defaults.c

   1 /*
   2  * firewall3 - 3rd OpenWrt UCI firewall implementation
   3  *
   4  *   Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
   5  *
   6  * Permission to use, copy, modify, and/or distribute this software for any
   7  * purpose with or without fee is hereby granted, provided that the above
   8  * copyright notice and this permission notice appear in all copies.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17  */
  18
  19 #include "defaults.h"
  20
  21
  22 #define C(f, tbl, def, fmt) \
  23         { FW3_FAMILY_##f, FW3_TABLE_##tbl, FW3_FLAG_##def, fmt }
  24
  25 static const struct fw3_chain_spec default_chains[] = {
  26         C(ANY, FILTER, UNSPEC,        "delegate_input"),
  27         C(ANY, FILTER, UNSPEC,        "delegate_output"),
  28         C(ANY, FILTER, UNSPEC,        "delegate_forward"),
  29         C(ANY, FILTER, UNSPEC,        "reject"),
  30         C(ANY, FILTER, CUSTOM_CHAINS, "input_rule"),
  31         C(ANY, FILTER, CUSTOM_CHAINS, "output_rule"),
  32         C(ANY, FILTER, CUSTOM_CHAINS, "forwarding_rule"),
  33         C(ANY, FILTER, SYN_FLOOD,     "syn_flood"),
  34
  35         C(V4,  NAT,    UNSPEC,        "delegate_prerouting"),
  36         C(V4,  NAT,    UNSPEC,        "delegate_postrouting"),
  37         C(V4,  NAT,    CUSTOM_CHAINS, "prerouting_rule"),
  38         C(V4,  NAT,    CUSTOM_CHAINS, "postrouting_rule"),
  39
  40         C(ANY, MANGLE, UNSPEC,        "mssfix"),
  41         C(ANY, MANGLE, UNSPEC,        "fwmark"),
  42
  43         C(ANY, RAW,    UNSPEC,        "notrack"),
  44
  45         { }
  46 };
  47
  48 const struct fw3_option fw3_flag_opts[] = {
  49         FW3_OPT("input",               target,   defaults, policy_input),
  50         FW3_OPT("forward",             target,   defaults, policy_forward),
  51         FW3_OPT("output",              target,   defaults, policy_output),
  52
  53         FW3_OPT("drop_invalid",        bool,     defaults, drop_invalid),
  54
  55         FW3_OPT("syn_flood",           bool,     defaults, syn_flood),
  56         FW3_OPT("synflood_protect",    bool,     defaults, syn_flood),
  57         FW3_OPT("synflood_rate",       limit,    defaults, syn_flood_rate),
  58         FW3_OPT("synflood_burst",      int,      defaults, syn_flood_rate.burst),
  59
  60         FW3_OPT("tcp_syncookies",      bool,     defaults, tcp_syncookies),
  61         FW3_OPT("tcp_ecn",             bool,     defaults, tcp_ecn),
  62         FW3_OPT("tcp_window_scaling",  bool,     defaults, tcp_window_scaling),
  63
  64         FW3_OPT("accept_redirects",    bool,     defaults, accept_redirects),
  65         FW3_OPT("accept_source_route", bool,     defaults, accept_source_route),
  66
  67         FW3_OPT("custom_chains",       bool,     defaults, custom_chains),
  68         FW3_OPT("disable_ipv6",        bool,     defaults, disable_ipv6),
  69
  70         FW3_OPT("__flags_v4",          int,      defaults, flags[0]),
  71         FW3_OPT("__flags_v6",          int,      defaults, flags[1]),
  72
  73         { }
  74 };
  75
  76
  77 static void
  78 check_policy(struct uci_element *e, enum fw3_flag *pol, const char *name)
  79 {
  80         if (*pol == FW3_FLAG_UNSPEC)
  81         {
  82                 warn_elem(e, "has no %s policy specified, defaulting to DROP", name);
  83                 *pol = FW3_FLAG_DROP;
  84         }
  85         else if (*pol > FW3_FLAG_DROP)
  86         {
  87                 warn_elem(e, "has invalid %s policy, defaulting to DROP", name);
  88                 *pol = FW3_FLAG_DROP;
  89         }
  90 }
  91
  92 void
  93 fw3_load_defaults(struct fw3_state *state, struct uci_package *p)
  94 {
  95         struct uci_section *s;
  96         struct uci_element *e;
  97         struct fw3_defaults *defs = &state->defaults;
  98
  99         bool seen = false;
 100
 101         defs->syn_flood_rate.rate  = 25;
 102         defs->syn_flood_rate.burst = 50;
 103         defs->tcp_syncookies       = true;
 104         defs->tcp_window_scaling   = true;
 105         defs->custom_chains        = true;
 106
 107         uci_foreach_element(&p->sections, e)
 108         {
 109                 s = uci_to_section(e);
 110
 111                 if (strcmp(s->type, "defaults"))
