2 * firewall3 - 3rd OpenWrt UCI firewall implementation
4 * Copyright (C) 2013 Jo-Philipp Wich <jo@mein.io>
6 * Permission to use, copy, modify, and/or distribute this software for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
24 const struct fw3_option fw3_ipset_opts
[] = {
25 FW3_OPT("enabled", bool, ipset
, enabled
),
26 FW3_OPT("reload_set", bool, ipset
, reload_set
),
27 FW3_OPT("counters", bool, ipset
, counters
),
28 FW3_OPT("comment", bool, ipset
, comment
),
30 FW3_OPT("name", string
, ipset
, name
),
31 FW3_OPT("family", family
, ipset
, family
),
33 FW3_OPT("storage", ipset_method
, ipset
, method
),
34 FW3_LIST("match", ipset_datatype
, ipset
, datatypes
),
36 FW3_OPT("iprange", address
, ipset
, iprange
),
37 FW3_OPT("portrange", port
, ipset
, portrange
),
39 FW3_OPT("netmask", int, ipset
, netmask
),
40 FW3_OPT("maxelem", int, ipset
, maxelem
),
41 FW3_OPT("hashsize", int, ipset
, hashsize
),
42 FW3_OPT("timeout", int, ipset
, timeout
),
44 FW3_OPT("external", string
, ipset
, external
),
46 FW3_LIST("entry", setentry
, ipset
, entries
),
47 FW3_OPT("loadfile", string
, ipset
, loadfile
),
52 #define T(m, t1, t2, t3, r, o) \
53 { FW3_IPSET_METHOD_##m, \
54 FW3_IPSET_TYPE_##t1 | (FW3_IPSET_TYPE_##t2 << 8) | (FW3_IPSET_TYPE_##t3 << 16), \
58 OPT_IPRANGE
= (1 << 0),
59 OPT_PORTRANGE
= (1 << 1),
60 OPT_NETMASK
= (1 << 2),
61 OPT_HASHSIZE
= (1 << 3),
62 OPT_MAXELEM
= (1 << 4),
63 OPT_FAMILY
= (1 << 5),
67 enum fw3_ipset_method method
;
73 static struct ipset_type ipset_types
[] = {
74 T(BITMAP
, IP
, UNSPEC
, UNSPEC
, OPT_IPRANGE
, OPT_NETMASK
),
75 T(BITMAP
, IP
, MAC
, UNSPEC
, OPT_IPRANGE
, 0),
76 T(BITMAP
, PORT
, UNSPEC
, UNSPEC
, OPT_PORTRANGE
, 0),
78 T(HASH
, IP
, UNSPEC
, UNSPEC
, 0,
79 OPT_FAMILY
| OPT_HASHSIZE
| OPT_MAXELEM
| OPT_NETMASK
),
80 T(HASH
, NET
, UNSPEC
, UNSPEC
, 0,
81 OPT_FAMILY
| OPT_HASHSIZE
| OPT_MAXELEM
),
82 T(HASH
, IP
, PORT
, UNSPEC
, 0,
83 OPT_FAMILY
| OPT_HASHSIZE
| OPT_MAXELEM
),
84 T(HASH
, NET
, PORT
, UNSPEC
, 0,
85 OPT_FAMILY
| OPT_HASHSIZE
| OPT_MAXELEM
),
86 T(HASH
, IP
, PORT
, IP
, 0,
87 OPT_FAMILY
| OPT_HASHSIZE
| OPT_MAXELEM
),
88 T(HASH
, IP
, PORT
, NET
, 0,
89 OPT_FAMILY
| OPT_HASHSIZE
| OPT_MAXELEM
),
91 T(LIST
, SET
, UNSPEC
, UNSPEC
, 0, OPT_MAXELEM
),
96 check_types(struct uci_element
*e
, struct fw3_ipset
*ipset
)
99 uint32_t typelist
= 0;
100 struct fw3_ipset_datatype
*type
;
102 list_for_each_entry(type
, &ipset
->datatypes
, list
)
106 warn_section("ipset", ipset
, e
, "must not have more than 3 datatypes assigned");
110 typelist
|= (type
->type
<< (i
++ * 8));
113 /* find a suitable storage method if none specified */
114 if (ipset
->method
== FW3_IPSET_METHOD_UNSPEC
)
116 for (i
= 0; i
< ARRAY_SIZE(ipset_types
); i
++)
118 /* skip type for v6 if it does not support family */
119 if (ipset
->family
!= FW3_FAMILY_V4
&&
120 !(ipset_types
[i
].optional
& OPT_FAMILY
))
123 if (ipset_types
[i
].types
== typelist
)
