redirects.c 20 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768
  1. /*
  2. * firewall3 - 3rd OpenWrt UCI firewall implementation
  3. *
  4. * Copyright (C) 2013-2018 Jo-Philipp Wich <jo@mein.io>
  5. *
  6. * Permission to use, copy, modify, and/or distribute this software for any
  7. * purpose with or without fee is hereby granted, provided that the above
  8. * copyright notice and this permission notice appear in all copies.
  9. *
  10. * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  11. * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12. * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  13. * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14. * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15. * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16. * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17. */
  18. #include "redirects.h"
  19. const struct fw3_option fw3_redirect_opts[] = {
  20. FW3_OPT("enabled", bool, redirect, enabled),
  21. FW3_OPT("name", string, redirect, name),
  22. FW3_OPT("family", family, redirect, family),
  23. FW3_OPT("src", device, redirect, src),
  24. FW3_OPT("dest", device, redirect, dest),
  25. FW3_OPT("ipset", setmatch, redirect, ipset),
  26. FW3_OPT("helper", cthelper, redirect, helper),
  27. FW3_LIST("proto", protocol, redirect, proto),
  28. FW3_OPT("src_ip", network, redirect, ip_src),
  29. FW3_LIST("src_mac", mac, redirect, mac_src),
  30. FW3_OPT("src_port", port, redirect, port_src),
  31. FW3_OPT("src_dip", network, redirect, ip_dest),
  32. FW3_OPT("src_dport", port, redirect, port_dest),
  33. FW3_OPT("dest_ip", network, redirect, ip_redir),
  34. FW3_OPT("dest_port", port, redirect, port_redir),
  35. FW3_OPT("extra", string, redirect, extra),
  36. FW3_OPT("limit", limit, redirect, limit),
  37. FW3_OPT("limit_burst", int, redirect, limit.burst),
  38. FW3_OPT("utc_time", bool, redirect, time.utc),
  39. FW3_OPT("start_date", date, redirect, time.datestart),
  40. FW3_OPT("stop_date", date, redirect, time.datestop),
  41. FW3_OPT("start_time", time, redirect, time.timestart),
  42. FW3_OPT("stop_time", time, redirect, time.timestop),
  43. FW3_OPT("weekdays", weekdays, redirect, time.weekdays),
  44. FW3_OPT("monthdays", monthdays, redirect, time.monthdays),
  45. FW3_OPT("mark", mark, redirect, mark),
  46. FW3_OPT("reflection", bool, redirect, reflection),
  47. FW3_OPT("reflection_src", reflection_source,
  48. redirect, reflection_src),
  49. FW3_OPT("target", target, redirect, target),
  50. { }
  51. };
  52. static bool
  53. check_families(struct uci_element *e, struct fw3_redirect *r)
  54. {
  55. if (r->family == FW3_FAMILY_ANY)
  56. return true;
  57. if (r->_src && r->_src->family && r->_src->family != r->family)
  58. {
  59. warn_elem(e, "refers to source zone with different family");
  60. return false;
  61. }
  62. if (r->_dest && r->_dest->family && r->_dest->family != r->family)
  63. {
  64. warn_elem(e, "refers to destination zone with different family");
  65. return false;
  66. }
  67. if (r->ipset.ptr && r->ipset.ptr->family &&
  68. r->ipset.ptr->family != r->family)
  69. {
  70. warn_elem(e, "refers to ipset with different family");
