Infer destination zone of DNAT redirects from dest_ip option
[project/firewall3.git] / defaults.c
1 /*
2  * firewall3 - 3rd OpenWrt UCI firewall implementation
3  *
4  *   Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
5  *
6  * Permission to use, copy, modify, and/or distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18
19 #include "defaults.h"
20
21
22 #define C(f, tbl, def, fmt) \
23         { FW3_FAMILY_##f, FW3_TABLE_##tbl, FW3_FLAG_##def, fmt }
24
25 static const struct fw3_chain_spec default_chains[] = {
26         C(ANY, FILTER, UNSPEC,        "delegate_input"),
27         C(ANY, FILTER, UNSPEC,        "delegate_output"),
28         C(ANY, FILTER, UNSPEC,        "delegate_forward"),
29         C(ANY, FILTER, UNSPEC,        "reject"),
30         C(ANY, FILTER, CUSTOM_CHAINS, "input_rule"),
31         C(ANY, FILTER, CUSTOM_CHAINS, "output_rule"),
32         C(ANY, FILTER, CUSTOM_CHAINS, "forwarding_rule"),
33         C(ANY, FILTER, SYN_FLOOD,     "syn_flood"),
34
35         C(V4,  NAT,    UNSPEC,        "delegate_prerouting"),
36         C(V4,  NAT,    UNSPEC,        "delegate_postrouting"),
37         C(V4,  NAT,    CUSTOM_CHAINS, "prerouting_rule"),
38         C(V4,  NAT,    CUSTOM_CHAINS, "postrouting_rule"),
39
40         C(ANY, MANGLE, UNSPEC,        "mssfix"),
41         C(ANY, MANGLE, UNSPEC,        "fwmark"),
42
43         C(ANY, RAW,    UNSPEC,        "notrack"),
44
45         { }
46 };
47
48 const struct fw3_option fw3_flag_opts[] = {
49         FW3_OPT("input",               target,   defaults, policy_input),
50         FW3_OPT("forward",             target,   defaults, policy_forward),
51         FW3_OPT("output",              target,   defaults, policy_output),
52
53         FW3_OPT("drop_invalid",        bool,     defaults, drop_invalid),
54
55         FW3_OPT("syn_flood",           bool,     defaults, syn_flood),
56         FW3_OPT("synflood_protect",    bool,     defaults, syn_flood),
57         FW3_OPT("synflood_rate",       limit,    defaults, syn_flood_rate),
58         FW3_OPT("synflood_burst",      int,      defaults, syn_flood_rate.burst),
59
60         FW3_OPT("tcp_syncookies",      bool,     defaults, tcp_syncookies),
61         FW3_OPT("tcp_ecn",             bool,     defaults, tcp_ecn),
62         FW3_OPT("tcp_window_scaling",  bool,     defaults, tcp_window_scaling),
63
64         FW3_OPT("accept_redirects",    bool,     defaults, accept_redirects),
65         FW3_OPT("accept_source_route", bool,     defaults, accept_source_route),
66
67         FW3_OPT("custom_chains",       bool,     defaults, custom_chains),
68         FW3_OPT("disable_ipv6",        bool,     defaults, disable_ipv6),
69
70         FW3_OPT("__flags_v4",          int,      defaults, flags[0]),
71         FW3_OPT("__flags_v6",          int,      defaults, flags[1]),
72
73         { }
74 };
75
76
77 static void
78 check_policy(struct uci_element *e, enum fw3_flag *pol, const char *name)
79 {
80         if (*pol == FW3_FLAG_UNSPEC)
81         {
82                 warn_elem(e, "has no %s policy specified, defaulting to DROP", name);
83                 *pol = FW3_FLAG_DROP;
84         }
85         else if (*pol > FW3_FLAG_DROP)
86         {
87                 warn_elem(e, "has invalid %s policy, defaulting to DROP", name);
88                 *pol = FW3_FLAG_DROP;
89         }
90 }
91
92 void
93 fw3_load_defaults(struct fw3_state *state, struct uci_package *p)
94 {
95         struct uci_section *s;
96         struct uci_element *e;
97         struct fw3_defaults *defs = &state->defaults;
98
99         bool seen = false;
100
101         defs->syn_flood_rate.rate  = 25;
102         defs->syn_flood_rate.burst = 50;
103         defs->tcp_syncookies       = true;
104         defs->tcp_window_scaling   = true;
105         defs->custom_chains        = true;
106
107         uci_foreach_element(&p->sections, e)
108         {
109                 s = uci_to_section(e);
110
111                 if (strcmp(s->type, "defaults"))
112                         continue;
113
114                 if (seen)
115                 {
