rules.c

   1 /*
   2  * firewall3 - 3rd OpenWrt UCI firewall implementation
   3  *
   4  *   Copyright (C) 2013-2018 Jo-Philipp Wich <jo@mein.io>
   5  *
   6  * Permission to use, copy, modify, and/or distribute this software for any
   7  * purpose with or without fee is hereby granted, provided that the above
   8  * copyright notice and this permission notice appear in all copies.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17  */
  18
  19 #include "rules.h"
  20
  21
  22 const struct fw3_option fw3_rule_opts[] = {
  23         FW3_OPT("enabled",             bool,      rule,     enabled),
  24
  25         FW3_OPT("name",                string,    rule,     name),
  26         FW3_OPT("family",              family,    rule,     family),
  27
  28         FW3_OPT("src",                 device,    rule,     src),
  29         FW3_OPT("dest",                device,    rule,     dest),
  30
  31         FW3_OPT("device",              string,    rule,     device),
  32         FW3_OPT("direction",           direction, rule,     direction_out),
  33
  34         FW3_OPT("ipset",               setmatch,  rule,     ipset),
  35         FW3_OPT("helper",              cthelper,  rule,     helper),
  36         FW3_OPT("set_helper",          cthelper,  rule,     set_helper),
  37
  38         FW3_LIST("proto",              protocol,  rule,     proto),
  39
  40         FW3_LIST("src_ip",             network,   rule,     ip_src),
  41         FW3_LIST("src_mac",            mac,       rule,     mac_src),
  42         FW3_LIST("src_port",           port,      rule,     port_src),
  43
  44         FW3_LIST("dest_ip",            network,   rule,     ip_dest),
  45         FW3_LIST("dest_port",          port,      rule,     port_dest),
  46
  47         FW3_LIST("icmp_type",          icmptype,  rule,     icmp_type),
  48         FW3_OPT("extra",               string,    rule,     extra),
  49
  50         FW3_OPT("limit",               limit,     rule,     limit),
  51         FW3_OPT("limit_burst",         int,       rule,     limit.burst),
  52
  53         FW3_OPT("utc_time",            bool,      rule,     time.utc),
  54         FW3_OPT("start_date",          date,      rule,     time.datestart),
  55         FW3_OPT("stop_date",           date,      rule,     time.datestop),
  56         FW3_OPT("start_time",          time,      rule,     time.timestart),
  57         FW3_OPT("stop_time",           time,      rule,     time.timestop),
  58         FW3_OPT("weekdays",            weekdays,  rule,     time.weekdays),
  59         FW3_OPT("monthdays",           monthdays, rule,     time.monthdays),
  60
  61         FW3_OPT("mark",                mark,      rule,     mark),
  62         FW3_OPT("set_mark",            mark,      rule,     set_mark),
  63         FW3_OPT("set_xmark",           mark,      rule,     set_xmark),
  64
  65         FW3_OPT("target",              target,    rule,     target),
  66
  67         { }
  68 };
  69
  70
  71 static bool
  72 need_src_action_chain(struct fw3_rule *r)
  73 {
  74         return (r->_src && r->_src->log && (r->target > FW3_FLAG_ACCEPT));
  75 }
  76
  77 static struct fw3_rule*
  78 alloc_rule(struct fw3_state *state)
  79 {
  80         struct fw3_rule *rule = calloc(1, sizeof(*rule));
  81
  82         if (rule) {
  83                 INIT_LIST_HEAD(&rule->proto);
  84
  85                 INIT_LIST_HEAD(&rule->ip_src);
  86                 INIT_LIST_HEAD(&rule->mac_src);
  87                 INIT_LIST_HEAD(&rule->port_src);
  88
  89                 INIT_LIST_HEAD(&rule->ip_dest);
  90                 INIT_LIST_HEAD(&rule->port_dest);
  91
  92                 INIT_LIST_HEAD(&rule->icmp_type);
  93
  94                 list_add_tail(&rule->list, &state->rules);
  95                 rule->enabled = true;
  96         }
  97
  98         return rule;
  99 }
 100
 101 static bool
 102 check_rule(struct fw3_state *state, struct fw3_rule *r, struct uci_element *e)
 103 {
 104         if (!r->enabled)
 105                 return false;
 106
 107         if (r->src.invert || r->dest.invert)
 108         {
 109                 warn_section("rule", r, e, "must not have inverted 'src' or 'dest' options");
 110                 return false;
 111         }
 112         else if (r->src.set && !r->src.any &&
 113                  !(r->_src = fw3_lookup_zone(state, r->src.name)))
 114         {
 115                 warn_section("rule", r, e, "refers to not existing zone '%s'", r->src.name);
 116                 return false;
