ubus: store rule origin as comment
[project/firewall3.git] / zones.c
1 /*
2  * firewall3 - 3rd OpenWrt UCI firewall implementation
3  *
4  *   Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
5  *
6  * Permission to use, copy, modify, and/or distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18
19 #include "zones.h"
20 #include "ubus.h"
21
22
23 #define C(f, tbl, tgt, fmt) \
24         { FW3_FAMILY_##f, FW3_TABLE_##tbl, FW3_FLAG_##tgt, fmt }
25
26 static const struct fw3_chain_spec zone_chains[] = {
27         C(ANY, FILTER, UNSPEC,        "zone_%s_input"),
28         C(ANY, FILTER, UNSPEC,        "zone_%s_output"),
29         C(ANY, FILTER, UNSPEC,        "zone_%s_forward"),
30
31         C(ANY, FILTER, SRC_ACCEPT,    "zone_%s_src_ACCEPT"),
32         C(ANY, FILTER, SRC_REJECT,    "zone_%s_src_REJECT"),
33         C(ANY, FILTER, SRC_DROP,      "zone_%s_src_DROP"),
34
35         C(ANY, FILTER, ACCEPT,        "zone_%s_dest_ACCEPT"),
36         C(ANY, FILTER, REJECT,        "zone_%s_dest_REJECT"),
37         C(ANY, FILTER, DROP,          "zone_%s_dest_DROP"),
38
39         C(V4,  NAT,    SNAT,          "zone_%s_postrouting"),
40         C(V4,  NAT,    DNAT,          "zone_%s_prerouting"),
41
42         C(ANY, RAW,    NOTRACK,       "zone_%s_notrack"),
43
44         C(ANY, FILTER, CUSTOM_CHAINS, "input_%s_rule"),
45         C(ANY, FILTER, CUSTOM_CHAINS, "output_%s_rule"),
46         C(ANY, FILTER, CUSTOM_CHAINS, "forwarding_%s_rule"),
47
48         C(V4,  NAT,    CUSTOM_CHAINS, "prerouting_%s_rule"),
49         C(V4,  NAT,    CUSTOM_CHAINS, "postrouting_%s_rule"),
50
51         { }
52 };
53
54 const struct fw3_option fw3_zone_opts[] = {
55         FW3_OPT("enabled",             bool,     zone,     enabled),
56
57         FW3_OPT("name",                string,   zone,     name),
58         FW3_OPT("family",              family,   zone,     family),
59
60         FW3_LIST("network",            device,   zone,     networks),
61         FW3_LIST("device",             device,   zone,     devices),
62         FW3_LIST("subnet",             network,  zone,     subnets),
63
64         FW3_OPT("input",               target,   zone,     policy_input),
65         FW3_OPT("forward",             target,   zone,     policy_forward),
66         FW3_OPT("output",              target,   zone,     policy_output),
67
68         FW3_OPT("masq",                bool,     zone,     masq),
69         FW3_LIST("masq_src",           network,  zone,     masq_src),
70         FW3_LIST("masq_dest",          network,  zone,     masq_dest),
71
72         FW3_OPT("extra",               string,   zone,     extra_src),
73         FW3_OPT("extra_src",           string,   zone,     extra_src),
74         FW3_OPT("extra_dest",          string,   zone,     extra_dest),
75
76         FW3_OPT("conntrack",           bool,     zone,     conntrack),
77         FW3_OPT("mtu_fix",             bool,     zone,     mtu_fix),
78         FW3_OPT("custom_chains",       bool,     zone,     custom_chains),
79
80         FW3_OPT("log",                 bool,     zone,     log),
81         FW3_OPT("log_limit",           limit,    zone,     log_limit),
82
83         FW3_OPT("__flags_v4",          int,      zone,     flags[0]),
84         FW3_OPT("__flags_v6",          int,      zone,     flags[1]),
85
86         FW3_LIST("__addrs",            address,  zone,     old_addrs),
87
88         { }
89 };
90
91
92 static void
93 check_policy(struct uci_element *e, enum fw3_flag *pol, enum fw3_flag def,
94              const char *name)
95 {
96         if (*pol == FW3_FLAG_UNSPEC)
97         {
98                 warn_elem(e, "has no %s policy specified, using default", name);
99                 *pol = def;
100         }
101         else if (*pol > FW3_FLAG_DROP)
102         {
103                 warn_elem(e, "has invalid %s policy, using default", name);
104                 *pol = def;
105         }
106 }
107
108 static void
109 resolve_networks(struct uci_element *e, struct fw3_zone *zone)
110 {
111         struct fw3_device *net, *tmp;
112
113         list_for_each_entry(net, &zone->networks, list)
