Rework zone flush logic
[project/firewall3.git] / utils.c
1 /*
2  * firewall3 - 3rd OpenWrt UCI firewall implementation
3  *
4  *   Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
5  *
6  * Permission to use, copy, modify, and/or distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18
19 #include "utils.h"
20 #include "options.h"
21
22 #include "zones.h"
23 #include "ipsets.h"
24
25
26 static int lock_fd = -1;
27 static pid_t pipe_pid = -1;
28 static FILE *pipe_fd = NULL;
29
30 bool fw3_pr_debug = false;
31
32
33 static void
34 warn_elem_section_name(struct uci_section *s, bool find_name)
35 {
36         int i = 0;
37         struct uci_option *o;
38         struct uci_element *tmp;
39
40         if (s->anonymous)
41         {
42                 uci_foreach_element(&s->package->sections, tmp)
43                 {
44                         if (strcmp(uci_to_section(tmp)->type, s->type))
45                                 continue;
46
47                         if (&s->e == tmp)
48                                 break;
49
50                         i++;
51                 }
52
53                 fprintf(stderr, "@%s[%d]", s->type, i);
54
55                 if (find_name)
56                 {
57                         uci_foreach_element(&s->options, tmp)
58                         {
59                                 o = uci_to_option(tmp);
60
61                                 if (!strcmp(tmp->name, "name") && (o->type == UCI_TYPE_STRING))
62                                 {
63                                         fprintf(stderr, " (%s)", o->v.string);
64                                         break;
65                                 }
66                         }
67                 }
68         }
69         else
70         {
71                 fprintf(stderr, "'%s'", s->e.name);
72         }
73
74         if (find_name)
75                 fprintf(stderr, " ");
76 }
77
78 void
79 warn_elem(struct uci_element *e, const char *format, ...)
80 {
81         if (e->type == UCI_TYPE_SECTION)
82         {
83                 fprintf(stderr, "Warning: Section ");
84                 warn_elem_section_name(uci_to_section(e), true);
85         }
86         else if (e->type == UCI_TYPE_OPTION)
87         {
88                 fprintf(stderr, "Warning: Option ");
89                 warn_elem_section_name(uci_to_option(e)->section, false);
90                 fprintf(stderr, ".%s ", e->name);
91         }
92
93     va_list argptr;
94     va_start(argptr, format);
95     vfprintf(stderr, format, argptr);
96     va_end(argptr);
97
98         fprintf(stderr, "\n");
99 }
100
101 void
102 warn(const char* format, ...)
103 {
104         fprintf(stderr, "Warning: ");
105     va_list argptr;
106     va_start(argptr, format);
107     vfprintf(stderr, format, argptr);
108     va_end(argptr);
109         fprintf(stderr, "\n");
110 }
111
112 void
113 error(const char* format, ...)
114 {
115         fprintf(stderr, "Error: ");
116     va_list argptr;
117     va_start(argptr, format);
118     vfprintf(stderr, format, argptr);
119     va_end(argptr);
120         fprintf(stderr, "\n");
121
122         exit(1);
123 }
124
125 void
126 info(const char* format, ...)
127 {
128         va_list argptr;
129     va_start(argptr, format);
130     vfprintf(stderr, format, argptr);
131     va_end(argptr);
132         fprintf(stderr, "\n");
133 }
134
135 const char *
136 fw3_find_command(const char *cmd)
137 {
138         struct stat s;
139         int plen = 0, clen = strlen(cmd) + 1;
140         char *search, *p;
141         static char path[PATH_MAX];
142
143         if (!stat(cmd, &s) && S_ISREG(s.st_mode))
144                 return cmd;
145
146         search = getenv("PATH");
147
148         if (!search)
149                 search = "/bin:/usr/bin:/sbin:/usr/sbin";
150
151         p = search;
152
153         do
154         {
155                 if (*p != ':' && *p != '\0')
156                         continue;
157
158                 plen = p - search;
159
160                 if ((plen + clen) >= sizeof(path))
161                         continue;
162
163                 strncpy(path, search, plen);
164                 sprintf(path + plen, "/%s", cmd);
165
166                 if (!stat(path, &s) && S_ISREG(s.st_mode))
167                         return path;
168
169                 search = p + 1;
170         }
171         while (*p++);
172
173         return NULL;
174 }
175
176 bool
177 fw3_stdout_pipe(void)
178 {
179         pipe_fd = stdout;
180         return true;
181 }
182
183 bool
184 __fw3_command_pipe(bool silent, const char *command, ...)
