Infer destination zone of DNAT redirects from dest_ip option
[project/firewall3.git] / zones.c
1 /*
2  * firewall3 - 3rd OpenWrt UCI firewall implementation
3  *
4  *   Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
5  *
6  * Permission to use, copy, modify, and/or distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18
19 #include "zones.h"
20 #include "ubus.h"
21
22
23 #define C(f, tbl, tgt, fmt) \
24         { FW3_FAMILY_##f, FW3_TABLE_##tbl, FW3_FLAG_##tgt, fmt }
25
26 static const struct fw3_chain_spec zone_chains[] = {
27         C(ANY, FILTER, UNSPEC,        "zone_%s_input"),
28         C(ANY, FILTER, UNSPEC,        "zone_%s_output"),
29         C(ANY, FILTER, UNSPEC,        "zone_%s_forward"),
30
31         C(ANY, FILTER, SRC_ACCEPT,    "zone_%s_src_ACCEPT"),
32         C(ANY, FILTER, SRC_REJECT,    "zone_%s_src_REJECT"),
33         C(ANY, FILTER, SRC_DROP,      "zone_%s_src_DROP"),
34
35         C(ANY, FILTER, ACCEPT,        "zone_%s_dest_ACCEPT"),
36         C(ANY, FILTER, REJECT,        "zone_%s_dest_REJECT"),
37         C(ANY, FILTER, DROP,          "zone_%s_dest_DROP"),
38
39         C(V4,  NAT,    SNAT,          "zone_%s_postrouting"),
40         C(V4,  NAT,    DNAT,          "zone_%s_prerouting"),
41
42         C(ANY, FILTER, CUSTOM_CHAINS, "input_%s_rule"),
43         C(ANY, FILTER, CUSTOM_CHAINS, "output_%s_rule"),
44         C(ANY, FILTER, CUSTOM_CHAINS, "forwarding_%s_rule"),
45
46         C(V4,  NAT,    CUSTOM_CHAINS, "prerouting_%s_rule"),
47         C(V4,  NAT,    CUSTOM_CHAINS, "postrouting_%s_rule"),
48
49         { }
50 };
51
52 const struct fw3_option fw3_zone_opts[] = {
53         FW3_OPT("enabled",             bool,     zone,     enabled),
54
55         FW3_OPT("name",                string,   zone,     name),
56         FW3_OPT("family",              family,   zone,     family),
57
58         FW3_LIST("network",            device,   zone,     networks),
59         FW3_LIST("device",             device,   zone,     devices),
60         FW3_LIST("subnet",             network,  zone,     subnets),
61
62         FW3_OPT("input",               target,   zone,     policy_input),
63         FW3_OPT("forward",             target,   zone,     policy_forward),
64         FW3_OPT("output",              target,   zone,     policy_output),
65
66         FW3_OPT("masq",                bool,     zone,     masq),
67         FW3_LIST("masq_src",           network,  zone,     masq_src),
68         FW3_LIST("masq_dest",          network,  zone,     masq_dest),
69
70         FW3_OPT("extra",               string,   zone,     extra_src),
71         FW3_OPT("extra_src",           string,   zone,     extra_src),
72         FW3_OPT("extra_dest",          string,   zone,     extra_dest),
73
74         FW3_OPT("conntrack",           bool,     zone,     conntrack),
75         FW3_OPT("mtu_fix",             bool,     zone,     mtu_fix),
76         FW3_OPT("custom_chains",       bool,     zone,     custom_chains),
77
78         FW3_OPT("log",                 bool,     zone,     log),
79         FW3_OPT("log_limit",           limit,    zone,     log_limit),
80
81         FW3_OPT("__flags_v4",          int,      zone,     flags[0]),
82         FW3_OPT("__flags_v6",          int,      zone,     flags[1]),
83
84         { }
85 };
86
87
88 static void
89 check_policy(struct uci_element *e, enum fw3_flag *pol, enum fw3_flag def,
90              const char *name)
91 {
92         if (*pol == FW3_FLAG_UNSPEC)
93         {
94                 warn_elem(e, "has no %s policy specified, using default", name);
95                 *pol = def;
96         }
97         else if (*pol > FW3_FLAG_DROP)
98         {
99                 warn_elem(e, "has invalid %s policy, using default", name);
100                 *pol = def;
101         }
102 }
103
104 static void
105 resolve_networks(struct uci_element *e, struct fw3_zone *zone)
106 {
107         struct fw3_device *net, *tmp;
108
109         list_for_each_entry(net, &zone->networks, list)
110         {
111                 tmp = fw3_ubus_device(net->name);
112
113                 if (!tmp)
114                 {
115                         warn_elem(e, "cannot resolve device of network '%s'", net->name);
116                         continue;
117                 }
118
119                 snprintf(tmp->network, sizeof(tmp->network), "%s", net->name);
120                 list_add_tail(&tmp->list, &zone->devices);
121         }
122 }
123
124 struct fw3_zone *
125 fw3_alloc_zone(void)
126 {
127         struct fw3_zone *zone;
128
129         zone = malloc(sizeof(*zone));
