defaults.c

   1 /*
   2  * firewall3 - 3rd OpenWrt UCI firewall implementation
   3  *
   4  *   Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
   5  *
   6  * Permission to use, copy, modify, and/or distribute this software for any
   7  * purpose with or without fee is hereby granted, provided that the above
   8  * copyright notice and this permission notice appear in all copies.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17  */
  18
  19 #include "defaults.h"
  20
  21
  22 #define C(f, tbl, def, fmt) \
  23         { FW3_FAMILY_##f, FW3_TABLE_##tbl, FW3_FLAG_##def, fmt }
  24
  25 static const struct fw3_rule_spec default_chains[] = {
  26         C(ANY, FILTER, UNSPEC,        "delegate_input"),
  27         C(ANY, FILTER, UNSPEC,        "delegate_output"),
  28         C(ANY, FILTER, UNSPEC,        "delegate_forward"),
  29         C(ANY, FILTER, UNSPEC,        "reject"),
  30         C(ANY, FILTER, CUSTOM_CHAINS, "input_rule"),
  31         C(ANY, FILTER, CUSTOM_CHAINS, "output_rule"),
  32         C(ANY, FILTER, CUSTOM_CHAINS, "forwarding_rule"),
  33         C(ANY, FILTER, SYN_FLOOD,     "syn_flood"),
  34
  35         C(V4,  NAT,    UNSPEC,        "delegate_prerouting"),
  36         C(V4,  NAT,    UNSPEC,        "delegate_postrouting"),
  37         C(V4,  NAT,    CUSTOM_CHAINS, "prerouting_rule"),
  38         C(V4,  NAT,    CUSTOM_CHAINS, "postrouting_rule"),
  39
  40         C(ANY, MANGLE, UNSPEC,        "mssfix"),
  41         C(ANY, MANGLE, UNSPEC,        "fwmark"),
  42
  43         C(ANY, RAW,    UNSPEC,        "notrack"),
  44
  45         { }
  46 };
  47
  48 static const struct fw3_rule_spec toplevel_rules[] = {
  49         C(ANY, FILTER, UNSPEC,        "INPUT -j delegate_input"),
  50         C(ANY, FILTER, UNSPEC,        "OUTPUT -j delegate_output"),
  51         C(ANY, FILTER, UNSPEC,        "FORWARD -j delegate_forward"),
  52
  53         C(V4,  NAT,    UNSPEC,        "PREROUTING -j delegate_prerouting"),
  54         C(V4,  NAT,    UNSPEC,        "POSTROUTING -j delegate_postrouting"),
  55
  56         C(ANY, MANGLE, UNSPEC,        "FORWARD -j mssfix"),
  57         C(ANY, MANGLE, UNSPEC,        "PREROUTING -j fwmark"),
  58
  59         C(ANY, RAW,    UNSPEC,        "PREROUTING -j notrack"),
  60
  61         { }
  62 };
  63
  64 const struct fw3_option fw3_flag_opts[] = {
  65         FW3_OPT("input",               target,   defaults, policy_input),
  66         FW3_OPT("forward",             target,   defaults, policy_forward),
  67         FW3_OPT("output",              target,   defaults, policy_output),
  68
  69         FW3_OPT("drop_invalid",        bool,     defaults, drop_invalid),
  70
  71         FW3_OPT("syn_flood",           bool,     defaults, syn_flood),
  72         FW3_OPT("synflood_protect",    bool,     defaults, syn_flood),
  73         FW3_OPT("synflood_rate",       limit,    defaults, syn_flood_rate),
  74         FW3_OPT("synflood_burst",      int,      defaults, syn_flood_rate.burst),
  75
  76         FW3_OPT("tcp_syncookies",      bool,     defaults, tcp_syncookies),
  77         FW3_OPT("tcp_ecn",             bool,     defaults, tcp_ecn),
  78         FW3_OPT("tcp_window_scaling",  bool,     defaults, tcp_window_scaling),
  79
  80         FW3_OPT("accept_redirects",    bool,     defaults, accept_redirects),
  81         FW3_OPT("accept_source_route", bool,     defaults, accept_source_route),
  82
  83         FW3_OPT("custom_chains",       bool,     defaults, custom_chains),
  84         FW3_OPT("disable_ipv6",        bool,     defaults, disable_ipv6),
  85
  86         FW3_OPT("__flags_v4",          int,      defaults, flags[0]),
  87         FW3_OPT("__flags_v6",          int,      defaults, flags[1]),
  88
  89         { }
  90 };
  91
  92
  93 static void
  94 check_policy(struct uci_element *e, enum fw3_flag *pol, const char *name)
  95 {
  96         if (*pol == FW3_FLAG_UNSPEC)
  97         {
  98                 warn_elem(e, "has no %s policy specified, defaulting to DROP", name);
  99                 *pol = FW3_FLAG_DROP;
 100         }
 101         else if (*pol > FW3_FLAG_DROP)
 102         {
 103                 warn_elem(e, "has invalid %s policy, defaulting to DROP", name);
 104                 *pol = FW3_FLAG_DROP;
 105         }
 106 }
 107
 108 void
 109 fw3_load_defaults(struct fw3_state *state, struct uci_package *p)
 110 {
 111         struct uci_section *s;
