2bf2c37452b4c1f8e8b6750ac2045f2c45411e4b
[project/firewall3.git] / redirects.c
1 /*
2  * firewall3 - 3rd OpenWrt UCI firewall implementation
3  *
4  *   Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
5  *
6  * Permission to use, copy, modify, and/or distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18
19 #include "redirects.h"
20
21
22 static struct fw3_option redirect_opts[] = {
23         FW3_OPT("name",                string,   redirect,     name),
24         FW3_OPT("family",              family,   redirect,     family),
25
26         FW3_OPT("src",                 device,   redirect,     src),
27         FW3_OPT("dest",                device,   redirect,     dest),
28
29         FW3_OPT("ipset",               device,   redirect,     ipset),
30
31         FW3_LIST("proto",              protocol, redirect,     proto),
32
33         FW3_OPT("src_ip",              address,  redirect,     ip_src),
34         FW3_LIST("src_mac",            mac,      redirect,     mac_src),
35         FW3_OPT("src_port",            port,     redirect,     port_src),
36
37         FW3_OPT("src_dip",             address,  redirect,     ip_dest),
38         FW3_OPT("src_dport",           port,     redirect,     port_dest),
39
40         FW3_OPT("dest_ip",             address,  redirect,     ip_redir),
41         FW3_OPT("dest_port",           port,     redirect,     port_redir),
42
43         FW3_OPT("extra",               string,   redirect,     extra),
44
45         FW3_OPT("reflection",          bool,     redirect,     reflection),
46
47         FW3_OPT("target",              target,   redirect,     target),
48 };
49
50
51 void
52 fw3_load_redirects(struct fw3_state *state, struct uci_package *p)
53 {
54         struct uci_section *s;
55         struct uci_element *e;
56         struct fw3_redirect *redir;
57
58         bool valid = false;
59
60         INIT_LIST_HEAD(&state->redirects);
61
62         uci_foreach_element(&p->sections, e)
63         {
64                 s = uci_to_section(e);
65
66                 if (strcmp(s->type, "redirect"))
67                         continue;
68
69                 redir = malloc(sizeof(*redir));
70
71                 if (!redir)
72                         continue;
73
74                 memset(redir, 0, sizeof(*redir));
75
76                 INIT_LIST_HEAD(&redir->proto);
77                 INIT_LIST_HEAD(&redir->mac_src);
78
79                 redir->reflection = true;
80
81                 fw3_parse_options(redir, redirect_opts, ARRAY_SIZE(redirect_opts), s);
82
83                 if (redir->src.invert)
84                 {
85                         warn_elem(e, "must not have an inverted source");
86                         fw3_free_redirect(redir);
87                         continue;
88                 }
89                 else if (redir->src.set && !redir->src.any &&
90                          !(redir->_src = fw3_lookup_zone(state, redir->src.name)))
91                 {
92                         warn_elem(e, "refers to not existing zone '%s'", redir->src.name);
93                         fw3_free_redirect(redir);
94                         continue;
95                 }
96                 else if (redir->dest.set && !redir->dest.any &&
97                          !(redir->_dest = fw3_lookup_zone(state, redir->dest.name)))
98                 {
99                         warn_elem(e, "refers to not existing zone '%s'", redir->dest.name);
100                         fw3_free_redirect(redir);
101                         continue;
102                 }
103                 else if (redir->ipset.set && state->disable_ipsets)
104                 {
105                         warn_elem(e, "skipped due to disabled ipset support");
106                         fw3_free_redirect(redir);
107                         continue;
108                 }
109                 else if (redir->ipset.set && !redir->ipset.any &&
110                          !(redir->_ipset = fw3_lookup_ipset(state, redir->ipset.name)))
111                 {
112                         warn_elem(e, "refers to not declared ipset '%s'", redir->ipset.name);
113                         fw3_free_redirect(redir);
114                         continue;
115                 }
116
117                 if (redir->target == FW3_TARGET_UNSPEC)
118                 {
119                         warn_elem(e, "has no target specified, defaulting to DNAT");
120                         redir->target = FW3_TARGET_DNAT;
121                 }
122                 else if (redir->target < FW3_TARGET_DNAT)
123                 {
124                         warn_elem(e, "has invalid target specified, defaulting to DNAT");
125                         redir->target = FW3_TARGET_DNAT;
126                 }
127
128                 if (redir->target == FW3_TARGET_DNAT)
129                 {
130                         if (redir->src.any)
131                                 warn_elem(e, "must not have source '*' for DNAT target");
132                         else if (!redir->_src)
133                                 warn_elem(e, "has no source specified");
134                         else
135                         {
136                                 redir->_src->has_dest_target[redir->target] = true;
137                                 redir->_src->conntrack = true;
138                                 valid = true;
139                         }
140
141                         if (redir->reflection && redir->_dest && redir->_src->masq)
