2 * firewall3 - 3rd OpenWrt UCI firewall implementation
4 * Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
6 * Permission to use, copy, modify, and/or distribute this software for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
22 static struct fw3_option ipset_opts
[] = {
23 FW3_OPT("name", string
, ipset
, name
),
24 FW3_OPT("family", family
, ipset
, family
),
26 FW3_OPT("storage", ipset_method
, ipset
, method
),
27 FW3_LIST("match", ipset_datatype
, ipset
, datatypes
),
29 FW3_LIST("iprange", address
, ipset
, iprange
),
30 FW3_OPT("portrange", port
, ipset
, portrange
),
32 FW3_OPT("netmask", int, ipset
, netmask
),
33 FW3_OPT("maxelem", int, ipset
, maxelem
),
34 FW3_OPT("hashsize", int, ipset
, hashsize
),
35 FW3_OPT("timeout", int, ipset
, timeout
),
37 FW3_OPT("external", string
, ipset
, external
),
40 #define T(m, t1, t2, t3, r, o) \
41 { FW3_IPSET_METHOD_##m, \
42 FW3_IPSET_TYPE_##t1 | (FW3_IPSET_TYPE_##t2 << 8) | (FW3_IPSET_TYPE_##t3 << 16), \
45 static struct fw3_ipset_settype ipset_types
[] = {
46 T(BITMAP
, IP
, UNSPEC
, UNSPEC
, FW3_IPSET_OPT_IPRANGE
,
47 FW3_IPSET_OPT_NETMASK
),
48 T(BITMAP
, IP
, MAC
, UNSPEC
, FW3_IPSET_OPT_IPRANGE
, 0),
49 T(BITMAP
, PORT
, UNSPEC
, UNSPEC
, FW3_IPSET_OPT_PORTRANGE
, 0),
51 T(HASH
, IP
, UNSPEC
, UNSPEC
, 0,
52 FW3_IPSET_OPT_FAMILY
| FW3_IPSET_OPT_HASHSIZE
| FW3_IPSET_OPT_MAXELEM
|
53 FW3_IPSET_OPT_NETMASK
),
54 T(HASH
, NET
, UNSPEC
, UNSPEC
, 0,
55 FW3_IPSET_OPT_FAMILY
| FW3_IPSET_OPT_HASHSIZE
| FW3_IPSET_OPT_MAXELEM
),
56 T(HASH
, IP
, PORT
, UNSPEC
, 0,
57 FW3_IPSET_OPT_FAMILY
| FW3_IPSET_OPT_HASHSIZE
| FW3_IPSET_OPT_MAXELEM
),
58 T(HASH
, NET
, PORT
, UNSPEC
, 0,
59 FW3_IPSET_OPT_FAMILY
| FW3_IPSET_OPT_HASHSIZE
| FW3_IPSET_OPT_MAXELEM
),
60 T(HASH
, IP
, PORT
, IP
, 0,
61 FW3_IPSET_OPT_FAMILY
| FW3_IPSET_OPT_HASHSIZE
| FW3_IPSET_OPT_MAXELEM
),
62 T(HASH
, IP
, PORT
, NET
, 0,
63 FW3_IPSET_OPT_FAMILY
| FW3_IPSET_OPT_HASHSIZE
| FW3_IPSET_OPT_MAXELEM
),
65 T(LIST
, SET
, UNSPEC
, UNSPEC
, 0, FW3_IPSET_OPT_MAXELEM
),
70 check_types(struct uci_element
*e
, struct fw3_ipset
*ipset
)
73 uint32_t typelist
= 0;
74 struct fw3_ipset_datatype
*type
;
76 const char *methods
[] = {
85 list_for_each_entry(type
, &ipset
->datatypes
, list
)
89 warn_elem(e
, "must not have more than 3 datatypes assigned");
93 typelist
|= (type
->type
<< (i
++ * 8));
96 /* find a suitable storage method if none specified */
97 if (ipset
->method
== FW3_IPSET_METHOD_UNSPEC
)
99 for (i
= 0; i
< ARRAY_SIZE(ipset_types
); i
++)
101 if (ipset_types
[i
].types
== typelist
)
103 ipset
->method
= ipset_types
[i
].method
;
105 warn_elem(e
, "defines no storage method, assuming '%s'",
106 methods
[ipset
->method
]);
113 //typelist |= ipset->method;
115 for (i
= 0; i
< ARRAY_SIZE(ipset_types
); i
++)
117 if (ipset_types
[i
].method
== ipset
->method
&&
118 ipset_types
[i
].types
== typelist
)
120 if (!ipset
->external
|| !*ipset
->external
)
122 if ((ipset_types
[i
].required
& FW3_IPSET_OPT_IPRANGE
) &&
123 list_empty(&ipset
->iprange
))
125 warn_elem(e
, "requires an ip range");
129 if ((ipset_types
[i
].required
& FW3_IPSET_OPT_PORTRANGE
) &&
130 !ipset
->portrange
.set
)
132 warn_elem(e
, "requires a port range");
136 if (!(ipset_types
[i
].required
& FW3_IPSET_OPT_IPRANGE
) &&
137 !list_empty(&ipset
->iprange
))
139 warn_elem(e
, "iprange ignored");
140 fw3_free_list(&ipset
->iprange
);
143 if (!(ipset_types
[i
].required
& FW3_IPSET_OPT_PORTRANGE
) &&
144 ipset
->portrange
.set
)
146 warn_elem(e
, "portrange ignored");
147 memset(&ipset
->portrange
, 0, sizeof(ipset
->portrange
));
150 if (!(ipset_types
[i
].optional
& FW3_IPSET_OPT_NETMASK
) &&
153 warn_elem(e
, "netmask ignored");
157 if (!(ipset_types
[i
].optional
& FW3_IPSET_OPT_HASHSIZE
) &&
160 warn_elem(e
, "hashsize ignored");
164 if (!(ipset_types
[i
].optional
& FW3_IPSET_OPT_MAXELEM
) &&
167 warn_elem(e
, "maxelem ignored");