114         {
115                 tmp = fw3_ubus_device(net->name);
116
117                 if (!tmp)
118                 {
119                         warn_elem(e, "cannot resolve device of network '%s'", net->name);
120                         continue;
121                 }
122
123                 snprintf(tmp->network, sizeof(tmp->network), "%s", net->name);
124                 list_add_tail(&tmp->list, &zone->devices);
125         }
126 }
127
128 struct fw3_zone *
129 fw3_alloc_zone(void)
130 {
131         struct fw3_zone *zone;
132
133         zone = calloc(1, sizeof(*zone));
134         if (!zone)
135                 return NULL;
136
137         INIT_LIST_HEAD(&zone->networks);
138         INIT_LIST_HEAD(&zone->devices);
139         INIT_LIST_HEAD(&zone->subnets);
140         INIT_LIST_HEAD(&zone->masq_src);
141         INIT_LIST_HEAD(&zone->masq_dest);
142
143         INIT_LIST_HEAD(&zone->old_addrs);
144
145         zone->enabled = true;
146         zone->custom_chains = true;
147         zone->log_limit.rate = 10;
148
149         return zone;
150 }
151
152 void
153 fw3_load_zones(struct fw3_state *state, struct uci_package *p)
154 {
155         struct uci_section *s;
156         struct uci_element *e;
157         struct fw3_zone *zone;
158         struct fw3_defaults *defs = &state->defaults;
159
160         INIT_LIST_HEAD(&state->zones);
161
162         uci_foreach_element(&p->sections, e)
163         {
164                 s = uci_to_section(e);
165
166                 if (strcmp(s->type, "zone"))
167                         continue;
168
169                 zone = fw3_alloc_zone();
170
171                 if (!zone)
172                         continue;
173
174                 fw3_parse_options(zone, fw3_zone_opts, s);
175
176                 if (!zone->enabled)
177                 {
178                         fw3_free_zone(zone);
179                         continue;
180                 }
181
182                 if (!zone->extra_dest)
183                         zone->extra_dest = zone->extra_src;
184
185                 if (!defs->custom_chains && zone->custom_chains)
186                         zone->custom_chains = false;
187
188                 if (!zone->name || !*zone->name)
189                 {
190                         warn_elem(e, "has no name - ignoring");
191                         fw3_free_zone(zone);
192                         continue;
193                 }
194
195                 if (strlen(zone->name) > FW3_ZONE_MAXNAMELEN)
196                 {
197                         warn_elem(e, "must not have a name longer than %u characters",
198                                      FW3_ZONE_MAXNAMELEN);
199                         fw3_free_zone(zone);
200                         continue;
201                 }
202
203                 fw3_ubus_zone_devices(zone);
204
205                 if (list_empty(&zone->networks) && list_empty(&zone->devices) &&
206                     list_empty(&zone->subnets) && !zone->extra_src)
207                 {
208                         warn_elem(e, "has no device, network, subnet or extra options");
209                 }
210
211                 check_policy(e, &zone->policy_input, defs->policy_input, "input");
212                 check_policy(e, &zone->policy_output, defs->policy_output, "output");
213                 check_policy(e, &zone->policy_forward, defs->policy_forward, "forward");
214
215                 resolve_networks(e, zone);
216
217                 if (zone->masq)
218                 {
219                         setbit(zone->flags[0], FW3_FLAG_SNAT);
220                         zone->conntrack = true;
221                 }
222
223                 if (zone->custom_chains)
224                 {
225                         setbit(zone->flags[0], FW3_FLAG_SNAT);
226                         setbit(zone->flags[0], FW3_FLAG_DNAT);
227                 }
228
229                 setbit(zone->flags[0], fw3_to_src_target(zone->policy_input));
230                 setbit(zone->flags[0], zone->policy_forward);
