zones.c

   1 /*
   2  * firewall3 - 3rd OpenWrt UCI firewall implementation
   3  *
   4  *   Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
   5  *
   6  * Permission to use, copy, modify, and/or distribute this software for any
   7  * purpose with or without fee is hereby granted, provided that the above
   8  * copyright notice and this permission notice appear in all copies.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17  */
  18
  19 #include "zones.h"
  20 #include "ubus.h"
  21
  22
  23 #define C(f, tbl, tgt, fmt) \
  24         { FW3_FAMILY_##f, FW3_TABLE_##tbl, FW3_FLAG_##tgt, fmt }
  25
  26 static const struct fw3_chain_spec zone_chains[] = {
  27         C(ANY, FILTER, UNSPEC,        "zone_%s_input"),
  28         C(ANY, FILTER, UNSPEC,        "zone_%s_output"),
  29         C(ANY, FILTER, UNSPEC,        "zone_%s_forward"),
  30
  31         C(ANY, FILTER, SRC_ACCEPT,    "zone_%s_src_ACCEPT"),
  32         C(ANY, FILTER, SRC_REJECT,    "zone_%s_src_REJECT"),
  33         C(ANY, FILTER, SRC_DROP,      "zone_%s_src_DROP"),
  34
  35         C(ANY, FILTER, ACCEPT,        "zone_%s_dest_ACCEPT"),
  36         C(ANY, FILTER, REJECT,        "zone_%s_dest_REJECT"),
  37         C(ANY, FILTER, DROP,          "zone_%s_dest_DROP"),
  38
  39         C(V4,  NAT,    SNAT,          "zone_%s_postrouting"),
  40         C(V4,  NAT,    DNAT,          "zone_%s_prerouting"),
  41
  42         C(ANY, FILTER, CUSTOM_CHAINS, "input_%s_rule"),
  43         C(ANY, FILTER, CUSTOM_CHAINS, "output_%s_rule"),
  44         C(ANY, FILTER, CUSTOM_CHAINS, "forwarding_%s_rule"),
  45
  46         C(V4,  NAT,    CUSTOM_CHAINS, "prerouting_%s_rule"),
  47         C(V4,  NAT,    CUSTOM_CHAINS, "postrouting_%s_rule"),
  48
  49         { }
  50 };
  51
  52 const struct fw3_option fw3_zone_opts[] = {
  53         FW3_OPT("enabled",             bool,     zone,     enabled),
  54
  55         FW3_OPT("name",                string,   zone,     name),
  56         FW3_OPT("family",              family,   zone,     family),
  57
  58         FW3_LIST("network",            device,   zone,     networks),
  59         FW3_LIST("device",             device,   zone,     devices),
  60         FW3_LIST("subnet",             network,  zone,     subnets),
  61
  62         FW3_OPT("input",               target,   zone,     policy_input),
  63         FW3_OPT("forward",             target,   zone,     policy_forward),
  64         FW3_OPT("output",              target,   zone,     policy_output),
  65
  66         FW3_OPT("masq",                bool,     zone,     masq),
  67         FW3_LIST("masq_src",           network,  zone,     masq_src),
  68         FW3_LIST("masq_dest",          network,  zone,     masq_dest),
  69
  70         FW3_OPT("extra",               string,   zone,     extra_src),
  71         FW3_OPT("extra_src",           string,   zone,     extra_src),
  72         FW3_OPT("extra_dest",          string,   zone,     extra_dest),
  73
  74         FW3_OPT("conntrack",           bool,     zone,     conntrack),
  75         FW3_OPT("mtu_fix",             bool,     zone,     mtu_fix),
  76         FW3_OPT("custom_chains",       bool,     zone,     custom_chains),
  77
  78         FW3_OPT("log",                 bool,     zone,     log),
  79         FW3_OPT("log_limit",           limit,    zone,     log_limit),
  80
  81         FW3_OPT("__flags_v4",          int,      zone,     flags[0]),
  82         FW3_OPT("__flags_v6",          int,      zone,     flags[1]),
  83
  84         { }
  85 };
  86
  87
  88 static void
  89 check_policy(struct uci_element *e, enum fw3_flag *pol, enum fw3_flag def,
  90              const char *name)
  91 {
  92         if (*pol == FW3_FLAG_UNSPEC)
  93         {
  94                 warn_elem(e, "has no %s policy specified, using default", name);
  95                 *pol = def;
  96         }
  97         else if (*pol > FW3_FLAG_DROP)
  98         {
  99                 warn_elem(e, "has invalid %s policy, using default", name);
 100                 *pol = def;
 101         }
 102 }
 103
 104 static void
 105 resolve_networks(struct uci_element *e, struct fw3_zone *zone)
 106 {
 107         struct fw3_device *net, *tmp;
 108
 109         list_for_each_entry(net, &zone->networks, list)
 110         {
 111                 tmp = fw3_ubus_device(net->name);
 112
 113                 if (!tmp)
 114                 {
