Make sure that NOTRACK is linked into firewall3 if it is part of libext*.a
[project/firewall3.git] / rules.c
1 /*
2  * firewall3 - 3rd OpenWrt UCI firewall implementation
3  *
4  *   Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
5  *
6  * Permission to use, copy, modify, and/or distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18
19 #include "rules.h"
20
21
22 const struct fw3_option fw3_rule_opts[] = {
23         FW3_OPT("enabled",             bool,      rule,     enabled),
24
25         FW3_OPT("name",                string,    rule,     name),
26         FW3_OPT("family",              family,    rule,     family),
27
28         FW3_OPT("src",                 device,    rule,     src),
29         FW3_OPT("dest",                device,    rule,     dest),
30
31         FW3_OPT("ipset",               setmatch,  rule,     ipset),
32
33         FW3_LIST("proto",              protocol,  rule,     proto),
34
35         FW3_LIST("src_ip",             network,   rule,     ip_src),
36         FW3_LIST("src_mac",            mac,       rule,     mac_src),
37         FW3_LIST("src_port",           port,      rule,     port_src),
38
39         FW3_LIST("dest_ip",            network,   rule,     ip_dest),
40         FW3_LIST("dest_port",          port,      rule,     port_dest),
41
42         FW3_LIST("icmp_type",          icmptype,  rule,     icmp_type),
43         FW3_OPT("extra",               string,    rule,     extra),
44
45         FW3_OPT("limit",               limit,     rule,     limit),
46         FW3_OPT("limit_burst",         int,       rule,     limit.burst),
47
48         FW3_OPT("utc_time",            bool,      rule,     time.utc),
49         FW3_OPT("start_date",          date,      rule,     time.datestart),
50         FW3_OPT("stop_date",           date,      rule,     time.datestop),
51         FW3_OPT("start_time",          time,      rule,     time.timestart),
52         FW3_OPT("stop_time",           time,      rule,     time.timestop),
53         FW3_OPT("weekdays",            weekdays,  rule,     time.weekdays),
54         FW3_OPT("monthdays",           monthdays, rule,     time.monthdays),
55
56         FW3_OPT("mark",                mark,      rule,     mark),
57         FW3_OPT("set_mark",            mark,      rule,     set_mark),
58         FW3_OPT("set_xmark",           mark,      rule,     set_xmark),
59
60         FW3_OPT("target",              target,    rule,     target),
61
62         { }
63 };
64
65
66 static bool
67 need_src_action_chain(struct fw3_rule *r)
68 {
69         return (r->_src && r->_src->log && (r->target > FW3_FLAG_ACCEPT));
70 }
71
72 void
73 fw3_load_rules(struct fw3_state *state, struct uci_package *p)
74 {
75         struct uci_section *s;
76         struct uci_element *e;
77         struct fw3_rule *rule;
78
79         INIT_LIST_HEAD(&state->rules);
80
81         uci_foreach_element(&p->sections, e)
82         {
83                 s = uci_to_section(e);
84
85                 if (strcmp(s->type, "rule"))
86                         continue;
87
88                 rule = malloc(sizeof(*rule));
89
90                 if (!rule)
91                         continue;
92
93                 memset(rule, 0, sizeof(*rule));
94
95                 INIT_LIST_HEAD(&rule->proto);
96
97                 INIT_LIST_HEAD(&rule->ip_src);
98                 INIT_LIST_HEAD(&rule->mac_src);
99                 INIT_LIST_HEAD(&rule->port_src);
100
101                 INIT_LIST_HEAD(&rule->ip_dest);
102                 INIT_LIST_HEAD(&rule->port_dest);
103
104                 INIT_LIST_HEAD(&rule->icmp_type);
105
106                 rule->enabled = true;
107
108                 fw3_parse_options(rule, fw3_rule_opts, s);
109
110                 if (!rule->enabled)
111                 {
112                         fw3_free_rule(rule);
113                         continue;
114                 }
115
116                 if (rule->src.invert || rule->dest.invert)
117                 {
118                         warn_elem(e, "must not have inverted 'src' or 'dest' options");
119                         fw3_free_rule(rule);
120                         continue;
121                 }
122                 else if (rule->src.set && !rule->src.any &&
123                          !(rule->_src = fw3_lookup_zone(state, rule->src.name)))
124                 {
