ipfw_rs/

lib.rs

/*-
 * SPDX-License-Identifier: BSD-2-Clause
 *
 * Copyright (c) 2021 Aleksandr Morozov, RELKOM s.r.o
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 *    - Redistributions of source code must retain the above copyright
 *      notice, this list of conditions and the following disclaimer.
 *    - Redistributions in binary form must reproduce the above
 *      copyright notice, this list of conditions and the following
 *      disclaimer in the documentation and/or other materials provided
 *      with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
 * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
 * ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 * POSSIBILITY OF SUCH DAMAGE.
 *
 */

//! ipfw-rs
//! 
//! <img src="https://cdn.4neko.org/ipfw.webp" width="280"/> <img src="https://cdn.4neko.org/source_avail.webp" width="280"/> <img src="https://cdn.4neko.org/bds2_2.webp" width="280"/>
//! 
//! Provides a userspace (partial) interface to the raw socket of the FreeBSD's firewall IPFW.
//!
//! Supports:
//! - Add, Test, Delete multiple IP/IPv6/DNS
//! 
//! This crate supports only FreeBSD 14, but it that protocol is compatiable with the FreeBSD 13.
//!
//! This is an experimantal crate!
extern crate libc;
extern crate nix;
extern crate mac_address;
extern crate cdns_rs;

mod xbuffer;
mod ipfw;
mod ipfw2;
mod misc;

mod portable;

#[macro_use] mod common;
#[macro_use] pub mod runtime_exception;

pub use ipfw_api::*;

pub mod ipfw_api
{
    use std::os::fd::{AsFd, FromRawFd, OwnedFd};

    use nix::errno::Errno;

    use crate::{ipfw::{ipfw_check_name, ipfw_obj_header}, ipfw2::IP_FW3Opcodes, runtime_exception::IpfwResult};


    pub enum IpfwCmd<'host>
    {
        /// Adds a host/hostname to table
        Add{ hosts: Vec<&'host str>, req_atomic_op: bool }, 

        /// Removes a host/hostname from table
        Delete{ hosts: Vec<&'host str> }, 

        /// Checks if host/hostname presents in table
        Test{ hosts: Vec<&'host str> },

        /// Flushes the 
        Flush,
    }

    impl<'host> IpfwCmd<'host>
    {
        pub 
        fn require_atomic(&self) -> bool
        {
            match *self
            {
                Self::Add{ req_atomic_op, .. } => 
                    return req_atomic_op,
                _ => 
                    return false,
            }
        }

        pub 
        fn count_hosts(&self) -> usize
        {
            match *self
            {
                Self::Add{ ref hosts, .. } => return hosts.len(),
                Self::Delete{ ref hosts } => return hosts.len(),
                Self::Test{ ref hosts } => return hosts.len(), // lookup
                Self::Flush => return 0,
            }
        }
    }


    /// The crates main, public instance which should be used by the program.
    pub struct Ipfw
    {
        /// A raw socket to the IPFW instance.
        socket_fd: OwnedFd,
    }

    impl Ipfw
    {
        /// Creates new instance and opens the connection to the IPFW instance in kernel.
        pub 
        fn new() -> IpfwResult<Self>
        {
            let fd = 
                unsafe 
                { 
                    libc::socket(libc::AF_INET, libc::SOCK_RAW, libc::IPPROTO_RAW) 
                };

            if fd < 0
            {
                runtime_error!("socket() failed: {}", nix::Error::last());
            }

            return Ok(
                Self{ socket_fd: unsafe{ OwnedFd::from_raw_fd(fd) } }
            );
        }