 117         }
 118         else if (r->dest.set && !r->dest.any &&
 119                  !(r->_dest = fw3_lookup_zone(state, r->dest.name)))
 120         {
 121                 warn_section("rule", r, e, "refers to not existing zone '%s'", r->dest.name);
 122                 return false;
 123         }
 124         else if (r->ipset.set && state->disable_ipsets)
 125         {
 126                 warn_section("rule", r, e, "skipped due to disabled ipset support");
 127                 return false;
 128         }
 129         else if (r->ipset.set &&
 130                  !(r->ipset.ptr = fw3_lookup_ipset(state, r->ipset.name)))
 131         {
 132                 warn_section("rule", r, e, "refers to unknown ipset '%s'", r->ipset.name);
 133                 return false;
 134         }
 135         else if (r->helper.set &&
 136                  !(r->helper.ptr = fw3_lookup_cthelper(state, r->helper.name)))
 137         {
 138                 warn_section("rule", r, e, "refers to unknown CT helper '%s'", r->helper.name);
 139                 return false;
 140         }
 141         else if (r->set_helper.set &&
 142                  !(r->set_helper.ptr = fw3_lookup_cthelper(state, r->set_helper.name)))
 143         {
 144                 warn_section("rule", r, e, "refers to unknown CT helper '%s'", r->set_helper.name);
 145                 return false;
 146         }
 147
 148         if (!r->_src && (r->target == FW3_FLAG_NOTRACK || r->target == FW3_FLAG_HELPER))
 149         {
 150                 warn_section("rule", r, e, "is set to target %s but has no source assigned",
 151                              fw3_flag_names[r->target]);
 152                 return false;
 153         }
 154
 155         if (!r->set_mark.set && !r->set_xmark.set &&
 156             r->target == FW3_FLAG_MARK)
 157         {
 158                 warn_section("rule", r, e, "is set to target MARK but specifies neither "
 159                                 "'set_mark' nor 'set_xmark' option");
 160                 return false;
 161         }
 162
 163         if (r->_dest && r->target == FW3_FLAG_MARK)
 164         {
 165                 warn_section("rule", r, e, "must not specify 'dest' for MARK target");
 166                 return false;
 167         }
 168
 169         if (r->set_mark.invert || r->set_xmark.invert)
 170         {
 171                 warn_section("rule", r, e, "must not have inverted 'set_mark' or 'set_xmark'");
 172                 return false;
 173         }
 174
 175         if (!r->set_helper.set && r->target == FW3_FLAG_HELPER)
 176         {
 177                 warn_section("rule", r, e, "is set to target HELPER but specifies "
 178                                            "no 'set_helper' option");
 179                 return false;
 180         }
 181
 182         if (r->set_helper.invert && r->target == FW3_FLAG_HELPER)
 183         {
 184                 warn_section("rule", r, e, "must not have inverted 'set_helper' option");
 185                 return false;
 186         }
 187
 188         if (!r->_src && !r->_dest && !r->src.any && !r->dest.any)
 189         {
 190                 warn_section("rule", r, e, "has neither a source nor a destination zone assigned "
 191                                 "- assuming an output r");
 192         }
 193
 194         if (list_empty(&r->proto))
 195         {
 196                 warn_section("rule", r, e, "does not specify a protocol, assuming TCP+UDP");
 197                 fw3_parse_protocol(&r->proto, "tcpudp", true);
 198         }
 199
 200         if (r->target == FW3_FLAG_UNSPEC)
 201         {
 202                 warn_section("rule", r, e, "has no target specified, defaulting to REJECT");
 203                 r->target = FW3_FLAG_REJECT;
 204         }
 205         else if (r->target > FW3_FLAG_MARK)
 206         {
 207                 warn_section("rule", r, e, "has invalid target specified, defaulting to REJECT");
 208                 r->target = FW3_FLAG_REJECT;
 209         }
 210
 211         /* NB: r family... */
 212         if (r->_dest)
 213         {
 214                 fw3_setbit(r->_dest->flags[0], r->target);
 215                 fw3_setbit(r->_dest->flags[1], r->target);
 216         }
 217         else if (need_src_action_chain(r))
 218         {
 219                 fw3_setbit(r->_src->flags[0], fw3_to_src_target(r->target));
 220                 fw3_setbit(r->_src->flags[1], fw3_to_src_target(r->target));
 221         }
 222
 223         return true;
 224 }
 225
