Make nat reflection src address configurable by introducing a reflection_src paramete...
[project/firewall3.git] / defaults.c
1 /*
2  * firewall3 - 3rd OpenWrt UCI firewall implementation
3  *
4  *   Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
5  *
6  * Permission to use, copy, modify, and/or distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18
19 #include "defaults.h"
20
21
22 #define C(f, tbl, def, fmt) \
23         { FW3_FAMILY_##f, FW3_TABLE_##tbl, FW3_FLAG_##def, fmt }
24
25 static const struct fw3_rule_spec default_chains[] = {
26         C(ANY, FILTER, UNSPEC,        "delegate_input"),
27         C(ANY, FILTER, UNSPEC,        "delegate_output"),
28         C(ANY, FILTER, UNSPEC,        "delegate_forward"),
29         C(ANY, FILTER, UNSPEC,        "reject"),
30         C(ANY, FILTER, CUSTOM_CHAINS, "input_rule"),
31         C(ANY, FILTER, CUSTOM_CHAINS, "output_rule"),
32         C(ANY, FILTER, CUSTOM_CHAINS, "forwarding_rule"),
33         C(ANY, FILTER, SYN_FLOOD,     "syn_flood"),
34
35         C(V4,  NAT,    UNSPEC,        "delegate_prerouting"),
36         C(V4,  NAT,    UNSPEC,        "delegate_postrouting"),
37         C(V4,  NAT,    CUSTOM_CHAINS, "prerouting_rule"),
38         C(V4,  NAT,    CUSTOM_CHAINS, "postrouting_rule"),
39
40         C(ANY, MANGLE, UNSPEC,        "mssfix"),
41         C(ANY, RAW,    UNSPEC,        "notrack"),
42
43         { }
44 };
45
46 static const struct fw3_rule_spec toplevel_rules[] = {
47         C(ANY, FILTER, UNSPEC,        "INPUT -j delegate_input"),
48         C(ANY, FILTER, UNSPEC,        "OUTPUT -j delegate_output"),
49         C(ANY, FILTER, UNSPEC,        "FORWARD -j delegate_forward"),
50
51         C(V4,  NAT,    UNSPEC,        "PREROUTING -j delegate_prerouting"),
52         C(V4,  NAT,    UNSPEC,        "POSTROUTING -j delegate_postrouting"),
53
54         C(ANY, MANGLE, UNSPEC,        "FORWARD -j mssfix"),
55         C(ANY, RAW,    UNSPEC,        "PREROUTING -j notrack"),
56
57         { }
58 };
59
60 const struct fw3_option fw3_flag_opts[] = {
61         FW3_OPT("input",               target,   defaults, policy_input),
62         FW3_OPT("forward",             target,   defaults, policy_forward),
63         FW3_OPT("output",              target,   defaults, policy_output),
64
65         FW3_OPT("drop_invalid",        bool,     defaults, drop_invalid),
66
67         FW3_OPT("syn_flood",           bool,     defaults, syn_flood),
68         FW3_OPT("synflood_protect",    bool,     defaults, syn_flood),
69         FW3_OPT("synflood_rate",       limit,    defaults, syn_flood_rate),
70         FW3_OPT("synflood_burst",      int,      defaults, syn_flood_rate.burst),
71
72         FW3_OPT("tcp_syncookies",      bool,     defaults, tcp_syncookies),
73         FW3_OPT("tcp_ecn",             bool,     defaults, tcp_ecn),
74         FW3_OPT("tcp_window_scaling",  bool,     defaults, tcp_window_scaling),
75
76         FW3_OPT("accept_redirects",    bool,     defaults, accept_redirects),
77         FW3_OPT("accept_source_route", bool,     defaults, accept_source_route),
78
79         FW3_OPT("custom_chains",       bool,     defaults, custom_chains),
80         FW3_OPT("disable_ipv6",        bool,     defaults, disable_ipv6),
81
82         { }
83 };
84
85
86 static void
87 check_policy(struct uci_element *e, enum fw3_flag *pol, const char *name)
88 {
89         if (*pol == FW3_FLAG_UNSPEC)
90         {
91                 warn_elem(e, "has no %s policy specified, defaulting to DROP", name);
92                 *pol = FW3_FLAG_DROP;
93         }
94         else if (*pol > FW3_FLAG_DROP)
95         {
96                 warn_elem(e, "has invalid %s policy, defaulting to DROP", name);
97                 *pol = FW3_FLAG_DROP;
98         }
99 }
100
101 void
102 fw3_load_defaults(struct fw3_state *state, struct uci_package *p)
103 {
104         struct uci_section *s;
105         struct uci_element *e;
106         struct fw3_defaults *defs = &state->defaults;
107
108         bool seen = false;
109
110         defs->syn_flood_rate.rate  = 25;
111         defs->syn_flood_rate.burst = 50;
112         defs->tcp_syncookies       = true;
113         defs->tcp_window_scaling   = true;
