2aa74738ebcddb23263bfb8f172b975030f3b7e4
[project/firewall3.git] / zones.c
1 /*
2  * firewall3 - 3rd OpenWrt UCI firewall implementation
3  *
4  *   Copyright (C) 2013 Jo-Philipp Wich <jo@mein.io>
5  *
6  * Permission to use, copy, modify, and/or distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18
19 #include "zones.h"
20 #include "ubus.h"
21
22
23 #define C(f, tbl, tgt, fmt) \
24         { FW3_FAMILY_##f, FW3_TABLE_##tbl, FW3_FLAG_##tgt, fmt }
25
26 static const struct fw3_chain_spec zone_chains[] = {
27         C(ANY, FILTER, UNSPEC,        "zone_%s_input"),
28         C(ANY, FILTER, UNSPEC,        "zone_%s_output"),
29         C(ANY, FILTER, UNSPEC,        "zone_%s_forward"),
30
31         C(ANY, FILTER, SRC_ACCEPT,    "zone_%s_src_ACCEPT"),
32         C(ANY, FILTER, SRC_REJECT,    "zone_%s_src_REJECT"),
33         C(ANY, FILTER, SRC_DROP,      "zone_%s_src_DROP"),
34
35         C(ANY, FILTER, ACCEPT,        "zone_%s_dest_ACCEPT"),
36         C(ANY, FILTER, REJECT,        "zone_%s_dest_REJECT"),
37         C(ANY, FILTER, DROP,          "zone_%s_dest_DROP"),
38
39         C(V4,  NAT,    SNAT,          "zone_%s_postrouting"),
40         C(V4,  NAT,    DNAT,          "zone_%s_prerouting"),
41
42         C(ANY, RAW,    NOTRACK,       "zone_%s_notrack"),
43
44         C(ANY, FILTER, CUSTOM_CHAINS, "input_%s_rule"),
45         C(ANY, FILTER, CUSTOM_CHAINS, "output_%s_rule"),
46         C(ANY, FILTER, CUSTOM_CHAINS, "forwarding_%s_rule"),
47
48         C(V4,  NAT,    CUSTOM_CHAINS, "prerouting_%s_rule"),
49         C(V4,  NAT,    CUSTOM_CHAINS, "postrouting_%s_rule"),
50
51         { }
52 };
53
54 const struct fw3_option fw3_zone_opts[] = {
55         FW3_OPT("enabled",             bool,     zone,     enabled),
56
57         FW3_OPT("name",                string,   zone,     name),
58         FW3_OPT("family",              family,   zone,     family),
59
60         FW3_LIST("network",            device,   zone,     networks),
61         FW3_LIST("device",             device,   zone,     devices),
62         FW3_LIST("subnet",             network,  zone,     subnets),
63
64         FW3_OPT("input",               target,   zone,     policy_input),
65         FW3_OPT("forward",             target,   zone,     policy_forward),
66         FW3_OPT("output",              target,   zone,     policy_output),
67
68         FW3_OPT("masq",                bool,     zone,     masq),
69         FW3_OPT("masq_allow_invalid",  bool,     zone,     masq_allow_invalid),
70         FW3_LIST("masq_src",           network,  zone,     masq_src),
71         FW3_LIST("masq_dest",          network,  zone,     masq_dest),
72
73         FW3_OPT("extra",               string,   zone,     extra_src),
74         FW3_OPT("extra_src",           string,   zone,     extra_src),
75         FW3_OPT("extra_dest",          string,   zone,     extra_dest),
76
77         FW3_OPT("mtu_fix",             bool,     zone,     mtu_fix),
78         FW3_OPT("custom_chains",       bool,     zone,     custom_chains),
79
80         FW3_OPT("log",                 bool,     zone,     log),
81         FW3_OPT("log_limit",           limit,    zone,     log_limit),
82
83         FW3_OPT("__flags_v4",          int,      zone,     flags[0]),
84         FW3_OPT("__flags_v6",          int,      zone,     flags[1]),
85
86         FW3_LIST("__addrs",            address,  zone,     old_addrs),
87
88         { }
89 };
90
91
92 static void
93 check_policy(struct uci_element *e, enum fw3_flag *pol, enum fw3_flag def,
94              const char *name)
95 {
96         if (*pol == FW3_FLAG_UNSPEC)
97         {
98                 warn_elem(e, "has no %s policy specified, using default", name);
99                 *pol = def;
100         }
101         else if (*pol > FW3_FLAG_DROP)
102         {
103                 warn_elem(e, "has invalid %s policy, using default", name);
104                 *pol = def;
105         }
106 }
107
108 static void
109 resolve_networks(struct uci_element *e, struct fw3_zone *zone)
110 {
111         struct fw3_device *net, *tmp;
112
113         list_for_each_entry(net, &zone->networks, list)
114         {
115                 tmp = fw3_ubus_device(net->name);
116
117                 if (!tmp)
118                 {
119                         warn_elem(e, "cannot resolve device of network '%s'", net->name);
120                         continue;
121                 }
122
123                 snprintf(tmp->network, sizeof(tmp->network), "%s", net->name);
124                 list_add_tail(&tmp->list, &zone->devices);
125         }