231                 setbit(zone->flags[0], zone->policy_output);
232
233                 setbit(zone->flags[1], fw3_to_src_target(zone->policy_input));
234                 setbit(zone->flags[1], zone->policy_forward);
235                 setbit(zone->flags[1], zone->policy_output);
236
237                 list_add_tail(&zone->list, &state->zones);
238         }
239 }
240
241
242 static void
243 print_zone_chain(struct fw3_ipt_handle *handle, struct fw3_state *state,
244                  bool reload, struct fw3_zone *zone)
245 {
246         int i;
247         struct fw3_ipt_rule *r;
248         const struct fw3_chain_spec *c;
249
250         const char *flt_chains[] = {
251                 "input",   "input",
252                 "output",  "output",
253                 "forward", "forwarding",
254         };
255
256         const char *nat_chains[] = {
257                 "prerouting",  "prerouting",
258                 "postrouting", "postrouting",
259         };
260
261         if (!fw3_is_family(zone, handle->family))
262                 return;
263
264         info("   * Zone '%s'", zone->name);
265
266         set(zone->flags, handle->family, handle->table);
267
268         if (zone->custom_chains)
269                 set(zone->flags, handle->family, FW3_FLAG_CUSTOM_CHAINS);
270
271         if (!zone->conntrack && !state->defaults.drop_invalid)
272                 set(zone->flags, handle->family, FW3_FLAG_NOTRACK);
273
274         for (c = zone_chains; c->format; c++)
275         {
276                 /* don't touch user chains on selective stop */
277                 if (reload && c->flag == FW3_FLAG_CUSTOM_CHAINS)
278                         continue;
279
280                 if (!fw3_is_family(c, handle->family))
281                         continue;
282
283                 if (c->table != handle->table)
284                         continue;
285
286                 if (c->flag &&
287                     !hasbit(zone->flags[handle->family == FW3_FAMILY_V6], c->flag))
288                         continue;
289
290                 fw3_ipt_create_chain(handle, c->format, zone->name);
291         }
292
293         if (zone->custom_chains)
294         {
295                 if (handle->table == FW3_TABLE_FILTER)
296                 {
297                         for (i = 0; i < sizeof(flt_chains)/sizeof(flt_chains[0]); i += 2)
298                         {
299                                 r = fw3_ipt_rule_new(handle);
300                                 fw3_ipt_rule_comment(r, "user chain for %s", flt_chains[i+1]);
301                                 fw3_ipt_rule_target(r, "%s_%s_rule", flt_chains[i+1], zone->name);
302                                 fw3_ipt_rule_append(r, "zone_%s_%s", zone->name, flt_chains[i]);
303                         }
304                 }
305                 else if (handle->table == FW3_TABLE_NAT)
306                 {
307                         for (i = 0; i < sizeof(nat_chains)/sizeof(nat_chains[0]); i += 2)
308                         {
309                                 r = fw3_ipt_rule_new(handle);
310                                 fw3_ipt_rule_comment(r, "user chain for %s", nat_chains[i+1]);
311                                 fw3_ipt_rule_target(r, "%s_%s_rule", nat_chains[i+1], zone->name);
312                                 fw3_ipt_rule_append(r, "zone_%s_%s", zone->name, nat_chains[i]);
313                         }
314                 }
315         }
316
317         set(zone->flags, handle->family, handle->table);
318 }
319
320 static void
321 print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
322                                          bool reload, struct fw3_zone *zone,
323                      struct fw3_device *dev, struct fw3_address *sub)
324 {
325         struct fw3_protocol tcp = { .protocol = 6 };
326         struct fw3_ipt_rule *r;
327         enum fw3_flag t;
328
329         char buf[32];
330
331         int i;
332
333         const char *chains[] = {
334                 "input",
335                 "output",
336                 "forward",
337         };
338