125 ipset
->method
= ipset_types
[i
].method
;
127 warn_section("ipset", ipset
, e
, "defines no storage method, assuming '%s'",
128 fw3_ipset_method_names
[ipset
->method
]);
135 //typelist |= ipset->method;
137 for (i
= 0; i
< ARRAY_SIZE(ipset_types
); i
++)
139 if (ipset_types
[i
].method
== ipset
->method
&&
140 ipset_types
[i
].types
== typelist
)
142 if (!ipset
->external
)
144 if ((ipset_types
[i
].required
& OPT_IPRANGE
) &&
147 warn_section("ipset", ipset
, e
, "requires an ip range");
151 if ((ipset_types
[i
].required
& OPT_PORTRANGE
) &&
152 !ipset
->portrange
.set
)
154 warn_section("ipset", ipset
, e
, "requires a port range");
158 if (!(ipset_types
[i
].required
& OPT_IPRANGE
) &&
161 warn_section("ipset", ipset
, e
, "iprange ignored");
162 ipset
->iprange
.set
= false;
165 if (!(ipset_types
[i
].required
& OPT_PORTRANGE
) &&
166 ipset
->portrange
.set
)
168 warn_section("ipset", ipset
, e
, "portrange ignored");
169 ipset
->portrange
.set
= false;
172 if (!(ipset_types
[i
].optional
& OPT_NETMASK
) &&
175 warn_section("ipset", ipset
, e
, "netmask ignored");
179 if (!(ipset_types
[i
].optional
& OPT_HASHSIZE
) &&
182 warn_section("ipset", ipset
, e
, "hashsize ignored");
186 if (!(ipset_types
[i
].optional
& OPT_MAXELEM
) &&
189 warn_section("ipset", ipset
, e
, "maxelem ignored");
193 if (!(ipset_types
[i
].optional
& OPT_FAMILY
) &&
194 ipset
->family
!= FW3_FAMILY_V4
)
196 warn_section("ipset", ipset
, e
, "family ignored");
197 ipset
->family
= FW3_FAMILY_V4
;
205 warn_section("ipset", ipset
, e
, "has an invalid combination of storage method and matches");
210 check_ipset(struct fw3_state
*state
, struct fw3_ipset
*ipset
, struct uci_element
*e
)
212 if (!ipset
->enabled
) {
218 if (!*ipset
->external
)
219 ipset
->external
= NULL
;
220 else if (!ipset
->name
)
221 ipset
->name
= ipset
->external
;
224 if (!ipset
->name
|| !*ipset
->name
)
226 warn_section("ipset", ipset
, e
, "ipset must have a name assigned");
228 //else if (fw3_lookup_ipset(state, ipset->name) != NULL)
230 // warn_section("ipset", ipset, e, "has duplicated set name", ipset->name);
232 else if (ipset
->family
== FW3_FAMILY_ANY
)
234 warn_section("ipset", ipset
, e
, "must not have family 'any'");
236 else if (ipset
->iprange
.set
&& ipset
->family
!= ipset
->iprange
.family
)
238 warn_section("ipset", ipset
, e
, "has iprange of wrong address family");
240 else if (list_empty(&ipset
->datatypes
))
242 warn_section("ipset", ipset
, e
, "has no datatypes assigned");
244 else if (check_types(e
, ipset
))
252 static struct fw3_ipset
*
253 fw3_alloc_ipset(struct fw3_state
*state
)
255 struct fw3_ipset
*ipset
;
257 ipset
= calloc(1, sizeof(*ipset
));
261 INIT_LIST_HEAD(&ipset
->datatypes
);
262 INIT_LIST_HEAD(&ipset
->entries
);
264 ipset
->comment
= false;
265 ipset
->counters
= false;
266 ipset
->enabled
= true;
267 ipset
->family
= FW3_FAMILY_V4
;
268 ipset
->reload_set
= false;
269 ipset
->timeout