130
131         if (!zone)
132                 return NULL;
133
134         memset(zone, 0, sizeof(*zone));
135
136         INIT_LIST_HEAD(&zone->networks);
137         INIT_LIST_HEAD(&zone->devices);
138         INIT_LIST_HEAD(&zone->subnets);
139         INIT_LIST_HEAD(&zone->masq_src);
140         INIT_LIST_HEAD(&zone->masq_dest);
141
142         zone->enabled = true;
143         zone->custom_chains = true;
144         zone->log_limit.rate = 10;
145
146         return zone;
147 }
148
149 void
150 fw3_load_zones(struct fw3_state *state, struct uci_package *p)
151 {
152         struct uci_section *s;
153         struct uci_element *e;
154         struct fw3_zone *zone;
155         struct fw3_defaults *defs = &state->defaults;
156
157         INIT_LIST_HEAD(&state->zones);
158
159         uci_foreach_element(&p->sections, e)
160         {
161                 s = uci_to_section(e);
162
163                 if (strcmp(s->type, "zone"))
164                         continue;
165
166                 zone = fw3_alloc_zone();
167
168                 if (!zone)
169                         continue;
170
171                 fw3_parse_options(zone, fw3_zone_opts, s);
172
173                 if (!zone->enabled)
174                 {
175                         fw3_free_zone(zone);
176                         continue;
177                 }
178
179                 if (!zone->extra_dest)
180                         zone->extra_dest = zone->extra_src;
181
182                 if (!defs->custom_chains && zone->custom_chains)
183                         zone->custom_chains = false;
184
185                 if (!zone->name || !*zone->name)
186                 {
187                         warn_elem(e, "has no name - ignoring");
188                         fw3_free_zone(zone);
189                         continue;
190                 }
191
192                 if (strlen(zone->name) > FW3_ZONE_MAXNAMELEN)
193                 {
194                         warn_elem(e, "must not have a name longer than %u characters",
195                                      FW3_ZONE_MAXNAMELEN);
196                         fw3_free_zone(zone);
197                         continue;
198                 }
199
200                 if (list_empty(&zone->networks) && list_empty(&zone->devices) &&
201                     list_empty(&zone->subnets) && !zone->extra_src)
202                 {
203                         warn_elem(e, "has no device, network, subnet or extra options");
204                 }
205
206                 check_policy(e, &zone->policy_input, defs->policy_input, "input");
207                 check_policy(e, &zone->policy_output, defs->policy_output, "output");
208                 check_policy(e, &zone->policy_forward, defs->policy_forward, "forward");
209
210                 resolve_networks(e, zone);
211
212                 if (zone->masq)
213                 {
214                         setbit(zone->flags[0], FW3_FLAG_SNAT);
215                         zone->conntrack = true;
216                 }
217
218                 if (zone->custom_chains)
219                 {
220                         setbit(zone->flags[0], FW3_FLAG_SNAT);
221                         setbit(zone->flags[0], FW3_FLAG_DNAT);
222                 }
223
224                 setbit(zone->flags[0], fw3_to_src_target(zone->policy_input));
225                 setbit(zone->flags[0], zone->policy_output);
226                 setbit(zone->flags[0], zone->policy_forward);
227
228                 setbit(zone->flags[1], fw3_to_src_target(zone->policy_input));
229                 setbit(zone->flags[1], zone->policy_output);
230                 setbit(zone->flags[1], zone->policy_forward);
231
232                 list_add_tail(&zone->list, &state->zones);
233         }
234 }
235
236
237 static void
238 print_zone_chain(struct fw3_ipt_handle *handle, struct fw3_state *state,
239                  bool reload, struct fw3_zone *zone)
240 {
241         int i;
242         struct fw3_ipt_rule *r;
243         const struct fw3_chain_spec *c;
244
245         const char *flt_chains[] = {
246                 "input",   "input",
247                 "output",  "output",
248                 "forward", "forwarding",
249         };
250
251         const char *nat_chains[] = {
252                 "prerouting",  "prerouting",
253                 "postrouting", "postrouting",
254         };
255
256         if (!fw3_is_family(zone, handle->family))
257                 return;
258
259         info("   * Zone '%s'", zone->name);
260
