zones.c

   1 /*
   2  * firewall3 - 3rd OpenWrt UCI firewall implementation
   3  *
   4  *   Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
   5  *
   6  * Permission to use, copy, modify, and/or distribute this software for any
   7  * purpose with or without fee is hereby granted, provided that the above
   8  * copyright notice and this permission notice appear in all copies.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17  */
  18
  19 #include "zones.h"
  20 #include "ubus.h"
  21
  22
  23 static struct fw3_option zone_opts[] = {
  24         FW3_OPT("name",                string,   zone,     name),
  25
  26         FW3_LIST("network",            device,   zone,     networks),
  27         FW3_LIST("device",             device,   zone,     devices),
  28         FW3_LIST("subnet",             address,  zone,     subnets),
  29
  30         FW3_OPT("input",               target,   zone,     policy_input),
  31         FW3_OPT("forward",             target,   zone,     policy_forward),
  32         FW3_OPT("output",              target,   zone,     policy_output),
  33
  34         FW3_OPT("masq",                bool,     zone,     masq),
  35         FW3_LIST("masq_src",           address,  zone,     masq_src),
  36         FW3_LIST("masq_dest",          address,  zone,     masq_dest),
  37
  38         FW3_OPT("extra",               string,   zone,     extra_src),
  39         FW3_OPT("extra_src",           string,   zone,     extra_src),
  40         FW3_OPT("extra_dest",          string,   zone,     extra_dest),
  41
  42         FW3_OPT("conntrack",           bool,     zone,     conntrack),
  43         FW3_OPT("mtu_fix",             bool,     zone,     mtu_fix),
  44         FW3_OPT("custom_chains",       bool,     zone,     custom_chains),
  45
  46         FW3_OPT("log",                 bool,     zone,     log),
  47         FW3_OPT("log_limit",           limit,    zone,     log_limit),
  48 };
  49
  50
  51 static void
  52 check_policy(struct uci_element *e, enum fw3_target *pol, enum fw3_target def,
  53              const char *name)
  54 {
  55         if (*pol == FW3_TARGET_UNSPEC)
  56         {
  57                 warn_elem(e, "has no %s policy specified, using default", name);
  58                 *pol = def;
  59         }
  60         else if (*pol > FW3_TARGET_DROP)
  61         {
  62                 warn_elem(e, "has invalid %s policy, using default", name);
  63                 *pol = def;
  64         }
  65 }
  66
  67 static void
  68 resolve_networks(struct uci_element *e, struct fw3_zone *zone)
  69 {
  70         struct fw3_device *net, *tmp;
  71
  72         list_for_each_entry(net, &zone->networks, list)
  73         {
  74                 tmp = fw3_ubus_device(net->name);
  75
  76                 if (!tmp)
  77                 {
  78                         warn_elem(e, "cannot resolve device of network '%s'", net->name);
  79                         continue;
  80                 }
  81
  82                 list_add_tail(&tmp->list, &zone->devices);
  83         }
  84 }
  85
  86 void
  87 fw3_load_zones(struct fw3_state *state, struct uci_package *p)
  88 {
  89         struct uci_section *s;
  90         struct uci_element *e;
  91         struct fw3_zone *zone;
  92         struct fw3_defaults *defs = &state->defaults;
  93
  94         INIT_LIST_HEAD(&state->zones);
  95
  96         uci_foreach_element(&p->sections, e)
  97         {
  98                 s = uci_to_section(e);
  99
 100                 if (strcmp(s->type, "zone"))
 101                         continue;
 102
 103                 zone = malloc(sizeof(*zone));
 104
 105                 if (!zone)
 106                         continue;
 107
 108                 memset(zone, 0, sizeof(*zone));
 109
 110                 INIT_LIST_HEAD(&zone->networks);
 111                 INIT_LIST_HEAD(&zone->devices);
 112                 INIT_LIST_HEAD(&zone->subnets);
 113                 INIT_LIST_HEAD(&zone->masq_src);
 114                 INIT_LIST_HEAD(&zone->masq_dest);
 115
 116                 zone->log_limit.rate = 10;
 117
 118                 fw3_parse_options(zone, zone_opts, ARRAY_SIZE(zone_opts), s);
 119
 120                 if (!zone->extra_dest)
 121                         zone->extra_dest = zone->extra_src;
 122
 123                 if (!zone->name || !*zone->name)
 124                 {
 125                         warn_elem(e, "has no name - ignoring");
 126                         fw3_free_zone(zone);
 127                         continue;
 128                 }
 129
 130                 if (list_empty(&zone->networks) && list_empty(&zone->devices) &&
