zones.c

   1 /*
   2  * firewall3 - 3rd OpenWrt UCI firewall implementation
   3  *
   4  *   Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
   5  *
   6  * Permission to use, copy, modify, and/or distribute this software for any
   7  * purpose with or without fee is hereby granted, provided that the above
   8  * copyright notice and this permission notice appear in all copies.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17  */
  18
  19 #include "zones.h"
  20 #include "ubus.h"
  21
  22
  23 #define C(f, tbl, tgt, name) \
  24         { FW3_FAMILY_##f, FW3_TABLE_##tbl, FW3_TARGET_##tgt, name }
  25
  26 struct chain {
  27         enum fw3_family family;
  28         enum fw3_table table;
  29         enum fw3_target target;
  30         const char *name;
  31 };
  32
  33 static const struct chain src_chains[] = {
  34         C(ANY, FILTER, UNSPEC,  "zone_%s_input"),
  35         C(ANY, FILTER, UNSPEC,  "zone_%s_output"),
  36         C(ANY, FILTER, UNSPEC,  "zone_%s_forward"),
  37
  38         C(ANY, FILTER, ACCEPT,  "zone_%s_src_ACCEPT"),
  39         C(ANY, FILTER, REJECT,  "zone_%s_src_REJECT"),
  40         C(ANY, FILTER, DROP,    "zone_%s_src_DROP"),
  41 };
  42
  43 static const struct chain dst_chains[] = {
  44         C(ANY, FILTER, ACCEPT,  "zone_%s_dest_ACCEPT"),
  45         C(ANY, FILTER, REJECT,  "zone_%s_dest_REJECT"),
  46         C(ANY, FILTER, DROP,    "zone_%s_dest_DROP"),
  47
  48         C(V4,  NAT,    SNAT,    "zone_%s_postrouting"),
  49         C(V4,  NAT,    DNAT,    "zone_%s_prerouting"),
  50 };
  51
  52 const struct fw3_option fw3_zone_opts[] = {
  53         FW3_OPT("enabled",             bool,     zone,     enabled),
  54
  55         FW3_OPT("name",                string,   zone,     name),
  56         FW3_OPT("family",              family,   zone,     family),
  57
  58         FW3_LIST("network",            device,   zone,     networks),
  59         FW3_LIST("device",             device,   zone,     devices),
  60         FW3_LIST("subnet",             address,  zone,     subnets),
  61
  62         FW3_OPT("input",               target,   zone,     policy_input),
  63         FW3_OPT("forward",             target,   zone,     policy_forward),
  64         FW3_OPT("output",              target,   zone,     policy_output),
  65
  66         FW3_OPT("masq",                bool,     zone,     masq),
  67         FW3_LIST("masq_src",           address,  zone,     masq_src),
  68         FW3_LIST("masq_dest",          address,  zone,     masq_dest),
  69
  70         FW3_OPT("extra",               string,   zone,     extra_src),
  71         FW3_OPT("extra_src",           string,   zone,     extra_src),
  72         FW3_OPT("extra_dest",          string,   zone,     extra_dest),
  73
  74         FW3_OPT("conntrack",           bool,     zone,     conntrack),
  75         FW3_OPT("mtu_fix",             bool,     zone,     mtu_fix),
  76         FW3_OPT("custom_chains",       bool,     zone,     custom_chains),
  77
  78         FW3_OPT("log",                 bool,     zone,     log),
  79         FW3_OPT("log_limit",           limit,    zone,     log_limit),
  80
  81         { }
  82 };
  83
  84
  85 static bool
  86 print_chains(enum fw3_table table, enum fw3_family family,
  87              const char *fmt, const char *name, uint16_t targets,
  88              const struct chain *chains, int n)
  89 {
  90         bool rv = false;
  91         char cn[128] = { 0 };
  92         const struct chain *c;
  93
  94         for (c = chains; n > 0; c++, n--)
  95         {
  96                 if (!fw3_is_family(c, family))
  97                         continue;
  98
  99                 if (c->table != table)
 100                         continue;
 101
 102                 if ((c->target != FW3_TARGET_UNSPEC) && !hasbit(targets, c->target))
 103                         continue;
 104
 105                 snprintf(cn, sizeof(cn), c->name, name);
 106                 fw3_pr(fmt, cn);
 107
 108                 rv = true;
 109         }
 110
 111         return rv;