261         set(zone->flags, handle->family, handle->table);
262
263         if (zone->custom_chains)
264                 set(zone->flags, handle->family, FW3_FLAG_CUSTOM_CHAINS);
265
266         if (!zone->conntrack && !state->defaults.drop_invalid)
267                 set(zone->flags, handle->family, FW3_FLAG_NOTRACK);
268
269         for (c = zone_chains; c->format; c++)
270         {
271                 /* don't touch user chains on selective stop */
272                 if (reload && c->flag == FW3_FLAG_CUSTOM_CHAINS)
273                         continue;
274
275                 if (!fw3_is_family(c, handle->family))
276                         continue;
277
278                 if (c->table != handle->table)
279                         continue;
280
281                 if (c->flag &&
282                     !hasbit(zone->flags[handle->family == FW3_FAMILY_V6], c->flag))
283                         continue;
284
285                 fw3_ipt_create_chain(handle, c->format, zone->name);
286         }
287
288         if (zone->custom_chains)
289         {
290                 if (handle->table == FW3_TABLE_FILTER)
291                 {
292                         for (i = 0; i < sizeof(flt_chains)/sizeof(flt_chains[0]); i += 2)
293                         {
294                                 r = fw3_ipt_rule_new(handle);
295                                 fw3_ipt_rule_comment(r, "user chain for %s", flt_chains[i+1]);
296                                 fw3_ipt_rule_target(r, "%s_%s_rule", flt_chains[i+1], zone->name);
297                                 fw3_ipt_rule_append(r, "zone_%s_%s", zone->name, flt_chains[i]);
298                         }
299                 }
300                 else if (handle->table == FW3_TABLE_NAT)
301                 {
302                         for (i = 0; i < sizeof(nat_chains)/sizeof(nat_chains[0]); i += 2)
303                         {
304                                 r = fw3_ipt_rule_new(handle);
305                                 fw3_ipt_rule_comment(r, "user chain for %s", nat_chains[i+1]);
306                                 fw3_ipt_rule_target(r, "%s_%s_rule", nat_chains[i+1], zone->name);
307                                 fw3_ipt_rule_append(r, "zone_%s_%s", zone->name, nat_chains[i]);
308                         }
309                 }
310         }
311
312         set(zone->flags, handle->family, handle->table);
313 }
314
315 static void
316 print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
317                                          bool reload, struct fw3_zone *zone,
318                      struct fw3_device *dev, struct fw3_address *sub)
319 {
320         bool disable_notrack = state->defaults.drop_invalid;
321         struct fw3_protocol tcp = { .protocol = 6 };
322         struct fw3_ipt_rule *r;
323         enum fw3_flag t;
324
325         char buf[32];
326
327         int i;
328
329         const char *chains[] = {
330                 "input",
331                 "output",
332                 "forward",
333         };
334
335 #define jump_target(t) \
336         ((t == FW3_FLAG_REJECT) ? "reject" : fw3_flag_names[t])
337
338         if (handle->table == FW3_TABLE_FILTER)
339         {
340                 for (t = FW3_FLAG_ACCEPT; t <= FW3_FLAG_DROP; t++)
341                 {
342                         if (has(zone->flags, handle->family, fw3_to_src_target(t)))
343                         {
344                                 r = fw3_ipt_rule_create(handle, NULL, dev, NULL, sub, NULL);
345                                 fw3_ipt_rule_target(r, jump_target(t));
346                                 fw3_ipt_rule_extra(r, zone->extra_src);
347                                 fw3_ipt_rule_append(r, "zone_%s_src_%s", zone->name,
348                                                     fw3_flag_names[t]);
349                         }
350
351                         if (has(zone->flags, handle->family, t))
352                         {
353                                 r = fw3_ipt_rule_create(handle, NULL, NULL, dev, NULL, sub);
354                                 fw3_ipt_rule_target(r, jump_target(t));
355                                 fw3_ipt_rule_extra(r, zone->extra_dest);
356                                 fw3_ipt_rule_append(r, "zone_%s_dest_%s", zone->name,
357                                                     fw3_flag_names[t]);
358                         }
359                 }
360
361                 for (i = 0; i < sizeof(chains)/sizeof(chains[0]); i++)
362                 {
363                         if (*chains[i] == 'o')