126 }
127
128 struct fw3_zone *
129 fw3_alloc_zone(void)
130 {
131         struct fw3_zone *zone;
132
133         zone = calloc(1, sizeof(*zone));
134         if (!zone)
135                 return NULL;
136
137         INIT_LIST_HEAD(&zone->networks);
138         INIT_LIST_HEAD(&zone->devices);
139         INIT_LIST_HEAD(&zone->subnets);
140         INIT_LIST_HEAD(&zone->masq_src);
141         INIT_LIST_HEAD(&zone->masq_dest);
142
143         INIT_LIST_HEAD(&zone->old_addrs);
144
145         zone->enabled = true;
146         zone->custom_chains = true;
147         zone->log_limit.rate = 10;
148
149         return zone;
150 }
151
152 void
153 fw3_load_zones(struct fw3_state *state, struct uci_package *p)
154 {
155         struct uci_section *s;
156         struct uci_element *e;
157         struct fw3_zone *zone;
158         struct fw3_defaults *defs = &state->defaults;
159
160         INIT_LIST_HEAD(&state->zones);
161
162         uci_foreach_element(&p->sections, e)
163         {
164                 s = uci_to_section(e);
165
166                 if (strcmp(s->type, "zone"))
167                         continue;
168
169                 zone = fw3_alloc_zone();
170
171                 if (!zone)
172                         continue;
173
174                 if (!fw3_parse_options(zone, fw3_zone_opts, s))
175                         warn_elem(e, "has invalid options");
176
177                 if (!zone->enabled)
178                 {
179                         fw3_free_zone(zone);
180                         continue;
181                 }
182
183                 if (!zone->extra_dest)
184                         zone->extra_dest = zone->extra_src;
185
186                 if (!defs->custom_chains && zone->custom_chains)
187                         zone->custom_chains = false;
188
189                 if (!zone->name || !*zone->name)
190                 {
191                         warn_elem(e, "has no name - ignoring");
192                         fw3_free_zone(zone);
193                         continue;
194                 }
195
196                 if (strlen(zone->name) > FW3_ZONE_MAXNAMELEN)
197                 {
198                         warn_elem(e, "must not have a name longer than %u characters",
199                                      FW3_ZONE_MAXNAMELEN);
200                         fw3_free_zone(zone);
201                         continue;
202                 }
203
204                 fw3_ubus_zone_devices(zone);
205
206                 if (list_empty(&zone->networks) && list_empty(&zone->devices) &&
207                     list_empty(&zone->subnets) && !zone->extra_src)
208                 {
209                         warn_elem(e, "has no device, network, subnet or extra options");
210                 }
211
212                 check_policy(e, &zone->policy_input, defs->policy_input, "input");
213                 check_policy(e, &zone->policy_output, defs->policy_output, "output");
214                 check_policy(e, &zone->policy_forward, defs->policy_forward, "forward");
215
216                 resolve_networks(e, zone);
217
218                 if (zone->masq)
219                 {
220                         fw3_setbit(zone->flags[0], FW3_FLAG_SNAT);
221                 }
222
223                 if (zone->custom_chains)
224                 {
225                         fw3_setbit(zone->flags[0], FW3_FLAG_SNAT);
226                         fw3_setbit(zone->flags[0], FW3_FLAG_DNAT);
227                 }
228
229                 fw3_setbit(zone->flags[0], fw3_to_src_target(zone->policy_input));
230                 fw3_setbit(zone->flags[0], zone->policy_forward);
231                 fw3_setbit(zone->flags[0], zone->policy_output);
232
233                 fw3_setbit(zone->flags[1], fw3_to_src_target(zone->policy_input));
234                 fw3_setbit(zone->flags[1], zone->policy_forward);
235                 fw3_setbit(zone->flags[1], zone->policy_output);
236
237                 list_add_tail(&zone->list, &state->zones);
238         }
239 }
240
241
242 static void
243 print_zone_chain(struct fw3_ipt_handle *handle, struct fw3_state *state,
244                  bool reload, struct fw3_zone *zone)
245 {
246         int i;
247         struct fw3_ipt_rule *r;
248         const struct fw3_chain_spec *c;
249
250         const char *flt_chains[] = {
251                 "input",   "input",
252                 "output",  "output",
253                 "forward", "forwarding",
254         };
255
256         const char *nat_chains[] = {
257                 "prerouting",  "prerouting",
