2 * firewall3 - 3rd OpenWrt UCI firewall implementation
4 * Copyright (C) 2013 Jo-Philipp Wich <jo@mein.io>
6 * Permission to use, copy, modify, and/or distribute this software for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
22 const struct fw3_option fw3_ipset_opts[] = {
23 FW3_OPT("enabled", bool, ipset, enabled),
25 FW3_OPT("name", string, ipset, name),
26 FW3_OPT("family", family, ipset, family),
28 FW3_OPT("storage", ipset_method, ipset, method),
29 FW3_LIST("match", ipset_datatype, ipset, datatypes),
31 FW3_OPT("iprange", address, ipset, iprange),
32 FW3_OPT("portrange", port, ipset, portrange),
34 FW3_OPT("netmask", int, ipset, netmask),
35 FW3_OPT("maxelem", int, ipset, maxelem),
36 FW3_OPT("hashsize", int, ipset, hashsize),
37 FW3_OPT("timeout", int, ipset, timeout),
39 FW3_OPT("external", string, ipset, external),
41 FW3_LIST("entry", setentry, ipset, entries),
42 FW3_OPT("loadfile", string, ipset, loadfile),
47 #define T(m, t1, t2, t3, r, o) \
48 { FW3_IPSET_METHOD_##m, \
49 FW3_IPSET_TYPE_##t1 | (FW3_IPSET_TYPE_##t2 << 8) | (FW3_IPSET_TYPE_##t3 << 16), \
53 OPT_IPRANGE = (1 << 0),
54 OPT_PORTRANGE = (1 << 1),
55 OPT_NETMASK = (1 << 2),
56 OPT_HASHSIZE = (1 << 3),
57 OPT_MAXELEM = (1 << 4),
58 OPT_FAMILY = (1 << 5),
62 enum fw3_ipset_method method;
68 static struct ipset_type ipset_types[] = {
69 T(BITMAP, IP, UNSPEC, UNSPEC, OPT_IPRANGE, OPT_NETMASK),
70 T(BITMAP, IP, MAC, UNSPEC, OPT_IPRANGE, 0),
71 T(BITMAP, PORT, UNSPEC, UNSPEC, OPT_PORTRANGE, 0),
73 T(HASH, IP, UNSPEC, UNSPEC, 0,
74 OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM | OPT_NETMASK),
75 T(HASH, NET, UNSPEC, UNSPEC, 0,
76 OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM),
77 T(HASH, IP, PORT, UNSPEC, 0,
78 OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM),
79 T(HASH, NET, PORT, UNSPEC, 0,
80 OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM),
81 T(HASH, IP, PORT, IP, 0,
82 OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM),
83 T(HASH, IP, PORT, NET, 0,
84 OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM),
86 T(LIST, SET, UNSPEC, UNSPEC, 0, OPT_MAXELEM),
91 check_types(struct uci_element *e, struct fw3_ipset *ipset)
94 uint32_t typelist = 0;
95 struct fw3_ipset_datatype *type;
97 list_for_each_entry(type, &ipset->datatypes, list)
101 warn_section("ipset", ipset, e, "must not have more than 3 datatypes assigned");
105 typelist |= (type->type << (i++ * 8));
108 /* find a suitable storage method if none specified */
109 if (ipset->method == FW3_IPSET_METHOD_UNSPEC)
111 for (i = 0; i < ARRAY_SIZE(ipset_types); i++)
113 /* skip type for v6 if it does not support family */
114 if (ipset->family != FW3_FAMILY_V4 &&
115 !(ipset_types[i].optional & OPT_FAMILY))
118 if (ipset_types[i].types == typelist)
120 ipset->method = ipset_types[i].method;
122 warn_section("ipset", ipset, e, "defines no storage method, assuming '%s'",
123 fw3_ipset_method_names[ipset->method]);
130 //typelist |= ipset->method;
132 for (i = 0; i < ARRAY_SIZE(ipset_types); i++)
134 if (ipset_types[i].method == ipset->method &&
135 ipset_types[i].types == typelist)
137 if (!ipset->external)
139 if ((ipset_types[i].required & OPT_IPRANGE) &&
142 warn_section("ipset", ipset, e, "requires an ip range");