185 {
186         pid_t pid;
187         va_list argp;
188         int pfds[2];
189         int argn;
190         char *arg, **args, **tmp;
191
192         command = fw3_find_command(command);
193
194         if (!command)
195                 return false;
196
197         if (pipe(pfds))
198                 return false;
199
200         argn = 2;
201         args = malloc(argn * sizeof(arg));
202
203         if (!args)
204                 return false;
205
206         args[0] = (char *)command;
207         args[1] = NULL;
208
209         va_start(argp, command);
210
211         while ((arg = va_arg(argp, char *)) != NULL)
212         {
213                 tmp = realloc(args, ++argn * sizeof(arg));
214
215                 if (!tmp)
216                         break;
217
218                 args = tmp;
219                 args[argn-2] = arg;
220                 args[argn-1] = NULL;
221         }
222
223         va_end(argp);
224
225         switch ((pid = fork()))
226         {
227         case -1:
228                 return false;
229
230         case 0:
231                 dup2(pfds[0], 0);
232
233                 close(pfds[0]);
234                 close(pfds[1]);
235
236                 close(1);
237
238                 if (silent)
239                         close(2);
240
241                 execv(command, args);
242
243         default:
244                 signal(SIGPIPE, SIG_IGN);
245                 pipe_pid = pid;
246                 close(pfds[0]);
247         }
248
249         pipe_fd = fdopen(pfds[1], "w");
250         return true;
251 }
252
253 void
254 fw3_pr(const char *fmt, ...)
255 {
256         va_list args;
257
258         if (fw3_pr_debug && pipe_fd != stdout)
259         {
260                 va_start(args, fmt);
261                 vfprintf(stderr, fmt, args);
262                 va_end(args);
263         }
264
265         va_start(args, fmt);
266         vfprintf(pipe_fd, fmt, args);
267         va_end(args);
268 }
269
270 void
271 fw3_command_close(void)
272 {
273         if (pipe_fd && pipe_fd != stdout)
274                 fclose(pipe_fd);
275
276         if (pipe_pid > -1)
277                 waitpid(pipe_pid, NULL, 0);
278
279         signal(SIGPIPE, SIG_DFL);
280
281         pipe_fd = NULL;
282         pipe_pid = -1;
283 }
284
285 bool
286 fw3_has_table(bool ipv6, const char *table)
287 {
288         FILE *f;
289
290         char line[12];
291         bool seen = false;
292
293         const char *path = ipv6
294                 ? "/proc/net/ip6_tables_names" : "/proc/net/ip_tables_names";
295
296         if (!(f = fopen(path, "r")))
297                 return false;
298
299         while (fgets(line, sizeof(line), f))
300         {
301                 if (!strncmp(line, table, strlen(table)))
302                 {
303                         seen = true;
304                         break;
305                 }
306         }
307
308         fclose(f);
309
310         return seen;
311 }
312
313
314 bool
315 fw3_lock(void)
316 {
317         lock_fd = open(FW3_LOCKFILE, O_CREAT|O_WRONLY, S_IRUSR|S_IWUSR);
318
319         if (lock_fd < 0)
320         {
321                 warn("Cannot create lock file %s: %s", FW3_LOCKFILE, strerror(errno));
322                 return false;
323         }
324
325         if (flock(lock_fd, LOCK_EX))
326         {
327                 warn("Cannot acquire exclusive lock: %s", strerror(errno));
328                 return false;
329         }
330
331         return true;
332 }
333
334 void
335 fw3_unlock(void)
336 {
337         if (lock_fd < 0)
338                 return;
339
340         if (flock(lock_fd, LOCK_UN))
341                 warn("Cannot release exclusive lock: %s", strerror(errno));
342
343         close(lock_fd);
344         unlink(FW3_LOCKFILE);
345
346         lock_fd = -1;
347 }
348
349
350 bool
351 fw3_read_statefile(void *state)
352 {
353         FILE *sf;
354
355         int type;
356         char line[128];
357         const char *p, *name;
358
359         uint32_t flags[2];
360
361         struct fw3_state *s = state;
362         struct fw3_zone *zone;
363         struct fw3_ipset *ipset;
364
365         sf = fopen(FW3_STATEFILE, "r");
366
367         if (!sf)
368                 return false;
369
370         while (fgets(line, sizeof(line), sf))
371         {
372                 p = strtok(line, " \t\n");
373
374                 if (!p)
375                         continue;
376
377                 type = strtoul(p, NULL, 16);
378                 name = strtok(NULL, " \t\n");
379
380                 if (!name)
381                         continue;
382
383                 if (!(p = strtok(NULL, " \t\n")))
384                         continue;
385
