2 * firewall3 - 3rd OpenWrt UCI firewall implementation
4 * Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
6 * Permission to use, copy, modify, and/or distribute this software for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
22 const struct fw3_option fw3_ipset_opts
[] = {
23 FW3_OPT("name", string
, ipset
, name
),
24 FW3_OPT("family", family
, ipset
, family
),
26 FW3_OPT("storage", ipset_method
, ipset
, method
),
27 FW3_LIST("match", ipset_datatype
, ipset
, datatypes
),
29 FW3_OPT("iprange", address
, ipset
, iprange
),
30 FW3_OPT("portrange", port
, ipset
, portrange
),
32 FW3_OPT("netmask", int, ipset
, netmask
),
33 FW3_OPT("maxelem", int, ipset
, maxelem
),
34 FW3_OPT("hashsize", int, ipset
, hashsize
),
35 FW3_OPT("timeout", int, ipset
, timeout
),
37 FW3_OPT("external", string
, ipset
, external
),
42 #define T(m, t1, t2, t3, r, o) \
43 { FW3_IPSET_METHOD_##m, \
44 FW3_IPSET_TYPE_##t1 | (FW3_IPSET_TYPE_##t2 << 8) | (FW3_IPSET_TYPE_##t3 << 16), \
48 OPT_IPRANGE
= (1 << 0),
49 OPT_PORTRANGE
= (1 << 1),
50 OPT_NETMASK
= (1 << 2),
51 OPT_HASHSIZE
= (1 << 3),
52 OPT_MAXELEM
= (1 << 4),
53 OPT_FAMILY
= (1 << 5),
57 enum fw3_ipset_method method
;
63 static struct ipset_type ipset_types
[] = {
64 T(BITMAP
, IP
, UNSPEC
, UNSPEC
, OPT_IPRANGE
, OPT_NETMASK
),
65 T(BITMAP
, IP
, MAC
, UNSPEC
, OPT_IPRANGE
, 0),
66 T(BITMAP
, PORT
, UNSPEC
, UNSPEC
, OPT_PORTRANGE
, 0),
68 T(HASH
, IP
, UNSPEC
, UNSPEC
, 0,
69 OPT_FAMILY
| OPT_HASHSIZE
| OPT_MAXELEM
| OPT_NETMASK
),
70 T(HASH
, NET
, UNSPEC
, UNSPEC
, 0,
71 OPT_FAMILY
| OPT_HASHSIZE
| OPT_MAXELEM
),
72 T(HASH
, IP
, PORT
, UNSPEC
, 0,
73 OPT_FAMILY
| OPT_HASHSIZE
| OPT_MAXELEM
),
74 T(HASH
, NET
, PORT
, UNSPEC
, 0,
75 OPT_FAMILY
| OPT_HASHSIZE
| OPT_MAXELEM
),
76 T(HASH
, IP
, PORT
, IP
, 0,
77 OPT_FAMILY
| OPT_HASHSIZE
| OPT_MAXELEM
),
78 T(HASH
, IP
, PORT
, NET
, 0,
79 OPT_FAMILY
| OPT_HASHSIZE
| OPT_MAXELEM
),
81 T(LIST
, SET
, UNSPEC
, UNSPEC
, 0, OPT_MAXELEM
),
86 check_types(struct uci_element
*e
, struct fw3_ipset
*ipset
)
89 uint32_t typelist
= 0;
90 struct fw3_ipset_datatype
*type
;
92 const char *methods
[] = {
101 list_for_each_entry(type
, &ipset
->datatypes
, list
)
105 warn_elem(e
, "must not have more than 3 datatypes assigned");
109 typelist
|= (type
->type
<< (i
++ * 8));
112 /* find a suitable storage method if none specified */
113 if (ipset
->method
== FW3_IPSET_METHOD_UNSPEC
)
115 for (i
= 0; i
< ARRAY_SIZE(ipset_types
); i
++)
117 if (ipset_types
[i
].types
== typelist
)
119 ipset
->method
= ipset_types
[i
].method
;
121 warn_elem(e
, "defines no storage method, assuming '%s'",
122 methods
[ipset
->method
]);
129 //typelist |= ipset->method;
131 for (i
= 0; i
< ARRAY_SIZE(ipset_types
); i
++)
133 if (ipset_types
[i
].method
== ipset
->method
&&
134 ipset_types
[i
].types
== typelist
)
136 if (!ipset
->external
|| !*ipset
->external
)
138 if ((ipset_types
[i
].required
& OPT_IPRANGE
) &&
141 warn_elem(e
, "requires an ip range");
145 if ((ipset_types
[i
].required
& OPT_PORTRANGE
) &&
146 !ipset
->portrange
.set
)
148 warn_elem(e
, "requires a port range");
152 if (!(ipset_types
[i
].required
& OPT_IPRANGE
) &&
155 warn_elem(e
, "iprange ignored");
156 ipset
->iprange
.set
= false;
159 if (!(ipset_types
[i
].required
& OPT_PORTRANGE
) &&
160 ipset
->portrange
.set
)
162 warn_elem(e
, "portrange ignored");
163 ipset
->portrange
.set
= false;
166 if (!(ipset_types
[i
].optional
& OPT_NETMASK
) &&
169 warn_elem(e
, "netmask ignored");
173 if (!(ipset_types
[i
].optional
& OPT_HASHSIZE
) &&
176 warn_elem(e
, "hashsize ignored");
180 if (!(ipset_types
[i
].optional
& OPT_MAXELEM
) &&
183 warn_elem(e
, "maxelem ignored");
187 if (!(ipset_types
[i
].optional
& OPT_FAMILY
) &&
188 ipset
->family
!= FW3_FAMILY_ANY
)
190 warn_elem(e
, "family ignored");
