2 * firewall3 - 3rd OpenWrt UCI firewall implementation
4 * Copyright (C) 2013-2018 Jo-Philipp Wich <jo@mein.io>
6 * Permission to use, copy, modify, and/or distribute this software for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
22 const struct fw3_option fw3_rule_opts[] = {
23 FW3_OPT("enabled", bool, rule, enabled),
25 FW3_OPT("name", string, rule, name),
26 FW3_OPT("family", family, rule, family),
28 FW3_OPT("src", device, rule, src),
29 FW3_OPT("dest", device, rule, dest),
31 FW3_OPT("device", string, rule, device),
32 FW3_OPT("direction", direction, rule, direction_out),
34 FW3_OPT("ipset", setmatch, rule, ipset),
35 FW3_OPT("helper", cthelper, rule, helper),
36 FW3_OPT("set_helper", cthelper, rule, set_helper),
38 FW3_LIST("proto", protocol, rule, proto),
40 FW3_LIST("src_ip", network, rule, ip_src),
41 FW3_LIST("src_mac", mac, rule, mac_src),
42 FW3_LIST("src_port", port, rule, port_src),
44 FW3_LIST("dest_ip", network, rule, ip_dest),
45 FW3_LIST("dest_port", port, rule, port_dest),
47 FW3_LIST("icmp_type", icmptype, rule, icmp_type),
48 FW3_OPT("extra", string, rule, extra),
50 FW3_OPT("limit", limit, rule, limit),
51 FW3_OPT("limit_burst", int, rule, limit.burst),
53 FW3_OPT("utc_time", bool, rule, time.utc),
54 FW3_OPT("start_date", date, rule, time.datestart),
55 FW3_OPT("stop_date", date, rule, time.datestop),
56 FW3_OPT("start_time", time, rule, time.timestart),
57 FW3_OPT("stop_time", time, rule, time.timestop),
58 FW3_OPT("weekdays", weekdays, rule, time.weekdays),
59 FW3_OPT("monthdays", monthdays, rule, time.monthdays),
61 FW3_OPT("mark", mark, rule, mark),
62 FW3_OPT("set_mark", mark, rule, set_mark),
63 FW3_OPT("set_xmark", mark, rule, set_xmark),
65 FW3_OPT("dscp", dscp, rule, dscp),
66 FW3_OPT("set_dscp", dscp, rule, set_dscp),
68 FW3_OPT("target", target, rule, target),
75 need_src_action_chain(struct fw3_rule *r)
77 return (r->_src && r->_src->log && (r->target > FW3_FLAG_ACCEPT));
80 static struct fw3_rule*
81 alloc_rule(struct fw3_state *state)
83 struct fw3_rule *rule = calloc(1, sizeof(*rule));
86 INIT_LIST_HEAD(&rule->proto);
88 INIT_LIST_HEAD(&rule->ip_src);
89 INIT_LIST_HEAD(&rule->mac_src);
90 INIT_LIST_HEAD(&rule->port_src);
92 INIT_LIST_HEAD(&rule->ip_dest);
93 INIT_LIST_HEAD(&rule->port_dest);
95 INIT_LIST_HEAD(&rule->icmp_type);
97 list_add_tail(&rule->list, &state->rules);
105 check_rule(struct fw3_state *state, struct fw3_rule *r, struct uci_element *e)
110 if (r->src.invert || r->dest.invert)
112 warn_section("rule", r, e, "must not have inverted 'src' or 'dest' options");
115 else if (r->src.set && !r->src.any &&
116 !(r->_src = fw3_lookup_zone(state, r->src.name)))
118 warn_section("rule", r, e, "refers to not existing zone '%s'", r->src.name);
121 else if (r->dest.set && !r->dest.any &&
122 !(r->_dest = fw3_lookup_zone(state, r->dest.name)))
124 warn_section("rule", r, e, "refers to not existing zone '%s'", r->dest.name);
127 else if (r->ipset.set && state->disable_ipsets)
129 warn_section("rule", r, e, "skipped due to disabled ipset support");
132 else if (r->ipset.set &&
133 !(r->ipset.ptr = fw3_lookup_ipset(state, r->ipset.name)))
135 warn_section("rule", r, e, "refers to unknown ipset '%s'", r->ipset.name);
138 else if (r->helper.set &&
139 !(r->helper.ptr = fw3_lookup_cthelper(state, r->helper.name)))
141 warn_section("rule", r, e, "refers to unknown CT helper '%s'", r->helper.name);
