zones: add zone identifying local traffic in raw OUTPUT chain

Add zone chains identifying local generated traffic; either by configuring
a loopback device or as subnet a loopback address; in the raw OUTPUT chain
as local generated traffic is passing this chain.
This allows helpers to be used for local generated traffic.

Signed-off-by: Alin Nastac <alin.nastac@gmail.com>
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
Acked-by: Jo-Philipp Wich <jo@mein.io>

diff --git a/utils.c b/utils.c
index 684b2c32c25eb5d3123151cce472413c6a9daa04..7f0978724d5132d50d5af74d25291941cab9f237 100644 (file)
--- a/utils.c
+++ b/utils.c
@@ -17,6 +17,10 @@
  */
 
 #define _GNU_SOURCE
+
+#include <net/if.h>
+#include <sys/ioctl.h>
+
 #include "utils.h"
 #include "options.h"
 
@@ -935,3 +939,37 @@ fw3_protoname(void *proto)
 
        return pe->p_name;
 }
+
+bool
+fw3_check_loopback_dev(const char *name)
+{
+       struct ifreq ifr;
+       int s = socket(AF_LOCAL, SOCK_DGRAM, 0);
+       bool rv = false;
+
+       memset(&ifr, 0, sizeof(ifr));
+       strncpy(ifr.ifr_name, name, sizeof(ifr.ifr_name) - 1);
+
+       if (s < 0 || ioctl(s, SIOCGIFFLAGS, &ifr) < 0)
+               goto out;
+
+       if (ifr.ifr_flags & IFF_LOOPBACK)
+               rv = true;
+out:
+       return rv;
+}
+
+bool
+fw3_check_loopback_addr(struct fw3_address *addr)
+{
+       if (addr->family == FW3_FAMILY_V4 &&
+           (ntohl(addr->address.v4.s_addr) >> IN_CLASSA_NSHIFT) == IN_LOOPBACKNET)
+               return true;
+
+       if (addr->family == FW3_FAMILY_V6 && !addr->range &&
+           fw3_netmask2bitlen(FW3_FAMILY_V6, &addr->mask.v6) == 128 &&
+           IN6_IS_ADDR_LOOPBACK(&addr->address.v6))
+               return true;
+
+       return false;
+}

diff --git a/utils.h b/utils.h
index c8ab0e5b0b91d82884880a6f8e528647279a08a1..1ada0dd989a503c332bfdb9362d9159a802d4d4c 100644 (file)
--- a/utils.h
+++ b/utils.h
@@ -44,6 +44,8 @@
 
 extern bool fw3_pr_debug;
 
+struct fw3_address;
+
 void warn_elem(struct uci_element *e, const char *format, ...);
 void warn(const char *format, ...);
 void error(const char *format, ...);
@@ -120,4 +122,7 @@ bool fw3_attr_parse_name_type(struct blob_attr *entry, const char **name, const
 
 const char * fw3_protoname(void *proto);
 
+bool fw3_check_loopback_dev(const char *name);
+
+bool fw3_check_loopback_addr(struct fw3_address *addr);
 #endif

diff --git a/zones.c b/zones.c
index 505ab208b24b2fb7a0c25a54efe942b0f9c86433..4f2b1e4bd88672d62250e972d78eebac151ab595 100644 (file)
--- a/zones.c
+++ b/zones.c
@@ -98,7 +98,6 @@ const struct fw3_option fw3_zone_opts[] = {
        { }
 };
 
-
 static void
 check_policy(struct uci_element *e, enum fw3_flag *pol, enum fw3_flag def,
              const char *name)
@@ -557,22 +556,27 @@ print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
        }
        else if (handle->table == FW3_TABLE_RAW)
        {
+               bool loopback_dev = (dev != NULL && !dev->any &&
+                                    !dev->invert && fw3_check_loopback_dev(dev->name));
+               char *chain = loopback_dev || (sub != NULL && !sub->invert && fw3_check_loopback_addr(sub)) ?
+                             "OUTPUT" : "PREROUTING";
+
                if (has(zone->flags, handle->family, FW3_FLAG_HELPER))
                {
-                       r = fw3_ipt_rule_create(handle, NULL, dev, NULL, sub, NULL);
+                       r = fw3_ipt_rule_create(handle, NULL, loopback_dev ? NULL : dev, NULL, sub, NULL);
                        fw3_ipt_rule_comment(r, "%s CT helper assignment", zone->name);
                        fw3_ipt_rule_target(r, "zone_%s_helper", zone->name);
                        fw3_ipt_rule_extra(r, zone->extra_src);
-                       fw3_ipt_rule_replace(r, "PREROUTING");
+                       fw3_ipt_rule_replace(r, chain);
                }
 
                if (has(zone->flags, handle->family, FW3_FLAG_NOTRACK))
                {
-                       r = fw3_ipt_rule_create(handle, NULL, dev, NULL, sub, NULL);
+                       r = fw3_ipt_rule_create(handle, NULL, loopback_dev ? NULL : dev, NULL, sub, NULL);
                        fw3_ipt_rule_comment(r, "%s CT bypass", zone->name);
                        fw3_ipt_rule_target(r, "zone_%s_notrack", zone->name);
                        fw3_ipt_rule_extra(r, zone->extra_src);
-                       fw3_ipt_rule_replace(r, "PREROUTING");
+                       fw3_ipt_rule_replace(r, chain);
                }
        }
 }