258                 "postrouting", "postrouting",
259         };
260
261         if (!fw3_is_family(zone, handle->family))
262                 return;
263
264         info("   * Zone '%s'", zone->name);
265
266         set(zone->flags, handle->family, handle->table);
267
268         if (zone->custom_chains)
269                 set(zone->flags, handle->family, FW3_FLAG_CUSTOM_CHAINS);
270
271         for (c = zone_chains; c->format; c++)
272         {
273                 /* don't touch user chains on selective stop */
274                 if (reload && c->flag == FW3_FLAG_CUSTOM_CHAINS)
275                         continue;
276
277                 if (!fw3_is_family(c, handle->family))
278                         continue;
279
280                 if (c->table != handle->table)
281                         continue;
282
283                 if (c->flag &&
284                     !fw3_hasbit(zone->flags[handle->family == FW3_FAMILY_V6], c->flag))
285                         continue;
286
287                 fw3_ipt_create_chain(handle, c->format, zone->name);
288         }
289
290         if (zone->custom_chains)
291         {
292                 if (handle->table == FW3_TABLE_FILTER)
293                 {
294                         for (i = 0; i < sizeof(flt_chains)/sizeof(flt_chains[0]); i += 2)
295                         {
296                                 r = fw3_ipt_rule_new(handle);
297                                 fw3_ipt_rule_comment(r, "user chain for %s", flt_chains[i+1]);
298                                 fw3_ipt_rule_target(r, "%s_%s_rule", flt_chains[i+1], zone->name);
299                                 fw3_ipt_rule_append(r, "zone_%s_%s", zone->name, flt_chains[i]);
300                         }
301                 }
302                 else if (handle->table == FW3_TABLE_NAT)
303                 {
304                         for (i = 0; i < sizeof(nat_chains)/sizeof(nat_chains[0]); i += 2)
305                         {
306                                 r = fw3_ipt_rule_new(handle);
307                                 fw3_ipt_rule_comment(r, "user chain for %s", nat_chains[i+1]);
308                                 fw3_ipt_rule_target(r, "%s_%s_rule", nat_chains[i+1], zone->name);
309                                 fw3_ipt_rule_append(r, "zone_%s_%s", zone->name, nat_chains[i]);
310                         }
311                 }
312         }
313
314         set(zone->flags, handle->family, handle->table);
315 }
316
317 static void
318 print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
319                                          bool reload, struct fw3_zone *zone,
320                      struct fw3_device *dev, struct fw3_address *sub)
321 {
322         struct fw3_protocol tcp = { .protocol = 6 };
323         struct fw3_ipt_rule *r;
324         enum fw3_flag t;
325
326         char buf[32];
327
328         int i;
329
330         const char *chains[] = {
331                 "input", "INPUT",
332                 "output", "OUTPUT",
333                 "forward", "FORWARD",
334         };
335
336 #define jump_target(t) \
337         ((t == FW3_FLAG_REJECT) ? "reject" : fw3_flag_names[t])
338
339         if (handle->table == FW3_TABLE_FILTER)
340         {
341                 for (t = FW3_FLAG_ACCEPT; t <= FW3_FLAG_DROP; t++)
342                 {
343                         if (has(zone->flags, handle->family, fw3_to_src_target(t)))
344                         {
345                                 r = fw3_ipt_rule_create(handle, NULL, dev, NULL, sub, NULL);
346                                 fw3_ipt_rule_target(r, jump_target(t));
347                                 fw3_ipt_rule_extra(r, zone->extra_src);
348
349                                 if (t == FW3_FLAG_ACCEPT && !state->defaults.drop_invalid)
350                                         fw3_ipt_rule_extra(r,
351                                                            "-m conntrack --ctstate NEW,UNTRACKED");
352
353                                 fw3_ipt_rule_replace(r, "zone_%s_src_%s", zone->name,
354                                                      fw3_flag_names[t]);
355                         }
356
357                         if (has(zone->flags, handle->family, t))
358                         {
359                                 if (t == FW3_FLAG_ACCEPT &&
360                                     zone->masq && !zone->masq_allow_invalid)
361                                 {
362                                         r = fw3_ipt_rule_create(handle, NULL, NULL, dev, NULL, sub);
