defaults.c

   1 /*
   2  * firewall3 - 3rd OpenWrt UCI firewall implementation
   3  *
   4  *   Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
   5  *
   6  * Permission to use, copy, modify, and/or distribute this software for any
   7  * purpose with or without fee is hereby granted, provided that the above
   8  * copyright notice and this permission notice appear in all copies.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17  */
  18
  19 #include "defaults.h"
  20
  21
  22 #define C(f, tbl, def, fmt) \
  23         { FW3_FAMILY_##f, FW3_TABLE_##tbl, FW3_FLAG_##def, fmt }
  24
  25 static const struct fw3_chain_spec default_chains[] = {
  26         C(ANY, FILTER, UNSPEC,        "reject"),
  27         C(ANY, FILTER, CUSTOM_CHAINS, "input_rule"),
  28         C(ANY, FILTER, CUSTOM_CHAINS, "output_rule"),
  29         C(ANY, FILTER, CUSTOM_CHAINS, "forwarding_rule"),
  30         C(ANY, FILTER, SYN_FLOOD,     "syn_flood"),
  31
  32         C(V4,  NAT,    CUSTOM_CHAINS, "prerouting_rule"),
  33         C(V4,  NAT,    CUSTOM_CHAINS, "postrouting_rule"),
  34
  35         { }
  36 };
  37
  38 const struct fw3_option fw3_flag_opts[] = {
  39         FW3_OPT("input",               target,   defaults, policy_input),
  40         FW3_OPT("forward",             target,   defaults, policy_forward),
  41         FW3_OPT("output",              target,   defaults, policy_output),
  42
  43         FW3_OPT("drop_invalid",        bool,     defaults, drop_invalid),
  44
  45         FW3_OPT("syn_flood",           bool,     defaults, syn_flood),
  46         FW3_OPT("synflood_protect",    bool,     defaults, syn_flood),
  47         FW3_OPT("synflood_rate",       limit,    defaults, syn_flood_rate),
  48         FW3_OPT("synflood_burst",      int,      defaults, syn_flood_rate.burst),
  49
  50         FW3_OPT("tcp_syncookies",      bool,     defaults, tcp_syncookies),
  51         FW3_OPT("tcp_ecn",             int,      defaults, tcp_ecn),
  52         FW3_OPT("tcp_window_scaling",  bool,     defaults, tcp_window_scaling),
  53
  54         FW3_OPT("accept_redirects",    bool,     defaults, accept_redirects),
  55         FW3_OPT("accept_source_route", bool,     defaults, accept_source_route),
  56
  57         FW3_OPT("custom_chains",       bool,     defaults, custom_chains),
  58         FW3_OPT("disable_ipv6",        bool,     defaults, disable_ipv6),
  59
  60         FW3_OPT("__flags_v4",          int,      defaults, flags[0]),
  61         FW3_OPT("__flags_v6",          int,      defaults, flags[1]),
  62
  63         { }
  64 };
  65
  66
  67 static void
  68 check_policy(struct uci_element *e, enum fw3_flag *pol, const char *name)
  69 {
  70         if (*pol == FW3_FLAG_UNSPEC)
  71         {
  72                 warn_elem(e, "has no %s policy specified, defaulting to DROP", name);
  73                 *pol = FW3_FLAG_DROP;
  74         }
  75         else if (*pol > FW3_FLAG_DROP)
  76         {
  77                 warn_elem(e, "has invalid %s policy, defaulting to DROP", name);
  78                 *pol = FW3_FLAG_DROP;
  79         }
  80 }
  81
  82 void
  83 fw3_load_defaults(struct fw3_state *state, struct uci_package *p)
  84 {
  85         struct uci_section *s;
  86         struct uci_element *e;
  87         struct fw3_defaults *defs = &state->defaults;
  88
  89         bool seen = false;
  90
  91         defs->syn_flood_rate.rate  = 25;
  92         defs->syn_flood_rate.burst = 50;
  93         defs->tcp_syncookies       = true;
  94         defs->tcp_window_scaling   = true;
  95         defs->custom_chains        = true;
  96         defs->drop_invalid         = true;
  97
  98         uci_foreach_element(&p->sections, e)
  99         {
 100                 s = uci_to_section(e);
 101
 102                 if (strcmp(s->type, "defaults"))
 103                         continue;
 104
 105                 if (seen)
 106                 {