386                 flags[0] = strtoul(p, NULL, 16);
387
388                 if (!(p = strtok(NULL, " \t\n")))
389                         continue;
390
391                 flags[1] = strtoul(p, NULL, 16);
392
393                 switch (type)
394                 {
395                 case FW3_TYPE_DEFAULTS:
396                         s->defaults.flags[0] = flags[0];
397                         s->defaults.flags[1] = flags[1];
398                         break;
399
400                 case FW3_TYPE_ZONE:
401                         if (!(zone = fw3_lookup_zone(state, name, false)))
402                         {
403                                 zone = fw3_alloc_zone();
404
405                                 if (!zone)
406                                         continue;
407
408                                 zone->name = strdup(name);
409                                 list_add_tail(&zone->list, &s->zones);
410                         }
411
412                         zone->flags[0] = flags[0];
413                         zone->flags[1] = flags[1];
414                         list_add_tail(&zone->running_list, &s->running_zones);
415                         break;
416
417                 case FW3_TYPE_IPSET:
418                         if (!(ipset = fw3_lookup_ipset(state, name, false)))
419                         {
420                                 ipset = fw3_alloc_ipset();
421
422                                 if (!ipset)
423                                         continue;
424
425                                 ipset->name = strdup(name);
426                                 list_add_tail(&ipset->list, &s->ipsets);
427                         }
428
429                         ipset->flags[0] = flags[0];
430                         ipset->flags[1] = flags[1];
431                         list_add_tail(&ipset->running_list, &s->running_ipsets);
432                         break;
433                 }
434         }
435
436         fclose(sf);
437
438         return true;
439 }
440
441 void
442 fw3_write_statefile(void *state)
443 {
444         FILE *sf;
445         struct fw3_state *s = state;
446         struct fw3_defaults *d = &s->defaults;
447         struct fw3_zone *z;
448         struct fw3_ipset *i;
449
450         if (fw3_no_table(d->flags[0]) && fw3_no_table(d->flags[1]))
451         {
452                 if (unlink(FW3_STATEFILE))
453                         warn("Unable to remove state %s: %s",
454                              FW3_STATEFILE, strerror(errno));
455
456                 return;
457         }
458
459         sf = fopen(FW3_STATEFILE, "w");
460
461         if (!sf)
462         {
463                 warn("Cannot create state %s: %s", FW3_STATEFILE, strerror(errno));
464                 return;
465         }
466
467         fprintf(sf, "%x - %x %x\n", FW3_TYPE_DEFAULTS, d->flags[0], d->flags[1]);
468
469         list_for_each_entry(z, &s->running_zones, running_list)
470         {
471                 if (!fw3_no_table(z->flags[0]) || !fw3_no_table(z->flags[1]))
472                 {
473                         fprintf(sf, "%x %s %x %x\n",
474                                         FW3_TYPE_ZONE, z->name, z->flags[0], z->flags[1]);
475                 }
476         }
477
478         list_for_each_entry(i, &s->running_ipsets, running_list)
479         {
480                 if (!fw3_no_family(i->flags[0]) || !fw3_no_family(i->flags[1]))
481                 {
482                         fprintf(sf, "%x %s %x %x\n",
483                                         FW3_TYPE_IPSET, i->name, i->flags[0], i->flags[1]);
484                 }
485         }
486
487         fclose(sf);
488 }
489
490
491 struct object_list_heads
492 {
493         struct list_head list;
494         struct list_head running_list;
495 };
496
497 void
498 fw3_set_running(void *object, struct list_head *dest)
499 {
500         struct object_list_heads *o = object;
501
502         if (dest && !o->running_list.next)
503                 list_add_tail(&o->running_list, dest);
504         else if (!dest && o->running_list.next)
505                 list_del(&o->running_list);
506 }
507
508 void
509 fw3_free_object(void *obj, const void *opts)
510 {
511         const struct fw3_option *ol;
512         struct list_head *list, *cur, *tmp;
513
514         for (ol = opts; ol->name; ol++)
515         {
516                 if (!ol->elem_size)
517                         continue;
518
519                 list = (struct list_head *)((char *)obj + ol->offset);
520                 list_for_each_safe(cur, tmp, list)
521                 {
522                         list_del(cur);
523                         free(cur);
524                 }
525         }
526
527         free(obj);
528 }