         warn_elem(e, "does not specify a protocol, assuming TCP+UDP");
303                         fw3_parse_protocol(&redir->proto, "tcpudp", true);
304                 }
305
306                 if (!valid)
307                 {
308                         fw3_free_redirect(redir);
309                         continue;
310                 }
311
312                 if (!redir->port_redir.set)
313                         redir->port_redir = redir->port_dest;
314
315                 list_add_tail(&redir->list, &state->redirects);
316         }
317 }
318
319 static void
320 append_chain_nat(struct fw3_ipt_rule *r, struct fw3_redirect *redir)
321 {
322         if (redir->target == FW3_FLAG_DNAT)
323                 fw3_ipt_rule_append(r, "zone_%s_prerouting", redir->src.name);
324         else
325                 fw3_ipt_rule_append(r, "zone_%s_postrouting", redir->dest.name);
326 }
327
328 static void
329 set_snat_dnat(struct fw3_ipt_rule *r, enum fw3_flag target,
330               struct fw3_address *addr, struct fw3_port *port)
331 {
332         char buf[sizeof("255.255.255.255:65535-65535\0")];
333
334         buf[0] = '\0';
335
336         if (addr && addr->set)
337         {
338                 inet_ntop(AF_INET, &addr->address.v4, buf, sizeof(buf));
339         }
340
341         if (port && port->set)
342         {
343                 if (port->port_min == port->port_max)
344                         sprintf(buf + strlen(buf), ":%u", port->port_min);
345                 else
346                         sprintf(buf + strlen(buf), ":%u-%u",
347                                 port->port_min, port->port_max);
348         }
349
350         if (target == FW3_FLAG_DNAT)
351         {
352                 fw3_ipt_rule_target(r, "DNAT");
353                 fw3_ipt_rule_addarg(r, false, "--to-destination", buf);
354         }
355         else
356         {
357                 fw3_ipt_rule_target(r, "SNAT");
358                 fw3_ipt_rule_addarg(r, false, "--to-source", buf);
359         }
360 }
361
362 static void
363 set_target_nat(struct fw3_ipt_rule *r, struct fw3_redirect *redir)
364 {
365         if (redir->target == FW3_FLAG_DNAT)
366                 set_snat_dnat(r, redir->target, &redir->ip_redir, &redir->port_redir);
367         else
368                 set_snat_dnat(r, redir->target, &redir->ip_dest, &redir->port_dest);
369 }
370
371 static void
372 append_chain_filter(struct fw3_ipt_rule *r, struct fw3_redirect *redir)
373 {
374         if (redir->target == FW3_FLAG_DNAT)
375         {
376                 /* XXX: check for local ip */
377                 if (!redir->ip_redir.set)
378                         fw3_ipt_rule_append(r, "zone_%s_input", redir->src.name);
379                 else
380                         fw3_ipt_rule_append(r, "zone_%s_forward", redir->src.name);
381         }
382         else
383         {
384                 if (redir->src.set && !redir->src.any)
385                         fw3_ipt_rule_append(r, "zone_%s_forward", redir->src.name);
386                 else
387                         fw3_ipt_rule_append(r, "delegate_forward");
388         }
389 }
390
391 static void
392 set_target_filter(struct fw3_ipt_rule *r, struct fw3_redirect *redir)
393 {
394         /* XXX: check for local ip */
395         if (redir->target == FW3_FLAG_DNAT && !redir->ip_redir.set)
396                 fw3_ipt_rule_extra(r, "-m conntrack --ctstate DNAT");
397
398         fw3_ipt_rule_target(r, "ACCEPT");
399 }
400
401 static void
402 set_comment(struct fw3_ipt_rule *r, const char *name, int num, bool ref)
403 {
404         if (name)
405         {
406                 if (ref)
407                         fw3_ipt_rule_comment(r, "%s (reflection)", name);
408                 else
409                         fw3_ipt_rule_comment(r, name);
410         }
411         else
412         {
413                 if (ref)
414                         fw3_ipt_rule_comment(r, "@redirect[%u] (reflection)", num);
415                 else
416                         fw3_ipt_rule_comment(r, "@redirect[%u]", num);
417         }
418 }
419
420 static void
421 print_redirect(struct fw3_ipt_handle *h, struct fw3_state *state,
422                struct fw3_redirect *redir, int num,