 112                         continue;
 113
 114                 if (seen)
 115                 {
 116                         warn_elem(e, "ignoring duplicate section");
 117                         continue;
 118                 }
 119
 120                 fw3_parse_options(&state->defaults, fw3_flag_opts, s);
 121
 122                 check_policy(e, &defs->policy_input, "input");
 123                 check_policy(e, &defs->policy_output, "output");
 124                 check_policy(e, &defs->policy_forward, "forward");
 125         }
 126 }
 127
 128 void
 129 fw3_print_default_chains(struct fw3_ipt_handle *handle, struct fw3_state *state,
 130                          bool reload)
 131 {
 132         struct fw3_defaults *defs = &state->defaults;
 133         const struct fw3_chain_spec *c;
 134
 135 #define policy(t) \
 136         ((t == FW3_FLAG_REJECT) ? FW3_FLAG_DROP : t)
 137
 138         if (handle->family == FW3_FAMILY_V6 && defs->disable_ipv6)
 139                 return;
 140
 141         if (handle->table == FW3_TABLE_FILTER)
 142         {
 143                 fw3_ipt_set_policy(handle, "INPUT",   policy(defs->policy_input));
 144                 fw3_ipt_set_policy(handle, "OUTPUT",  policy(defs->policy_output));
 145                 fw3_ipt_set_policy(handle, "FORWARD", policy(defs->policy_forward));
 146         }
 147
 148         if (defs->custom_chains)
 149                 set(defs->flags, handle->family, FW3_FLAG_CUSTOM_CHAINS);
 150
 151         if (defs->syn_flood)
 152                 set(defs->flags, handle->family, FW3_FLAG_SYN_FLOOD);
 153
 154         for (c = default_chains; c->format; c++)
 155         {
 156                 /* don't touch user chains on selective stop */
 157                 if (reload && c->flag == FW3_FLAG_CUSTOM_CHAINS)
 158                         continue;
 159
 160                 if (!fw3_is_family(c, handle->family))
 161                         continue;
 162
 163                 if (c->table != handle->table)
 164                         continue;
 165
 166                 if (c->flag &&
 167                     !hasbit(defs->flags[handle->family == FW3_FAMILY_V6], c->flag))
 168                         continue;
 169
 170                 fw3_ipt_create_chain(handle, c->format);
 171         }
 172
 173         set(defs->flags, handle->family, handle->table);
 174 }
 175
 176
 177 struct toplevel_rule {
 178         enum fw3_table table;
 179         const char *chain;
 180         const char *target;
 181 };
 182
 183 void
 184 fw3_print_default_head_rules(struct fw3_ipt_handle *handle,
 185                              struct fw3_state *state, bool reload)
 186 {
 187         int i;
 188         struct fw3_defaults *defs = &state->defaults;
 189         struct fw3_device lodev = { .set = true };
 190         struct fw3_protocol tcp = { .protocol = 6 };
 191         struct fw3_ipt_rule *r;
 192         struct toplevel_rule *tr;
 193
 194         const char *chains[] = {
 195                 "delegate_input", "input",
 196                 "delegate_output", "output",
 197                 "delegate_forward", "forwarding",
 198         };
 199
 200         struct toplevel_rule rules[] = {
 201                 { FW3_TABLE_FILTER, "INPUT",       "delegate_input" },
 202                 { FW3_TABLE_FILTER, "OUTPUT",      "delegate_output" },
 203                 { FW3_TABLE_FILTER, "FORWARD",     "delegate_forward" },
 204
 205                 { FW3_TABLE_NAT,    "PREROUTING",  "delegate_prerouting" },
 206                 { FW3_TABLE_NAT,    "POSTROUTING", "delegate_postrouting" },
 207
 208                 { FW3_TABLE_MANGLE, "FORWARD",     "mssfix" },
 209                 { FW3_TABLE_MANGLE, "PREROUTING",  "fwmark" },
 210
 211                 { FW3_TABLE_RAW,    "PREROUTING",  "notrack" },
 212
 213                 { 0, NULL },
 214         };
 215
 216         for (tr = rules; tr->chain; tr++)
 217         {
 218                 if (tr->table != handle->table)
 219                         continue;
 220
 221                 r = fw3_ipt_rule_new(handle);
 222                 fw3_ipt_rule_target(r, tr->target);
 223                 fw3_ipt_rule_replace(r, tr->chain);
 224         }
 225
 226         switch (handle->table)
 227         {
 228         case FW3_TABLE_FILTER:
 229