        // https://www.unix.com/man-page/FreeBSD/8/ipfw/
        /// A commands over tables only.
        /// 
        /// # Arguments
        /// 
        /// * `tablename` - a title of the table.
        /// 
        /// * `cmd` - a [IpfwCmd] command which is required to run.
        /// 
        /// * `quite` - do not output to stdout (unused).
        /// 
        /// # Returns 
        /// 
        /// A [Result] is returned as type [IpfwResult]
        /// 
        /// * [Result::Ok] - with the amount of the successfull operations.
        /// 
        /// * [Result::Err] - an error description witht eh error code.
        pub 
        fn ipfw_table_handler<T>(&self, tablename: T, cmd: IpfwCmd, quite: bool) -> IpfwResult<i32>
        where T: AsRef<str>
        {
            //let do_add: bool = false;
            let mut is_all: libc::c_int = 0;
            let mut oh = ipfw_obj_header::new_zeroed();
            let tbl_name = tablename.as_ref();

            let set = 0;
                /*if g_co_set != 0
                {
                    g_co_set - 1
                }
                else
                {
                    0
                };*/

            // performing operations on table name
            match ipfw_check_name(tbl_name)
            {
                Ok(_) =>
                {
                    oh.ntlv.table_fill_ntlv(tbl_name, set, 1)?;
                    oh.idx = 1;
                },
                Err(e) =>
                {
                    if tbl_name == "all"
                    {
                        is_all = 1;
                    }
                    else
                    {
                        return Err(e);
                    }
                }
            }

            // table command
            // tcmd = get_token(tablecmds, *av, "table command");
            //let tcmd = _s_x::get_token(tablecmds, IpfwCmd::to_cmd(&self), "table command")?;
            
            /*if req_atomic_op == true
            {
                if tcmd != tokens::TOK_ADD
                {
                    runtime_error!("atomic is not compatible with: '{}'", IpfwCmd::to_cmd(&self));
                }
            }*/

            /*match tcmd
            { 
                tokens::TOK_LIST | tokens::TOK_INFO | 
                tokens::TOK_DETAIL | 
                tokens::TOK_FLUSH | tokens::TOK_DESTROY => {},
                _ =>
                {
                    if is_all != 0
                    {
                        runtime_error!("table name is required");
                    }
                }
            }*/
            match cmd
            {
                IpfwCmd::Flush => {},
                _ => 
                {
                    if is_all != 0
                    {
                        runtime_error!("table name is required");
                    }
                }
            }

            // https://github.com/freebsd/freebsd-src/blob/373ffc62c158e52cde86a5b934ab4a51307f9f2e/sbin/ipfw/tables.c#L225
            match cmd
            {
                IpfwCmd::Add{ .. } | IpfwCmd::Delete{ .. } =>
                {
                    //C table_modify_record(&oh, ac, av, do_add, g_co.do_quiet, g_co.do_quiet, atomic);
                    // I don't know what is update argument but it is supplied with quite flag, so when quite flag is
                    //  raised then update is 1
                    //todo
                    return oh.table_modify_record(self.socket_fd.as_fd(), cmd, quite);
                },
                /*tokens::TOK_CREATE =>
                {

                },*/
                /*TOK_MODIFY =>
                {

                },*/
                /*TOK_DESTROY => 
                {

                },*/
                IpfwCmd::Flush =>
                {
                    // Flush ALL only!
                    match IP_FW3Opcodes::table_flush(self.socket_fd.as_fd(), &oh)
                    {
                        Ok(_) => 
                            return Ok(0),
                        Err(e) if e.get_errno() == Errno::ESRCH => 
                            return Ok(0),
                        Err(e) => 
                            runtime_error!("Flush of table: '{}' failed with error: {}", tbl_name, e),
                    }
                },
                //TOK_SWAP
                //TOK_LOCK | TOK_UNLOCK
                //TOK_DETAIL | TOK_INFO
                // TOK_LIST
                IpfwCmd::Test{ hosts } =>  // TOK_LOOKUP
                {
                    let mut ret: i32 = 0;
                    for host in hosts
                    {
                        match oh.table_lookup(self.socket_fd.as_fd(), host)
                        {
                            Ok(res) => ret += res,
                            Err(e) =>
                            {
                                println!("{}", e)
                            }
                        }

                    }
                    
                    return Ok(ret);
                }
            }

        }

    }

}