X-Git-Url: http://git.archive.openwrt.org/?p=project%2Ffirewall3.git;a=blobdiff_plain;f=redirects.c;h=15855c9ea74673af8614a7ad7c3ccdc88f1eda08;hp=f91cd47295964862f12ece87bd76b8095bbb0187;hb=52d62c3d4654c39b39f4851d2884884e0c104b24;hpb=62863ea95d3c2c7dd0b56ac0f1dee5a4590ca70c diff --git a/redirects.c b/redirects.c index f91cd47..15855c9 100644 --- a/redirects.c +++ b/redirects.c @@ -28,22 +28,25 @@ const struct fw3_option fw3_redirect_opts[] = { FW3_OPT("src", device, redirect, src), FW3_OPT("dest", device, redirect, dest), - FW3_OPT("ipset", device, redirect, ipset), + FW3_OPT("ipset", setmatch, redirect, ipset), FW3_LIST("proto", protocol, redirect, proto), - FW3_OPT("src_ip", address, redirect, ip_src), + FW3_OPT("src_ip", network, redirect, ip_src), FW3_LIST("src_mac", mac, redirect, mac_src), FW3_OPT("src_port", port, redirect, port_src), - FW3_OPT("src_dip", address, redirect, ip_dest), + FW3_OPT("src_dip", network, redirect, ip_dest), FW3_OPT("src_dport", port, redirect, port_dest), - FW3_OPT("dest_ip", address, redirect, ip_redir), + FW3_OPT("dest_ip", network, redirect, ip_redir), FW3_OPT("dest_port", port, redirect, port_redir), FW3_OPT("extra", string, redirect, extra), + FW3_OPT("limit", limit, redirect, limit), + FW3_OPT("limit_burst", int, redirect, limit.burst), + FW3_OPT("utc_time", bool, redirect, time.utc), FW3_OPT("start_date", date, redirect, time.datestart), FW3_OPT("stop_date", date, redirect, time.datestop), @@ -52,7 +55,11 @@ const struct fw3_option fw3_redirect_opts[] = { FW3_OPT("weekdays", weekdays, redirect, time.weekdays), FW3_OPT("monthdays", monthdays, redirect, time.monthdays), + FW3_OPT("mark", mark, redirect, mark), + FW3_OPT("reflection", bool, redirect, reflection), + FW3_OPT("reflection_src", reflection_source, + redirect, reflection_src), FW3_OPT("target", target, redirect, target), @@ -78,7 +85,8 @@ check_families(struct uci_element *e, struct fw3_redirect *r) return false; } - if (r->_ipset && r->_ipset->family && r->_ipset->family != r->family) + if (r->ipset.ptr && r->ipset.ptr->family && + r->ipset.ptr->family != r->family) { warn_elem(e, "refers to ipset with different family"); return false; @@ -105,6 +113,58 @@ check_families(struct uci_element *e, struct fw3_redirect *r) return true; } +static bool +compare_addr(struct fw3_address *a, struct fw3_address *b) +{ + uint32_t mask; + + if (a->family != FW3_FAMILY_V4) + return false; + + mask = htonl(~((1 << (32 - a->mask)) - 1)); + + return ((a->address.v4.s_addr & mask) == (b->address.v4.s_addr & mask)); +} + +static bool +resolve_dest(struct uci_element *e, struct fw3_redirect *redir, + struct fw3_state *state) +{ + struct fw3_zone *zone; + struct fw3_address *addr; + struct list_head *addrs; + + if (!redir->ip_redir.set) + return false; + + list_for_each_entry(zone, &state->zones, list) + { + addrs = fw3_resolve_zone_addresses(zone); + + if (!addrs) + continue; + + list_for_each_entry(addr, addrs, list) + { + if (!compare_addr(addr, &redir->ip_redir)) + continue; + + strncpy(redir->dest.name, zone->name, sizeof(redir->dest.name)); + redir->dest.set = true; + redir->_dest = zone; + + break; + } + + fw3_free_list(addrs); + + if (redir->_dest) + return true; + } + + return false; +} + void fw3_load_redirects(struct fw3_state *state, struct uci_package *p) { @@ -112,7 +172,7 @@ fw3_load_redirects(struct fw3_state *state, struct uci_package *p) struct uci_element *e; struct fw3_redirect *redir; - bool valid = false; + bool valid; INIT_LIST_HEAD(&state->redirects); @@ -136,6 +196,8 @@ fw3_load_redirects(struct fw3_state *state, struct uci_package *p) redir->enabled = true; redir->reflection = true; + valid = false; + fw3_parse_options(redir, fw3_redirect_opts, s); if (!redir->enabled) @@ -151,14 +213,14 @@ fw3_load_redirects(struct fw3_state *state, struct uci_package *p) continue; } else if (redir->src.set && !redir->src.any && - !(redir->_src = fw3_lookup_zone(state, redir->src.name, false))) + !(redir->_src = fw3_lookup_zone(state, redir->src.name))) { warn_elem(e, "refers to not existing zone '%s'", redir->src.name); fw3_free_redirect(redir); continue; } else if (redir->dest.set && !redir->dest.any && - !(redir->_dest = fw3_lookup_zone(state, redir->dest.name, false))) + !(redir->_dest = fw3_lookup_zone(state, redir->dest.name))) { warn_elem(e, "refers to not existing zone '%s'", redir->dest.name); fw3_free_redirect(redir); @@ -170,8 +232,8 @@ fw3_load_redirects(struct fw3_state *state, struct uci_package *p) fw3_free_redirect(redir); continue; } - else if (redir->ipset.set && !redir->ipset.any && - !(redir->_ipset = fw3_lookup_ipset(state, redir->ipset.name, false))) + else if (redir->ipset.set && + !(redir->ipset.ptr = fw3_lookup_ipset(state, redir->ipset.name))) { warn_elem(e, "refers to unknown ipset '%s'", redir->ipset.name); fw3_free_redirect(redir); @@ -208,6 +270,12 @@ fw3_load_redirects(struct fw3_state *state, struct uci_package *p) valid = true; } + if (!redir->dest.set && resolve_dest(e, redir, state)) + { + warn_elem(e, "does not specify a destination, assuming '%s'", + redir->dest.name); + } + if (redir->reflection && redir->_dest && redir->_src->masq) { set(redir->_dest->flags, FW3_FAMILY_V4, FW3_FLAG_ACCEPT); @@ -223,6 +291,8 @@ fw3_load_redirects(struct fw3_state *state, struct uci_package *p) warn_elem(e, "has no destination specified"); else if (!redir->ip_dest.set) warn_elem(e, "has no src_dip option specified"); + else if (!list_empty(&redir->mac_src)) + warn_elem(e, "must not use 'src_mac' option for SNAT target"); else { set(redir->_dest->flags, FW3_FAMILY_V4, redir->target); @@ -231,6 +301,12 @@ fw3_load_redirects(struct fw3_state *state, struct uci_package *p) } } + if (list_empty(&redir->proto)) + { + warn_elem(e, "does not specify a protocol, assuming TCP+UDP"); + fw3_parse_protocol(&redir->proto, "tcpudp", true); + } + if (!valid) { fw3_free_redirect(redir); @@ -245,87 +321,215 @@ fw3_load_redirects(struct fw3_state *state, struct uci_package *p) } static void -print_chain_nat(struct fw3_redirect *redir) +append_chain_nat(struct fw3_ipt_rule *r, struct fw3_redirect *redir) { if (redir->target == FW3_FLAG_DNAT) - fw3_pr("-A zone_%s_prerouting", redir->src.name); + fw3_ipt_rule_append(r, "zone_%s_prerouting", redir->src.name); else - fw3_pr("-A zone_%s_postrouting", redir->dest.name); + fw3_ipt_rule_append(r, "zone_%s_postrouting", redir->dest.name); } static void -print_snat_dnat(enum fw3_flag target, - struct fw3_address *addr, struct fw3_port *port) +set_snat_dnat(struct fw3_ipt_rule *r, enum fw3_flag target, + struct fw3_address *addr, struct fw3_port *port) { - const char *t; - char s[sizeof("255.255.255.255 ")]; - - if (target == FW3_FLAG_DNAT) - t = "DNAT --to-destination"; - else - t = "SNAT --to-source"; + char buf[sizeof("255.255.255.255:65535-65535\0")]; - inet_ntop(AF_INET, &addr->address.v4, s, sizeof(s)); + buf[0] = '\0'; - fw3_pr(" -j %s %s", t, s); + if (addr && addr->set) + { + inet_ntop(AF_INET, &addr->address.v4, buf, sizeof(buf)); + } if (port && port->set) { if (port->port_min == port->port_max) - fw3_pr(":%u", port->port_min); + sprintf(buf + strlen(buf), ":%u", port->port_min); else - fw3_pr(":%u-%u", port->port_min, port->port_max); + sprintf(buf + strlen(buf), ":%u-%u", + port->port_min, port->port_max); } - fw3_pr("\n"); + if (target == FW3_FLAG_DNAT) + { + fw3_ipt_rule_target(r, "DNAT"); + fw3_ipt_rule_addarg(r, false, "--to-destination", buf); + } + else + { + fw3_ipt_rule_target(r, "SNAT"); + fw3_ipt_rule_addarg(r, false, "--to-source", buf); + } } static void -print_target_nat(struct fw3_redirect *redir) +set_target_nat(struct fw3_ipt_rule *r, struct fw3_redirect *redir) { if (redir->target == FW3_FLAG_DNAT) - print_snat_dnat(redir->target, &redir->ip_redir, &redir->port_redir); + set_snat_dnat(r, redir->target, &redir->ip_redir, &redir->port_redir); else - print_snat_dnat(redir->target, &redir->ip_dest, &redir->port_dest); + set_snat_dnat(r, redir->target, &redir->ip_dest, &redir->port_dest); } static void -print_chain_filter(struct fw3_redirect *redir) +append_chain_filter(struct fw3_ipt_rule *r, struct fw3_redirect *redir) { if (redir->target == FW3_FLAG_DNAT) { /* XXX: check for local ip */ if (!redir->ip_redir.set) - fw3_pr("-A zone_%s_input", redir->src.name); + fw3_ipt_rule_append(r, "zone_%s_input", redir->src.name); else - fw3_pr("-A zone_%s_forward", redir->src.name); + fw3_ipt_rule_append(r, "zone_%s_forward", redir->src.name); } else { if (redir->src.set && !redir->src.any) - fw3_pr("-A zone_%s_forward", redir->src.name); + fw3_ipt_rule_append(r, "zone_%s_forward", redir->src.name); else - fw3_pr("-A delegate_forward"); + fw3_ipt_rule_append(r, "delegate_forward"); } } static void -print_target_filter(struct fw3_redirect *redir) +set_target_filter(struct fw3_ipt_rule *r, struct fw3_redirect *redir) { /* XXX: check for local ip */ if (redir->target == FW3_FLAG_DNAT && !redir->ip_redir.set) - fw3_pr(" -m conntrack --ctstate DNAT -j ACCEPT\n"); + fw3_ipt_rule_extra(r, "-m conntrack --ctstate DNAT"); + + fw3_ipt_rule_target(r, "ACCEPT"); +} + +static void +set_comment(struct fw3_ipt_rule *r, const char *name, int num, bool ref) +{ + if (name) + { + if (ref) + fw3_ipt_rule_comment(r, "%s (reflection)", name); + else + fw3_ipt_rule_comment(r, name); + } else - fw3_pr(" -j ACCEPT\n"); + { + if (ref) + fw3_ipt_rule_comment(r, "@redirect[%u] (reflection)", num); + else + fw3_ipt_rule_comment(r, "@redirect[%u]", num); + } +} + +static void +print_redirect(struct fw3_ipt_handle *h, struct fw3_state *state, + struct fw3_redirect *redir, int num, + struct fw3_protocol *proto, struct fw3_mac *mac) +{ + struct fw3_ipt_rule *r; + struct fw3_address *src, *dst; + struct fw3_port *spt, *dpt; + + switch (h->table) + { + case FW3_TABLE_NAT: + src = &redir->ip_src; + dst = &redir->ip_dest; + spt = &redir->port_src; + dpt = &redir->port_dest; + + if (redir->target == FW3_FLAG_SNAT) + { + dst = &redir->ip_redir; + dpt = &redir->port_redir; + } + + r = fw3_ipt_rule_create(h, proto, NULL, NULL, src, dst); + fw3_ipt_rule_sport_dport(r, spt, dpt); + fw3_ipt_rule_mac(r, mac); + fw3_ipt_rule_ipset(r, &redir->ipset); + fw3_ipt_rule_limit(r, &redir->limit); + fw3_ipt_rule_time(r, &redir->time); + fw3_ipt_rule_mark(r, &redir->mark); + set_target_nat(r, redir); + fw3_ipt_rule_extra(r, redir->extra); + set_comment(r, redir->name, num, false); + append_chain_nat(r, redir); + break; + + case FW3_TABLE_FILTER: + src = &redir->ip_src; + dst = &redir->ip_redir; + spt = &redir->port_src; + dpt = &redir->port_redir; + + r = fw3_ipt_rule_create(h, proto, NULL, NULL, src, dst); + fw3_ipt_rule_sport_dport(r, spt, dpt); + fw3_ipt_rule_mac(r, mac); + fw3_ipt_rule_ipset(r, &redir->ipset); + fw3_ipt_rule_limit(r, &redir->limit); + fw3_ipt_rule_time(r, &redir->time); + fw3_ipt_rule_mark(r, &redir->mark); + set_target_filter(r, redir); + fw3_ipt_rule_extra(r, redir->extra); + set_comment(r, redir->name, num, false); + append_chain_filter(r, redir); + break; + + default: + break; + } } static void -print_redirect(enum fw3_table table, enum fw3_family family, - struct fw3_redirect *redir, int num) +print_reflection(struct fw3_ipt_handle *h, struct fw3_state *state, + struct fw3_redirect *redir, int num, + struct fw3_protocol *proto, struct fw3_address *ra, + struct fw3_address *ia, struct fw3_address *ea) +{ + struct fw3_ipt_rule *r; + + switch (h->table) + { + case FW3_TABLE_NAT: + r = fw3_ipt_rule_create(h, proto, NULL, NULL, ia, ea); + fw3_ipt_rule_sport_dport(r, NULL, &redir->port_dest); + fw3_ipt_rule_limit(r, &redir->limit); + fw3_ipt_rule_time(r, &redir->time); + set_comment(r, redir->name, num, true); + set_snat_dnat(r, FW3_FLAG_DNAT, &redir->ip_redir, &redir->port_redir); + fw3_ipt_rule_append(r, "zone_%s_prerouting", redir->dest.name); + + r = fw3_ipt_rule_create(h, proto, NULL, NULL, ia, &redir->ip_redir); + fw3_ipt_rule_sport_dport(r, NULL, &redir->port_redir); + fw3_ipt_rule_limit(r, &redir->limit); + fw3_ipt_rule_time(r, &redir->time); + set_comment(r, redir->name, num, true); + set_snat_dnat(r, FW3_FLAG_SNAT, ra, NULL); + fw3_ipt_rule_append(r, "zone_%s_postrouting", redir->dest.name); + break; + + case FW3_TABLE_FILTER: + r = fw3_ipt_rule_create(h, proto, NULL, NULL, ia, &redir->ip_redir); + fw3_ipt_rule_sport_dport(r, NULL, &redir->port_redir); + fw3_ipt_rule_limit(r, &redir->limit); + fw3_ipt_rule_time(r, &redir->time); + set_comment(r, redir->name, num, true); + fw3_ipt_rule_target(r, "zone_%s_dest_ACCEPT", redir->dest.name); + fw3_ipt_rule_append(r, "zone_%s_forward", redir->dest.name); + break; + + default: + break; + } +} + +static void +expand_redirect(struct fw3_ipt_handle *handle, struct fw3_state *state, + struct fw3_redirect *redir, int num) { struct list_head *ext_addrs, *int_addrs; - struct fw3_address *ext_addr, *int_addr; - struct fw3_device *ext_net, *int_net; + struct fw3_address *ext_addr, *int_addr, ref_addr; struct fw3_protocol *proto; struct fw3_mac *mac; @@ -334,72 +538,47 @@ print_redirect(enum fw3_table table, enum fw3_family family, else info(" * Redirect #%u", num); - if (!fw3_is_family(redir->_src, family) || - !fw3_is_family(redir->_dest, family)) + if (!fw3_is_family(redir->_src, handle->family) || + !fw3_is_family(redir->_dest, handle->family)) { info(" ! Skipping due to different family of zone"); return; } - if (!fw3_is_family(&redir->ip_src, family) || - !fw3_is_family(&redir->ip_dest, family) || - !fw3_is_family(&redir->ip_redir, family)) + if (!fw3_is_family(&redir->ip_src, handle->family) || + !fw3_is_family(&redir->ip_dest, handle->family) || + !fw3_is_family(&redir->ip_redir, handle->family)) { - info(" ! Skipping due to different family of ip address"); + if (!redir->ip_src.resolved || + !redir->ip_dest.resolved || + !redir->ip_redir.resolved) + info(" ! Skipping due to different family of ip address"); + return; } - if (redir->_ipset) + if (redir->ipset.ptr) { - if (!fw3_is_family(redir->_ipset, family)) + if (!fw3_is_family(redir->ipset.ptr, handle->family)) { info(" ! Skipping due to different family in ipset"); return; } - set(redir->_ipset->flags, family, family); + if (!fw3_check_ipset(redir->ipset.ptr)) + { + info(" ! Skipping due to missing ipset '%s'", + redir->ipset.ptr->external ? + redir->ipset.ptr->external : redir->ipset.ptr->name); + return; + } + + set(redir->ipset.ptr->flags, handle->family, handle->family); } fw3_foreach(proto, &redir->proto) fw3_foreach(mac, &redir->mac_src) - { - if (table == FW3_TABLE_NAT) - { - print_chain_nat(redir); - fw3_format_ipset(redir->_ipset, redir->ipset.invert); - fw3_format_protocol(proto, family); - - if (redir->target == FW3_FLAG_DNAT) - { - fw3_format_src_dest(&redir->ip_src, &redir->ip_dest); - fw3_format_sport_dport(&redir->port_src, &redir->port_dest); - } - else - { - fw3_format_src_dest(&redir->ip_src, &redir->ip_redir); - fw3_format_sport_dport(&redir->port_src, &redir->port_redir); - } - - fw3_format_mac(mac); - fw3_format_time(&redir->time); - fw3_format_extra(redir->extra); - fw3_format_comment(redir->name); - print_target_nat(redir); - } - else if (table == FW3_TABLE_FILTER) - { - print_chain_filter(redir); - fw3_format_ipset(redir->_ipset, redir->ipset.invert); - fw3_format_protocol(proto, family); - fw3_format_src_dest(&redir->ip_src, &redir->ip_redir); - fw3_format_sport_dport(&redir->port_src, &redir->port_redir); - fw3_format_mac(mac); - fw3_format_time(&redir->time); - fw3_format_extra(redir->extra); - fw3_format_comment(redir->name); - print_target_filter(redir); - } - } + print_redirect(handle, state, redir, num, proto, mac); /* reflection rules */ if (redir->target != FW3_FLAG_DNAT || !redir->reflection) @@ -408,84 +587,58 @@ print_redirect(enum fw3_table table, enum fw3_family family, if (!redir->_dest || !redir->_src->masq) return; - list_for_each_entry(ext_net, &redir->_src->networks, list) - { - ext_addrs = fw3_ubus_address(ext_net->name); + ext_addrs = fw3_resolve_zone_addresses(redir->_src); + int_addrs = fw3_resolve_zone_addresses(redir->_dest); - if (!ext_addrs || list_empty(ext_addrs)) + if (!ext_addrs || !int_addrs) + goto out; + + list_for_each_entry(ext_addr, ext_addrs, list) + { + if (!fw3_is_family(ext_addr, handle->family)) continue; - list_for_each_entry(int_net, &redir->_dest->networks, list) + list_for_each_entry(int_addr, int_addrs, list) { - int_addrs = fw3_ubus_address(int_net->name); - - if (!int_addrs || list_empty(int_addrs)) + if (!fw3_is_family(int_addr, handle->family)) continue; - fw3_foreach(ext_addr, ext_addrs) - fw3_foreach(int_addr, int_addrs) fw3_foreach(proto, &redir->proto) { - if (!fw3_is_family(int_addr, family) || - !fw3_is_family(ext_addr, family)) - continue; - if (!proto || (proto->protocol != 6 && proto->protocol != 17)) continue; + if (redir->reflection_src == FW3_REFLECTION_INTERNAL) + ref_addr = *int_addr; + else + ref_addr = *ext_addr; + + ref_addr.mask = 32; ext_addr->mask = 32; - if (table == FW3_TABLE_NAT) - { - fw3_pr("-A zone_%s_prerouting", redir->dest.name); - fw3_format_protocol(proto, family); - fw3_format_src_dest(int_addr, ext_addr); - fw3_format_sport_dport(NULL, &redir->port_dest); - fw3_format_time(&redir->time); - fw3_format_comment(redir->name, " (reflection)"); - print_snat_dnat(FW3_FLAG_DNAT, - &redir->ip_redir, &redir->port_redir); - - fw3_pr("-A zone_%s_postrouting", redir->dest.name); - fw3_format_protocol(proto, family); - fw3_format_src_dest(int_addr, &redir->ip_redir); - fw3_format_sport_dport(NULL, &redir->port_redir); - fw3_format_time(&redir->time); - fw3_format_comment(redir->name, " (reflection)"); - print_snat_dnat(FW3_FLAG_SNAT, ext_addr, NULL); - } - else if (table == FW3_TABLE_FILTER) - { - fw3_pr("-A zone_%s_forward", redir->dest.name); - fw3_format_protocol(proto, family); - fw3_format_src_dest(int_addr, &redir->ip_redir); - fw3_format_sport_dport(NULL, &redir->port_redir); - fw3_format_time(&redir->time); - fw3_format_comment(redir->name, " (reflection)"); - fw3_pr(" -j zone_%s_dest_ACCEPT\n", redir->dest.name); - } + print_reflection(handle, state, redir, num, proto, + &ref_addr, int_addr, ext_addr); } - - fw3_ubus_address_free(int_addrs); } - - fw3_ubus_address_free(ext_addrs); } + +out: + fw3_free_list(ext_addrs); + fw3_free_list(int_addrs); } void -fw3_print_redirects(enum fw3_table table, enum fw3_family family, - struct fw3_state *state) +fw3_print_redirects(struct fw3_ipt_handle *handle, struct fw3_state *state) { int num = 0; struct fw3_redirect *redir; - if (family == FW3_FAMILY_V6) + if (handle->family == FW3_FAMILY_V6) return; - if (table != FW3_TABLE_FILTER && table != FW3_TABLE_NAT) + if (handle->table != FW3_TABLE_FILTER && handle->table != FW3_TABLE_NAT) return; list_for_each_entry(redir, &state->redirects, list) - print_redirect(table, family, redir, num++); + expand_redirect(handle, state, redir, num++); }