 131                     list_empty(&zone->subnets) && !zone->extra_src)
 132                 {
 133                         warn_elem(e, "has no device, network, subnet or extra options");
 134                 }
 135
 136                 check_policy(e, &zone->policy_input, defs->policy_input, "input");
 137                 check_policy(e, &zone->policy_output, defs->policy_output, "output");
 138                 check_policy(e, &zone->policy_forward, defs->policy_forward, "forward");
 139
 140                 resolve_networks(e, zone);
 141
 142                 if (zone->masq)
 143                 {
 144                         zone->has_dest_target[FW3_TARGET_SNAT] = true;
 145                         zone->conntrack = true;
 146                 }
 147
 148                 zone->has_src_target[zone->policy_input] = true;
 149                 zone->has_dest_target[zone->policy_output] = true;
 150                 zone->has_dest_target[zone->policy_forward] = true;
 151
 152                 list_add_tail(&zone->list, &state->zones);
 153         }
 154 }
 155
 156
 157 static void
 158 print_zone_chain(enum fw3_table table, enum fw3_family family,
 159                  struct fw3_zone *zone, bool disable_notrack)
 160 {
 161         enum fw3_target t;
 162         const char *targets[] = {
 163                 "(bug)",
 164                 "ACCEPT",
 165                 "REJECT",
 166                 "DROP",
 167         };
 168
 169         if (!fw3_is_family(zone, family))
 170                 return;
 171
 172         switch (table)
 173         {
 174         case FW3_TABLE_FILTER:
 175                 info("   * Zone '%s'", zone->name);
 176
 177                 for (t = FW3_TARGET_ACCEPT; t <= FW3_TARGET_DROP; t++)
 178                 {
 179                         if (zone->has_src_target[t])
 180                                 fw3_pr(":zone_%s_src_%s - [0:0]\n", zone->name, targets[t]);
 181
 182                         if (zone->has_dest_target[t])
 183                                 fw3_pr(":zone_%s_dest_%s - [0:0]\n", zone->name, targets[t]);
 184                 }
 185
 186                 fw3_pr(":zone_%s_forward - [0:0]\n", zone->name);
 187                 fw3_pr(":zone_%s_input - [0:0]\n", zone->name);
 188                 fw3_pr(":zone_%s_output - [0:0]\n", zone->name);
 189                 break;
 190
 191         case FW3_TABLE_NAT:
 192                 if (family == FW3_FAMILY_V4)
 193                 {
 194                         info("   * Zone '%s'", zone->name);
 195
 196                         if (zone->has_dest_target[FW3_TARGET_SNAT])
 197                                 fw3_pr(":zone_%s_postrouting - [0:0]\n", zone->name);
 198
 199                         if (zone->has_dest_target[FW3_TARGET_DNAT])
 200                                 fw3_pr(":zone_%s_prerouting - [0:0]\n", zone->name);
 201                 }
 202                 break;
 203
 204         case FW3_TABLE_RAW:
 205                 if (!zone->conntrack && !disable_notrack)
 206                 {
 207                         info("   * Zone '%s'", zone->name);
 208                         fw3_pr(":zone_%s_notrack - [0:0]\n", zone->name);
 209                 }
 210                 break;
 211
 212         case FW3_TABLE_MANGLE:
 213                 break;
 214         }
 215 }
 216
 217 static void
 218 print_interface_rule(enum fw3_table table, enum fw3_family family,
 219                      struct fw3_zone *zone, struct fw3_device *dev,
 220                      struct fw3_address *sub, bool disable_notrack)
 221 {
 222         enum fw3_target t;
 223         const char *targets[] = {
 224                 "(bug)",  "(bug)",
 225                 "ACCEPT", "ACCEPT",
 226                 "REJECT", "reject",
 227                 "DROP",   "DROP",
 228         };
 229
 230         if (table == FW3_TABLE_FILTER)
 231         {
 232                 for (t = FW3_TARGET_ACCEPT; t <= FW3_TARGET_DROP; t++)
 233                 {
 234                         if (zone->has_src_target[t])
 235                         {
 236                                 fw3_pr("-A zone_%s_src_%s", zone->name, targets[t*2]);
 237                                 fw3_format_in_out(dev, NULL);
 238                                 fw3_format_src_dest(sub, NULL);
 239                                 fw3_format_extra(zone->extra_src);
 240                                 fw3_pr(" -j %s\n", targets[t*2+1]);
 241                         }
 242
 243                         if (zone->has_dest_target[t])
 244                         {