125                         warn_elem(e, "refers to not existing zone '%s'", rule->src.name);
126                         fw3_free_rule(rule);
127                         continue;
128                 }
129                 else if (rule->dest.set && !rule->dest.any &&
130                          !(rule->_dest = fw3_lookup_zone(state, rule->dest.name)))
131                 {
132                         warn_elem(e, "refers to not existing zone '%s'", rule->dest.name);
133                         fw3_free_rule(rule);
134                         continue;
135                 }
136                 else if (rule->ipset.set && state->disable_ipsets)
137                 {
138                         warn_elem(e, "skipped due to disabled ipset support");
139                         fw3_free_rule(rule);
140                         continue;
141                 }
142                 else if (rule->ipset.set &&
143                          !(rule->ipset.ptr = fw3_lookup_ipset(state, rule->ipset.name)))
144                 {
145                         warn_elem(e, "refers to unknown ipset '%s'", rule->ipset.name);
146                         fw3_free_rule(rule);
147                         continue;
148                 }
149
150                 if (!rule->_src && rule->target == FW3_FLAG_NOTRACK)
151                 {
152                         warn_elem(e, "is set to target NOTRACK but has no source assigned");
153                         fw3_free_rule(rule);
154                         continue;
155                 }
156
157                 if (!rule->set_mark.set && !rule->set_xmark.set &&
158                     rule->target == FW3_FLAG_MARK)
159                 {
160                         warn_elem(e, "is set to target MARK but specifies neither "
161                                      "'set_mark' nor 'set_xmark' option");
162                         fw3_free_rule(rule);
163                         continue;
164                 }
165
166                 if (rule->_dest && rule->target == FW3_FLAG_MARK)
167                 {
168                         warn_elem(e, "must not specify 'dest' for MARK target");
169                         fw3_free_rule(rule);
170                         continue;
171                 }
172
173                 if (rule->set_mark.invert || rule->set_xmark.invert)
174                 {
175                         warn_elem(e, "must not have inverted 'set_mark' or 'set_xmark'");
176                         fw3_free_rule(rule);
177                         continue;
178                 }
179
180                 if (!rule->_src && !rule->_dest && !rule->src.any && !rule->dest.any)
181                 {
182                         warn_elem(e, "has neither a source nor a destination zone assigned "
183                                      "- assuming an output rule");
184                 }
185
186                 if (list_empty(&rule->proto))
187                 {
188                         warn_elem(e, "does not specify a protocol, assuming TCP+UDP");
189                         fw3_parse_protocol(&rule->proto, "tcpudp", true);
190                 }
191
192                 if (rule->target == FW3_FLAG_UNSPEC)
193                 {
194                         warn_elem(e, "has no target specified, defaulting to REJECT");
195                         rule->target = FW3_FLAG_REJECT;
196                 }
197                 else if (rule->target > FW3_FLAG_MARK)
198                 {
199                         warn_elem(e, "has invalid target specified, defaulting to REJECT");
200                         rule->target = FW3_FLAG_REJECT;
201                 }
202
203                 /* NB: rule family... */
204                 if (rule->_dest)
205                 {
206                         setbit(rule->_dest->flags[0], rule->target);
207                         setbit(rule->_dest->flags[1], rule->target);
208                 }
209                 else if (need_src_action_chain(rule))
210                 {
211                         setbit(rule->_src->flags[0], fw3_to_src_target(rule->target));
212                         setbit(rule->_src->flags[1], fw3_to_src_target(rule->target));
213                 }
214
215                 list_add_tail(&rule->list, &state->rules);
216                 continue;
217         }
218 }
219
220
221 static void
222 append_chain(struct fw3_ipt_rule *r, struct fw3_rule *rule)
223 {
