defaults.c

   1 /*
   2  * firewall3 - 3rd OpenWrt UCI firewall implementation
   3  *
   4  *   Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
   5  *
   6  * Permission to use, copy, modify, and/or distribute this software for any
   7  * purpose with or without fee is hereby granted, provided that the above
   8  * copyright notice and this permission notice appear in all copies.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17  */
  18
  19 #include "defaults.h"
  20
  21
  22 #define C(f, tbl, def, name) \
  23         { FW3_FAMILY_##f, FW3_TABLE_##tbl, FW3_DEFAULT_##def, name }
  24
  25 struct chain {
  26         enum fw3_family family;
  27         enum fw3_table table;
  28         enum fw3_default flag;
  29         const char *name;
  30 };
  31
  32 static const struct chain default_chains[] = {
  33         C(ANY, FILTER, UNSPEC,        "delegate_input"),
  34         C(ANY, FILTER, UNSPEC,        "delegate_output"),
  35         C(ANY, FILTER, UNSPEC,        "delegate_forward"),
  36         C(ANY, FILTER, UNSPEC,        "reject"),
  37         C(ANY, FILTER, CUSTOM_CHAINS, "input_rule"),
  38         C(ANY, FILTER, CUSTOM_CHAINS, "output_rule"),
  39         C(ANY, FILTER, CUSTOM_CHAINS, "forwarding_rule"),
  40         C(ANY, FILTER, SYN_FLOOD,     "syn_flood"),
  41
  42         C(V4,  NAT,    UNSPEC,        "delegate_prerouting"),
  43         C(V4,  NAT,    UNSPEC,        "delegate_postrouting"),
  44         C(V4,  NAT,    CUSTOM_CHAINS, "prerouting_rule"),
  45         C(V4,  NAT,    CUSTOM_CHAINS, "postrouting_rule"),
  46
  47         C(ANY, MANGLE, UNSPEC,        "mssfix"),
  48         C(ANY, RAW,    UNSPEC,        "notrack"),
  49 };
  50
  51 static const struct chain toplevel_rules[] = {
  52         C(ANY, FILTER, UNSPEC,        "INPUT -j delegate_input"),
  53         C(ANY, FILTER, UNSPEC,        "OUTPUT -j delegate_output"),
  54         C(ANY, FILTER, UNSPEC,        "FORWARD -j delegate_forward"),
  55
  56         C(V4,  NAT,    UNSPEC,        "PREROUTING -j delegate_prerouting"),
  57         C(V4,  NAT,    UNSPEC,        "POSTROUTING -j delegate_postrouting"),
  58
  59         C(ANY, MANGLE, UNSPEC,        "FORWARD -j mssfix"),
  60         C(ANY, RAW,    UNSPEC,        "PREROUTING -j notrack"),
  61 };
  62
  63 const struct fw3_option fw3_default_opts[] = {
  64         FW3_OPT("input",               target,   defaults, policy_input),
  65         FW3_OPT("forward",             target,   defaults, policy_forward),
  66         FW3_OPT("output",              target,   defaults, policy_output),
  67
  68         FW3_OPT("drop_invalid",        bool,     defaults, drop_invalid),
  69
  70         FW3_OPT("syn_flood",           bool,     defaults, syn_flood),
  71         FW3_OPT("synflood_protect",    bool,     defaults, syn_flood),
  72         FW3_OPT("synflood_rate",       limit,    defaults, syn_flood_rate),
  73         FW3_OPT("synflood_burst",      int,      defaults, syn_flood_rate.burst),
  74
  75         FW3_OPT("tcp_syncookies",      bool,     defaults, tcp_syncookies),
  76         FW3_OPT("tcp_ecn",             bool,     defaults, tcp_ecn),
  77         FW3_OPT("tcp_window_scaling",  bool,     defaults, tcp_window_scaling),
  78
  79         FW3_OPT("accept_redirects",    bool,     defaults, accept_redirects),
  80         FW3_OPT("accept_source_route", bool,     defaults, accept_source_route),
  81
  82         FW3_OPT("custom_chains",       bool,     defaults, custom_chains),
  83         FW3_OPT("disable_ipv6",        bool,     defaults, disable_ipv6),
  84
  85         { }
  86 };
  87
  88
  89 static bool
  90 print_chains(enum fw3_table table, enum fw3_family family,
  91              const char *fmt, uint32_t *flags, uint32_t mask,
  92              const struct chain *chains, int n)
  93 {
  94         bool rv = false;
  95         const struct chain *c;
  96         uint32_t f = flags ? flags[family == FW3_FAMILY_V6] : 0;
  97
  98         if (mask)
  99                 f &= mask;
 100
 101         for (c = chains; n > 0; c++, n--)
 102         {
 103                 if (!fw3_is_family(c, family))
 104                         continue;
 105
 106                 if (c->table != table)
 107                         continue;
 108
 109                 if ((c->flag != FW3_DEFAULT_UNSPEC) && !hasbit(f, c->flag))
 110                         continue;
 111
 112                 fw3_pr(fmt, c->name);
 113
 114                 rv = true;
 115         }
 116
 117         return rv;
 118 }
 119
 120 static void
 121 check_policy(struct uci_element *e, enum fw3_target *pol, const char *name)
 122 {
 123         if (*pol == FW3_TARGET_UNSPEC)
 124         {
 125                 warn_elem(e, "has no %s policy specified, defaulting to DROP", name);
