fg-iptables.c

/* filter generator, iptables driver
 *
 * Copyright (c) 2002 Matthew Kirkwood
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 */

/*
 * Description of generated filter
 *
 * 1. Policy:
 *    + "filter" chains DROP.
 *    + "nat" chains ACCEPT.
 * 2. State:
 *    + Non-TCP/UDP rules don't include state.
 *    + Allow rules include state.
 *    + Deny rules don't.
 * 3. NAT is done in PRE- and POSTROUTING, as required.
 *    However, we also must add rules to INPUT (for
 *    transproxy) and OUTPUT (for masquerading).
 * 4. Reject rules need to go into FORWARD as well as
 *    INPUT or OUTPUT.
 * 5. INPUT rules also get added to FORWARD.
 * 6. If LOCALONLY is set, no FORWARD rules are output.
 *
 * The above means that each rulechain can generate up to
 * three rules -- nat, in and out.
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#include "filter.h"
#include "util.h"

/* bitfields for features used */
#define	REJECT	0x01
#define	A_TCP	0x10
#define	A_UDP	0x20

/* full path to ip{,6}tables executables */
#define IPTABLES "/sbin/iptables"
#define IP6TABLES "/sbin/ip6tables"

static char *appip(char *r, const struct addr_spec *h)
{
    APPS(r, h->addrstr);
    if(h->maskstr) APP2(r, "/", h->maskstr);
    return r;
}
#define	APPIP(r, h)		(r = appip(r, h))
#define	APPIP2(f, r, h)		(APPS(r, f), APPIP(r, h))


static char *appport(char *r, const struct port_spec *h)
{
    APPS(r, h->minstr);
    if(h->maxstr) APP2(r, ":", h->maxstr);
    return r;
}
#define	APPPORT(r, h)		(r = appport(r, h))
#define	APPPORT2(f, r, h)	(APPS(r, f), APPPORT(r, h))


static int cb_iptables_rule_common(const struct filterent *ent, struct fg_misc *misc, sa_family_t family, const char *iptables)
{
    char *rulechain = NULL, *revchain = NULL, *natchain = NULL;
    char *ruletarget = NULL, *revtarget = NULL, *nattarget = NULL;
    char *natrule = NULL, *rule = NULL, *rule_r = NULL;
    char *forchain = NULL, *forrevchain = NULL;
    char *fortarget = NULL, *forrevtarget = NULL;
    char *subchain = NULL, *subtarget = NULL;
    int neednat = 0, needret = 0;
    int islocal = (ent->rtype != ROUTEDONLY);
    int isforward = (ent->rtype != LOCALONLY);
    long *feat = (long*)misc->misc;
    enum filtertype target = ent->target;
    int orules = 0;

    /* nat rule? */
    if((target == MASQ) || (target == REDIRECT)) {
	neednat = 1;
	if(family == AF_INET6) {
	    fprintf(stderr, "can't NAT with IPv6\n");
	    return -1;
	}
	if((target == MASQ) && (ent->direction == INPUT)) {
	    fprintf(stderr, "can't masquerade on input\n");
	    return -1;
	} else if((target == REDIRECT) && (ent->direction == OUTPUT)) {
	    fprintf(stderr, "can't redirect on output\n");
	    return -1;
	}
    }

    /* sub-stuff? */
    if(target == F_SUBGROUP) {
	subtarget = strapp(strdup(ent->subgroup), "-");
	needret = 1;
    } else subtarget = strdup("");

    if(ent->groupname) subchain = strapp(strdup(ent->groupname), "-");
    else subchain = strdup("");