= -1; /* no timeout by default */
271 list_add_tail(&ipset
->list
, &state
->ipsets
);
277 fw3_load_ipsets(struct fw3_state
*state
, struct uci_package
*p
,
280 struct uci_section
*s
;
281 struct uci_element
*e
;
282 struct fw3_ipset
*ipset
;
283 struct blob_attr
*entry
;
286 INIT_LIST_HEAD(&state
->ipsets
);
288 if (state
->disable_ipsets
)
291 blob_for_each_attr(entry
, a
, rem
)
294 const char *name
= "ubus ipset";
296 if (!fw3_attr_parse_name_type(entry
, &name
, &type
))
299 if (strcmp(type
, "ipset"))
302 ipset
= fw3_alloc_ipset(state
);
306 if (!fw3_parse_blob_options(ipset
, fw3_ipset_opts
, entry
, name
))
308 warn_section("ipset", ipset
, NULL
, "skipped due to invalid options");
309 fw3_free_ipset(ipset
);
313 if (!check_ipset(state
, ipset
, NULL
))
314 fw3_free_ipset(ipset
);
317 uci_foreach_element(&p
->sections
, e
)
319 s
= uci_to_section(e
);
321 if (strcmp(s
->type
, "ipset"))
324 ipset
= fw3_alloc_ipset(state
);
329 if (!fw3_parse_options(ipset
, fw3_ipset_opts
, s
))
330 warn_elem(e
, "has invalid options");
332 if (!check_ipset(state
, ipset
, e
))
333 fw3_free_ipset(ipset
);
339 load_file(struct fw3_ipset
*ipset
)
345 if (!ipset
->loadfile
)
348 info(" * Loading file %s", ipset
->loadfile
);
350 f
= fopen(ipset
->loadfile
, "r");
353 info(" ! Skipping due to open error: %s", strerror(errno
));
357 while (fgets(line
, sizeof(line
), f
)) {
362 fw3_pr("add %s %s", ipset
->name
, line
);
369 create_ipset(struct fw3_ipset
*ipset
, struct fw3_state
*state
)
372 struct fw3_setentry
*entry
;
373 struct fw3_ipset_datatype
*type
;
375 info(" * Creating ipset %s", ipset
->name
);
378 fw3_pr("create %s %s", ipset
->name
, fw3_ipset_method_names
[ipset
->method
]);
380 list_for_each_entry(type
, &ipset
->datatypes
, list
)
382 fw3_pr("%c%s", first
? ':' : ',', fw3_ipset_type_names
[type
->type
]);
386 if (ipset
->method
== FW3_IPSET_METHOD_HASH
)
387 fw3_pr(" family inet%s", (ipset
->family
== FW3_FAMILY_V4
) ? "" : "6");
389 if (ipset
->iprange
.set
)
391 fw3_pr(" range %s", fw3_address_to_string(&ipset
->iprange
, false, true));
393 else if (ipset
->portrange
.set
)
395 fw3_pr(" range %u-%u",
396 ipset
->portrange
.port_min
, ipset
->portrange
.port_max
);
399 if (ipset
->timeout
>= 0)
400 fw3_pr(" timeout %u", ipset
->timeout
);
402 if (ipset
->maxelem
> 0)
403 fw3_pr(" maxelem %u", ipset
->maxelem
);
405 if (ipset
->netmask
> 0)
406 fw3_pr(" netmask %u", ipset
->netmask
);
408 if (ipset
->hashsize
> 0)
409 fw3_pr(" hashsize %u", ipset
->hashsize
);
419 list_for_each_entry(entry
, &ipset
->entries
, list
)
420 fw3_pr("add %s %s\n", ipset
->name
, entry
->value
);
426 fw3_create_ipsets(struct fw3_state
*state
, enum fw3_family family
,
429 unsigned int delay
, tries
;
431 struct fw3_ipset
*ipset
;
433 if (state
->disable_ipsets
)
437 list_for_each_entry(ipset
, &state
->ipsets
, list
)
439 if (ipset
->family
!= family
)
445 if (fw3_check_ipset(ipset
) &&
446 (reload_set
