Don't store zone src_flags in statefile anymore, read and write numeric state values...
[project/firewall3.git] / defaults.c
1 /*
2  * firewall3 - 3rd OpenWrt UCI firewall implementation
3  *
4  *   Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
5  *
6  * Permission to use, copy, modify, and/or distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18
19 #include "defaults.h"
20
21
22 #define C(f, tbl, def, name) \
23         { FW3_FAMILY_##f, FW3_TABLE_##tbl, FW3_DEFAULT_##def, name }
24
25 struct chain {
26         enum fw3_family family;
27         enum fw3_table table;
28         enum fw3_default flag;
29         const char *name;
30 };
31
32 static const struct chain default_chains[] = {
33         C(ANY, FILTER, UNSPEC,        "delegate_input"),
34         C(ANY, FILTER, UNSPEC,        "delegate_output"),
35         C(ANY, FILTER, UNSPEC,        "delegate_forward"),
36         C(ANY, FILTER, CUSTOM_CHAINS, "input_rule"),
37         C(ANY, FILTER, CUSTOM_CHAINS, "output_rule"),
38         C(ANY, FILTER, CUSTOM_CHAINS, "forwarding_rule"),
39         C(ANY, FILTER, UNSPEC,        "reject"),
40         C(ANY, FILTER, SYN_FLOOD,     "syn_flood"),
41
42         C(V4,  NAT,    UNSPEC,        "delegate_prerouting"),
43         C(V4,  NAT,    UNSPEC,        "delegate_postrouting"),
44         C(V4,  NAT,    CUSTOM_CHAINS, "prerouting_rule"),
45         C(V4,  NAT,    CUSTOM_CHAINS, "postrouting_rule"),
46
47         C(ANY, MANGLE, UNSPEC,        "mssfix"),
48         C(ANY, RAW,    UNSPEC,        "notrack"),
49 };
50
51 static const struct chain toplevel_rules[] = {
52         C(ANY, FILTER, UNSPEC,        "INPUT -j delegate_input"),
53         C(ANY, FILTER, UNSPEC,        "OUTPUT -j delegate_output"),
54         C(ANY, FILTER, UNSPEC,        "FORWARD -j delegate_forward"),
55
56         C(V4,  NAT,    UNSPEC,        "PREROUTING -j delegate_prerouting"),
57         C(V4,  NAT,    UNSPEC,        "POSTROUTING -j delegate_postrouting"),
58
59         C(ANY, MANGLE, UNSPEC,        "FORWARD -j mssfix"),
60         C(ANY, RAW,    UNSPEC,        "PREROUTING -j notrack"),
61 };
62
63 const struct fw3_option fw3_default_opts[] = {
64         FW3_OPT("input",               target,   defaults, policy_input),
65         FW3_OPT("forward",             target,   defaults, policy_forward),
66         FW3_OPT("output",              target,   defaults, policy_output),
67
68         FW3_OPT("drop_invalid",        bool,     defaults, drop_invalid),
69
70         FW3_OPT("syn_flood",           bool,     defaults, syn_flood),
71         FW3_OPT("synflood_protect",    bool,     defaults, syn_flood),
72         FW3_OPT("synflood_rate",       limit,    defaults, syn_flood_rate),
73         FW3_OPT("synflood_burst",      int,      defaults, syn_flood_rate.burst),
74
75         FW3_OPT("tcp_syncookies",      bool,     defaults, tcp_syncookies),
76         FW3_OPT("tcp_ecn",             bool,     defaults, tcp_ecn),
77         FW3_OPT("tcp_window_scaling",  bool,     defaults, tcp_window_scaling),
78
79         FW3_OPT("accept_redirects",    bool,     defaults, accept_redirects),
80         FW3_OPT("accept_source_route", bool,     defaults, accept_source_route),
81
82         FW3_OPT("custom_chains",       bool,     defaults, custom_chains),
83         FW3_OPT("disable_ipv6",        bool,     defaults, disable_ipv6),
84
85         { }
86 };
87
88
89 static bool
90 print_chains(enum fw3_table table, enum fw3_family family,
91              const char *fmt, uint32_t flags,
92              const struct chain *chains, int n)
93 {
94         bool rv = false;
95         const struct chain *c;
96
97         for (c = chains; n > 0; c++, n--)
98         {
99                 if (!fw3_is_family(c, family))
100                         continue;
101
102                 if (c->table != table)
103                         continue;
104
105                 if ((c->flag != FW3_DEFAULT_UNSPEC) && !hasbit(flags, c->flag))
106                         continue;
107
108                 fw3_pr(fmt, c->name);
109
110                 rv = true;
111         }
112
113         return rv;
114 }
115
116 static void
117 check_policy(struct uci_element *e, enum fw3_target *pol, const char *name)
118 {
119         if (*pol == FW3_TARGET_UNSPEC)
120         {
121                 warn_elem(e, "has no %s policy specified, defaulting to DROP", name);
122                 *pol = FW3_TARGET_DROP;
123         }
124         else if (*pol > FW3_TARGET_DROP)
125         {
126                 warn_elem(e, "has invalid %s policy, defaulting to DROP", name);