 112         struct uci_element *e;
 113         struct fw3_defaults *defs = &state->defaults;
 114
 115         bool seen = false;
 116
 117         defs->syn_flood_rate.rate  = 25;
 118         defs->syn_flood_rate.burst = 50;
 119         defs->tcp_syncookies       = true;
 120         defs->tcp_window_scaling   = true;
 121         defs->custom_chains        = true;
 122
 123         uci_foreach_element(&p->sections, e)
 124         {
 125                 s = uci_to_section(e);
 126
 127                 if (strcmp(s->type, "defaults"))
 128                         continue;
 129
 130                 if (seen)
 131                 {
 132                         warn_elem(e, "ignoring duplicate section");
 133                         continue;
 134                 }
 135
 136                 fw3_parse_options(&state->defaults, fw3_flag_opts, s);
 137
 138                 check_policy(e, &defs->policy_input, "input");
 139                 check_policy(e, &defs->policy_output, "output");
 140                 check_policy(e, &defs->policy_forward, "forward");
 141         }
 142 }
 143
 144 void
 145 fw3_print_default_chains(struct fw3_state *state, enum fw3_family family,
 146                          enum fw3_table table, bool reload)
 147 {
 148         bool rv;
 149         struct fw3_defaults *defs = &state->defaults;
 150         uint32_t custom_mask = ~0;
 151
 152 #define policy(t) \
 153         ((t == FW3_FLAG_REJECT) ? "DROP" : fw3_flag_names[t])
 154
 155         if (family == FW3_FAMILY_V6 && defs->disable_ipv6)
 156                 return;
 157
 158         if (table == FW3_TABLE_FILTER)
 159         {
 160                 fw3_pr(":INPUT %s [0:0]\n", policy(defs->policy_input));
 161                 fw3_pr(":FORWARD %s [0:0]\n", policy(defs->policy_forward));
 162                 fw3_pr(":OUTPUT %s [0:0]\n", policy(defs->policy_output));
 163         }
 164
 165         /* Don't touch user chains on reload */
 166         if (reload)
 167                 delbit(custom_mask, FW3_FLAG_CUSTOM_CHAINS);
 168
 169         if (defs->custom_chains)
 170                 set(defs->flags, family, FW3_FLAG_CUSTOM_CHAINS);
 171
 172         if (defs->syn_flood)
 173                 set(defs->flags, family, FW3_FLAG_SYN_FLOOD);
 174
 175         rv = fw3_pr_rulespec(table, family, defs->flags, custom_mask,
 176                              default_chains, ":%s - [0:0]\n");
 177
 178         if (rv)
 179                 set(defs->flags, family, table);
 180 }
 181
 182 void
 183 fw3_print_default_head_rules(struct fw3_state *state, enum fw3_family family,
 184                              enum fw3_table table, bool reload)
 185 {
 186         int i;
 187         struct fw3_defaults *defs = &state->defaults;
 188         const char *chains[] = {
 189                 "input", "input",
 190                 "output", "output",
 191                 "forward", "forwarding",
 192         };
 193
 194         fw3_pr_rulespec(table, family, NULL, 0, toplevel_rules, "-A %s\n");
 195
 196         switch (table)
 197         {
 198         case FW3_TABLE_FILTER:
 199                 fw3_pr("-A delegate_input -i lo -j ACCEPT\n");
 200                 fw3_pr("-A delegate_output -o lo -j ACCEPT\n");
 201
 202                 if (defs->custom_chains)
 203                 {
 204                         for (i = 0; i < ARRAY_SIZE(chains); i += 2)
 205                         {
 206                                 fw3_pr("-A delegate_%s -m comment "
 207                                        "--comment \"user chain for %s\" -j %s_rule\n",
 208                                            chains[i], chains[i+1], chains[i+1]);
 209                         }
 210                 }
 211
 212                 for (i = 0; i < ARRAY_SIZE(chains); i += 2)
 213                 {
 214                         fw3_pr("-A delegate_%s -m conntrack --ctstate RELATED,ESTABLISHED "
 215                                "-j ACCEPT\n", chains[i]);
 216
 217                         if (defs->drop_invalid)
 218                         {
 219                                 fw3_pr("-A delegate_%s -m conntrack --ctstate INVALID -j DROP\n",
 220                                        chains[i]);
 221                         }
 222                 }
 223
 224                 if (defs->syn_flood)
 225                 {
 226                         fw3_pr("-A syn_flood -p tcp --syn");
 227                         fw3_format_limit(&defs->syn_flood_rate);