 126                 *pol = FW3_TARGET_DROP;
 127         }
 128         else if (*pol > FW3_TARGET_DROP)
 129         {
 130                 warn_elem(e, "has invalid %s policy, defaulting to DROP", name);
 131                 *pol = FW3_TARGET_DROP;
 132         }
 133 }
 134
 135 void
 136 fw3_load_defaults(struct fw3_state *state, struct uci_package *p)
 137 {
 138         struct uci_section *s;
 139         struct uci_element *e;
 140         struct fw3_defaults *defs = &state->defaults;
 141
 142         bool seen = false;
 143
 144         defs->syn_flood_rate.rate  = 25;
 145         defs->syn_flood_rate.burst = 50;
 146         defs->tcp_syncookies       = true;
 147         defs->tcp_window_scaling   = true;
 148         defs->custom_chains        = true;
 149
 150         uci_foreach_element(&p->sections, e)
 151         {
 152                 s = uci_to_section(e);
 153
 154                 if (strcmp(s->type, "defaults"))
 155                         continue;
 156
 157                 if (seen)
 158                 {
 159                         warn_elem(e, "ignoring duplicate section");
 160                         continue;
 161                 }
 162
 163                 fw3_parse_options(&state->defaults, fw3_default_opts, s);
 164
 165                 check_policy(e, &defs->policy_input, "input");
 166                 check_policy(e, &defs->policy_output, "output");
 167                 check_policy(e, &defs->policy_forward, "forward");
 168         }
 169 }
 170
 171 void
 172 fw3_print_default_chains(enum fw3_table table, enum fw3_family family,
 173                          bool reload, struct fw3_state *state)
 174 {
 175         bool rv;
 176         struct fw3_defaults *defs = &state->defaults;
 177         uint32_t custom_mask = ~0;
 178
 179 #define policy(t) \
 180         ((t == FW3_TARGET_REJECT) ? "DROP" : fw3_flag_names[t])
 181
 182         if (family == FW3_FAMILY_V6 && defs->disable_ipv6)
 183                 return;
 184
 185         if (table == FW3_TABLE_FILTER)
 186         {
 187                 fw3_pr(":INPUT %s [0:0]\n", policy(defs->policy_input));
 188                 fw3_pr(":FORWARD %s [0:0]\n", policy(defs->policy_forward));
 189                 fw3_pr(":OUTPUT %s [0:0]\n", policy(defs->policy_output));
 190         }
 191
 192         /* Don't touch user chains on reload */
 193         if (reload)
 194                 delbit(custom_mask, FW3_DEFAULT_CUSTOM_CHAINS);
 195
 196         if (defs->custom_chains)
 197                 set(defs->flags, family, FW3_DEFAULT_CUSTOM_CHAINS);
 198
 199         if (defs->syn_flood)
 200                 set(defs->flags, family, FW3_DEFAULT_SYN_FLOOD);
 201
 202         rv = print_chains(table, family, ":%s - [0:0]\n", defs->flags, custom_mask,
 203                           default_chains, ARRAY_SIZE(default_chains));
 204
 205         if (rv)
 206                 set(defs->flags, family, table);
 207 }
 208
 209 void
 210 fw3_print_default_head_rules(enum fw3_table table, enum fw3_family family,
 211                              bool reload, struct fw3_state *state)
 212 {
 213         int i;
 214         struct fw3_defaults *defs = &state->defaults;
 215         const char *chains[] = {
 216                 "input", "input",
 217                 "output", "output",
 218                 "forward", "forwarding",
 219         };
 220
 221         print_chains(table, family, "-A %s\n", NULL, 0,
 222                      toplevel_rules, ARRAY_SIZE(toplevel_rules));
 223
 224         switch (table)
 225         {
 226         case FW3_TABLE_FILTER:
 227                 fw3_pr("-A delegate_input -i lo -j ACCEPT\n");
 228                 fw3_pr("-A delegate_output -o lo -j ACCEPT\n");
 229
 230                 if (defs->custom_chains)
 231                 {
 232                         for (i = 0; i < ARRAY_SIZE(chains); i += 2)
 233                         {
 234                                 fw3_pr("-A delegate_%s -m comment "
 235                                        "--comment \"user chain for %s\" -j %s_rule\n",
 236                                            chains[i], chains[i+1], chains[i+1]);
 237                         }
 238                 }
 239
 240                 for (i = 0; i < ARRAY_SIZE(chains); i += 2)
 241                 {
 242                         fw3_pr("-A delegate_%s -m conntrack --ctstate RELATED,ESTABLISHED "
 243                                "-j ACCEPT\n", chains[i]);
 244
 245                         if (defs->drop_invalid)
 246                         {
 247                                 fw3_pr("-A delegate_%s -m conntrack --ctstate INVALID -j DROP\n",
 248                                        chains[i]);
 249                         }
 250                 }
 251
 252                 if (defs->syn_flood)
 253                 {
