treewide: replace jow@openwrt.org with jo@mein.io
[project/firewall3.git] / rules.c
1 /*
2  * firewall3 - 3rd OpenWrt UCI firewall implementation
3  *
4  *   Copyright (C) 2013 Jo-Philipp Wich <jo@mein.io>
5  *
6  * Permission to use, copy, modify, and/or distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18
19 #include "rules.h"
20
21
22 const struct fw3_option fw3_rule_opts[] = {
23         FW3_OPT("enabled",             bool,      rule,     enabled),
24
25         FW3_OPT("name",                string,    rule,     name),
26         FW3_OPT("family",              family,    rule,     family),
27
28         FW3_OPT("src",                 device,    rule,     src),
29         FW3_OPT("dest",                device,    rule,     dest),
30
31         FW3_OPT("device",              string,    rule,     device),
32         FW3_OPT("direction",           direction, rule,     direction_out),
33
34         FW3_OPT("ipset",               setmatch,  rule,     ipset),
35
36         FW3_LIST("proto",              protocol,  rule,     proto),
37
38         FW3_LIST("src_ip",             network,   rule,     ip_src),
39         FW3_LIST("src_mac",            mac,       rule,     mac_src),
40         FW3_LIST("src_port",           port,      rule,     port_src),
41
42         FW3_LIST("dest_ip",            network,   rule,     ip_dest),
43         FW3_LIST("dest_port",          port,      rule,     port_dest),
44
45         FW3_LIST("icmp_type",          icmptype,  rule,     icmp_type),
46         FW3_OPT("extra",               string,    rule,     extra),
47
48         FW3_OPT("limit",               limit,     rule,     limit),
49         FW3_OPT("limit_burst",         int,       rule,     limit.burst),
50
51         FW3_OPT("utc_time",            bool,      rule,     time.utc),
52         FW3_OPT("start_date",          date,      rule,     time.datestart),
53         FW3_OPT("stop_date",           date,      rule,     time.datestop),
54         FW3_OPT("start_time",          time,      rule,     time.timestart),
55         FW3_OPT("stop_time",           time,      rule,     time.timestop),
56         FW3_OPT("weekdays",            weekdays,  rule,     time.weekdays),
57         FW3_OPT("monthdays",           monthdays, rule,     time.monthdays),
58
59         FW3_OPT("mark",                mark,      rule,     mark),
60         FW3_OPT("set_mark",            mark,      rule,     set_mark),
61         FW3_OPT("set_xmark",           mark,      rule,     set_xmark),
62
63         FW3_OPT("target",              target,    rule,     target),
64
65         { }
66 };
67
68
69 static bool
70 need_src_action_chain(struct fw3_rule *r)
71 {
72         return (r->_src && r->_src->log && (r->target > FW3_FLAG_ACCEPT));
73 }
74
75 static struct fw3_rule*
76 alloc_rule(struct fw3_state *state)
77 {
78         struct fw3_rule *rule = calloc(1, sizeof(*rule));
79
80         if (rule) {
81                 INIT_LIST_HEAD(&rule->proto);
82
83                 INIT_LIST_HEAD(&rule->ip_src);
84                 INIT_LIST_HEAD(&rule->mac_src);
85                 INIT_LIST_HEAD(&rule->port_src);
86
87                 INIT_LIST_HEAD(&rule->ip_dest);
88                 INIT_LIST_HEAD(&rule->port_dest);
89
90                 INIT_LIST_HEAD(&rule->icmp_type);
91
92                 list_add_tail(&rule->list, &state->rules);
93                 rule->enabled = true;
94         }
95
96         return rule;
97 }
98
99 void
100 fw3_load_rules(struct fw3_state *state, struct uci_package *p,
101                 struct blob_attr *a)
102 {
103         struct uci_section *s;
104         struct uci_element *e;
105         struct fw3_rule *rule, *n;
106         struct blob_attr *entry, *opt;
107         unsigned rem, orem;
108
109         INIT_LIST_HEAD(&state->rules);
110
111         blob_for_each_attr(entry, a, rem) {
112                 const char *type = NULL;
113                 const char *name = "ubus rule";
114                 blobmsg_for_each_attr(opt, entry, orem)
115                         if (!strcmp(blobmsg_name(opt), "type"))
116                                 type = blobmsg_get_string(opt);
117                         else if (!strcmp(blobmsg_name(opt), "name"))
118                                 name = blobmsg_get_string(opt);
119
120                 if (!type || strcmp(type, "rule"))
121                         continue;
122
123                 if (!(rule = alloc_rule(state)))
124                         continue;
125
126                 if (!fw3_parse_blob_options(rule, fw3_rule_opts, entry, name))
127                 {
128                         fprintf(stderr, "%s skipped due to invalid options\n", name);
129                         fw3_free_rule(rule);
130                         continue;
131                 }
132         }
133
134         uci_foreach_element(&p->sections, e)
