2 * firewall3 - 3rd OpenWrt UCI firewall implementation
4 * Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
6 * Permission to use, copy, modify, and/or distribute this software for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
22 const struct fw3_option fw3_ipset_opts[] = {
23 FW3_OPT("name", string, ipset, name),
24 FW3_OPT("family", family, ipset, family),
26 FW3_OPT("storage", ipset_method, ipset, method),
27 FW3_LIST("match", ipset_datatype, ipset, datatypes),
29 FW3_OPT("iprange", address, ipset, iprange),
30 FW3_OPT("portrange", port, ipset, portrange),
32 FW3_OPT("netmask", int, ipset, netmask),
33 FW3_OPT("maxelem", int, ipset, maxelem),
34 FW3_OPT("hashsize", int, ipset, hashsize),
35 FW3_OPT("timeout", int, ipset, timeout),
37 FW3_OPT("external", string, ipset, external),
42 #define T(m, t1, t2, t3, r, o) \
43 { FW3_IPSET_METHOD_##m, \
44 FW3_IPSET_TYPE_##t1 | (FW3_IPSET_TYPE_##t2 << 8) | (FW3_IPSET_TYPE_##t3 << 16), \
48 OPT_IPRANGE = (1 << 0),
49 OPT_PORTRANGE = (1 << 1),
50 OPT_NETMASK = (1 << 2),
51 OPT_HASHSIZE = (1 << 3),
52 OPT_MAXELEM = (1 << 4),
53 OPT_FAMILY = (1 << 5),
57 enum fw3_ipset_method method;
63 static struct ipset_type ipset_types[] = {
64 T(BITMAP, IP, UNSPEC, UNSPEC, OPT_IPRANGE, OPT_NETMASK),
65 T(BITMAP, IP, MAC, UNSPEC, OPT_IPRANGE, 0),
66 T(BITMAP, PORT, UNSPEC, UNSPEC, OPT_PORTRANGE, 0),
68 T(HASH, IP, UNSPEC, UNSPEC, 0,
69 OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM | OPT_NETMASK),
70 T(HASH, NET, UNSPEC, UNSPEC, 0,
71 OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM),
72 T(HASH, IP, PORT, UNSPEC, 0,
73 OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM),
74 T(HASH, NET, PORT, UNSPEC, 0,
75 OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM),
76 T(HASH, IP, PORT, IP, 0,
77 OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM),
78 T(HASH, IP, PORT, NET, 0,
79 OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM),
81 T(LIST, SET, UNSPEC, UNSPEC, 0, OPT_MAXELEM),
86 check_types(struct uci_element *e, struct fw3_ipset *ipset)
89 uint32_t typelist = 0;
90 struct fw3_ipset_datatype *type;
92 const char *methods[] = {
101 list_for_each_entry(type, &ipset->datatypes, list)
105 warn_elem(e, "must not have more than 3 datatypes assigned");
109 typelist |= (type->type << (i++ * 8));
112 /* find a suitable storage method if none specified */
113 if (ipset->method == FW3_IPSET_METHOD_UNSPEC)
115 for (i = 0; i < ARRAY_SIZE(ipset_types); i++)
117 if (ipset_types[i].types == typelist)
119 ipset->method = ipset_types[i].method;
121 warn_elem(e, "defines no storage method, assuming '%s'",
122 methods[ipset->method]);
129 //typelist |= ipset->method;
131 for (i = 0; i < ARRAY_SIZE(ipset_types); i++)
133 if (ipset_types[i].method == ipset->method &&
134 ipset_types[i].types == typelist)
136 if (!ipset->external || !*ipset->external)
138 if ((ipset_types[i].required & OPT_IPRANGE) &&
141 warn_elem(e, "requires an ip range");
145 if ((ipset_types[i].required & OPT_PORTRANGE) &&
146 !ipset->portrange.set)
148 warn_elem(e, "requires a port range");
152 if (!(ipset_types[i].required & OPT_IPRANGE) &&
155 warn_elem(e, "iprange ignored");
156 ipset->iprange.set = false;
159 if (!(ipset_types[i].required & OPT_PORTRANGE) &&
160 ipset->portrange.set)
162 warn_elem(e, "portrange ignored");
163 ipset->portrange.set = false;
166 if (!(ipset_types[i].optional & OPT_NETMASK) &&
169 warn_elem(e, "netmask ignored");
173 if (!(ipset_types[i].optional & OPT_HASHSIZE) &&
176 warn_elem(e, "hashsize ignored");
180 if (!(ipset_types[i].optional & OPT_MAXELEM) &&
183 warn_elem(e, "maxelem ignored");
187 if (!(ipset_types[i].optional & OPT_FAMILY) &&