 112 }
 113
 114 static void
 115 check_policy(struct uci_element *e, enum fw3_target *pol, enum fw3_target def,
 116              const char *name)
 117 {
 118         if (*pol == FW3_TARGET_UNSPEC)
 119         {
 120                 warn_elem(e, "has no %s policy specified, using default", name);
 121                 *pol = def;
 122         }
 123         else if (*pol > FW3_TARGET_DROP)
 124         {
 125                 warn_elem(e, "has invalid %s policy, using default", name);
 126                 *pol = def;
 127         }
 128 }
 129
 130 static void
 131 resolve_networks(struct uci_element *e, struct fw3_zone *zone)
 132 {
 133         struct fw3_device *net, *tmp;
 134
 135         list_for_each_entry(net, &zone->networks, list)
 136         {
 137                 tmp = fw3_ubus_device(net->name);
 138
 139                 if (!tmp)
 140                 {
 141                         warn_elem(e, "cannot resolve device of network '%s'", net->name);
 142                         continue;
 143                 }
 144
 145                 list_add_tail(&tmp->list, &zone->devices);
 146         }
 147 }
 148
 149 struct fw3_zone *
 150 fw3_alloc_zone(void)
 151 {
 152         struct fw3_zone *zone;
 153
 154         zone = malloc(sizeof(*zone));
 155
 156         if (!zone)
 157                 return NULL;
 158
 159         memset(zone, 0, sizeof(*zone));
 160
 161         INIT_LIST_HEAD(&zone->networks);
 162         INIT_LIST_HEAD(&zone->devices);
 163         INIT_LIST_HEAD(&zone->subnets);
 164         INIT_LIST_HEAD(&zone->masq_src);
 165         INIT_LIST_HEAD(&zone->masq_dest);
 166
 167         zone->enabled = true;
 168         zone->log_limit.rate = 10;
 169
 170         return zone;
 171 }
 172
 173 void
 174 fw3_load_zones(struct fw3_state *state, struct uci_package *p)
 175 {
 176         struct uci_section *s;
 177         struct uci_element *e;
 178         struct fw3_zone *zone;
 179         struct fw3_defaults *defs = &state->defaults;
 180
 181         INIT_LIST_HEAD(&state->zones);
 182
 183         uci_foreach_element(&p->sections, e)
 184         {
 185                 s = uci_to_section(e);
 186
 187                 if (strcmp(s->type, "zone"))
 188                         continue;
 189
 190                 zone = fw3_alloc_zone();
 191
 192                 if (!zone)
 193                         continue;
 194
 195                 fw3_parse_options(zone, fw3_zone_opts, s);
 196
 197                 if (!zone->enabled)
 198                 {
 199                         fw3_free_zone(zone);
 200                         continue;
 201                 }
 202
 203                 if (!zone->extra_dest)
 204                         zone->extra_dest = zone->extra_src;
 205
 206                 if (!zone->name || !*zone->name)
 207                 {
 208                         warn_elem(e, "has no name - ignoring");
 209                         fw3_free_zone(zone);
 210                         continue;
 211                 }
 212
 213                 if (list_empty(&zone->networks) && list_empty(&zone->devices) &&
 214                     list_empty(&zone->subnets) && !zone->extra_src)
 215                 {
 216                         warn_elem(e, "has no device, network, subnet or extra options");
 217                 }
 218
 219                 check_policy(e, &zone->policy_input, defs->policy_input, "input");
 220                 check_policy(e, &zone->policy_output, defs->policy_output, "output");
 221                 check_policy(e, &zone->policy_forward, defs->policy_forward, "forward");
 222
 223                 resolve_networks(e, zone);
 224
 225                 if (zone->masq)
 226                 {
 227                         setbit(zone->dst_flags, FW3_TARGET_SNAT);
 228                         zone->conntrack = true;
 229                 }
 230
 231                 setbit(zone->src_flags, zone->policy_input);
 232                 setbit(zone->dst_flags, zone->policy_output);
 233                 setbit(zone->dst_flags, zone->policy_forward);
 234