116                         warn_elem(e, "ignoring duplicate section");
117                         continue;
118                 }
119
120                 fw3_parse_options(&state->defaults, fw3_flag_opts, s);
121
122                 check_policy(e, &defs->policy_input, "input");
123                 check_policy(e, &defs->policy_output, "output");
124                 check_policy(e, &defs->policy_forward, "forward");
125         }
126 }
127
128 void
129 fw3_print_default_chains(struct fw3_ipt_handle *handle, struct fw3_state *state,
130                          bool reload)
131 {
132         struct fw3_defaults *defs = &state->defaults;
133         const struct fw3_chain_spec *c;
134
135 #define policy(t) \
136         ((t == FW3_FLAG_REJECT) ? FW3_FLAG_DROP : t)
137
138         if (handle->family == FW3_FAMILY_V6 && defs->disable_ipv6)
139                 return;
140
141         if (handle->table == FW3_TABLE_FILTER)
142         {
143                 fw3_ipt_set_policy(handle, "INPUT",   policy(defs->policy_input));
144                 fw3_ipt_set_policy(handle, "OUTPUT",  policy(defs->policy_output));
145                 fw3_ipt_set_policy(handle, "FORWARD", policy(defs->policy_forward));
146         }
147
148         if (defs->custom_chains)
149                 set(defs->flags, handle->family, FW3_FLAG_CUSTOM_CHAINS);
150
151         if (defs->syn_flood)
152                 set(defs->flags, handle->family, FW3_FLAG_SYN_FLOOD);
153
154         for (c = default_chains; c->format; c++)
155         {
156                 /* don't touch user chains on selective stop */
157                 if (reload && c->flag == FW3_FLAG_CUSTOM_CHAINS)
158                         continue;
159
160                 if (!fw3_is_family(c, handle->family))
161                         continue;
162
163                 if (c->table != handle->table)
164                         continue;
165
166                 if (c->flag &&
167                     !hasbit(defs->flags[handle->family == FW3_FAMILY_V6], c->flag))
168                         continue;
169
170                 fw3_ipt_create_chain(handle, c->format);
171         }
172
173         set(defs->flags, handle->family, handle->table);
174 }
175
176
177 struct toplevel_rule {
178         enum fw3_table table;
179         const char *chain;
180         const char *target;
181 };
182
183 void
184 fw3_print_default_head_rules(struct fw3_ipt_handle *handle,
185                              struct fw3_state *state, bool reload)
186 {
187         int i;
188         struct fw3_defaults *defs = &state->defaults;
189         struct fw3_device lodev = { .set = true };
190         struct fw3_protocol tcp = { .protocol = 6 };
191         struct fw3_ipt_rule *r;
192         struct toplevel_rule *tr;
193
194         const char *chains[] = {
195                 "delegate_input", "input",
196                 "delegate_output", "output",
197                 "delegate_forward", "forwarding",
198         };
199
200         struct toplevel_rule rules[] = {
201                 { FW3_TABLE_FILTER, "INPUT",       "delegate_input" },
202                 { FW3_TABLE_FILTER, "OUTPUT",      "delegate_output" },
203                 { FW3_TABLE_FILTER, "FORWARD",     "delegate_forward" },
204
205                 { FW3_TABLE_NAT,    "PREROUTING",  "delegate_prerouting" },
206                 { FW3_TABLE_NAT,    "POSTROUTING", "delegate_postrouting" },
207
208                 { FW3_TABLE_MANGLE, "FORWARD",     "mssfix" },
209                 { FW3_TABLE_MANGLE, "PREROUTING",  "fwmark" },
210
211                 { FW3_TABLE_RAW,    "PREROUTING",  "notrack" },
212
213                 { 0, NULL },
214         };
215
216         for (tr = rules; tr->chain; tr++)
217         {
218                 if (tr->table != handle->table)
219                         continue;
220
221                 r = fw3_ipt_rule_new(handle);
222                 fw3_ipt_rule_target(r, tr->target);
223                 fw3_ipt_rule_append(r, tr->chain);
224         }
225
226         switch (handle->table)
227         {
