5 * Copyright (C) 2013,2015 BMW Car IT GmbH.
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
29 #include <linux/netfilter_ipv4/ip_tables.h>
33 #define CHAIN_PREFIX "connman-"
35 static const char *builtin_chains[] = {
36 [NF_IP_PRE_ROUTING] = "PREROUTING",
37 [NF_IP_LOCAL_IN] = "INPUT",
38 [NF_IP_FORWARD] = "FORWARD",
39 [NF_IP_LOCAL_OUT] = "OUTPUT",
40 [NF_IP_POST_ROUTING] = "POSTROUTING",
43 struct connman_managed_table {
45 unsigned int chains[NF_INET_NUMHOOKS];
55 struct firewall_context {
59 static GSList *managed_tables;
60 static struct firewall_context *connmark_ctx;
61 static unsigned int connmark_ref;
63 static int chain_to_index(const char *chain_name)
65 if (!g_strcmp0(builtin_chains[NF_IP_PRE_ROUTING], chain_name))
66 return NF_IP_PRE_ROUTING;
67 if (!g_strcmp0(builtin_chains[NF_IP_LOCAL_IN], chain_name))
68 return NF_IP_LOCAL_IN;
69 if (!g_strcmp0(builtin_chains[NF_IP_FORWARD], chain_name))
71 if (!g_strcmp0(builtin_chains[NF_IP_LOCAL_OUT], chain_name))
72 return NF_IP_LOCAL_OUT;
73 if (!g_strcmp0(builtin_chains[NF_IP_POST_ROUTING], chain_name))
74 return NF_IP_POST_ROUTING;
79 static int managed_chain_to_index(const char *chain_name)
81 if (!g_str_has_prefix(chain_name, CHAIN_PREFIX))
84 return chain_to_index(chain_name + strlen(CHAIN_PREFIX));
87 static int insert_managed_chain(const char *table_name, int id)
89 char *rule, *managed_chain;
92 managed_chain = g_strdup_printf("%s%s", CHAIN_PREFIX,
95 err = __connman_iptables_new_chain(AF_INET, table_name, managed_chain);
99 rule = g_strdup_printf("-j %s", managed_chain);
100 err = __connman_iptables_insert(AF_INET, table_name, builtin_chains[id],
104 __connman_iptables_delete_chain(AF_INET, table_name,
110 g_free(managed_chain);
115 static int delete_managed_chain(const char *table_name, int id)
117 char *rule, *managed_chain;
120 managed_chain = g_strdup_printf("%s%s", CHAIN_PREFIX,
123 rule = g_strdup_printf("-j %s", managed_chain);
124 err = __connman_iptables_delete(AF_INET, table_name, builtin_chains[id],
131 err = __connman_iptables_delete_chain(AF_INET, table_name,
135 g_free(managed_chain);
140 static int insert_managed_rule(const char *table_name,
141 const char *chain_name,
142 const char *rule_spec)
144 struct connman_managed_table *mtable = NULL;
149 id = chain_to_index(chain_name);
151 /* This chain is not managed */
152 chain = g_strdup(chain_name);
156 for (list = managed_tables; list; list = list->next) {
159 if (g_strcmp0(mtable->name, table_name) == 0)
166 mtable = g_new0(struct connman_managed_table, 1);
167 mtable->name = g_strdup(table_name);
169 managed_tables = g_slist_prepend(managed_tables, mtable);
172 if (mtable->chains[id] == 0) {
173 DBG("table %s add managed chain for %s",
174 table_name, chain_name);
176 err = insert_managed_chain(table_name, id);
181 mtable->chains[id]++;
182 chain = g_strdup_printf("%s%s", CHAIN_PREFIX, chain_name);
185 err = __connman_iptables_append(AF_INET, table_name, chain, rule_spec);
192 static int delete_managed_rule(const char *table_name,
193 const char *chain_name,
194 const char *rule_spec)
196 struct connman_managed_table *mtable = NULL;
201 id = chain_to_index(chain_name);
203 /* This chain is not managed */
204 return __connman_iptables_delete(AF_INET, table_name,
205 chain_name, rule_spec);
208 managed_chain = g_strdup_printf("%s%s", CHAIN_PREFIX, chain_name);