 230                 sprintf(lodev.name, "lo");
 231
 232                 r = fw3_ipt_rule_create(handle, NULL, &lodev, NULL, NULL, NULL);
 233                 fw3_ipt_rule_target(r, "ACCEPT");
 234                 fw3_ipt_rule_append(r, "delegate_input");
 235
 236                 r = fw3_ipt_rule_create(handle, NULL, NULL, &lodev, NULL, NULL);
 237                 fw3_ipt_rule_target(r, "ACCEPT");
 238                 fw3_ipt_rule_append(r, "delegate_output");
 239
 240                 if (defs->custom_chains)
 241                 {
 242                         for (i = 0; i < ARRAY_SIZE(chains); i += 2)
 243                         {
 244                                 r = fw3_ipt_rule_new(handle);
 245                                 fw3_ipt_rule_comment(r, "user chain for %s", chains[i+1]);
 246                                 fw3_ipt_rule_target(r, "%s_rule", chains[i+1]);
 247                                 fw3_ipt_rule_append(r, chains[i]);
 248                         }
 249                 }
 250
 251                 for (i = 0; i < ARRAY_SIZE(chains); i += 2)
 252                 {
 253                         r = fw3_ipt_rule_new(handle);
 254                         fw3_ipt_rule_extra(r, "-m conntrack --ctstate RELATED,ESTABLISHED");
 255                         fw3_ipt_rule_target(r, "ACCEPT");
 256                         fw3_ipt_rule_append(r, chains[i]);
 257
 258                         if (defs->drop_invalid)
 259                         {
 260                                 r = fw3_ipt_rule_new(handle);
 261                                 fw3_ipt_rule_extra(r, "-m conntrack --ctstate INVALID");
 262                                 fw3_ipt_rule_target(r, "DROP");
 263                                 fw3_ipt_rule_append(r, chains[i]);
 264                         }
 265                 }
 266
 267                 if (defs->syn_flood)
 268                 {
 269                         r = fw3_ipt_rule_create(handle, &tcp, NULL, NULL, NULL, NULL);
 270                         fw3_ipt_rule_extra(r, "--syn");
 271                         fw3_ipt_rule_limit(r, &defs->syn_flood_rate);
 272                         fw3_ipt_rule_target(r, "RETURN");
 273                         fw3_ipt_rule_append(r, "syn_flood");
 274
 275                         r = fw3_ipt_rule_new(handle);
 276                         fw3_ipt_rule_target(r, "DROP");
 277                         fw3_ipt_rule_append(r, "syn_flood");
 278
 279                         r = fw3_ipt_rule_create(handle, &tcp, NULL, NULL, NULL, NULL);
 280                         fw3_ipt_rule_extra(r, "--syn");
 281                         fw3_ipt_rule_target(r, "syn_flood");
 282                         fw3_ipt_rule_append(r, "delegate_input");
 283                 }
 284
 285                 r = fw3_ipt_rule_create(handle, &tcp, NULL, NULL, NULL, NULL);
 286                 fw3_ipt_rule_target(r, "REJECT");
 287                 fw3_ipt_rule_addarg(r, false, "--reject-with", "tcp-reset");
 288                 fw3_ipt_rule_append(r, "reject");
 289
 290                 r = fw3_ipt_rule_new(handle);
 291                 fw3_ipt_rule_target(r, "REJECT");
 292                 fw3_ipt_rule_addarg(r, false, "--reject-with", "port-unreach");
 293                 fw3_ipt_rule_append(r, "reject");
 294
 295                 break;
 296
 297         case FW3_TABLE_NAT:
 298                 if (defs->custom_chains)
 299                 {
 300                         r = fw3_ipt_rule_new(handle);
 301                         fw3_ipt_rule_comment(r, "user chain for prerouting");
 302                         fw3_ipt_rule_target(r, "prerouting_rule");
 303                         fw3_ipt_rule_append(r, "delegate_prerouting");
 304
 305                         r = fw3_ipt_rule_new(handle);
 306                         fw3_ipt_rule_comment(r, "user chain for postrouting");
 307                         fw3_ipt_rule_target(r, "postrouting_rule");
 308                         fw3_ipt_rule_append(r, "delegate_postrouting");
 309                 }
 310                 break;
 311
 312         default:
 313                 break;
 314         }
 315 }
 316
 317 void
 318 fw3_print_default_tail_rules(struct fw3_ipt_handle *handle,
 319                              struct fw3_state *state, bool reload)