228         case FW3_TABLE_FILTER:
229
230                 sprintf(lodev.name, "lo");
231
232                 r = fw3_ipt_rule_create(handle, NULL, &lodev, NULL, NULL, NULL);
233                 fw3_ipt_rule_target(r, "ACCEPT");
234                 fw3_ipt_rule_append(r, "delegate_input");
235
236                 r = fw3_ipt_rule_create(handle, NULL, NULL, &lodev, NULL, NULL);
237                 fw3_ipt_rule_target(r, "ACCEPT");
238                 fw3_ipt_rule_append(r, "delegate_output");
239
240                 if (defs->custom_chains)
241                 {
242                         for (i = 0; i < ARRAY_SIZE(chains); i += 2)
243                         {
244                                 r = fw3_ipt_rule_new(handle);
245                                 fw3_ipt_rule_comment(r, "user chain for %s", chains[i+1]);
246                                 fw3_ipt_rule_target(r, "%s_rule", chains[i+1]);
247                                 fw3_ipt_rule_append(r, chains[i]);
248                         }
249                 }
250
251                 for (i = 0; i < ARRAY_SIZE(chains); i += 2)
252                 {
253                         r = fw3_ipt_rule_new(handle);
254                         fw3_ipt_rule_extra(r, "-m conntrack --ctstate RELATED,ESTABLISHED");
255                         fw3_ipt_rule_target(r, "ACCEPT");
256                         fw3_ipt_rule_append(r, chains[i]);
257
258                         if (defs->drop_invalid)
259                         {
260                                 r = fw3_ipt_rule_new(handle);
261                                 fw3_ipt_rule_extra(r, "-m conntrack --ctstate INVALID");
262                                 fw3_ipt_rule_target(r, "DROP");
263                                 fw3_ipt_rule_append(r, chains[i]);
264                         }
265                 }
266
267                 if (defs->syn_flood)
268                 {
269                         r = fw3_ipt_rule_create(handle, &tcp, NULL, NULL, NULL, NULL);
270                         fw3_ipt_rule_extra(r, "--syn");
271                         fw3_ipt_rule_limit(r, &defs->syn_flood_rate);
272                         fw3_ipt_rule_target(r, "RETURN");
273                         fw3_ipt_rule_append(r, "syn_flood");
274
275                         r = fw3_ipt_rule_new(handle);
276                         fw3_ipt_rule_target(r, "DROP");
277                         fw3_ipt_rule_append(r, "syn_flood");
278
279                         r = fw3_ipt_rule_create(handle, &tcp, NULL, NULL, NULL, NULL);
280                         fw3_ipt_rule_extra(r, "--syn");
281                         fw3_ipt_rule_target(r, "syn_flood");
282                         fw3_ipt_rule_append(r, "delegate_input");
283                 }
284
285                 r = fw3_ipt_rule_create(handle, &tcp, NULL, NULL, NULL, NULL);
286                 fw3_ipt_rule_target(r, "REJECT");
287                 fw3_ipt_rule_addarg(r, false, "--reject-with", "tcp-reset");
288                 fw3_ipt_rule_append(r, "reject");
289
290                 r = fw3_ipt_rule_new(handle);
291                 fw3_ipt_rule_target(r, "REJECT");
292                 fw3_ipt_rule_addarg(r, false, "--reject-with", "port-unreach");
293                 fw3_ipt_rule_append(r, "reject");
294
295                 break;
296
297         case FW3_TABLE_NAT:
298                 if (defs->custom_chains)
299                 {
300                         r = fw3_ipt_rule_new(handle);
301                         fw3_ipt_rule_comment(r, "user chain for prerouting");
302                         fw3_ipt_rule_target(r, "prerouting_rule");
303                         fw3_ipt_rule_append(r, "delegate_prerouting");
304
305                         r = fw3_ipt_rule_new(handle);
306                         fw3_ipt_rule_comment(r, "user chain for postrouting");
307                         fw3_ipt_rule_target(r, "postrouting_rule");
308                         fw3_ipt_rule_append(r, "delegate_postrouting");
309                 }
310                 break;
311
312         default:
313                 break;
