2 * firewall3 - 3rd OpenWrt UCI firewall implementation
4 * Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
6 * Permission to use, copy, modify, and/or distribute this software for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
22 static struct fw3_option ipset_opts[] = {
23 FW3_OPT("name", string, ipset, name),
24 FW3_OPT("family", family, ipset, family),
26 FW3_OPT("storage", ipset_method, ipset, method),
27 FW3_LIST("match", ipset_datatype, ipset, datatypes),
29 FW3_LIST("iprange", address, ipset, iprange),
30 FW3_OPT("portrange", port, ipset, portrange),
32 FW3_OPT("netmask", int, ipset, netmask),
33 FW3_OPT("maxelem", int, ipset, maxelem),
34 FW3_OPT("hashsize", int, ipset, hashsize),
35 FW3_OPT("timeout", int, ipset, timeout),
37 FW3_OPT("external", string, ipset, external),
40 #define T(m, t1, t2, t3, r, o) \
41 { FW3_IPSET_METHOD_##m, \
42 FW3_IPSET_TYPE_##t1 | (FW3_IPSET_TYPE_##t2 << 8) | (FW3_IPSET_TYPE_##t3 << 16), \
45 static struct fw3_ipset_settype ipset_types[] = {
46 T(BITMAP, IP, UNSPEC, UNSPEC, FW3_IPSET_OPT_IPRANGE,
47 FW3_IPSET_OPT_NETMASK),
48 T(BITMAP, IP, MAC, UNSPEC, FW3_IPSET_OPT_IPRANGE, 0),
49 T(BITMAP, PORT, UNSPEC, UNSPEC, FW3_IPSET_OPT_PORTRANGE, 0),
51 T(HASH, IP, UNSPEC, UNSPEC, 0,
52 FW3_IPSET_OPT_FAMILY | FW3_IPSET_OPT_HASHSIZE | FW3_IPSET_OPT_MAXELEM |
53 FW3_IPSET_OPT_NETMASK),
54 T(HASH, NET, UNSPEC, UNSPEC, 0,
55 FW3_IPSET_OPT_FAMILY | FW3_IPSET_OPT_HASHSIZE | FW3_IPSET_OPT_MAXELEM),
56 T(HASH, IP, PORT, UNSPEC, 0,
57 FW3_IPSET_OPT_FAMILY | FW3_IPSET_OPT_HASHSIZE | FW3_IPSET_OPT_MAXELEM),
58 T(HASH, NET, PORT, UNSPEC, 0,
59 FW3_IPSET_OPT_FAMILY | FW3_IPSET_OPT_HASHSIZE | FW3_IPSET_OPT_MAXELEM),
60 T(HASH, IP, PORT, IP, 0,
61 FW3_IPSET_OPT_FAMILY | FW3_IPSET_OPT_HASHSIZE | FW3_IPSET_OPT_MAXELEM),
62 T(HASH, IP, PORT, NET, 0,
63 FW3_IPSET_OPT_FAMILY | FW3_IPSET_OPT_HASHSIZE | FW3_IPSET_OPT_MAXELEM),
65 T(LIST, SET, UNSPEC, UNSPEC, 0, FW3_IPSET_OPT_MAXELEM),
70 check_types(struct uci_element *e, struct fw3_ipset *ipset)
73 uint32_t typelist = 0;
74 struct fw3_ipset_datatype *type;
76 const char *methods[] = {
85 list_for_each_entry(type, &ipset->datatypes, list)
89 warn_elem(e, "must not have more than 3 datatypes assigned");
93 typelist |= (type->type << (i++ * 8));
96 /* find a suitable storage method if none specified */
97 if (ipset->method == FW3_IPSET_METHOD_UNSPEC)
99 for (i = 0; i < ARRAY_SIZE(ipset_types); i++)
101 if (ipset_types[i].types == typelist)
103 ipset->method = ipset_types[i].method;
105 warn_elem(e, "defines no storage method, assuming '%s'",
106 methods[ipset->method]);
113 //typelist |= ipset->method;
115 for (i = 0; i < ARRAY_SIZE(ipset_types); i++)
117 if (ipset_types[i].method == ipset->method &&
118 ipset_types[i].types == typelist)
120 if (!ipset->external || !*ipset->external)
122 if ((ipset_types[i].required & FW3_IPSET_OPT_IPRANGE) &&
123 list_empty(&ipset->iprange))
125 warn_elem(e, "requires an ip range");
129 if ((ipset_types[i].required & FW3_IPSET_OPT_PORTRANGE) &&
130 !ipset->portrange.set)
132 warn_elem(e, "requires a port range");
136 if (!(ipset_types[i].required & FW3_IPSET_OPT_IPRANGE) &&
137 !list_empty(&ipset->iprange))
139 warn_elem(e, "iprange ignored");
140 fw3_free_list(&ipset->iprange);
143 if (!(ipset_types[i].required & FW3_IPSET_OPT_PORTRANGE) &&
144 ipset->portrange.set)
146 warn_elem(e, "portrange ignored");
147 memset(&ipset->portrange, 0, sizeof(ipset->portrange));
150 if (!(ipset_types[i].optional & FW3_IPSET_OPT_NETMASK) &&
153 warn_elem(e, "netmask ignored");
157 if (!(ipset_types[i].optional & FW3_IPSET_OPT_HASHSIZE) &&
160 warn_elem(e, "hashsize ignored");
164 if (!(ipset_types[i].optional & FW3_IPSET_OPT_MAXELEM) &&
167 warn_elem(e, "maxelem ignored");