144 else if (r->set_helper.set &&
145 !(r->set_helper.ptr = fw3_lookup_cthelper(state, r->set_helper.name)))
147 warn_section("rule", r, e, "refers to unknown CT helper '%s'", r->set_helper.name);
151 if (!r->_src && (r->target == FW3_FLAG_NOTRACK || r->target == FW3_FLAG_HELPER))
153 warn_section("rule", r, e, "is set to target %s but has no source assigned",
154 fw3_flag_names[r->target]);
158 if (!r->set_mark.set && !r->set_xmark.set &&
159 r->target == FW3_FLAG_MARK)
161 warn_section("rule", r, e, "is set to target MARK but specifies neither "
162 "'set_mark' nor 'set_xmark' option");
166 if (!r->set_dscp.set && r->target == FW3_FLAG_DSCP)
168 warn_section("rule", r, e, "is set to target DSCP but specifies no "
169 "'set_dscp' option");
173 if (r->_dest && (r->target == FW3_FLAG_MARK || r->target == FW3_FLAG_DSCP))
175 warn_section("rule", r, e, "must not specify 'dest' for %s target",
176 fw3_flag_names[r->target]);
180 if (r->set_mark.invert || r->set_xmark.invert || r->set_dscp.invert)
182 warn_section("rule", r, e, "must not have inverted 'set_mark', "
183 "'set_xmark' or 'set_dscp'");
187 if (!r->set_helper.set && r->target == FW3_FLAG_HELPER)
189 warn_section("rule", r, e, "is set to target HELPER but specifies "
190 "no 'set_helper' option");
194 if (r->set_helper.invert && r->target == FW3_FLAG_HELPER)
196 warn_section("rule", r, e, "must not have inverted 'set_helper' option");
200 if (!r->_src && !r->_dest && !r->src.any && !r->dest.any)
202 warn_section("rule", r, e, "has neither a source nor a destination zone assigned "
203 "- assuming an output rule");
206 if (list_empty(&r->proto))
208 warn_section("rule", r, e, "does not specify a protocol, assuming TCP+UDP");
209 fw3_parse_protocol(&r->proto, "tcpudp", true);
212 if (r->target == FW3_FLAG_UNSPEC)
214 warn_section("rule", r, e, "has no target specified, defaulting to REJECT");
215 r->target = FW3_FLAG_REJECT;
217 else if (r->target > FW3_FLAG_DSCP)
219 warn_section("rule", r, e, "has invalid target specified, defaulting to REJECT");
220 r->target = FW3_FLAG_REJECT;
223 /* NB: r family... */
226 fw3_setbit(r->_dest->flags[0], r->target);
227 fw3_setbit(r->_dest->flags[1], r->target);
229 else if (need_src_action_chain(r))
231 fw3_setbit(r->_src->flags[0], fw3_to_src_target(r->target));
232 fw3_setbit(r->_src->flags[1], fw3_to_src_target(r->target));
239 fw3_load_rules(struct fw3_state *state, struct uci_package *p,
242 struct uci_section *s;
243 struct uci_element *e;
244 struct fw3_rule *rule;
245 struct blob_attr *entry;
248 INIT_LIST_HEAD(&state->rules);
250 blob_for_each_attr(entry, a, rem) {
252 const char *name = "ubus rule";
254 if (!fw3_attr_parse_name_type(entry, &name, &type))
257 if (strcmp(type, "rule"))
260 if (!(rule = alloc_rule(state)))
263 if (!fw3_parse_blob_options(rule, fw3_rule_opts, entry, name))
265 warn_section("rule", rule, NULL, "skipped due to invalid options");
270 if (!check_rule(state, rule, NULL))
274 uci_foreach_element(&p->sections, e)
276 s = uci_to_section(e);
278 if (strcmp(s->type, "rule"))
281 if (!(rule = alloc_rule(state)))
284 if (!fw3_parse_options(rule, fw3_rule_opts, s))
286 warn_elem(e, "skipped due to invalid options");
291 if (!check_rule(state, rule, e))
298 append_chain(struct fw3_ipt_rule *r, struct fw3_rule *rule)
302 snprintf(chain, sizeof(chain), "OUTPUT");
304 if (rule->target == FW3_FLAG_NOTRACK)
