• source navigation  • diff markup  • identifier search  • freetext search  • 

Sources/firewall3/defaults.c

  1 /*
  2  * firewall3 - 3rd OpenWrt UCI firewall implementation
  3  *
  4  *   Copyright (C) 2013 Jo-Philipp Wich <jo@mein.io>
  5  *
  6  * Permission to use, copy, modify, and/or distribute this software for any
  7  * purpose with or without fee is hereby granted, provided that the above
  8  * copyright notice and this permission notice appear in all copies.
  9  *
 10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 17  */
 18 
 19 #include "defaults.h"
 20 
 21 
 22 #define C(f, tbl, def, fmt) \
 23         { FW3_FAMILY_##f, FW3_TABLE_##tbl, FW3_FLAG_##def, fmt }
 24 
 25 static const struct fw3_chain_spec default_chains[] = {
 26         C(ANY, FILTER, UNSPEC,        "reject"),
 27         C(ANY, FILTER, CUSTOM_CHAINS, "input_rule"),
 28         C(ANY, FILTER, CUSTOM_CHAINS, "output_rule"),
 29         C(ANY, FILTER, CUSTOM_CHAINS, "forwarding_rule"),
 30         C(ANY, FILTER, SYN_FLOOD,     "syn_flood"),
 31 
 32         C(V4,  NAT,    CUSTOM_CHAINS, "prerouting_rule"),
 33         C(V4,  NAT,    CUSTOM_CHAINS, "postrouting_rule"),
 34 
 35         { }
 36 };
 37 
 38 const struct fw3_option fw3_flag_opts[] = {
 39         FW3_OPT("input",               target,   defaults, policy_input),
 40         FW3_OPT("forward",             target,   defaults, policy_forward),
 41         FW3_OPT("output",              target,   defaults, policy_output),
 42 
 43         FW3_OPT("drop_invalid",        bool,     defaults, drop_invalid),
 44         FW3_OPT("tcp_reject_code",     reject_code, defaults, tcp_reject_code),
 45         FW3_OPT("any_reject_code",     reject_code, defaults, any_reject_code),
 46 
 47         FW3_OPT("syn_flood",           bool,     defaults, syn_flood),
 48         FW3_OPT("synflood_protect",    bool,     defaults, syn_flood),
 49         FW3_OPT("synflood_rate",       limit,    defaults, syn_flood_rate),
 50         FW3_OPT("synflood_burst",      int,      defaults, syn_flood_rate.burst),
 51 
 52         FW3_OPT("tcp_syncookies",      bool,     defaults, tcp_syncookies),
 53         FW3_OPT("tcp_ecn",             int,      defaults, tcp_ecn),
 54         FW3_OPT("tcp_window_scaling",  bool,     defaults, tcp_window_scaling),
 55 
 56         FW3_OPT("accept_redirects",    bool,     defaults, accept_redirects),
 57         FW3_OPT("accept_source_route", bool,     defaults, accept_source_route),
 58 
 59         FW3_OPT("auto_helper",         bool,     defaults, auto_helper),
 60         FW3_OPT("custom_chains",       bool,     defaults, custom_chains),
 61         FW3_OPT("disable_ipv6",        bool,     defaults, disable_ipv6),
 62         FW3_OPT("flow_offloading",     bool,     defaults, flow_offloading),
 63         FW3_OPT("flow_offloading_hw",  bool,     defaults, flow_offloading_hw),
 64 
 65         FW3_OPT("__flags_v4",          int,      defaults, flags[0]),
 66         FW3_OPT("__flags_v6",          int,      defaults, flags[1]),
 67 
 68         { }
 69 };
 70 
 71 
 72 static void
 73 check_policy(struct uci_element *e, enum fw3_flag *pol, const char *name)
 74 {
 75         if (*pol == FW3_FLAG_UNSPEC)
 76         {
 77                 warn_elem(e, "has no %s policy specified, defaulting to DROP", name);
 78                 *pol = FW3_FLAG_DROP;
 79         }
 80         else if (*pol > FW3_FLAG_DROP)
 81         {
 82                 warn_elem(e, "has invalid %s policy, defaulting to DROP", name);
 83                 *pol = FW3_FLAG_DROP;
 84         }
 85 }
 86 
 87 static void
 88 check_target(struct uci_element *e, bool *available, const char *target, const bool ipv6)
