2 * firewall3 - 3rd OpenWrt UCI firewall implementation
4 * Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
6 * Permission to use, copy, modify, and/or distribute this software for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
23 static struct fw3_option zone_opts[] = {
24 FW3_OPT("name", string, zone, name),
26 FW3_LIST("network", device, zone, networks),
27 FW3_LIST("device", device, zone, devices),
28 FW3_LIST("subnet", address, zone, subnets),
30 FW3_OPT("input", target, zone, policy_input),
31 FW3_OPT("forward", target, zone, policy_forward),
32 FW3_OPT("output", target, zone, policy_output),
34 FW3_OPT("masq", bool, zone, masq),
35 FW3_LIST("masq_src", address, zone, masq_src),
36 FW3_LIST("masq_dest", address, zone, masq_dest),
38 FW3_OPT("extra", string, zone, extra_src),
39 FW3_OPT("extra_src", string, zone, extra_src),
40 FW3_OPT("extra_dest", string, zone, extra_dest),
42 FW3_OPT("conntrack", bool, zone, conntrack),
43 FW3_OPT("mtu_fix", bool, zone, mtu_fix),
44 FW3_OPT("custom_chains", bool, zone, custom_chains),
46 FW3_OPT("log", bool, zone, log),
47 FW3_OPT("log_limit", limit, zone, log_limit),
52 check_policy(struct uci_element *e, enum fw3_target *pol, enum fw3_target def,
55 if (*pol == FW3_TARGET_UNSPEC)
57 warn_elem(e, "has no %s policy specified, using default", name);
60 else if (*pol > FW3_TARGET_DROP)
62 warn_elem(e, "has invalid %s policy, using default", name);
68 resolve_networks(struct uci_element *e, struct fw3_zone *zone)
70 struct fw3_device *net, *tmp;
72 list_for_each_entry(net, &zone->networks, list)
74 tmp = fw3_ubus_device(net->name);
78 warn_elem(e, "cannot resolve device of network '%s'", net->name);
82 list_add_tail(&tmp->list, &zone->devices);
87 fw3_load_zones(struct fw3_state *state, struct uci_package *p)
89 struct uci_section *s;
90 struct uci_element *e;
91 struct fw3_zone *zone;
92 struct fw3_defaults *defs = &state->defaults;
94 INIT_LIST_HEAD(&state->zones);
96 uci_foreach_element(&p->sections, e)
98 s = uci_to_section(e);
100 if (strcmp(s->type, "zone"))
103 zone = malloc(sizeof(*zone));
108 memset(zone, 0, sizeof(*zone));
110 INIT_LIST_HEAD(&zone->networks);
111 INIT_LIST_HEAD(&zone->devices);
112 INIT_LIST_HEAD(&zone->subnets);
113 INIT_LIST_HEAD(&zone->masq_src);
114 INIT_LIST_HEAD(&zone->masq_dest);
116 zone->log_limit.rate = 10;
118 fw3_parse_options(zone, zone_opts, ARRAY_SIZE(zone_opts), s);
120 if (!zone->extra_dest)
121 zone->extra_dest = zone->extra_src;
123 if (!zone->name || !*zone->name)
125 warn_elem(e, "has no name - ignoring");
130 if (list_empty(&zone->networks) && list_empty(&zone->devices) &&
131 list_empty(&zone->subnets) && !zone->extra_src)
133 warn_elem(e, "has no device, network, subnet or extra options");
136 check_policy(e, &zone->policy_input, defs->policy_input, "input");
137 check_policy(e, &zone->policy_output, defs->policy_output, "output");
138 check_policy(e, &zone->policy_forward, defs->policy_forward, "forward");
140 resolve_networks(e, zone);
144 zone->has_dest_target[FW3_TARGET_SNAT] = true;
145 zone->conntrack = true;
148 zone->has_src_target[zone->policy_input] = true;
149 zone->has_dest_target[zone->policy_output] = true;
150 zone->has_dest_target[zone->policy_forward] = true;
152 list_add_tail(&zone->list, &state->zones);
