src/shared/firewall-util.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 /* Temporary work-around for broken glibc vs. linux kernel header definitions
   4  * This is already fixed upstream, remove this when distributions have updated.
   5  */
   6 #define _NET_IF_H 1
   7
   8 #include <alloca.h>
   9 #include <arpa/inet.h>
  10 #include <endian.h>
  11 #include <errno.h>
  12 #include <stddef.h>
  13 #include <string.h>
  14 #include <sys/socket.h>
  15 #include <net/if.h>
  16 #ifndef IFNAMSIZ
  17 #define IFNAMSIZ 16
  18 #endif
  19 #include <linux/if.h>
  20 #include <linux/netfilter_ipv4/ip_tables.h>
  21 #include <linux/netfilter/nf_nat.h>
  22 #include <linux/netfilter/xt_addrtype.h>
  23 #include <libiptc/libiptc.h>
  24
  25 #include "alloc-util.h"
  26 #include "firewall-util.h"
  27 #include "in-addr-util.h"
  28 #include "macro.h"
  29 #include "socket-util.h"
  30
  31 DEFINE_TRIVIAL_CLEANUP_FUNC(struct xtc_handle*, iptc_free);
  32
  33 static int entry_fill_basics(
  34                 struct ipt_entry *entry,
  35                 int protocol,
  36                 const char *in_interface,
  37                 const union in_addr_union *source,
  38                 unsigned source_prefixlen,
  39                 const char *out_interface,
  40                 const union in_addr_union *destination,
  41                 unsigned destination_prefixlen) {
  42
  43         assert(entry);
  44
  45         if (out_interface && !ifname_valid(out_interface))
  46                 return -EINVAL;
  47         if (in_interface && !ifname_valid(in_interface))
  48                 return -EINVAL;
  49
  50         entry->ip.proto = protocol;
  51
  52         if (in_interface) {
  53                 size_t l;
  54
  55                 l = strlen(in_interface);
  56                 assert(l < sizeof entry->ip.iniface);
  57                 assert(l < sizeof entry->ip.iniface_mask);
  58
  59                 strcpy(entry->ip.iniface, in_interface);
  60                 memset(entry->ip.iniface_mask, 0xFF, l + 1);
  61         }
  62         if (source) {
  63                 entry->ip.src = source->in;
  64                 in4_addr_prefixlen_to_netmask(&entry->ip.smsk, source_prefixlen);
  65         }
  66
  67         if (out_interface) {
  68                 size_t l = strlen(out_interface);
  69                 assert(l < sizeof entry->ip.outiface);
  70                 assert(l < sizeof entry->ip.outiface_mask);
  71
  72                 strcpy(entry->ip.outiface, out_interface);
  73                 memset(entry->ip.outiface_mask, 0xFF, l + 1);
  74         }
  75         if (destination) {
  76                 entry->ip.dst = destination->in;
  77                 in4_addr_prefixlen_to_netmask(&entry->ip.dmsk, destination_prefixlen);
  78         }
  79
  80         return 0;
  81 }
  82
  83 int fw_add_masquerade(
  84                 bool add,
  85                 int af,
  86                 int protocol,
  87                 const union in_addr_union *source,
  88                 unsigned source_prefixlen,
  89                 const char *out_interface,
  90                 const union in_addr_union *destination,
  91                 unsigned destination_prefixlen) {
  92
  93         _cleanup_(iptc_freep) struct xtc_handle *h = NULL;
  94         struct ipt_entry *entry, *mask;
  95         struct ipt_entry_target *t;
  96         size_t sz;
  97         struct nf_nat_ipv4_multi_range_compat *mr;
  98         int r;
  99
 100         if (af != AF_INET)
 101                 return -EOPNOTSUPP;
 102
 103         if (!IN_SET(protocol, 0, IPPROTO_TCP, IPPROTO_UDP))
 104                 return -EOPNOTSUPP;
 105
 106         h = iptc_init("nat");
 107         if (!h)
 108                 return -errno;
 109
 110         sz = XT_ALIGN(sizeof(struct ipt_entry)) +
 111              XT_ALIGN(sizeof(struct ipt_entry_target)) +
 112              XT_ALIGN(sizeof(struct nf_nat_ipv4_multi_range_compat));
 113
 114         /* Put together the entry we want to add or remove */
 115         entry = alloca0(sz);
 116         entry->next_offset = sz;
 117         entry->target_offset = XT_ALIGN(sizeof(struct ipt_entry));
 118         r = entry_fill_basics(entry, protocol, NULL, source, source_prefixlen, out_interface, destination, destination_prefixlen);
 119         if (r < 0)
 120                 return r;
 121
 122         /* Fill in target part */
 123         t = ipt_get_target(entry);
 124         t->u.target_size =
 125                 XT_ALIGN(sizeof(struct ipt_entry_target)) +
 126                 XT_ALIGN(sizeof(struct nf_nat_ipv4_multi_range_compat));
 127         strncpy(t->u.user.name, "MASQUERADE", sizeof(t->u.user.name));
 128         mr = (struct nf_nat_ipv4_multi_range_compat*) t->data;
 129         mr->rangesize = 1;
 130