224         char chain[32];
225
226         snprintf(chain, sizeof(chain), "delegate_output");
227
228         if (rule->target == FW3_FLAG_NOTRACK)
229         {
230                 snprintf(chain, sizeof(chain), "zone_%s_notrack", rule->src.name);
231         }
232         else if (rule->target == FW3_FLAG_MARK)
233         {
234                 snprintf(chain, sizeof(chain), "fwmark");
235         }
236         else
237         {
238                 if (rule->src.set)
239                 {
240                         if (!rule->src.any)
241                         {
242                                 if (rule->dest.set)
243                                         snprintf(chain, sizeof(chain), "zone_%s_forward",
244                                                  rule->src.name);
245                                 else
246                                         snprintf(chain, sizeof(chain), "zone_%s_input",
247                                                  rule->src.name);
248                         }
249                         else
250                         {
251                                 if (rule->dest.set)
252                                         snprintf(chain, sizeof(chain), "delegate_forward");
253                                 else
254                                         snprintf(chain, sizeof(chain), "delegate_input");
255                         }
256                 }
257
258                 if (rule->dest.set && !rule->src.set)
259                 {
260                         if (rule->dest.any)
261                                 snprintf(chain, sizeof(chain), "delegate_output");
262                         else
263                                 snprintf(chain, sizeof(chain), "zone_%s_output",
264                                          rule->dest.name);
265                 }
266         }
267
268         fw3_ipt_rule_append(r, chain);
269 }
270
271 static void set_target(struct fw3_ipt_rule *r, struct fw3_rule *rule)
272 {
273         const char *name;
274         struct fw3_mark *mark;
275         char buf[sizeof("0xFFFFFFFF/0xFFFFFFFF\0")];
276
277         switch(rule->target)
278         {
279         case FW3_FLAG_MARK:
280                 name = rule->set_mark.set ? "--set-mark" : "--set-xmark";
281                 mark = rule->set_mark.set ? &rule->set_mark : &rule->set_xmark;
282                 sprintf(buf, "0x%x/0x%x", mark->mark, mark->mask);
283
284                 fw3_ipt_rule_target(r, "MARK");
285                 fw3_ipt_rule_addarg(r, false, name, buf);
286                 return;
287
288         case FW3_FLAG_NOTRACK:
289                 fw3_ipt_rule_target(r, fw3_flag_names[rule->target]);
290                 return;
291
292         case FW3_FLAG_ACCEPT:
293         case FW3_FLAG_DROP:
294                 name = fw3_flag_names[rule->target];
295                 break;
296
297         default:
298                 name = fw3_flag_names[FW3_FLAG_REJECT];
299                 break;
300         }
301
302         if (rule->dest.set && !rule->dest.any)
303                 fw3_ipt_rule_target(r, "zone_%s_dest_%s", rule->dest.name, name);
304         else if (need_src_action_chain(rule))
305                 fw3_ipt_rule_target(r, "zone_%s_src_%s", rule->src.name, name);
306         else if (strcmp(name, "REJECT"))
307                 fw3_ipt_rule_target(r, name);
308         else
309                 fw3_ipt_rule_target(r, "reject");
310 }
311
312 static void
313 set_comment(struct fw3_ipt_rule *r, const char *name, int num)
314 {
315         if (name)
316                 fw3_ipt_rule_comment(r, name);
317         else
318                 fw3_ipt_rule_comment(r, "@rule[%u]", num);
319 }
320
321 static void
322 print_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
323            struct fw3_rule *rule, int num, struct fw3_protocol *proto,
324            struct fw3_address *sip, struct fw3_address *dip,
325            struct fw3_port *sport, struct fw3_port *dport,
326            struct fw3_mac *mac, struct fw3_icmptype *icmptype)
327 {
328         struct fw3_ipt_rule *r;
329
330         if (!fw3_is_family(sip, handle->family) ||
331             !fw3_is_family(dip, handle->family))
332         {
333                 if ((sip && !sip->resolved) || (dip && !dip->resolved))
334                         info("     ! Skipping due to different family of ip address");
335