 115                         warn_elem(e, "cannot resolve device of network '%s'", net->name);
 116                         continue;
 117                 }
 118
 119                 snprintf(tmp->network, sizeof(tmp->network), "%s", net->name);
 120                 list_add_tail(&tmp->list, &zone->devices);
 121         }
 122 }
 123
 124 struct fw3_zone *
 125 fw3_alloc_zone(void)
 126 {
 127         struct fw3_zone *zone;
 128
 129         zone = malloc(sizeof(*zone));
 130
 131         if (!zone)
 132                 return NULL;
 133
 134         memset(zone, 0, sizeof(*zone));
 135
 136         INIT_LIST_HEAD(&zone->networks);
 137         INIT_LIST_HEAD(&zone->devices);
 138         INIT_LIST_HEAD(&zone->subnets);
 139         INIT_LIST_HEAD(&zone->masq_src);
 140         INIT_LIST_HEAD(&zone->masq_dest);
 141
 142         zone->enabled = true;
 143         zone->custom_chains = true;
 144         zone->log_limit.rate = 10;
 145
 146         return zone;
 147 }
 148
 149 void
 150 fw3_load_zones(struct fw3_state *state, struct uci_package *p)
 151 {
 152         struct uci_section *s;
 153         struct uci_element *e;
 154         struct fw3_zone *zone;
 155         struct fw3_defaults *defs = &state->defaults;
 156
 157         INIT_LIST_HEAD(&state->zones);
 158
 159         uci_foreach_element(&p->sections, e)
 160         {
 161                 s = uci_to_section(e);
 162
 163                 if (strcmp(s->type, "zone"))
 164                         continue;
 165
 166                 zone = fw3_alloc_zone();
 167
 168                 if (!zone)
 169                         continue;
 170
 171                 fw3_parse_options(zone, fw3_zone_opts, s);
 172
 173                 if (!zone->enabled)
 174                 {
 175                         fw3_free_zone(zone);
 176                         continue;
 177                 }
 178
 179                 if (!zone->extra_dest)
 180                         zone->extra_dest = zone->extra_src;
 181
 182                 if (!defs->custom_chains && zone->custom_chains)
 183                         zone->custom_chains = false;
 184
 185                 if (!zone->name || !*zone->name)
 186                 {
 187                         warn_elem(e, "has no name - ignoring");
 188                         fw3_free_zone(zone);
 189                         continue;
 190                 }
 191
 192                 if (list_empty(&zone->networks) && list_empty(&zone->devices) &&
 193                     list_empty(&zone->subnets) && !zone->extra_src)
 194                 {
 195                         warn_elem(e, "has no device, network, subnet or extra options");
 196                 }
 197
 198                 check_policy(e, &zone->policy_input, defs->policy_input, "input");
 199                 check_policy(e, &zone->policy_output, defs->policy_output, "output");
 200                 check_policy(e, &zone->policy_forward, defs->policy_forward, "forward");
 201
 202                 resolve_networks(e, zone);
 203
 204                 if (zone->masq)
 205                 {
 206                         setbit(zone->flags[0], FW3_FLAG_SNAT);
 207                         zone->conntrack = true;
 208                 }
 209
 210                 if (zone->custom_chains)
 211                 {
 212                         setbit(zone->flags[0], FW3_FLAG_SNAT);
 213                         setbit(zone->flags[0], FW3_FLAG_DNAT);
 214                 }
 215
 216                 setbit(zone->flags[0], fw3_to_src_target(zone->policy_input));
 217                 setbit(zone->flags[0], zone->policy_output);
 218                 setbit(zone->flags[0], zone->policy_forward);
 219
 220                 setbit(zone->flags[1], fw3_to_src_target(zone->policy_input));
 221                 setbit(zone->flags[1], zone->policy_output);
 222                 setbit(zone->flags[1], zone->policy_forward);
 223
 224                 list_add_tail(&zone->list, &state->zones);
 225         }
 226 }
 227
 228
 229 static void
 230 print_zone_chain(struct fw3_ipt_handle *handle, struct fw3_state *state,
 231                  bool reload, struct fw3_zone *zone)
 232 {
 233         int i;
 234         struct fw3_ipt_rule *r;
 235         const struct fw3_chain_spec *c;
 236
 237         const char *flt_chains[] = {
 238                 "input",   "input",
 239                 "output",  "output",
 240                 "forward", "forwarding",