135         {
136                 s = uci_to_section(e);
137
138                 if (strcmp(s->type, "rule"))
139                         continue;
140
141                 if (!(rule = alloc_rule(state)))
142                         continue;
143
144                 if (!fw3_parse_options(rule, fw3_rule_opts, s))
145                 {
146                         warn_elem(e, "skipped due to invalid options");
147                         fw3_free_rule(rule);
148                         continue;
149                 }
150         }
151
152         list_for_each_entry_safe(rule, n, &state->rules, list)
153         {
154                 if (!rule->enabled)
155                 {
156                         fw3_free_rule(rule);
157                         continue;
158                 }
159
160                 if (rule->src.invert || rule->dest.invert)
161                 {
162                         warn_elem(e, "must not have inverted 'src' or 'dest' options");
163                         fw3_free_rule(rule);
164                         continue;
165                 }
166                 else if (rule->src.set && !rule->src.any &&
167                          !(rule->_src = fw3_lookup_zone(state, rule->src.name)))
168                 {
169                         warn_elem(e, "refers to not existing zone '%s'", rule->src.name);
170                         fw3_free_rule(rule);
171                         continue;
172                 }
173                 else if (rule->dest.set && !rule->dest.any &&
174                          !(rule->_dest = fw3_lookup_zone(state, rule->dest.name)))
175                 {
176                         warn_elem(e, "refers to not existing zone '%s'", rule->dest.name);
177                         fw3_free_rule(rule);
178                         continue;
179                 }
180                 else if (rule->ipset.set && state->disable_ipsets)
181                 {
182                         warn_elem(e, "skipped due to disabled ipset support");
183                         fw3_free_rule(rule);
184                         continue;
185                 }
186                 else if (rule->ipset.set &&
187                          !(rule->ipset.ptr = fw3_lookup_ipset(state, rule->ipset.name)))
188                 {
189                         warn_elem(e, "refers to unknown ipset '%s'", rule->ipset.name);
190                         fw3_free_rule(rule);
191                         continue;
192                 }
193
194                 if (!rule->_src && rule->target == FW3_FLAG_NOTRACK)
195                 {
196                         warn_elem(e, "is set to target NOTRACK but has no source assigned");
197                         fw3_free_rule(rule);
198                         continue;
199                 }
200
201                 if (!rule->set_mark.set && !rule->set_xmark.set &&
202                     rule->target == FW3_FLAG_MARK)
203                 {
204                         warn_elem(e, "is set to target MARK but specifies neither "
205                                      "'set_mark' nor 'set_xmark' option");
206                         fw3_free_rule(rule);
207                         continue;
208                 }
209
210                 if (rule->_dest && rule->target == FW3_FLAG_MARK)
211                 {
212                         warn_elem(e, "must not specify 'dest' for MARK target");
213                         fw3_free_rule(rule);
214                         continue;
215                 }
216
217                 if (rule->set_mark.invert || rule->set_xmark.invert)
218                 {
219                         warn_elem(e, "must not have inverted 'set_mark' or 'set_xmark'");
220                         fw3_free_rule(rule);
221                         continue;
222                 }
223
224                 if (!rule->_src && !rule->_dest && !rule->src.any && !rule->dest.any)
225                 {
226                         warn_elem(e, "has neither a source nor a destination zone assigned "
227                                      "- assuming an output rule");
228                 }
229
230                 if (list_empty(&rule->proto))
231                 {
232                         warn_elem(e, "does not specify a protocol, assuming TCP+UDP");
233                         fw3_parse_protocol(&rule->proto, "tcpudp", true);
234                 }
235
236                 if (rule->target == FW3_FLAG_UNSPEC)
237                 {
238                         warn_elem(e, "has no target specified, defaulting to REJECT");
239                         rule->target = FW3_FLAG_REJECT;
240                 }
241                 else if (rule->target > FW3_FLAG_MARK)
242                 {
243                         warn_elem(e, "has invalid target specified, defaulting to REJECT");
