Firewall.cpp

#include "Firewall.hpp"
 
namespace fw
{
    Firewall::Firewall()
    {
        this->amount_of_rules = retrieve_amount_of_rules();
        for (uint8_t i = 1; i <= this->amount_of_rules; i++)
        {
            firewall_rule_t *rule_ptr = retrieve_firewall_rule(i);
            this->add_rule_to_firewall(rule_ptr, false);
        }
    }
 
    Firewall::~Firewall()
    {
    }
 
    firewall_rule_t *Firewall::get_rule_head()
    {
        return this->rule_head;
    }
 
    void Firewall::add_rule_to_firewall(firewall_rule_t *rule_ptr, const bool save_in_eeprom)
    {
        store_amount_of_rules(this->amount_of_rules);
        if (save_in_eeprom)
            Storage::store_firewall_rule(rule_ptr);
        if (this->rule_head == NULL)
        {
            this->rule_head = rule_ptr;
            rule_ptr->next = NULL;
            return;
        }
        firewall_rule_t *current_rule;
        current_rule = this->rule_head;
        while (current_rule->next != NULL)
            current_rule = current_rule->next;
        current_rule->next = rule_ptr;
        rule_ptr->next = NULL;
    }
 
    firewall_rule_t *Firewall::add_rule_to_firewall(String *args)
    {
        firewall_rule_t *rule_ptr = (firewall_rule_t *)malloc(sizeof(firewall_rule_t));
        rule_ptr->key = ++this->amount_of_rules;
 
        strncpy(rule_ptr->ip, args[IP].c_str(), sizeof(rule_ptr->ip));
        rule_ptr->port_from = args[PORT_FROM].toInt();
        rule_ptr->port_to = args[PORT_TO].toInt();
        rule_ptr->protocol = string_to_protocol(args[PROTOCOL]);
        rule_ptr->target = string_to_target(args[TARGET]);
 
        add_rule_to_firewall(rule_ptr);
        return rule_ptr;
    }
 
    firewall_rule_t *Firewall::update_rule_of_firewall(String *args, const uint8_t key)
    {
        firewall_rule_t *rule_ptr = get_rule_from_firewall(key);
        if (rule_ptr == NULL)
            return rule_ptr;
        strncpy(rule_ptr->ip, args[IP].c_str(), sizeof(rule_ptr->ip));
        rule_ptr->port_from = args[PORT_FROM].toInt();
        rule_ptr->port_to = args[PORT_TO].toInt();
        rule_ptr->protocol = string_to_protocol(args[PROTOCOL]);
        rule_ptr->target = string_to_target(args[TARGET]);
 
        Storage::store_firewall_rule(rule_ptr);
        return rule_ptr;
    }
 
    firewall_rule_t *Firewall::get_rule_from_firewall(const uint8_t key)
    {
        firewall_rule_t *rule_ptr = this->rule_head;
        if (this->rule_head == NULL)
            return NULL;
        while (rule_ptr->key != key)
        {
            if (rule_ptr->next == NULL)
                return NULL;
            else
                rule_ptr = rule_ptr->next;
        }
        return rule_ptr;
    }
 
    ok_t Firewall::delete_rule_from_firewall(const uint8_t key)
    {
        if (this->rule_head == NULL)
            return NO_ACTION;
        firewall_rule_t *current_rule = this->rule_head;
        firewall_rule_t *previous_rule = NULL;
        firewall_rule_t *temp = NULL;
        while (current_rule->key != key)
        {
            if (current_rule->next == NULL)
                return NO_ACTION;
            else
            {
                previous_rule = current_rule;
                current_rule = current_rule->next;
            }
        }
        if (current_rule == this->rule_head)
        {
            this->rule_head = rule_head->next;
            temp = this->rule_head;
        }
        else
        {
            previous_rule->next = current_rule->next;
            temp = previous_rule->next;
        }
        while (temp != NULL)
        {
            temp->key--;
            temp = temp->next;
        }
        free(current_rule);
        this->amount_of_rules--;
        Storage::store_amount_of_rules(this->amount_of_rules);
        if (this->amount_of_rules != 0)
            Storage::store_all_firewall_rules(rule_head);
        return SUCCESS;
    }
 
    my_packet_t *Firewall::get_packet_information(struct pbuf *pbuf)
    {
        my_packet_t *packet = (my_packet_t *)malloc(sizeof(my_packet_t));
        const struct ip_hdr *iphdr = (struct ip_hdr *)pbuf->payload;
        u16_t iphdr_hlen = IPH_HL_BYTES(iphdr);
 
        packet->protocol = (firewall_protocol_t)IPH_PROTO(iphdr);
        sprintf(packet->ip, "%d.%d.%d.%d", ip4_addr1_16_val(iphdr->src), ip4_addr2_16_val(iphdr->src), ip4_addr3_16_val(iphdr->src), ip4_addr4_16_val(iphdr->src));
 
        if (packet->protocol == PROTOCOL_UDP)
        {
            const struct udp_hdr *udphdr = (const struct udp_hdr *)((const u8_t *)iphdr + iphdr_hlen);
            packet->port = lwip_ntohs(udphdr->dest);
        }
        else if (packet->protocol == PROTOCOL_TCP)
        {
            const struct tcp_hdr *tcphdr = (const struct tcp_hdr *)((const u8_t *)iphdr + iphdr_hlen);
            packet->port = lwip_ntohs(tcphdr->dest);
        }
 
        return packet;
    }
 
    bool Firewall::rule_allows_packet(firewall_rule_t *rule_ptr, my_packet_t *packet)
    {
        if (strncmp(rule_ptr->ip, packet->ip, IPV4ADDRESS_LENGTH) == 0)
        {
            if ((rule_ptr->protocol == PROTOCOL_ALL || packet->protocol == rule_ptr->protocol) &&
                is_in_range(packet->port, rule_ptr->port_from, rule_ptr->port_to) &&
                rule_ptr->target == TARGET_ACCEPT)
            {
                free(packet);
                return true;
            }
        }
        return false;
    }
 
    bool Firewall::is_packet_allowed(struct pbuf *pbuf)
    {
        // no rules -> no action
        if (this->amount_of_rules == 0)
            return true;
 
        my_packet_t *packet = get_packet_information(pbuf);
        firewall_rule_t *rule_ptr = this->rule_head;
        while (rule_ptr != NULL)
        {
            if (rule_allows_packet(rule_ptr, packet))
                return true;
            rule_ptr = rule_ptr->next;
        }
        free(packet);
        return false;
    }
}