 228                         fw3_pr(" -j RETURN\n");
 229
 230                         fw3_pr("-A syn_flood -j DROP\n");
 231                         fw3_pr("-A delegate_input -p tcp --syn -j syn_flood\n");
 232                 }
 233
 234                 fw3_pr("-A reject -p tcp -j REJECT --reject-with tcp-reset\n");
 235                 fw3_pr("-A reject -j REJECT --reject-with port-unreach\n");
 236
 237                 break;
 238
 239         case FW3_TABLE_NAT:
 240                 if (defs->custom_chains)
 241                 {
 242                         fw3_pr("-A delegate_prerouting "
 243                                "-m comment --comment \"user chain for prerouting\" "
 244                                "-j prerouting_rule\n");
 245
 246                         fw3_pr("-A delegate_postrouting "
 247                                "-m comment --comment \"user chain for postrouting\" "
 248                                "-j postrouting_rule\n");
 249                 }
 250                 break;
 251
 252         default:
 253                 break;
 254         }
 255 }
 256
 257 void
 258 fw3_print_default_tail_rules(struct fw3_state *state, enum fw3_family family,
 259                              enum fw3_table table, bool reload)
 260 {
 261         struct fw3_defaults *defs = &state->defaults;
 262
 263         if (table != FW3_TABLE_FILTER)
 264                 return;
 265
 266         if (defs->policy_input == FW3_FLAG_REJECT)
 267                 fw3_pr("-A delegate_input -j reject\n");
 268
 269         if (defs->policy_output == FW3_FLAG_REJECT)
 270                 fw3_pr("-A delegate_output -j reject\n");
 271
 272         if (defs->policy_forward == FW3_FLAG_REJECT)
 273                 fw3_pr("-A delegate_forward -j reject\n");
 274 }
 275
 276 static void
 277 set_default(const char *name, bool set)
 278 {
 279         FILE *f;
 280         char path[sizeof("/proc/sys/net/ipv4/tcp_window_scaling\0")];
 281
 282         snprintf(path, sizeof(path), "/proc/sys/net/ipv4/tcp_%s", name);
 283
 284         info(" * Set tcp_%s to %s", name, set ? "on" : "off", name);
 285
 286         if (!(f = fopen(path, "w")))
 287         {
 288                 info("   ! Unable to write value: %s", strerror(errno));
 289                 return;
 290         }
 291
 292         fprintf(f, "%u\n", set);
 293         fclose(f);
 294 }
 295
 296 void
 297 fw3_set_defaults(struct fw3_state *state)
 298 {
 299         set_default("ecn",            state->defaults.tcp_ecn);
 300         set_default("syncookies",     state->defaults.tcp_syncookies);
 301         set_default("window_scaling", state->defaults.tcp_window_scaling);
 302 }
 303
 304 static void
 305 reset_policy(enum fw3_table table, enum fw3_flag policy)
 306 {
 307         if (table != FW3_TABLE_FILTER)
 308                 return;
 309
 310         fw3_pr(":INPUT %s [0:0]\n", fw3_flag_names[policy]);
 311         fw3_pr(":OUTPUT %s [0:0]\n", fw3_flag_names[policy]);
 312         fw3_pr(":FORWARD %s [0:0]\n", fw3_flag_names[policy]);
 313 }
 314
 315 void
 316 fw3_flush_rules(struct fw3_state *state, enum fw3_family family,
 317                 enum fw3_table table, bool reload, bool pass2)
 318 {
 319         struct fw3_defaults *defs = &state->defaults;
 320         uint32_t custom_mask = ~0;
 321
 322         if (!has(defs->flags, family, table))
 323                 return;
 324
 325         /* don't touch user chains on selective stop */
 326         if (reload)
 327                 delbit(custom_mask, FW3_FLAG_CUSTOM_CHAINS);
 328
 329         if (!pass2)
 330         {
 331                 reset_policy(table, reload ? FW3_FLAG_DROP : FW3_FLAG_ACCEPT);
 332
 333                 fw3_pr_rulespec(table, family, defs->flags, custom_mask,
 334                                 toplevel_rules, "-D %s\n");
 335
 336                 fw3_pr_rulespec(table, family, defs->flags, custom_mask,
 337                                 default_chains, "-F %s\n");
 338         }
 339         else
 340         {
 341                 fw3_pr_rulespec(table, family, defs->flags, custom_mask,
 342                                 default_chains, "-X %s\n");
 343
 344                 del(defs->flags, family, table);
 345         }
 346 }
 347
 348 void
 349 fw3_flush_all(enum fw3_table table)
 350 {
 351         reset_policy(table, FW3_FLAG_ACCEPT);
 352
 353         fw3_pr("-F\n");
 354         fw3_pr("-X\n");
 355 }