210 err = __connman_iptables_delete(AF_INET, table_name, managed_chain,
213 for (list = managed_tables; list; list = list->next) {
216 if (g_strcmp0(mtable->name, table_name) == 0)
227 mtable->chains[id]--;
228 if (mtable->chains[id] > 0)
231 DBG("table %s remove managed chain for %s",
232 table_name, chain_name);
234 err = delete_managed_chain(table_name, id);
237 g_free(managed_chain);
242 static void cleanup_managed_table(gpointer user_data)
244 struct connman_managed_table *table = user_data;
250 static void cleanup_fw_rule(gpointer user_data)
252 struct fw_rule *rule = user_data;
254 g_free(rule->rule_spec);
260 struct firewall_context *__connman_firewall_create(void)
262 struct firewall_context *ctx;
264 ctx = g_new0(struct firewall_context, 1);
269 void __connman_firewall_destroy(struct firewall_context *ctx)
271 g_list_free_full(ctx->rules, cleanup_fw_rule);
275 static int enable_rule(struct fw_rule *rule)
282 DBG("%s %s %s", rule->table, rule->chain, rule->rule_spec);
284 err = insert_managed_rule(rule->table, rule->chain, rule->rule_spec);
288 err = __connman_iptables_commit(AF_INET, rule->table);
292 rule->enabled = true;
297 static int disable_rule(struct fw_rule *rule)
304 err = delete_managed_rule(rule->table, rule->chain, rule->rule_spec);
306 connman_error("Cannot remove previously installed "
307 "iptables rules: %s", strerror(-err));
311 err = __connman_iptables_commit(AF_INET, rule->table);
313 connman_error("Cannot remove previously installed "
314 "iptables rules: %s", strerror(-err));
318 rule->enabled = false;
323 static void firewall_add_rule(struct firewall_context *ctx,
326 const char *rule_fmt, ...)
330 struct fw_rule *rule;
332 va_start(args, rule_fmt);
334 rule_spec = g_strdup_vprintf(rule_fmt, args);
338 rule = g_new0(struct fw_rule, 1);
340 rule->enabled = false;
341 rule->table = g_strdup(table);
342 rule->chain = g_strdup(chain);
343 rule->rule_spec = rule_spec;
345 ctx->rules = g_list_append(ctx->rules, rule);
348 static void firewall_remove_rules(struct firewall_context *ctx)
350 g_list_free_full(ctx->rules, cleanup_fw_rule);
354 static int firewall_enable_rules(struct firewall_context *ctx)
356 struct fw_rule *rule;
360 for (list = g_list_first(ctx->rules); list; list = g_list_next(list)) {
363 err = enable_rule(rule);
371 static int firewall_disable_rules(struct firewall_context *ctx)
373 struct fw_rule *rule;
378 for (list = g_list_last(ctx->rules); list;
379 list = g_list_previous(list)) {
382 e = disable_rule(rule);
384 /* Report last error back */
385 if (e == 0 && err == -ENOENT)
394 int __connman_firewall_enable_nat(struct firewall_context *ctx,
395 char *address, unsigned char prefixlen,
400 firewall_add_rule(ctx, "nat", "POSTROUTING",
401 "-s %s/%d -o %s -j MASQUERADE",
402 address, prefixlen, interface);
404 err = firewall_enable_rules(ctx);
406 firewall_remove_rules(ctx);
410 int __connman_firewall_disable_nat(struct firewall_context *ctx)
414 err = firewall_disable_rules(ctx);
416 DBG("could not disable NAT rule");
420 firewall_remove_rules(ctx);
424 int __connman_firewall_enable_snat(struct firewall_context *ctx,
425 int index, const char *ifname,
430 firewall_add_rule(ctx, "nat", "POSTROUTING",
431 "-o %s -j SNAT --to-source %s",
434 err = firewall_enable_rules(ctx);
436 firewall_remove_rules(ctx);