  71. return false;
  72. }
  73. if (r->helper.ptr && r->helper.ptr->family &&
  74. r->helper.ptr->family != r->family)
  75. {
  76. warn_elem(e, "refers to CT helper not supporting family");
  77. return false;
  78. }
  79. if (r->ip_src.family && r->ip_src.family != r->family)
  80. {
  81. warn_elem(e, "uses source ip with different family");
  82. return false;
  83. }
  84. if (r->ip_dest.family && r->ip_dest.family != r->family)
  85. {
  86. warn_elem(e, "uses destination ip with different family");
  87. return false;
  88. }
  89. if (r->ip_redir.family && r->ip_redir.family != r->family)
  90. {
  91. warn_elem(e, "uses redirect ip with different family");
  92. return false;
  93. }
  94. return true;
  95. }
  96. static bool
  97. compare_addr(struct fw3_address *a, struct fw3_address *b)
  98. {
  99. if (a->family != FW3_FAMILY_V4 || b->family != FW3_FAMILY_V4)
  100. return false;
  101. return ((a->address.v4.s_addr & a->mask.v4.s_addr) ==
  102. (b->address.v4.s_addr & a->mask.v4.s_addr));
  103. }
  104. static bool
  105. resolve_dest(struct uci_element *e, struct fw3_redirect *redir,
  106. struct fw3_state *state)
  107. {
  108. struct fw3_zone *zone;
  109. struct fw3_address *addr;
  110. struct list_head *addrs;
  111. if (!redir->ip_redir.set)
  112. return false;
  113. list_for_each_entry(zone, &state->zones, list)
  114. {
  115. addrs = fw3_resolve_zone_addresses(zone, NULL);
  116. if (!addrs)
  117. continue;
  118. list_for_each_entry(addr, addrs, list)
  119. {
  120. if (!compare_addr(addr, &redir->ip_redir))
  121. continue;
  122. strncpy(redir->dest.name, zone->name, sizeof(redir->dest.name) - 1);
  123. redir->dest.set = true;
  124. redir->_dest = zone;
  125. break;
  126. }
  127. fw3_free_list(addrs);
  128. if (redir->_dest)
  129. return true;
  130. }
  131. return false;
  132. }
  133. static bool
  134. check_local(struct uci_element *e, struct fw3_redirect *redir,
  135. struct fw3_state *state)
  136. {
  137. if (redir->target != FW3_FLAG_DNAT)
  138. return false;
  139. if (!redir->ip_redir.set)
  140. redir->local = true;
  141. return redir->local;
  142. }
  143. static void
  144. select_helper(struct fw3_state *state, struct fw3_redirect *redir)
  145. {
  146. struct fw3_protocol *proto;
  147. struct fw3_cthelper *helper;
  148. int n_matches = 0;
  149. if (!state->defaults.auto_helper)
  150. return;
  151. if (!redir->_src || redir->target != FW3_FLAG_DNAT)
  152. return;
  153. if (!redir->port_redir.set || redir->port_redir.invert)
  154. return;
  155. if (redir->helper.set || redir->helper.ptr)
  156. return;
  157. if (list_empty(&redir->proto))
  158. return;
  159. list_for_each_entry(proto, &redir->proto, list)
  160. {
  161. helper = fw3_lookup_cthelper_by_proto_port(state, proto, &redir->port_redir);
  162. if (helper)
  163. n_matches++;
  164. }
  165. if (n_matches != 1)
  166. return;
  167. /* store pointer to auto-selected helper but set ".set" flag to false,
  168. * to allow later code to decide between configured or auto-selected
  169. * helpers */
  170. redir->helper.set = false;
  171. redir->helper.ptr = helper;
