introduce support for enabled option in zones, forwards, rules, redirects, ipsets...
[project/firewall3.git] / ipsets.c
1 /*
2  * firewall3 - 3rd OpenWrt UCI firewall implementation
3  *
4  *   Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
5  *
6  * Permission to use, copy, modify, and/or distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18
19 #include "ipsets.h"
20
21
22 const struct fw3_option fw3_ipset_opts[] = {
23         FW3_OPT("enabled",       bool,           ipset,     enabled),
24
25         FW3_OPT("name",          string,         ipset,     name),
26         FW3_OPT("family",        family,         ipset,     family),
27
28         FW3_OPT("storage",       ipset_method,   ipset,     method),
29         FW3_LIST("match",        ipset_datatype, ipset,     datatypes),
30
31         FW3_OPT("iprange",       address,        ipset,     iprange),
32         FW3_OPT("portrange",     port,           ipset,     portrange),
33
34         FW3_OPT("netmask",       int,            ipset,     netmask),
35         FW3_OPT("maxelem",       int,            ipset,     maxelem),
36         FW3_OPT("hashsize",      int,            ipset,     hashsize),
37         FW3_OPT("timeout",       int,            ipset,     timeout),
38
39         FW3_OPT("external",      string,         ipset,     external),
40
41         { }
42 };
43
44 #define T(m, t1, t2, t3, r, o) \
45         { FW3_IPSET_METHOD_##m, \
46           FW3_IPSET_TYPE_##t1 | (FW3_IPSET_TYPE_##t2 << 8) | (FW3_IPSET_TYPE_##t3 << 16), \
47           r, o }
48
49 enum ipset_optflag {
50         OPT_IPRANGE   = (1 << 0),
51         OPT_PORTRANGE = (1 << 1),
52         OPT_NETMASK   = (1 << 2),
53         OPT_HASHSIZE  = (1 << 3),
54         OPT_MAXELEM   = (1 << 4),
55         OPT_FAMILY    = (1 << 5),
56 };
57
58 struct ipset_type {
59         enum fw3_ipset_method method;
60         uint32_t types;
61         uint8_t required;
62         uint8_t optional;
63 };
64
65 static struct ipset_type ipset_types[] = {
66         T(BITMAP, IP,   UNSPEC, UNSPEC, OPT_IPRANGE, OPT_NETMASK),
67         T(BITMAP, IP,   MAC,    UNSPEC, OPT_IPRANGE, 0),
68         T(BITMAP, PORT, UNSPEC, UNSPEC, OPT_PORTRANGE, 0),
69
70         T(HASH,   IP,   UNSPEC, UNSPEC, 0,
71           OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM | OPT_NETMASK),
72         T(HASH,   NET,  UNSPEC, UNSPEC, 0,
73           OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM),
74         T(HASH,   IP,   PORT,   UNSPEC, 0,
75           OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM),
76         T(HASH,   NET,  PORT,   UNSPEC, 0,
77           OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM),
78         T(HASH,   IP,   PORT,   IP,     0,
79           OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM),
80         T(HASH,   IP,   PORT,   NET,    0,
81           OPT_FAMILY | OPT_HASHSIZE | OPT_MAXELEM),
82
83         T(LIST,   SET,  UNSPEC, UNSPEC, 0, OPT_MAXELEM),
84 };
85
86
87 static bool
88 check_types(struct uci_element *e, struct fw3_ipset *ipset)
89 {
90         int i = 0;
91         uint32_t typelist = 0;
92         struct fw3_ipset_datatype *type;
93
94         const char *methods[] = {
95                 "(bug)",
96                 "bitmap",
97                 "hash",
98                 "list",
99         };
100
101         typelist = 0;
102
103         list_for_each_entry(type, &ipset->datatypes, list)
104         {
105                 if (i >= 3)
106                 {
107                         warn_elem(e, "must not have more than 3 datatypes assigned");
108                         return false;
109                 }
110
111                 typelist |= (type->type << (i++ * 8));
112         }
113
114         /* find a suitable storage method if none specified */
115         if (ipset->method == FW3_IPSET_METHOD_UNSPEC)
116         {
117                 for (i = 0; i < ARRAY_SIZE(ipset_types); i++)
118                 {
119                         if (ipset_types[i].types == typelist)
120                         {
121                                 ipset->method = ipset_types[i].method;
122
123                                 warn_elem(e, "defines no storage method, assuming '%s'",
124                                           methods[ipset->method]);
125
126                                 break;
127                         }
128                 }
129         }
130
131         //typelist |= ipset->method;
132
133         for (i = 0; i < ARRAY_SIZE(ipset_types); i++)
134         {
135                 if (ipset_types[i].method == ipset->method &&
136                     ipset_types[i].types == typelist)
137                 {
138                         if (!ipset->external || !*ipset->external)
139                         {
140                                 if ((ipset_types[i].required & OPT_IPRANGE) &&