191 ipset
->family
= FW3_FAMILY_ANY
;
199 warn_elem(e
, "has an invalid combination of storage method and matches");
204 fw3_alloc_ipset(void)
206 struct fw3_ipset
*ipset
;
208 ipset
= malloc(sizeof(*ipset
));
213 memset(ipset
, 0, sizeof(*ipset
));
215 INIT_LIST_HEAD(&ipset
->datatypes
);
221 fw3_load_ipsets(struct fw3_state
*state
, struct uci_package
*p
)
223 struct uci_section
*s
;
224 struct uci_element
*e
;
225 struct fw3_ipset
*ipset
;
227 INIT_LIST_HEAD(&state
->ipsets
);
229 if (state
->disable_ipsets
)
232 uci_foreach_element(&p
->sections
, e
)
234 s
= uci_to_section(e
);
236 if (strcmp(s
->type
, "ipset"))
239 ipset
= fw3_alloc_ipset();
244 fw3_parse_options(ipset
, fw3_ipset_opts
, s
);
246 if (!ipset
->name
|| !*ipset
->name
)
248 warn_elem(e
, "must have a name assigned");
250 //else if (fw3_lookup_ipset(state, ipset->name) != NULL)
252 // warn_elem(e, "has duplicated set name '%s'", ipset->name);
254 else if (list_empty(&ipset
->datatypes
))
256 warn_elem(e
, "has no datatypes assigned");
258 else if (check_types(e
, ipset
))
260 list_add_tail(&ipset
->list
, &state
->ipsets
);
264 fw3_free_ipset(ipset
);
270 create_ipset(struct fw3_ipset
*ipset
, struct fw3_state
*state
)
273 char s
[INET6_ADDRSTRLEN
];
275 struct fw3_ipset_datatype
*type
;
276 struct fw3_address
*a
;
278 const char *methods
[] = {
285 const char *types
[] = {
294 if (ipset
->external
&& *ipset
->external
)
297 info("Creating ipset %s", ipset
->name
);
300 fw3_pr("create %s %s", ipset
->name
, methods
[ipset
->method
]);
302 list_for_each_entry(type
, &ipset
->datatypes
, list
)
304 fw3_pr("%c%s", first
? ':' : ',', types
[type
->type
]);
308 if (ipset
->iprange
.set
)
314 inet_ntop(a
->family
== FW3_FAMILY_V4
? AF_INET
: AF_INET6
,
315 &a
->address
.v6
, s
, sizeof(s
));
317 fw3_pr(" range %s/%u", s
, a
->mask
);
321 inet_ntop(a
->family
== FW3_FAMILY_V4
? AF_INET
: AF_INET6
,
322 &a
->address
.v6
, s
, sizeof(s
));
324 fw3_pr(" range %s", s
);
326 inet_ntop(a
->family
== FW3_FAMILY_V4
? AF_INET
: AF_INET6
,
327 &a
->address2
.v6
, s
, sizeof(s
));
332 else if (ipset
->portrange
.set
)
334 fw3_pr(" range %u-%u",
335 ipset
->portrange
.port_min
, ipset
->portrange
.port_max
);
338 if (ipset
->family
!= FW3_FAMILY_ANY
)
339 fw3_pr(" family inet%s", (ipset
->family
== FW3_FAMILY_V4
) ? "" : "6");
341 if (ipset
->timeout
> 0)
342 fw3_pr(" timeout %u", ipset
->timeout
);
344 if (ipset
->maxelem
> 0)
345 fw3_pr(" maxelem %u", ipset
->maxelem
);
347 if (ipset
->netmask
> 0)
348 fw3_pr(" netmask %u", ipset
->netmask
);
350 if (ipset
->hashsize
> 0)
351 fw3_pr(" hashsize %u", ipset
->hashsize
);
355 fw3_set_running(ipset
, &state
->running_ipsets
);
359 fw3_create_ipsets(struct fw3_state
*state
)
361 struct fw3_ipset
*ipset
;
363 if (state
->disable_ipsets
)
366 list_for_each_entry(ipset
, &state
->ipsets
, list
)
367 if (!fw3_lookup_ipset(state
, ipset
->name
, true))
368 create_ipset(ipset
, state
);
374 fw3_destroy_ipsets(struct fw3_state
*state
)
376 struct fw3_ipset
*s
, *tmp
;
377 int mask
= (1 << FW3_FAMILY_V4
) | (1 << FW3_FAMILY_V6
);
379 list_for_each_entry_safe(s
, tmp
, &state
->running_ipsets
, running_list
)
381 if (!hasbit(state
->defaults
.flags
, FW3_FAMILY_V4
))
382 delbit(s
->flags
, FW3_FAMILY_V4
);
384 if (!hasbit(state
->defaults
.flags
, FW3_FAMILY_V6
))
385 delbit(s
->flags
, FW3_FAMILY_V6
);
387 if (!(s
->flags
& mask
))
389 info("Deleting ipset %s", s
->name
);
391 fw3_pr("flush %s\n", s
->name
);
392 fw3_pr("destroy %s\n", s
->name
);
394 fw3_set_running(s
, NULL
);
400 fw3_lookup_ipset(struct fw3_state
*state
, const char *name
, bool running
)
404 if (list_empty(&state
->ipsets
))
407 list_for_each_entry(s
, &state
->ipsets
, list
)
409 if (strcmp(s
->name
, name
))
412 if (!running
|| s
->running_list
.next
)