 235                 list_add_tail(&zone->list, &state->zones);
 236         }
 237 }
 238
 239
 240 static void
 241 print_zone_chain(enum fw3_table table, enum fw3_family family,
 242                  struct fw3_zone *zone, struct fw3_state *state)
 243 {
 244         bool s, d;
 245
 246         if (!fw3_is_family(zone, family))
 247                 return;
 248
 249         setbit(zone->dst_flags, family);
 250
 251         if (!zone->conntrack && !state->defaults.drop_invalid)
 252                 setbit(zone->dst_flags, FW3_TARGET_NOTRACK);
 253
 254         s = print_chains(table, family, ":%s - [0:0]\n", zone->name,
 255                          zone->src_flags, src_chains, ARRAY_SIZE(src_chains));
 256
 257         d = print_chains(table, family, ":%s - [0:0]\n", zone->name,
 258                          zone->dst_flags, dst_chains, ARRAY_SIZE(dst_chains));
 259
 260         if (s || d)
 261         {
 262                 info("   * Zone '%s'", zone->name);
 263                 fw3_set_running(zone, &state->running_zones);
 264         }
 265 }
 266
 267 static void
 268 print_interface_rule(enum fw3_table table, enum fw3_family family,
 269                      struct fw3_zone *zone, struct fw3_device *dev,
 270                      struct fw3_address *sub, bool disable_notrack)
 271 {
 272         enum fw3_target t;
 273
 274 #define jump_target(t) \
 275         ((t == FW3_TARGET_REJECT) ? "reject" : fw3_flag_names[t])
 276
 277         if (table == FW3_TABLE_FILTER)
 278         {
 279                 for (t = FW3_TARGET_ACCEPT; t <= FW3_TARGET_DROP; t++)
 280                 {
 281                         if (hasbit(zone->src_flags, t))
 282                         {
 283                                 fw3_pr("-A zone_%s_src_%s", zone->name, fw3_flag_names[t]);
 284                                 fw3_format_in_out(dev, NULL);
 285                                 fw3_format_src_dest(sub, NULL);
 286                                 fw3_format_extra(zone->extra_src);
 287                                 fw3_pr(" -j %s\n", jump_target(t));
 288                         }
 289
 290                         if (hasbit(zone->dst_flags, t))
 291                         {
 292                                 fw3_pr("-A zone_%s_dest_%s", zone->name, fw3_flag_names[t]);
 293                                 fw3_format_in_out(NULL, dev);
 294                                 fw3_format_src_dest(NULL, sub);
 295                                 fw3_format_extra(zone->extra_dest);
 296                                 fw3_pr(" -j %s\n", jump_target(t));
 297                         }
 298                 }
 299
 300                 fw3_pr("-A delegate_input");
 301                 fw3_format_in_out(dev, NULL);
 302                 fw3_format_src_dest(sub, NULL);
 303                 fw3_format_extra(zone->extra_src);
 304                 fw3_pr(" -j zone_%s_input\n", zone->name);
 305
 306                 fw3_pr("-A delegate_forward");
 307                 fw3_format_in_out(dev, NULL);
 308                 fw3_format_src_dest(sub, NULL);
 309                 fw3_format_extra(zone->extra_src);
 310                 fw3_pr(" -j zone_%s_forward\n", zone->name);
 311
 312                 fw3_pr("-A delegate_output");
 313                 fw3_format_in_out(NULL, dev);
 314                 fw3_format_src_dest(NULL, sub);
 315                 fw3_format_extra(zone->extra_dest);
 316                 fw3_pr(" -j zone_%s_output\n", zone->name);
 317         }
 318         else if (table == FW3_TABLE_NAT)
 319         {
 320                 if (hasbit(zone->dst_flags, FW3_TARGET_DNAT))
 321                 {
 322                         fw3_pr("-A delegate_prerouting");
 323                         fw3_format_in_out(dev, NULL);
 324                         fw3_format_src_dest(sub, NULL);
 325                         fw3_format_extra(zone->extra_src);
 326                         fw3_pr(" -j zone_%s_prerouting\n", zone->name);
 327                 }
 328
 329                 if (hasbit(zone->dst_flags, FW3_TARGET_SNAT))
 330                 {