141                                         !ipset->iprange.set)
142                                 {
143                                         warn_elem(e, "requires an ip range");
144                                         return false;
145                                 }
146
147                                 if ((ipset_types[i].required & OPT_PORTRANGE) &&
148                                     !ipset->portrange.set)
149                                 {
150                                         warn_elem(e, "requires a port range");
151                                         return false;
152                                 }
153
154                                 if (!(ipset_types[i].required & OPT_IPRANGE) &&
155                                     ipset->iprange.set)
156                                 {
157                                         warn_elem(e, "iprange ignored");
158                                         ipset->iprange.set = false;
159                                 }
160
161                                 if (!(ipset_types[i].required & OPT_PORTRANGE) &&
162                                     ipset->portrange.set)
163                                 {
164                                         warn_elem(e, "portrange ignored");
165                                         ipset->portrange.set = false;
166                                 }
167
168                                 if (!(ipset_types[i].optional & OPT_NETMASK) &&
169                                     ipset->netmask > 0)
170                                 {
171                                         warn_elem(e, "netmask ignored");
172                                         ipset->netmask = 0;
173                                 }
174
175                                 if (!(ipset_types[i].optional & OPT_HASHSIZE) &&
176                                     ipset->hashsize > 0)
177                                 {
178                                         warn_elem(e, "hashsize ignored");
179                                         ipset->hashsize = 0;
180                                 }
181
182                                 if (!(ipset_types[i].optional & OPT_MAXELEM) &&
183                                     ipset->maxelem > 0)
184                                 {
185                                         warn_elem(e, "maxelem ignored");
186                                         ipset->maxelem = 0;
187                                 }
188
189                                 if (!(ipset_types[i].optional & OPT_FAMILY) &&
190                                     ipset->family != FW3_FAMILY_ANY)
191                                 {
192                                         warn_elem(e, "family ignored");
193                                         ipset->family = FW3_FAMILY_ANY;
194                                 }
195                         }
196
197                         return true;
198                 }
199         }
200
201         warn_elem(e, "has an invalid combination of storage method and matches");
202         return false;
203 }
204
205 struct fw3_ipset *
206 fw3_alloc_ipset(void)
207 {
208         struct fw3_ipset *ipset;
209
210         ipset = malloc(sizeof(*ipset));
211
212         if (!ipset)
213                 return NULL;
214
215         memset(ipset, 0, sizeof(*ipset));
216
217         INIT_LIST_HEAD(&ipset->datatypes);
218
219         return ipset;
220 }
221
222 void
223 fw3_load_ipsets(struct fw3_state *state, struct uci_package *p)
224 {
225         struct uci_section *s;
226         struct uci_element *e;
227         struct fw3_ipset *ipset;
228
229         INIT_LIST_HEAD(&state->ipsets);
230
231         if (state->disable_ipsets)
232                 return;
233
234         uci_foreach_element(&p->sections, e)
235         {
236                 s = uci_to_section(e);
237
238                 if (strcmp(s->type, "ipset"))
239                         continue;
240
241                 ipset = fw3_alloc_ipset();
242
243                 if (!ipset)
244                         continue;
245
246                 fw3_parse_options(ipset, fw3_ipset_opts, s);
247
248                 if (!ipset->name || !*ipset->name)
249                 {
250                         warn_elem(e, "must have a name assigned");
251                 }
252                 //else if (fw3_lookup_ipset(state, ipset->name) != NULL)
253                 //{
254                 //      warn_elem(e, "has duplicated set name '%s'", ipset->name);
255                 //}
256                 else if (list_empty(&ipset->datatypes))
257                 {
258                         warn_elem(e, "has no datatypes assigned");
259                 }
260                 else if (check_types(e, ipset))
261                 {
262                         list_add_tail(&ipset->list, &state->ipsets);