336                 return;
337         }
338
339         if (proto->protocol == 58 && handle->family == FW3_FAMILY_V4)
340         {
341                 info("     ! Skipping due to different family of protocol");
342                 return;
343         }
344
345         r = fw3_ipt_rule_create(handle, proto, NULL, NULL, sip, dip);
346         fw3_ipt_rule_sport_dport(r, sport, dport);
347         fw3_ipt_rule_icmptype(r, icmptype);
348         fw3_ipt_rule_mac(r, mac);
349         fw3_ipt_rule_ipset(r, &rule->ipset);
350         fw3_ipt_rule_limit(r, &rule->limit);
351         fw3_ipt_rule_time(r, &rule->time);
352         fw3_ipt_rule_mark(r, &rule->mark);
353         set_target(r, rule);
354         fw3_ipt_rule_extra(r, rule->extra);
355         set_comment(r, rule->name, num);
356         append_chain(r, rule);
357 }
358
359 static void
360 expand_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
361             struct fw3_rule *rule, int num)
362 {
363         struct fw3_protocol *proto;
364         struct fw3_address *sip;
365         struct fw3_address *dip;
366         struct fw3_port *sport;
367         struct fw3_port *dport;
368         struct fw3_mac *mac;
369         struct fw3_icmptype *icmptype;
370
371         struct list_head *sports = NULL;
372         struct list_head *dports = NULL;
373         struct list_head *icmptypes = NULL;
374
375         struct list_head empty;
376         INIT_LIST_HEAD(&empty);
377
378         if (!fw3_is_family(rule, handle->family))
379                 return;
380
381         if ((rule->target == FW3_FLAG_NOTRACK && handle->table != FW3_TABLE_RAW) ||
382             (rule->target == FW3_FLAG_MARK && handle->table != FW3_TABLE_MANGLE) ||
383                 (rule->target < FW3_FLAG_NOTRACK && handle->table != FW3_TABLE_FILTER))
384                 return;
385
386         if (rule->name)
387                 info("   * Rule '%s'", rule->name);
388         else
389                 info("   * Rule #%u", num);
390
391         if (!fw3_is_family(rule->_src, handle->family) ||
392             !fw3_is_family(rule->_dest, handle->family))
393         {
394                 info("     ! Skipping due to different family of zone");
395                 return;
396         }
397
398         if (rule->ipset.ptr)
399         {
400                 if (!fw3_is_family(rule->ipset.ptr, handle->family))
401                 {
402                         info("     ! Skipping due to different family in ipset");
403                         return;
404                 }
405
406                 if (!fw3_check_ipset(rule->ipset.ptr))
407                 {
408                         info("     ! Skipping due to missing ipset '%s'",
409                              rule->ipset.ptr->external
410                                         ? rule->ipset.ptr->external : rule->ipset.ptr->name);
411                         return;
412                 }
413
414                 set(rule->ipset.ptr->flags, handle->family, handle->family);
415         }
416
417         list_for_each_entry(proto, &rule->proto, list)
418         {
419                 /* icmp / ipv6-icmp */
420                 if (proto->protocol == 1 || proto->protocol == 58)
421                 {
422                         sports = &empty;
423                         dports = &empty;
424                         icmptypes = &rule->icmp_type;
425                 }
426                 else
427                 {
428                         sports = &rule->port_src;
429                         dports = &rule->port_dest;
430                         icmptypes = &empty;
431                 }
432
433                 fw3_foreach(sip, &rule->ip_src)
434                 fw3_foreach(dip, &rule->ip_dest)
435                 fw3_foreach(sport, sports)
436                 fw3_foreach(dport, dports)
437                 fw3_foreach(mac, &rule->mac_src)
438                 fw3_foreach(icmptype, icmptypes)
439                         print_rule(handle, state, rule, num, proto, sip, dip,
440                                    sport, dport, mac, icmptype);
441         }
442 }
443
444 void
445 fw3_print_rules(struct fw3_ipt_handle *handle, struct fw3_state *state)
446 {
447         int num = 0;
448         struct fw3_rule *rule;
449
450         list_for_each_entry(rule, &state->rules, list)
451                 expand_rule(handle, state, rule, num++);
452 }