146 if ((ipset_types[i].required & OPT_PORTRANGE) &&
147 !ipset->portrange.set)
149 warn_section("ipset", ipset, e, "requires a port range");
153 if (!(ipset_types[i].required & OPT_IPRANGE) &&
156 warn_section("ipset", ipset, e, "iprange ignored");
157 ipset->iprange.set = false;
160 if (!(ipset_types[i].required & OPT_PORTRANGE) &&
161 ipset->portrange.set)
163 warn_section("ipset", ipset, e, "portrange ignored");
164 ipset->portrange.set = false;
167 if (!(ipset_types[i].optional & OPT_NETMASK) &&
170 warn_section("ipset", ipset, e, "netmask ignored");
174 if (!(ipset_types[i].optional & OPT_HASHSIZE) &&
177 warn_section("ipset", ipset, e, "hashsize ignored");
181 if (!(ipset_types[i].optional & OPT_MAXELEM) &&
184 warn_section("ipset", ipset, e, "maxelem ignored");
188 if (!(ipset_types[i].optional & OPT_FAMILY) &&
189 ipset->family != FW3_FAMILY_V4)
191 warn_section("ipset", ipset, e, "family ignored");
192 ipset->family = FW3_FAMILY_V4;
200 warn_section("ipset", ipset, e, "has an invalid combination of storage method and matches");
205 check_ipset(struct fw3_state *state, struct fw3_ipset *ipset, struct uci_element *e)
209 if (!*ipset->external)
210 ipset->external = NULL;
211 else if (!ipset->name)
212 ipset->name = ipset->external;
215 if (!ipset->name || !*ipset->name)
217 warn_section("ipset", ipset, e, "ipset must have a name assigned");
219 //else if (fw3_lookup_ipset(state, ipset->name) != NULL)
221 // warn_section("ipset", ipset, e, "has duplicated set name", ipset->name);
223 else if (ipset->family == FW3_FAMILY_ANY)
225 warn_section("ipset", ipset, e, "must not have family 'any'");
227 else if (ipset->iprange.set && ipset->family != ipset->iprange.family)
229 warn_section("ipset", ipset, e, "has iprange of wrong address family");
231 else if (list_empty(&ipset->datatypes))
233 warn_section("ipset", ipset, e, "has no datatypes assigned");
235 else if (check_types(e, ipset))
243 static struct fw3_ipset *
244 fw3_alloc_ipset(struct fw3_state *state)
246 struct fw3_ipset *ipset;
248 ipset = calloc(1, sizeof(*ipset));
252 INIT_LIST_HEAD(&ipset->datatypes);
253 INIT_LIST_HEAD(&ipset->entries);
255 ipset->enabled = true;
256 ipset->family = FW3_FAMILY_V4;
258 list_add_tail(&ipset->list, &state->ipsets);
264 fw3_load_ipsets(struct fw3_state *state, struct uci_package *p,
267 struct uci_section *s;
268 struct uci_element *e;
269 struct fw3_ipset *ipset;
270 struct blob_attr *entry;
273 INIT_LIST_HEAD(&state->ipsets);
275 if (state->disable_ipsets)
278 blob_for_each_attr(entry, a, rem)
281 const char *name = "ubus ipset";
283 if (!fw3_attr_parse_name_type(entry, &name, &type))
286 if (strcmp(type, "ipset"))
289 ipset = fw3_alloc_ipset(state);
293 if (!fw3_parse_blob_options(ipset, fw3_ipset_opts, entry, name))
295 warn_section("ipset", ipset, NULL, "skipped due to invalid options");
296 fw3_free_ipset(ipset);
300 if (!check_ipset(state, ipset, NULL))
301 fw3_free_ipset(ipset);
304 uci_foreach_element(&p->sections, e)
306 s = uci_to_section(e);
308 if (strcmp(s->type, "ipset"))
311 ipset = fw3_alloc_ipset(state);
316 if (!fw3_parse_options(ipset, fw3_ipset_opts, s))
317 warn_elem(e, "has invalid options");
319 if (!check_ipset(state, ipset, e))