 245                                 fw3_pr("-A zone_%s_dest_%s", zone->name, targets[t*2]);
 246                                 fw3_format_in_out(NULL, dev);
 247                                 fw3_format_src_dest(NULL, sub);
 248                                 fw3_format_extra(zone->extra_dest);
 249                                 fw3_pr(" -j %s\n", targets[t*2+1]);
 250                         }
 251                 }
 252
 253                 fw3_pr("-A delegate_input");
 254                 fw3_format_in_out(dev, NULL);
 255                 fw3_format_src_dest(sub, NULL);
 256                 fw3_format_extra(zone->extra_src);
 257                 fw3_pr(" -j zone_%s_input\n", zone->name);
 258
 259                 fw3_pr("-A delegate_forward");
 260                 fw3_format_in_out(dev, NULL);
 261                 fw3_format_src_dest(sub, NULL);
 262                 fw3_format_extra(zone->extra_src);
 263                 fw3_pr(" -j zone_%s_forward\n", zone->name);
 264
 265                 fw3_pr("-A delegate_output");
 266                 fw3_format_in_out(NULL, dev);
 267                 fw3_format_src_dest(NULL, sub);
 268                 fw3_format_extra(zone->extra_dest);
 269                 fw3_pr(" -j zone_%s_output\n", zone->name);
 270         }
 271         else if (table == FW3_TABLE_NAT)
 272         {
 273                 if (zone->has_dest_target[FW3_TARGET_DNAT])
 274                 {
 275                         fw3_pr("-A PREROUTING");
 276                         fw3_format_in_out(dev, NULL);
 277                         fw3_format_src_dest(sub, NULL);
 278                         fw3_format_extra(zone->extra_src);
 279                         fw3_pr(" -j zone_%s_prerouting\n", zone->name);
 280                 }
 281
 282                 if (zone->has_dest_target[FW3_TARGET_SNAT])
 283                 {
 284                         fw3_pr("-A POSTROUTING");
 285                         fw3_format_in_out(NULL, dev);
 286                         fw3_format_src_dest(NULL, sub);
 287                         fw3_format_extra(zone->extra_dest);
 288                         fw3_pr(" -j zone_%s_postrouting\n", zone->name);
 289                 }
 290         }
 291         else if (table == FW3_TABLE_MANGLE)
 292         {
 293                 if (zone->mtu_fix)
 294                 {
 295                         if (zone->log)
 296                         {
 297                                 fw3_pr("-A mssfix");
 298                                 fw3_format_in_out(NULL, dev);
 299                                 fw3_format_src_dest(NULL, sub);
 300                                 fw3_pr(" -p tcp --tcp-flags SYN,RST SYN");
 301                                 fw3_format_limit(&zone->log_limit);
 302                                 fw3_format_comment(zone->name, " (mtu_fix logging)");
 303                                 fw3_pr(" -j LOG --log-prefix \"MSSFIX(%s): \"\n", zone->name);
 304                         }
 305
 306                         fw3_pr("-A mssfix");
 307                         fw3_format_in_out(NULL, dev);
 308                         fw3_format_src_dest(NULL, sub);
 309                         fw3_pr(" -p tcp --tcp-flags SYN,RST SYN");
 310                         fw3_format_comment(zone->name, " (mtu_fix)");
 311                         fw3_pr(" -j TCPMSS --clamp-mss-to-pmtu\n");
 312                 }
 313         }
 314         else if (table == FW3_TABLE_RAW)
 315         {
 316                 if (!zone->conntrack && !disable_notrack)
 317                 {
 318                         fw3_pr("-A notrack");
 319                         fw3_format_in_out(dev, NULL);
 320                         fw3_format_src_dest(sub, NULL);
 321                         fw3_format_extra(zone->extra_src);
 322                         fw3_format_comment(zone->name, " (notrack)");
 323                         fw3_pr(" -j CT --notrack\n", zone->name);
 324                 }
 325         }
 326 }
 327
 328 static void
 329 print_interface_rules(enum fw3_table table, enum fw3_family family,
 330                       struct fw3_zone *zone, bool disable_notrack)
 331 {
 332         struct fw3_device *dev;
 333         struct fw3_address *sub;
 334
 335         fw3_foreach(dev, &zone->devices)
 336         fw3_foreach(sub, &zone->subnets)
 337         {
 338                 if (!fw3_is_family(sub, family))
 339                         continue;
 340
 341                 if (!dev && !sub)
 342                         continue;
 343
 344                 print_interface_rule(table, family, zone, dev, sub, disable_notrack);
 345         }
 346 }
 347
 348 static void
