/*
* firewall3 - 3rd OpenWrt UCI firewall implementation
*
- * Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
+ * Copyright (C) 2013 Jo-Philipp Wich <jo@mein.io>
*
* Permission to use, copy, modify, and/or distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
#include "ubus.h"
+static struct blob_attr *interfaces = NULL;
+static struct blob_attr *procd_data;
-static struct ubus_context *ctx = NULL;
+
+static void dump_cb(struct ubus_request *req, int type, struct blob_attr *msg)
+{
+ static const struct blobmsg_policy policy = { "interface", BLOBMSG_TYPE_ARRAY };
+ struct blob_attr *cur;
+
+ blobmsg_parse(&policy, 1, &cur, blob_data(msg), blob_len(msg));
+ if (cur)
+ interfaces = blob_memdup(cur);
+}
+
+static void procd_data_cb(struct ubus_request *req, int type, struct blob_attr *msg)
+{
+ procd_data = blob_memdup(msg);
+}
bool
fw3_ubus_connect(void)
{
- ctx = ubus_connect(NULL);
- return !!ctx;
+ bool status = false;
+ uint32_t id;
+ struct ubus_context *ctx = ubus_connect(NULL);
+ struct blob_buf b = { };
+
+ if (!ctx)
+ goto out;
+
+ if (ubus_lookup_id(ctx, "network.interface", &id))
+ goto out;
+
+ if (ubus_invoke(ctx, id, "dump", NULL, dump_cb, NULL, 500))
+ goto out;
+
+ status = true;
+
+ if (ubus_lookup_id(ctx, "service", &id))
+ goto out;
+
+ blob_buf_init(&b, 0);
+ blobmsg_add_string(&b, "type", "firewall");
+ ubus_invoke(ctx, id, "get_data", b.head, procd_data_cb, NULL, 2000);
+ blob_buf_free(&b);
+
+out:
+ if (ctx)
+ ubus_free(ctx);
+ return status;
}
void
fw3_ubus_disconnect(void)
{
- if (!ctx)
- return;
-
- ubus_free(ctx);
- ctx = NULL;
+ free(interfaces);
+ interfaces = NULL;
}
static struct fw3_address *
struct blob_attr *cur;
struct fw3_address *addr;
- addr = malloc(sizeof(*addr));
-
+ addr = calloc(1, sizeof(*addr));
if (!addr)
return NULL;
- memset(addr, 0, sizeof(*addr));
-
addr->set = true;
addr->family = family;
{
if (!strcmp(blobmsg_name(cur), "address"))
inet_pton(family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
- blobmsg_data(cur), &addr->address.v6);
+ blobmsg_get_string(cur), &addr->address.v6);
else if (!strcmp(blobmsg_name(cur), "mask"))
- addr->mask = be32_to_cpu(*(uint32_t *)blobmsg_data(cur));
+ fw3_bitlen2netmask(family, blobmsg_get_u32(cur), &addr->mask.v6);
}
return addr;
static void
parse_subnets(struct list_head *head, enum fw3_family family,
- struct blob_attr *list, int rem)
+ struct blob_attr *list)
{
struct blob_attr *cur;
struct fw3_address *addr;
+ int rem;
- __blob_for_each_attr(cur, list, rem)
+ if (!list)
+ return;
+
+ rem = blobmsg_data_len(list);
+
+ __blob_for_each_attr(cur, blobmsg_data(list), rem)
{
addr = parse_subnet(family, blobmsg_data(cur), blobmsg_data_len(cur));
}
}
-struct dev_addr
-{
- struct fw3_device *dev;
- struct list_head *addr;
-};
-
-static void
-invoke_cb(struct ubus_request *req, int type, struct blob_attr *msg)
+struct fw3_device *
+fw3_ubus_device(const char *net)
{
- int rem;
- char *data;
+ enum {
+ DEV_INTERFACE,
+ DEV_DEVICE,
+ DEV_L3_DEVICE,
+ __DEV_MAX
+ };
+ static const struct blobmsg_policy policy[__DEV_MAX] = {
+ [DEV_INTERFACE] = { "interface", BLOBMSG_TYPE_STRING },
+ [DEV_DEVICE] = { "device", BLOBMSG_TYPE_STRING },
+ [DEV_L3_DEVICE] = { "l3_device", BLOBMSG_TYPE_STRING },
+ };
+ struct fw3_device *dev = NULL;