364                                 r = fw3_ipt_rule_create(handle, NULL, NULL, dev, NULL, sub);
365                         else
366                                 r = fw3_ipt_rule_create(handle, NULL, dev, NULL, sub, NULL);
367
368                         fw3_ipt_rule_target(r, "zone_%s_%s", zone->name, chains[i]);
369
370                         if (*chains[i] == 'o')
371                                 fw3_ipt_rule_extra(r, zone->extra_dest);
372                         else
373                                 fw3_ipt_rule_extra(r, zone->extra_src);
374
375                         fw3_ipt_rule_append(r, "delegate_%s", chains[i]);
376                 }
377         }
378         else if (handle->table == FW3_TABLE_NAT)
379         {
380                 if (has(zone->flags, handle->family, FW3_FLAG_DNAT))
381                 {
382                         r = fw3_ipt_rule_create(handle, NULL, dev, NULL, sub, NULL);
383                         fw3_ipt_rule_target(r, "zone_%s_prerouting", zone->name);
384                         fw3_ipt_rule_extra(r, zone->extra_src);
385                         fw3_ipt_rule_append(r, "delegate_prerouting");
386                 }
387
388                 if (has(zone->flags, handle->family, FW3_FLAG_SNAT))
389                 {
390                         r = fw3_ipt_rule_create(handle, NULL, NULL, dev, NULL, sub);
391                         fw3_ipt_rule_target(r, "zone_%s_postrouting", zone->name);
392                         fw3_ipt_rule_extra(r, zone->extra_dest);
393                         fw3_ipt_rule_append(r, "delegate_postrouting");
394                 }
395         }
396         else if (handle->table == FW3_TABLE_MANGLE)
397         {
398                 if (zone->mtu_fix)
399                 {
400                         if (zone->log)
401                         {
402                                 snprintf(buf, sizeof(buf) - 1, "MSSFIX(%s): ", zone->name);
403
404                                 r = fw3_ipt_rule_create(handle, &tcp, NULL, dev, NULL, sub);
405                                 fw3_ipt_rule_addarg(r, false, "--tcp-flags", "SYN,RST");
406                                 fw3_ipt_rule_addarg(r, false, "SYN", NULL);
407                                 fw3_ipt_rule_limit(r, &zone->log_limit);
408                                 fw3_ipt_rule_comment(r, "%s (mtu_fix logging)", zone->name);
409                                 fw3_ipt_rule_target(r, "LOG");
410                                 fw3_ipt_rule_addarg(r, false, "--log-prefix", buf);
411                                 fw3_ipt_rule_append(r, "mssfix");
412                         }
413
414                         r = fw3_ipt_rule_create(handle, &tcp, NULL, dev, NULL, sub);
415                         fw3_ipt_rule_addarg(r, false, "--tcp-flags", "SYN,RST");
416                         fw3_ipt_rule_addarg(r, false, "SYN", NULL);
417                         fw3_ipt_rule_comment(r, "%s (mtu_fix)", zone->name);
418                         fw3_ipt_rule_target(r, "TCPMSS");
419                         fw3_ipt_rule_addarg(r, false, "--clamp-mss-to-pmtu", NULL);
420                         fw3_ipt_rule_append(r, "mssfix");
421                 }
422         }
423         else if (handle->table == FW3_TABLE_RAW)
424         {
425                 if (!zone->conntrack && !disable_notrack)
426                 {
427                         r = fw3_ipt_rule_create(handle, NULL, dev, NULL, sub, NULL);
428                         fw3_ipt_rule_target(r, "CT");
429                         fw3_ipt_rule_addarg(r, false, "--notrack", NULL);
430                         fw3_ipt_rule_extra(r, zone->extra_src);
431                         fw3_ipt_rule_append(r, "notrack");
432                 }
433         }
434 }
435
436 static void
437 print_interface_rules(struct fw3_ipt_handle *handle, struct fw3_state *state,
438                       bool reload, struct fw3_zone *zone)
439 {
440         struct fw3_device *dev;
441         struct fw3_address *sub;
442
443         fw3_foreach(dev, &zone->devices)
444         fw3_foreach(sub, &zone->subnets)
445         {
446                 if (!fw3_is_family(sub, handle->family))
447                         continue;
448
449                 if (!dev && !sub)
450                         continue;
451
452                 print_interface_rule(handle, state, reload, zone, dev, sub);
453         }
454 }
455
456 static void
457 print_zone_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
458                 bool reload, struct fw3_zone *zone)
459 {