127                 *pol = FW3_TARGET_DROP;
128         }
129 }
130
131 void
132 fw3_load_defaults(struct fw3_state *state, struct uci_package *p)
133 {
134         struct uci_section *s;
135         struct uci_element *e;
136         struct fw3_defaults *defs = &state->defaults;
137
138         bool seen = false;
139
140         defs->syn_flood_rate.rate  = 25;
141         defs->syn_flood_rate.burst = 50;
142         defs->tcp_syncookies       = true;
143         defs->tcp_window_scaling   = true;
144         defs->custom_chains        = true;
145
146         setbit(defs->flags, FW3_FAMILY_V4);
147
148         uci_foreach_element(&p->sections, e)
149         {
150                 s = uci_to_section(e);
151
152                 if (strcmp(s->type, "defaults"))
153                         continue;
154
155                 if (seen)
156                 {
157                         warn_elem(e, "ignoring duplicate section");
158                         continue;
159                 }
160
161                 fw3_parse_options(&state->defaults, fw3_default_opts, s);
162
163                 check_policy(e, &defs->policy_input, "input");
164                 check_policy(e, &defs->policy_output, "output");
165                 check_policy(e, &defs->policy_forward, "forward");
166
167                 if (!defs->disable_ipv6)
168                         setbit(defs->flags, FW3_FAMILY_V6);
169
170                 if (defs->custom_chains)
171                         setbit(defs->flags, FW3_DEFAULT_CUSTOM_CHAINS);
172
173                 if (defs->syn_flood)
174                         setbit(defs->flags, FW3_DEFAULT_SYN_FLOOD);
175         }
176 }
177
178 void
179 fw3_print_default_chains(enum fw3_table table, enum fw3_family family,
180                          struct fw3_state *state)
181 {
182         struct fw3_defaults *defs = &state->defaults;
183         uint32_t custom_mask = ~0;
184
185 #define policy(t) \
186         ((t == FW3_TARGET_REJECT) ? "DROP" : fw3_flag_names[t])
187
188         if (table == FW3_TABLE_FILTER)
189         {
190                 fw3_pr(":INPUT %s [0:0]\n", policy(defs->policy_input));
191                 fw3_pr(":FORWARD %s [0:0]\n", policy(defs->policy_forward));
192                 fw3_pr(":OUTPUT %s [0:0]\n", policy(defs->policy_output));
193         }
194
195         /* user chains already loaded, don't create again */
196         if (hasbit(state->defaults.running_flags, FW3_DEFAULT_CUSTOM_CHAINS))
197                 delbit(custom_mask, FW3_DEFAULT_CUSTOM_CHAINS);
198
199         print_chains(table, family, ":%s - [0:0]\n", defs->flags & custom_mask,
200                      default_chains, ARRAY_SIZE(default_chains));
201 }
202
203 void
204 fw3_print_default_head_rules(enum fw3_table table, enum fw3_family family,
205                              struct fw3_state *state)
206 {
207         int i;
208         struct fw3_defaults *defs = &state->defaults;
209         const char *chains[] = {
210                 "input", "input",
211                 "output", "output",
212                 "forward", "forwarding",
213         };
214
215         print_chains(table, family, "-A %s\n", 0,
216                      toplevel_rules, ARRAY_SIZE(toplevel_rules));
217
218         switch (table)
219         {
220         case FW3_TABLE_FILTER:
221                 fw3_pr("-A delegate_input -i lo -j ACCEPT\n");
222                 fw3_pr("-A delegate_output -o lo -j ACCEPT\n");
223
224                 if (defs->custom_chains)
225                 {
226                         for (i = 0; i < ARRAY_SIZE(chains); i += 2)
227                         {
228                                 fw3_pr("-A delegate_%s -m comment "
229                                        "--comment \"user chain for %s\" -j %s_rule\n",
230                                            chains[i], chains[i+1], chains[i+1]);
231                         }
232                 }
233
234                 for (i = 0; i < ARRAY_SIZE(chains); i += 2)
235                 {
236                         fw3_pr("-A delegate_%s -m conntrack --ctstate RELATED,ESTABLISHED "
237                                "-j ACCEPT\n", chains[i]);
238
239                         if (defs->drop_invalid)
240                         {
241                                 fw3_pr("-A delegate_%s -m conntrack --ctstate INVALID -j DROP\n",
242                                        chains[i]);
243                         }
244                 }
245
246                 if (defs->syn_flood)
247                 {
248                         fw3_pr("-A syn_flood -p tcp --syn");