 107                         warn_elem(e, "ignoring duplicate section");
 108                         continue;
 109                 }
 110
 111                 fw3_parse_options(&state->defaults, fw3_flag_opts, s);
 112
 113                 check_policy(e, &defs->policy_input, "input");
 114                 check_policy(e, &defs->policy_output, "output");
 115                 check_policy(e, &defs->policy_forward, "forward");
 116         }
 117 }
 118
 119 void
 120 fw3_print_default_chains(struct fw3_ipt_handle *handle, struct fw3_state *state,
 121                          bool reload)
 122 {
 123         struct fw3_defaults *defs = &state->defaults;
 124         const struct fw3_chain_spec *c;
 125
 126 #define policy(t) \
 127         ((t == FW3_FLAG_REJECT) ? FW3_FLAG_DROP : t)
 128
 129         if (handle->family == FW3_FAMILY_V6 && defs->disable_ipv6)
 130                 return;
 131
 132         if (handle->table == FW3_TABLE_FILTER)
 133         {
 134                 fw3_ipt_set_policy(handle, "INPUT",   policy(defs->policy_input));
 135                 fw3_ipt_set_policy(handle, "OUTPUT",  policy(defs->policy_output));
 136                 fw3_ipt_set_policy(handle, "FORWARD", policy(defs->policy_forward));
 137         }
 138
 139         if (defs->custom_chains)
 140                 set(defs->flags, handle->family, FW3_FLAG_CUSTOM_CHAINS);
 141
 142         if (defs->syn_flood)
 143                 set(defs->flags, handle->family, FW3_FLAG_SYN_FLOOD);
 144
 145         for (c = default_chains; c->format; c++)
 146         {
 147                 /* don't touch user chains on selective stop */
 148                 if (reload && c->flag == FW3_FLAG_CUSTOM_CHAINS)
 149                         continue;
 150
 151                 if (!fw3_is_family(c, handle->family))
 152                         continue;
 153
 154                 if (c->table != handle->table)
 155                         continue;
 156
 157                 if (c->flag &&
 158                     !hasbit(defs->flags[handle->family == FW3_FAMILY_V6], c->flag))
 159                         continue;
 160
 161                 fw3_ipt_create_chain(handle, c->format);
 162         }
 163
 164         set(defs->flags, handle->family, handle->table);
 165 }
 166
 167
 168 struct toplevel_rule {
 169         enum fw3_table table;
 170         const char *chain;
 171         const char *target;
 172 };
 173
 174 void
 175 fw3_print_default_head_rules(struct fw3_ipt_handle *handle,
 176                              struct fw3_state *state, bool reload)
 177 {
 178         int i;
 179         struct fw3_defaults *defs = &state->defaults;
 180         struct fw3_device lodev = { .set = true };
 181         struct fw3_protocol tcp = { .protocol = 6 };
 182         struct fw3_ipt_rule *r;
 183
 184         const char *chains[] = {
 185                 "INPUT", "input",
 186                 "OUTPUT", "output",
 187                 "FORWARD", "forwarding",
 188         };
 189
 190         switch (handle->table)
 191         {
 192         case FW3_TABLE_FILTER:
 193
 194                 sprintf(lodev.name, "lo");
 195
 196                 r = fw3_ipt_rule_create(handle, NULL, &lodev, NULL, NULL, NULL);
 197                 fw3_ipt_rule_target(r, "ACCEPT");
 198                 fw3_ipt_rule_append(r, "INPUT");
 199
 200                 r = fw3_ipt_rule_create(handle, NULL, NULL, &lodev, NULL, NULL);
 201                 fw3_ipt_rule_target(r, "ACCEPT");
 202                 fw3_ipt_rule_append(r, "OUTPUT");
 203
 204                 if (defs->custom_chains)
 205                 {
 206                         for (i = 0; i < ARRAY_SIZE(chains); i += 2)
 207                         {
 208                                 r = fw3_ipt_rule_new(handle);
 209                                 fw3_ipt_rule_comment(r, "user chain for %s", chains[i+1]);
 210                                 fw3_ipt_rule_target(r, "%s_rule", chains[i+1]);