314         }
315 }
316
317 void
318 fw3_print_default_tail_rules(struct fw3_ipt_handle *handle,
319                              struct fw3_state *state, bool reload)
320 {
321         struct fw3_defaults *defs = &state->defaults;
322         struct fw3_ipt_rule *r;
323
324         if (handle->table != FW3_TABLE_FILTER)
325                 return;
326
327         if (defs->policy_input == FW3_FLAG_REJECT)
328         {
329                 r = fw3_ipt_rule_new(handle);
330
331                 if (!r)
332                         return;
333
334                 fw3_ipt_rule_target(r, "reject");
335                 fw3_ipt_rule_append(r, "delegate_input");
336         }
337
338         if (defs->policy_output == FW3_FLAG_REJECT)
339         {
340                 r = fw3_ipt_rule_new(handle);
341
342                 if (!r)
343                         return;
344
345                 fw3_ipt_rule_target(r, "reject");
346                 fw3_ipt_rule_append(r, "delegate_output");
347         }
348
349         if (defs->policy_forward == FW3_FLAG_REJECT)
350         {
351                 r = fw3_ipt_rule_new(handle);
352
353                 if (!r)
354                         return;
355
356                 fw3_ipt_rule_target(r, "reject");
357                 fw3_ipt_rule_append(r, "delegate_forward");
358         }
359 }
360
361 static void
362 set_default(const char *name, bool set)
363 {
364         FILE *f;
365         char path[sizeof("/proc/sys/net/ipv4/tcp_window_scaling\0")];
366
367         snprintf(path, sizeof(path), "/proc/sys/net/ipv4/tcp_%s", name);
368
369         info(" * Set tcp_%s to %s", name, set ? "on" : "off", name);
370
371         if (!(f = fopen(path, "w")))
372         {
373                 info("   ! Unable to write value: %s", strerror(errno));
374                 return;
375         }
376
377         fprintf(f, "%u\n", set);
378         fclose(f);
379 }
380
381 void
382 fw3_set_defaults(struct fw3_state *state)
383 {
384         set_default("ecn",            state->defaults.tcp_ecn);
385         set_default("syncookies",     state->defaults.tcp_syncookies);
386         set_default("window_scaling", state->defaults.tcp_window_scaling);
387 }
388
389 void
390 fw3_flush_rules(struct fw3_ipt_handle *handle, struct fw3_state *state,
391                 bool reload)
392 {
393         enum fw3_flag policy = reload ? FW3_FLAG_DROP : FW3_FLAG_ACCEPT;
394         struct fw3_defaults *defs = &state->defaults;
395         const struct fw3_chain_spec *c;
396
397         if (!has(defs->flags, handle->family, handle->table))
398                 return;
399
400         if (handle->table == FW3_TABLE_FILTER)
401         {
402                 fw3_ipt_set_policy(handle, "INPUT",   policy);
403                 fw3_ipt_set_policy(handle, "OUTPUT",  policy);
404                 fw3_ipt_set_policy(handle, "FORWARD", policy);
405         }
406
407         for (c = default_chains; c->format; c++)
408         {
409                 /* don't touch user chains on selective stop */
410                 if (reload && c->flag == FW3_FLAG_CUSTOM_CHAINS)
411                         continue;
412
413                 if (!fw3_is_family(c, handle->family))
414                         continue;
415
416                 if (c->table != handle->table)
417                         continue;
418
419                 if (c->flag && !has(defs->flags, handle->family, c->flag))
420                         continue;
421
422                 fw3_ipt_delete_rules(handle, c->format);
423                 fw3_ipt_delete_chain(handle, c->format);
424         }
425
426         del(defs->flags, handle->family, handle->table);
427 }
428
429 void
430 fw3_flush_all(struct fw3_ipt_handle *handle)
431 {
432         if (handle->table == FW3_TABLE_FILTER)
433         {
434                 fw3_ipt_set_policy(handle, "INPUT",   FW3_FLAG_ACCEPT);
435                 fw3_ipt_set_policy(handle, "OUTPUT",  FW3_FLAG_ACCEPT);
436                 fw3_ipt_set_policy(handle, "FORWARD", FW3_FLAG_ACCEPT);
437         }
438
439         fw3_ipt_flush(handle);
440 }