Fix output rules with "option dest *"
[project/firewall3.git] / rules.c
1 /*
2  * firewall3 - 3rd OpenWrt UCI firewall implementation
3  *
4  *   Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
5  *
6  * Permission to use, copy, modify, and/or distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18
19 #include "rules.h"
20
21
22 const struct fw3_option fw3_rule_opts[] = {
23         FW3_OPT("enabled",             bool,      rule,     enabled),
24
25         FW3_OPT("name",                string,    rule,     name),
26         FW3_OPT("family",              family,    rule,     family),
27
28         FW3_OPT("src",                 device,    rule,     src),
29         FW3_OPT("dest",                device,    rule,     dest),
30
31         FW3_OPT("ipset",               device,    rule,     ipset),
32
33         FW3_LIST("proto",              protocol,  rule,     proto),
34
35         FW3_LIST("src_ip",             network,   rule,     ip_src),
36         FW3_LIST("src_mac",            mac,       rule,     mac_src),
37         FW3_LIST("src_port",           port,      rule,     port_src),
38
39         FW3_LIST("dest_ip",            network,   rule,     ip_dest),
40         FW3_LIST("dest_port",          port,      rule,     port_dest),
41
42         FW3_LIST("icmp_type",          icmptype,  rule,     icmp_type),
43         FW3_OPT("extra",               string,    rule,     extra),
44
45         FW3_OPT("limit",               limit,     rule,     limit),
46         FW3_OPT("limit_burst",         int,       rule,     limit.burst),
47
48         FW3_OPT("utc_time",            bool,      rule,     time.utc),
49         FW3_OPT("start_date",          date,      rule,     time.datestart),
50         FW3_OPT("stop_date",           date,      rule,     time.datestop),
51         FW3_OPT("start_time",          time,      rule,     time.timestart),
52         FW3_OPT("stop_time",           time,      rule,     time.timestop),
53         FW3_OPT("weekdays",            weekdays,  rule,     time.weekdays),
54         FW3_OPT("monthdays",           monthdays, rule,     time.monthdays),
55
56         FW3_OPT("mark",                mark,      rule,     mark),
57         FW3_OPT("set_mark",            mark,      rule,     set_mark),
58         FW3_OPT("set_xmark",           mark,      rule,     set_xmark),
59
60         FW3_OPT("target",              target,    rule,     target),
61
62         { }
63 };
64
65
66 void
67 fw3_load_rules(struct fw3_state *state, struct uci_package *p)
68 {
69         struct uci_section *s;
70         struct uci_element *e;
71         struct fw3_rule *rule;
72
73         INIT_LIST_HEAD(&state->rules);
74
75         uci_foreach_element(&p->sections, e)
76         {
77                 s = uci_to_section(e);
78
79                 if (strcmp(s->type, "rule"))
80                         continue;
81
82                 rule = malloc(sizeof(*rule));
83
84                 if (!rule)
85                         continue;
86
87                 memset(rule, 0, sizeof(*rule));
88
89                 INIT_LIST_HEAD(&rule->proto);
90
91                 INIT_LIST_HEAD(&rule->ip_src);
92                 INIT_LIST_HEAD(&rule->mac_src);
93                 INIT_LIST_HEAD(&rule->port_src);
94
95                 INIT_LIST_HEAD(&rule->ip_dest);
96                 INIT_LIST_HEAD(&rule->port_dest);
97
98                 INIT_LIST_HEAD(&rule->icmp_type);
99
100                 rule->enabled = true;
101
102                 fw3_parse_options(rule, fw3_rule_opts, s);
103
104                 if (!rule->enabled)
105                 {
106                         fw3_free_rule(rule);
107                         continue;
108                 }
109
110                 if (rule->src.invert || rule->dest.invert)
111                 {
112                         warn_elem(e, "must not have inverted 'src' or 'dest' options");
113                         fw3_free_rule(rule);
114                         continue;
115                 }
116                 else if (rule->src.set && !rule->src.any &&
117                          !(rule->_src = fw3_lookup_zone(state, rule->src.name)))
118                 {
119                         warn_elem(e, "refers to not existing zone '%s'", rule->src.name);
120                         fw3_free_rule(rule);
121                         continue;
122                 }
123                 else if (rule->dest.set && !rule->dest.any &&
124                          !(rule->_dest = fw3_lookup_zone(state, rule->dest.name)))
125                 {
126                         warn_elem(e, "refers to not existing zone '%s'", rule->dest.name);
127                         fw3_free_rule(rule);
128                         continue;
129                 }
130                 else if (rule->ipset.set && state->disable_ipsets)
131                 {
132                         warn_elem(e, "skipped due to disabled ipset support");
133                         fw3_free_rule(rule);
134                         continue;
135                 }
136                 else if (rule->ipset.set && !rule->ipset.any &&
137                          !(rule->_ipset = fw3_lookup_ipset(state, rule->ipset.name)))
138                 {
139                         warn_elem(e, "refers to unknown ipset '%s'", rule->ipset.name);
140                         fw3_free_rule(rule);
141                         continue;
142                 }
143
144                 if (!rule->_src && rule->target == FW3_FLAG_NOTRACK)
145                 {
146                         warn_elem(e, "is set to target NOTRACK but has no source assigned");
