main.c

   1 /*
   2  * firewall3 - 3rd OpenWrt UCI firewall implementation
   3  *
   4  *   Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
   5  *
   6  * Permission to use, copy, modify, and/or distribute this software for any
   7  * purpose with or without fee is hereby granted, provided that the above
   8  * copyright notice and this permission notice appear in all copies.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17  */
  18
  19 #include <stdio.h>
  20 #include <unistd.h>
  21
  22 #include "options.h"
  23 #include "defaults.h"
  24 #include "zones.h"
  25 #include "rules.h"
  26 #include "redirects.h"
  27 #include "forwards.h"
  28 #include "ipsets.h"
  29 #include "ubus.h"
  30
  31
  32 static bool print_rules = false;
  33 static bool skip_family[FW3_FAMILY_V6 + 1] = { false };
  34
  35
  36 static struct fw3_state *
  37 build_state(void)
  38 {
  39         struct fw3_state *state = NULL;
  40         struct uci_package *p = NULL;
  41
  42         state = malloc(sizeof(*state));
  43
  44         if (!state)
  45                 error("Out of memory");
  46
  47         memset(state, 0, sizeof(*state));
  48         state->uci = uci_alloc_context();
  49
  50         if (!state->uci)
  51                 error("Out of memory");
  52
  53         if (uci_load(state->uci, "firewall", &p))
  54         {
  55                 uci_perror(state->uci, NULL);
  56                 error("Failed to load /etc/config/firewall");
  57         }
  58
  59         if (!fw3_find_command("ipset"))
  60         {
  61                 warn("Unable to locate ipset utility, disabling ipset support");
  62                 state->disable_ipsets = true;
  63         }
  64
  65         fw3_load_defaults(state, p);
  66         fw3_load_ipsets(state, p);
  67         fw3_load_zones(state, p);
  68         fw3_load_rules(state, p);
  69         fw3_load_redirects(state, p);
  70         fw3_load_forwards(state, p);
  71
  72         if (state->defaults.disable_ipv6 && !skip_family[FW3_FAMILY_V6])
  73         {
  74                 warn("IPv6 rules globally disabled in configuration");
  75                 skip_family[FW3_FAMILY_V6] = true;
  76         }
  77
  78         return state;
  79 }
  80
  81 static void
  82 free_state(struct fw3_state *state)
  83 {
  84         struct list_head *cur, *tmp;
  85
  86         list_for_each_safe(cur, tmp, &state->zones)
  87                 fw3_free_zone((struct fw3_zone *)cur);
  88
  89         list_for_each_safe(cur, tmp, &state->rules)
  90                 fw3_free_rule((struct fw3_rule *)cur);
  91
  92         list_for_each_safe(cur, tmp, &state->redirects)
  93                 fw3_free_redirect((struct fw3_redirect *)cur);
  94
  95         list_for_each_safe(cur, tmp, &state->forwards)
  96                 fw3_free_forward((struct fw3_forward *)cur);
  97
  98         uci_free_context(state->uci);
  99
 100         free(state);
 101
 102         fw3_ubus_disconnect();
 103 }
 104
 105
 106 static bool
 107 restore_pipe(enum fw3_family family, bool silent)
 108 {
 109         const char *cmd[] = {
 110                 "(bug)",
 111                 "iptables-restore",
 112                 "ip6tables-restore",
 113         };
 114
 115         if (print_rules)
 116                 return fw3_stdout_pipe();
 117
 118         if (!fw3_command_pipe(silent, cmd[family], "--lenient", "--noflush"))
 119         {
 120                 warn("Unable to execute %s", cmd[family]);
 121                 return false;
 122         }
 123
 124         return true;
 125 }
 126
 127 static int
 128 stop(struct fw3_state *state, bool complete)
 129 {
 130         enum fw3_family family;
 131         enum fw3_table table;
 132
 133         const char *tables[] = {
 134                 "filter",
 135                 "nat",
 136                 "mangle",
 137                 "raw",
 138         };
 139
 140         for (family = FW3_FAMILY_V4; family <= FW3_FAMILY_V6; family++)
 141         {
 142                 if (skip_family[family] || !restore_pipe(family, true))
 143                         continue;
 144