363                                         fw3_ipt_rule_extra(r, "-m conntrack --ctstate INVALID");
364                                         fw3_ipt_rule_comment(r, "Prevent NAT leakage");
365                                         fw3_ipt_rule_target(r, fw3_flag_names[FW3_FLAG_DROP]);
366                                         fw3_ipt_rule_replace(r, "zone_%s_dest_%s", zone->name,
367                                                              fw3_flag_names[t]);
368                                 }
369
370                                 r = fw3_ipt_rule_create(handle, NULL, NULL, dev, NULL, sub);
371                                 fw3_ipt_rule_target(r, jump_target(t));
372                                 fw3_ipt_rule_extra(r, zone->extra_dest);
373                                 fw3_ipt_rule_replace(r, "zone_%s_dest_%s", zone->name,
374                                                      fw3_flag_names[t]);
375                         }
376                 }
377
378                 for (i = 0; i < sizeof(chains)/sizeof(chains[0]); i += 2)
379                 {
380                         if (*chains[i] == 'o')
381                                 r = fw3_ipt_rule_create(handle, NULL, NULL, dev, NULL, sub);
382                         else
383                                 r = fw3_ipt_rule_create(handle, NULL, dev, NULL, sub, NULL);
384
385                         fw3_ipt_rule_target(r, "zone_%s_%s", zone->name, chains[i]);
386
387                         if (*chains[i] == 'o')
388                                 fw3_ipt_rule_extra(r, zone->extra_dest);
389                         else
390                                 fw3_ipt_rule_extra(r, zone->extra_src);
391
392                         fw3_ipt_rule_replace(r, chains[i + 1]);
393                 }
394         }
395         else if (handle->table == FW3_TABLE_NAT)
396         {
397                 if (has(zone->flags, handle->family, FW3_FLAG_DNAT))
398                 {
399                         r = fw3_ipt_rule_create(handle, NULL, dev, NULL, sub, NULL);
400                         fw3_ipt_rule_target(r, "zone_%s_prerouting", zone->name);
401                         fw3_ipt_rule_extra(r, zone->extra_src);
402                         fw3_ipt_rule_replace(r, "PREROUTING");
403                 }
404
405                 if (has(zone->flags, handle->family, FW3_FLAG_SNAT))
406                 {
407                         r = fw3_ipt_rule_create(handle, NULL, NULL, dev, NULL, sub);
408                         fw3_ipt_rule_target(r, "zone_%s_postrouting", zone->name);
409                         fw3_ipt_rule_extra(r, zone->extra_dest);
410                         fw3_ipt_rule_replace(r, "POSTROUTING");
411                 }
412         }
413         else if (handle->table == FW3_TABLE_MANGLE)
414         {
415                 if (zone->mtu_fix)
416                 {
417                         if (zone->log)
418                         {
419                                 snprintf(buf, sizeof(buf) - 1, "MSSFIX(%s): ", zone->name);
420
421                                 r = fw3_ipt_rule_create(handle, &tcp, NULL, dev, NULL, sub);
422                                 fw3_ipt_rule_addarg(r, false, "--tcp-flags", "SYN,RST");
423                                 fw3_ipt_rule_addarg(r, false, "SYN", NULL);
424                                 fw3_ipt_rule_limit(r, &zone->log_limit);
425                                 fw3_ipt_rule_comment(r, "%s (mtu_fix logging)", zone->name);
426                                 fw3_ipt_rule_target(r, "LOG");
427                                 fw3_ipt_rule_addarg(r, false, "--log-prefix", buf);
428                                 fw3_ipt_rule_replace(r, "FORWARD");
429                         }
430
431                         r = fw3_ipt_rule_create(handle, &tcp, NULL, dev, NULL, sub);
432                         fw3_ipt_rule_addarg(r, false, "--tcp-flags", "SYN,RST");
433                         fw3_ipt_rule_addarg(r, false, "SYN", NULL);
434                         fw3_ipt_rule_comment(r, "%s (mtu_fix)", zone->name);
435                         fw3_ipt_rule_target(r, "TCPMSS");
436                         fw3_ipt_rule_addarg(r, false, "--clamp-mss-to-pmtu", NULL);
437                         fw3_ipt_rule_replace(r, "FORWARD");
438                 }
439         }
440         else if (handle->table == FW3_TABLE_RAW)
441         {
442                 if (has(zone->flags, handle->family, FW3_FLAG_NOTRACK))
443                 {
444                         r = fw3_ipt_rule_create(handle, NULL, dev, NULL, sub, NULL);
