defaults.c

   1 /*
   2  * firewall3 - 3rd OpenWrt UCI firewall implementation
   3  *
   4  *   Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
   5  *
   6  * Permission to use, copy, modify, and/or distribute this software for any
   7  * purpose with or without fee is hereby granted, provided that the above
   8  * copyright notice and this permission notice appear in all copies.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17  */
  18
  19 #include "defaults.h"
  20
  21
  22 static struct fw3_option default_opts[] = {
  23         FW3_OPT("input",               target,   defaults, policy_input),
  24         FW3_OPT("forward",             target,   defaults, policy_forward),
  25         FW3_OPT("output",              target,   defaults, policy_output),
  26
  27         FW3_OPT("drop_invalid",        bool,     defaults, drop_invalid),
  28
  29         FW3_OPT("syn_flood",           bool,     defaults, syn_flood),
  30         FW3_OPT("synflood_protect",    bool,     defaults, syn_flood),
  31         FW3_OPT("synflood_rate",       limit,    defaults, syn_flood_rate),
  32         FW3_OPT("synflood_burst",      int,      defaults, syn_flood_rate.burst),
  33
  34         FW3_OPT("tcp_syncookies",      bool,     defaults, tcp_syncookies),
  35         FW3_OPT("tcp_ecn",             bool,     defaults, tcp_ecn),
  36         FW3_OPT("tcp_westwood",        bool,     defaults, tcp_westwood),
  37         FW3_OPT("tcp_window_scaling",  bool,     defaults, tcp_window_scaling),
  38
  39         FW3_OPT("accept_redirects",    bool,     defaults, accept_redirects),
  40         FW3_OPT("accept_source_route", bool,     defaults, accept_source_route),
  41
  42         FW3_OPT("custom_chains",       bool,     defaults, custom_chains),
  43         FW3_OPT("disable_ipv6",        bool,     defaults, disable_ipv6),
  44 };
  45
  46
  47 static void
  48 check_policy(struct uci_element *e, enum fw3_target *pol, const char *name)
  49 {
  50         if (*pol == FW3_TARGET_UNSPEC)
  51         {
  52                 warn_elem(e, "has no %s policy specified, defaulting to DROP", name);
  53                 *pol = FW3_TARGET_DROP;
  54         }
  55         else if (*pol > FW3_TARGET_DROP)
  56         {
  57                 warn_elem(e, "has invalid %s policy, defaulting to DROP", name);
  58                 *pol = FW3_TARGET_DROP;
  59         }
  60 }
  61
  62 void
  63 fw3_load_defaults(struct fw3_state *state, struct uci_package *p)
  64 {
  65         struct uci_section *s;
  66         struct uci_element *e;
  67         struct fw3_defaults *defs = &state->defaults;
  68
  69         bool seen = false;
  70
  71         defs->syn_flood_rate.rate  = 25;
  72         defs->syn_flood_rate.burst = 50;
  73         defs->tcp_syncookies       = true;
  74         defs->tcp_window_scaling   = true;
  75         defs->custom_chains        = true;
  76
  77         uci_foreach_element(&p->sections, e)
  78         {
  79                 s = uci_to_section(e);
  80
  81                 if (strcmp(s->type, "defaults"))
  82                         continue;
  83
  84                 if (seen)
  85                 {
  86                         warn_elem(e, "ignoring duplicate section");
  87                         continue;
  88                 }
  89
  90                 fw3_parse_options(&state->defaults,
  91                                   default_opts, ARRAY_SIZE(default_opts), s);
  92
  93                 check_policy(e, &defs->policy_input, "input");
  94                 check_policy(e, &defs->policy_output, "output");
  95                 check_policy(e, &defs->policy_forward, "forward");
  96         }
  97 }
  98
  99 void
 100 fw3_print_default_chains(enum fw3_table table, enum fw3_family family,
 101                          struct fw3_state *state)
 102 {
 103         struct fw3_defaults *defs = &state->defaults;
 104         const char *policy[] = {
 105                 "(bug)",
 106                 "ACCEPT",
 107                 "DROP",
 108                 "DROP",
 109                 "(bug)",
 110                 "(bug)",
 111                 "(bug)",
 112         };
 113
 114         switch (table)
 115         {
 116         case FW3_TABLE_FILTER:
 117                 fw3_pr(":INPUT %s [0:0]\n", policy[defs->policy_input]);
 118                 fw3_pr(":FORWARD %s [0:0]\n", policy[defs->policy_forward]);
 119                 fw3_pr(":OUTPUT %s [0:0]\n", policy[defs->policy_output]);
 120
 121                 if (defs->custom_chains)
 122                 {
 123                         fw3_pr(":input_rule - [0:0]\n");
 124                         fw3_pr(":output_rule - [0:0]\n");
 125                         fw3_pr(":forwarding_rule - [0:0]\n");
 126                 }
 127
 128                 fw3_pr(":delegate_input - [0:0]\n");
 129                 fw3_pr(":delegate_output - [0:0]\n");
 130                 fw3_pr(":delegate_forward - [0:0]\n");
 131                 fw3_pr(":reject - [0:0]\n");
 132                 fw3_pr(":syn_flood - [0:0]\n");
 133                 break;
 134
 135         case FW3_TABLE_NAT:
 136                 if (defs->custom_chains)
 137                 {
 138                         fw3_pr(":prerouting_rule - [0:0]\n");
