main.c

   1 /*
   2  * firewall3 - 3rd OpenWrt UCI firewall implementation
   3  *
   4  *   Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
   5  *
   6  * Permission to use, copy, modify, and/or distribute this software for any
   7  * purpose with or without fee is hereby granted, provided that the above
   8  * copyright notice and this permission notice appear in all copies.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17  */
  18
  19 #include <stdio.h>
  20 #include <unistd.h>
  21
  22 #include "options.h"
  23 #include "defaults.h"
  24 #include "zones.h"
  25 #include "rules.h"
  26 #include "redirects.h"
  27 #include "forwards.h"
  28 #include "ipsets.h"
  29 #include "ubus.h"
  30
  31
  32 static bool print_rules = false;
  33 static bool skip_family[FW3_FAMILY_V6 + 1] = { false };
  34
  35
  36 static struct fw3_state *
  37 build_state(void)
  38 {
  39         struct fw3_state *state = NULL;
  40         struct uci_package *p = NULL;
  41
  42         state = malloc(sizeof(*state));
  43
  44         if (!state)
  45                 error("Out of memory");
  46
  47         memset(state, 0, sizeof(*state));
  48         state->uci = uci_alloc_context();
  49
  50         if (!state->uci)
  51                 error("Out of memory");
  52
  53         if (uci_load(state->uci, "firewall", &p))
  54         {
  55                 uci_perror(state->uci, NULL);
  56                 error("Failed to load /etc/config/firewall");
  57         }
  58
  59         if (!fw3_find_command("ipset"))
  60         {
  61                 warn("Unable to locate ipset utility, disabling ipset support");
  62                 state->disable_ipsets = true;
  63         }
  64
  65         fw3_load_defaults(state, p);
  66         fw3_load_ipsets(state, p);
  67         fw3_load_zones(state, p);
  68         fw3_load_rules(state, p);
  69         fw3_load_redirects(state, p);
  70         fw3_load_forwards(state, p);
  71
  72         if (state->defaults.disable_ipv6 && !skip_family[FW3_FAMILY_V6])
  73         {
  74                 warn("IPv6 rules globally disabled in configuration");
  75                 skip_family[FW3_FAMILY_V6] = true;
  76         }
  77
  78         return state;
  79 }
  80
  81 static void
  82 free_state(struct fw3_state *state)
  83 {
  84         struct list_head *cur, *tmp;
  85
  86         list_for_each_safe(cur, tmp, &state->zones)
  87                 fw3_free_zone((struct fw3_zone *)cur);
  88
  89         list_for_each_safe(cur, tmp, &state->rules)
  90                 fw3_free_rule((struct fw3_rule *)cur);
  91
  92         list_for_each_safe(cur, tmp, &state->redirects)
  93                 fw3_free_redirect((struct fw3_redirect *)cur);
  94
  95         list_for_each_safe(cur, tmp, &state->forwards)
  96                 fw3_free_forward((struct fw3_forward *)cur);
  97
  98         uci_free_context(state->uci);
  99
 100         free(state);
 101
 102         fw3_ubus_disconnect();
 103 }
 104
 105
 106 static bool
 107 restore_pipe(enum fw3_family family, bool silent)
 108 {
 109         const char *cmd[] = {
 110                 "(bug)",
 111                 "iptables-restore",
 112                 "ip6tables-restore",
 113         };
 114
 115         if (print_rules)
 116                 return fw3_stdout_pipe();
 117
 118         if (!fw3_command_pipe(silent, cmd[family], "--lenient", "--noflush"))
 119         {
 120                 warn("Unable to execute %s", cmd[family]);
 121                 return false;
 122         }
 123
 124         return true;
 125 }
 126
 127 static int
 128 stop(struct fw3_state *state, bool complete, bool ipsets)
 129 {
 130         enum fw3_family family;
 131         enum fw3_table table;
 132
 133         struct list_head *statefile = fw3_read_state();
 134
 135         const char *tables[] = {
 136                 "filter",
 137                 "nat",
 138                 "mangle",
 139                 "raw",
 140         };
 141
 142         for (family = FW3_FAMILY_V4; family <= FW3_FAMILY_V6; family++)
 143         {
 144                 if (skip_family[family] || !restore_pipe(family, true))
 145                         continue;
 146
 147                 info("Removing IPv%d rules ...", family == FW3_FAMILY_V4 ? 4 : 6);
 148
 149                 for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++)
 150                 {