158 print_zone_chain(enum fw3_table table, enum fw3_family family,
159 struct fw3_zone *zone, bool disable_notrack)
162 const char *targets[] = {
169 if (!fw3_is_family(zone, family))
174 case FW3_TABLE_FILTER:
175 info(" * Zone '%s'", zone->name);
177 for (t = FW3_TARGET_ACCEPT; t <= FW3_TARGET_DROP; t++)
179 if (zone->has_src_target[t])
180 fw3_pr(":zone_%s_src_%s - [0:0]\n", zone->name, targets[t]);
182 if (zone->has_dest_target[t])
183 fw3_pr(":zone_%s_dest_%s - [0:0]\n", zone->name, targets[t]);
186 fw3_pr(":zone_%s_forward - [0:0]\n", zone->name);
187 fw3_pr(":zone_%s_input - [0:0]\n", zone->name);
188 fw3_pr(":zone_%s_output - [0:0]\n", zone->name);
192 if (family == FW3_FAMILY_V4)
194 info(" * Zone '%s'", zone->name);
196 if (zone->has_dest_target[FW3_TARGET_SNAT])
197 fw3_pr(":zone_%s_postrouting - [0:0]\n", zone->name);
199 if (zone->has_dest_target[FW3_TARGET_DNAT])
200 fw3_pr(":zone_%s_prerouting - [0:0]\n", zone->name);
205 if (!zone->conntrack && !disable_notrack)
207 info(" * Zone '%s'", zone->name);
208 fw3_pr(":zone_%s_notrack - [0:0]\n", zone->name);
212 case FW3_TABLE_MANGLE:
218 print_interface_rule(enum fw3_table table, enum fw3_family family,
219 struct fw3_zone *zone, struct fw3_device *dev,
220 struct fw3_address *sub, bool disable_notrack)
223 const char *targets[] = {
230 if (table == FW3_TABLE_FILTER)
232 for (t = FW3_TARGET_ACCEPT; t <= FW3_TARGET_DROP; t++)
234 if (zone->has_src_target[t])
236 fw3_pr("-A zone_%s_src_%s", zone->name, targets[t*2]);
237 fw3_format_in_out(dev, NULL);
238 fw3_format_src_dest(sub, NULL);
239 fw3_format_extra(zone->extra_src);
240 fw3_pr(" -j %s\n", targets[t*2+1]);
243 if (zone->has_dest_target[t])
245 fw3_pr("-A zone_%s_dest_%s", zone->name, targets[t*2]);
246 fw3_format_in_out(NULL, dev);
247 fw3_format_src_dest(NULL, sub);
248 fw3_format_extra(zone->extra_dest);
249 fw3_pr(" -j %s\n", targets[t*2+1]);
253 fw3_pr("-A delegate_input");
254 fw3_format_in_out(dev, NULL);
255 fw3_format_src_dest(sub, NULL);
256 fw3_format_extra(zone->extra_src);
257 fw3_pr(" -j zone_%s_input\n", zone->name);
259 fw3_pr("-A delegate_forward");
260 fw3_format_in_out(dev, NULL);
261 fw3_format_src_dest(sub, NULL);
262 fw3_format_extra(zone->extra_src);
263 fw3_pr(" -j zone_%s_forward\n", zone->name);
265 fw3_pr("-A delegate_output");
266 fw3_format_in_out(NULL, dev);
267 fw3_format_src_dest(NULL, sub);
268 fw3_format_extra(zone->extra_dest);
269 fw3_pr(" -j zone_%s_output\n", zone->name);
271 else if (table == FW3_TABLE_NAT)
273 if (zone->has_dest_target[FW3_TARGET_DNAT])
275 fw3_pr("-A PREROUTING");
276 fw3_format_in_out(dev, NULL);
277 fw3_format_src_dest(sub, NULL);
278 fw3_format_extra(zone->extra_src);
279 fw3_pr(" -j zone_%s_prerouting\n", zone->name);
282 if (zone->has_dest_target[FW3_TARGET_SNAT])
284 fw3_pr("-A POSTROUTING");
285 fw3_format_in_out(NULL, dev);
286 fw3_format_src_dest(NULL, sub);
287 fw3_format_extra(zone->extra_dest);
288 fw3_pr(" -j zone_%s_postrouting\n", zone->name);
291 else if (table == FW3_TABLE_MANGLE)
298 fw3_format_in_out(NULL, dev);
299 fw3_format_src_dest(NULL, sub);
300 fw3_pr(" -p tcp --tcp-flags SYN,RST SYN");
301 fw3_format_limit(&zone->log_limit);
302 fw3_format_comment(zone->name, " (mtu_fix logging)");