 226 void
 227 fw3_load_rules(struct fw3_state *state, struct uci_package *p,
 228                 struct blob_attr *a)
 229 {
 230         struct uci_section *s;
 231         struct uci_element *e;
 232         struct fw3_rule *rule;
 233         struct blob_attr *entry;
 234         unsigned rem;
 235
 236         INIT_LIST_HEAD(&state->rules);
 237
 238         blob_for_each_attr(entry, a, rem) {
 239                 const char *type;
 240                 const char *name = "ubus rule";
 241
 242                 if (!fw3_attr_parse_name_type(entry, &name, &type))
 243                         continue;
 244
 245                 if (strcmp(type, "rule"))
 246                         continue;
 247
 248                 if (!(rule = alloc_rule(state)))
 249                         continue;
 250
 251                 if (!fw3_parse_blob_options(rule, fw3_rule_opts, entry, name))
 252                 {
 253                         warn_section("rule", rule, NULL, "skipped due to invalid options");
 254                         fw3_free_rule(rule);
 255                         continue;
 256                 }
 257
 258                 if (!check_rule(state, rule, NULL))
 259                         fw3_free_rule(rule);
 260         }
 261
 262         uci_foreach_element(&p->sections, e)
 263         {
 264                 s = uci_to_section(e);
 265
 266                 if (strcmp(s->type, "rule"))
 267                         continue;
 268
 269                 if (!(rule = alloc_rule(state)))
 270                         continue;
 271
 272                 if (!fw3_parse_options(rule, fw3_rule_opts, s))
 273                 {
 274                         warn_elem(e, "skipped due to invalid options");
 275                         fw3_free_rule(rule);
 276                         continue;
 277                 }
 278
 279                 if (!check_rule(state, rule, e))
 280                         fw3_free_rule(rule);
 281         }
 282 }
 283
 284
 285 static void
 286 append_chain(struct fw3_ipt_rule *r, struct fw3_rule *rule)
 287 {
 288         char chain[32];
 289
 290         snprintf(chain, sizeof(chain), "OUTPUT");
 291
 292         if (rule->target == FW3_FLAG_NOTRACK)
 293         {
 294                 snprintf(chain, sizeof(chain), "zone_%s_notrack", rule->src.name);
 295         }
 296         else if (rule->target == FW3_FLAG_HELPER)
 297         {
 298                 snprintf(chain, sizeof(chain), "zone_%s_helper", rule->src.name);
 299         }
 300         else if (rule->target == FW3_FLAG_MARK && (rule->_src || rule->src.any))
 301         {
 302                 snprintf(chain, sizeof(chain), "PREROUTING");
 303         }
 304         else
 305         {
 306                 if (rule->src.set)
 307                 {
 308                         if (!rule->src.any)
 309                         {
 310                                 if (rule->dest.set)
 311                                         snprintf(chain, sizeof(chain), "zone_%s_forward",
 312                                                  rule->src.name);
 313                                 else
 314                                         snprintf(chain, sizeof(chain), "zone_%s_input",
 315                                                  rule->src.name);
 316                         }
 317                         else
 318                         {
 319                                 if (rule->dest.set)
 320                                         snprintf(chain, sizeof(chain), "FORWARD");
 321                                 else
 322                                         snprintf(chain, sizeof(chain), "INPUT");
 323                         }
 324                 }
 325
 326                 if (rule->dest.set && !rule->src.set)
 327                 {
 328                         if (rule->dest.any)
 329                                 snprintf(chain, sizeof(chain), "OUTPUT");
 330                         else
 331                                 snprintf(chain, sizeof(chain), "zone_%s_output",
 332                                          rule->dest.name);
 333                 }
 334         }
 335
 336         fw3_ipt_rule_append(r, chain);
 337 }
 338
 339 static void set_target(struct fw3_ipt_rule *r, struct fw3_rule *rule)
 340 {
 341         const char *name;
 342         struct fw3_mark *mark;
 343         char buf[sizeof("0xFFFFFFFF/0xFFFFFFFF\0")];
 344
 345         switch(rule->target)
 346         {
 347         case FW3_FLAG_MARK:
 348                 name = rule->set_mark.set ? "--set-mark" : "--set-xmark";
