zones: disable masq when resolving of all masq_src or masq_dest items failed

[project/firewall3.git] / zones.c

diff --git a/zones.c b/zones.c
index a95e363..514d203 100644 (file)
--- a/zones.c
+++ b/zones.c
@@ -66,6 +66,7 @@ const struct fw3_option fw3_zone_opts[] = {
        FW3_OPT("output",              target,   zone,     policy_output),
 
        FW3_OPT("masq",                bool,     zone,     masq),
+       FW3_OPT("masq_allow_invalid",  bool,     zone,     masq_allow_invalid),
        FW3_LIST("masq_src",           network,  zone,     masq_src),
        FW3_LIST("masq_dest",          network,  zone,     masq_dest),
 
@@ -73,7 +74,6 @@ const struct fw3_option fw3_zone_opts[] = {
        FW3_OPT("extra_src",           string,   zone,     extra_src),
        FW3_OPT("extra_dest",          string,   zone,     extra_dest),
 
-       FW3_OPT("conntrack",           bool,     zone,     conntrack),
        FW3_OPT("mtu_fix",             bool,     zone,     mtu_fix),
        FW3_OPT("custom_chains",       bool,     zone,     custom_chains),
 
@@ -105,6 +105,26 @@ check_policy(struct uci_element *e, enum fw3_flag *pol, enum fw3_flag def,
        }
 }
 
+static bool
+check_masq_addrs(struct list_head *head)
+{
+       struct fw3_address *addr;
+       int n_addr = 0, n_failed = 0;
+
+       list_for_each_entry(addr, head, list)
+       {
+               if (addr->invert)
+                       continue;
+
+               n_addr++;
+
+               if (!addr->set && addr->resolved)
+                       n_failed++;
+       }
+
+       return (n_addr == 0 || n_failed < n_addr);
+}
+
 static void
 resolve_networks(struct uci_element *e, struct fw3_zone *zone)
 {
@@ -171,7 +191,8 @@ fw3_load_zones(struct fw3_state *state, struct uci_package *p)
                if (!zone)
                        continue;
 
-               fw3_parse_options(zone, fw3_zone_opts, s);
+               if (!fw3_parse_options(zone, fw3_zone_opts, s))
+                       warn_elem(e, "has invalid options");
 
                if (!zone->enabled)
                {
@@ -208,6 +229,18 @@ fw3_load_zones(struct fw3_state *state, struct uci_package *p)
                        warn_elem(e, "has no device, network, subnet or extra options");
                }
 
+               if (!check_masq_addrs(&zone->masq_src))
+               {
+                       warn_elem(e, "has unresolved masq_src, disabling masq");
+                       zone->masq = false;
+               }
+
+               if (!check_masq_addrs(&zone->masq_dest))
+               {
+                       warn_elem(e, "has unresolved masq_dest, disabling masq");
+                       zone->masq = false;
+               }
+
                check_policy(e, &zone->policy_input, defs->policy_input, "input");
                check_policy(e, &zone->policy_output, defs->policy_output, "output");
                check_policy(e, &zone->policy_forward, defs->policy_forward, "forward");
@@ -217,7 +250,6 @@ fw3_load_zones(struct fw3_state *state, struct uci_package *p)
                if (zone->masq)
                {
                        fw3_setbit(zone->flags[0], FW3_FLAG_SNAT);
-                       zone->conntrack = true;
                }
 
                if (zone->custom_chains)
@@ -268,9 +300,6 @@ print_zone_chain(struct fw3_ipt_handle *handle, struct fw3_state *state,
        if (zone->custom_chains)
                set(zone->flags, handle->family, FW3_FLAG_CUSTOM_CHAINS);
 
-       if (!zone->conntrack && !state->defaults.drop_invalid)
-               set(zone->flags, handle->family, FW3_FLAG_NOTRACK);
-
        for (c = zone_chains; c->format; c++)
        {
                /* don't touch user chains on selective stop */
@@ -359,14 +388,20 @@ print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
 
                        if (has(zone->flags, handle->family, t))
                        {
+                               if (t == FW3_FLAG_ACCEPT &&
+                                   zone->masq && !zone->masq_allow_invalid)
+                               {
+                                       r = fw3_ipt_rule_create(handle, NULL, NULL, dev, NULL, sub);
+                                       fw3_ipt_rule_extra(r, "-m conntrack --ctstate INVALID");
+                                       fw3_ipt_rule_comment(r, "Prevent NAT leakage");
+                                       fw3_ipt_rule_target(r, fw3_flag_names[FW3_FLAG_DROP]);
+                                       fw3_ipt_rule_replace(r, "zone_%s_dest_%s", zone->name,
+                                                            fw3_flag_names[t]);
+                               }
+
                                r = fw3_ipt_rule_create(handle, NULL, NULL, dev, NULL, sub);
                                fw3_ipt_rule_target(r, jump_target(t));
                                fw3_ipt_rule_extra(r, zone->extra_dest);
-
-                               if (t == FW3_FLAG_ACCEPT && !state->defaults.drop_invalid)
-                                       fw3_ipt_rule_extra(r,
-                                                          "-m conntrack --ctstate NEW,UNTRACKED");
-
                                fw3_ipt_rule_replace(r, "zone_%s_dest_%s", zone->name,
                                                     fw3_flag_names[t]);
                        }
@@ -477,7 +512,7 @@ next_addr(struct fw3_address *addr, struct list_head *list,
        {
                rv = list_entry(p, struct fw3_address, list);
 
-               if (fw3_is_family(rv, family) && rv->invert == invert)
+               if (fw3_is_family(rv, family) && rv->set && rv->invert == invert)
                        return rv;
        }
 
@@ -488,7 +523,6 @@ static void
 print_zone_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
                 bool reload, struct fw3_zone *zone)
 {
-       bool disable_notrack = state->defaults.drop_invalid;
        bool first_src, first_dest;
        struct fw3_address *msrc;
        struct fw3_address *mdest;
@@ -620,15 +654,6 @@ print_zone_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
                break;
 
        case FW3_TABLE_RAW:
-               if (!zone->conntrack && !disable_notrack)
-               {
-                       r = fw3_ipt_rule_new(handle);
-                       fw3_ipt_rule_target(r, "CT");
-                       fw3_ipt_rule_addarg(r, false, "--notrack", NULL);
-                       fw3_ipt_rule_append(r, "zone_%s_notrack", zone->name);
-               }
-               break;
-
        case FW3_TABLE_MANGLE:
                break;
        }