  172. set(redir->_src->flags, FW3_FAMILY_V4, FW3_FLAG_HELPER);
  173. }
  174. static bool
  175. check_redirect(struct fw3_state *state, struct fw3_redirect *redir, struct uci_element *e)
  176. {
  177. bool valid;
  178. if (!redir->enabled)
  179. return false;
  180. if (redir->src.invert)
  181. {
  182. warn_section("redirect", redir, e, "must not have an inverted source");
  183. return false;
  184. }
  185. else if (redir->src.set && !redir->src.any &&
  186. !(redir->_src = fw3_lookup_zone(state, redir->src.name)))
  187. {
  188. warn_section("redirect", redir, e, "refers to not existing zone '%s'",
  189. redir->src.name);
  190. return false;
  191. }
  192. else if (redir->dest.set && !redir->dest.any &&
  193. !(redir->_dest = fw3_lookup_zone(state, redir->dest.name)))
  194. {
  195. warn_section("redirect", redir, e, "refers to not existing zone '%s'",
  196. redir->dest.name);
  197. return false;
  198. }
  199. else if (redir->ipset.set && state->disable_ipsets)
  200. {
  201. warn_section("redirect", redir, e, "skipped due to disabled ipset support",
  202. redir->name);
  203. return false;
  204. }
  205. else if (redir->ipset.set &&
  206. !(redir->ipset.ptr = fw3_lookup_ipset(state, redir->ipset.name)))
  207. {
  208. warn_section("redirect", redir, e, "refers to unknown ipset '%s'", redir->name,
  209. redir->ipset.name);
  210. return false;
  211. }
  212. else if (redir->helper.set &&
  213. !(redir->helper.ptr = fw3_lookup_cthelper(state, redir->helper.name)))
  214. {
  215. warn_section("redirect", redir, e, "refers to unknown CT helper '%s'",
  216. redir->helper.name);
  217. return false;
  218. }
  219. if (!check_families(e, redir))
  220. return false;
  221. if (redir->target == FW3_FLAG_UNSPEC)
  222. {
  223. warn_section("redirect", redir, e, "has no target specified, defaulting to DNAT");
  224. redir->target = FW3_FLAG_DNAT;
  225. }
  226. else if (redir->target < FW3_FLAG_DNAT || redir->target > FW3_FLAG_SNAT)
  227. {
  228. warn_section("redirect", redir, e, "has invalid target specified, defaulting to DNAT");
  229. redir->target = FW3_FLAG_DNAT;
  230. }
  231. valid = false;
  232. if (redir->target == FW3_FLAG_DNAT)
  233. {
  234. if (redir->src.any)
  235. warn_section("redirect", redir, e, "must not have source '*' for DNAT target");
  236. else if (!redir->_src)
  237. warn_section("redirect", redir, e, "has no source specified");
  238. else if (redir->helper.invert)
  239. warn_section("redirect", redir, e, "must not use a negated helper match");
  240. else
  241. {
  242. set(redir->_src->flags, FW3_FAMILY_V4, redir->target);
  243. valid = true;
  244. if (!check_local(e, redir, state) && !redir->dest.set &&
  245. resolve_dest(e, redir, state))
  246. {
  247. warn_section("redirect", redir, e,
  248. "does not specify a destination, assuming '%s'",
  249. redir->dest.name);
  250. }
  251. if (redir->reflection && redir->_dest && redir->_src->masq)
  252. {
  253. set(redir->_dest->flags, FW3_FAMILY_V4, FW3_FLAG_ACCEPT);
  254. set(redir->_dest->flags, FW3_FAMILY_V4, FW3_FLAG_DNAT);
  255. set(redir->_dest->flags, FW3_FAMILY_V4, FW3_FLAG_SNAT);
  256. }
  257. if (redir->helper.ptr)