 211                                 fw3_ipt_rule_append(r, chains[i]);
 212                         }
 213                 }
 214
 215                 for (i = 0; i < ARRAY_SIZE(chains); i += 2)
 216                 {
 217                         r = fw3_ipt_rule_new(handle);
 218                         fw3_ipt_rule_extra(r, "-m conntrack --ctstate RELATED,ESTABLISHED");
 219                         fw3_ipt_rule_target(r, "ACCEPT");
 220                         fw3_ipt_rule_append(r, chains[i]);
 221
 222                         if (defs->drop_invalid)
 223                         {
 224                                 r = fw3_ipt_rule_new(handle);
 225                                 fw3_ipt_rule_extra(r, "-m conntrack --ctstate INVALID");
 226                                 fw3_ipt_rule_target(r, "DROP");
 227                                 fw3_ipt_rule_append(r, chains[i]);
 228                         }
 229                 }
 230
 231                 if (defs->syn_flood)
 232                 {
 233                         r = fw3_ipt_rule_create(handle, &tcp, NULL, NULL, NULL, NULL);
 234                         fw3_ipt_rule_extra(r, "--syn");
 235                         fw3_ipt_rule_limit(r, &defs->syn_flood_rate);
 236                         fw3_ipt_rule_target(r, "RETURN");
 237                         fw3_ipt_rule_append(r, "syn_flood");
 238
 239                         r = fw3_ipt_rule_new(handle);
 240                         fw3_ipt_rule_target(r, "DROP");
 241                         fw3_ipt_rule_append(r, "syn_flood");
 242
 243                         r = fw3_ipt_rule_create(handle, &tcp, NULL, NULL, NULL, NULL);
 244                         fw3_ipt_rule_extra(r, "--syn");
 245                         fw3_ipt_rule_target(r, "syn_flood");
 246                         fw3_ipt_rule_append(r, "INPUT");
 247                 }
 248
 249                 r = fw3_ipt_rule_create(handle, &tcp, NULL, NULL, NULL, NULL);
 250                 fw3_ipt_rule_target(r, "REJECT");
 251                 fw3_ipt_rule_addarg(r, false, "--reject-with", "tcp-reset");
 252                 fw3_ipt_rule_append(r, "reject");
 253
 254                 r = fw3_ipt_rule_new(handle);
 255                 fw3_ipt_rule_target(r, "REJECT");
 256                 fw3_ipt_rule_addarg(r, false, "--reject-with", "port-unreach");
 257                 fw3_ipt_rule_append(r, "reject");
 258
 259                 break;
 260
 261         case FW3_TABLE_NAT:
 262                 if (defs->custom_chains)
 263                 {
 264                         r = fw3_ipt_rule_new(handle);
 265                         fw3_ipt_rule_comment(r, "user chain for prerouting");
 266                         fw3_ipt_rule_target(r, "prerouting_rule");
 267                         fw3_ipt_rule_append(r, "PREROUTING");
 268
 269                         r = fw3_ipt_rule_new(handle);
 270                         fw3_ipt_rule_comment(r, "user chain for postrouting");
 271                         fw3_ipt_rule_target(r, "postrouting_rule");
 272                         fw3_ipt_rule_append(r, "POSTROUTING");
 273                 }
 274                 break;
 275
 276         default:
 277                 break;
 278         }
 279 }
 280
 281 void
 282 fw3_print_default_tail_rules(struct fw3_ipt_handle *handle,
 283                              struct fw3_state *state, bool reload)
 284 {
 285         struct fw3_defaults *defs = &state->defaults;
 286         struct fw3_ipt_rule *r;
 287
 288         if (handle->table != FW3_TABLE_FILTER)
 289                 return;
 290
 291         if (defs->policy_input == FW3_FLAG_REJECT)
 292         {
 293                 r = fw3_ipt_rule_new(handle);
 294
 295                 if (!r)
 296                         return;
 297
 298                 fw3_ipt_rule_target(r, "reject");
 299                 fw3_ipt_rule_append(r, "INPUT");
 300         }
 301
 302         if (defs->policy_output == FW3_FLAG_REJECT)
 303         {