445                         fw3_ipt_rule_target(r, "zone_%s_notrack", zone->name);
446                         fw3_ipt_rule_extra(r, zone->extra_src);
447                         fw3_ipt_rule_replace(r, "PREROUTING");
448                 }
449         }
450 }
451
452 static void
453 print_interface_rules(struct fw3_ipt_handle *handle, struct fw3_state *state,
454                       bool reload, struct fw3_zone *zone)
455 {
456         struct fw3_device *dev;
457         struct fw3_address *sub;
458
459         fw3_foreach(dev, &zone->devices)
460         fw3_foreach(sub, &zone->subnets)
461         {
462                 if (!fw3_is_family(sub, handle->family))
463                         continue;
464
465                 if (!dev && !sub)
466                         continue;
467
468                 print_interface_rule(handle, state, reload, zone, dev, sub);
469         }
470 }
471
472 static struct fw3_address *
473 next_addr(struct fw3_address *addr, struct list_head *list,
474                 enum fw3_family family, bool invert)
475 {
476         struct list_head *p;
477         struct fw3_address *rv;
478
479         for (p = addr ? addr->list.next : list->next; p != list; p = p->next)
480         {
481                 rv = list_entry(p, struct fw3_address, list);
482
483                 if (fw3_is_family(rv, family) && rv->invert == invert)
484                         return rv;
485         }
486
487         return NULL;
488 }
489
490 static void
491 print_zone_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
492                 bool reload, struct fw3_zone *zone)
493 {
494         bool first_src, first_dest;
495         struct fw3_address *msrc;
496         struct fw3_address *mdest;
497         struct fw3_ipt_rule *r;
498
499         enum fw3_flag t;
500         char buf[32];
501
502         if (!fw3_is_family(zone, handle->family))
503                 return;
504
505         switch (handle->table)
506         {
507         case FW3_TABLE_FILTER:
508                 if (has(zone->flags, handle->family, FW3_FLAG_DNAT))
509                 {
510                         r = fw3_ipt_rule_new(handle);
511                         fw3_ipt_rule_extra(r, "-m conntrack --ctstate DNAT");
512                         fw3_ipt_rule_comment(r, "Accept port redirections");
513                         fw3_ipt_rule_target(r, fw3_flag_names[FW3_FLAG_ACCEPT]);
514                         fw3_ipt_rule_append(r, "zone_%s_input", zone->name);
515
516                         r = fw3_ipt_rule_new(handle);
517                         fw3_ipt_rule_extra(r, "-m conntrack --ctstate DNAT");
518                         fw3_ipt_rule_comment(r, "Accept port forwards");
519                         fw3_ipt_rule_target(r, fw3_flag_names[FW3_FLAG_ACCEPT]);
520                         fw3_ipt_rule_append(r, "zone_%s_forward", zone->name);
521                 }
522
523                 r = fw3_ipt_rule_new(handle);
524                 fw3_ipt_rule_target(r, "zone_%s_src_%s", zone->name,
525                                      fw3_flag_names[zone->policy_input]);
526                 fw3_ipt_rule_append(r, "zone_%s_input", zone->name);
527
528                 r = fw3_ipt_rule_new(handle);
529                 fw3_ipt_rule_target(r, "zone_%s_dest_%s", zone->name,
530                                      fw3_flag_names[zone->policy_forward]);
531                 fw3_ipt_rule_append(r, "zone_%s_forward", zone->name);
532
533                 r = fw3_ipt_rule_new(handle);
534                 fw3_ipt_rule_target(r, "zone_%s_dest_%s", zone->name,
535                                      fw3_flag_names[zone->policy_output]);
536                 fw3_ipt_rule_append(r, "zone_%s_output", zone->name);
537
538                 if (zone->log)
539                 {
540                         for (t = FW3_FLAG_REJECT; t <= FW3_FLAG_DROP; t++)
541                         {
542                                 if (has(zone->flags, handle->family, fw3_to_src_target(t)))
543                                 {
544                                         r = fw3_ipt_rule_new(handle);
545
546                                         snprintf(buf, sizeof(buf) - 1, "%s(src %s)",
547                                                  fw3_flag_names[t], zone->name);
548
549                                         fw3_ipt_rule_limit(r, &zone->log_limit);
550                                         fw3_ipt_rule_target(r, "LOG");
551                                         fw3_ipt_rule_addarg(r, false, "--log-prefix", buf);