  258. set(redir->_src->flags, FW3_FAMILY_V4, FW3_FLAG_HELPER);
  259. }
  260. }
  261. else
  262. {
  263. if (redir->dest.any)
  264. warn_section("redirect", redir, e,
  265. "must not have destination '*' for SNAT target");
  266. else if (!redir->_dest)
  267. warn_section("redirect", redir, e, "has no destination specified");
  268. else if (!redir->ip_dest.set)
  269. warn_section("redirect", redir, e, "has no src_dip option specified");
  270. else if (!list_empty(&redir->mac_src))
  271. warn_section("redirect", redir, e, "must not use 'src_mac' option for SNAT target");
  272. else if (redir->helper.set)
  273. warn_section("redirect", redir, e, "must not use 'helper' option for SNAT target");
  274. else
  275. {
  276. set(redir->_dest->flags, FW3_FAMILY_V4, redir->target);
  277. valid = true;
  278. }
  279. }
  280. if (list_empty(&redir->proto))
  281. {
  282. warn_section("redirect", redir, e, "does not specify a protocol, assuming TCP+UDP");
  283. fw3_parse_protocol(&redir->proto, "tcpudp", true);
  284. }
  285. if (!valid)
  286. return false;
  287. if (redir->target == FW3_FLAG_DNAT && !redir->port_redir.set)
  288. redir->port_redir = redir->port_dest;
  289. return true;
  290. }
  291. static struct fw3_redirect *
  292. fw3_alloc_redirect(struct fw3_state *state)
  293. {
  294. struct fw3_redirect *redir;
  295. redir = calloc(1, sizeof(*redir));
  296. if (!redir)
  297. return NULL;
  298. INIT_LIST_HEAD(&redir->proto);
  299. INIT_LIST_HEAD(&redir->mac_src);
  300. redir->enabled = true;
  301. redir->reflection = true;
  302. list_add_tail(&redir->list, &state->redirects);
  303. return redir;
  304. }
  305. void
  306. fw3_load_redirects(struct fw3_state *state, struct uci_package *p,
  307. struct blob_attr *a)
  308. {
  309. struct uci_section *s;
  310. struct uci_element *e;
  311. struct fw3_redirect *redir;
  312. struct blob_attr *entry;
  313. unsigned rem;
  314. INIT_LIST_HEAD(&state->redirects);
  315. blob_for_each_attr(entry, a, rem)
  316. {
  317. const char *type;
  318. const char *name = "ubus redirect";
  319. if (!fw3_attr_parse_name_type(entry, &name, &type))
  320. continue;
  321. if (strcmp(type, "redirect"))
  322. continue;
  323. redir = fw3_alloc_redirect(state);
  324. if (!redir)
  325. continue;
  326. if (!fw3_parse_blob_options(redir, fw3_redirect_opts, entry, name))
  327. {
  328. warn_section("redirect", redir, NULL, "skipped due to invalid options");
  329. fw3_free_redirect(redir);
  330. continue;
  331. }
  332. if (!check_redirect(state, redir, NULL)) {
  333. fw3_free_redirect(redir);
  334. continue;
  335. }
  336. select_helper(state, redir);
  337. }
  338. uci_foreach_element(&p->sections, e)
  339. {
  340. s = uci_to_section(e);
  341. if (strcmp(s->type, "redirect"))
  342. continue;
  343. redir = fw3_alloc_redirect(state);
  344. if (!redir)
  345. continue;
  346. if (!fw3_parse_options(redir, fw3_redirect_opts, s))
  347. {
  348. warn_elem(e, "skipped due to invalid options");
  349. fw3_free_redirect(redir);
  350. continue;
  351. }
  352. if (!check_redirect(state, redir, e)) {
  353. fw3_free_redirect(redir);
  354. continue;
  355. }
  356. select_helper(state, redir);