306 snprintf(chain, sizeof(chain), "zone_%s_notrack", rule->src.name);
308 else if (rule->target == FW3_FLAG_HELPER)
310 snprintf(chain, sizeof(chain), "zone_%s_helper", rule->src.name);
312 else if ((rule->target == FW3_FLAG_MARK || rule->target == FW3_FLAG_DSCP) &&
313 (rule->_src || rule->src.any))
315 snprintf(chain, sizeof(chain), "PREROUTING");
324 snprintf(chain, sizeof(chain), "zone_%s_forward",
327 snprintf(chain, sizeof(chain), "zone_%s_input",
333 snprintf(chain, sizeof(chain), "FORWARD");
335 snprintf(chain, sizeof(chain), "INPUT");
339 if (rule->dest.set && !rule->src.set)
342 snprintf(chain, sizeof(chain), "OUTPUT");
344 snprintf(chain, sizeof(chain), "zone_%s_output",
349 fw3_ipt_rule_append(r, chain);
352 static void set_target(struct fw3_ipt_rule *r, struct fw3_rule *rule)
355 struct fw3_mark *mark;
356 char buf[sizeof("0xFFFFFFFF/0xFFFFFFFF")];
361 name = rule->set_mark.set ? "--set-mark" : "--set-xmark";
362 mark = rule->set_mark.set ? &rule->set_mark : &rule->set_xmark;
363 snprintf(buf, sizeof(buf), "0x%x/0x%x", mark->mark, mark->mask);
365 fw3_ipt_rule_target(r, "MARK");
366 fw3_ipt_rule_addarg(r, false, name, buf);
370 snprintf(buf, sizeof(buf), "0x%x", rule->set_dscp.dscp);
372 fw3_ipt_rule_target(r, "DSCP");
373 fw3_ipt_rule_addarg(r, false, "--set-dscp", buf);
376 case FW3_FLAG_NOTRACK:
377 fw3_ipt_rule_target(r, "CT");
378 fw3_ipt_rule_addarg(r, false, "--notrack", NULL);
381 case FW3_FLAG_HELPER:
382 fw3_ipt_rule_target(r, "CT");
383 fw3_ipt_rule_addarg(r, false, "--helper", rule->set_helper.ptr->name);
386 case FW3_FLAG_ACCEPT:
388 name = fw3_flag_names[rule->target];
392 name = fw3_flag_names[FW3_FLAG_REJECT];
396 if (rule->dest.set && !rule->dest.any)
397 fw3_ipt_rule_target(r, "zone_%s_dest_%s", rule->dest.name, name);
398 else if (need_src_action_chain(rule))
399 fw3_ipt_rule_target(r, "zone_%s_src_%s", rule->src.name, name);
400 else if (strcmp(name, "REJECT"))
401 fw3_ipt_rule_target(r, name);
403 fw3_ipt_rule_target(r, "reject");
407 set_comment(struct fw3_ipt_rule *r, const char *name, int num)
410 fw3_ipt_rule_comment(r, name);
412 fw3_ipt_rule_comment(r, "@rule[%u]", num);
416 print_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
417 struct fw3_rule *rule, int num, struct fw3_protocol *proto,
418 struct fw3_address *sip, struct fw3_address *dip,
419 struct fw3_port *sport, struct fw3_port *dport,
420 struct fw3_mac *mac, struct fw3_icmptype *icmptype)
422 struct fw3_ipt_rule *r;
424 if (!fw3_is_family(sip, handle->family) ||
425 !fw3_is_family(dip, handle->family))
427 if ((sip && !sip->resolved) || (dip && !dip->resolved))
428 info(" ! Skipping due to different family of ip address");
433 if (!fw3_is_family(sip, handle->family) ||
434 !fw3_is_family(dip, handle->family))
436 if ((sip && !sip->resolved) || (dip && !dip->resolved))
437 info(" ! Skipping due to different family of ip address");
442 if (!fw3_is_family(sip, handle->family) ||
443 !fw3_is_family(dip, handle->family))
445 if ((sip && !sip->resolved) || (dip && !dip->resolved))
446 info(" ! Skipping due to different family of ip address");
451 if (proto->protocol == 58 && handle->family == FW3_FAMILY_V4)
453 info(" ! Skipping protocol %s due to different family",
454 fw3_protoname(proto));
458 if (rule->helper.ptr &&
459 !fw3_cthelper_check_proto(rule->helper.ptr, proto))
461 info(" ! Skipping protocol %s since helper '%s' does not support it",