244                         rule->target = FW3_FLAG_REJECT;
245                 }
246
247                 /* NB: rule family... */
248                 if (rule->_dest)
249                 {
250                         setbit(rule->_dest->flags[0], rule->target);
251                         setbit(rule->_dest->flags[1], rule->target);
252                 }
253                 else if (need_src_action_chain(rule))
254                 {
255                         setbit(rule->_src->flags[0], fw3_to_src_target(rule->target));
256                         setbit(rule->_src->flags[1], fw3_to_src_target(rule->target));
257                 }
258         }
259 }
260
261
262 static void
263 append_chain(struct fw3_ipt_rule *r, struct fw3_rule *rule)
264 {
265         char chain[32];
266
267         snprintf(chain, sizeof(chain), "OUTPUT");
268
269         if (rule->target == FW3_FLAG_NOTRACK)
270         {
271                 snprintf(chain, sizeof(chain), "zone_%s_notrack", rule->src.name);
272         }
273         else if (rule->target == FW3_FLAG_MARK && (rule->_src || rule->src.any))
274         {
275                 snprintf(chain, sizeof(chain), "PREROUTING");
276         }
277         else
278         {
279                 if (rule->src.set)
280                 {
281                         if (!rule->src.any)
282                         {
283                                 if (rule->dest.set)
284                                         snprintf(chain, sizeof(chain), "zone_%s_forward",
285                                                  rule->src.name);
286                                 else
287                                         snprintf(chain, sizeof(chain), "zone_%s_input",
288                                                  rule->src.name);
289                         }
290                         else
291                         {
292                                 if (rule->dest.set)
293                                         snprintf(chain, sizeof(chain), "FORWARD");
294                                 else
295                                         snprintf(chain, sizeof(chain), "INPUT");
296                         }
297                 }
298
299                 if (rule->dest.set && !rule->src.set)
300                 {
301                         if (rule->dest.any)
302                                 snprintf(chain, sizeof(chain), "OUTPUT");
303                         else
304                                 snprintf(chain, sizeof(chain), "zone_%s_output",
305                                          rule->dest.name);
306                 }
307         }
308
309         fw3_ipt_rule_append(r, chain);
310 }
311
312 static void set_target(struct fw3_ipt_rule *r, struct fw3_rule *rule)
313 {
314         const char *name;
315         struct fw3_mark *mark;
316         char buf[sizeof("0xFFFFFFFF/0xFFFFFFFF\0")];
317
318         switch(rule->target)
319         {
320         case FW3_FLAG_MARK:
321                 name = rule->set_mark.set ? "--set-mark" : "--set-xmark";
322                 mark = rule->set_mark.set ? &rule->set_mark : &rule->set_xmark;
323                 sprintf(buf, "0x%x/0x%x", mark->mark, mark->mask);
324
325                 fw3_ipt_rule_target(r, "MARK");
326                 fw3_ipt_rule_addarg(r, false, name, buf);
327                 return;
328
329         case FW3_FLAG_NOTRACK:
330                 fw3_ipt_rule_target(r, "CT");
331                 fw3_ipt_rule_addarg(r, false, "--notrack", NULL);
332                 return;
333
334         case FW3_FLAG_ACCEPT:
335         case FW3_FLAG_DROP:
336                 name = fw3_flag_names[rule->target];
337                 break;
338
339         default:
340                 name = fw3_flag_names[FW3_FLAG_REJECT];
341                 break;
342         }
343
344         if (rule->dest.set && !rule->dest.any)
345                 fw3_ipt_rule_target(r, "zone_%s_dest_%s", rule->dest.name, name);
346         else if (need_src_action_chain(rule))
347                 fw3_ipt_rule_target(r, "zone_%s_src_%s", rule->src.name, name);
348         else if (strcmp(name, "REJECT"))
349                 fw3_ipt_rule_target(r, name);
350         else
351                 fw3_ipt_rule_target(r, "reject");
352 }
353
354 static void
355 set_comment(struct fw3_ipt_rule *r, const char *name, int num)
356 {
357         if (name)
358                 fw3_ipt_rule_comment(r, name);
359         else
360                 fw3_ipt_rule_comment(r, "@rule[%u]", num);
361 }
362
363 static void
364 print_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
365            struct fw3_rule *rule, int num, struct fw3_protocol *proto,
366            struct fw3_address *sip, struct fw3_address *dip,
367            struct fw3_port *sport, struct fw3_port *dport,
368            struct fw3_mac *mac, struct fw3_icmptype *icmptype)