 131         /* Create a search mask entry */
 132         mask = alloca(sz);
 133         memset(mask, 0xFF, sz);
 134
 135         if (add) {
 136                 if (iptc_check_entry("POSTROUTING", entry, (unsigned char*) mask, h))
 137                         return 0;
 138                 if (errno != ENOENT) /* if other error than not existing yet, fail */
 139                         return -errno;
 140
 141                 if (!iptc_insert_entry("POSTROUTING", entry, 0, h))
 142                         return -errno;
 143         } else {
 144                 if (!iptc_delete_entry("POSTROUTING", entry, (unsigned char*) mask, h)) {
 145                         if (errno == ENOENT) /* if it's already gone, all is good! */
 146                                 return 0;
 147
 148                         return -errno;
 149                 }
 150         }
 151
 152         if (!iptc_commit(h))
 153                 return -errno;
 154
 155         return 0;
 156 }
 157
 158 int fw_add_local_dnat(
 159                 bool add,
 160                 int af,
 161                 int protocol,
 162                 const char *in_interface,
 163                 const union in_addr_union *source,
 164                 unsigned source_prefixlen,
 165                 const union in_addr_union *destination,
 166                 unsigned destination_prefixlen,
 167                 uint16_t local_port,
 168                 const union in_addr_union *remote,
 169                 uint16_t remote_port,
 170                 const union in_addr_union *previous_remote) {
 171
 172         _cleanup_(iptc_freep) struct xtc_handle *h = NULL;
 173         struct ipt_entry *entry, *mask;
 174         struct ipt_entry_target *t;
 175         struct ipt_entry_match *m;
 176         struct xt_addrtype_info_v1 *at;
 177         struct nf_nat_ipv4_multi_range_compat *mr;
 178         size_t sz, msz;
 179         int r;
 180
 181         assert(add || !previous_remote);
 182
 183         if (af != AF_INET)
 184                 return -EOPNOTSUPP;
 185
 186         if (!IN_SET(protocol, IPPROTO_TCP, IPPROTO_UDP))
 187                 return -EOPNOTSUPP;
 188
 189         if (local_port <= 0)
 190                 return -EINVAL;
 191
 192         if (remote_port <= 0)
 193                 return -EINVAL;
 194
 195         h = iptc_init("nat");
 196         if (!h)
 197                 return -errno;
 198
 199         sz = XT_ALIGN(sizeof(struct ipt_entry)) +
 200              XT_ALIGN(sizeof(struct ipt_entry_match)) +
 201              XT_ALIGN(sizeof(struct xt_addrtype_info_v1)) +
 202              XT_ALIGN(sizeof(struct ipt_entry_target)) +
 203              XT_ALIGN(sizeof(struct nf_nat_ipv4_multi_range_compat));
 204
 205         if (protocol == IPPROTO_TCP)
 206                 msz = XT_ALIGN(sizeof(struct ipt_entry_match)) +
 207                       XT_ALIGN(sizeof(struct xt_tcp));
 208         else
 209                 msz = XT_ALIGN(sizeof(struct ipt_entry_match)) +
 210                       XT_ALIGN(sizeof(struct xt_udp));
 211
 212         sz += msz;
 213
 214         /* Fill in basic part */
 215         entry = alloca0(sz);
 216         entry->next_offset = sz;
 217         entry->target_offset =
 218                 XT_ALIGN(sizeof(struct ipt_entry)) +
 219                 XT_ALIGN(sizeof(struct ipt_entry_match)) +
 220                 XT_ALIGN(sizeof(struct xt_addrtype_info_v1)) +
 221                 msz;
 222         r = entry_fill_basics(entry, protocol, in_interface, source, source_prefixlen, NULL, destination, destination_prefixlen);
 223         if (r < 0)
 224                 return r;
 225
 226         /* Fill in first match */
 227         m = (struct ipt_entry_match*) ((uint8_t*) entry + XT_ALIGN(sizeof(struct ipt_entry)));
 228         m->u.match_size = msz;
 229         if (protocol == IPPROTO_TCP) {
 230                 struct xt_tcp *tcp;
 231
 232                 strncpy(m->u.user.name, "tcp", sizeof(m->u.user.name));
 233                 tcp = (struct xt_tcp*) m->data;
 234                 tcp->dpts[0] = tcp->dpts[1] = local_port;
 235                 tcp->spts[0] = 0;
 236                 tcp->spts[1] = 0xFFFF;
 237
 238         } else {
 239                 struct xt_udp *udp;
 240
 241                 strncpy(m->u.user.name, "udp", sizeof(m->u.user.name));
 242                 udp = (struct xt_udp*) m->data;
 243                 udp->dpts[0] = udp->dpts[1] = local_port;
 244                 udp->spts[0] = 0;
 245                 udp->spts[1] = 0xFFFF;
 246         }
 247
 248         /* Fill in second match */
 249         m = (struct ipt_entry_match*) ((uint8_t*) entry + XT_ALIGN(sizeof(struct ipt_entry)) + msz);
 250         m->u.match_size =
 251                 XT_ALIGN(sizeof(struct ipt_entry_match)) +