552                                         fw3_ipt_rule_append(r, "zone_%s_src_%s",
553                                                             zone->name, fw3_flag_names[t]);
554                                 }
555
556                                 if (has(zone->flags, handle->family, t))
557                                 {
558                                         r = fw3_ipt_rule_new(handle);
559
560                                         snprintf(buf, sizeof(buf) - 1, "%s(dest %s)",
561                                                  fw3_flag_names[t], zone->name);
562
563                                         fw3_ipt_rule_limit(r, &zone->log_limit);
564                                         fw3_ipt_rule_target(r, "LOG");
565                                         fw3_ipt_rule_addarg(r, false, "--log-prefix", buf);
566                                         fw3_ipt_rule_append(r, "zone_%s_dest_%s",
567                                                             zone->name, fw3_flag_names[t]);
568                                 }
569                         }
570                 }
571                 break;
572
573         case FW3_TABLE_NAT:
574                 if (zone->masq && handle->family == FW3_FAMILY_V4)
575                 {
576                         /* for any negated masq_src ip, emit -s addr -j RETURN rules */
577                         for (msrc = NULL;
578                              (msrc = next_addr(msrc, &zone->masq_src,
579                                                handle->family, true)) != NULL; )
580                         {
581                                 msrc->invert = false;
582                                 r = fw3_ipt_rule_new(handle);
583                                 fw3_ipt_rule_src_dest(r, msrc, NULL);
584                                 fw3_ipt_rule_target(r, "RETURN");
585                                 fw3_ipt_rule_append(r, "zone_%s_postrouting", zone->name);
586                                 msrc->invert = true;
587                         }
588
589                         /* for any negated masq_dest ip, emit -d addr -j RETURN rules */
590                         for (mdest = NULL;
591                              (mdest = next_addr(mdest, &zone->masq_dest,
592                                                 handle->family, true)) != NULL; )
593                         {
594                                 mdest->invert = false;
595                                 r = fw3_ipt_rule_new(handle);
596                                 fw3_ipt_rule_src_dest(r, NULL, mdest);
597                                 fw3_ipt_rule_target(r, "RETURN");
598                                 fw3_ipt_rule_append(r, "zone_%s_postrouting", zone->name);
599                                 mdest->invert = true;
600                         }
601
602                         /* emit masquerading entries for non-negated addresses
603                            and ensure that both src and dest loops run at least once,
604                            even if there are no relevant addresses */
605                         for (first_src = true, msrc = NULL;
606                              (msrc = next_addr(msrc, &zone->masq_src,
607                                                    handle->family, false)) || first_src;
608                              first_src = false)
609                         {
610                                 for (first_dest = true, mdest = NULL;
611                                      (mdest = next_addr(mdest, &zone->masq_dest,
612                                                             handle->family, false)) || first_dest;
613                                      first_dest = false)
614                                 {
615                                         r = fw3_ipt_rule_new(handle);
616                                         fw3_ipt_rule_src_dest(r, msrc, mdest);
617                                         fw3_ipt_rule_target(r, "MASQUERADE");
618                                         fw3_ipt_rule_append(r, "zone_%s_postrouting", zone->name);
619                                 }
620                         }
621                 }
622                 break;
623
624         case FW3_TABLE_RAW:
625         case FW3_TABLE_MANGLE:
626                 break;
627         }
628
629         print_interface_rules(handle, state, reload, zone);
630 }
631
632 void
633 fw3_print_zone_chains(struct fw3_ipt_handle *handle, struct fw3_state *state,
634                       bool reload)