 241         };
 242
 243         const char *nat_chains[] = {
 244                 "prerouting",  "prerouting",
 245                 "postrouting", "postrouting",
 246         };
 247
 248         if (!fw3_is_family(zone, handle->family))
 249                 return;
 250
 251         info("   * Zone '%s'", zone->name);
 252
 253         set(zone->flags, handle->family, handle->table);
 254
 255         if (zone->custom_chains)
 256                 set(zone->flags, handle->family, FW3_FLAG_CUSTOM_CHAINS);
 257
 258         if (!zone->conntrack && !state->defaults.drop_invalid)
 259                 set(zone->flags, handle->family, FW3_FLAG_NOTRACK);
 260
 261         for (c = zone_chains; c->format; c++)
 262         {
 263                 /* don't touch user chains on selective stop */
 264                 if (reload && c->flag == FW3_FLAG_CUSTOM_CHAINS)
 265                         continue;
 266
 267                 if (!fw3_is_family(c, handle->family))
 268                         continue;
 269
 270                 if (c->table != handle->table)
 271                         continue;
 272
 273                 if (c->flag &&
 274                     !hasbit(zone->flags[handle->family == FW3_FAMILY_V6], c->flag))
 275                         continue;
 276
 277                 fw3_ipt_create_chain(handle, c->format, zone->name);
 278         }
 279
 280         if (zone->custom_chains)
 281         {
 282                 if (handle->table == FW3_TABLE_FILTER)
 283                 {
 284                         for (i = 0; i < sizeof(flt_chains)/sizeof(flt_chains[0]); i += 2)
 285                         {
 286                                 r = fw3_ipt_rule_new(handle);
 287                                 fw3_ipt_rule_comment(r, "user chain for %s", flt_chains[i+1]);
 288                                 fw3_ipt_rule_target(r, "%s_%s_rule", flt_chains[i+1], zone->name);
 289                                 fw3_ipt_rule_append(r, "zone_%s_%s", zone->name, flt_chains[i]);
 290                         }
 291                 }
 292                 else if (handle->table == FW3_TABLE_NAT)
 293                 {
 294                         for (i = 0; i < sizeof(nat_chains)/sizeof(nat_chains[0]); i += 2)
 295                         {
 296                                 r = fw3_ipt_rule_new(handle);
 297                                 fw3_ipt_rule_comment(r, "user chain for %s", nat_chains[i+1]);
 298                                 fw3_ipt_rule_target(r, "%s_%s_rule", nat_chains[i+1], zone->name);
 299                                 fw3_ipt_rule_append(r, "zone_%s_%s", zone->name, nat_chains[i]);
 300                         }
 301                 }
 302         }
 303
 304         set(zone->flags, handle->family, handle->table);
 305 }
 306
 307 static void
 308 print_interface_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
 309                                          bool reload, struct fw3_zone *zone,
 310                      struct fw3_device *dev, struct fw3_address *sub)
 311 {
 312         bool disable_notrack = state->defaults.drop_invalid;
 313         struct fw3_protocol tcp = { .protocol = 6 };
 314         struct fw3_ipt_rule *r;
 315         enum fw3_flag t;
 316
 317         char buf[32];
 318
 319         int i;
 320
 321         const char *chains[] = {
 322                 "input",
 323                 "output",
 324                 "forward",
 325         };
 326
 327 #define jump_target(t) \
 328         ((t == FW3_FLAG_REJECT) ? "reject" : fw3_flag_names[t])
 329
 330         if (handle->table == FW3_TABLE_FILTER)
 331         {
 332                 for (t = FW3_FLAG_ACCEPT; t <= FW3_FLAG_DROP; t++)
 333                 {
 334                         if (has(zone->flags, handle->family, fw3_to_src_target(t)))
 335                         {
 336                                 r = fw3_ipt_rule_create(handle, NULL, dev, NULL, sub, NULL);
 337                                 fw3_ipt_rule_target(r, jump_target(t));
 338                                 fw3_ipt_rule_extra(r, zone->extra_src);
 339                                 fw3_ipt_rule_append(r, "zone_%s_src_%s", zone->name,
 340                                                     fw3_flag_names[t]);
 341                         }
 342
 343                         if (has(zone->flags, handle->family, t))
 344                         {