 89 {
 90         const bool b = fw3_has_target(ipv6, target);
 91         if (!b)
 92         {
 93                 warn_elem(e, "requires unavailable target extension %s, disabling", target);
 94         }
 95         *available = b;
 96 }
 97 
 98 static void
 99 check_any_reject_code(struct uci_element *e, enum fw3_reject_code *any_reject_code)
100 {
101         if (*any_reject_code == FW3_REJECT_CODE_TCP_RESET) {
102                 warn_elem(e, "tcp-reset not valid for any_reject_code, defaulting to port-unreach");
103                 *any_reject_code = FW3_REJECT_CODE_PORT_UNREACH;
104         }
105 }
106 
107 static const char*
108 get_reject_code(enum fw3_family family, enum fw3_reject_code reject_code)
109 {
110         switch (reject_code) {
111         case FW3_REJECT_CODE_TCP_RESET:
112                 return "tcp-reset";
113         case FW3_REJECT_CODE_PORT_UNREACH:
114                 return "port-unreach";
115         case FW3_REJECT_CODE_ADM_PROHIBITED:
116                 return family == FW3_FAMILY_V6 ? "adm-prohibited": "admin-prohib";
117         default:
118                 return "unknown";
119         }
120 }
121 
122 void
123 fw3_load_defaults(struct fw3_state *state, struct uci_package *p)
124 {
125         struct uci_section *s;
126         struct uci_element *e;
127         struct fw3_defaults *defs = &state->defaults;
128 
129         bool seen = false;
130 
131         defs->tcp_reject_code      = FW3_REJECT_CODE_TCP_RESET;
132         defs->any_reject_code      = FW3_REJECT_CODE_PORT_UNREACH;
133         defs->syn_flood_rate.rate  = 25;
134         defs->syn_flood_rate.burst = 50;
135         defs->tcp_syncookies       = true;
136         defs->tcp_window_scaling   = true;
137         defs->custom_chains        = true;
138         defs->auto_helper          = true;
139 
140         uci_foreach_element(&p->sections, e)
141         {
142                 s = uci_to_section(e);
143 
144                 if (strcmp(s->type, "defaults"))
145                         continue;
146 
147                 if (seen)
148                 {
149                         warn_elem(e, "ignoring duplicate section");
150                         continue;
151                 }
152 
153                 if(!fw3_parse_options(&state->defaults, fw3_flag_opts, s))
154                         warn_elem(e, "has invalid options");
155 
156                 check_policy(e, &defs->policy_input, "input");
157                 check_policy(e, &defs->policy_output, "output");
158                 check_policy(e, &defs->policy_forward, "forward");
159 
160                 check_any_reject_code(e, &defs->any_reject_code);
161 
162                 /* exists in both ipv4 and ipv6, if at all, so only check ipv4 */
163                 check_target(e, &defs->flow_offloading, "FLOWOFFLOAD", false);
164         }
165 }
166 
167 void
168 fw3_print_default_chains(struct fw3_ipt_handle *handle, struct fw3_state *state,
169                          bool reload)
170 {
171         struct fw3_defaults *defs = &state->defaults;
172         const struct fw3_chain_spec *c;
173 
174 #define policy(t) \
175         ((t == FW3_FLAG_REJECT) ? FW3_FLAG_DROP : t)
176 
177         if (handle->family == FW3_FAMILY_V6 && defs->disable_ipv6)
178                 return;
179 
180         if (handle->table == FW3_TABLE_FILTER)
181         {
182                 fw3_ipt_set_policy(handle, "INPUT",   policy(defs->policy_input));
183                 fw3_ipt_set_policy(handle, "OUTPUT",  policy(defs->policy_output));
184                 fw3_ipt_set_policy(handle, "FORWARD", policy(defs->policy_forward));
185         }
186 