147                         fw3_free_rule(rule);
148                         continue;
149                 }
150
151                 if (!rule->set_mark.set && !rule->set_xmark.set &&
152                     rule->target == FW3_FLAG_MARK)
153                 {
154                         warn_elem(e, "is set to target MARK but specifies neither "
155                                      "'set_mark' nor 'set_xmark' option");
156                         fw3_free_rule(rule);
157                         continue;
158                 }
159
160                 if (rule->_dest && rule->target == FW3_FLAG_MARK)
161                 {
162                         warn_elem(e, "must not specify 'dest' for MARK target");
163                         fw3_free_rule(rule);
164                         continue;
165                 }
166
167                 if (rule->set_mark.invert || rule->set_xmark.invert)
168                 {
169                         warn_elem(e, "must not have inverted 'set_mark' or 'set_xmark'");
170                         fw3_free_rule(rule);
171                         continue;
172                 }
173
174                 if (!rule->_src && !rule->_dest && !rule->src.any && !rule->dest.any)
175                 {
176                         warn_elem(e, "has neither a source nor a destination zone assigned "
177                                      "- assuming an output rule");
178                 }
179
180                 if (list_empty(&rule->proto))
181                 {
182                         warn_elem(e, "does not specify a protocol, assuming TCP+UDP");
183                         fw3_parse_protocol(&rule->proto, "tcpudp", true);
184                 }
185
186                 if (rule->target == FW3_FLAG_UNSPEC)
187                 {
188                         warn_elem(e, "has no target specified, defaulting to REJECT");
189                         rule->target = FW3_FLAG_REJECT;
190                 }
191                 else if (rule->target > FW3_FLAG_MARK)
192                 {
193                         warn_elem(e, "has invalid target specified, defaulting to REJECT");
194                         rule->target = FW3_FLAG_REJECT;
195                 }
196
197                 /* NB: rule family... */
198                 if (rule->_dest)
199                 {
200                         setbit(rule->_dest->flags[0], rule->target);
201                         setbit(rule->_dest->flags[1], rule->target);
202                 }
203
204                 list_add_tail(&rule->list, &state->rules);
205                 continue;
206         }
207 }
208
209
210 static void
211 append_chain(struct fw3_ipt_rule *r, struct fw3_rule *rule)
212 {
213         char chain[32];
214
215         snprintf(chain, sizeof(chain), "delegate_output");
216
217         if (rule->target == FW3_FLAG_NOTRACK)
218         {
219                 snprintf(chain, sizeof(chain), "zone_%s_notrack", rule->src.name);
220         }
221         else if (rule->target == FW3_FLAG_MARK)
222         {
223                 snprintf(chain, sizeof(chain), "fwmark");
224         }
225         else
226         {
227                 if (rule->src.set)
228                 {
229                         if (!rule->src.any)
230                         {
231                                 if (rule->dest.set)
232                                         snprintf(chain, sizeof(chain), "zone_%s_forward",
233                                                  rule->src.name);
234                                 else
235                                         snprintf(chain, sizeof(chain), "zone_%s_input",
236                                                  rule->src.name);
237                         }
238                         else
239                         {
240                                 if (rule->dest.set)
241                                         snprintf(chain, sizeof(chain), "delegate_forward");
242                                 else
243                                         snprintf(chain, sizeof(chain), "delegate_input");
244                         }
245                 }
246
247                 if (rule->dest.set && !rule->src.set)
248                 {
249                         if (rule->dest.any)
250                                 snprintf(chain, sizeof(chain), "delegate_output");
251                         else
252                                 snprintf(chain, sizeof(chain), "zone_%s_output",
253                                          rule->dest.name);
254                 }
255         }
256
257         fw3_ipt_rule_append(r, chain);
258 }
259
260 static void set_target(struct fw3_ipt_rule *r, struct fw3_rule *rule)
261 {
262         const char *name;
263         struct fw3_mark *mark;
264         char buf[sizeof("0xFFFFFFFF/0xFFFFFFFF\0")];
265
266         switch(rule->target)
267         {
268         case FW3_FLAG_MARK:
269                 name = rule->set_mark.set ? "--set-mark" : "--set-xmark";
270                 mark = rule->set_mark.set ? &rule->set_mark : &rule->set_xmark;
271                 sprintf(buf, "0x%x/0x%x", mark->mark, mark->mask);
272
273                 fw3_ipt_rule_target(r, "MARK");
274                 fw3_ipt_rule_addarg(r, false, name, buf);
275                 return;
276
277         case FW3_FLAG_ACCEPT:
278         case FW3_FLAG_DROP:
279         case FW3_FLAG_NOTRACK:
280                 name = fw3_flag_names[rule->target];
281                 break;
282
283         default:
284                 name = fw3_flag_names[FW3_FLAG_REJECT];
285                 break;