 331                         fw3_pr("-A delegate_postrouting");
 332                         fw3_format_in_out(NULL, dev);
 333                         fw3_format_src_dest(NULL, sub);
 334                         fw3_format_extra(zone->extra_dest);
 335                         fw3_pr(" -j zone_%s_postrouting\n", zone->name);
 336                 }
 337         }
 338         else if (table == FW3_TABLE_MANGLE)
 339         {
 340                 if (zone->mtu_fix)
 341                 {
 342                         if (zone->log)
 343                         {
 344                                 fw3_pr("-A mssfix");
 345                                 fw3_format_in_out(NULL, dev);
 346                                 fw3_format_src_dest(NULL, sub);
 347                                 fw3_pr(" -p tcp --tcp-flags SYN,RST SYN");
 348                                 fw3_format_limit(&zone->log_limit);
 349                                 fw3_format_comment(zone->name, " (mtu_fix logging)");
 350                                 fw3_pr(" -j LOG --log-prefix \"MSSFIX(%s): \"\n", zone->name);
 351                         }
 352
 353                         fw3_pr("-A mssfix");
 354                         fw3_format_in_out(NULL, dev);
 355                         fw3_format_src_dest(NULL, sub);
 356                         fw3_pr(" -p tcp --tcp-flags SYN,RST SYN");
 357                         fw3_format_comment(zone->name, " (mtu_fix)");
 358                         fw3_pr(" -j TCPMSS --clamp-mss-to-pmtu\n");
 359                 }
 360         }
 361         else if (table == FW3_TABLE_RAW)
 362         {
 363                 if (!zone->conntrack && !disable_notrack)
 364                 {
 365                         fw3_pr("-A notrack");
 366                         fw3_format_in_out(dev, NULL);
 367                         fw3_format_src_dest(sub, NULL);
 368                         fw3_format_extra(zone->extra_src);
 369                         fw3_format_comment(zone->name, " (notrack)");
 370                         fw3_pr(" -j CT --notrack\n", zone->name);
 371                 }
 372         }
 373 }
 374
 375 static void
 376 print_interface_rules(enum fw3_table table, enum fw3_family family,
 377                       struct fw3_zone *zone, bool disable_notrack)
 378 {
 379         struct fw3_device *dev;
 380         struct fw3_address *sub;
 381
 382         fw3_foreach(dev, &zone->devices)
 383         fw3_foreach(sub, &zone->subnets)
 384         {
 385                 if (!fw3_is_family(sub, family))
 386                         continue;
 387
 388                 if (!dev && !sub)
 389                         continue;
 390
 391                 print_interface_rule(table, family, zone, dev, sub, disable_notrack);
 392         }
 393 }
 394
 395 static void
 396 print_zone_rule(enum fw3_table table, enum fw3_family family,
 397                 struct fw3_zone *zone, bool disable_notrack)
 398 {
 399         struct fw3_address *msrc;
 400         struct fw3_address *mdest;
 401
 402         enum fw3_target t;
 403
 404         if (!fw3_is_family(zone, family))
 405                 return;
 406
 407         switch (table)
 408         {
 409         case FW3_TABLE_FILTER:
 410                 fw3_pr("-A zone_%s_input -j zone_%s_src_%s\n",
 411                            zone->name, zone->name, fw3_flag_names[zone->policy_input]);
 412
 413                 fw3_pr("-A zone_%s_forward -j zone_%s_dest_%s\n",
 414                            zone->name, zone->name, fw3_flag_names[zone->policy_forward]);
 415
 416                 fw3_pr("-A zone_%s_output -j zone_%s_dest_%s\n",
 417                            zone->name, zone->name, fw3_flag_names[zone->policy_output]);
 418
 419                 if (zone->log)
 420                 {
 421                         for (t = FW3_TARGET_REJECT; t <= FW3_TARGET_DROP; t++)
 422                         {
 423                                 if (hasbit(zone->src_flags, t))
 424                                 {
 425                                         fw3_pr("-A zone_%s_src_%s", zone->name, fw3_flag_names[t]);