171 if (!(ipset_types[i].optional & FW3_IPSET_OPT_FAMILY) &&
172 ipset->family != FW3_FAMILY_ANY)
174 warn_elem(e, "family ignored");
175 ipset->family = FW3_FAMILY_ANY;
183 warn_elem(e, "has an invalid combination of storage method and matches");
188 fw3_load_ipsets(struct fw3_state *state, struct uci_package *p)
190 struct uci_section *s;
191 struct uci_element *e;
192 struct fw3_ipset *ipset;
194 INIT_LIST_HEAD(&state->ipsets);
196 if (state->disable_ipsets)
199 uci_foreach_element(&p->sections, e)
201 s = uci_to_section(e);
203 if (strcmp(s->type, "ipset"))
206 ipset = malloc(sizeof(*ipset));
211 memset(ipset, 0, sizeof(*ipset));
213 INIT_LIST_HEAD(&ipset->datatypes);
214 INIT_LIST_HEAD(&ipset->iprange);
216 fw3_parse_options(ipset, ipset_opts, ARRAY_SIZE(ipset_opts), s);
218 if (!ipset->name || !*ipset->name)
220 warn_elem(e, "must have a name assigned");
222 //else if (fw3_lookup_ipset(state, ipset->name) != NULL)
224 // warn_elem(e, "has duplicated set name '%s'", ipset->name);
226 else if (list_empty(&ipset->datatypes))
228 warn_elem(e, "has no datatypes assigned");
230 else if (check_types(e, ipset))
232 list_add_tail(&ipset->list, &state->ipsets);
236 fw3_free_ipset(ipset);
242 create_ipset(struct fw3_ipset *ipset)
245 char s[INET6_ADDRSTRLEN];
247 struct fw3_ipset_datatype *type;
248 struct fw3_address *a1, *a2;
250 const char *methods[] = {
257 const char *types[] = {
266 const char *families[] = {
272 if (ipset->external && *ipset->external)
275 info(" * %s", ipset->name);
278 fw3_pr("create %s %s", ipset->name, methods[ipset->method]);
280 list_for_each_entry(type, &ipset->datatypes, list)
282 fw3_pr("%c%s", first ? ':' : ',', types[type->type]);
286 if (!list_empty(&ipset->iprange))
288 a1 = list_first_entry(&ipset->iprange, struct fw3_address, list);
289 a2 = list_last_entry(&ipset->iprange, struct fw3_address, list);
293 inet_ntop(a1->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
294 &a1->address.v6, s, sizeof(s));
296 fw3_pr(" range %s/%u", s, a1->mask);
298 else if (a1->family == a2->family &&
299 fw3_is_family(ipset, a1->family) &&
300 fw3_is_family(ipset, a2->family))
302 inet_ntop(a1->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
303 &a1->address.v6, s, sizeof(s));
305 fw3_pr(" range %s", s);
307 inet_ntop(a2->family == FW3_FAMILY_V4 ? AF_INET : AF_INET6,
308 &a2->address.v6, s, sizeof(s));
313 else if (ipset->portrange.set)
315 fw3_pr(" range %u-%u",
316 ipset->portrange.port_min, ipset->portrange.port_max);
319 if (ipset->family != FW3_FAMILY_ANY)
320 fw3_pr(" family %s", families[ipset->family]);
322 if (ipset->timeout > 0)
323 fw3_pr(" timeout %u", ipset->timeout);
325 if (ipset->maxelem > 0)
326 fw3_pr(" maxelem %u", ipset->maxelem);
328 if (ipset->netmask > 0)
329 fw3_pr(" netmask %u", ipset->netmask);
331 if (ipset->hashsize > 0)
332 fw3_pr(" hashsize %u", ipset->hashsize);
338 fw3_create_ipsets(struct fw3_state *state)
340 struct fw3_ipset *ipset;
342 if (state->disable_ipsets)
345 info("Initializing ipsets ...");
347 list_for_each_entry(ipset, &state->ipsets, list)
354 fw3_destroy_ipsets(struct fw3_state *state)
361 sf = fopen(FW3_STATEFILE, "r");
366 info("Destroying ipsets ...");
368 while (fgets(line, sizeof(line), sf))
370 if (strncmp(line, "ipset ", 6))
373 p = strtok(line+6, " \t\n");
375 if (!p || !strlen(p))
380 fw3_pr("flush %s\n", p);
381 fw3_pr("destroy %s\n", p);
388 fw3_free_ipset(struct fw3_ipset *ipset)
390 fw3_free_list(&ipset->datatypes);
391 fw3_free_list(&ipset->iprange);
397 fw3_lookup_ipset(struct fw3_state *state, const char *name)
399 struct fw3_ipset *ipset;
401 if (list_empty(&state->ipsets))
404 list_for_each_entry(ipset, &state->ipsets, list)
405 if (!strcmp(ipset->name, name))