 320 {
 321         struct fw3_defaults *defs = &state->defaults;
 322         struct fw3_ipt_rule *r;
 323
 324         if (handle->table != FW3_TABLE_FILTER)
 325                 return;
 326
 327         if (defs->policy_input == FW3_FLAG_REJECT)
 328         {
 329                 r = fw3_ipt_rule_new(handle);
 330
 331                 if (!r)
 332                         return;
 333
 334                 fw3_ipt_rule_target(r, "reject");
 335                 fw3_ipt_rule_append(r, "delegate_input");
 336         }
 337
 338         if (defs->policy_output == FW3_FLAG_REJECT)
 339         {
 340                 r = fw3_ipt_rule_new(handle);
 341
 342                 if (!r)
 343                         return;
 344
 345                 fw3_ipt_rule_target(r, "reject");
 346                 fw3_ipt_rule_append(r, "delegate_output");
 347         }
 348
 349         if (defs->policy_forward == FW3_FLAG_REJECT)
 350         {
 351                 r = fw3_ipt_rule_new(handle);
 352
 353                 if (!r)
 354                         return;
 355
 356                 fw3_ipt_rule_target(r, "reject");
 357                 fw3_ipt_rule_append(r, "delegate_forward");
 358         }
 359 }
 360
 361 static void
 362 set_default(const char *name, bool set)
 363 {
 364         FILE *f;
 365         char path[sizeof("/proc/sys/net/ipv4/tcp_window_scaling\0")];
 366
 367         snprintf(path, sizeof(path), "/proc/sys/net/ipv4/tcp_%s", name);
 368
 369         info(" * Set tcp_%s to %s", name, set ? "on" : "off", name);
 370
 371         if (!(f = fopen(path, "w")))
 372         {
 373                 info("   ! Unable to write value: %s", strerror(errno));
 374                 return;
 375         }
 376
 377         fprintf(f, "%u\n", set);
 378         fclose(f);
 379 }
 380
 381 void
 382 fw3_set_defaults(struct fw3_state *state)
 383 {
 384         set_default("ecn",            state->defaults.tcp_ecn);
 385         set_default("syncookies",     state->defaults.tcp_syncookies);
 386         set_default("window_scaling", state->defaults.tcp_window_scaling);
 387 }
 388
 389 void
 390 fw3_flush_rules(struct fw3_ipt_handle *handle, struct fw3_state *state,
 391                 bool reload)
 392 {
 393         enum fw3_flag policy = reload ? FW3_FLAG_DROP : FW3_FLAG_ACCEPT;
 394         struct fw3_defaults *defs = &state->defaults;
 395         const struct fw3_chain_spec *c;
 396
 397         if (!has(defs->flags, handle->family, handle->table))
 398                 return;
 399
 400         if (handle->table == FW3_TABLE_FILTER)
 401         {
 402                 fw3_ipt_set_policy(handle, "INPUT",   policy);
 403                 fw3_ipt_set_policy(handle, "OUTPUT",  policy);
 404                 fw3_ipt_set_policy(handle, "FORWARD", policy);
 405         }
 406
 407         for (c = default_chains; c->format; c++)
 408         {
 409                 /* don't touch user chains on selective stop */
 410                 if (reload && c->flag == FW3_FLAG_CUSTOM_CHAINS)
 411                         continue;
 412
 413                 if (!fw3_is_family(c, handle->family))
 414                         continue;
 415
 416                 if (c->table != handle->table)
 417                         continue;
 418
 419                 if (c->flag && !has(defs->flags, handle->family, c->flag))
 420                         continue;
 421
 422                 fw3_ipt_flush_chain(handle, c->format);
 423
 424                 /* keep certain basic chains that do not depend on any settings to
 425                    avoid purging unrelated user rules pointing to them */
 426                 if (reload && !c->flag)
 427                         continue;
 428
 429                 fw3_ipt_delete_chain(handle, c->format);
 430         }
 431
 432         del(defs->flags, handle->family, handle->table);
 433 }
 434
 435 void
 436 fw3_flush_all(struct fw3_ipt_handle *handle)
 437 {
 438         if (handle->table == FW3_TABLE_FILTER)
 439         {
 440                 fw3_ipt_set_policy(handle, "INPUT",   FW3_FLAG_ACCEPT);
 441                 fw3_ipt_set_policy(handle, "OUTPUT",  FW3_FLAG_ACCEPT);
 442                 fw3_ipt_set_policy(handle, "FORWARD", FW3_FLAG_ACCEPT);
 443         }
 444
 445         fw3_ipt_flush(handle);
 446 }