423                struct fw3_protocol *proto, struct fw3_mac *mac)
424 {
425         struct fw3_ipt_rule *r;
426         struct fw3_address *src, *dst;
427         struct fw3_port *spt, *dpt;
428
429         switch (h->table)
430         {
431         case FW3_TABLE_NAT:
432                 src = &redir->ip_src;
433                 dst = &redir->ip_dest;
434                 spt = &redir->port_src;
435                 dpt = &redir->port_dest;
436
437                 if (redir->target == FW3_FLAG_SNAT)
438                 {
439                         dst = &redir->ip_redir;
440                         dpt = &redir->port_redir;
441                 }
442
443                 r = fw3_ipt_rule_create(h, proto, NULL, NULL, src, dst);
444                 fw3_ipt_rule_sport_dport(r, spt, dpt);
445                 fw3_ipt_rule_mac(r, mac);
446                 fw3_ipt_rule_ipset(r, redir->_ipset, redir->ipset.invert);
447                 fw3_ipt_rule_time(r, &redir->time);
448                 fw3_ipt_rule_mark(r, &redir->mark);
449                 set_target_nat(r, redir);
450                 fw3_ipt_rule_extra(r, redir->extra);
451                 set_comment(r, redir->name, num, false);
452                 append_chain_nat(r, redir);
453                 break;
454
455         case FW3_TABLE_FILTER:
456                 src = &redir->ip_src;
457                 dst = &redir->ip_redir;
458                 spt = &redir->port_src;
459                 dpt = &redir->port_redir;
460
461                 r = fw3_ipt_rule_create(h, proto, NULL, NULL, src, dst);
462                 fw3_ipt_rule_sport_dport(r, spt, dpt);
463                 fw3_ipt_rule_mac(r, mac);
464                 fw3_ipt_rule_ipset(r, redir->_ipset, redir->ipset.invert);
465                 fw3_ipt_rule_time(r, &redir->time);
466                 fw3_ipt_rule_mark(r, &redir->mark);
467                 set_target_filter(r, redir);
468                 fw3_ipt_rule_extra(r, redir->extra);
469                 set_comment(r, redir->name, num, false);
470                 append_chain_filter(r, redir);
471                 break;
472
473         default:
474                 break;
475         }
476 }
477
478 static void
479 print_reflection(struct fw3_ipt_handle *h, struct fw3_state *state,
480                  struct fw3_redirect *redir, int num,
481                  struct fw3_protocol *proto, struct fw3_address *ra,
482                  struct fw3_address *ia, struct fw3_address *ea)
483 {
484         struct fw3_ipt_rule *r;
485
486         switch (h->table)
487         {
488         case FW3_TABLE_NAT:
489                 r = fw3_ipt_rule_create(h, proto, NULL, NULL, ia, ea);
490                 fw3_ipt_rule_sport_dport(r, NULL, &redir->port_dest);
491                 fw3_ipt_rule_time(r, &redir->time);
492                 set_comment(r, redir->name, num, true);
493                 set_snat_dnat(r, FW3_FLAG_DNAT, &redir->ip_redir, &redir->port_redir);
494                 fw3_ipt_rule_append(r, "zone_%s_prerouting", redir->dest.name);
495
496                 r = fw3_ipt_rule_create(h, proto, NULL, NULL, ia, &redir->ip_redir);
497                 fw3_ipt_rule_sport_dport(r, NULL, &redir->port_redir);
498                 fw3_ipt_rule_time(r, &redir->time);
499                 set_comment(r, redir->name, num, true);
500                 set_snat_dnat(r, FW3_FLAG_SNAT, ra, NULL);
501                 fw3_ipt_rule_append(r, "zone_%s_postrouting", redir->dest.name);
502                 break;
503
504         case FW3_TABLE_FILTER:
505                 r = fw3_ipt_rule_create(h, proto, NULL, NULL, ia, &redir->ip_redir);
506                 fw3_ipt_rule_sport_dport(r, NULL, &redir->port_redir);
507                 fw3_ipt_rule_time(r, &redir->time);
508                 set_comment(r, redir->name, num, true);
509                 fw3_ipt_rule_target(r, "zone_%s_dest_ACCEPT", redir->dest.name);
510                 fw3_ipt_rule_append(r, "zone_%s_forward", redir->dest.name);
511                 break;
512
513         default:
514                 break;
515         }
516 }
517
518 static void
519 expand_redirect(struct fw3_ipt_handle *handle, struct fw3_state *state,
520                 struct fw3_redirect *redir, int num)