 145                 info("Removing IPv%d rules ...", family == FW3_FAMILY_V4 ? 4 : 6);
 146
 147                 for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++)
 148                 {
 149                         if (!fw3_has_table(family == FW3_FAMILY_V6, tables[table]))
 150                                 continue;
 151
 152                         info(" * %sing %s table",
 153                              complete ? "Flush" : "Clear", tables[table]);
 154
 155                         fw3_pr("*%s\n", tables[table]);
 156                         fw3_print_flush_rules(table, family, state, complete);
 157                         fw3_pr("COMMIT\n");
 158                 }
 159
 160                 fw3_command_close();
 161         }
 162
 163         if (complete && fw3_command_pipe(false, "ipset", "-exist", "-"))
 164         {
 165                 fw3_destroy_ipsets(state);
 166                 fw3_command_close();
 167         }
 168
 169         return 0;
 170 }
 171
 172 static int
 173 start(struct fw3_state *state)
 174 {
 175         enum fw3_family family;
 176         enum fw3_table table;
 177
 178         const char *tables[] = {
 179                 "filter",
 180                 "nat",
 181                 "mangle",
 182                 "raw",
 183         };
 184
 185         if (!print_rules && fw3_command_pipe(false, "ipset", "-exist", "-"))
 186         {
 187                 fw3_create_ipsets(state);
 188                 fw3_command_close();
 189         }
 190
 191         for (family = FW3_FAMILY_V4; family <= FW3_FAMILY_V6; family++)
 192         {
 193                 if (skip_family[family] || !restore_pipe(family, false))
 194                         continue;
 195
 196                 info("Constructing IPv%d rules ...", family == FW3_FAMILY_V4 ? 4 : 6);
 197
 198                 for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++)
 199                 {
 200                         if (!fw3_has_table(family == FW3_FAMILY_V6, tables[table]))
 201                                 continue;
 202
 203                         info(" * Populating %s table", tables[table]);
 204
 205                         fw3_pr("*%s\n", tables[table]);
 206                         fw3_print_default_chains(table, family, state);
 207                         fw3_print_zone_chains(table, family, state);
 208                         fw3_print_default_rules(table, family, state);
 209                         fw3_print_rules(table, family, state);
 210                         fw3_print_redirects(table, family, state);
 211                         fw3_print_forwards(table, family, state);
 212                         fw3_print_zone_rules(table, family, state);
 213                         fw3_pr("COMMIT\n");
 214                 }
 215
 216                 fw3_command_close();
 217         }
 218
 219         return 0;
 220 }
 221
 222 static int
 223 lookup_network(struct fw3_state *state, const char *net)
 224 {
 225         struct fw3_zone *z;
 226         struct fw3_device *d;
 227
 228         list_for_each_entry(z, &state->zones, list)
 229         {
 230                 list_for_each_entry(d, &z->networks, list)
 231                 {
 232                         if (!strcmp(d->name, net))
 233                         {
 234                                 printf("%s\n", z->name);
 235                                 return 0;
 236                         }
 237                 }
 238         }
 239
 240         return 1;
 241 }
 242
 243 static int
 244 lookup_device(struct fw3_state *state, const char *dev)
 245 {
 246         struct fw3_zone *z;
 247         struct fw3_device *d;
 248
 249         list_for_each_entry(z, &state->zones, list)
 250         {
 251                 list_for_each_entry(d, &z->devices, list)
 252                 {
 253                         if (!strcmp(d->name, dev))
 254                         {
 255                                 printf("%s\n", z->name);
 256                                 return 0;
 257                         }
 258                 }
 259         }
 260
 261         return 1;
 262 }
 263
 264 static int
 265 usage(void)