 254                         fw3_pr("-A syn_flood -p tcp --syn");
 255                         fw3_format_limit(&defs->syn_flood_rate);
 256                         fw3_pr(" -j RETURN\n");
 257
 258                         fw3_pr("-A syn_flood -j DROP\n");
 259                         fw3_pr("-A delegate_input -p tcp --syn -j syn_flood\n");
 260                 }
 261
 262                 fw3_pr("-A reject -p tcp -j REJECT --reject-with tcp-reset\n");
 263                 fw3_pr("-A reject -j REJECT --reject-with port-unreach\n");
 264
 265                 break;
 266
 267         case FW3_TABLE_NAT:
 268                 if (defs->custom_chains)
 269                 {
 270                         fw3_pr("-A delegate_prerouting "
 271                                "-m comment --comment \"user chain for prerouting\" "
 272                                "-j prerouting_rule\n");
 273
 274                         fw3_pr("-A delegate_postrouting "
 275                                "-m comment --comment \"user chain for postrouting\" "
 276                                "-j postrouting_rule\n");
 277                 }
 278                 break;
 279
 280         default:
 281                 break;
 282         }
 283 }
 284
 285 void
 286 fw3_print_default_tail_rules(enum fw3_table table, enum fw3_family family,
 287                              bool reload, struct fw3_state *state)
 288 {
 289         struct fw3_defaults *defs = &state->defaults;
 290
 291         if (table != FW3_TABLE_FILTER)
 292                 return;
 293
 294         if (defs->policy_input == FW3_TARGET_REJECT)
 295                 fw3_pr("-A delegate_input -j reject\n");
 296
 297         if (defs->policy_output == FW3_TARGET_REJECT)
 298                 fw3_pr("-A delegate_output -j reject\n");
 299
 300         if (defs->policy_forward == FW3_TARGET_REJECT)
 301                 fw3_pr("-A delegate_forward -j reject\n");
 302 }
 303
 304 static void
 305 set_default(const char *name, bool set)
 306 {
 307         FILE *f;
 308         char path[sizeof("/proc/sys/net/ipv4/tcp_window_scaling\0")];
 309
 310         snprintf(path, sizeof(path), "/proc/sys/net/ipv4/tcp_%s", name);
 311
 312         info(" * Set tcp_%s to %s", name, set ? "on" : "off", name);
 313
 314         if (!(f = fopen(path, "w")))
 315         {
 316                 info("   ! Unable to write value: %s", strerror(errno));
 317                 return;
 318         }
 319
 320         fprintf(f, "%u\n", set);
 321         fclose(f);
 322 }
 323
 324 void
 325 fw3_set_defaults(struct fw3_state *state)
 326 {
 327         set_default("ecn",            state->defaults.tcp_ecn);
 328         set_default("syncookies",     state->defaults.tcp_syncookies);
 329         set_default("window_scaling", state->defaults.tcp_window_scaling);
 330 }
 331
 332 static void
 333 reset_policy(enum fw3_table table, enum fw3_target policy)
 334 {
 335         if (table != FW3_TABLE_FILTER)
 336                 return;
 337
 338         fw3_pr(":INPUT %s [0:0]\n", fw3_flag_names[policy]);
 339         fw3_pr(":OUTPUT %s [0:0]\n", fw3_flag_names[policy]);
 340         fw3_pr(":FORWARD %s [0:0]\n", fw3_flag_names[policy]);
 341 }
 342
 343 void
 344 fw3_flush_rules(enum fw3_table table, enum fw3_family family,
 345                 bool pass2, bool reload, struct fw3_state *state)
 346 {
 347         struct fw3_defaults *defs = &state->defaults;
 348         uint32_t custom_mask = ~0;
 349
 350         if (!has(defs->flags, family, table))
 351                 return;
 352
 353         /* don't touch user chains on selective stop */
 354         if (reload)
 355                 delbit(custom_mask, FW3_DEFAULT_CUSTOM_CHAINS);
 356
 357         if (!pass2)
 358         {
 359                 reset_policy(table, reload ? FW3_TARGET_DROP : FW3_TARGET_ACCEPT);
 360
 361                 print_chains(table, family, "-D %s\n",
 362                              defs->flags, custom_mask,
 363                                          toplevel_rules, ARRAY_SIZE(toplevel_rules));
 364
 365                 print_chains(table, family, "-F %s\n",
 366                              defs->flags, custom_mask,
 367                                          default_chains, ARRAY_SIZE(default_chains));
 368         }
 369         else
 370         {
 371                 print_chains(table, family, "-X %s\n",
 372                              defs->flags, custom_mask,
 373                                          default_chains, ARRAY_SIZE(default_chains));
 374
 375                 del(defs->flags, family, table);
 376         }
 377 }
 378
 379 void
 380 fw3_flush_all(enum fw3_table table)
 381 {
 382         reset_policy(table, FW3_TARGET_ACCEPT);
 383
 384         fw3_pr("-F\n");
 385         fw3_pr("-X\n");
 386 }