defaults.c

   1 /*
   2  * firewall3 - 3rd OpenWrt UCI firewall implementation
   3  *
   4  *   Copyright (C) 2013 Jo-Philipp Wich <jo@mein.io>
   5  *
   6  * Permission to use, copy, modify, and/or distribute this software for any
   7  * purpose with or without fee is hereby granted, provided that the above
   8  * copyright notice and this permission notice appear in all copies.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17  */
  18
  19 #include "defaults.h"
  20
  21
  22 #define C(f, tbl, def, fmt) \
  23         { FW3_FAMILY_##f, FW3_TABLE_##tbl, FW3_FLAG_##def, fmt }
  24
  25 static const struct fw3_chain_spec default_chains[] = {
  26         C(ANY, FILTER, UNSPEC,        "reject"),
  27         C(ANY, FILTER, CUSTOM_CHAINS, "input_rule"),
  28         C(ANY, FILTER, CUSTOM_CHAINS, "output_rule"),
  29         C(ANY, FILTER, CUSTOM_CHAINS, "forwarding_rule"),
  30         C(ANY, FILTER, SYN_FLOOD,     "syn_flood"),
  31
  32         C(V4,  NAT,    CUSTOM_CHAINS, "prerouting_rule"),
  33         C(V4,  NAT,    CUSTOM_CHAINS, "postrouting_rule"),
  34
  35         { }
  36 };
  37
  38 const struct fw3_option fw3_flag_opts[] = {
  39         FW3_OPT("input",               target,   defaults, policy_input),
  40         FW3_OPT("forward",             target,   defaults, policy_forward),
  41         FW3_OPT("output",              target,   defaults, policy_output),
  42
  43         FW3_OPT("drop_invalid",        bool,     defaults, drop_invalid),
  44
  45         FW3_OPT("syn_flood",           bool,     defaults, syn_flood),
  46         FW3_OPT("synflood_protect",    bool,     defaults, syn_flood),
  47         FW3_OPT("synflood_rate",       limit,    defaults, syn_flood_rate),
  48         FW3_OPT("synflood_burst",      int,      defaults, syn_flood_rate.burst),
  49
  50         FW3_OPT("tcp_syncookies",      bool,     defaults, tcp_syncookies),
  51         FW3_OPT("tcp_ecn",             int,      defaults, tcp_ecn),
  52         FW3_OPT("tcp_window_scaling",  bool,     defaults, tcp_window_scaling),
  53
  54         FW3_OPT("accept_redirects",    bool,     defaults, accept_redirects),
  55         FW3_OPT("accept_source_route", bool,     defaults, accept_source_route),
  56
  57         FW3_OPT("auto_helper",         bool,     defaults, auto_helper),
  58         FW3_OPT("custom_chains",       bool,     defaults, custom_chains),
  59         FW3_OPT("disable_ipv6",        bool,     defaults, disable_ipv6),
  60         FW3_OPT("flow_offloading",     bool,     defaults, flow_offloading),
  61         FW3_OPT("flow_offloading_hw",  bool,     defaults, flow_offloading_hw),
  62
  63         FW3_OPT("__flags_v4",          int,      defaults, flags[0]),
  64         FW3_OPT("__flags_v6",          int,      defaults, flags[1]),
  65
  66         { }
  67 };
  68
  69
  70 static void
  71 check_policy(struct uci_element *e, enum fw3_flag *pol, const char *name)
  72 {
  73         if (*pol == FW3_FLAG_UNSPEC)
  74         {
  75                 warn_elem(e, "has no %s policy specified, defaulting to DROP", name);
  76                 *pol = FW3_FLAG_DROP;
  77         }
  78         else if (*pol > FW3_FLAG_DROP)
  79         {
  80                 warn_elem(e, "has invalid %s policy, defaulting to DROP", name);
  81                 *pol = FW3_FLAG_DROP;
  82         }
  83 }
  84
  85 static void
  86 check_offloading(struct uci_element *e, bool *offloading)
  87 {
  88         FILE *f;
  89
  90         if (!*offloading)
  91                 return;
  92
  93         f = fopen("/sys/module/xt_FLOWOFFLOAD/refcnt", "r");
  94
  95         if (f)
  96         {
  97                 fclose(f);
  98                 return;
  99         }
 100
 101         warn_elem(e, "enables offloading but missing kernel support, disabling");
 102         *offloading = false;
 103 }
 104
 105 void
 106 fw3_load_defaults(struct fw3_state *state, struct uci_package *p)
 107 {
 108         struct uci_section *s;
 109         struct uci_element *e;
 110         struct fw3_defaults *defs = &state->defaults;
 111
 112         bool seen = false;
 113
 114         defs->syn_flood_rate.rate  = 25;
 115         defs->syn_flood_rate.burst = 50;
 116         defs->tcp_syncookies       = true;
 117         defs->tcp_window_scaling   = true;
 118         defs->custom_chains        = true;
 119         defs->auto_helper          = true;
 120
 121         uci_foreach_element(&p->sections, e)
 122         {
 123                 s = uci_to_section(e);
 124
 125                 if (strcmp(s->type, "defaults"))
 126                         continue;
 127
 128                 if (seen)
 129                 {
 130                         warn_elem(e, "ignoring duplicate section");
 131                         continue;
 132                 }
 133
 134                 if(!fw3_parse_options(&state->defaults, fw3_flag_opts, s))
 135                         warn_elem(e, "has invalid options");