369 {
370         struct fw3_ipt_rule *r;
371
372         if (!fw3_is_family(sip, handle->family) ||
373             !fw3_is_family(dip, handle->family))
374         {
375                 if ((sip && !sip->resolved) || (dip && !dip->resolved))
376                         info("     ! Skipping due to different family of ip address");
377
378                 return;
379         }
380
381         if (proto->protocol == 58 && handle->family == FW3_FAMILY_V4)
382         {
383                 info("     ! Skipping due to different family of protocol");
384                 return;
385         }
386
387         r = fw3_ipt_rule_create(handle, proto, NULL, NULL, sip, dip);
388         fw3_ipt_rule_sport_dport(r, sport, dport);
389         fw3_ipt_rule_device(r, rule->device, rule->direction_out);
390         fw3_ipt_rule_icmptype(r, icmptype);
391         fw3_ipt_rule_mac(r, mac);
392         fw3_ipt_rule_ipset(r, &rule->ipset);
393         fw3_ipt_rule_limit(r, &rule->limit);
394         fw3_ipt_rule_time(r, &rule->time);
395         fw3_ipt_rule_mark(r, &rule->mark);
396         set_target(r, rule);
397         fw3_ipt_rule_extra(r, rule->extra);
398         set_comment(r, rule->name, num);
399         append_chain(r, rule);
400 }
401
402 static void
403 expand_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
404             struct fw3_rule *rule, int num)
405 {
406         struct fw3_protocol *proto;
407         struct fw3_address *sip;
408         struct fw3_address *dip;
409         struct fw3_port *sport;
410         struct fw3_port *dport;
411         struct fw3_mac *mac;
412         struct fw3_icmptype *icmptype;
413
414         struct list_head *sports = NULL;
415         struct list_head *dports = NULL;
416         struct list_head *icmptypes = NULL;
417
418         struct list_head empty;
419         INIT_LIST_HEAD(&empty);
420
421         if (!fw3_is_family(rule, handle->family))
422                 return;
423
424         if ((rule->target == FW3_FLAG_NOTRACK && handle->table != FW3_TABLE_RAW) ||
425             (rule->target == FW3_FLAG_MARK && handle->table != FW3_TABLE_MANGLE) ||
426                 (rule->target < FW3_FLAG_NOTRACK && handle->table != FW3_TABLE_FILTER))
427                 return;
428
429         if (rule->name)
430                 info("   * Rule '%s'", rule->name);
431         else
432                 info("   * Rule #%u", num);
433
434         if (!fw3_is_family(rule->_src, handle->family) ||
435             !fw3_is_family(rule->_dest, handle->family))
436         {
437                 info("     ! Skipping due to different family of zone");
438                 return;
439         }
440
441         if (rule->ipset.ptr)
442         {
443                 if (!fw3_is_family(rule->ipset.ptr, handle->family))
444                 {
445                         info("     ! Skipping due to different family in ipset");
446                         return;
447                 }
448
449                 if (!fw3_check_ipset(rule->ipset.ptr))
450                 {
451                         info("     ! Skipping due to missing ipset '%s'",
452                              rule->ipset.ptr->external
453                                         ? rule->ipset.ptr->external : rule->ipset.ptr->name);
454                         return;
455                 }
456
457                 set(rule->ipset.ptr->flags, handle->family, handle->family);
458         }
459
460         list_for_each_entry(proto, &rule->proto, list)
461         {
462                 /* icmp / ipv6-icmp */
463                 if (proto->protocol == 1 || proto->protocol == 58)
464                 {
465                         sports = &empty;
466                         dports = &empty;
467                         icmptypes = &rule->icmp_type;
468                 }
469                 else
470                 {
471                         sports = &rule->port_src;
472                         dports = &rule->port_dest;
473                         icmptypes = &empty;
474                 }
475
476                 fw3_foreach(sip, &rule->ip_src)
477                 fw3_foreach(dip, &rule->ip_dest)
478                 fw3_foreach(sport, sports)
479                 fw3_foreach(dport, dports)
480                 fw3_foreach(mac, &rule->mac_src)
481                 fw3_foreach(icmptype, icmptypes)
482                         print_rule(handle, state, rule, num, proto, sip, dip,
483                                    sport, dport, mac, icmptype);
484         }
485 }
486
487 void
488 fw3_print_rules(struct fw3_ipt_handle *handle, struct fw3_state *state)
489 {
490         int num = 0;
491         struct fw3_rule *rule;
492
493         list_for_each_entry(rule, &state->rules, list)
494                 expand_rule(handle, state, rule, num++);
495 }