187         if (defs->custom_chains)
188                 set(defs->flags, handle->family, FW3_FLAG_CUSTOM_CHAINS);
189 
190         if (defs->syn_flood)
191                 set(defs->flags, handle->family, FW3_FLAG_SYN_FLOOD);
192 
193         for (c = default_chains; c->format; c++)
194         {
195                 /* don't touch user chains on selective stop */
196                 if (reload && c->flag == FW3_FLAG_CUSTOM_CHAINS)
197                         continue;
198 
199                 if (!fw3_is_family(c, handle->family))
200                         continue;
201 
202                 if (c->table != handle->table)
203                         continue;
204 
205                 if (c->flag &&
206                     !fw3_hasbit(defs->flags[handle->family == FW3_FAMILY_V6], c->flag))
207                         continue;
208 
209                 fw3_ipt_create_chain(handle, c->format);
210         }
211 
212         set(defs->flags, handle->family, handle->table);
213 }
214 
215 void
216 fw3_print_default_head_rules(struct fw3_ipt_handle *handle,
217                              struct fw3_state *state, bool reload)
218 {
219         int i;
220         struct fw3_defaults *defs = &state->defaults;
221         struct fw3_device lodev = { .set = true };
222         struct fw3_protocol tcp = { .protocol = 6 };
223         struct fw3_ipt_rule *r;
224 
225         const char *chains[] = {
226                 "INPUT", "input",
227                 "OUTPUT", "output",
228                 "FORWARD", "forwarding",
229         };
230 
231         switch (handle->table)
232         {
233         case FW3_TABLE_FILTER:
234 
235                 sprintf(lodev.name, "lo");
236 
237                 r = fw3_ipt_rule_create(handle, NULL, &lodev, NULL, NULL, NULL);
238                 fw3_ipt_rule_target(r, "ACCEPT");
239                 fw3_ipt_rule_append(r, "INPUT");
240 
241                 r = fw3_ipt_rule_create(handle, NULL, NULL, &lodev, NULL, NULL);
242                 fw3_ipt_rule_target(r, "ACCEPT");
243                 fw3_ipt_rule_append(r, "OUTPUT");
244 
245                 if (defs->custom_chains)
246                 {
247                         for (i = 0; i < ARRAY_SIZE(chains); i += 2)
248                         {
249                                 r = fw3_ipt_rule_new(handle);
250                                 fw3_ipt_rule_comment(r, "Custom %s rule chain", chains[i+1]);
251                                 fw3_ipt_rule_target(r, "%s_rule", chains[i+1]);
252                                 fw3_ipt_rule_append(r, chains[i]);
253                         }
254                 }
255 
256                 if (defs->flow_offloading)
257                 {
258                         r = fw3_ipt_rule_new(handle);
259                         fw3_ipt_rule_comment(r, "Traffic offloading");
260                         fw3_ipt_rule_extra(r, "-m conntrack --ctstate RELATED,ESTABLISHED");
261                         fw3_ipt_rule_target(r, "FLOWOFFLOAD");
262                         if (defs->flow_offloading_hw)
263                                 fw3_ipt_rule_addarg(r, false, "--hw", NULL);
264                         fw3_ipt_rule_append(r, "FORWARD");
265                 }
266 
267                 for (i = 0; i < ARRAY_SIZE(chains); i += 2)
268                 {
269                         r = fw3_ipt_rule_new(handle);
270                         fw3_ipt_rule_extra(r, "-m conntrack --ctstate RELATED,ESTABLISHED");
271                         fw3_ipt_rule_target(r, "ACCEPT");
272                         fw3_ipt_rule_append(r, chains[i]);
273 
274                         if (defs->drop_invalid)
275                         {