  357. }
  358. }
  359. static void
  360. append_chain_nat(struct fw3_ipt_rule *r, struct fw3_redirect *redir)
  361. {
  362. if (redir->target == FW3_FLAG_DNAT)
  363. fw3_ipt_rule_append(r, "zone_%s_prerouting", redir->src.name);
  364. else
  365. fw3_ipt_rule_append(r, "zone_%s_postrouting", redir->dest.name);
  366. }
  367. static void
  368. set_redirect(struct fw3_ipt_rule *r, struct fw3_port *port)
  369. {
  370. char buf[sizeof("65535-65535\0")];
  371. fw3_ipt_rule_target(r, "REDIRECT");
  372. if (port && port->set)
  373. {
  374. if (port->port_min == port->port_max)
  375. sprintf(buf, "%u", port->port_min);
  376. else
  377. snprintf(buf, sizeof(buf), "%u-%u", port->port_min, port->port_max);
  378. fw3_ipt_rule_addarg(r, false, "--to-ports", buf);
  379. }
  380. }
  381. static void
  382. set_snat_dnat(struct fw3_ipt_rule *r, enum fw3_flag target,
  383. struct fw3_address *addr, struct fw3_port *port)
  384. {
  385. char buf[sizeof("255.255.255.255:65535-65535\0")];
  386. buf[0] = '\0';
  387. if (addr && addr->set)
  388. {
  389. inet_ntop(AF_INET, &addr->address.v4, buf, sizeof(buf));
  390. }
  391. if (port && port->set)
  392. {
  393. if (port->port_min == port->port_max)
  394. sprintf(buf + strlen(buf), ":%u", port->port_min);
  395. else
  396. sprintf(buf + strlen(buf), ":%u-%u",
  397. port->port_min, port->port_max);
  398. }
  399. if (target == FW3_FLAG_DNAT)
  400. {
  401. fw3_ipt_rule_target(r, "DNAT");
  402. fw3_ipt_rule_addarg(r, false, "--to-destination", buf);
  403. }
  404. else
  405. {
  406. fw3_ipt_rule_target(r, "SNAT");
  407. fw3_ipt_rule_addarg(r, false, "--to-source", buf);
  408. }
  409. }
  410. static void
  411. set_target_nat(struct fw3_ipt_rule *r, struct fw3_redirect *redir)
  412. {
  413. if (redir->local)
  414. set_redirect(r, &redir->port_redir);
  415. else if (redir->target == FW3_FLAG_DNAT)
  416. set_snat_dnat(r, redir->target, &redir->ip_redir, &redir->port_redir);
  417. else
  418. set_snat_dnat(r, redir->target, &redir->ip_dest, &redir->port_dest);
  419. }
  420. static void
  421. set_comment(struct fw3_ipt_rule *r, const char *name, int num, const char *suffix)
  422. {
  423. if (name)
  424. {
  425. if (suffix)
  426. fw3_ipt_rule_comment(r, "%s (%s)", name, suffix);
  427. else
  428. fw3_ipt_rule_comment(r, name);
  429. }
  430. else
  431. {
  432. if (suffix)
  433. fw3_ipt_rule_comment(r, "@redirect[%u] (%s)", num, suffix);
  434. else
  435. fw3_ipt_rule_comment(r, "@redirect[%u]", num);
  436. }
  437. }
  438. static void
  439. print_redirect(struct fw3_ipt_handle *h, struct fw3_state *state,
  440. struct fw3_redirect *redir, int num,
  441. struct fw3_protocol *proto, struct fw3_mac *mac)
  442. {
  443. struct fw3_ipt_rule *r;
  444. struct fw3_address *src, *dst;
  445. struct fw3_port *spt, *dpt;
  446. switch (h->table)
  447. {
  448. case FW3_TABLE_NAT:
  449. src = &redir->ip_src;
  450. dst = &redir->ip_dest;
  451. spt = &redir->port_src;
  452. dpt = &redir->port_dest;
  453. if (redir->target == FW3_FLAG_SNAT)
  454. {
  455. dst = &redir->ip_redir;
  456. dpt = &redir->port_redir;
  457. }
  458. r = fw3_ipt_rule_create(h, proto, NULL, NULL, src, dst);