249                         fw3_format_limit(&defs->syn_flood_rate);
250                         fw3_pr(" -j RETURN\n");
251
252                         fw3_pr("-A syn_flood -j DROP\n");
253                         fw3_pr("-A delegate_input -p tcp --syn -j syn_flood\n");
254                 }
255
256                 fw3_pr("-A reject -p tcp -j REJECT --reject-with tcp-reset\n");
257                 fw3_pr("-A reject -j REJECT --reject-with port-unreach\n");
258
259                 break;
260
261         case FW3_TABLE_NAT:
262                 if (defs->custom_chains)
263                 {
264                         fw3_pr("-A delegate_prerouting "
265                                "-m comment --comment \"user chain for prerouting\" "
266                                "-j prerouting_rule\n");
267
268                         fw3_pr("-A delegate_postrouting "
269                                "-m comment --comment \"user chain for postrouting\" "
270                                "-j postrouting_rule\n");
271                 }
272                 break;
273
274         default:
275                 break;
276         }
277 }
278
279 void
280 fw3_print_default_tail_rules(enum fw3_table table, enum fw3_family family,
281                              struct fw3_state *state)
282 {
283         struct fw3_defaults *defs = &state->defaults;
284
285         if (table != FW3_TABLE_FILTER)
286                 return;
287
288         if (defs->policy_input == FW3_TARGET_REJECT)
289                 fw3_pr("-A delegate_input -j reject\n");
290
291         if (defs->policy_output == FW3_TARGET_REJECT)
292                 fw3_pr("-A delegate_output -j reject\n");
293
294         if (defs->policy_forward == FW3_TARGET_REJECT)
295                 fw3_pr("-A delegate_forward -j reject\n");
296 }
297
298 static void
299 set_default(const char *name, bool set)
300 {
301         FILE *f;
302         char path[sizeof("/proc/sys/net/ipv4/tcp_window_scaling\0")];
303
304         snprintf(path, sizeof(path), "/proc/sys/net/ipv4/tcp_%s", name);
305
306         info(" * Set tcp_%s to %s", name, set ? "on" : "off", name);
307
308         if (!(f = fopen(path, "w")))
309         {
310                 info("   ! Unable to write value: %s", strerror(errno));
311                 return;
312         }
313
314         fprintf(f, "%u\n", set);
315         fclose(f);
316 }
317
318 void
319 fw3_set_defaults(struct fw3_state *state)
320 {
321         info("Setting sysctl values");
322
323         set_default("ecn",            state->defaults.tcp_ecn);
324         set_default("syncookies",     state->defaults.tcp_syncookies);
325         set_default("window_scaling", state->defaults.tcp_window_scaling);
326 }
327
328 static void
329 reset_policy(enum fw3_table table, enum fw3_target policy)
330 {
331         if (table != FW3_TABLE_FILTER)
332                 return;
333
334         fw3_pr(":INPUT %s [0:0]\n", fw3_flag_names[policy]);
335         fw3_pr(":OUTPUT %s [0:0]\n", fw3_flag_names[policy]);
336         fw3_pr(":FORWARD %s [0:0]\n", fw3_flag_names[policy]);
337 }
338
339 void
340 fw3_flush_rules(enum fw3_table table, enum fw3_family family,
341                 bool pass2, struct fw3_state *state, enum fw3_target policy)
342 {
343         struct fw3_defaults *defs = &state->defaults;
344         uint32_t custom_mask = ~0;
345
346         if (!hasbit(defs->running_flags, family))
347                 return;
348
349         /* don't touch user chains on selective stop */
350         delbit(custom_mask, FW3_DEFAULT_CUSTOM_CHAINS);
351
352         if (!pass2)
353         {
354                 reset_policy(table, policy);
355
356                 print_chains(table, family, "-D %s\n",
357                              defs->running_flags & custom_mask,
358                                          toplevel_rules, ARRAY_SIZE(toplevel_rules));
359
360                 print_chains(table, family, "-F %s\n",
361                              defs->running_flags & custom_mask,
362                                          default_chains, ARRAY_SIZE(default_chains));
363         }
364         else
365         {
366                 print_chains(table, family, "-X %s\n",
367                              defs->running_flags & custom_mask,
368                                          default_chains, ARRAY_SIZE(default_chains));
369
370                 delbit(defs->flags, family);
371         }
372 }
373
374 void
375 fw3_flush_all(enum fw3_table table)
376 {
377         reset_policy(table, FW3_TARGET_ACCEPT);
378
379         fw3_pr("-F\n");
380         fw3_pr("-X\n");
381 }