+ struct blob_attr *tb[__DEV_MAX];
struct blob_attr *cur;
- struct dev_addr *da = (struct dev_addr *)req->priv;
- struct fw3_device *dev = da->dev;
+ char *name = NULL;
+ int rem;
- if (!msg)
- return;
+ if (!net || !interfaces)
+ return NULL;
- rem = blob_len(msg);
- __blob_for_each_attr(cur, blob_data(msg), rem)
- {
- data = blobmsg_data(cur);
-
- if (dev && !strcmp(blobmsg_name(cur), "device") && !dev->name[0])
- snprintf(dev->name, sizeof(dev->name), "%s", data);
- else if (dev && !strcmp(blobmsg_name(cur), "l3_device"))
- snprintf(dev->name, sizeof(dev->name), "%s", data);
- else if (!dev && !strcmp(blobmsg_name(cur), "ipv4-address"))
- parse_subnets(da->addr, FW3_FAMILY_V4,
- blobmsg_data(cur), blobmsg_data_len(cur));
- else if (!dev && (!strcmp(blobmsg_name(cur), "ipv6-address") ||
- !strcmp(blobmsg_name(cur), "ipv6-prefix-assignment")))
- parse_subnets(da->addr, FW3_FAMILY_V6,
- blobmsg_data(cur), blobmsg_data_len(cur));
- }
+ blobmsg_for_each_attr(cur, interfaces, rem) {
+ blobmsg_parse(policy, __DEV_MAX, tb, blobmsg_data(cur), blobmsg_len(cur));
+ if (!tb[DEV_INTERFACE] ||
+ strcmp(blobmsg_data(tb[DEV_INTERFACE]), net) != 0)
+ continue;
- if (dev)
- dev->set = !!dev->name[0];
-}
+ if (tb[DEV_L3_DEVICE])
+ name = blobmsg_data(tb[DEV_L3_DEVICE]);
+ else if (tb[DEV_DEVICE])
+ name = blobmsg_data(tb[DEV_DEVICE]);
+ else
+ continue;
-static void *
-invoke_common(const char *net, bool dev)
-{
- uint32_t id;
- char path[128];
- static struct dev_addr da;
+ break;
+ }
- if (!net)
+ if (!name)
return NULL;
- memset(&da, 0, sizeof(da));
-
- if (dev)
- da.dev = malloc(sizeof(*da.dev));
- else
- da.addr = malloc(sizeof(*da.addr));
-
- if ((dev && !da.dev) || (!dev && !da.addr))
- goto fail;
-
- if (dev)
- memset(da.dev, 0, sizeof(*da.dev));
- else
- INIT_LIST_HEAD(da.addr);
+ dev = calloc(1, sizeof(*dev));
- snprintf(path, sizeof(path), "network.interface.%s", net);
+ if (!dev)
+ return NULL;
- if (ubus_lookup_id(ctx, path, &id))
- goto fail;
+ snprintf(dev->name, sizeof(dev->name), "%s", name);
+ dev->set = true;
- if (ubus_invoke(ctx, id, "status", NULL, invoke_cb, &da, 500))
- goto fail;
+ return dev;
+}
- if (dev && da.dev->set)
- return da.dev;
- else if (!dev && !list_empty(da.addr))
- return da.addr;
+void
+fw3_ubus_address(struct list_head *list, const char *net)
+{
+ enum {
+ ADDR_INTERFACE,
+ ADDR_IPV4,
+ ADDR_IPV6,
+ ADDR_IPV6_PREFIX,
+ __ADDR_MAX
+ };
+ static const struct blobmsg_policy policy[__ADDR_MAX] = {
+ [ADDR_INTERFACE] = { "interface", BLOBMSG_TYPE_STRING },
+ [ADDR_IPV4] = { "ipv4-address", BLOBMSG_TYPE_ARRAY },
+ [ADDR_IPV6] = { "ipv6-address", BLOBMSG_TYPE_ARRAY },
+ [ADDR_IPV6_PREFIX] = { "ipv6-prefix-assignment", BLOBMSG_TYPE_ARRAY },
+ };
+ struct blob_attr *tb[__ADDR_MAX];
+ struct blob_attr *cur;
+ int rem;
-fail:
- if (da.dev)
- free(da.dev);
+ if (!net || !interfaces)
+ return;
- if (da.addr)
- free(da.addr);
+ blobmsg_for_each_attr(cur, interfaces, rem) {
+ blobmsg_parse(policy, __ADDR_MAX, tb, blobmsg_data(cur), blobmsg_len(cur));
- return NULL;
-}
+ if (!tb[ADDR_INTERFACE] ||
+ strcmp(blobmsg_data(tb[ADDR_INTERFACE]), net) != 0)
+ continue;
-struct fw3_device *
-fw3_ubus_device(const char *net)
-{
- return invoke_common(net, true);
+ parse_subnets(list, FW3_FAMILY_V4, tb[ADDR_IPV4]);