460         struct fw3_address *msrc;
461         struct fw3_address *mdest;
462         struct fw3_ipt_rule *r;
463
464         enum fw3_flag t;
465         char buf[32];
466
467         if (!fw3_is_family(zone, handle->family))
468                 return;
469
470         switch (handle->table)
471         {
472         case FW3_TABLE_FILTER:
473                 r = fw3_ipt_rule_new(handle);
474                 fw3_ipt_rule_target(r, "zone_%s_src_%s", zone->name,
475                                      fw3_flag_names[zone->policy_input]);
476                 fw3_ipt_rule_append(r, "zone_%s_input", zone->name);
477
478                 r = fw3_ipt_rule_new(handle);
479                 fw3_ipt_rule_target(r, "zone_%s_dest_%s", zone->name,
480                                      fw3_flag_names[zone->policy_forward]);
481                 fw3_ipt_rule_append(r, "zone_%s_forward", zone->name);
482
483                 r = fw3_ipt_rule_new(handle);
484                 fw3_ipt_rule_target(r, "zone_%s_dest_%s", zone->name,
485                                      fw3_flag_names[zone->policy_output]);
486                 fw3_ipt_rule_append(r, "zone_%s_output", zone->name);
487
488                 if (zone->log)
489                 {
490                         for (t = FW3_FLAG_REJECT; t <= FW3_FLAG_DROP; t++)
491                         {
492                                 if (has(zone->flags, handle->family, fw3_to_src_target(t)))
493                                 {
494                                         r = fw3_ipt_rule_new(handle);
495
496                                         snprintf(buf, sizeof(buf) - 1, "%s(src %s)",
497                                                  fw3_flag_names[t], zone->name);
498
499                                         fw3_ipt_rule_limit(r, &zone->log_limit);
500                                         fw3_ipt_rule_target(r, "LOG");
501                                         fw3_ipt_rule_addarg(r, false, "--log-prefix", buf);
502                                         fw3_ipt_rule_append(r, "zone_%s_src_%s",
503                                                             zone->name, fw3_flag_names[t]);
504                                 }
505
506                                 if (has(zone->flags, handle->family, t))
507                                 {
508                                         r = fw3_ipt_rule_new(handle);
509
510                                         snprintf(buf, sizeof(buf) - 1, "%s(dest %s)",
511                                                  fw3_flag_names[t], zone->name);
512
513                                         fw3_ipt_rule_limit(r, &zone->log_limit);
514                                         fw3_ipt_rule_target(r, "LOG");
515                                         fw3_ipt_rule_addarg(r, false, "--log-prefix", buf);
516                                         fw3_ipt_rule_append(r, "zone_%s_dest_%s",
517                                                             zone->name, fw3_flag_names[t]);
518                                 }
519                         }
520                 }
521                 break;
522
523         case FW3_TABLE_NAT:
524                 if (zone->masq && handle->family == FW3_FAMILY_V4)
525                 {
526                         fw3_foreach(msrc, &zone->masq_src)
527                         fw3_foreach(mdest, &zone->masq_dest)
528                         {
529                                 if (!fw3_is_family(msrc, handle->family) ||
530                                     !fw3_is_family(mdest, handle->family))
531                                         continue;
532
533                                 r = fw3_ipt_rule_new(handle);
534                                 fw3_ipt_rule_src_dest(r, msrc, mdest);
535                                 fw3_ipt_rule_target(r, "MASQUERADE");
536                                 fw3_ipt_rule_append(r, "zone_%s_postrouting", zone->name);
537                         }
538                 }
539                 break;
540
541         case FW3_TABLE_RAW:
542         case FW3_TABLE_MANGLE:
543                 break;
544         }
545
546         print_interface_rules(handle, state, reload, zone);
547 }
548
549 void
550 fw3_print_zone_chains(struct fw3_ipt_handle *handle, struct fw3_state *state,
551                       bool reload)
552 {
553         struct fw3_zone *zone;
554
555         list_for_each_entry(zone, &state->zones, list)
556                 print_zone_chain(handle, state, reload, zone);
557 }
558
559 void