 151                         if (!fw3_has_table(family == FW3_FAMILY_V6, tables[table]))
 152                                 continue;
 153
 154                         info(" * %sing %s table",
 155                              complete ? "Flush" : "Clear", tables[table]);
 156
 157                         fw3_pr("*%s\n", tables[table]);
 158
 159                         if (complete)
 160                         {
 161                                 fw3_flush_all(table);
 162                         }
 163                         else
 164                         {
 165                                 /* pass 1 */
 166                                 fw3_flush_rules(table, family, false, statefile);
 167                                 fw3_flush_zones(table, family, false, statefile);
 168
 169                                 /* pass 2 */
 170                                 fw3_flush_rules(table, family, true, statefile);
 171                                 fw3_flush_zones(table, family, true, statefile);
 172                         }
 173
 174                         fw3_pr("COMMIT\n");
 175                 }
 176
 177                 fw3_command_close();
 178         }
 179
 180         if (ipsets && fw3_command_pipe(false, "ipset", "-exist", "-"))
 181         {
 182                 fw3_destroy_ipsets(statefile);
 183                 fw3_command_close();
 184         }
 185
 186         fw3_free_state(statefile);
 187
 188         return 0;
 189 }
 190
 191 static int
 192 start(struct fw3_state *state)
 193 {
 194         enum fw3_family family;
 195         enum fw3_table table;
 196
 197         const char *tables[] = {
 198                 "filter",
 199                 "nat",
 200                 "mangle",
 201                 "raw",
 202         };
 203
 204         if (!print_rules && fw3_command_pipe(false, "ipset", "-exist", "-"))
 205         {
 206                 fw3_create_ipsets(state);
 207                 fw3_command_close();
 208         }
 209
 210         for (family = FW3_FAMILY_V4; family <= FW3_FAMILY_V6; family++)
 211         {
 212                 if (skip_family[family] || !restore_pipe(family, false))
 213                         continue;
 214
 215                 info("Constructing IPv%d rules ...", family == FW3_FAMILY_V4 ? 4 : 6);
 216
 217                 for (table = FW3_TABLE_FILTER; table <= FW3_TABLE_RAW; table++)
 218                 {
 219                         if (!fw3_has_table(family == FW3_FAMILY_V6, tables[table]))
 220                                 continue;
 221
 222                         info(" * Populating %s table", tables[table]);
 223
 224                         fw3_pr("*%s\n", tables[table]);
 225                         fw3_print_default_chains(table, family, state);
 226                         fw3_print_zone_chains(table, family, state);
 227                         fw3_print_default_head_rules(table, family, state);
 228                         fw3_print_rules(table, family, state);
 229                         fw3_print_redirects(table, family, state);
 230                         fw3_print_forwards(table, family, state);
 231                         fw3_print_zone_rules(table, family, state);
 232                         fw3_print_default_tail_rules(table, family, state);
 233                         fw3_pr("COMMIT\n");
 234                 }
 235
 236                 fw3_command_close();
 237         }
 238
 239         return 0;
 240 }
 241
 242 static int
 243 lookup_network(struct fw3_state *state, const char *net)
 244 {
 245         struct fw3_zone *z;
 246         struct fw3_device *d;
 247
 248         list_for_each_entry(z, &state->zones, list)
 249         {
 250                 list_for_each_entry(d, &z->networks, list)
 251                 {
 252                         if (!strcmp(d->name, net))
 253                         {
 254                                 printf("%s\n", z->name);
 255                                 return 0;
 256                         }
 257                 }
 258         }
 259
 260         return 1;
 261 }
 262
 263 static int
 264 lookup_device(struct fw3_state *state, const char *dev)
 265 {
 266         struct fw3_zone *z;
 267         struct fw3_device *d;
 268
 269         list_for_each_entry(z, &state->zones, list)
 270         {
 271                 list_for_each_entry(d, &z->devices, list)
 272                 {
 273                         if (!strcmp(d->name, dev))