339 #define jump_target(t) \
340         ((t == FW3_FLAG_REJECT) ? "reject" : fw3_flag_names[t])
341
342         if (handle->table == FW3_TABLE_FILTER)
343         {
344                 for (t = FW3_FLAG_ACCEPT; t <= FW3_FLAG_DROP; t++)
345                 {
346                         if (has(zone->flags, handle->family, fw3_to_src_target(t)))
347                         {
348                                 r = fw3_ipt_rule_create(handle, NULL, dev, NULL, sub, NULL);
349                                 fw3_ipt_rule_target(r, jump_target(t));
350                                 fw3_ipt_rule_extra(r, zone->extra_src);
351                                 fw3_ipt_rule_replace(r, "zone_%s_src_%s", zone->name,
352                                                      fw3_flag_names[t]);
353                         }
354
355                         if (has(zone->flags, handle->family, t))
356                         {
357                                 r = fw3_ipt_rule_create(handle, NULL, NULL, dev, NULL, sub);
358                                 fw3_ipt_rule_target(r, jump_target(t));
359                                 fw3_ipt_rule_extra(r, zone->extra_dest);
360                                 fw3_ipt_rule_replace(r, "zone_%s_dest_%s", zone->name,
361                                                      fw3_flag_names[t]);
362                         }
363                 }
364
365                 for (i = 0; i < sizeof(chains)/sizeof(chains[0]); i++)
366                 {
367                         if (*chains[i] == 'o')
368                                 r = fw3_ipt_rule_create(handle, NULL, NULL, dev, NULL, sub);
369                         else
370                                 r = fw3_ipt_rule_create(handle, NULL, dev, NULL, sub, NULL);
371
372                         fw3_ipt_rule_target(r, "zone_%s_%s", zone->name, chains[i]);
373
374                         if (*chains[i] == 'o')
375                                 fw3_ipt_rule_extra(r, zone->extra_dest);
376                         else
377                                 fw3_ipt_rule_extra(r, zone->extra_src);
378
379                         fw3_ipt_rule_replace(r, "delegate_%s", chains[i]);
380                 }
381         }
382         else if (handle->table == FW3_TABLE_NAT)
383         {
384                 if (has(zone->flags, handle->family, FW3_FLAG_DNAT))
385                 {
386                         r = fw3_ipt_rule_create(handle, NULL, dev, NULL, sub, NULL);
387                         fw3_ipt_rule_target(r, "zone_%s_prerouting", zone->name);
388                         fw3_ipt_rule_extra(r, zone->extra_src);
389                         fw3_ipt_rule_replace(r, "delegate_prerouting");
390                 }
391
392                 if (has(zone->flags, handle->family, FW3_FLAG_SNAT))
393                 {
394                         r = fw3_ipt_rule_create(handle, NULL, NULL, dev, NULL, sub);
395                         fw3_ipt_rule_target(r, "zone_%s_postrouting", zone->name);
396                         fw3_ipt_rule_extra(r, zone->extra_dest);
397                         fw3_ipt_rule_replace(r, "delegate_postrouting");
398                 }
399         }
400         else if (handle->table == FW3_TABLE_MANGLE)
401         {
402                 if (zone->mtu_fix)
403                 {
404                         if (zone->log)
405                         {
406                                 snprintf(buf, sizeof(buf) - 1, "MSSFIX(%s): ", zone->name);
407
408                                 r = fw3_ipt_rule_create(handle, &tcp, NULL, dev, NULL, sub);
409                                 fw3_ipt_rule_addarg(r, false, "--tcp-flags", "SYN,RST");
410                                 fw3_ipt_rule_addarg(r, false, "SYN", NULL);
411                                 fw3_ipt_rule_limit(r, &zone->log_limit);
412                                 fw3_ipt_rule_comment(r, "%s (mtu_fix logging)", zone->name);
413                                 fw3_ipt_rule_target(r, "LOG");
414                                 fw3_ipt_rule_addarg(r, false, "--log-prefix", buf);