    switch(ent->direction) {
      case INPUT:
	natchain = strdup("PREROUTING");
	rulechain = strdup("INPUT");
	revchain = strdup("OUTPUT");
	forchain = strdup("FORWARD");
	forrevchain = strdup("FORW_OUT");
	if(ent->iface && strcmp(ent->iface, "*")) {
	    if(NEG(DIRECTION)) {
		APPS(natrule, "!");
		APPS(rule, "!");
		APPS(rule_r, "!");
	    }
	    APPSS2(natrule, "-i", ent->iface);
	    APPSS2(rule, "-i", ent->iface);
	    APPSS2(rule_r, "-o", ent->iface);
	}
	break;
      case OUTPUT:
	natchain = strdup("POSTROUTING");
	rulechain = strdup("OUTPUT");
	revchain = strdup("INPUT");
	forchain = strdup("FORW_OUT");
	forrevchain = strdup("FORWARD");
	if(ent->iface && strcmp(ent->iface, "*")) {
	    if(NEG(DIRECTION)) {
		APPS(natrule, "!");
		APPS(rule, "!");
		APPS(rule_r, "!");
	    }
	    APPSS2(natrule, "-o", ent->iface);
	    APPSS2(rule, "-o", ent->iface);
	    APPSS2(rule_r, "-i", ent->iface);
	}
	break;
      default: fprintf(stderr, "unknown direction\n"); abort();
    }

    /* state and reverse rules here */
    /* FIXME: state established on reverse for every rule, not just
     * specifically udp and tcp */
    if(ent->proto.name) {
	int needstate = 0;

	APPSS2(natrule, "-p", ent->proto.name);
	APPSS2(rule, "-p", ent->proto.name);
	APPSS2(rule_r, "-p", ent->proto.name);
	switch(ent->proto.num) {
	  case IPPROTO_TCP:
	    needret++;
	    needstate++;
	    *feat |= A_TCP;
	    APPS(rule_r, "! --syn");
	    break;
	  case IPPROTO_UDP:
	    needret++;
	    needstate++;
	    *feat |= A_UDP;
	    break;
	}
	if(needstate) {
	    APPS(rule, "-m state --state NEW,ESTABLISHED");
	    APPS(rule_r, "-m state --state ESTABLISHED");
	}
    }

    if(ent->srcaddr.addrstr) {
	NEGA(natrule, SOURCE); NEGA(rule, SOURCE); NEGA(rule_r, SOURCE);
	APPIP2("-s", natrule, &ent->srcaddr);
	APPIP2("-s", rule, &ent->srcaddr);
	APPIP2("-d", rule_r, &ent->srcaddr);
    }
    if(ent->dstaddr.addrstr) {
	NEGA(natrule, DEST); NEGA(rule, DEST); NEGA(rule_r, DEST);
	APPIP2("-d", natrule, &ent->dstaddr);
	APPIP2("-d", rule, &ent->dstaddr);
	APPIP2("-s", rule_r, &ent->dstaddr);
    }

    switch(ent->proto.num) {
      case 0: break;
      case IPPROTO_UDP: case IPPROTO_TCP:
	if(ent->u.ports.src.minstr) {
	    NEGA(natrule, SPORT);
	    NEGA(rule, SPORT);
	    NEGA(rule_r, SPORT);
	    APPPORT2("--sport", natrule, &ent->u.ports.src);
	    APPPORT2("--sport", rule, &ent->u.ports.src);
	    APPPORT2("--dport", rule_r, &ent->u.ports.src);
	}
	if(ent->u.ports.dst.minstr) {
	    NEGA(natrule, DPORT);
	    NEGA(rule, DPORT);
	    NEGA(rule_r, DPORT);
	    APPPORT2("--dport", natrule, &ent->u.ports.dst);
	    APPPORT2("--dport", rule, &ent->u.ports.dst);
	    APPPORT2("--sport", rule_r, &ent->u.ports.dst);
	}
	break;
      case IPPROTO_ICMP:
	if(ent->u.icmp) {
	    NEGA(natrule, ICMPTYPE);
	    APPSS2(natrule, "--icmp-type", ent->u.icmp);
	    NEGA(rule, ICMPTYPE);
	    APPSS2(rule, "--icmp-type", ent->u.icmp);
	}
	break;
      default:;
    }

    APPS(natrule, "-j"); APPS(rule, "-j"); APPS(rule_r, "-j");

    /* The "rule+1" in the printfs below are an ugly hack to
     * prevent a double-space in the output rule */

