defaults.c

   1 /*
   2  * firewall3 - 3rd OpenWrt UCI firewall implementation
   3  *
   4  *   Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
   5  *
   6  * Permission to use, copy, modify, and/or distribute this software for any
   7  * purpose with or without fee is hereby granted, provided that the above
   8  * copyright notice and this permission notice appear in all copies.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17  */
  18
  19 #include "defaults.h"
  20
  21
  22 #define C(f, tbl, def, fmt) \
  23         { FW3_FAMILY_##f, FW3_TABLE_##tbl, FW3_FLAG_##def, fmt }
  24
  25 static const struct fw3_rule_spec default_chains[] = {
  26         C(ANY, FILTER, UNSPEC,        "delegate_input"),
  27         C(ANY, FILTER, UNSPEC,        "delegate_output"),
  28         C(ANY, FILTER, UNSPEC,        "delegate_forward"),
  29         C(ANY, FILTER, UNSPEC,        "reject"),
  30         C(ANY, FILTER, CUSTOM_CHAINS, "input_rule"),
  31         C(ANY, FILTER, CUSTOM_CHAINS, "output_rule"),
  32         C(ANY, FILTER, CUSTOM_CHAINS, "forwarding_rule"),
  33         C(ANY, FILTER, SYN_FLOOD,     "syn_flood"),
  34
  35         C(V4,  NAT,    UNSPEC,        "delegate_prerouting"),
  36         C(V4,  NAT,    UNSPEC,        "delegate_postrouting"),
  37         C(V4,  NAT,    CUSTOM_CHAINS, "prerouting_rule"),
  38         C(V4,  NAT,    CUSTOM_CHAINS, "postrouting_rule"),
  39
  40         C(ANY, MANGLE, UNSPEC,        "mssfix"),
  41         C(ANY, MANGLE, UNSPEC,        "fwmark"),
  42
  43         C(ANY, RAW,    UNSPEC,        "notrack"),
  44
  45         { }
  46 };
  47
  48 static const struct fw3_rule_spec toplevel_rules[] = {
  49         C(ANY, FILTER, UNSPEC,        "INPUT -j delegate_input"),
  50         C(ANY, FILTER, UNSPEC,        "OUTPUT -j delegate_output"),
  51         C(ANY, FILTER, UNSPEC,        "FORWARD -j delegate_forward"),
  52
  53         C(V4,  NAT,    UNSPEC,        "PREROUTING -j delegate_prerouting"),
  54         C(V4,  NAT,    UNSPEC,        "POSTROUTING -j delegate_postrouting"),
  55
  56         C(ANY, MANGLE, UNSPEC,        "FORWARD -j mssfix"),
  57         C(ANY, MANGLE, UNSPEC,        "PREROUTING -j fwmark"),
  58
  59         C(ANY, RAW,    UNSPEC,        "PREROUTING -j notrack"),
  60
  61         { }
  62 };
  63
  64 const struct fw3_option fw3_flag_opts[] = {
  65         FW3_OPT("input",               target,   defaults, policy_input),
  66         FW3_OPT("forward",             target,   defaults, policy_forward),
  67         FW3_OPT("output",              target,   defaults, policy_output),
  68
  69         FW3_OPT("drop_invalid",        bool,     defaults, drop_invalid),
  70
  71         FW3_OPT("syn_flood",           bool,     defaults, syn_flood),
  72         FW3_OPT("synflood_protect",    bool,     defaults, syn_flood),
  73         FW3_OPT("synflood_rate",       limit,    defaults, syn_flood_rate),
  74         FW3_OPT("synflood_burst",      int,      defaults, syn_flood_rate.burst),
  75
  76         FW3_OPT("tcp_syncookies",      bool,     defaults, tcp_syncookies),
  77         FW3_OPT("tcp_ecn",             bool,     defaults, tcp_ecn),
  78         FW3_OPT("tcp_window_scaling",  bool,     defaults, tcp_window_scaling),
  79
  80         FW3_OPT("accept_redirects",    bool,     defaults, accept_redirects),
  81         FW3_OPT("accept_source_route", bool,     defaults, accept_source_route),
  82
  83         FW3_OPT("custom_chains",       bool,     defaults, custom_chains),
  84         FW3_OPT("disable_ipv6",        bool,     defaults, disable_ipv6),
  85
  86         { }
  87 };
  88
  89
  90 static void
  91 check_policy(struct uci_element *e, enum fw3_flag *pol, const char *name)
  92 {
  93         if (*pol == FW3_FLAG_UNSPEC)
  94         {
  95                 warn_elem(e, "has no %s policy specified, defaulting to DROP", name);
  96                 *pol = FW3_FLAG_DROP;
  97         }
  98         else if (*pol > FW3_FLAG_DROP)
  99         {
 100                 warn_elem(e, "has invalid %s policy, defaulting to DROP", name);
 101                 *pol = FW3_FLAG_DROP;
 102         }
 103 }
 104
 105 void
 106 fw3_load_defaults(struct fw3_state *state, struct uci_package *p)
 107 {
 108         struct uci_section *s;
 109         struct uci_element *e;
 110         struct fw3_defaults *defs = &state->defaults;
 111
 112         bool seen = false;
