forwards.c

   1 /*
   2  * firewall3 - 3rd OpenWrt UCI firewall implementation
   3  *
   4  *   Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
   5  *
   6  * Permission to use, copy, modify, and/or distribute this software for any
   7  * purpose with or without fee is hereby granted, provided that the above
   8  * copyright notice and this permission notice appear in all copies.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17  */
  18
  19 #include "forwards.h"
  20
  21
  22 const struct fw3_option fw3_forward_opts[] = {
  23         FW3_OPT("name",                string,   forward,     name),
  24         FW3_OPT("family",              family,   forward,     family),
  25
  26         FW3_OPT("src",                 device,   forward,     src),
  27         FW3_OPT("dest",                device,   forward,     dest),
  28
  29         { }
  30 };
  31
  32
  33 void
  34 fw3_load_forwards(struct fw3_state *state, struct uci_package *p)
  35 {
  36         struct uci_section *s;
  37         struct uci_element *e;
  38         struct fw3_forward *forward;
  39
  40         INIT_LIST_HEAD(&state->forwards);
  41
  42         uci_foreach_element(&p->sections, e)
  43         {
  44                 s = uci_to_section(e);
  45
  46                 if (strcmp(s->type, "forwarding"))
  47                         continue;
  48
  49                 forward = malloc(sizeof(*forward));
  50
  51                 if (!forward)
  52                         continue;
  53
  54                 memset(forward, 0, sizeof(*forward));
  55
  56                 fw3_parse_options(forward, fw3_forward_opts, s);
  57
  58                 if (forward->src.invert || forward->dest.invert)
  59                 {
  60                         warn_elem(e, "must not have inverted 'src' or 'dest' options");
  61                         fw3_free_forward(forward);
  62                         continue;
  63                 }
  64                 else if (forward->src.set && !forward->src.any &&
  65                          !(forward->_src = fw3_lookup_zone(state, forward->src.name, false)))
  66                 {
  67                         warn_elem(e, "refers to not existing zone '%s'", forward->src.name);
  68                         fw3_free_forward(forward);
  69                         continue;
  70                 }
  71                 else if (forward->dest.set && !forward->dest.any &&
  72                          !(forward->_dest = fw3_lookup_zone(state, forward->dest.name, false)))
  73                 {
  74                         warn_elem(e, "refers to not existing zone '%s'", forward->dest.name);
  75                         fw3_free_forward(forward);
  76                         continue;
  77                 }
  78
  79                 if (forward->_dest)
  80                 {
  81                         setbit(forward->_dest->dst_flags, FW3_TARGET_ACCEPT);
  82
  83                         if (forward->_src &&
  84                             (forward->_src->conntrack || forward->_dest->conntrack))
  85                         {
  86                                 forward->_src->conntrack = forward->_dest->conntrack = true;
  87                         }
  88                 }
  89
  90                 list_add_tail(&forward->list, &state->forwards);
  91                 continue;
  92         }
  93 }
  94
  95
  96 static void
  97 print_chain(struct fw3_forward *forward)
  98 {
  99         if (forward->src.any || !forward->src.set)
 100                 fw3_pr("-A delegate_forward");
 101         else
 102                 fw3_pr("-A zone_%s_forward", forward->src.name);
 103 }
 104
 105 static void print_target(struct fw3_forward *forward)
 106 {
 107         if (forward->dest.any || !forward->dest.set)
 108                 fw3_pr(" -j ACCEPT\n");
 109         else
 110                 fw3_pr(" -j zone_%s_dest_ACCEPT\n", forward->dest.name);
 111 }
 112
 113 static void
 114 print_forward(enum fw3_table table, enum fw3_family family,
 115               struct fw3_forward *forward)
 116 {
 117         const char *s, *d;
 118
 119         if (table != FW3_TABLE_FILTER)
 120                 return;
 121
 122         if (!fw3_is_family(forward, family))
 123                 return;
 124
 125         s = forward->_src  ? forward->_src->name  : "*";
 126         d = forward->_dest ? forward->_dest->name : "*";
 127
 128         info("   * Forward '%s' -> '%s'", s, d);
 129
 130         if (!fw3_is_family(forward->_src, family) ||
 131             !fw3_is_family(forward->_dest, family))
 132         {
 133                 info("     ! Skipping due to different family of zone");
 134                 return;
 135         }
 136
 137         print_chain(forward);
 138         fw3_format_comment("forwarding ", s, "->", d);
 139         print_target(forward);
 140 }
 141
 142 void
 143 fw3_print_forwards(enum fw3_table table, enum fw3_family family,
 144                    struct fw3_state *state)
 145 {
 146         struct fw3_forward *forward;
 147
 148         list_for_each_entry(forward, &state->forwards, list)
 149                 print_forward(table, family, forward);
 150 }