276                                 r = fw3_ipt_rule_new(handle);
277                                 fw3_ipt_rule_extra(r, "-m conntrack --ctstate INVALID");
278                                 fw3_ipt_rule_target(r, "DROP");
279                                 fw3_ipt_rule_append(r, chains[i]);
280                         }
281                 }
282 
283                 if (defs->syn_flood)
284                 {
285                         r = fw3_ipt_rule_create(handle, &tcp, NULL, NULL, NULL, NULL);
286                         fw3_ipt_rule_extra(r, "--syn");
287                         fw3_ipt_rule_limit(r, &defs->syn_flood_rate);
288                         fw3_ipt_rule_target(r, "RETURN");
289                         fw3_ipt_rule_append(r, "syn_flood");
290 
291                         r = fw3_ipt_rule_new(handle);
292                         fw3_ipt_rule_target(r, "DROP");
293                         fw3_ipt_rule_append(r, "syn_flood");
294 
295                         r = fw3_ipt_rule_create(handle, &tcp, NULL, NULL, NULL, NULL);
296                         fw3_ipt_rule_extra(r, "--syn");
297                         fw3_ipt_rule_target(r, "syn_flood");
298                         fw3_ipt_rule_append(r, "INPUT");
299                 }
300 
301                 r = fw3_ipt_rule_create(handle, &tcp, NULL, NULL, NULL, NULL);
302                 fw3_ipt_rule_target(r, "REJECT");
303                 fw3_ipt_rule_addarg(r, false, "--reject-with", get_reject_code(handle->family, defs->tcp_reject_code));
304                 fw3_ipt_rule_append(r, "reject");
305 
306                 r = fw3_ipt_rule_new(handle);
307                 fw3_ipt_rule_target(r, "REJECT");
308                 fw3_ipt_rule_addarg(r, false, "--reject-with", get_reject_code(handle->family, defs->any_reject_code));
309                 fw3_ipt_rule_append(r, "reject");
310 
311                 break;
312 
313         case FW3_TABLE_NAT:
314                 if (defs->custom_chains)
315                 {
316                         r = fw3_ipt_rule_new(handle);
317                         fw3_ipt_rule_comment(r, "Custom prerouting rule chain");
318                         fw3_ipt_rule_target(r, "prerouting_rule");
319                         fw3_ipt_rule_append(r, "PREROUTING");
320 
321                         r = fw3_ipt_rule_new(handle);
322                         fw3_ipt_rule_comment(r, "Custom postrouting rule chain");
323                         fw3_ipt_rule_target(r, "postrouting_rule");
324                         fw3_ipt_rule_append(r, "POSTROUTING");
325                 }
326                 break;
327 
328         default:
329                 break;
330         }
331 }
332 
333 void
334 fw3_print_default_tail_rules(struct fw3_ipt_handle *handle,
335                              struct fw3_state *state, bool reload)
336 {
337         struct fw3_defaults *defs = &state->defaults;
338         struct fw3_ipt_rule *r;
339 
340         if (handle->table != FW3_TABLE_FILTER)
341                 return;
342 
343         if (defs->policy_input == FW3_FLAG_REJECT)
344         {
345                 r = fw3_ipt_rule_new(handle);
346 
347                 if (!r)
348                         return;
349 
350                 fw3_ipt_rule_target(r, "reject");
351                 fw3_ipt_rule_append(r, "INPUT");
352         }
353 
354         if (defs->policy_output == FW3_FLAG_REJECT)
355         {
356                 r = fw3_ipt_rule_new(handle);
357 
358                 if (!r)
359                         return;
360 
361                 fw3_ipt_rule_target(r, "reject");
362                 fw3_ipt_rule_append(r, "OUTPUT");
363         }
364 