 345                                 r = fw3_ipt_rule_create(handle, NULL, NULL, dev, NULL, sub);
 346                                 fw3_ipt_rule_target(r, jump_target(t));
 347                                 fw3_ipt_rule_extra(r, zone->extra_dest);
 348                                 fw3_ipt_rule_append(r, "zone_%s_dest_%s", zone->name,
 349                                                     fw3_flag_names[t]);
 350                         }
 351                 }
 352
 353                 for (i = 0; i < sizeof(chains)/sizeof(chains[0]); i++)
 354                 {
 355                         if (*chains[i] == 'o')
 356                                 r = fw3_ipt_rule_create(handle, NULL, NULL, dev, NULL, sub);
 357                         else
 358                                 r = fw3_ipt_rule_create(handle, NULL, dev, NULL, sub, NULL);
 359
 360                         fw3_ipt_rule_target(r, "zone_%s_%s", zone->name, chains[i]);
 361
 362                         if (*chains[i] == 'o')
 363                                 fw3_ipt_rule_extra(r, zone->extra_dest);
 364                         else
 365                                 fw3_ipt_rule_extra(r, zone->extra_src);
 366
 367                         fw3_ipt_rule_append(r, "delegate_%s", chains[i]);
 368                 }
 369         }
 370         else if (handle->table == FW3_TABLE_NAT)
 371         {
 372                 if (has(zone->flags, handle->family, FW3_FLAG_DNAT))
 373                 {
 374                         r = fw3_ipt_rule_create(handle, NULL, dev, NULL, sub, NULL);
 375                         fw3_ipt_rule_target(r, "zone_%s_prerouting", zone->name);
 376                         fw3_ipt_rule_extra(r, zone->extra_src);
 377                         fw3_ipt_rule_append(r, "delegate_prerouting");
 378                 }
 379
 380                 if (has(zone->flags, handle->family, FW3_FLAG_SNAT))
 381                 {
 382                         r = fw3_ipt_rule_create(handle, NULL, NULL, dev, NULL, sub);
 383                         fw3_ipt_rule_target(r, "zone_%s_postrouting", zone->name);
 384                         fw3_ipt_rule_extra(r, zone->extra_dest);
 385                         fw3_ipt_rule_append(r, "delegate_postrouting");
 386                 }
 387         }
 388         else if (handle->table == FW3_TABLE_MANGLE)
 389         {
 390                 if (zone->mtu_fix)
 391                 {
 392                         if (zone->log)
 393                         {
 394                                 snprintf(buf, sizeof(buf) - 1, "MSSFIX(%s): ", zone->name);
 395
 396                                 r = fw3_ipt_rule_create(handle, &tcp, NULL, dev, NULL, sub);
 397                                 fw3_ipt_rule_addarg(r, false, "--tcp-flags", "SYN,RST");
 398                                 fw3_ipt_rule_addarg(r, false, "SYN", NULL);
 399                                 fw3_ipt_rule_limit(r, &zone->log_limit);
 400                                 fw3_ipt_rule_comment(r, "%s (mtu_fix logging)", zone->name);
 401                                 fw3_ipt_rule_target(r, "LOG");
 402                                 fw3_ipt_rule_addarg(r, false, "--log-prefix", buf);
 403                                 fw3_ipt_rule_append(r, "mssfix");
 404                         }
 405
 406                         r = fw3_ipt_rule_create(handle, &tcp, NULL, dev, NULL, sub);
 407                         fw3_ipt_rule_addarg(r, false, "--tcp-flags", "SYN,RST");
 408                         fw3_ipt_rule_addarg(r, false, "SYN", NULL);
 409                         fw3_ipt_rule_comment(r, "%s (mtu_fix)", zone->name);
 410                         fw3_ipt_rule_target(r, "TCPMSS");
 411                         fw3_ipt_rule_addarg(r, false, "--clamp-mss-to-pmtu", NULL);
 412                         fw3_ipt_rule_append(r, "mssfix");
 413                 }
 414         }
 415         else if (handle->table == FW3_TABLE_RAW)
 416         {
 417                 if (!zone->conntrack && !disable_notrack)
 418                 {
 419                         r = fw3_ipt_rule_create(handle, NULL, dev, NULL, sub, NULL);
 420                         fw3_ipt_rule_target(r, "CT");
 421                         fw3_ipt_rule_addarg(r, false, "--notrack", NULL);
 422                         fw3_ipt_rule_extra(r, zone->extra_src);
 423                         fw3_ipt_rule_append(r, "notrack");