  459. fw3_ipt_rule_sport_dport(r, spt, dpt);
  460. fw3_ipt_rule_mac(r, mac);
  461. fw3_ipt_rule_ipset(r, &redir->ipset);
  462. fw3_ipt_rule_helper(r, &redir->helper);
  463. fw3_ipt_rule_limit(r, &redir->limit);
  464. fw3_ipt_rule_time(r, &redir->time);
  465. fw3_ipt_rule_mark(r, &redir->mark);
  466. set_target_nat(r, redir);
  467. fw3_ipt_rule_extra(r, redir->extra);
  468. set_comment(r, redir->name, num, NULL);
  469. append_chain_nat(r, redir);
  470. break;
  471. case FW3_TABLE_RAW:
  472. if (redir->target == FW3_FLAG_DNAT && redir->helper.ptr)
  473. {
  474. if (!fw3_cthelper_check_proto(redir->helper.ptr, proto))
  475. {
  476. info(" ! Skipping protocol %s since helper '%s' does not support it",
  477. fw3_protoname(proto), redir->helper.ptr->name);
  478. return;
  479. }
  480. if (!redir->helper.set)
  481. info(" - Auto-selected conntrack helper '%s' based on proto/port",
  482. redir->helper.ptr->name);
  483. r = fw3_ipt_rule_create(h, proto, NULL, NULL, &redir->ip_src, &redir->ip_redir);
  484. fw3_ipt_rule_sport_dport(r, &redir->port_src, &redir->port_redir);
  485. fw3_ipt_rule_mac(r, mac);
  486. fw3_ipt_rule_ipset(r, &redir->ipset);
  487. fw3_ipt_rule_limit(r, &redir->limit);
  488. fw3_ipt_rule_time(r, &redir->time);
  489. fw3_ipt_rule_mark(r, &redir->mark);
  490. fw3_ipt_rule_addarg(r, false, "-m", "conntrack");
  491. fw3_ipt_rule_addarg(r, false, "--ctstate", "DNAT");
  492. fw3_ipt_rule_target(r, "CT");
  493. fw3_ipt_rule_addarg(r, false, "--helper", redir->helper.ptr->name);
  494. set_comment(r, redir->name, num, "CT helper");
  495. fw3_ipt_rule_append(r, "zone_%s_helper", redir->_src->name);
  496. }
  497. break;
  498. default:
  499. break;
  500. }
  501. }
  502. static void
  503. print_reflection(struct fw3_ipt_handle *h, struct fw3_state *state,
  504. struct fw3_redirect *redir, int num,
  505. struct fw3_protocol *proto, struct fw3_address *ra,
  506. struct fw3_address *ia, struct fw3_address *ea)
  507. {
  508. struct fw3_ipt_rule *r;
  509. switch (h->table)
  510. {
  511. case FW3_TABLE_NAT:
  512. r = fw3_ipt_rule_create(h, proto, NULL, NULL, ia, ea);
  513. fw3_ipt_rule_sport_dport(r, NULL, &redir->port_dest);
  514. fw3_ipt_rule_limit(r, &redir->limit);
  515. fw3_ipt_rule_time(r, &redir->time);
  516. set_comment(r, redir->name, num, "reflection");
  517. set_snat_dnat(r, FW3_FLAG_DNAT, &redir->ip_redir, &redir->port_redir);
  518. fw3_ipt_rule_replace(r, "zone_%s_prerouting", redir->dest.name);
  519. r = fw3_ipt_rule_create(h, proto, NULL, NULL, ia, &redir->ip_redir);
  520. fw3_ipt_rule_sport_dport(r, NULL, &redir->port_redir);
  521. fw3_ipt_rule_limit(r, &redir->limit);
  522. fw3_ipt_rule_time(r, &redir->time);
  523. set_comment(r, redir->name, num, "reflection");
  524. set_snat_dnat(r, FW3_FLAG_SNAT, ra, NULL);
  525. fw3_ipt_rule_replace(r, "zone_%s_postrouting", redir->dest.name);
  526. break;
  527. default:
  528. break;
  529. }
  530. }
  531. static void
  532. expand_redirect(struct fw3_ipt_handle *handle, struct fw3_state *state,
  533. struct fw3_redirect *redir, int num)
  534. {
  535. struct list_head *ext_addrs, *int_addrs;