263                         continue;
264                 }
265
266                 fw3_free_ipset(ipset);
267         }
268 }
269
270
271 static void
272 create_ipset(struct fw3_ipset *ipset, struct fw3_state *state)
273 {
274         bool first = true;
275         char s[INET6_ADDRSTRLEN];
276
277         struct fw3_ipset_datatype *type;
278         struct fw3_address *a;
279
280         const char *methods[] = {
281                 "(bug)",
282                 "bitmap",
283                 "hash",
284                 "list",
285         };
286
287         const char *types[] = {
288                 "(bug)",
289                 "ip",
290                 "port",
291                 "mac",
292                 "net",
293                 "set",
294         };
295
296         if (ipset->external && *ipset->external)
297                 return;
298
299         info("Creating ipset %s", ipset->name);
300
301         first = true;
302         fw3_pr("create %s %s", ipset->name, methods[ipset->method]);
303
304         list_for_each_entry(type, &ipset->datatypes, list)
305         {
306                 fw3_pr("%c%s", first ? ':' : ',', types[type->type]);
307                 first = false;
308         }
309
310         if (ipset->iprange.set)
311         {
312                 a = &ipset->iprange;
313
314                 if (!a->range)
315                 {
316                         inet_ntop(a->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
317                                   &a->address.v6, s, sizeof(s));
318
319                         fw3_pr(" range %s/%u", s, a->mask);
320                 }
321                 else
322                 {
323                         inet_ntop(a->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
324                                   &a->address.v6, s, sizeof(s));
325
326                         fw3_pr(" range %s", s);
327
328                         inet_ntop(a->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
329                                   &a->address2.v6, s, sizeof(s));
330
331                         fw3_pr("-%s", s);
332                 }
333         }
334         else if (ipset->portrange.set)
335         {
336                 fw3_pr(" range %u-%u",
337                        ipset->portrange.port_min, ipset->portrange.port_max);
338         }
339
340         if (ipset->family != FW3_FAMILY_ANY)
341                 fw3_pr(" family inet%s", (ipset->family == FW3_FAMILY_V4) ? "" : "6");
342
343         if (ipset->timeout > 0)
344                 fw3_pr(" timeout %u", ipset->timeout);
345
346         if (ipset->maxelem > 0)
347                 fw3_pr(" maxelem %u", ipset->maxelem);
348
349         if (ipset->netmask > 0)
350                 fw3_pr(" netmask %u", ipset->netmask);
351
352         if (ipset->hashsize > 0)
353                 fw3_pr(" hashsize %u", ipset->hashsize);
354
355         fw3_pr("\n");
356
357         fw3_set_running(ipset, &state->running_ipsets);
358 }
359
360 void
361 fw3_create_ipsets(struct fw3_state *state)
362 {
363         struct fw3_ipset *ipset;
364
365         if (state->disable_ipsets)
366                 return;
367
368         list_for_each_entry(ipset, &state->ipsets, list)
369                 if (!fw3_lookup_ipset(state, ipset->name, true))
370                         create_ipset(ipset, state);
371
372         fw3_pr("quit\n");
373 }
374
375 void
376 fw3_destroy_ipsets(struct fw3_state *state)
377 {
378         struct fw3_ipset *s, *tmp;
379         int mask = (1 << FW3_FAMILY_V4) | (1 << FW3_FAMILY_V6);
380
381         list_for_each_entry_safe(s, tmp, &state->running_ipsets, running_list)
382         {
383                 if (!hasbit(state->defaults.flags, FW3_FAMILY_V4))
384                         delbit(s->flags, FW3_FAMILY_V4);
385
386                 if (!hasbit(state->defaults.flags, FW3_FAMILY_V6))
387                         delbit(s->flags, FW3_FAMILY_V6);
388
389                 if (!(s->flags & mask))
390                 {
391                         info("Deleting ipset %s", s->name);
392
393                         fw3_pr("flush %s\n", s->name);
394                         fw3_pr("destroy %s\n", s->name);
395
396                         fw3_set_running(s, NULL);
397                 }
398         }
399 }
400
401 struct fw3_ipset *
402 fw3_lookup_ipset(struct fw3_state *state, const char *name, bool running)
403 {
404         struct fw3_ipset *s;
405
406         if (list_empty(&state->ipsets))
407                 return NULL;
408
409         list_for_each_entry(s, &state->ipsets, list)
410         {
411                 if (strcmp(s->name, name))
412                         continue;
413
414                 if (!running || s->running_list.next)
415                         return s;
416
417                 break;
418         }
419
420         return NULL;
421 }