2 * firewall3 - 3rd OpenWrt UCI firewall implementation
4 * Copyright (C) 2013 Jo-Philipp Wich <jo@mein.io>
6 * Permission to use, copy, modify, and/or distribute this software for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
21 static struct blob_attr
*interfaces
= NULL
;
22 static struct blob_attr
*procd_data
;
25 static void dump_cb(struct ubus_request
*req
, int type
, struct blob_attr
*msg
)
27 static const struct blobmsg_policy policy
= { "interface", BLOBMSG_TYPE_ARRAY
};
28 struct blob_attr
*cur
;
30 blobmsg_parse(&policy
, 1, &cur
, blob_data(msg
), blob_len(msg
));
32 interfaces
= blob_memdup(cur
);
35 static void procd_data_cb(struct ubus_request
*req
, int type
, struct blob_attr
*msg
)
37 procd_data
= blob_memdup(msg
);
41 fw3_ubus_connect(void)
45 struct ubus_context
*ctx
= ubus_connect(NULL
);
46 struct blob_buf b
= { };
53 if (ubus_lookup_id(ctx
, "network.interface", &id
))
56 if (ubus_invoke(ctx
, id
, "dump", b
.head
, dump_cb
, NULL
, 2000))
61 if (ubus_lookup_id(ctx
, "service", &id
))
64 blobmsg_add_string(&b
, "type", "firewall");
65 ubus_invoke(ctx
, id
, "get_data", b
.head
, procd_data_cb
, NULL
, 2000);
77 fw3_ubus_disconnect(void)
83 static struct fw3_address
*
84 parse_subnet(enum fw3_family family
, struct blob_attr
*dict
, int rem
)
86 struct blob_attr
*cur
;
87 struct fw3_address
*addr
;
89 addr
= calloc(1, sizeof(*addr
));
94 addr
->family
= family
;
96 __blob_for_each_attr(cur
, dict
, rem
)
98 if (!strcmp(blobmsg_name(cur
), "address"))
99 inet_pton(family
== FW3_FAMILY_V4
? AF_INET
: AF_INET6
,
100 blobmsg_get_string(cur
), &addr
->address
.v6
);
102 else if (!strcmp(blobmsg_name(cur
), "mask"))
103 fw3_bitlen2netmask(family
, blobmsg_get_u32(cur
), &addr
->mask
.v6
);
110 parse_subnets(struct list_head
*head
, enum fw3_family family
,
111 struct blob_attr
*list
)
113 struct blob_attr
*cur
;
114 struct fw3_address
*addr
;
120 rem
= blobmsg_data_len(list
);
122 __blob_for_each_attr(cur
, blobmsg_data(list
), rem
)
124 addr
= parse_subnet(family
, blobmsg_data(cur
), blobmsg_data_len(cur
));
128 list_add_tail(&addr
->list
, head
);
137 fw3_ubus_device(const char *net
)
145 static const struct blobmsg_policy policy
[__DEV_MAX
] = {
146 [DEV_INTERFACE
] = { "interface", BLOBMSG_TYPE_STRING
},
147 [DEV_DEVICE
] = { "device", BLOBMSG_TYPE_STRING
},
148 [DEV_L3_DEVICE
] = { "l3_device", BLOBMSG_TYPE_STRING
},
150 struct fw3_device
*dev
= NULL
;
151 struct blob_attr
*tb
[__DEV_MAX
];
152 struct blob_attr
*cur
;
156 if (!net
|| !interfaces
)
159 blobmsg_for_each_attr(cur
, interfaces
, rem
) {
160 blobmsg_parse(policy
, __DEV_MAX
, tb
, blobmsg_data(cur
), blobmsg_len(cur
));
161 if (!tb
[DEV_INTERFACE
] ||
162 strcmp(blobmsg_data(tb
[DEV_INTERFACE
]), net
) != 0)
165 if (tb
[DEV_L3_DEVICE
])
166 name
= blobmsg_data(tb
[DEV_L3_DEVICE
]);
167 else if (tb
[DEV_DEVICE
])
168 name
= blobmsg_data(tb
[DEV_DEVICE
]);
178 dev
= calloc(1, sizeof(*dev
));
183 snprintf(dev
->name
, sizeof(dev
->name
), "%s", name
);
190 fw3_ubus_address(struct list_head
*list
, const char *net
)
199 static const struct blobmsg_policy policy
[__ADDR_MAX
] = {
200 [ADDR_INTERFACE
] = { "interface", BLOBMSG_TYPE_STRING
},
201 [ADDR_IPV4
] = { "ipv4-address", BLOBMSG_TYPE_ARRAY
},
202 [ADDR_IPV6
] = { "ipv6-address", BLOBMSG_TYPE_ARRAY
},
203 [ADDR_IPV6_PREFIX
] = { "ipv6-prefix-assignment", BLOBMSG_TYPE_ARRAY
},
205 struct blob_attr
*tb
[__ADDR_MAX
];
206 struct blob_attr
*cur
;
209 if (!net
|| !interfaces
)
212 blobmsg_for_each_attr(cur