415                                 fw3_ipt_rule_replace(r, "mssfix");
416                         }
417
418                         r = fw3_ipt_rule_create(handle, &tcp, NULL, dev, NULL, sub);
419                         fw3_ipt_rule_addarg(r, false, "--tcp-flags", "SYN,RST");
420                         fw3_ipt_rule_addarg(r, false, "SYN", NULL);
421                         fw3_ipt_rule_comment(r, "%s (mtu_fix)", zone->name);
422                         fw3_ipt_rule_target(r, "TCPMSS");
423                         fw3_ipt_rule_addarg(r, false, "--clamp-mss-to-pmtu", NULL);
424                         fw3_ipt_rule_replace(r, "mssfix");
425                 }
426         }
427         else if (handle->table == FW3_TABLE_RAW)
428         {
429                 if (has(zone->flags, handle->family, FW3_FLAG_NOTRACK))
430                 {
431                         r = fw3_ipt_rule_create(handle, NULL, dev, NULL, sub, NULL);
432                         fw3_ipt_rule_target(r, "zone_%s_notrack", zone->name);
433                         fw3_ipt_rule_extra(r, zone->extra_src);
434                         fw3_ipt_rule_replace(r, "delegate_notrack");
435                 }
436         }
437 }
438
439 static void
440 print_interface_rules(struct fw3_ipt_handle *handle, struct fw3_state *state,
441                       bool reload, struct fw3_zone *zone)
442 {
443         struct fw3_device *dev;
444         struct fw3_address *sub;
445
446         fw3_foreach(dev, &zone->devices)
447         fw3_foreach(sub, &zone->subnets)
448         {
449                 if (!fw3_is_family(sub, handle->family))
450                         continue;
451
452                 if (!dev && !sub)
453                         continue;
454
455                 print_interface_rule(handle, state, reload, zone, dev, sub);
456         }
457 }
458
459 static void
460 print_zone_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
461                 bool reload, struct fw3_zone *zone)
462 {
463         bool disable_notrack = state->defaults.drop_invalid;
464         struct fw3_address *msrc;
465         struct fw3_address *mdest;
466         struct fw3_ipt_rule *r;
467
468         enum fw3_flag t;
469         char buf[32];
470
471         if (!fw3_is_family(zone, handle->family))
472                 return;
473
474         switch (handle->table)
475         {
476         case FW3_TABLE_FILTER:
477                 if (has(zone->flags, handle->family, FW3_FLAG_DNAT))
478                 {
479                         r = fw3_ipt_rule_new(handle);
480                         fw3_ipt_rule_extra(r, "-m conntrack --ctstate DNAT");
481                         fw3_ipt_rule_comment(r, "Accept port redirections");
482                         fw3_ipt_rule_target(r, fw3_flag_names[FW3_FLAG_ACCEPT]);
483                         fw3_ipt_rule_append(r, "zone_%s_input", zone->name);
484
485                         r = fw3_ipt_rule_new(handle);
486                         fw3_ipt_rule_extra(r, "-m conntrack --ctstate DNAT");
487                         fw3_ipt_rule_comment(r, "Accept port forwards");
488                         fw3_ipt_rule_target(r, fw3_flag_names[FW3_FLAG_ACCEPT]);
489                         fw3_ipt_rule_append(r, "zone_%s_forward", zone->name);
490                 }
491
492                 r = fw3_ipt_rule_new(handle);
493                 fw3_ipt_rule_target(r, "zone_%s_src_%s", zone->name,
494                                      fw3_flag_names[zone->policy_input]);
495                 fw3_ipt_rule_append(r, "zone_%s_input", zone->name);
496
497                 r = fw3_ipt_rule_new(handle);
498                 fw3_ipt_rule_target(r, "zone_%s_dest_%s", zone->name,
499                                      fw3_flag_names[zone->policy_forward]);
500                 fw3_ipt_rule_append(r, "zone_%s_forward", zone->name);
501
502                 r = fw3_ipt_rule_new(handle);
503                 fw3_ipt_rule_target(r, "zone_%s_dest_%s", zone->name,
504                                      fw3_flag_names[zone->policy_output]);
505                 fw3_ipt_rule_append(r, "zone_%s_output", zone->name);