&& !ipset
->reload_set
))
451 exec
= fw3_command_pipe(false, "ipset", "-exist", "-");
457 create_ipset(ipset
, state
);
466 /* wait a little expontially for ipsets to appear */
467 list_for_each_entry(ipset
, &state
->ipsets
, list
)
473 for (tries
= 0; !fw3_check_ipset(ipset
) && tries
< 10; tries
++)
479 fw3_destroy_ipsets(struct fw3_state
*state
, enum fw3_family family
,
482 unsigned int delay
, tries
;
484 struct fw3_ipset
*ipset
;
486 if (state
->disable_ipsets
)
490 list_for_each_entry(ipset
, &state
->ipsets
, list
)
492 if (ipset
->family
!= family
||
493 (reload_set
&& !ipset
->reload_set
))
498 exec
= fw3_command_pipe(false, "ipset", "-exist", "-");
504 info(" * Deleting ipset %s", ipset
->name
);
506 fw3_pr("flush %s\n", ipset
->name
);
507 fw3_pr("destroy %s\n", ipset
->name
);
516 /* wait for ipsets to disappear */
517 list_for_each_entry(ipset
, &state
->ipsets
, list
)
523 for (tries
= 0; fw3_check_ipset(ipset
) && tries
< 10; tries
++)
529 fw3_lookup_ipset(struct fw3_state
*state
, const char *name
)
533 if (list_empty(&state
->ipsets
))
536 list_for_each_entry(s
, &state
->ipsets
, list
)
538 if (strcmp(s
->name
, name
))
548 fw3_check_ipset(struct fw3_ipset
*set
)
553 int s
= socket(AF_INET
, SOCK_RAW
, IPPROTO_RAW
);
554 struct ip_set_req_version req_ver
;
555 struct ip_set_req_get_set req_name
;
557 if (s
< 0 || fcntl(s
, F_SETFD
, FD_CLOEXEC
))
560 sz
= sizeof(req_ver
);
561 req_ver
.op
= IP_SET_OP_VERSION
;
563 if (getsockopt(s
, SOL_IP
, SO_IP_SET
, &req_ver
, &sz
))
566 sz
= sizeof(req_name
);
567 req_name
.op
= IP_SET_OP_GET_BYNAME
;
568 req_name
.version
= req_ver
.version
;
569 snprintf(req_name
.set
.name
, IPSET_MAXNAMELEN
- 1, "%s",
570 set
->external
? set
->external
: set
->name
);
572 if (getsockopt(s
, SOL_IP
, SO_IP_SET
, &req_name
, &sz
))
575 rv
= ((sz
== sizeof(req_name
)) && (req_name
.set
.index
!= IPSET_INVALID_ID
));
585 fw3_ipsets_update_run_state(enum fw3_family family
, struct fw3_state
*run_state
,
586 struct fw3_state
*cfg_state
)
588 struct fw3_ipset
*ipset_run
, *ipset_cfg
;
591 list_for_each_entry(ipset_run
, &run_state
->ipsets
, list
) {
592 if (ipset_run
->family
!= family
)
597 list_for_each_entry(ipset_cfg
, &cfg_state
->ipsets
, list
) {
598 if (ipset_cfg
->family
!= family
)
601 if (strlen(ipset_run
->name
) ==
602 strlen(ipset_cfg
->name
) &&
603 !strcmp(ipset_run
->name
, ipset_cfg
->name
)) {
609 /* If a set is found in run_state, but not in cfg_state then the
610 * set has been deleted/renamed. Set reload_set to true to force
611 * the old set to be destroyed in the "stop" fase of the reload.
612 * If the set is found, then copy the reload_set value from the
613 * configuration state. This ensures that the elements are
614 * always updated according to the configuration, and not the
615 * runtime state (which the user might have forgotten).
618 ipset_run
->reload_set
= true;
620 ipset_run
->reload_set
= ipset_cfg
->reload_set
;