440 int __connman_firewall_disable_snat(struct firewall_context *ctx)
444 err = firewall_disable_rules(ctx);
446 DBG("could not disable SNAT rule");
450 firewall_remove_rules(ctx);
454 static int firewall_enable_connmark(void)
458 if (connmark_ref > 0) {
463 connmark_ctx = __connman_firewall_create();
465 firewall_add_rule(connmark_ctx, "mangle", "INPUT",
466 "-j CONNMARK --restore-mark");
467 firewall_add_rule(connmark_ctx, "mangle", "POSTROUTING",
468 "-j CONNMARK --save-mark");
469 err = firewall_enable_rules(connmark_ctx);
471 __connman_firewall_destroy(connmark_ctx);
479 static void firewall_disable_connmark(void)
482 if (connmark_ref > 0)
485 firewall_disable_rules(connmark_ctx);
486 __connman_firewall_destroy(connmark_ctx);
490 int __connman_firewall_enable_marking(struct firewall_context *ctx,
491 enum connman_session_id_type id_type,
492 char *id, const char *src_ip,
497 err = firewall_enable_connmark();
502 case CONNMAN_SESSION_ID_TYPE_UID:
503 firewall_add_rule(ctx, "mangle", "OUTPUT",
504 "-m owner --uid-owner %s -j MARK --set-mark %d",
507 case CONNMAN_SESSION_ID_TYPE_GID:
508 firewall_add_rule(ctx, "mangle", "OUTPUT",
509 "-m owner --gid-owner %s -j MARK --set-mark %d",
512 case CONNMAN_SESSION_ID_TYPE_UNKNOWN:
514 case CONNMAN_SESSION_ID_TYPE_LSM:
520 firewall_add_rule(ctx, "mangle", "OUTPUT",
521 "-s %s -j MARK --set-mark %d",
525 return firewall_enable_rules(ctx);
528 int __connman_firewall_disable_marking(struct firewall_context *ctx)
530 firewall_disable_connmark();
531 return firewall_disable_rules(ctx);
534 static void iterate_chains_cb(const char *chain_name, void *user_data)
536 GSList **chains = user_data;
539 id = managed_chain_to_index(chain_name);
543 *chains = g_slist_prepend(*chains, GINT_TO_POINTER(id));
546 static void flush_table(const char *table_name)
548 GSList *chains = NULL, *list;
549 char *rule, *managed_chain;
552 __connman_iptables_iterate_chains(AF_INET, table_name,
553 iterate_chains_cb, &chains);
555 for (list = chains; list; list = list->next) {
556 id = GPOINTER_TO_INT(list->data);
558 managed_chain = g_strdup_printf("%s%s", CHAIN_PREFIX,
561 rule = g_strdup_printf("-j %s", managed_chain);
562 err = __connman_iptables_delete(AF_INET, table_name,
563 builtin_chains[id], rule);
565 connman_warn("Failed to delete jump rule '%s': %s",
566 rule, strerror(-err));
570 err = __connman_iptables_flush_chain(AF_INET, table_name,
573 connman_warn("Failed to flush chain '%s': %s",
574 managed_chain, strerror(-err));
576 err = __connman_iptables_delete_chain(AF_INET, table_name,
579 connman_warn("Failed to delete chain '%s': %s",
580 managed_chain, strerror(-err));
583 g_free(managed_chain);
586 err = __connman_iptables_commit(AF_INET, table_name);
588 connman_warn("Failed to flush table '%s': %s",
589 table_name, strerror(-err));
592 g_slist_free(chains);
595 static void flush_all_tables(void)
597 /* Flush the tables ConnMan might have modified
598 * But do so if only ConnMan has done something with
601 if (!g_file_test("/proc/net/ip_tables_names",
602 G_FILE_TEST_EXISTS | G_FILE_TEST_IS_REGULAR)) {
606 flush_table("filter");
607 flush_table("mangle");
611 int __connman_firewall_init(void)
615 __connman_iptables_init();
621 void __connman_firewall_cleanup(void)
625 g_slist_free_full(managed_tables, cleanup_managed_table);
626 __connman_iptables_cleanup();