506
507                 if (zone->log)
508                 {
509                         for (t = FW3_FLAG_REJECT; t <= FW3_FLAG_DROP; t++)
510                         {
511                                 if (has(zone->flags, handle->family, fw3_to_src_target(t)))
512                                 {
513                                         r = fw3_ipt_rule_new(handle);
514
515                                         snprintf(buf, sizeof(buf) - 1, "%s(src %s)",
516                                                  fw3_flag_names[t], zone->name);
517
518                                         fw3_ipt_rule_limit(r, &zone->log_limit);
519                                         fw3_ipt_rule_target(r, "LOG");
520                                         fw3_ipt_rule_addarg(r, false, "--log-prefix", buf);
521                                         fw3_ipt_rule_append(r, "zone_%s_src_%s",
522                                                             zone->name, fw3_flag_names[t]);
523                                 }
524
525                                 if (has(zone->flags, handle->family, t))
526                                 {
527                                         r = fw3_ipt_rule_new(handle);
528
529                                         snprintf(buf, sizeof(buf) - 1, "%s(dest %s)",
530                                                  fw3_flag_names[t], zone->name);
531
532                                         fw3_ipt_rule_limit(r, &zone->log_limit);
533                                         fw3_ipt_rule_target(r, "LOG");
534                                         fw3_ipt_rule_addarg(r, false, "--log-prefix", buf);
535                                         fw3_ipt_rule_append(r, "zone_%s_dest_%s",
536                                                             zone->name, fw3_flag_names[t]);
537                                 }
538                         }
539                 }
540                 break;
541
542         case FW3_TABLE_NAT:
543                 if (zone->masq && handle->family == FW3_FAMILY_V4)
544                 {
545                         fw3_foreach(msrc, &zone->masq_src)
546                         fw3_foreach(mdest, &zone->masq_dest)
547                         {
548                                 if (!fw3_is_family(msrc, handle->family) ||
549                                     !fw3_is_family(mdest, handle->family))
550                                         continue;
551
552                                 r = fw3_ipt_rule_new(handle);
553                                 fw3_ipt_rule_src_dest(r, msrc, mdest);
554                                 fw3_ipt_rule_target(r, "MASQUERADE");
555                                 fw3_ipt_rule_append(r, "zone_%s_postrouting", zone->name);
556                         }
557                 }
558                 break;
559
560         case FW3_TABLE_RAW:
561                 if (!zone->conntrack && !disable_notrack)
562                 {
563                         r = fw3_ipt_rule_new(handle);
564                         fw3_ipt_rule_target(r, "CT");
565                         fw3_ipt_rule_addarg(r, false, "--notrack", NULL);
566                         fw3_ipt_rule_append(r, "zone_%s_notrack", zone->name);
567                 }
568                 break;
569
570         case FW3_TABLE_MANGLE:
571                 break;
572         }
573
574         print_interface_rules(handle, state, reload, zone);
575 }
576
577 void
578 fw3_print_zone_chains(struct fw3_ipt_handle *handle, struct fw3_state *state,
579                       bool reload)
580 {
581         struct fw3_zone *zone;
582
583         list_for_each_entry(zone, &state->zones, list)
584                 print_zone_chain(handle, state, reload, zone);
585 }
586
587 void
588 fw3_print_zone_rules(struct fw3_ipt_handle *handle, struct fw3_state *state,
589                      bool reload)
590 {
591         struct fw3_zone *zone;
592
593         list_for_each_entry(zone, &state->zones, list)
594                 print_zone_rule(handle, state, reload, zone);