  536. struct fw3_address *ext_addr, *int_addr, ref_addr;
  537. struct fw3_protocol *proto;
  538. struct fw3_mac *mac;
  539. if (redir->name)
  540. info(" * Redirect '%s'", redir->name);
  541. else
  542. info(" * Redirect #%u", num);
  543. if (!fw3_is_family(redir->_src, handle->family) ||
  544. !fw3_is_family(redir->_dest, handle->family))
  545. {
  546. info(" ! Skipping due to different family of zone");
  547. return;
  548. }
  549. if (!fw3_is_family(&redir->ip_src, handle->family) ||
  550. !fw3_is_family(&redir->ip_dest, handle->family) ||
  551. !fw3_is_family(&redir->ip_redir, handle->family))
  552. {
  553. if (!redir->ip_src.resolved ||
  554. !redir->ip_dest.resolved ||
  555. !redir->ip_redir.resolved)
  556. info(" ! Skipping due to different family of ip address");
  557. return;
  558. }
  559. if (redir->ipset.ptr)
  560. {
  561. if (!fw3_is_family(redir->ipset.ptr, handle->family))
  562. {
  563. info(" ! Skipping due to different family in ipset");
  564. return;
  565. }
  566. if (!fw3_check_ipset(redir->ipset.ptr))
  567. {
  568. info(" ! Skipping due to missing ipset '%s'",
  569. redir->ipset.ptr->external ?
  570. redir->ipset.ptr->external : redir->ipset.ptr->name);
  571. return;
  572. }
  573. set(redir->ipset.ptr->flags, handle->family, handle->family);
  574. }
  575. fw3_foreach(proto, &redir->proto)
  576. fw3_foreach(mac, &redir->mac_src)
  577. print_redirect(handle, state, redir, num, proto, mac);
  578. /* reflection rules */
  579. if (redir->target != FW3_FLAG_DNAT || !redir->reflection || redir->local)
  580. return;
  581. if (!redir->_dest || !redir->_src->masq)
  582. return;
  583. ext_addrs = fw3_resolve_zone_addresses(redir->_src, &redir->ip_dest);
  584. int_addrs = fw3_resolve_zone_addresses(redir->_dest, NULL);
  585. if (!ext_addrs || !int_addrs)
  586. goto out;
  587. list_for_each_entry(ext_addr, ext_addrs, list)
  588. {
  589. if (!fw3_is_family(ext_addr, handle->family))
  590. continue;
  591. list_for_each_entry(int_addr, int_addrs, list)
  592. {
  593. if (!fw3_is_family(int_addr, handle->family))
  594. continue;
  595. fw3_foreach(proto, &redir->proto)
  596. {
  597. if (!proto)
  598. continue;
  599. if (redir->reflection_src == FW3_REFLECTION_INTERNAL)
  600. ref_addr = *int_addr;
  601. else
  602. ref_addr = *ext_addr;
  603. ref_addr.mask.v4.s_addr = 0xFFFFFFFF;
  604. ext_addr->mask.v4.s_addr = 0xFFFFFFFF;
  605. print_reflection(handle, state, redir, num, proto,
  606. &ref_addr, int_addr, ext_addr);
  607. }
  608. }
  609. }
  610. out:
  611. fw3_free_list(ext_addrs);
  612. fw3_free_list(int_addrs);
  613. }
  614. void
  615. fw3_print_redirects(struct fw3_ipt_handle *handle, struct fw3_state *state)
  616. {
  617. int num = 0;
  618. struct fw3_redirect *redir;
  619. if (handle->family == FW3_FAMILY_V6)
  620. return;
  621. if (handle->table != FW3_TABLE_FILTER &&
  622. handle->table != FW3_TABLE_NAT &&
  623. handle->table != FW3_TABLE_RAW)
  624. return;
  625. list_for_each_entry(redir, &state->redirects, list)
  626. {
  627. if (handle->table == FW3_TABLE_RAW && !redir->helper.ptr)
  628. continue;
  629. expand_redirect(handle, state, redir, num++);
  630. }
  631. }