114         defs->custom_chains        = true;
115
116         uci_foreach_element(&p->sections, e)
117         {
118                 s = uci_to_section(e);
119
120                 if (strcmp(s->type, "defaults"))
121                         continue;
122
123                 if (seen)
124                 {
125                         warn_elem(e, "ignoring duplicate section");
126                         continue;
127                 }
128
129                 fw3_parse_options(&state->defaults, fw3_flag_opts, s);
130
131                 check_policy(e, &defs->policy_input, "input");
132                 check_policy(e, &defs->policy_output, "output");
133                 check_policy(e, &defs->policy_forward, "forward");
134         }
135 }
136
137 void
138 fw3_print_default_chains(enum fw3_table table, enum fw3_family family,
139                          bool reload, struct fw3_state *state)
140 {
141         bool rv;
142         struct fw3_defaults *defs = &state->defaults;
143         uint32_t custom_mask = ~0;
144
145 #define policy(t) \
146         ((t == FW3_FLAG_REJECT) ? "DROP" : fw3_flag_names[t])
147
148         if (family == FW3_FAMILY_V6 && defs->disable_ipv6)
149                 return;
150
151         if (table == FW3_TABLE_FILTER)
152         {
153                 fw3_pr(":INPUT %s [0:0]\n", policy(defs->policy_input));
154                 fw3_pr(":FORWARD %s [0:0]\n", policy(defs->policy_forward));
155                 fw3_pr(":OUTPUT %s [0:0]\n", policy(defs->policy_output));
156         }
157
158         /* Don't touch user chains on reload */
159         if (reload)
160                 delbit(custom_mask, FW3_FLAG_CUSTOM_CHAINS);
161
162         if (defs->custom_chains)
163                 set(defs->flags, family, FW3_FLAG_CUSTOM_CHAINS);
164
165         if (defs->syn_flood)
166                 set(defs->flags, family, FW3_FLAG_SYN_FLOOD);
167
168         rv = fw3_pr_rulespec(table, family, defs->flags, custom_mask,
169                              default_chains, ":%s - [0:0]\n");
170
171         if (rv)
172                 set(defs->flags, family, table);
173 }
174
175 void
176 fw3_print_default_head_rules(enum fw3_table table, enum fw3_family family,
177                              bool reload, struct fw3_state *state)
178 {
179         int i;
180         struct fw3_defaults *defs = &state->defaults;
181         const char *chains[] = {
182                 "input", "input",
183                 "output", "output",
184                 "forward", "forwarding",
185         };
186
187         fw3_pr_rulespec(table, family, NULL, 0, toplevel_rules, "-A %s\n");
188
189         switch (table)
190         {
191         case FW3_TABLE_FILTER:
192                 fw3_pr("-A delegate_input -i lo -j ACCEPT\n");
193                 fw3_pr("-A delegate_output -o lo -j ACCEPT\n");
194
195                 if (defs->custom_chains)
196                 {
197                         for (i = 0; i < ARRAY_SIZE(chains); i += 2)
198                         {
199                                 fw3_pr("-A delegate_%s -m comment "
200                                        "--comment \"user chain for %s\" -j %s_rule\n",
201                                            chains[i], chains[i+1], chains[i+1]);
202                         }
203                 }
204
205                 for (i = 0; i < ARRAY_SIZE(chains); i += 2)
206                 {
207                         fw3_pr("-A delegate_%s -m conntrack --ctstate RELATED,ESTABLISHED "
208                                "-j ACCEPT\n", chains[i]);
209
210                         if (defs->drop_invalid)
211                         {
212                                 fw3_pr("-A delegate_%s -m conntrack --ctstate INVALID -j DROP\n",
213                                        chains[i]);
214                         }
215                 }
216
217                 if (defs->syn_flood)
218                 {
219                         fw3_pr("-A syn_flood -p tcp --syn");
220                         fw3_format_limit(&defs->syn_flood_rate);
221                         fw3_pr(" -j RETURN\n");
222
223                         fw3_pr("-A syn_flood -j DROP\n");