462 fw3_protoname(proto), rule->helper.ptr->name);
466 if (rule->set_helper.ptr &&
467 !fw3_cthelper_check_proto(rule->set_helper.ptr, proto))
469 info(" ! Skipping protocol %s since helper '%s' does not support it",
470 fw3_protoname(proto), rule->helper.ptr->name);
474 r = fw3_ipt_rule_create(handle, proto, NULL, NULL, sip, dip);
475 fw3_ipt_rule_sport_dport(r, sport, dport);
476 fw3_ipt_rule_device(r, rule->device, rule->direction_out);
477 fw3_ipt_rule_icmptype(r, icmptype);
478 fw3_ipt_rule_mac(r, mac);
479 fw3_ipt_rule_ipset(r, &rule->ipset);
480 fw3_ipt_rule_helper(r, &rule->helper);
481 fw3_ipt_rule_limit(r, &rule->limit);
482 fw3_ipt_rule_time(r, &rule->time);
483 fw3_ipt_rule_mark(r, &rule->mark);
484 fw3_ipt_rule_dscp(r, &rule->dscp);
486 fw3_ipt_rule_extra(r, rule->extra);
487 set_comment(r, rule->name, num);
488 append_chain(r, rule);
492 expand_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
493 struct fw3_rule *rule, int num)
495 struct fw3_protocol *proto;
496 struct fw3_address *sip;
497 struct fw3_address *dip;
498 struct fw3_port *sport;
499 struct fw3_port *dport;
501 struct fw3_icmptype *icmptype;
503 struct list_head *sports = NULL;
504 struct list_head *dports = NULL;
505 struct list_head *icmptypes = NULL;
507 struct list_head empty;
508 INIT_LIST_HEAD(&empty);
510 if (!fw3_is_family(rule, handle->family))
513 if ((rule->target == FW3_FLAG_NOTRACK && handle->table != FW3_TABLE_RAW) ||
514 (rule->target == FW3_FLAG_HELPER && handle->table != FW3_TABLE_RAW) ||
515 (rule->target == FW3_FLAG_MARK && handle->table != FW3_TABLE_MANGLE) ||
516 (rule->target == FW3_FLAG_DSCP && handle->table != FW3_TABLE_MANGLE) ||
517 (rule->target < FW3_FLAG_NOTRACK && handle->table != FW3_TABLE_FILTER))
521 info(" * Rule '%s'", rule->name);
523 info(" * Rule #%u", num);
525 if (!fw3_is_family(rule->_src, handle->family) ||
526 !fw3_is_family(rule->_dest, handle->family))
528 info(" ! Skipping due to different family of zone");
534 if (!fw3_is_family(rule->ipset.ptr, handle->family))
536 info(" ! Skipping due to different family in ipset");
540 if (!fw3_check_ipset(rule->ipset.ptr))
542 info(" ! Skipping due to missing ipset '%s'",
543 rule->ipset.ptr->external
544 ? rule->ipset.ptr->external : rule->ipset.ptr->name);
548 set(rule->ipset.ptr->flags, handle->family, handle->family);
551 if (rule->helper.ptr && !fw3_is_family(rule->helper.ptr, handle->family))
553 info(" ! Skipping due to unsupported family of CT helper");
557 if (rule->set_helper.ptr && !fw3_is_family(rule->set_helper.ptr, handle->family))
559 info(" ! Skipping due to unsupported family of CT helper");
563 list_for_each_entry(proto, &rule->proto, list)
565 /* icmp / ipv6-icmp */
566 if (proto->protocol == 1 || proto->protocol == 58)
570 icmptypes = &rule->icmp_type;
574 sports = &rule->port_src;
575 dports = &rule->port_dest;
579 fw3_foreach(sip, &rule->ip_src)
580 fw3_foreach(dip, &rule->ip_dest)
581 fw3_foreach(sport, sports)
582 fw3_foreach(dport, dports)
583 fw3_foreach(mac, &rule->mac_src)
584 fw3_foreach(icmptype, icmptypes)
585 print_rule(handle, state, rule, num, proto, sip, dip,
586 sport, dport, mac, icmptype);
591 fw3_print_rules(struct fw3_ipt_handle *handle, struct fw3_state *state)
594 struct fw3_rule *rule;
596 list_for_each_entry(rule, &state->rules, list)
597 expand_rule(handle, state, rule, num++);