 349                 mark = rule->set_mark.set ? &rule->set_mark : &rule->set_xmark;
 350                 sprintf(buf, "0x%x/0x%x", mark->mark, mark->mask);
 351
 352                 fw3_ipt_rule_target(r, "MARK");
 353                 fw3_ipt_rule_addarg(r, false, name, buf);
 354                 return;
 355
 356         case FW3_FLAG_NOTRACK:
 357                 fw3_ipt_rule_target(r, "CT");
 358                 fw3_ipt_rule_addarg(r, false, "--notrack", NULL);
 359                 return;
 360
 361         case FW3_FLAG_HELPER:
 362                 fw3_ipt_rule_target(r, "CT");
 363                 fw3_ipt_rule_addarg(r, false, "--helper", rule->set_helper.ptr->name);
 364                 return;
 365
 366         case FW3_FLAG_ACCEPT:
 367         case FW3_FLAG_DROP:
 368                 name = fw3_flag_names[rule->target];
 369                 break;
 370
 371         default:
 372                 name = fw3_flag_names[FW3_FLAG_REJECT];
 373                 break;
 374         }
 375
 376         if (rule->dest.set && !rule->dest.any)
 377                 fw3_ipt_rule_target(r, "zone_%s_dest_%s", rule->dest.name, name);
 378         else if (need_src_action_chain(rule))
 379                 fw3_ipt_rule_target(r, "zone_%s_src_%s", rule->src.name, name);
 380         else if (strcmp(name, "REJECT"))
 381                 fw3_ipt_rule_target(r, name);
 382         else
 383                 fw3_ipt_rule_target(r, "reject");
 384 }
 385
 386 static void
 387 set_comment(struct fw3_ipt_rule *r, const char *name, int num)
 388 {
 389         if (name)
 390                 fw3_ipt_rule_comment(r, name);
 391         else
 392                 fw3_ipt_rule_comment(r, "@rule[%u]", num);
 393 }
 394
 395 static void
 396 print_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
 397            struct fw3_rule *rule, int num, struct fw3_protocol *proto,
 398            struct fw3_address *sip, struct fw3_address *dip,
 399            struct fw3_port *sport, struct fw3_port *dport,
 400            struct fw3_mac *mac, struct fw3_icmptype *icmptype)
 401 {
 402         struct fw3_ipt_rule *r;
 403
 404         if (!fw3_is_family(sip, handle->family) ||
 405             !fw3_is_family(dip, handle->family))
 406         {
 407                 if ((sip && !sip->resolved) || (dip && !dip->resolved))
 408                         info("     ! Skipping due to different family of ip address");
 409
 410                 return;
 411         }
 412
 413         if (!fw3_is_family(sip, handle->family) ||
 414             !fw3_is_family(dip, handle->family))
 415         {
 416                 if ((sip && !sip->resolved) || (dip && !dip->resolved))
 417                         info("     ! Skipping due to different family of ip address");
 418
 419                 return;
 420         }
 421
 422         if (!fw3_is_family(sip, handle->family) ||
 423             !fw3_is_family(dip, handle->family))
 424         {
 425                 if ((sip && !sip->resolved) || (dip && !dip->resolved))
 426                         info("     ! Skipping due to different family of ip address");
 427
 428                 return;
 429         }
 430
 431         if (proto->protocol == 58 && handle->family == FW3_FAMILY_V4)
 432         {
 433                 info("     ! Skipping protocol %s due to different family",
 434                      fw3_protoname(proto));
 435                 return;
 436         }
 437
 438         if (rule->helper.ptr &&
 439             !fw3_cthelper_check_proto(rule->helper.ptr, proto))
 440         {
 441                 info("     ! Skipping protocol %s since helper '%s' does not support it",
 442                      fw3_protoname(proto), rule->helper.ptr->name);
 443                 return;
 444         }
 445
 446         if (rule->set_helper.ptr &&
 447             !fw3_cthelper_check_proto(rule->set_helper.ptr, proto))
 448         {
 449                 info("     ! Skipping protocol %s since helper '%s' does not support it",
 450                      fw3_protoname(proto), rule->helper.ptr->name);
 451                 return;
 452         }
 453
 454         r = fw3_ipt_rule_create(handle, proto, NULL, NULL, sip, dip);
 455         fw3_ipt_rule_sport_dport(r, sport, dport);
 456         fw3_ipt_rule_device(r, rule->device, rule->direction_out);
 457         fw3_ipt_rule_icmptype(r, icmptype);
 458         fw3_ipt_rule_mac(r, mac);
 459         fw3_ipt_rule_ipset(r, &rule->ipset);
 460         fw3_ipt_rule_helper(r, &rule->helper);