 349 print_zone_rule(enum fw3_table table, enum fw3_family family,
 350                 struct fw3_zone *zone, bool disable_notrack)
 351 {
 352         struct fw3_address *msrc;
 353         struct fw3_address *mdest;
 354
 355         enum fw3_target t;
 356         const char *targets[] = {
 357                 "(bug)",
 358                 "ACCEPT",
 359                 "REJECT",
 360                 "DROP",
 361                 "(bug)",
 362                 "(bug)",
 363                 "(bug)",
 364         };
 365
 366         if (!fw3_is_family(zone, family))
 367                 return;
 368
 369         switch (table)
 370         {
 371         case FW3_TABLE_FILTER:
 372                 fw3_pr("-A zone_%s_input -j zone_%s_src_%s\n",
 373                            zone->name, zone->name, targets[zone->policy_input]);
 374
 375                 fw3_pr("-A zone_%s_forward -j zone_%s_dest_%s\n",
 376                            zone->name, zone->name, targets[zone->policy_forward]);
 377
 378                 fw3_pr("-A zone_%s_output -j zone_%s_dest_%s\n",
 379                            zone->name, zone->name, targets[zone->policy_output]);
 380
 381                 if (zone->log)
 382                 {
 383                         for (t = FW3_TARGET_REJECT; t <= FW3_TARGET_DROP; t++)
 384                         {
 385                                 if (zone->has_src_target[t])
 386                                 {
 387                                         fw3_pr("-A zone_%s_src_%s", zone->name, targets[t]);
 388                                         fw3_format_limit(&zone->log_limit);
 389                                         fw3_pr(" -j LOG --log-prefix \"%s(src %s)\"\n",
 390                                                    targets[t], zone->name);
 391                                 }
 392
 393                                 if (zone->has_dest_target[t])
 394                                 {
 395                                         fw3_pr("-A zone_%s_dest_%s", zone->name, targets[t]);
 396                                         fw3_format_limit(&zone->log_limit);
 397                                         fw3_pr(" -j LOG --log-prefix \"%s(dest %s)\"\n",
 398                                                    targets[t], zone->name);
 399                                 }
 400                         }
 401                 }
 402                 break;
 403
 404         case FW3_TABLE_NAT:
 405                 if (zone->masq && family == FW3_FAMILY_V4)
 406                 {
 407                         fw3_foreach(msrc, &zone->masq_src)
 408                         fw3_foreach(mdest, &zone->masq_dest)
 409                         {
 410                                 fw3_pr("-A zone_%s_postrouting ", zone->name);
 411                                 fw3_format_src_dest(msrc, mdest);
 412                                 fw3_pr("-j MASQUERADE\n");
 413                         }
 414                 }
 415                 break;
 416
 417         case FW3_TABLE_RAW:
 418         case FW3_TABLE_MANGLE:
 419                 break;
 420         }
 421
 422         print_interface_rules(table, family, zone, disable_notrack);
 423 }
 424
 425 void
 426 fw3_print_zone_chains(enum fw3_table table, enum fw3_family family,
 427                       struct fw3_state *state)
 428 {
 429         struct fw3_zone *zone;
 430
 431         list_for_each_entry(zone, &state->zones, list)
 432                 print_zone_chain(table, family, zone, state->defaults.drop_invalid);
 433 }
 434
 435 void
 436 fw3_print_zone_rules(enum fw3_table table, enum fw3_family family,
 437                      struct fw3_state *state)
 438 {
 439         struct fw3_zone *zone;
 440
 441         list_for_each_entry(zone, &state->zones, list)
 442                 print_zone_rule(table, family, zone, state->defaults.drop_invalid);
 443 }
 444
 445
 446 struct fw3_zone *
 447 fw3_lookup_zone(struct fw3_state *state, const char *name)
 448 {
 449         struct fw3_zone *z;
 450
 451         if (list_empty(&state->zones))
 452                 return NULL;
 453
 454         list_for_each_entry(z, &state->zones, list)
 455                 if (!strcmp(z->name, name))
 456                         return z;
 457
 458         return NULL;
 459 }
 460
 461 void
 462 fw3_free_zone(struct fw3_zone *zone)
 463 {
 464         fw3_free_list(&zone->networks);
 465         fw3_free_list(&zone->devices);
 466         fw3_free_list(&zone->subnets);
 467
 468         fw3_free_list(&zone->masq_src);
 469         fw3_free_list(&zone->masq_dest);
 470
 471         free(zone);
 472 }