 113
 114         defs->syn_flood_rate.rate  = 25;
 115         defs->syn_flood_rate.burst = 50;
 116         defs->tcp_syncookies       = true;
 117         defs->tcp_window_scaling   = true;
 118         defs->custom_chains        = true;
 119
 120         uci_foreach_element(&p->sections, e)
 121         {
 122                 s = uci_to_section(e);
 123
 124                 if (strcmp(s->type, "defaults"))
 125                         continue;
 126
 127                 if (seen)
 128                 {
 129                         warn_elem(e, "ignoring duplicate section");
 130                         continue;
 131                 }
 132
 133                 fw3_parse_options(&state->defaults, fw3_flag_opts, s);
 134
 135                 check_policy(e, &defs->policy_input, "input");
 136                 check_policy(e, &defs->policy_output, "output");
 137                 check_policy(e, &defs->policy_forward, "forward");
 138         }
 139 }
 140
 141 void
 142 fw3_print_default_chains(struct fw3_state *state, enum fw3_family family,
 143                          enum fw3_table table, bool reload)
 144 {
 145         bool rv;
 146         struct fw3_defaults *defs = &state->defaults;
 147         uint32_t custom_mask = ~0;
 148
 149 #define policy(t) \
 150         ((t == FW3_FLAG_REJECT) ? "DROP" : fw3_flag_names[t])
 151
 152         if (family == FW3_FAMILY_V6 && defs->disable_ipv6)
 153                 return;
 154
 155         if (table == FW3_TABLE_FILTER)
 156         {
 157                 fw3_pr(":INPUT %s [0:0]\n", policy(defs->policy_input));
 158                 fw3_pr(":FORWARD %s [0:0]\n", policy(defs->policy_forward));
 159                 fw3_pr(":OUTPUT %s [0:0]\n", policy(defs->policy_output));
 160         }
 161
 162         /* Don't touch user chains on reload */
 163         if (reload)
 164                 delbit(custom_mask, FW3_FLAG_CUSTOM_CHAINS);
 165
 166         if (defs->custom_chains)
 167                 set(defs->flags, family, FW3_FLAG_CUSTOM_CHAINS);
 168
 169         if (defs->syn_flood)
 170                 set(defs->flags, family, FW3_FLAG_SYN_FLOOD);
 171
 172         rv = fw3_pr_rulespec(table, family, defs->flags, custom_mask,
 173                              default_chains, ":%s - [0:0]\n");
 174
 175         if (rv)
 176                 set(defs->flags, family, table);
 177 }
 178
 179 void
 180 fw3_print_default_head_rules(struct fw3_state *state, enum fw3_family family,
 181                              enum fw3_table table, bool reload)
 182 {
 183         int i;
 184         struct fw3_defaults *defs = &state->defaults;
 185         const char *chains[] = {
 186                 "input", "input",
 187                 "output", "output",
 188                 "forward", "forwarding",
 189         };
 190
 191         fw3_pr_rulespec(table, family, NULL, 0, toplevel_rules, "-A %s\n");
 192
 193         switch (table)
 194         {
 195         case FW3_TABLE_FILTER:
 196                 fw3_pr("-A delegate_input -i lo -j ACCEPT\n");
 197                 fw3_pr("-A delegate_output -o lo -j ACCEPT\n");
 198
 199                 if (defs->custom_chains)
 200                 {
 201                         for (i = 0; i < ARRAY_SIZE(chains); i += 2)
 202                         {
 203                                 fw3_pr("-A delegate_%s -m comment "
 204                                        "--comment \"user chain for %s\" -j %s_rule\n",
 205                                            chains[i], chains[i+1], chains[i+1]);
 206                         }
 207                 }
 208
 209                 for (i = 0; i < ARRAY_SIZE(chains); i += 2)
 210                 {
 211                         fw3_pr("-A delegate_%s -m conntrack --ctstate RELATED,ESTABLISHED "
 212                                "-j ACCEPT\n", chains[i]);
 213
 214                         if (defs->drop_invalid)
 215                         {
 216                                 fw3_pr("-A delegate_%s -m conntrack --ctstate INVALID -j DROP\n",
 217                                        chains[i]);
 218                         }
 219                 }
 220
 221                 if (defs->syn_flood)
 222                 {
 223                         fw3_pr("-A syn_flood -p tcp --syn");
 224                         fw3_format_limit(&defs->syn_flood_rate);
 225                         fw3_pr(" -j RETURN\n");