635 {
636         struct fw3_zone *zone;
637
638         list_for_each_entry(zone, &state->zones, list)
639                 print_zone_chain(handle, state, reload, zone);
640 }
641
642 void
643 fw3_print_zone_rules(struct fw3_ipt_handle *handle, struct fw3_state *state,
644                      bool reload)
645 {
646         struct fw3_zone *zone;
647
648         list_for_each_entry(zone, &state->zones, list)
649                 print_zone_rule(handle, state, reload, zone);
650 }
651
652 void
653 fw3_flush_zones(struct fw3_ipt_handle *handle, struct fw3_state *state,
654                 bool reload)
655 {
656         struct fw3_zone *z, *tmp;
657         const struct fw3_chain_spec *c;
658         char chain[32];
659
660         list_for_each_entry_safe(z, tmp, &state->zones, list)
661         {
662                 if (!has(z->flags, handle->family, handle->table))
663                         continue;
664
665                 for (c = zone_chains; c->format; c++)
666                 {
667                         /* don't touch user chains on selective stop */
668                         if (reload && c->flag == FW3_FLAG_CUSTOM_CHAINS)
669                                 continue;
670
671                         if (!fw3_is_family(c, handle->family))
672                                 continue;
673
674                         if (c->table != handle->table)
675                                 continue;
676
677                         if (c->flag && !has(z->flags, handle->family, c->flag))
678                                 continue;
679
680                         snprintf(chain, sizeof(chain), c->format, z->name);
681                         fw3_ipt_flush_chain(handle, chain);
682
683                         /* keep certain basic chains that do not depend on any settings to
684                            avoid purging unrelated user rules pointing to them */
685                         if (reload && !c->flag)
686                                 continue;
687
688                         fw3_ipt_delete_chain(handle, chain);
689                 }
690
691                 del(z->flags, handle->family, handle->table);
692         }
693 }
694
695 void
696 fw3_hotplug_zones(struct fw3_state *state, bool add)
697 {
698         struct fw3_zone *z;
699         struct fw3_device *d;
700
701         list_for_each_entry(z, &state->zones, list)
702         {
703                 if (add != fw3_hasbit(z->flags[0], FW3_FLAG_HOTPLUG))
704                 {
705                         list_for_each_entry(d, &z->devices, list)
706                                 fw3_hotplug(add, z, d);
707
708                         if (add)
709                                 fw3_setbit(z->flags[0], FW3_FLAG_HOTPLUG);
710                         else
711                                 fw3_delbit(z->flags[0], FW3_FLAG_HOTPLUG);
712                 }
713         }
714 }
715
716 struct fw3_zone *
717 fw3_lookup_zone(struct fw3_state *state, const char *name)
718 {
719         struct fw3_zone *z;
720
721         if (list_empty(&state->zones))
722                 return NULL;
723
724         list_for_each_entry(z, &state->zones, list)
725         {
726                 if (strcmp(z->name, name))
727                         continue;
728
729                 return z;
730         }
731
732         return NULL;
733 }
734
735 struct list_head *
736 fw3_resolve_zone_addresses(struct fw3_zone *zone, struct fw3_address *addr)
737 {
738         struct fw3_device *net;
739         struct fw3_address *cur, *tmp;
740         struct list_head *all;
741
742         all = calloc(1, sizeof(*all));
743         if (!all)
744                 return NULL;
745
746         INIT_LIST_HEAD(all);
747
748         if (addr && addr->set)
749         {
750                 tmp = malloc(sizeof(*tmp));
751
752                 if (tmp)
753                 {
754                         *tmp = *addr;
755                         list_add_tail(&tmp->list, all);
756                 }
757         }
758         else
759         {
760                 list_for_each_entry(net, &zone->networks, list)
761                         fw3_ubus_address(all, net->name);
762
763                 list_for_each_entry(cur, &zone->subnets, list)
764                 {
765                         tmp = malloc(sizeof(*tmp));
766
767                         if (!tmp)
768                                 continue;
769
770                         *tmp = *cur;
771                         list_add_tail(&tmp->list, all);
772                 }
773         }
774
775         return all;
776 }