224                         fw3_pr("-A delegate_input -p tcp --syn -j syn_flood\n");
225                 }
226
227                 fw3_pr("-A reject -p tcp -j REJECT --reject-with tcp-reset\n");
228                 fw3_pr("-A reject -j REJECT --reject-with port-unreach\n");
229
230                 break;
231
232         case FW3_TABLE_NAT:
233                 if (defs->custom_chains)
234                 {
235                         fw3_pr("-A delegate_prerouting "
236                                "-m comment --comment \"user chain for prerouting\" "
237                                "-j prerouting_rule\n");
238
239                         fw3_pr("-A delegate_postrouting "
240                                "-m comment --comment \"user chain for postrouting\" "
241                                "-j postrouting_rule\n");
242                 }
243                 break;
244
245         default:
246                 break;
247         }
248 }
249
250 void
251 fw3_print_default_tail_rules(enum fw3_table table, enum fw3_family family,
252                              bool reload, struct fw3_state *state)
253 {
254         struct fw3_defaults *defs = &state->defaults;
255
256         if (table != FW3_TABLE_FILTER)
257                 return;
258
259         if (defs->policy_input == FW3_FLAG_REJECT)
260                 fw3_pr("-A delegate_input -j reject\n");
261
262         if (defs->policy_output == FW3_FLAG_REJECT)
263                 fw3_pr("-A delegate_output -j reject\n");
264
265         if (defs->policy_forward == FW3_FLAG_REJECT)
266                 fw3_pr("-A delegate_forward -j reject\n");
267 }
268
269 static void
270 set_default(const char *name, bool set)
271 {
272         FILE *f;
273         char path[sizeof("/proc/sys/net/ipv4/tcp_window_scaling\0")];
274
275         snprintf(path, sizeof(path), "/proc/sys/net/ipv4/tcp_%s", name);
276
277         info(" * Set tcp_%s to %s", name, set ? "on" : "off", name);
278
279         if (!(f = fopen(path, "w")))
280         {
281                 info("   ! Unable to write value: %s", strerror(errno));
282                 return;
283         }
284
285         fprintf(f, "%u\n", set);
286         fclose(f);
287 }
288
289 void
290 fw3_set_defaults(struct fw3_state *state)
291 {
292         set_default("ecn",            state->defaults.tcp_ecn);
293         set_default("syncookies",     state->defaults.tcp_syncookies);
294         set_default("window_scaling", state->defaults.tcp_window_scaling);
295 }
296
297 static void
298 reset_policy(enum fw3_table table, enum fw3_flag policy)
299 {
300         if (table != FW3_TABLE_FILTER)
301                 return;
302
303         fw3_pr(":INPUT %s [0:0]\n", fw3_flag_names[policy]);
304         fw3_pr(":OUTPUT %s [0:0]\n", fw3_flag_names[policy]);
305         fw3_pr(":FORWARD %s [0:0]\n", fw3_flag_names[policy]);
306 }
307
308 void
309 fw3_flush_rules(enum fw3_table table, enum fw3_family family,
310                 bool pass2, bool reload, struct fw3_state *state)
311 {
312         struct fw3_defaults *defs = &state->defaults;
313         uint32_t custom_mask = ~0;
314
315         if (!has(defs->flags, family, table))
316                 return;
317
318         /* don't touch user chains on selective stop */
319         if (reload)
320                 delbit(custom_mask, FW3_FLAG_CUSTOM_CHAINS);
321
322         if (!pass2)
323         {
324                 reset_policy(table, reload ? FW3_FLAG_DROP : FW3_FLAG_ACCEPT);
325
326                 fw3_pr_rulespec(table, family, defs->flags, custom_mask,
327                                 toplevel_rules, "-D %s\n");
328
329                 fw3_pr_rulespec(table, family, defs->flags, custom_mask,
330                                 default_chains, "-F %s\n");
331         }
332         else
333         {
334                 fw3_pr_rulespec(table, family, defs->flags, custom_mask,
335                                 default_chains, "-X %s\n");
336
337                 del(defs->flags, family, table);
338         }
339 }
340
341 void
342 fw3_flush_all(enum fw3_table table)
343 {
344         reset_policy(table, FW3_FLAG_ACCEPT);
345
346         fw3_pr("-F\n");
347         fw3_pr("-X\n");
348 }