171 if (!(ipset_types
[i
].optional
& FW3_IPSET_OPT_FAMILY
) &&
172 ipset
->family
!= FW3_FAMILY_ANY
)
174 warn_elem(e
, "family ignored");
175 ipset
->family
= FW3_FAMILY_ANY
;
183 warn_elem(e
, "has an invalid combination of storage method and matches");
188 fw3_load_ipsets(struct fw3_state
*state
, struct uci_package
*p
)
190 struct uci_section
*s
;
191 struct uci_element
*e
;
192 struct fw3_ipset
*ipset
;
194 INIT_LIST_HEAD(&state
->ipsets
);
196 if (state
->disable_ipsets
)
199 uci_foreach_element(&p
->sections
, e
)
201 s
= uci_to_section(e
);
203 if (strcmp(s
->type
, "ipset"))
206 ipset
= malloc(sizeof(*ipset
));
211 memset(ipset
, 0, sizeof(*ipset
));
213 INIT_LIST_HEAD(&ipset
->datatypes
);
214 INIT_LIST_HEAD(&ipset
->iprange
);
216 fw3_parse_options(ipset
, ipset_opts
, ARRAY_SIZE(ipset_opts
), s
);
218 if (!ipset
->name
|| !*ipset
->name
)
220 warn_elem(e
, "must have a name assigned");
222 //else if (fw3_lookup_ipset(state, ipset->name) != NULL)
224 // warn_elem(e, "has duplicated set name '%s'", ipset->name);
226 else if (list_empty(&ipset
->datatypes
))
228 warn_elem(e
, "has no datatypes assigned");
230 else if (check_types(e
, ipset
))
232 list_add_tail(&ipset
->list
, &state
->ipsets
);
236 fw3_free_ipset(ipset
);
242 create_ipset(struct fw3_ipset
*ipset
)
245 char s
[INET6_ADDRSTRLEN
];
247 struct fw3_ipset_datatype
*type
;
248 struct fw3_address
*a1
, *a2
;
250 const char *methods
[] = {
257 const char *types
[] = {
266 const char *families
[] = {
272 if (ipset
->external
&& *ipset
->external
)
275 info(" * %s", ipset
->name
);
278 fw3_pr("create %s %s", ipset
->name
, methods
[ipset
->method
]);
280 list_for_each_entry(type
, &ipset
->datatypes
, list
)
282 fw3_pr("%c%s", first
? ':' : ',', types
[type
->type
]);
286 if (!list_empty(&ipset
->iprange
))
288 a1
= list_first_entry(&ipset
->iprange
, struct fw3_address
, list
);
289 a2
= list_last_entry(&ipset
->iprange
, struct fw3_address
, list
);
293 inet_ntop(a1
->family
== FW3_FAMILY_V4
? AF_INET
: AF_INET6
,
294 &a1
->address
.v6
, s
, sizeof(s
));
296 fw3_pr(" range %s/%u", s
, a1
->mask
);
298 else if (a1
->family
== a2
->family
&&
299 fw3_is_family(ipset
, a1
->family
) &&
300 fw3_is_family(ipset
, a2
->family
))
302 inet_ntop(a1
->family
== FW3_FAMILY_V4
? AF_INET
: AF_INET6
,
303 &a1
->address
.v6
, s
, sizeof(s
));
305 fw3_pr(" range %s", s
);
307 inet_ntop(a2
->family
== FW3_FAMILY_V4
? AF_INET
: AF_INET6
,
308 &a2
->address
.v6
, s
, sizeof(s
));
313 else if (ipset
->portrange
.set
)
315 fw3_pr(" range %u-%u",
316 ipset
->portrange
.port_min
, ipset
->portrange
.port_max
);
319 if (ipset
->family
!= FW3_FAMILY_ANY
)
320 fw3_pr(" family %s", families
[ipset
->family
]);
322 if (ipset
->timeout
> 0)
323 fw3_pr(" timeout %u", ipset
->timeout
);
325 if (ipset
->maxelem
> 0)
326 fw3_pr(" maxelem %u", ipset
->maxelem
);
328 if (ipset
->netmask
> 0)
329 fw3_pr(" netmask %u", ipset
->netmask
);
331 if (ipset
->hashsize
> 0)
332 fw3_pr(" hashsize %u", ipset
->hashsize
);
338 fw3_create_ipsets(struct fw3_state
*state
)
340 struct fw3_ipset
*ipset
;
342 if (state
->disable_ipsets
)
345 info("Initializing ipsets ...");
347 list_for_each_entry(ipset
, &state
->ipsets
, list
)
354 fw3_destroy_ipsets(struct list_head
*statefile
)
356 struct fw3_statefile_entry
*e
;
360 info("Destroying ipsets ...");
362 list_for_each_entry(e
, statefile
, list
)
364 if (e
->type
!= FW3_TYPE_IPSET
)
367 info(" * %s", e
->name
);
369 fw3_pr("flush %s\n", e
->name
);
370 fw3_pr("destroy %s\n", e
->name
);
376 fw3_free_ipset(struct fw3_ipset
*ipset
)
378 fw3_free_list(&ipset
->datatypes
);
379 fw3_free_list(&ipset
->iprange
);
385 fw3_lookup_ipset(struct fw3_state
*state
, const char *name
)
387 struct fw3_ipset
*ipset
;
389 if (list_empty(&state
->ipsets
))
392 list_for_each_entry(ipset
, &state
->ipsets
, list
)
393 if (!strcmp(ipset
->name
, name
))