365         if (defs->policy_forward == FW3_FLAG_REJECT)
366         {
367                 r = fw3_ipt_rule_new(handle);
368 
369                 if (!r)
370                         return;
371 
372                 fw3_ipt_rule_target(r, "reject");
373                 fw3_ipt_rule_append(r, "FORWARD");
374         }
375 }
376 
377 static void
378 set_default(const char *name, int set)
379 {
380         FILE *f;
381         char path[sizeof("/proc/sys/net/ipv4/tcp_window_scaling\0")];
382 
383         snprintf(path, sizeof(path), "/proc/sys/net/ipv4/tcp_%s", name);
384 
385         info(" * Set tcp_%s to %s", name, set ? "on" : "off");
386 
387         if (!(f = fopen(path, "w")))
388         {
389                 info("   ! Unable to write value: %s", strerror(errno));
390                 return;
391         }
392 
393         fprintf(f, "%u\n", set);
394         fclose(f);
395 }
396 
397 void
398 fw3_set_defaults(struct fw3_state *state)
399 {
400         set_default("ecn",            state->defaults.tcp_ecn);
401         set_default("syncookies",     state->defaults.tcp_syncookies);
402         set_default("window_scaling", state->defaults.tcp_window_scaling);
403 }
404 
405 void
406 fw3_flush_rules(struct fw3_ipt_handle *handle, struct fw3_state *state,
407                 bool reload)
408 {
409         enum fw3_flag policy = reload ? FW3_FLAG_DROP : FW3_FLAG_ACCEPT;
410         struct fw3_defaults *defs = &state->defaults;
411         const struct fw3_chain_spec *c;
412 
413         if (!has(defs->flags, handle->family, handle->table))
414                 return;
415 
416         if (handle->table == FW3_TABLE_FILTER)
417         {
418                 fw3_ipt_set_policy(handle, "INPUT",   policy);
419                 fw3_ipt_set_policy(handle, "OUTPUT",  policy);
420                 fw3_ipt_set_policy(handle, "FORWARD", policy);
421         }
422 
423         fw3_ipt_delete_id_rules(handle, "INPUT");
424         fw3_ipt_delete_id_rules(handle, "OUTPUT");
425         fw3_ipt_delete_id_rules(handle, "FORWARD");
426         fw3_ipt_delete_id_rules(handle, "PREROUTING");
427         fw3_ipt_delete_id_rules(handle, "POSTROUTING");
428 
429         for (c = default_chains; c->format; c++)
430         {
431                 /* don't touch user chains on selective stop */
432                 if (reload && c->flag == FW3_FLAG_CUSTOM_CHAINS)
433                         continue;
434 
435                 if (!fw3_is_family(c, handle->family))
436                         continue;
437 
438                 if (c->table != handle->table)
439                         continue;
440 
441                 if (c->flag && !has(defs->flags, handle->family, c->flag))
442                         continue;
443 
444                 fw3_ipt_flush_chain(handle, c->format);
445 
446                 /* keep certain basic chains that do not depend on any settings to
447                    avoid purging unrelated user rules pointing to them */
448                 if (reload && !c->flag)
449                         continue;
450 
451                 fw3_ipt_delete_chain(handle, c->format);
452         }
453 
454         del(defs->flags, handle->family, handle->table);
455 }
456 
457 void
458 fw3_flush_all(struct fw3_ipt_handle *handle)
459 {
460         if (handle->table == FW3_TABLE_FILTER)
461         {
462                 fw3_ipt_set_policy(handle, "INPUT",   FW3_FLAG_ACCEPT);
463                 fw3_ipt_set_policy(handle, "OUTPUT",  FW3_FLAG_ACCEPT);
464                 fw3_ipt_set_policy(handle, "FORWARD", FW3_FLAG_ACCEPT);
465         }
466 
467         fw3_ipt_flush(handle);
468 }
469 

This page was automatically generated by LXR 0.3.1.  •  OpenWrt