+ parse_subnets(list, FW3_FAMILY_V6, tb[ADDR_IPV6]);
+ parse_subnets(list, FW3_FAMILY_V6, tb[ADDR_IPV6_PREFIX]);
+ }
}
-struct list_head *
-fw3_ubus_address(const char *net)
+void
+fw3_ubus_zone_devices(struct fw3_zone *zone)
{
- return invoke_common(net, false);
+ struct blob_attr *c, *cur, *dcur;
+ unsigned r, rem, drem;
+ const char *name;
+ bool matches;
+
+ blobmsg_for_each_attr(c, interfaces, r) {
+ name = NULL;
+ matches = false;
+
+ blobmsg_for_each_attr(cur, c, rem) {
+ if (!strcmp(blobmsg_name(cur), "interface"))
+ name = blobmsg_get_string(cur);
+ else if (!strcmp(blobmsg_name(cur), "data"))
+ blobmsg_for_each_attr(dcur, cur, drem)
+ if (!strcmp(blobmsg_name(dcur), "zone"))
+ matches = !strcmp(blobmsg_get_string(dcur), zone->name);
+ }
+
+ if (name && matches)
+ fw3_parse_device(&zone->networks, name, true);
+ }
}
void
-fw3_ubus_address_free(struct list_head *list)
+fw3_ubus_rules(struct blob_buf *b)
{
- struct fw3_address *addr, *tmp;
-
- list_for_each_entry_safe(addr, tmp, list, list)
- {
- list_del(&addr->list);
- free(addr);
+ blob_buf_init(b, 0);
+
+ struct blob_attr *c, *cur, *dcur, *rule, *ropt;
+ unsigned n, r, rem, drem, rrem, orem;
+ char comment[256];
+
+ blobmsg_for_each_attr(c, interfaces, r) {
+ const char *l3_device = NULL;
+ const char *iface_proto = "unknown";
+ const char *iface_name = "unknown";
+ struct blob_attr *data = NULL;
+
+ blobmsg_for_each_attr(cur, c, rem) {
+ if (!strcmp(blobmsg_name(cur), "l3_device"))
+ l3_device = blobmsg_get_string(cur);
+ else if (!strcmp(blobmsg_name(cur), "interface"))
+ iface_name = blobmsg_get_string(cur);
+ else if (!strcmp(blobmsg_name(cur), "proto"))
+ iface_proto = blobmsg_get_string(cur);
+ else if (!strcmp(blobmsg_name(cur), "data"))
+ data = cur;
+ }
+
+ if (!data || !l3_device)
+ continue;
+
+ blobmsg_for_each_attr(dcur, data, drem) {
+ if (strcmp(blobmsg_name(dcur), "firewall"))
+ continue;
+
+ n = 0;
+
+ blobmsg_for_each_attr(rule, dcur, rrem) {
+ void *k = blobmsg_open_table(b, "");
+
+ snprintf(comment, sizeof(comment), "ubus:%s[%s] rule %d",
+ iface_name, iface_proto, n++);
+
+ blobmsg_for_each_attr(ropt, rule, orem) {
+ if (!strcmp(blobmsg_name(ropt), "device"))
+ l3_device = blobmsg_get_string(ropt);
+ else if (strcmp(blobmsg_name(ropt), "name"))
+ blobmsg_add_blob(b, ropt);
+ }
+
+ blobmsg_add_string(b, "name", comment);
+ blobmsg_add_string(b, "device", l3_device);
+ blobmsg_close_table(b, k);
+ }
+ }
}
- free(list);
+ if (!procd_data)
+ return;
+
+ /* service */
+ blobmsg_for_each_attr(c, procd_data, r) {
+ if (!blobmsg_check_attr(c, true))
+ continue;
+
+ /* instance */
+ blobmsg_for_each_attr(cur, c, rem) {
+ if (!blobmsg_check_attr(cur, true))
+ continue;
+
+ /* type */
+ blobmsg_for_each_attr(dcur, cur, drem) {
+ if (!blobmsg_check_attr(dcur, true))
+ continue;
+
+ n = 0;
+
+ blobmsg_for_each_attr(rule, dcur, rrem) {
+ void *k = blobmsg_open_table(b, "");
+
+ snprintf(comment, sizeof(comment), "ubus:%s[%s] rule %d",
+ blobmsg_name(c), blobmsg_name(cur), n++);
+
+ blobmsg_for_each_attr(ropt, rule, orem)
+ if (strcmp(blobmsg_name(ropt), "name"))
+ blobmsg_add_blob(b, ropt);
+
+ blobmsg_add_string(b, "name", comment);
+ blobmsg_close_table(b, k);
+ }
+ }
+ }
+ }
}
projects / project / firewall3.git / blobdiff