 461         fw3_ipt_rule_limit(r, &rule->limit);
 462         fw3_ipt_rule_time(r, &rule->time);
 463         fw3_ipt_rule_mark(r, &rule->mark);
 464         set_target(r, rule);
 465         fw3_ipt_rule_extra(r, rule->extra);
 466         set_comment(r, rule->name, num);
 467         append_chain(r, rule);
 468 }
 469
 470 static void
 471 expand_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
 472             struct fw3_rule *rule, int num)
 473 {
 474         struct fw3_protocol *proto;
 475         struct fw3_address *sip;
 476         struct fw3_address *dip;
 477         struct fw3_port *sport;
 478         struct fw3_port *dport;
 479         struct fw3_mac *mac;
 480         struct fw3_icmptype *icmptype;
 481
 482         struct list_head *sports = NULL;
 483         struct list_head *dports = NULL;
 484         struct list_head *icmptypes = NULL;
 485
 486         struct list_head empty;
 487         INIT_LIST_HEAD(&empty);
 488
 489         if (!fw3_is_family(rule, handle->family))
 490                 return;
 491
 492         if ((rule->target == FW3_FLAG_NOTRACK && handle->table != FW3_TABLE_RAW) ||
 493             (rule->target == FW3_FLAG_HELPER && handle->table != FW3_TABLE_RAW)  ||
 494             (rule->target == FW3_FLAG_MARK && handle->table != FW3_TABLE_MANGLE) ||
 495                 (rule->target < FW3_FLAG_NOTRACK && handle->table != FW3_TABLE_FILTER))
 496                 return;
 497
 498         if (rule->name)
 499                 info("   * Rule '%s'", rule->name);
 500         else
 501                 info("   * Rule #%u", num);
 502
 503         if (!fw3_is_family(rule->_src, handle->family) ||
 504             !fw3_is_family(rule->_dest, handle->family))
 505         {
 506                 info("     ! Skipping due to different family of zone");
 507                 return;
 508         }
 509
 510         if (rule->ipset.ptr)
 511         {
 512                 if (!fw3_is_family(rule->ipset.ptr, handle->family))
 513                 {
 514                         info("     ! Skipping due to different family in ipset");
 515                         return;
 516                 }
 517
 518                 if (!fw3_check_ipset(rule->ipset.ptr))
 519                 {
 520                         info("     ! Skipping due to missing ipset '%s'",
 521                              rule->ipset.ptr->external
 522                                         ? rule->ipset.ptr->external : rule->ipset.ptr->name);
 523                         return;
 524                 }
 525
 526                 set(rule->ipset.ptr->flags, handle->family, handle->family);
 527         }
 528
 529         if (rule->helper.ptr && !fw3_is_family(rule->helper.ptr, handle->family))
 530         {
 531                 info("     ! Skipping due to unsupported family of CT helper");
 532                 return;
 533         }
 534
 535         if (rule->set_helper.ptr && !fw3_is_family(rule->set_helper.ptr, handle->family))
 536         {
 537                 info("     ! Skipping due to unsupported family of CT helper");
 538                 return;
 539         }
 540
 541         list_for_each_entry(proto, &rule->proto, list)
 542         {
 543                 /* icmp / ipv6-icmp */
 544                 if (proto->protocol == 1 || proto->protocol == 58)
 545                 {
 546                         sports = &empty;
 547                         dports = &empty;
 548                         icmptypes = &rule->icmp_type;
 549                 }
 550                 else
 551                 {
 552                         sports = &rule->port_src;
 553                         dports = &rule->port_dest;
 554                         icmptypes = &empty;
 555                 }
 556
 557                 fw3_foreach(sip, &rule->ip_src)
 558                 fw3_foreach(dip, &rule->ip_dest)
 559                 fw3_foreach(sport, sports)
 560                 fw3_foreach(dport, dports)
 561                 fw3_foreach(mac, &rule->mac_src)
 562                 fw3_foreach(icmptype, icmptypes)
 563                         print_rule(handle, state, rule, num, proto, sip, dip,
 564                                    sport, dport, mac, icmptype);
 565         }
 566 }
 567
 568 void
 569 fw3_print_rules(struct fw3_ipt_handle *handle, struct fw3_state *state)
 570 {
 571         int num = 0;
 572         struct fw3_rule *rule;
 573
 574         list_for_each_entry(rule, &state->rules, list)
 575                 expand_rule(handle, state, rule, num++);
 576 }