142                         {
143                                 redir->_dest->has_dest_target[FW3_TARGET_ACCEPT] = true;
144                                 redir->_dest->has_dest_target[FW3_TARGET_DNAT]   = true;
145                                 redir->_dest->has_dest_target[FW3_TARGET_SNAT]   = true;
146                         }
147                 }
148                 else
149                 {
150                         if (redir->dest.any)
151                                 warn_elem(e, "must not have destination '*' for SNAT target");
152                         else if (!redir->_dest)
153                                 warn_elem(e, "has no destination specified");
154                         else if (!redir->ip_dest.set)
155                                 warn_elem(e, "has no src_dip option specified");
156                         else
157                         {
158                                 redir->_dest->has_dest_target[redir->target] = true;
159                                 redir->_dest->conntrack = true;
160                                 valid = true;
161                         }
162                 }
163
164                 if (!valid)
165                 {
166                         fw3_free_redirect(redir);
167                         continue;
168                 }
169
170                 if (!redir->port_redir.set)
171                         redir->port_redir = redir->port_dest;
172
173                 list_add_tail(&redir->list, &state->redirects);
174         }
175 }
176
177 static void
178 print_chain_nat(struct fw3_redirect *redir)
179 {
180         if (redir->target == FW3_TARGET_DNAT)
181                 fw3_pr("-A zone_%s_prerouting", redir->src.name);
182         else
183                 fw3_pr("-A zone_%s_postrouting", redir->dest.name);
184 }
185
186 static void
187 print_snat_dnat(enum fw3_target target,
188                 struct fw3_address *addr, struct fw3_port *port)
189 {
190         const char *t;
191         char s[sizeof("255.255.255.255 ")];
192
193         if (target == FW3_TARGET_DNAT)
194                 t = "DNAT --to-destination";
195         else
196                 t = "SNAT --to-source";
197
198         inet_ntop(AF_INET, &addr->address.v4, s, sizeof(s));
199
200         fw3_pr(" -j %s %s", t, s);
201
202         if (port && port->set)
203         {
204                 if (port->port_min == port->port_max)
205                         fw3_pr(":%u", port->port_min);
206                 else
207                         fw3_pr(":%u-%u", port->port_min, port->port_max);
208         }
209
210         fw3_pr("\n");
211 }
212
213 static void
214 print_target_nat(struct fw3_redirect *redir)
215 {
216         if (redir->target == FW3_TARGET_DNAT)
217                 print_snat_dnat(redir->target, &redir->ip_redir, &redir->port_redir);
218         else
219                 print_snat_dnat(redir->target, &redir->ip_dest, &redir->port_dest);
220 }
221
222 static void
223 print_chain_filter(struct fw3_redirect *redir)
224 {
225         if (redir->target == FW3_TARGET_DNAT)
226         {
227                 /* XXX: check for local ip */
228                 if (!redir->ip_redir.set)
229                         fw3_pr("-A zone_%s_input", redir->src.name);
230                 else
231                         fw3_pr("-A zone_%s_forward", redir->src.name);
232         }
233         else
234         {
235                 if (redir->src.set && !redir->src.any)
236                         fw3_pr("-A zone_%s_forward", redir->src.name);
237                 else
238                         fw3_pr("-A delegate_forward");
239         }
240 }
241
242 static void
243 print_target_filter(struct fw3_redirect *redir)
244 {
245         /* XXX: check for local ip */
246         if (redir->target == FW3_TARGET_DNAT && !redir->ip_redir.set)
247                 fw3_pr(" -m conntrack --ctstate DNAT -j ACCEPT\n");
248         else
249                 fw3_pr(" -j ACCEPT\n");
250 }
251
252 static void
253 print_redirect(enum fw3_table table, enum fw3_family family,
254                struct fw3_redirect *redir, int num)
255 {
256         struct list_head *ext_addrs, *int_addrs;
257         struct fw3_address *ext_addr, *int_addr;
258         struct fw3_device *ext_net, *int_net;
259         struct fw3_protocol *proto;
260         struct fw3_mac *mac;
261
262         fw3_foreach(proto, &redir->proto)
263         fw3_foreach(mac, &redir->mac_src)
264         {
265                 if (table == FW3_TABLE_NAT)
266                 {
267                         if (redir->name)
268                                 info("   * Redirect '%s'", redir->name);
269                         else
270                                 info("   * Redirect #%u", num);
271
272                         print_chain_nat(redir);
273                         fw3_format_ipset(redir->_ipset, redir->ipset.invert);
274                         fw3_format_protocol(proto, family);
275
276                         if (redir->target == FW3_TARGET_DNAT)
277                         {
278                                 fw3_format_src_dest(&redir->ip_src, &redir->ip_dest);
279                                 fw3_format_sport_dport(&redir->port_src, &redir->port_dest);
280                         }
281                         else
282                         {
283                                 fw3_format_src_dest(&redir->ip_src, &redir->ip_redir);
284                                 fw3_format_sport_dport(&redir->port_src, &redir->port_redir);