 426                                         fw3_format_limit(&zone->log_limit);
 427                                         fw3_pr(" -j LOG --log-prefix \"%s(src %s)\"\n",
 428                                                    fw3_flag_names[t], zone->name);
 429                                 }
 430
 431                                 if (hasbit(zone->dst_flags, t))
 432                                 {
 433                                         fw3_pr("-A zone_%s_dest_%s", zone->name, fw3_flag_names[t]);
 434                                         fw3_format_limit(&zone->log_limit);
 435                                         fw3_pr(" -j LOG --log-prefix \"%s(dest %s)\"\n",
 436                                                    fw3_flag_names[t], zone->name);
 437                                 }
 438                         }
 439                 }
 440                 break;
 441
 442         case FW3_TABLE_NAT:
 443                 if (zone->masq && family == FW3_FAMILY_V4)
 444                 {
 445                         fw3_foreach(msrc, &zone->masq_src)
 446                         fw3_foreach(mdest, &zone->masq_dest)
 447                         {
 448                                 fw3_pr("-A zone_%s_postrouting ", zone->name);
 449                                 fw3_format_src_dest(msrc, mdest);
 450                                 fw3_pr("-j MASQUERADE\n");
 451                         }
 452                 }
 453                 break;
 454
 455         case FW3_TABLE_RAW:
 456         case FW3_TABLE_MANGLE:
 457                 break;
 458         }
 459
 460         print_interface_rules(table, family, zone, disable_notrack);
 461 }
 462
 463 void
 464 fw3_print_zone_chains(enum fw3_table table, enum fw3_family family,
 465                       struct fw3_state *state)
 466 {
 467         struct fw3_zone *zone;
 468
 469         list_for_each_entry(zone, &state->zones, list)
 470                 print_zone_chain(table, family, zone, state);
 471 }
 472
 473 void
 474 fw3_print_zone_rules(enum fw3_table table, enum fw3_family family,
 475                      struct fw3_state *state)
 476 {
 477         struct fw3_zone *zone;
 478
 479         list_for_each_entry(zone, &state->zones, list)
 480                 print_zone_rule(table, family, zone, state->defaults.drop_invalid);
 481 }
 482
 483 void
 484 fw3_flush_zones(enum fw3_table table, enum fw3_family family,
 485                             bool pass2, struct fw3_state *state)
 486 {
 487         struct fw3_zone *z, *tmp;
 488         int mask = (1 << FW3_FAMILY_V4) | (1 << FW3_FAMILY_V6);
 489
 490         list_for_each_entry_safe(z, tmp, &state->running_zones, running_list)
 491         {
 492                 if (!hasbit(z->dst_flags, family))
 493                         continue;
 494
 495                 print_chains(table, family, pass2 ? "-X %s\n" : "-F %s\n",
 496                              z->name, z->src_flags, src_chains, ARRAY_SIZE(src_chains));
 497
 498                 print_chains(table, family, pass2 ? "-X %s\n" : "-F %s\n",
 499                              z->name, z->dst_flags, dst_chains, ARRAY_SIZE(dst_chains));
 500
 501                 if (pass2)
 502                 {
 503                         delbit(z->dst_flags, family);
 504
 505                         if (!(z->dst_flags & mask))
 506                                 fw3_set_running(z, NULL);
 507                 }
 508         }
 509 }
 510
 511 struct fw3_zone *
 512 fw3_lookup_zone(struct fw3_state *state, const char *name, bool running)
 513 {
 514         struct fw3_zone *z;
 515
 516         if (list_empty(&state->zones))
 517                 return NULL;
 518
 519         list_for_each_entry(z, &state->zones, list)
 520         {
 521                 if (strcmp(z->name, name))
 522                         continue;
 523
 524                 if (!running || z->running_list.next)
 525                         return z;
 526
 527                 break;
 528         }
 529
 530         return NULL;
 531 }