    /* Yuck, separate rules for logging packets.  Be still my
     * beating lunch.
     *
     * Logging and target rules have to be the last bits
     * before output, or this doesn't work.  This will also
     * fail if any mangling has been done above.
     */
    if(ESET(ent, LOG)) {
	char *lc, *la, *ls;
	if(ent->logmsg) {
	    lc = strdup(" --log-prefix=");
	    la = ent->logmsg;
	    ls = strdup("\" \"");
	} else
	    lc = la = ls = strdup("");
	if(islocal) orules++,oprintf("%s -A %s %s LOG%s%s%s\n", iptables, rulechain, rule+1, lc, la, ls);
	if(isforward) orules++,oprintf("%s -A %s %s LOG%s%s%s\n", iptables, forchain, rule+1, lc, la, ls);
    }

    /* Do this twice, once for NAT, once for filter */
    if(neednat) {
	switch(target) {
	  case MASQ:
	    nattarget = strdup("MASQUERADE");
	    break;
	  case REDIRECT:
	    nattarget = strdup("REDIRECT");
	    break;
	  default:
	    abort();
	}
    }

    switch(target) {
      case MASQ:
      case REDIRECT:
      case T_ACCEPT:
	ruletarget = revtarget =
	    fortarget = forrevtarget = strdup("ACCEPT");
	switch(ent->direction) {
	  case INPUT:
	    fortarget = strdup("FORW_OUT");
	    break;
	  case OUTPUT:
	    forrevtarget = strdup("FORW_OUT");
	    break;
	  default:
	    abort();
	}
	break;
      case DROP:
	ruletarget = fortarget = strdup("DROP");
	needret = 0;
	break;
      case T_REJECT:
	ruletarget = fortarget = strdup("REJECT");
	needret = 0;
	*feat |= T_REJECT;
	break;
      case F_SUBGROUP:
	switch(ent->direction) {
	  case INPUT:
	    ruletarget = strdup("INPUT");
	    revtarget = strdup("OUTPUT");
	    fortarget = strdup("FORWARD");
	    forrevtarget = strdup("FORW_OUT");
	    break;
	  case OUTPUT:
	    ruletarget = strdup("OUTPUT");
	    revtarget = strdup("INPUT");
	    fortarget = strdup("FORW_OUT");
	    forrevtarget = strdup("FORWARD");
	    break;
	  default:
	    abort();
	}
	break;
      default:
	abort();
    }

    if((misc->flags & FF_LSTATE) && (target != T_REJECT)) needret = 0;

    if(ent->oneway) needret = 0;

    if(neednat) orules++,oprintf("%s -t nat -A %s%s %s %s%s\n", iptables, subchain, natchain, natrule+1, subtarget, nattarget);
    if(islocal) orules++,oprintf("%s -A %s%s %s %s%s\n", iptables, subchain, rulechain, rule+1, subtarget, ruletarget);
    if(needret) orules++,oprintf("%s -I %s%s %s %s%s\n", iptables, subchain, revchain, rule_r+1, subtarget, revtarget);
    if(isforward) {
	orules++,oprintf("%s -A %s%s %s %s%s\n", iptables, subchain, forchain, rule+1, subtarget, fortarget);
	if(needret) orules++,oprintf("%s -I %s%s %s %s%s\n", iptables, subchain, forrevchain, rule_r+1, subtarget, forrevtarget);
    }

    free(natrule); free(rule); free(rule_r);
    free(subchain); free(subtarget);
    return orules;
}

static int cb_iptables_rule(const struct filterent *ent, struct fg_misc *misc)
{
    return cb_iptables_rule_common(ent, misc, AF_INET, IPTABLES);
}

static int cb_ip6tables_rule(const struct filterent *ent, struct fg_misc *misc)
{
    return cb_iptables_rule_common(ent, misc, AF_INET6, IP6TABLES);
}

static int cb_iptables_group_common(const char *name, const char *iptables)
{
    oprintf("for f in INPUT OUTPUT FORWARD FORW_OUT; do %s -N %s-$f; done\n", iptables, name);
    return 4;
}

static int cb_iptables_group(const char *name)
{
    return cb_iptables_group_common(name, IPTABLES);
}

