2 * firewall3 - 3rd OpenWrt UCI firewall implementation
4 * Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
6 * Permission to use, copy, modify, and/or distribute this software for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
22 static struct fw3_option ipset_opts[] = {
23 FW3_OPT("name", string, ipset, name),
24 FW3_OPT("family", family, ipset, family),
26 FW3_OPT("storage", ipset_method, ipset, method),
27 FW3_LIST("match", ipset_datatype, ipset, datatypes),
29 FW3_LIST("iprange", address, ipset, iprange),
30 FW3_OPT("portrange", port, ipset, portrange),
32 FW3_OPT("netmask", int, ipset, netmask),
33 FW3_OPT("maxelem", int, ipset, maxelem),
34 FW3_OPT("hashsize", int, ipset, hashsize),
35 FW3_OPT("timeout", int, ipset, timeout),
37 FW3_OPT("external", string, ipset, external),
40 #define T(m, t1, t2, t3, r, o) \
41 { FW3_IPSET_METHOD_##m, \
42 FW3_IPSET_TYPE_##t1 | (FW3_IPSET_TYPE_##t2 << 8) | (FW3_IPSET_TYPE_##t3 << 16), \
45 static struct fw3_ipset_settype ipset_types[] = {
46 T(BITMAP, IP, UNSPEC, UNSPEC, FW3_IPSET_OPT_IPRANGE,
47 FW3_IPSET_OPT_NETMASK),
48 T(BITMAP, IP, MAC, UNSPEC, FW3_IPSET_OPT_IPRANGE, 0),
49 T(BITMAP, PORT, UNSPEC, UNSPEC, FW3_IPSET_OPT_PORTRANGE, 0),
51 T(HASH, IP, UNSPEC, UNSPEC, 0,
52 FW3_IPSET_OPT_FAMILY | FW3_IPSET_OPT_HASHSIZE | FW3_IPSET_OPT_MAXELEM |
53 FW3_IPSET_OPT_NETMASK),
54 T(HASH, NET, UNSPEC, UNSPEC, 0,
55 FW3_IPSET_OPT_FAMILY | FW3_IPSET_OPT_HASHSIZE | FW3_IPSET_OPT_MAXELEM),
56 T(HASH, IP, PORT, UNSPEC, 0,
57 FW3_IPSET_OPT_FAMILY | FW3_IPSET_OPT_HASHSIZE | FW3_IPSET_OPT_MAXELEM),
58 T(HASH, NET, PORT, UNSPEC, 0,
59 FW3_IPSET_OPT_FAMILY | FW3_IPSET_OPT_HASHSIZE | FW3_IPSET_OPT_MAXELEM),
60 T(HASH, IP, PORT, IP, 0,
61 FW3_IPSET_OPT_FAMILY | FW3_IPSET_OPT_HASHSIZE | FW3_IPSET_OPT_MAXELEM),
62 T(HASH, IP, PORT, NET, 0,
63 FW3_IPSET_OPT_FAMILY | FW3_IPSET_OPT_HASHSIZE | FW3_IPSET_OPT_MAXELEM),
65 T(LIST, SET, UNSPEC, UNSPEC, 0, FW3_IPSET_OPT_MAXELEM),
70 check_types(struct uci_element *e, struct fw3_ipset *ipset)
73 uint32_t typelist = 0;
74 struct fw3_ipset_datatype *type;
76 const char *methods[] = {
85 list_for_each_entry(type, &ipset->datatypes, list)
89 warn_elem(e, "must not have more than 3 datatypes assigned");
93 typelist |= (type->type << (i++ * 8));
96 /* find a suitable storage method if none specified */
97 if (ipset->method == FW3_IPSET_METHOD_UNSPEC)
99 for (i = 0; i < ARRAY_SIZE(ipset_types); i++)
101 if (ipset_types[i].types == typelist)
103 ipset->method = ipset_types[i].method;
105 warn_elem(e, "defines no storage method, assuming '%s'",
106 methods[ipset->method]);
113 //typelist |= ipset->method;
115 for (i = 0; i < ARRAY_SIZE(ipset_types); i++)
117 if (ipset_types[i].method == ipset->method &&
118 ipset_types[i].types == typelist)
120 if (!ipset->external || !*ipset->external)
122 if ((ipset_types[i].required & FW3_IPSET_OPT_IPRANGE) &&
123 list_empty(&ipset->iprange))
125 warn_elem(e, "requires an ip range");
129 if ((ipset_types[i].required & FW3_IPSET_OPT_PORTRANGE) &&
130 !ipset->portrange.set)
132 warn_elem(e, "requires a port range");
136 if (!(ipset_types[i].required & FW3_IPSET_OPT_IPRANGE) &&
137 !list_empty(&ipset->iprange))
139 warn_elem(e, "iprange ignored");
140 fw3_free_list(&ipset->iprange);
143 if (!(ipset_types[i].required & FW3_IPSET_OPT_PORTRANGE) &&
144 ipset->portrange.set)
146 warn_elem(e, "portrange ignored");
147 memset(&ipset->portrange, 0, sizeof(ipset->portrange));
150 if (!(ipset_types[i].optional & FW3_IPSET_OPT_NETMASK) &&
153 warn_elem(e, "netmask ignored");
157 if (!(ipset_types[i].optional & FW3_IPSET_OPT_HASHSIZE) &&
160 warn_elem(e, "hashsize ignored");
164 if (!(ipset_types[i].optional & FW3_IPSET_OPT_MAXELEM) &&
167 warn_elem(e, "maxelem ignored");
171 if (!(ipset_types[i].optional & FW3_IPSET_OPT_FAMILY) &&
172 ipset->family != FW3_FAMILY_ANY)
174 warn_elem(e, "family ignored");
175 ipset->family = FW3_FAMILY_ANY;
183 warn_elem(e, "has an invalid combination of storage method and matches");
