forwards.c

   1 /*
   2  * firewall3 - 3rd OpenWrt UCI firewall implementation
   3  *
   4  *   Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
   5  *
   6  * Permission to use, copy, modify, and/or distribute this software for any
   7  * purpose with or without fee is hereby granted, provided that the above
   8  * copyright notice and this permission notice appear in all copies.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17  */
  18
  19 #include "forwards.h"
  20
  21
  22 const struct fw3_option fw3_forward_opts[] = {
  23         FW3_OPT("enabled",             bool,     forward,     enabled),
  24
  25         FW3_OPT("name",                string,   forward,     name),
  26         FW3_OPT("family",              family,   forward,     family),
  27
  28         FW3_OPT("src",                 device,   forward,     src),
  29         FW3_OPT("dest",                device,   forward,     dest),
  30
  31         { }
  32 };
  33
  34
  35 void
  36 fw3_load_forwards(struct fw3_state *state, struct uci_package *p)
  37 {
  38         struct uci_section *s;
  39         struct uci_element *e;
  40         struct fw3_forward *forward;
  41
  42         INIT_LIST_HEAD(&state->forwards);
  43
  44         uci_foreach_element(&p->sections, e)
  45         {
  46                 s = uci_to_section(e);
  47
  48                 if (strcmp(s->type, "forwarding"))
  49                         continue;
  50
  51                 forward = malloc(sizeof(*forward));
  52
  53                 if (!forward)
  54                         continue;
  55
  56                 memset(forward, 0, sizeof(*forward));
  57
  58                 forward->enabled = true;
  59
  60                 fw3_parse_options(forward, fw3_forward_opts, s);
  61
  62                 if (!forward->enabled)
  63                 {
  64                         fw3_free_forward(forward);
  65                         continue;
  66                 }
  67
  68                 if (forward->src.invert || forward->dest.invert)
  69                 {
  70                         warn_elem(e, "must not have inverted 'src' or 'dest' options");
  71                         fw3_free_forward(forward);
  72                         continue;
  73                 }
  74                 else if (forward->src.set && !forward->src.any &&
  75                          !(forward->_src = fw3_lookup_zone(state, forward->src.name, false)))
  76                 {
  77                         warn_elem(e, "refers to not existing zone '%s'", forward->src.name);
  78                         fw3_free_forward(forward);
  79                         continue;
  80                 }
  81                 else if (forward->dest.set && !forward->dest.any &&
  82                          !(forward->_dest = fw3_lookup_zone(state, forward->dest.name, false)))
  83                 {
  84                         warn_elem(e, "refers to not existing zone '%s'", forward->dest.name);
  85                         fw3_free_forward(forward);
  86                         continue;
  87                 }
  88
  89                 if (forward->_dest)
  90                 {
  91                         setbit(forward->_dest->flags, FW3_TARGET_ACCEPT);
  92
  93                         if (forward->_src &&
  94                             (forward->_src->conntrack || forward->_dest->conntrack))
  95                         {
  96                                 forward->_src->conntrack = forward->_dest->conntrack = true;
  97                         }
  98                 }
  99
 100                 list_add_tail(&forward->list, &state->forwards);
 101                 continue;
 102         }
 103 }
 104
 105
 106 static void
 107 print_chain(struct fw3_forward *forward)
 108 {
 109         if (forward->src.any || !forward->src.set)
 110                 fw3_pr("-A delegate_forward");
 111         else
 112                 fw3_pr("-A zone_%s_forward", forward->src.name);
 113 }
 114
 115 static void print_target(struct fw3_forward *forward)
 116 {
 117         if (forward->dest.any || !forward->dest.set)
 118                 fw3_pr(" -j ACCEPT\n");
 119         else
 120                 fw3_pr(" -j zone_%s_dest_ACCEPT\n", forward->dest.name);
 121 }
 122
 123 static void
 124 print_forward(enum fw3_table table, enum fw3_family family,
 125               struct fw3_forward *forward)
 126 {
 127         const char *s, *d;
 128
 129         if (table != FW3_TABLE_FILTER)
 130                 return;
 131
 132         if (!fw3_is_family(forward, family))
 133                 return;
 134
 135         s = forward->_src  ? forward->_src->name  : "*";
 136         d = forward->_dest ? forward->_dest->name : "*";
 137
 138         info("   * Forward '%s' -> '%s'", s, d);
 139
 140         if (!fw3_is_family(forward->_src, family) ||
 141             !fw3_is_family(forward->_dest, family))
 142         {
 143                 info("     ! Skipping due to different family of zone");
 144                 return;
 145         }
 146
 147         print_chain(forward);
 148         fw3_format_comment("forwarding ", s, "->", d);
 149         print_target(forward);
 150 }
 151
 152 void
 153 fw3_print_forwards(enum fw3_table table, enum fw3_family family,
 154                    struct fw3_state *state)
 155 {
 156         struct fw3_forward *forward;
 157
 158         list_for_each_entry(forward, &state->forwards, list)
 159                 print_forward(table, family, forward);
 160 }