 139                         fw3_pr(":postrouting_rule - [0:0]\n");
 140                 }
 141                 break;
 142
 143         case FW3_TABLE_MANGLE:
 144                 fw3_pr(":mssfix - [0:0]\n");
 145                 break;
 146
 147         case FW3_TABLE_RAW:
 148                 if (!defs->drop_invalid)
 149                         fw3_pr(":notrack - [0:0]\n");
 150                 break;
 151         }
 152 }
 153
 154 void
 155 fw3_print_default_rules(enum fw3_table table, enum fw3_family family,
 156                         struct fw3_state *state)
 157 {
 158         int i;
 159         struct fw3_defaults *defs = &state->defaults;
 160         const char *chains[] = {
 161                 "INPUT",
 162                 "OUTPUT",
 163                 "FORWARD",
 164         };
 165
 166         switch (table)
 167         {
 168         case FW3_TABLE_FILTER:
 169                 fw3_pr("-A INPUT -i lo -j ACCEPT\n");
 170                 fw3_pr("-A OUTPUT -o lo -j ACCEPT\n");
 171
 172                 for (i = 0; i < ARRAY_SIZE(chains); i++)
 173                 {
 174                         fw3_pr("-A %s -m conntrack --ctstate RELATED,ESTABLISHED "
 175                                "-j ACCEPT\n", chains[i]);
 176
 177                         if (defs->drop_invalid)
 178                         {
 179                                 fw3_pr("-A %s -m conntrack --ctstate INVALID -j DROP\n",
 180                                        chains[i]);
 181                         }
 182                 }
 183
 184                 if (defs->syn_flood)
 185                 {
 186                         fw3_pr("-A syn_flood -p tcp --syn");
 187                         fw3_format_limit(&defs->syn_flood_rate);
 188                         fw3_pr(" -j RETURN\n");
 189
 190                         fw3_pr("-A syn_flood -j DROP\n");
 191                         fw3_pr("-A INPUT -p tcp --syn -j syn_flood\n");
 192                 }
 193
 194                 if (defs->custom_chains)
 195                 {
 196                         fw3_pr("-A INPUT -j input_rule\n");
 197                         fw3_pr("-A OUTPUT -j output_rule\n");
 198                         fw3_pr("-A FORWARD -j forwarding_rule\n");
 199                 }
 200
 201                 fw3_pr("-A INPUT -j delegate_input\n");
 202                 fw3_pr("-A OUTPUT -j delegate_output\n");
 203                 fw3_pr("-A FORWARD -j delegate_forward\n");
 204
 205                 fw3_pr("-A reject -p tcp -j REJECT --reject-with tcp-reset\n");
 206                 fw3_pr("-A reject -j REJECT --reject-with port-unreach\n");
 207
 208                 if (defs->policy_input == FW3_TARGET_REJECT)
 209                         fw3_pr("-A INPUT -j reject\n");
 210
 211                 if (defs->policy_output == FW3_TARGET_REJECT)
 212                         fw3_pr("-A OUTPUT -j reject\n");
 213
 214                 if (defs->policy_forward == FW3_TARGET_REJECT)
 215                         fw3_pr("-A FORWARD -j reject\n");
 216
 217                 break;
 218
 219         case FW3_TABLE_NAT:
 220                 if (defs->custom_chains)
 221                 {
 222                         fw3_pr("-A PREROUTING -j prerouting_rule\n");
 223                         fw3_pr("-A POSTROUTING -j postrouting_rule\n");
 224                 }
 225                 break;
 226
 227         case FW3_TABLE_MANGLE:
 228                 fw3_pr("-A FORWARD -j mssfix\n");
 229                 break;
 230
 231         case FW3_TABLE_RAW:
 232                 if (!defs->drop_invalid)
 233                         fw3_pr("-A PREROUTING -j notrack\n");
 234                 break;
 235         }
 236 }
 237
 238 void
 239 fw3_print_flush_rules(enum fw3_table table, enum fw3_family family,
 240                                           struct fw3_state *state, bool complete)
 241 {
 242         switch (table)
 243         {
 244         case FW3_TABLE_FILTER:
 245                 fw3_pr(":INPUT ACCEPT [0:0]\n");
 246                 fw3_pr(":OUTPUT ACCEPT [0:0]\n");
 247                 fw3_pr(":FORWARD ACCEPT [0:0]\n");
 248                 /* fall through */
 249
 250         case FW3_TABLE_NAT:
 251                 fw3_pr("-F\n");
 252                 fw3_pr("-X\n");
 253                 break;
 254
 255         case FW3_TABLE_MANGLE:
 256                 if (complete)
 257                 {
 258                         fw3_pr("-F\n");
 259                         fw3_pr("-X\n");
 260                 }
 261                 else
 262                 {
 263                         fw3_pr("-D FORWARD -j mssfix\n");
 264                         fw3_pr("-F mssfix\n");
 265                         fw3_pr("-X mssfix\n");
 266                 }
 267                 break;
 268
 269         case FW3_TABLE_RAW:
 270                 if (complete)
 271                 {
 272                         fw3_pr("-F\n");
 273                         fw3_pr("-X\n");
 274                 }
 275                 else
 276                 {
 277                         fw3_pr("-D PREROUTING -j notrack\n");
 278                         fw3_pr("-F notrack\n");
 279                         fw3_pr("-X notrack\n");
 280                 }
 281                 break;
 282         }
 283 }