286         }
287
288         if (rule->dest.set && !rule->dest.any)
289                 fw3_ipt_rule_target(r, "zone_%s_dest_%s", rule->dest.name, name);
290         else if (rule->target == FW3_FLAG_REJECT)
291                 fw3_ipt_rule_target(r, "reject");
292         else
293                 fw3_ipt_rule_target(r, name);
294 }
295
296 static void
297 set_comment(struct fw3_ipt_rule *r, const char *name, int num)
298 {
299         if (name)
300                 fw3_ipt_rule_comment(r, name);
301         else
302                 fw3_ipt_rule_comment(r, "@rule[%u]", num);
303 }
304
305 static void
306 print_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
307            struct fw3_rule *rule, int num, struct fw3_protocol *proto,
308            struct fw3_address *sip, struct fw3_address *dip,
309            struct fw3_port *sport, struct fw3_port *dport,
310            struct fw3_mac *mac, struct fw3_icmptype *icmptype)
311 {
312         struct fw3_ipt_rule *r;
313
314         if (!fw3_is_family(sip, handle->family) ||
315             !fw3_is_family(dip, handle->family))
316         {
317                 info("     ! Skipping due to different family of ip address");
318                 return;
319         }
320
321         if (proto->protocol == 58 && handle->family == FW3_FAMILY_V4)
322         {
323                 info("     ! Skipping due to different family of protocol");
324                 return;
325         }
326
327         r = fw3_ipt_rule_create(handle, proto, NULL, NULL, sip, dip);
328         fw3_ipt_rule_sport_dport(r, sport, dport);
329         fw3_ipt_rule_icmptype(r, icmptype);
330         fw3_ipt_rule_mac(r, mac);
331         fw3_ipt_rule_ipset(r, rule->_ipset, rule->ipset.invert);
332         fw3_ipt_rule_limit(r, &rule->limit);
333         fw3_ipt_rule_time(r, &rule->time);
334         fw3_ipt_rule_mark(r, &rule->mark);
335         set_target(r, rule);
336         fw3_ipt_rule_extra(r, rule->extra);
337         set_comment(r, rule->name, num);
338         append_chain(r, rule);
339 }
340
341 static void
342 expand_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
343             struct fw3_rule *rule, int num)
344 {
345         struct fw3_protocol *proto;
346         struct fw3_address *sip;
347         struct fw3_address *dip;
348         struct fw3_port *sport;
349         struct fw3_port *dport;
350         struct fw3_mac *mac;
351         struct fw3_icmptype *icmptype;
352
353         struct list_head *sports = NULL;
354         struct list_head *dports = NULL;
355         struct list_head *icmptypes = NULL;
356
357         struct list_head empty;
358         INIT_LIST_HEAD(&empty);
359
360         if (!fw3_is_family(rule, handle->family))
361                 return;
362
363         if ((rule->target == FW3_FLAG_NOTRACK && handle->table != FW3_TABLE_RAW) ||
364             (rule->target == FW3_FLAG_MARK && handle->table != FW3_TABLE_MANGLE) ||
365                 (rule->target < FW3_FLAG_NOTRACK && handle->table != FW3_TABLE_FILTER))
366                 return;
367
368         if (rule->name)
369                 info("   * Rule '%s'", rule->name);
370         else
371                 info("   * Rule #%u", num);
372
373         if (!fw3_is_family(rule->_src, handle->family) ||
374             !fw3_is_family(rule->_dest, handle->family))
375         {
376                 info("     ! Skipping due to different family of zone");
377                 return;
378         }
379
380         if (rule->_ipset)
381         {
382                 if (!fw3_is_family(rule->_ipset, handle->family))
383                 {
384                         info("     ! Skipping due to different family in ipset");
385                         return;
386                 }
387
388                 if (!fw3_check_ipset(rule->_ipset))
389                 {
390                         info("     ! Skipping due to missing ipset '%s'",
391                              rule->_ipset->external
392                                         ? rule->_ipset->external : rule->_ipset->name);
393                         return;
394                 }
395
396                 set(rule->_ipset->flags, handle->family, handle->family);
397         }
398
399         list_for_each_entry(proto, &rule->proto, list)
400         {
401                 /* icmp / ipv6-icmp */
402                 if (proto->protocol == 1 || proto->protocol == 58)
403                 {
404                         sports = &empty;
405                         dports = &empty;
406                         icmptypes = &rule->icmp_type;
407                 }
408                 else
409                 {
410                         sports = &rule->port_src;
411                         dports = &rule->port_dest;
412                         icmptypes = &empty;
413                 }
414
415                 fw3_foreach(sip, &rule->ip_src)
416                 fw3_foreach(dip, &rule->ip_dest)
417                 fw3_foreach(sport, sports)
418                 fw3_foreach(dport, dports)
419                 fw3_foreach(mac, &rule->mac_src)
420                 fw3_foreach(icmptype, icmptypes)
421                         print_rule(handle, state, rule, num, proto, sip, dip,
422                                    sport, dport, mac, icmptype);
423         }
424 }
425
426 void
427 fw3_print_rules(struct fw3_ipt_handle *handle, struct fw3_state *state)
428 {
429         int num = 0;
430         struct fw3_rule *rule;
431
432         list_for_each_entry(rule, &state->rules, list)
433                 expand_rule(handle, state, rule, num++);
434 }