 226
 227                         fw3_pr("-A syn_flood -j DROP\n");
 228                         fw3_pr("-A delegate_input -p tcp --syn -j syn_flood\n");
 229                 }
 230
 231                 fw3_pr("-A reject -p tcp -j REJECT --reject-with tcp-reset\n");
 232                 fw3_pr("-A reject -j REJECT --reject-with port-unreach\n");
 233
 234                 break;
 235
 236         case FW3_TABLE_NAT:
 237                 if (defs->custom_chains)
 238                 {
 239                         fw3_pr("-A delegate_prerouting "
 240                                "-m comment --comment \"user chain for prerouting\" "
 241                                "-j prerouting_rule\n");
 242
 243                         fw3_pr("-A delegate_postrouting "
 244                                "-m comment --comment \"user chain for postrouting\" "
 245                                "-j postrouting_rule\n");
 246                 }
 247                 break;
 248
 249         default:
 250                 break;
 251         }
 252 }
 253
 254 void
 255 fw3_print_default_tail_rules(struct fw3_state *state, enum fw3_family family,
 256                              enum fw3_table table, bool reload)
 257 {
 258         struct fw3_defaults *defs = &state->defaults;
 259
 260         if (table != FW3_TABLE_FILTER)
 261                 return;
 262
 263         if (defs->policy_input == FW3_FLAG_REJECT)
 264                 fw3_pr("-A delegate_input -j reject\n");
 265
 266         if (defs->policy_output == FW3_FLAG_REJECT)
 267                 fw3_pr("-A delegate_output -j reject\n");
 268
 269         if (defs->policy_forward == FW3_FLAG_REJECT)
 270                 fw3_pr("-A delegate_forward -j reject\n");
 271 }
 272
 273 static void
 274 set_default(const char *name, bool set)
 275 {
 276         FILE *f;
 277         char path[sizeof("/proc/sys/net/ipv4/tcp_window_scaling\0")];
 278
 279         snprintf(path, sizeof(path), "/proc/sys/net/ipv4/tcp_%s", name);
 280
 281         info(" * Set tcp_%s to %s", name, set ? "on" : "off", name);
 282
 283         if (!(f = fopen(path, "w")))
 284         {
 285                 info("   ! Unable to write value: %s", strerror(errno));
 286                 return;
 287         }
 288
 289         fprintf(f, "%u\n", set);
 290         fclose(f);
 291 }
 292
 293 void
 294 fw3_set_defaults(struct fw3_state *state)
 295 {
 296         set_default("ecn",            state->defaults.tcp_ecn);
 297         set_default("syncookies",     state->defaults.tcp_syncookies);
 298         set_default("window_scaling", state->defaults.tcp_window_scaling);
 299 }
 300
 301 static void
 302 reset_policy(enum fw3_table table, enum fw3_flag policy)
 303 {
 304         if (table != FW3_TABLE_FILTER)
 305                 return;
 306
 307         fw3_pr(":INPUT %s [0:0]\n", fw3_flag_names[policy]);
 308         fw3_pr(":OUTPUT %s [0:0]\n", fw3_flag_names[policy]);
 309         fw3_pr(":FORWARD %s [0:0]\n", fw3_flag_names[policy]);
 310 }
 311
 312 void
 313 fw3_flush_rules(struct fw3_state *state, enum fw3_family family,
 314                 enum fw3_table table, bool reload, bool pass2)
 315 {
 316         struct fw3_defaults *defs = &state->defaults;
 317         uint32_t custom_mask = ~0;
 318
 319         if (!has(defs->flags, family, table))
 320                 return;
 321
 322         /* don't touch user chains on selective stop */
 323         if (reload)
 324                 delbit(custom_mask, FW3_FLAG_CUSTOM_CHAINS);
 325
 326         if (!pass2)
 327         {
 328                 reset_policy(table, reload ? FW3_FLAG_DROP : FW3_FLAG_ACCEPT);
 329
 330                 fw3_pr_rulespec(table, family, defs->flags, custom_mask,
 331                                 toplevel_rules, "-D %s\n");
 332
 333                 fw3_pr_rulespec(table, family, defs->flags, custom_mask,
 334                                 default_chains, "-F %s\n");
 335         }
 336         else
 337         {
 338                 fw3_pr_rulespec(table, family, defs->flags, custom_mask,
 339                                 default_chains, "-X %s\n");
 340
 341                 del(defs->flags, family, table);
 342         }
 343 }
 344
 345 void
 346 fw3_flush_all(enum fw3_table table)
 347 {
 348         reset_policy(table, FW3_FLAG_ACCEPT);
 349
 350         fw3_pr("-F\n");
 351         fw3_pr("-X\n");
 352 }