static int cb_ip6tables_group(const char *name)
{
    return cb_iptables_group_common(name, IP6TABLES);
}

static int fg_iptables_common(struct filter *filter, int flags, sa_family_t family, const char *iptables)
{
    long feat = 0;
    int r = 0;
    struct fg_misc misc = { flags, &feat };
    fg_callback cb_iptables = {
	rule:	family == AF_INET ? cb_iptables_rule : cb_ip6tables_rule,
	group:	family == AF_INET ? cb_iptables_group : cb_ip6tables_group,
    };
    const int nchains = 3;

    filter_unroll(&filter);
    filter_apply_flags(filter, flags);

    if(!(flags & FF_NOSKEL)) {
	oputs("CHAINS=\"INPUT OUTPUT FORWARD\"");
	oputs("");

	oputs("# Flush/remove rules, set policy");
	oprintf("for f in $CHAINS; do %s -P $f DROP; done\n", iptables);
	oprintf("%s -F; %s -X\n", iptables, iptables);
	if (family == AF_INET)
	    oprintf("%s -t nat -F; %s -t nat -X\n", iptables, iptables);
	oputs("");

	oputs("# Create FORW_OUT chain");
	oprintf("%s -N FORW_OUT\n", iptables);
	oputs("");

	oputs("# Setup INVALID chain");
	oprintf("%s -N INVALID\n", iptables);
#if 0
	oprintf("%s -A INVALID -j LOG --log-prefix \"invalid \"\n", iptables);
#endif
	oprintf("%s -A INVALID -j DROP\n", iptables);
	oprintf("for f in $CHAINS; do\n"
	      "\t%s -I $f -m state --state INVALID -j INVALID;\n"
	      "done\n", iptables);
	oputs("");
	r += nchains;
    }
    if((r = filtergen_cprod(filter, &cb_iptables, &misc)) < 0)
	return r;
    if(!(flags & FF_NOSKEL)) {
	if((flags & FF_LSTATE) && (feat & (A_TCP|A_UDP))) {
	    oputs("for f in $CHAINS; do");
	    if(feat & A_TCP) {
		r += nchains;
		oprintf("\t%s -I $f -p tcp ! --syn -m state --state ESTABLISHED -j ACCEPT;\n", iptables);
	    }
	    if(feat & A_UDP) {
		r += nchains;
		oprintf("\t%s -I $f -p udp -m state --state ESTABLISHED -j ACCEPT;\n", iptables);
	    }
	    oputs("done");
	}
#if 0
	oprintf("for f in $CHAINS; do %s -A $f -j LOG; done\n", iptables);
	r += nchains;
#endif
    }
    return r;
}

int fg_iptables(struct filter *filter, int flags)
{
    return fg_iptables_common(filter, flags, AF_INET, IPTABLES);
}

int fg_ip6tables(struct filter *filter, int flags)
{
    return fg_iptables_common(filter, flags, AF_INET6, IP6TABLES);
}

/* Rules which just flush the packet filter */
static int flush_iptables_common(enum filtertype policy, sa_family_t family, const char *iptables) {
    char * ostr;

    oputs("CHAINS=\"INPUT OUTPUT FORWARD\"");
    oputs("");

    switch (policy) {
      case T_ACCEPT:
	ostr = strdup("ACCEPT");
	break;
      case DROP:
	ostr = strdup("DROP");
	break;
      case T_REJECT:
	ostr = strdup("REJECT");
	break;
      default:
	fprintf(stderr, "invalid filtertype %d\n", policy);
	abort();
    }
    oprintf("for f in $CHAINS; do %s -P $f %s; done\n", iptables, ostr);
    oprintf("%s -F; %s -X\n", iptables, iptables);
    if (family == AF_INET)
	oprintf("%s -t nat -F; %s -t nat -X\n", iptables, iptables);

    return 0;
}

int flush_iptables(enum filtertype policy)
{
    return flush_iptables_common(policy, AF_INET, IPTABLES);
}

int flush_ip6tables(enum filtertype policy)
{
    return flush_iptables_common(policy, AF_INET, IP6TABLES);
}