188 fw3_alloc_ipset(void)
190 struct fw3_ipset *ipset;
192 ipset = malloc(sizeof(*ipset));
197 memset(ipset, 0, sizeof(*ipset));
199 INIT_LIST_HEAD(&ipset->datatypes);
200 INIT_LIST_HEAD(&ipset->iprange);
206 fw3_load_ipsets(struct fw3_state *state, struct uci_package *p)
208 struct uci_section *s;
209 struct uci_element *e;
210 struct fw3_ipset *ipset;
212 INIT_LIST_HEAD(&state->ipsets);
214 if (state->disable_ipsets)
217 uci_foreach_element(&p->sections, e)
219 s = uci_to_section(e);
221 if (strcmp(s->type, "ipset"))
224 ipset = fw3_alloc_ipset();
229 fw3_parse_options(ipset, ipset_opts, ARRAY_SIZE(ipset_opts), s);
231 if (!ipset->name || !*ipset->name)
233 warn_elem(e, "must have a name assigned");
235 //else if (fw3_lookup_ipset(state, ipset->name) != NULL)
237 // warn_elem(e, "has duplicated set name '%s'", ipset->name);
239 else if (list_empty(&ipset->datatypes))
241 warn_elem(e, "has no datatypes assigned");
243 else if (check_types(e, ipset))
245 list_add_tail(&ipset->list, &state->ipsets);
249 fw3_free_ipset(ipset);
255 create_ipset(struct fw3_ipset *ipset, struct fw3_state *state)
258 char s[INET6_ADDRSTRLEN];
260 struct fw3_ipset_datatype *type;
261 struct fw3_address *a1, *a2;
263 const char *methods[] = {
270 const char *types[] = {
279 if (ipset->external && *ipset->external)
282 info("Creating ipset %s", ipset->name);
285 fw3_pr("create %s %s", ipset->name, methods[ipset->method]);
287 list_for_each_entry(type, &ipset->datatypes, list)
289 fw3_pr("%c%s", first ? ':' : ',', types[type->type]);
293 if (!list_empty(&ipset->iprange))
295 a1 = list_first_entry(&ipset->iprange, struct fw3_address, list);
296 a2 = list_last_entry(&ipset->iprange, struct fw3_address, list);
300 inet_ntop(a1->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
301 &a1->address.v6, s, sizeof(s));
303 fw3_pr(" range %s/%u", s, a1->mask);
305 else if (a1->family == a2->family &&
306 fw3_is_family(ipset, a1->family) &&
307 fw3_is_family(ipset, a2->family))
309 inet_ntop(a1->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
310 &a1->address.v6, s, sizeof(s));
312 fw3_pr(" range %s", s);
314 inet_ntop(a2->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
315 &a2->address.v6, s, sizeof(s));
320 else if (ipset->portrange.set)
322 fw3_pr(" range %u-%u",
323 ipset->portrange.port_min, ipset->portrange.port_max);
326 if (ipset->family != FW3_FAMILY_ANY)
327 fw3_pr(" family inet%s", (ipset->family == FW3_FAMILY_V4) ? "" : "6");
329 if (ipset->timeout > 0)
330 fw3_pr(" timeout %u", ipset->timeout);
332 if (ipset->maxelem > 0)
333 fw3_pr(" maxelem %u", ipset->maxelem);
335 if (ipset->netmask > 0)
336 fw3_pr(" netmask %u", ipset->netmask);
338 if (ipset->hashsize > 0)
339 fw3_pr(" hashsize %u", ipset->hashsize);
343 fw3_set_running(ipset, &state->running_ipsets);
347 fw3_create_ipsets(struct fw3_state *state)
349 struct fw3_ipset *ipset;
351 if (state->disable_ipsets)
354 list_for_each_entry(ipset, &state->ipsets, list)
355 if (!fw3_lookup_ipset(state, ipset->name, true))
356 create_ipset(ipset, state);
362 fw3_destroy_ipsets(struct fw3_state *state)
364 struct fw3_ipset *s, *tmp;
365 int mask = (1 << FW3_FAMILY_V4) | (1 << FW3_FAMILY_V6);
367 list_for_each_entry_safe(s, tmp, &state->running_ipsets, running_list)
369 if (!hasbit(state->defaults.flags, FW3_FAMILY_V4))
370 delbit(s->flags, FW3_FAMILY_V4);
372 if (!hasbit(state->defaults.flags, FW3_FAMILY_V6))
373 delbit(s->flags, FW3_FAMILY_V6);
375 if (!(s->flags & mask))
377 info("Deleting ipset %s", s->name);
379 fw3_pr("flush %s\n", s->name);
380 fw3_pr("destroy %s\n", s->name);
382 fw3_set_running(s, NULL);
388 fw3_free_ipset(struct fw3_ipset *ipset)
390 fw3_free_list(&ipset->datatypes);
391 fw3_free_list(&ipset->iprange);
397 fw3_lookup_ipset(struct fw3_state *state, const char *name, bool running)
401 if (list_empty(&state->ipsets))
404 list_for_each_entry(s, &state->ipsets, list)
406 if (strcmp(s->name, name))
409 if (!running || s->running_list.next)