 304                 r = fw3_ipt_rule_new(handle);
 305
 306                 if (!r)
 307                         return;
 308
 309                 fw3_ipt_rule_target(r, "reject");
 310                 fw3_ipt_rule_append(r, "OUTPUT");
 311         }
 312
 313         if (defs->policy_forward == FW3_FLAG_REJECT)
 314         {
 315                 r = fw3_ipt_rule_new(handle);
 316
 317                 if (!r)
 318                         return;
 319
 320                 fw3_ipt_rule_target(r, "reject");
 321                 fw3_ipt_rule_append(r, "FORWARD");
 322         }
 323 }
 324
 325 static void
 326 set_default(const char *name, int set)
 327 {
 328         FILE *f;
 329         char path[sizeof("/proc/sys/net/ipv4/tcp_window_scaling\0")];
 330
 331         snprintf(path, sizeof(path), "/proc/sys/net/ipv4/tcp_%s", name);
 332
 333         info(" * Set tcp_%s to %s", name, set ? "on" : "off", name);
 334
 335         if (!(f = fopen(path, "w")))
 336         {
 337                 info("   ! Unable to write value: %s", strerror(errno));
 338                 return;
 339         }
 340
 341         fprintf(f, "%u\n", set);
 342         fclose(f);
 343 }
 344
 345 void
 346 fw3_set_defaults(struct fw3_state *state)
 347 {
 348         set_default("ecn",            state->defaults.tcp_ecn);
 349         set_default("syncookies",     state->defaults.tcp_syncookies);
 350         set_default("window_scaling", state->defaults.tcp_window_scaling);
 351 }
 352
 353 void
 354 fw3_flush_rules(struct fw3_ipt_handle *handle, struct fw3_state *state,
 355                 bool reload)
 356 {
 357         enum fw3_flag policy = reload ? FW3_FLAG_DROP : FW3_FLAG_ACCEPT;
 358         struct fw3_defaults *defs = &state->defaults;
 359         const struct fw3_chain_spec *c;
 360
 361         if (!has(defs->flags, handle->family, handle->table))
 362                 return;
 363
 364         if (handle->table == FW3_TABLE_FILTER)
 365         {
 366                 fw3_ipt_set_policy(handle, "INPUT",   policy);
 367                 fw3_ipt_set_policy(handle, "OUTPUT",  policy);
 368                 fw3_ipt_set_policy(handle, "FORWARD", policy);
 369         }
 370
 371         fw3_ipt_delete_id_rules(handle, "INPUT");
 372         fw3_ipt_delete_id_rules(handle, "OUTPUT");
 373         fw3_ipt_delete_id_rules(handle, "FORWARD");
 374         fw3_ipt_delete_id_rules(handle, "PREROUTING");
 375         fw3_ipt_delete_id_rules(handle, "POSTROUTING");
 376
 377         for (c = default_chains; c->format; c++)
 378         {
 379                 /* don't touch user chains on selective stop */
 380                 if (reload && c->flag == FW3_FLAG_CUSTOM_CHAINS)
 381                         continue;
 382
 383                 if (!fw3_is_family(c, handle->family))
 384                         continue;
 385
 386                 if (c->table != handle->table)
 387                         continue;
 388
 389                 if (c->flag && !has(defs->flags, handle->family, c->flag))
 390                         continue;
 391
 392                 fw3_ipt_flush_chain(handle, c->format);
 393
 394                 /* keep certain basic chains that do not depend on any settings to
 395                    avoid purging unrelated user rules pointing to them */
 396                 if (reload && !c->flag)
 397                         continue;
 398
 399                 fw3_ipt_delete_chain(handle, c->format);
 400         }
 401
 402         del(defs->flags, handle->family, handle->table);
 403 }
 404
 405 void
 406 fw3_flush_all(struct fw3_ipt_handle *handle)
 407 {
 408         if (handle->table == FW3_TABLE_FILTER)
 409         {
 410                 fw3_ipt_set_policy(handle, "INPUT",   FW3_FLAG_ACCEPT);
 411                 fw3_ipt_set_policy(handle, "OUTPUT",  FW3_FLAG_ACCEPT);
 412                 fw3_ipt_set_policy(handle, "FORWARD", FW3_FLAG_ACCEPT);
 413         }
 414
 415         fw3_ipt_flush(handle);
 416 }