ubus: store rule origin as comment
[project/firewall3.git] / forwards.c
1 /*
2  * firewall3 - 3rd OpenWrt UCI firewall implementation
3  *
4  *   Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
5  *
6  * Permission to use, copy, modify, and/or distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18
19 #include "forwards.h"
20
21
22 const struct fw3_option fw3_forward_opts[] = {
23         FW3_OPT("enabled",             bool,     forward,     enabled),
24
25         FW3_OPT("name",                string,   forward,     name),
26         FW3_OPT("family",              family,   forward,     family),
27
28         FW3_OPT("src",                 device,   forward,     src),
29         FW3_OPT("dest",                device,   forward,     dest),
30
31         { }
32 };
33
34
35 void
36 fw3_load_forwards(struct fw3_state *state, struct uci_package *p)
37 {
38         struct uci_section *s;
39         struct uci_element *e;
40         struct fw3_forward *forward;
41
42         INIT_LIST_HEAD(&state->forwards);
43
44         uci_foreach_element(&p->sections, e)
45         {
46                 s = uci_to_section(e);
47
48                 if (strcmp(s->type, "forwarding"))
49                         continue;
50
51                 forward = calloc(1, sizeof(*forward));
52                 if (!forward)
53                         continue;
54
55                 forward->enabled = true;
56
57                 fw3_parse_options(forward, fw3_forward_opts, s);
58
59                 if (!forward->enabled)
60                 {
61                         fw3_free_forward(forward);
62                         continue;
63                 }
64
65                 if (forward->src.invert || forward->dest.invert)
66                 {
67                         warn_elem(e, "must not have inverted 'src' or 'dest' options");
68                         fw3_free_forward(forward);
69                         continue;
70                 }
71                 else if (forward->src.set && !forward->src.any &&
72                          !(forward->_src = fw3_lookup_zone(state, forward->src.name)))
73                 {
74                         warn_elem(e, "refers to not existing zone '%s'", forward->src.name);
75                         fw3_free_forward(forward);
76                         continue;
77                 }
78                 else if (forward->dest.set && !forward->dest.any &&
79                          !(forward->_dest = fw3_lookup_zone(state, forward->dest.name)))
80                 {
81                         warn_elem(e, "refers to not existing zone '%s'", forward->dest.name);
82                         fw3_free_forward(forward);
83                         continue;
84                 }
85
86                 /* NB: forward family... */
87                 if (forward->_dest)
88                 {
89                         setbit(forward->_dest->flags[0], FW3_FLAG_ACCEPT);
90                         setbit(forward->_dest->flags[1], FW3_FLAG_ACCEPT);
91
92                         if (forward->_src &&
93                             (forward->_src->conntrack || forward->_dest->conntrack))
94                         {
95                                 forward->_src->conntrack = forward->_dest->conntrack = true;
96                         }
97                 }
98
99                 list_add_tail(&forward->list, &state->forwards);
100                 continue;
101         }
102 }
103
104
105 static void
106 append_chain(struct fw3_ipt_rule *r, struct fw3_forward *forward)
107 {
108         if (forward->src.any || !forward->src.set)
109                 fw3_ipt_rule_append(r, "delegate_forward");
110         else
111                 fw3_ipt_rule_append(r, "zone_%s_forward", forward->src.name);
112 }
113
114 static void set_target(struct fw3_ipt_rule *r, struct fw3_forward *forward)
115 {
116         if (forward->dest.any || !forward->dest.set)
117                 fw3_ipt_rule_target(r, "ACCEPT");
118         else
119                 fw3_ipt_rule_target(r, "zone_%s_dest_ACCEPT", forward->dest.name);
120 }
121
122 static void
123 print_forward(struct fw3_ipt_handle *handle, struct fw3_forward *forward)
124 {
125         const char *s, *d;
126         struct fw3_ipt_rule *r;
127
128         if (handle->table != FW3_TABLE_FILTER)
129                 return;
130
131         if (!fw3_is_family(forward, handle->family))
132                 return;
133
134         s = forward->_src  ? forward->_src->name  : "*";
135         d = forward->_dest ? forward->_dest->name : "*";
136
137         info("   * Forward '%s' -> '%s'", s, d);
138
139         if (!fw3_is_family(forward->_src, handle->family) ||
140             !fw3_is_family(forward->_dest, handle->family))
141         {
142                 info("     ! Skipping due to different family of zone");
143                 return;
144         }
145
146         r = fw3_ipt_rule_new(handle);
147         fw3_ipt_rule_comment(r, "forwarding %s -> %s", s, d);
148         set_target(r, forward);
149         append_chain(r, forward);
150 }
151
152 void
153 fw3_print_forwards(struct fw3_ipt_handle *handle, struct fw3_state *state)
154 {
155         struct fw3_forward *forward;
156
157         list_for_each_entry(forward, &state->forwards, list)
158                 print_forward(handle, forward);
159 }