 274                         {
 275                                 printf("%s\n", z->name);
 276                                 return 0;
 277                         }
 278                 }
 279         }
 280
 281         return 1;
 282 }
 283
 284 static int
 285 usage(void)
 286 {
 287         fprintf(stderr, "fw3 [-4] [-6] [-q] {start|stop|flush|restart|print}\n");
 288         fprintf(stderr, "fw3 [-q] network {net}\n");
 289         fprintf(stderr, "fw3 [-q] device {dev}\n");
 290
 291         return 1;
 292 }
 293
 294
 295 int main(int argc, char **argv)
 296 {
 297         int ch, rv = 1;
 298         struct fw3_state *state = NULL;
 299
 300         while ((ch = getopt(argc, argv, "46qh")) != -1)
 301         {
 302                 switch (ch)
 303                 {
 304                 case '4':
 305                         skip_family[FW3_FAMILY_V4] = false;
 306                         skip_family[FW3_FAMILY_V6] = true;
 307                         break;
 308
 309                 case '6':
 310                         skip_family[FW3_FAMILY_V4] = true;
 311                         skip_family[FW3_FAMILY_V6] = false;
 312                         break;
 313
 314                 case 'q':
 315                         freopen("/dev/null", "w", stderr);
 316                         break;
 317
 318                 case 'h':
 319                         rv = usage();
 320                         goto out;
 321                 }
 322         }
 323
 324         if (!fw3_ubus_connect())
 325                 error("Failed to connect to ubus");
 326
 327         state = build_state();
 328
 329         if (!fw3_lock())
 330                 goto out;
 331
 332         if (optind >= argc)
 333         {
 334                 rv = usage();
 335                 goto out;
 336         }
 337
 338         if (!strcmp(argv[optind], "print"))
 339         {
 340                 freopen("/dev/null", "w", stderr);
 341
 342                 state->disable_ipsets = true;
 343                 print_rules = true;
 344
 345                 if (!skip_family[FW3_FAMILY_V4] && !skip_family[FW3_FAMILY_V6])
 346                         skip_family[FW3_FAMILY_V6] = true;
 347
 348                 rv = start(state);
 349         }
 350         else if (!strcmp(argv[optind], "start"))
 351         {
 352                 if (fw3_has_state())
 353                 {
 354                         warn("The firewall appears to be started already. "
 355                                  "If it is indeed empty, remove the %s file and retry.",
 356                                  FW3_STATEFILE);
 357
 358                         goto out;
 359                 }
 360
 361                 rv = start(state);
 362                 fw3_write_state(state);
 363         }
 364         else if (!strcmp(argv[optind], "stop"))
 365         {
 366                 if (!fw3_has_state())
 367                 {
 368                         warn("The firewall appears to be stopped. "
 369                                  "Use the 'flush' command to forcefully purge all rules.");
 370
 371                         goto out;
 372                 }
 373
 374                 rv = stop(state, false, true);
 375
 376                 fw3_remove_state();
 377         }
 378         else if (!strcmp(argv[optind], "flush"))
 379         {
 380                 rv = stop(state, true, true);
 381
 382                 if (fw3_has_state())
 383                         fw3_remove_state();
 384         }
 385         else if (!strcmp(argv[optind], "restart"))
 386         {
 387                 if (fw3_has_state())
 388                 {
 389                         stop(state, false, false);
 390                         fw3_remove_state();
 391                 }
 392
 393                 rv = start(state);
 394                 fw3_write_state(state);
 395         }
 396         else if (!strcmp(argv[optind], "network") && (optind + 1) < argc)
 397         {
 398                 rv = lookup_network(state, argv[optind + 1]);
 399         }
 400         else if (!strcmp(argv[optind], "device") && (optind + 1) < argc)
 401         {
 402                 rv = lookup_device(state, argv[optind + 1]);
 403         }
 404         else
 405         {
 406                 rv = usage();
 407         }
 408
 409 out:
 410         if (state)
 411                 free_state(state);
 412
 413         fw3_unlock();
 414
 415         return rv;
 416 }