 252                 XT_ALIGN(sizeof(struct xt_addrtype_info_v1));
 253         strncpy(m->u.user.name, "addrtype", sizeof(m->u.user.name));
 254         m->u.user.revision = 1;
 255         at = (struct xt_addrtype_info_v1*) m->data;
 256         at->dest = XT_ADDRTYPE_LOCAL;
 257
 258         /* Fill in target part */
 259         t = ipt_get_target(entry);
 260         t->u.target_size =
 261                 XT_ALIGN(sizeof(struct ipt_entry_target)) +
 262                 XT_ALIGN(sizeof(struct nf_nat_ipv4_multi_range_compat));
 263         strncpy(t->u.user.name, "DNAT", sizeof(t->u.user.name));
 264         mr = (struct nf_nat_ipv4_multi_range_compat*) t->data;
 265         mr->rangesize = 1;
 266         mr->range[0].flags = NF_NAT_RANGE_PROTO_SPECIFIED|NF_NAT_RANGE_MAP_IPS;
 267         mr->range[0].min_ip = mr->range[0].max_ip = remote->in.s_addr;
 268         if (protocol == IPPROTO_TCP)
 269                 mr->range[0].min.tcp.port = mr->range[0].max.tcp.port = htons(remote_port);
 270         else
 271                 mr->range[0].min.udp.port = mr->range[0].max.udp.port = htons(remote_port);
 272
 273         mask = alloca0(sz);
 274         memset(mask, 0xFF, sz);
 275
 276         if (add) {
 277                 /* Add the PREROUTING rule, if it is missing so far */
 278                 if (!iptc_check_entry("PREROUTING", entry, (unsigned char*) mask, h)) {
 279                         if (errno != ENOENT)
 280                                 return -EINVAL;
 281
 282                         if (!iptc_insert_entry("PREROUTING", entry, 0, h))
 283                                 return -errno;
 284                 }
 285
 286                 /* If a previous remote is set, remove its entry */
 287                 if (previous_remote && previous_remote->in.s_addr != remote->in.s_addr) {
 288                         mr->range[0].min_ip = mr->range[0].max_ip = previous_remote->in.s_addr;
 289
 290                         if (!iptc_delete_entry("PREROUTING", entry, (unsigned char*) mask, h)) {
 291                                 if (errno != ENOENT)
 292                                         return -errno;
 293                         }
 294
 295                         mr->range[0].min_ip = mr->range[0].max_ip = remote->in.s_addr;
 296                 }
 297
 298                 /* Add the OUTPUT rule, if it is missing so far */
 299                 if (!in_interface) {
 300
 301                         /* Don't apply onto loopback addresses */
 302                         if (!destination) {
 303                                 entry->ip.dst.s_addr = htobe32(0x7F000000);
 304                                 entry->ip.dmsk.s_addr = htobe32(0xFF000000);
 305                                 entry->ip.invflags = IPT_INV_DSTIP;
 306                         }
 307
 308                         if (!iptc_check_entry("OUTPUT", entry, (unsigned char*) mask, h)) {
 309                                 if (errno != ENOENT)
 310                                         return -errno;
 311
 312                                 if (!iptc_insert_entry("OUTPUT", entry, 0, h))
 313                                         return -errno;
 314                         }
 315
 316                         /* If a previous remote is set, remove its entry */
 317                         if (previous_remote && previous_remote->in.s_addr != remote->in.s_addr) {
 318                                 mr->range[0].min_ip = mr->range[0].max_ip = previous_remote->in.s_addr;
 319
 320                                 if (!iptc_delete_entry("OUTPUT", entry, (unsigned char*) mask, h)) {
 321                                         if (errno != ENOENT)
 322                                                 return -errno;
 323                                 }
 324                         }
 325                 }
 326         } else {
 327                 if (!iptc_delete_entry("PREROUTING", entry, (unsigned char*) mask, h)) {
 328                         if (errno != ENOENT)
 329                                 return -errno;
 330                 }
 331
 332                 if (!in_interface) {
 333                         if (!destination) {
 334                                 entry->ip.dst.s_addr = htobe32(0x7F000000);
 335                                 entry->ip.dmsk.s_addr = htobe32(0xFF000000);
 336                                 entry->ip.invflags = IPT_INV_DSTIP;
 337                         }
 338
 339                         if (!iptc_delete_entry("OUTPUT", entry, (unsigned char*) mask, h)) {
 340                                 if (errno != ENOENT)
 341                                         return -errno;
 342                         }
 343                 }
 344         }
 345
 346         if (!iptc_commit(h))
 347                 return -errno;
 348
 349         return 0;
 350 }