285                         }
286
287                         fw3_format_mac(mac);
288                         fw3_format_extra(redir->extra);
289                         fw3_format_comment(redir->name);
290                         print_target_nat(redir);
291                 }
292                 else if (table == FW3_TABLE_FILTER)
293                 {
294                         if (redir->name)
295                                 info("   * Redirect '%s'", redir->name);
296                         else
297                                 info("   * Redirect #%u", num);
298
299                         print_chain_filter(redir);
300                         fw3_format_ipset(redir->_ipset, redir->ipset.invert);
301                         fw3_format_protocol(proto, family);
302                         fw3_format_src_dest(&redir->ip_src, &redir->ip_redir);
303                         fw3_format_sport_dport(&redir->port_src, &redir->port_redir);
304                         fw3_format_mac(mac);
305                         fw3_format_extra(redir->extra);
306                         fw3_format_comment(redir->name);
307                         print_target_filter(redir);
308                 }
309         }
310
311         /* reflection rules */
312         if (redir->target != FW3_TARGET_DNAT || !redir->reflection)
313                 return;
314
315         if (!redir->_dest || !redir->_src->masq)
316                 return;
317
318         list_for_each_entry(ext_net, &redir->_src->networks, list)
319         {
320                 ext_addrs = fw3_ubus_address(ext_net->name);
321
322                 if (!ext_addrs || list_empty(ext_addrs))
323                         continue;
324
325                 list_for_each_entry(int_net, &redir->_dest->networks, list)
326                 {
327                         int_addrs = fw3_ubus_address(int_net->name);
328
329                         if (!int_addrs || list_empty(int_addrs))
330                                 continue;
331
332                         fw3_foreach(ext_addr, ext_addrs)
333                         fw3_foreach(int_addr, int_addrs)
334                         fw3_foreach(proto, &redir->proto)
335                         {
336                                 if (!fw3_is_family(int_addr, family) ||
337                                     !fw3_is_family(ext_addr, family))
338                                         continue;
339
340                                 if (!proto || (proto->protocol != 6 && proto->protocol != 17))
341                                         continue;
342
343                                 ext_addr->mask = 32;
344
345                                 if (table == FW3_TABLE_NAT)
346                                 {
347                                         fw3_pr("-A zone_%s_prerouting", redir->dest.name);
348                                         fw3_format_protocol(proto, family);
349                                         fw3_format_src_dest(int_addr, ext_addr);
350                                         fw3_format_sport_dport(NULL, &redir->port_dest);
351                                         fw3_format_comment(redir->name, " (reflection)");
352                                         print_snat_dnat(FW3_TARGET_DNAT,
353                                                         &redir->ip_redir, &redir->port_redir);
354
355                                         fw3_pr("-A zone_%s_postrouting", redir->dest.name);
356                                         fw3_format_protocol(proto, family);
357                                         fw3_format_src_dest(int_addr, &redir->ip_redir);
358                                         fw3_format_sport_dport(NULL, &redir->port_redir);
359                                         fw3_format_comment(redir->name, " (reflection)");
360                                         print_snat_dnat(FW3_TARGET_SNAT, ext_addr, NULL);
361                                 }
362                                 else if (table == FW3_TABLE_FILTER)
363                                 {
364                                         fw3_pr("-A zone_%s_forward", redir->dest.name);
365                                         fw3_format_protocol(proto, family);
366                                         fw3_format_src_dest(int_addr, &redir->ip_redir);
367                                         fw3_format_sport_dport(NULL, &redir->port_redir);
368                                         fw3_format_comment(redir->name, " (reflection)");
369                                         fw3_pr(" -j zone_%s_dest_ACCEPT\n", redir->dest.name);
370                                 }
371                         }
372
373                         fw3_ubus_address_free(int_addrs);
374                 }
375
376                 fw3_ubus_address_free(ext_addrs);
377         }
378 }
379
380 void
381 fw3_print_redirects(enum fw3_table table, enum fw3_family family,
382                     struct fw3_state *state)
383 {
384         int num = 0;
385         struct fw3_redirect *redir;
386
387         if (family == FW3_FAMILY_V6)
388                 return;
389
390         list_for_each_entry(redir, &state->redirects, list)
391                 print_redirect(table, family, redir, num++);
392 }
393
394 void
395 fw3_free_redirect(struct fw3_redirect *redir)
396 {
397         fw3_free_list(&redir->proto);
398         fw3_free_list(&redir->mac_src);
399         free(redir);
400 }