 424                 }
 425         }
 426 }
 427
 428 static void
 429 print_interface_rules(struct fw3_ipt_handle *handle, struct fw3_state *state,
 430                       bool reload, struct fw3_zone *zone)
 431 {
 432         struct fw3_device *dev;
 433         struct fw3_address *sub;
 434
 435         fw3_foreach(dev, &zone->devices)
 436         fw3_foreach(sub, &zone->subnets)
 437         {
 438                 if (!fw3_is_family(sub, handle->family))
 439                         continue;
 440
 441                 if (!dev && !sub)
 442                         continue;
 443
 444                 print_interface_rule(handle, state, reload, zone, dev, sub);
 445         }
 446 }
 447
 448 static void
 449 print_zone_rule(struct fw3_ipt_handle *handle, struct fw3_state *state,
 450                 bool reload, struct fw3_zone *zone)
 451 {
 452         struct fw3_address *msrc;
 453         struct fw3_address *mdest;
 454         struct fw3_ipt_rule *r;
 455
 456         enum fw3_flag t;
 457         char buf[32];
 458
 459         if (!fw3_is_family(zone, handle->family))
 460                 return;
 461
 462         switch (handle->table)
 463         {
 464         case FW3_TABLE_FILTER:
 465                 r = fw3_ipt_rule_new(handle);
 466                 fw3_ipt_rule_target(r, "zone_%s_src_%s", zone->name,
 467                                      fw3_flag_names[zone->policy_input]);
 468                 fw3_ipt_rule_append(r, "zone_%s_input", zone->name);
 469
 470                 r = fw3_ipt_rule_new(handle);
 471                 fw3_ipt_rule_target(r, "zone_%s_dest_%s", zone->name,
 472                                      fw3_flag_names[zone->policy_forward]);
 473                 fw3_ipt_rule_append(r, "zone_%s_forward", zone->name);
 474
 475                 r = fw3_ipt_rule_new(handle);
 476                 fw3_ipt_rule_target(r, "zone_%s_dest_%s", zone->name,
 477                                      fw3_flag_names[zone->policy_output]);
 478                 fw3_ipt_rule_append(r, "zone_%s_output", zone->name);
 479
 480                 if (zone->log)
 481                 {
 482                         for (t = FW3_FLAG_REJECT; t <= FW3_FLAG_DROP; t++)
 483                         {
 484                                 if (has(zone->flags, handle->family, fw3_to_src_target(t)))
 485                                 {
 486                                         r = fw3_ipt_rule_new(handle);
 487
 488                                         snprintf(buf, sizeof(buf) - 1, "%s(src %s)",
 489                                                  fw3_flag_names[t], zone->name);
 490
 491                                         fw3_ipt_rule_limit(r, &zone->log_limit);
 492                                         fw3_ipt_rule_target(r, "LOG");
 493                                         fw3_ipt_rule_addarg(r, false, "--log-prefix", buf);
 494                                         fw3_ipt_rule_append(r, "zone_%s_src_%s",
 495                                                             zone->name, fw3_flag_names[t]);
 496                                 }
 497
 498                                 if (has(zone->flags, handle->family, t))
 499                                 {
 500                                         r = fw3_ipt_rule_new(handle);
 501
 502                                         snprintf(buf, sizeof(buf) - 1, "%s(dest %s)",
 503                                                  fw3_flag_names[t], zone->name);
 504
 505                                         fw3_ipt_rule_limit(r, &zone->log_limit);
 506                                         fw3_ipt_rule_target(r, "LOG");
 507                                         fw3_ipt_rule_addarg(r, false, "--log-prefix", buf);
 508                                         fw3_ipt_rule_append(r, "zone_%s_dest_%s",
 509                                                             zone->name, fw3_flag_names[t]);
 510                                 }
 511                         }
 512                 }
 513                 break;
 514
 515         case FW3_TABLE_NAT:
 516                 if (zone->masq && handle->family == FW3_FAMILY_V4)
 517                 {
 518                         fw3_foreach(msrc, &zone->masq_src)
 519                         fw3_foreach(mdest, &zone->masq_dest)
 520                         {
 521                                 if (!fw3_is_family(msrc, handle->family) ||