595 }
596
597 void
598 fw3_flush_zones(struct fw3_ipt_handle *handle, struct fw3_state *state,
599                 bool reload)
600 {
601         struct fw3_zone *z, *tmp;
602         const struct fw3_chain_spec *c;
603         char chain[32];
604
605         list_for_each_entry_safe(z, tmp, &state->zones, list)
606         {
607                 if (!has(z->flags, handle->family, handle->table))
608                         continue;
609
610                 for (c = zone_chains; c->format; c++)
611                 {
612                         /* don't touch user chains on selective stop */
613                         if (reload && c->flag == FW3_FLAG_CUSTOM_CHAINS)
614                                 continue;
615
616                         if (!fw3_is_family(c, handle->family))
617                                 continue;
618
619                         if (c->table != handle->table)
620                                 continue;
621
622                         if (c->flag && !has(z->flags, handle->family, c->flag))
623                                 continue;
624
625                         snprintf(chain, sizeof(chain), c->format, z->name);
626                         fw3_ipt_flush_chain(handle, chain);
627
628                         /* keep certain basic chains that do not depend on any settings to
629                            avoid purging unrelated user rules pointing to them */
630                         if (reload && !c->flag)
631                                 continue;
632
633                         fw3_ipt_delete_chain(handle, chain);
634                 }
635
636                 del(z->flags, handle->family, handle->table);
637         }
638 }
639
640 void
641 fw3_hotplug_zones(struct fw3_state *state, bool add)
642 {
643         struct fw3_zone *z;
644         struct fw3_device *d;
645
646         list_for_each_entry(z, &state->zones, list)
647         {
648                 if (add != hasbit(z->flags[0], FW3_FLAG_HOTPLUG))
649                 {
650                         list_for_each_entry(d, &z->devices, list)
651                                 fw3_hotplug(add, z, d);
652
653                         if (add)
654                                 setbit(z->flags[0], FW3_FLAG_HOTPLUG);
655                         else
656                                 delbit(z->flags[0], FW3_FLAG_HOTPLUG);
657                 }
658         }
659 }
660
661 struct fw3_zone *
662 fw3_lookup_zone(struct fw3_state *state, const char *name)
663 {
664         struct fw3_zone *z;
665
666         if (list_empty(&state->zones))
667                 return NULL;
668
669         list_for_each_entry(z, &state->zones, list)
670         {
671                 if (strcmp(z->name, name))
672                         continue;
673
674                 return z;
675         }
676
677         return NULL;
678 }
679
680 struct list_head *
681 fw3_resolve_zone_addresses(struct fw3_zone *zone, struct fw3_address *addr)
682 {
683         struct fw3_device *net;
684         struct fw3_address *cur, *tmp;
685         struct list_head *all;
686
687         all = calloc(1, sizeof(*all));
688         if (!all)
689                 return NULL;
690
691         INIT_LIST_HEAD(all);
692
693         if (addr && addr->set)
694         {
695                 tmp = malloc(sizeof(*tmp));
696
697                 if (tmp)
698                 {
699                         *tmp = *addr;
700                         list_add_tail(&tmp->list, all);
701                 }
702         }
703         else
704         {
705                 list_for_each_entry(net, &zone->networks, list)
706                         fw3_ubus_address(all, net->name);
707
708                 list_for_each_entry(cur, &zone->subnets, list)
709                 {
710                         tmp = malloc(sizeof(*tmp));
711
712                         if (!tmp)
713                                 continue;
714
715                         *tmp = *cur;
716                         list_add_tail(&tmp->list, all);
717                 }
718         }
719
720         return all;
721 }