560 fw3_print_zone_rules(struct fw3_ipt_handle *handle, struct fw3_state *state,
561                      bool reload)
562 {
563         struct fw3_zone *zone;
564
565         list_for_each_entry(zone, &state->zones, list)
566                 print_zone_rule(handle, state, reload, zone);
567 }
568
569 void
570 fw3_flush_zones(struct fw3_ipt_handle *handle, struct fw3_state *state,
571                 bool reload)
572 {
573         struct fw3_zone *z, *tmp;
574         const struct fw3_chain_spec *c;
575         char chain[32];
576
577         list_for_each_entry_safe(z, tmp, &state->zones, list)
578         {
579                 if (!has(z->flags, handle->family, handle->table))
580                         continue;
581
582                 for (c = zone_chains; c->format; c++)
583                 {
584                         /* don't touch user chains on selective stop */
585                         if (reload && c->flag == FW3_FLAG_CUSTOM_CHAINS)
586                                 continue;
587
588                         if (!fw3_is_family(c, handle->family))
589                                 continue;
590
591                         if (c->table != handle->table)
592                                 continue;
593
594                         if (c->flag && !has(z->flags, handle->family, c->flag))
595                                 continue;
596
597                         snprintf(chain, sizeof(chain), c->format, z->name);
598                         fw3_ipt_delete_rules(handle, chain);
599                         fw3_ipt_delete_chain(handle, chain);
600                 }
601
602                 del(z->flags, handle->family, handle->table);
603         }
604 }
605
606 void
607 fw3_hotplug_zones(struct fw3_state *state, bool add)
608 {
609         struct fw3_zone *z;
610         struct fw3_device *d;
611
612         list_for_each_entry(z, &state->zones, list)
613         {
614                 if (add != hasbit(z->flags[0], FW3_FLAG_HOTPLUG))
615                 {
616                         list_for_each_entry(d, &z->devices, list)
617                                 fw3_hotplug(add, z, d);
618
619                         if (add)
620                                 setbit(z->flags[0], FW3_FLAG_HOTPLUG);
621                         else
622                                 delbit(z->flags[0], FW3_FLAG_HOTPLUG);
623                 }
624         }
625 }
626
627 struct fw3_zone *
628 fw3_lookup_zone(struct fw3_state *state, const char *name)
629 {
630         struct fw3_zone *z;
631
632         if (list_empty(&state->zones))
633                 return NULL;
634
635         list_for_each_entry(z, &state->zones, list)
636         {
637                 if (strcmp(z->name, name))
638                         continue;
639
640                 return z;
641         }
642
643         return NULL;
644 }
645
646 struct list_head *
647 fw3_resolve_zone_addresses(struct fw3_zone *zone)
648 {
649         struct fw3_device *net;
650         struct fw3_address *addr, *tmp;
651         struct list_head *addrs, *all;
652
653         all = malloc(sizeof(*all));
654
655         if (!all)
656                 return NULL;
657
658         memset(all, 0, sizeof(*all));
659         INIT_LIST_HEAD(all);
660
661         list_for_each_entry(net, &zone->networks, list)
662         {
663                 addrs = fw3_ubus_address(net->name);
664
665                 if (!addrs)
666                         continue;
667
668                 list_for_each_entry_safe(addr, tmp, addrs, list)
669                 {
670                         list_del(&addr->list);
671                         list_add_tail(&addr->list, all);
672                 }
673
674                 free(addrs);
675         }
676
677         list_for_each_entry(addr, &zone->subnets, list)
678         {
679                 tmp = malloc(sizeof(*tmp));
680
681                 if (!tmp)
682                         continue;
683
684                 memcpy(tmp, addr, sizeof(*tmp));
685                 list_add_tail(&tmp->list, all);
686         }
687
688         return all;
689 }
690
691 void
692 fw3_free_zone(struct fw3_zone *zone)
693 {
694         struct fw3_device *dev, *tmp;
695
696         list_for_each_entry_safe(dev, tmp, &zone->devices, list)
697         {
698                 list_del(&dev->list);
699                 free(dev);
700         }
701
702         list_for_each_entry_safe(dev, tmp, &zone->networks, list)
703         {
704                 list_del(&dev->list);
705                 free(dev);
706         }
707
708         fw3_free_object(zone, fw3_zone_opts);
709 }