303 fw3_pr(" -j LOG --log-prefix \"MSSFIX(%s): \"\n", zone->name);
307 fw3_format_in_out(NULL, dev);
308 fw3_format_src_dest(NULL, sub);
309 fw3_pr(" -p tcp --tcp-flags SYN,RST SYN");
310 fw3_format_comment(zone->name, " (mtu_fix)");
311 fw3_pr(" -j TCPMSS --clamp-mss-to-pmtu\n");
314 else if (table == FW3_TABLE_RAW)
316 if (!zone->conntrack && !disable_notrack)
318 fw3_pr("-A notrack");
319 fw3_format_in_out(dev, NULL);
320 fw3_format_src_dest(sub, NULL);
321 fw3_format_extra(zone->extra_src);
322 fw3_format_comment(zone->name, " (notrack)");
323 fw3_pr(" -j CT --notrack\n", zone->name);
329 print_interface_rules(enum fw3_table table, enum fw3_family family,
330 struct fw3_zone *zone, bool disable_notrack)
332 struct fw3_device *dev;
333 struct fw3_address *sub;
335 fw3_foreach(dev, &zone->devices)
336 fw3_foreach(sub, &zone->subnets)
338 if (!fw3_is_family(sub, family))
344 print_interface_rule(table, family, zone, dev, sub, disable_notrack);
349 print_zone_rule(enum fw3_table table, enum fw3_family family,
350 struct fw3_zone *zone, bool disable_notrack)
352 struct fw3_address *msrc;
353 struct fw3_address *mdest;
356 const char *targets[] = {
366 if (!fw3_is_family(zone, family))
371 case FW3_TABLE_FILTER:
372 fw3_pr("-A zone_%s_input -j zone_%s_src_%s\n",
373 zone->name, zone->name, targets[zone->policy_input]);
375 fw3_pr("-A zone_%s_forward -j zone_%s_dest_%s\n",
376 zone->name, zone->name, targets[zone->policy_forward]);
378 fw3_pr("-A zone_%s_output -j zone_%s_dest_%s\n",
379 zone->name, zone->name, targets[zone->policy_output]);
383 for (t = FW3_TARGET_REJECT; t <= FW3_TARGET_DROP; t++)
385 if (zone->has_src_target[t])
387 fw3_pr("-A zone_%s_src_%s", zone->name, targets[t]);
388 fw3_format_limit(&zone->log_limit);
389 fw3_pr(" -j LOG --log-prefix \"%s(src %s)\"\n",
390 targets[t], zone->name);
393 if (zone->has_dest_target[t])
395 fw3_pr("-A zone_%s_dest_%s", zone->name, targets[t]);
396 fw3_format_limit(&zone->log_limit);
397 fw3_pr(" -j LOG --log-prefix \"%s(dest %s)\"\n",
398 targets[t], zone->name);
405 if (zone->masq && family == FW3_FAMILY_V4)
407 fw3_foreach(msrc, &zone->masq_src)
408 fw3_foreach(mdest, &zone->masq_dest)
410 fw3_pr("-A zone_%s_postrouting ", zone->name);
411 fw3_format_src_dest(msrc, mdest);
412 fw3_pr("-j MASQUERADE\n");
418 case FW3_TABLE_MANGLE:
422 print_interface_rules(table, family, zone, disable_notrack);
426 fw3_print_zone_chains(enum fw3_table table, enum fw3_family family,
427 struct fw3_state *state)
429 struct fw3_zone *zone;
431 list_for_each_entry(zone, &state->zones, list)
432 print_zone_chain(table, family, zone, state->defaults.drop_invalid);
436 fw3_print_zone_rules(enum fw3_table table, enum fw3_family family,
437 struct fw3_state *state)
439 struct fw3_zone *zone;
441 list_for_each_entry(zone, &state->zones, list)
442 print_zone_rule(table, family, zone, state->defaults.drop_invalid);
447 fw3_lookup_zone(struct fw3_state *state, const char *name)
451 if (list_empty(&state->zones))
454 list_for_each_entry(z, &state->zones, list)
455 if (!strcmp(z->name, name))
462 fw3_free_zone(struct fw3_zone *zone)
464 fw3_free_list(&zone->networks);
465 fw3_free_list(&zone->devices);
466 fw3_free_list(&zone->subnets);
468 fw3_free_list(&zone->masq_src);
469 fw3_free_list(&zone->masq_dest);