 266 {
 267         fprintf(stderr, "fw3 [-4] [-6] [-q] {start|stop|flush|restart|print}\n");
 268         fprintf(stderr, "fw3 [-q] network {net}\n");
 269         fprintf(stderr, "fw3 [-q] device {dev}\n");
 270
 271         return 1;
 272 }
 273
 274
 275 int main(int argc, char **argv)
 276 {
 277         int ch, rv = 1;
 278         struct fw3_state *state = NULL;
 279
 280         while ((ch = getopt(argc, argv, "46qh")) != -1)
 281         {
 282                 switch (ch)
 283                 {
 284                 case '4':
 285                         skip_family[FW3_FAMILY_V4] = false;
 286                         skip_family[FW3_FAMILY_V6] = true;
 287                         break;
 288
 289                 case '6':
 290                         skip_family[FW3_FAMILY_V4] = true;
 291                         skip_family[FW3_FAMILY_V6] = false;
 292                         break;
 293
 294                 case 'q':
 295                         freopen("/dev/null", "w", stderr);
 296                         break;
 297
 298                 case 'h':
 299                         rv = usage();
 300                         goto out;
 301                 }
 302         }
 303
 304         if (!fw3_ubus_connect())
 305                 error("Failed to connect to ubus");
 306
 307         state = build_state();
 308
 309         if (!fw3_lock())
 310                 goto out;
 311
 312         if (optind >= argc)
 313         {
 314                 rv = usage();
 315                 goto out;
 316         }
 317
 318         if (!strcmp(argv[optind], "print"))
 319         {
 320                 freopen("/dev/null", "w", stderr);
 321
 322                 state->disable_ipsets = true;
 323                 print_rules = true;
 324
 325                 if (!skip_family[FW3_FAMILY_V4] && !skip_family[FW3_FAMILY_V6])
 326                         skip_family[FW3_FAMILY_V6] = true;
 327
 328                 rv = start(state);
 329         }
 330         else if (!strcmp(argv[optind], "start"))
 331         {
 332                 if (fw3_has_state())
 333                 {
 334                         warn("The firewall appears to be started already. "
 335                                  "If it is indeed empty, remove the %s file and retry.",
 336                                  FW3_STATEFILE);
 337
 338                         goto out;
 339                 }
 340
 341                 rv = start(state);
 342                 fw3_write_state(state);
 343         }
 344         else if (!strcmp(argv[optind], "stop"))
 345         {
 346                 if (!fw3_has_state())
 347                 {
 348                         warn("The firewall appears to be stopped. "
 349                                  "Use the 'flush' command to forcefully purge all rules.");
 350
 351                         goto out;
 352                 }
 353
 354                 rv = stop(state, false);
 355                 fw3_remove_state();
 356         }
 357         else if (!strcmp(argv[optind], "flush"))
 358         {
 359                 rv = stop(state, true);
 360
 361                 if (fw3_has_state())
 362                         fw3_remove_state();
 363         }
 364         else if (!strcmp(argv[optind], "restart"))
 365         {
 366                 if (fw3_has_state())
 367                 {
 368                         stop(state, false);
 369                         fw3_remove_state();
 370                 }
 371
 372                 rv = start(state);
 373                 fw3_write_state(state);
 374         }
 375         else if (!strcmp(argv[optind], "network") && (optind + 1) < argc)
 376         {
 377                 rv = lookup_network(state, argv[optind + 1]);
 378         }
 379         else if (!strcmp(argv[optind], "device") && (optind + 1) < argc)
 380         {
 381                 rv = lookup_device(state, argv[optind + 1]);
 382         }
 383         else
 384         {
 385                 rv = usage();
 386         }
 387
 388 out:
 389         if (state)
 390                 free_state(state);
 391
 392         fw3_unlock();
 393
 394         return rv;
 395 }