188 ipset->family != FW3_FAMILY_ANY)
190 warn_elem(e, "family ignored");
191 ipset->family = FW3_FAMILY_ANY;
199 warn_elem(e, "has an invalid combination of storage method and matches");
204 fw3_alloc_ipset(void)
206 struct fw3_ipset *ipset;
208 ipset = malloc(sizeof(*ipset));
213 memset(ipset, 0, sizeof(*ipset));
215 INIT_LIST_HEAD(&ipset->datatypes);
221 fw3_load_ipsets(struct fw3_state *state, struct uci_package *p)
223 struct uci_section *s;
224 struct uci_element *e;
225 struct fw3_ipset *ipset;
227 INIT_LIST_HEAD(&state->ipsets);
229 if (state->disable_ipsets)
232 uci_foreach_element(&p->sections, e)
234 s = uci_to_section(e);
236 if (strcmp(s->type, "ipset"))
239 ipset = fw3_alloc_ipset();
244 fw3_parse_options(ipset, fw3_ipset_opts, s);
246 if (!ipset->name || !*ipset->name)
248 warn_elem(e, "must have a name assigned");
250 //else if (fw3_lookup_ipset(state, ipset->name) != NULL)
252 // warn_elem(e, "has duplicated set name '%s'", ipset->name);
254 else if (list_empty(&ipset->datatypes))
256 warn_elem(e, "has no datatypes assigned");
258 else if (check_types(e, ipset))
260 list_add_tail(&ipset->list, &state->ipsets);
264 fw3_free_ipset(ipset);
270 create_ipset(struct fw3_ipset *ipset, struct fw3_state *state)
273 char s[INET6_ADDRSTRLEN];
275 struct fw3_ipset_datatype *type;
276 struct fw3_address *a;
278 const char *methods[] = {
285 const char *types[] = {
294 if (ipset->external && *ipset->external)
297 info("Creating ipset %s", ipset->name);
300 fw3_pr("create %s %s", ipset->name, methods[ipset->method]);
302 list_for_each_entry(type, &ipset->datatypes, list)
304 fw3_pr("%c%s", first ? ':' : ',', types[type->type]);
308 if (ipset->iprange.set)
314 inet_ntop(a->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
315 &a->address.v6, s, sizeof(s));
317 fw3_pr(" range %s/%u", s, a->mask);
321 inet_ntop(a->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
322 &a->address.v6, s, sizeof(s));
324 fw3_pr(" range %s", s);
326 inet_ntop(a->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
327 &a->address2.v6, s, sizeof(s));
332 else if (ipset->portrange.set)
334 fw3_pr(" range %u-%u",
335 ipset->portrange.port_min, ipset->portrange.port_max);
338 if (ipset->family != FW3_FAMILY_ANY)
339 fw3_pr(" family inet%s", (ipset->family == FW3_FAMILY_V4) ? "" : "6");
341 if (ipset->timeout > 0)
342 fw3_pr(" timeout %u", ipset->timeout);
344 if (ipset->maxelem > 0)
345 fw3_pr(" maxelem %u", ipset->maxelem);
347 if (ipset->netmask > 0)
348 fw3_pr(" netmask %u", ipset->netmask);
350 if (ipset->hashsize > 0)
351 fw3_pr(" hashsize %u", ipset->hashsize);
355 fw3_set_running(ipset, &state->running_ipsets);
359 fw3_create_ipsets(struct fw3_state *state)
361 struct fw3_ipset *ipset;
363 if (state->disable_ipsets)
366 list_for_each_entry(ipset, &state->ipsets, list)
367 if (!fw3_lookup_ipset(state, ipset->name, true))
368 create_ipset(ipset, state);
374 fw3_destroy_ipsets(struct fw3_state *state)
376 struct fw3_ipset *s, *tmp;
377 int mask = (1 << FW3_FAMILY_V4) | (1 << FW3_FAMILY_V6);
379 list_for_each_entry_safe(s, tmp, &state->running_ipsets, running_list)
381 if (!hasbit(state->defaults.flags, FW3_FAMILY_V4))
382 delbit(s->flags, FW3_FAMILY_V4);
384 if (!hasbit(state->defaults.flags, FW3_FAMILY_V6))
385 delbit(s->flags, FW3_FAMILY_V6);
387 if (!(s->flags & mask))
389 info("Deleting ipset %s", s->name);
391 fw3_pr("flush %s\n", s->name);
392 fw3_pr("destroy %s\n", s->name);
394 fw3_set_running(s, NULL);
400 fw3_lookup_ipset(struct fw3_state *state, const char *name, bool running)
404 if (list_empty(&state->ipsets))
407 list_for_each_entry(s, &state->ipsets, list)
409 if (strcmp(s->name, name))
412 if (!running || s->running_list.next)