320 fw3_free_ipset(ipset);
326 load_file(struct fw3_ipset *ipset)
331 if (!ipset->loadfile)
334 info(" * Loading file %s", ipset->loadfile);
336 f = fopen(ipset->loadfile, "r");
339 info(" ! Skipping due to open error: %s", strerror(errno));
343 while (fgets(line, sizeof(line), f))
344 fw3_pr("add %s %s", ipset->name, line);
350 create_ipset(struct fw3_ipset *ipset, struct fw3_state *state)
353 struct fw3_setentry *entry;
354 struct fw3_ipset_datatype *type;
356 info(" * Creating ipset %s", ipset->name);
359 fw3_pr("create %s %s", ipset->name, fw3_ipset_method_names[ipset->method]);
361 list_for_each_entry(type, &ipset->datatypes, list)
363 fw3_pr("%c%s", first ? ':' : ',', fw3_ipset_type_names[type->type]);
367 if (ipset->method == FW3_IPSET_METHOD_HASH)
368 fw3_pr(" family inet%s", (ipset->family == FW3_FAMILY_V4) ? "" : "6");
370 if (ipset->iprange.set)
372 fw3_pr(" range %s", fw3_address_to_string(&ipset->iprange, false, true));
374 else if (ipset->portrange.set)
376 fw3_pr(" range %u-%u",
377 ipset->portrange.port_min, ipset->portrange.port_max);
380 if (ipset->timeout > 0)
381 fw3_pr(" timeout %u", ipset->timeout);
383 if (ipset->maxelem > 0)
384 fw3_pr(" maxelem %u", ipset->maxelem);
386 if (ipset->netmask > 0)
387 fw3_pr(" netmask %u", ipset->netmask);
389 if (ipset->hashsize > 0)
390 fw3_pr(" hashsize %u", ipset->hashsize);
394 list_for_each_entry(entry, &ipset->entries, list)
395 fw3_pr("add %s %s\n", ipset->name, entry->value);
401 fw3_create_ipsets(struct fw3_state *state)
405 struct fw3_ipset *ipset;
407 if (state->disable_ipsets)
411 list_for_each_entry(ipset, &state->ipsets, list)
418 exec = fw3_command_pipe(false, "ipset", "-exist", "-");
424 create_ipset(ipset, state);
433 /* wait for ipsets to appear */
434 list_for_each_entry(ipset, &state->ipsets, list)
439 for (tries = 0; !fw3_check_ipset(ipset) && tries < 10; tries++)
445 fw3_destroy_ipsets(struct fw3_state *state)
449 struct fw3_ipset *ipset;
452 list_for_each_entry(ipset, &state->ipsets, list)
456 exec = fw3_command_pipe(false, "ipset", "-exist", "-");
462 info(" * Deleting ipset %s", ipset->name);
464 fw3_pr("flush %s\n", ipset->name);
465 fw3_pr("destroy %s\n", ipset->name);
474 /* wait for ipsets to disappear */
475 list_for_each_entry(ipset, &state->ipsets, list)
480 for (tries = 0; fw3_check_ipset(ipset) && tries < 10; tries++)
486 fw3_lookup_ipset(struct fw3_state *state, const char *name)
490 if (list_empty(&state->ipsets))
493 list_for_each_entry(s, &state->ipsets, list)
495 if (strcmp(s->name, name))
505 fw3_check_ipset(struct fw3_ipset *set)
510 int s = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
511 struct ip_set_req_version req_ver;
512 struct ip_set_req_get_set req_name;
514 if (s < 0 || fcntl(s, F_SETFD, FD_CLOEXEC))
517 sz = sizeof(req_ver);
518 req_ver.op = IP_SET_OP_VERSION;
520 if (getsockopt(s, SOL_IP, SO_IP_SET, &req_ver, &sz))
523 sz = sizeof(req_name);
524 req_name.op = IP_SET_OP_GET_BYNAME;
525 req_name.version = req_ver.version;
526 snprintf(req_name.set.name, IPSET_MAXNAMELEN - 1, "%s",
527 set->external ? set->external : set->name);
529 if (getsockopt(s, SOL_IP, SO_IP_SET, &req_name, &sz))
532 rv = ((sz == sizeof(req_name)) && (req_name.set.index != IPSET_INVALID_ID));