521 {
522         struct list_head *ext_addrs, *int_addrs;
523         struct fw3_address *ext_addr, *int_addr, ref_addr;
524         struct fw3_protocol *proto;
525         struct fw3_mac *mac;
526
527         if (redir->name)
528                 info("   * Redirect '%s'", redir->name);
529         else
530                 info("   * Redirect #%u", num);
531
532         if (!fw3_is_family(redir->_src, handle->family) ||
533                 !fw3_is_family(redir->_dest, handle->family))
534         {
535                 info("     ! Skipping due to different family of zone");
536                 return;
537         }
538
539         if (!fw3_is_family(&redir->ip_src, handle->family) ||
540             !fw3_is_family(&redir->ip_dest, handle->family) ||
541                 !fw3_is_family(&redir->ip_redir, handle->family))
542         {
543                 info("     ! Skipping due to different family of ip address");
544                 return;
545         }
546
547         if (redir->_ipset)
548         {
549                 if (!fw3_is_family(redir->_ipset, handle->family))
550                 {
551                         info("     ! Skipping due to different family in ipset");
552                         return;
553                 }
554
555                 if (!fw3_check_ipset(redir->_ipset))
556                 {
557                         info("     ! Skipping due to missing ipset '%s'",
558                              redir->_ipset->external ?
559                                         redir->_ipset->external : redir->_ipset->name);
560                         return;
561                 }
562
563                 set(redir->_ipset->flags, handle->family, handle->family);
564         }
565
566         fw3_foreach(proto, &redir->proto)
567         fw3_foreach(mac, &redir->mac_src)
568                 print_redirect(handle, state, redir, num, proto, mac);
569
570         /* reflection rules */
571         if (redir->target != FW3_FLAG_DNAT || !redir->reflection)
572                 return;
573
574         if (!redir->_dest || !redir->_src->masq)
575                 return;
576
577         ext_addrs = fw3_resolve_zone_addresses(redir->_src);
578         int_addrs = fw3_resolve_zone_addresses(redir->_dest);
579
580         if (!ext_addrs || !int_addrs)
581                 goto out;
582
583         list_for_each_entry(ext_addr, ext_addrs, list)
584         {
585                 if (!fw3_is_family(ext_addr, handle->family))
586                         continue;
587
588                 list_for_each_entry(int_addr, int_addrs, list)
589                 {
590                         if (!fw3_is_family(int_addr, handle->family))
591                                 continue;
592
593                         fw3_foreach(proto, &redir->proto)
594                         {
595                                 if (!proto || (proto->protocol != 6 && proto->protocol != 17))
596                                         continue;
597
598                                 if (redir->reflection_src == FW3_REFLECTION_INTERNAL)
599                                         ref_addr = *int_addr;
600                                 else
601                                         ref_addr = *ext_addr;
602
603                                 ref_addr.mask = 32;
604                                 ext_addr->mask = 32;
605
606                                 print_reflection(handle, state, redir, num, proto,
607                                                                  &ref_addr, int_addr, ext_addr);
608                         }
609                 }
610         }
611
612 out:
613         fw3_free_list(ext_addrs);
614         fw3_free_list(int_addrs);
615 }
616
617 void
618 fw3_print_redirects(struct fw3_ipt_handle *handle, struct fw3_state *state)
619 {
620         int num = 0;
621         struct fw3_redirect *redir;
622
623         if (handle->family == FW3_FAMILY_V6)
624                 return;
625
626         if (handle->table != FW3_TABLE_FILTER && handle->table != FW3_TABLE_NAT)
627                 return;
628
629         list_for_each_entry(redir, &state->redirects, list)
630                 expand_redirect(handle, state, redir, num++);
631 }