 522                                     !fw3_is_family(mdest, handle->family))
 523                                         continue;
 524
 525                                 r = fw3_ipt_rule_new(handle);
 526                                 fw3_ipt_rule_src_dest(r, msrc, mdest);
 527                                 fw3_ipt_rule_target(r, "MASQUERADE");
 528                                 fw3_ipt_rule_append(r, "zone_%s_postrouting", zone->name);
 529                         }
 530                 }
 531                 break;
 532
 533         case FW3_TABLE_RAW:
 534         case FW3_TABLE_MANGLE:
 535                 break;
 536         }
 537
 538         print_interface_rules(handle, state, reload, zone);
 539 }
 540
 541 void
 542 fw3_print_zone_chains(struct fw3_ipt_handle *handle, struct fw3_state *state,
 543                       bool reload)
 544 {
 545         struct fw3_zone *zone;
 546
 547         list_for_each_entry(zone, &state->zones, list)
 548                 print_zone_chain(handle, state, reload, zone);
 549 }
 550
 551 void
 552 fw3_print_zone_rules(struct fw3_ipt_handle *handle, struct fw3_state *state,
 553                      bool reload)
 554 {
 555         struct fw3_zone *zone;
 556
 557         list_for_each_entry(zone, &state->zones, list)
 558                 print_zone_rule(handle, state, reload, zone);
 559 }
 560
 561 void
 562 fw3_flush_zones(struct fw3_ipt_handle *handle, struct fw3_state *state,
 563                 bool reload)
 564 {
 565         struct fw3_zone *z, *tmp;
 566         const struct fw3_chain_spec *c;
 567         char chain[32];
 568
 569         list_for_each_entry_safe(z, tmp, &state->zones, list)
 570         {
 571                 if (!has(z->flags, handle->family, handle->table))
 572                         continue;
 573
 574                 for (c = zone_chains; c->format; c++)
 575                 {
 576                         /* don't touch user chains on selective stop */
 577                         if (reload && hasbit(c->flag, FW3_FLAG_CUSTOM_CHAINS))
 578                                 continue;
 579
 580                         if (!fw3_is_family(c, handle->family))
 581                                 continue;
 582
 583                         if (c->table != handle->table)
 584                                 continue;
 585
 586                         snprintf(chain, sizeof(chain), c->format, z->name);
 587                         fw3_ipt_delete_rules(handle, chain);
 588                         fw3_ipt_delete_chain(handle, chain);
 589                 }
 590
 591                 del(z->flags, handle->family, handle->table);
 592         }
 593 }
 594
 595 void
 596 fw3_hotplug_zones(struct fw3_state *state, bool add)
 597 {
 598         struct fw3_zone *z;
 599         struct fw3_device *d;
 600
 601         list_for_each_entry(z, &state->zones, list)
 602         {
 603                 if (add != hasbit(z->flags[0], FW3_FLAG_HOTPLUG))
 604                 {
 605                         list_for_each_entry(d, &z->devices, list)
 606                                 fw3_hotplug(add, z, d);
 607
 608                         if (add)
 609                                 setbit(z->flags[0], FW3_FLAG_HOTPLUG);
 610                         else
 611                                 delbit(z->flags[0], FW3_FLAG_HOTPLUG);
 612                 }
 613         }
 614 }
 615
 616 struct fw3_zone *
 617 fw3_lookup_zone(struct fw3_state *state, const char *name)
 618 {
 619         struct fw3_zone *z;
 620
 621         if (list_empty(&state->zones))
 622                 return NULL;
 623
 624         list_for_each_entry(z, &state->zones, list)
 625         {
 626                 if (strcmp(z->name, name))
 627                         continue;
 628
 629                 return z;
 630         }
 631
 632         return NULL;
 633 }
 634
 635 void
 636 fw3_free_zone(struct fw3_zone *zone)
 637 {
 638         struct fw3_device *dev, *tmp;
 639
 640         list_for_each_entry_safe(dev, tmp, &zone->devices, list)
 641         {
 642                 list_del(&dev->list);
 643                 free(dev);
 644         }
 645
 646         list_for_each_entry_safe(dev, tmp, &zone->networks, list)
 647         {
 648                 list_del(&dev->list);
 649                 free(dev);
 650         }
 651
 652         fw3_free_object(zone, fw3_zone_opts);
 653 }