, interfaces
, rem
) {
213 blobmsg_parse(policy
, __ADDR_MAX
, tb
, blobmsg_data(cur
), blobmsg_len(cur
));
215 if (!tb
[ADDR_INTERFACE
] ||
216 strcmp(blobmsg_data(tb
[ADDR_INTERFACE
]), net
) != 0)
219 n
+= parse_subnets(list
, FW3_FAMILY_V4
, tb
[ADDR_IPV4
]);
220 n
+= parse_subnets(list
, FW3_FAMILY_V6
, tb
[ADDR_IPV6
]);
221 n
+= parse_subnets(list
, FW3_FAMILY_V6
, tb
[ADDR_IPV6_PREFIX
]);
228 fw3_ubus_zone_devices(struct fw3_zone
*zone
)
230 struct blob_attr
*c
, *cur
, *dcur
;
231 unsigned r
, rem
, drem
;
235 blobmsg_for_each_attr(c
, interfaces
, r
) {
239 blobmsg_for_each_attr(cur
, c
, rem
) {
240 if (!strcmp(blobmsg_name(cur
), "interface"))
241 name
= blobmsg_get_string(cur
);
242 else if (!strcmp(blobmsg_name(cur
), "data"))
243 blobmsg_for_each_attr(dcur
, cur
, drem
)
244 if (!strcmp(blobmsg_name(dcur
), "zone"))
245 matches
= !strcmp(blobmsg_get_string(dcur
), zone
->name
);
249 fw3_parse_device(&zone
->networks
, name
, true);
253 static void fw3_ubus_rules_add(struct blob_buf
*b
, const char *service
,
254 const char *instance
, const char *device
,
255 const struct blob_attr
*rule
, unsigned n
)
257 void *k
= blobmsg_open_table(b
, "");
258 struct blob_attr
*ropt
;
263 blobmsg_for_each_attr(ropt
, rule
, orem
) {
264 if (!strcmp(blobmsg_name(ropt
), "type"))
265 type
= blobmsg_data(ropt
);
266 if (device
&& !strcmp(blobmsg_name(ropt
), "device"))
267 device
= blobmsg_get_string(ropt
);
268 else if (strcmp(blobmsg_name(ropt
), "name"))
269 blobmsg_add_blob(b
, ropt
);
273 snprintf(comment
, sizeof(comment
), "ubus:%s[%s] %s %d",
274 service
, instance
, type
? type
: "rule", n
);
276 snprintf(comment
, sizeof(comment
), "ubus:%s %s %d",
277 service
, type
? type
: "rule", n
);
279 blobmsg_add_string(b
, "name", comment
);
282 blobmsg_add_string(b
, "device", device
);
284 blobmsg_close_table(b
, k
);
288 fw3_ubus_rules(struct blob_buf
*b
)
292 struct blob_attr
*c
, *cur
, *dcur
, *rule
;
293 unsigned n
, r
, rem
, drem
, rrem
;
295 blobmsg_for_each_attr(c
, interfaces
, r
) {
296 const char *l3_device
= NULL
;
297 const char *iface_proto
= "unknown";
298 const char *iface_name
= "unknown";
299 struct blob_attr
*data
= NULL
;
301 blobmsg_for_each_attr(cur
, c
, rem
) {
302 if (!strcmp(blobmsg_name(cur
), "l3_device"))
303 l3_device
= blobmsg_get_string(cur
);
304 else if (!strcmp(blobmsg_name(cur
), "interface"))
305 iface_name
= blobmsg_get_string(cur
);
306 else if (!strcmp(blobmsg_name(cur
), "proto"))
307 iface_proto
= blobmsg_get_string(cur
);
308 else if (!strcmp(blobmsg_name(cur
), "data"))
312 if (!data
|| !l3_device
)
315 blobmsg_for_each_attr(dcur
, data
, drem
) {
316 if (strcmp(blobmsg_name(dcur
), "firewall"))
321 blobmsg_for_each_attr(rule
, dcur
, rrem
)
322 fw3_ubus_rules_add(b
, iface_name
, iface_proto
,
323 l3_device
, rule
, n
++);
331 blobmsg_for_each_attr(c
, procd_data
, r
) {
332 if (!blobmsg_check_attr(c
, true))
336 blobmsg_for_each_attr(cur
, c
, rem
) {
337 if (!blobmsg_check_attr(cur
, true))
340 /* fw rules within the service itself */
341 if (!strcmp(blobmsg_name(cur
), "firewall")) {
344 blobmsg_for_each_attr(rule
, cur
, rrem
)
345 fw3_ubus_rules_add(b
, blobmsg_name(c
),
346 NULL
, NULL
, rule
, n
++);
352 blobmsg_for_each_attr(dcur
, cur
, drem
) {
353 if (!blobmsg_check_attr(dcur
, true))
356 if (strcmp(blobmsg_name(dcur
), "firewall"))
361 blobmsg_for_each_attr(rule
, dcur
, rrem
)
362 fw3_ubus_rules_add(b
, blobmsg_name(c
),
363 blobmsg_name(cur
), NULL
, rule
, n
++);