 136
 137                 check_policy(e, &defs->policy_input, "input");
 138                 check_policy(e, &defs->policy_output, "output");
 139                 check_policy(e, &defs->policy_forward, "forward");
 140
 141                 check_offloading(e, &defs->flow_offloading);
 142         }
 143 }
 144
 145 void
 146 fw3_print_default_chains(struct fw3_ipt_handle *handle, struct fw3_state *state,
 147                          bool reload)
 148 {
 149         struct fw3_defaults *defs = &state->defaults;
 150         const struct fw3_chain_spec *c;
 151
 152 #define policy(t) \
 153         ((t == FW3_FLAG_REJECT) ? FW3_FLAG_DROP : t)
 154
 155         if (handle->family == FW3_FAMILY_V6 && defs->disable_ipv6)
 156                 return;
 157
 158         if (handle->table == FW3_TABLE_FILTER)
 159         {
 160                 fw3_ipt_set_policy(handle, "INPUT",   policy(defs->policy_input));
 161                 fw3_ipt_set_policy(handle, "OUTPUT",  policy(defs->policy_output));
 162                 fw3_ipt_set_policy(handle, "FORWARD", policy(defs->policy_forward));
 163         }
 164
 165         if (defs->custom_chains)
 166                 set(defs->flags, handle->family, FW3_FLAG_CUSTOM_CHAINS);
 167
 168         if (defs->syn_flood)
 169                 set(defs->flags, handle->family, FW3_FLAG_SYN_FLOOD);
 170
 171         for (c = default_chains; c->format; c++)
 172         {
 173                 /* don't touch user chains on selective stop */
 174                 if (reload && c->flag == FW3_FLAG_CUSTOM_CHAINS)
 175                         continue;
 176
 177                 if (!fw3_is_family(c, handle->family))
 178                         continue;
 179
 180                 if (c->table != handle->table)
 181                         continue;
 182
 183                 if (c->flag &&
 184                     !fw3_hasbit(defs->flags[handle->family == FW3_FAMILY_V6], c->flag))
 185                         continue;
 186
 187                 fw3_ipt_create_chain(handle, c->format);
 188         }
 189
 190         set(defs->flags, handle->family, handle->table);
 191 }
 192
 193 void
 194 fw3_print_default_head_rules(struct fw3_ipt_handle *handle,
 195                              struct fw3_state *state, bool reload)
 196 {
 197         int i;
 198         struct fw3_defaults *defs = &state->defaults;
 199         struct fw3_device lodev = { .set = true };
 200         struct fw3_protocol tcp = { .protocol = 6 };
 201         struct fw3_ipt_rule *r;
 202
 203         const char *chains[] = {
 204                 "INPUT", "input",
 205                 "OUTPUT", "output",
 206                 "FORWARD", "forwarding",
 207         };
 208
 209         switch (handle->table)
 210         {
 211         case FW3_TABLE_FILTER:
 212
 213                 sprintf(lodev.name, "lo");
 214
 215                 r = fw3_ipt_rule_create(handle, NULL, &lodev, NULL, NULL, NULL);
 216                 fw3_ipt_rule_target(r, "ACCEPT");
 217                 fw3_ipt_rule_append(r, "INPUT");
 218
 219                 r = fw3_ipt_rule_create(handle, NULL, NULL, &lodev, NULL, NULL);
 220                 fw3_ipt_rule_target(r, "ACCEPT");
 221                 fw3_ipt_rule_append(r, "OUTPUT");
 222
 223                 if (defs->custom_chains)
 224                 {
 225                         for (i = 0; i < ARRAY_SIZE(chains); i += 2)
 226                         {
 227                                 r = fw3_ipt_rule_new(handle);
 228                                 fw3_ipt_rule_comment(r, "Custom %s rule chain", chains[i+1]);
 229                                 fw3_ipt_rule_target(r, "%s_rule", chains[i+1]);
 230                                 fw3_ipt_rule_append(r, chains[i]);
 231                         }
 232                 }
 233
 234                 if (defs->flow_offloading)
 235                 {
 236                         r = fw3_ipt_rule_new(handle);
 237                         fw3_ipt_rule_comment(r, "Traffic offloading");
 238                         fw3_ipt_rule_extra(r, "-m conntrack --ctstate RELATED,ESTABLISHED");
 239                         fw3_ipt_rule_target(r, "FLOWOFFLOAD");
 240                         if (defs->flow_offloading_hw)
 241                                 fw3_ipt_rule_addarg(r, false, "--hw", NULL);
 242                         fw3_ipt_rule_append(r, "FORWARD");
 243                 }
 244
 245                 for (i = 0; i < ARRAY_SIZE(chains); i += 2)
 246                 {
 247                         r = fw3_ipt_rule_new(handle);
 248                         fw3_ipt_rule_extra(r, "-m conntrack --ctstate RELATED,ESTABLISHED");
 249                         fw3_ipt_rule_target(r, "ACCEPT");
 250                         fw3_ipt_rule_append(r, chains[i]);
 251
 252                         if (defs->drop_invalid)
 253                         {
 254                                 r = fw3_ipt_rule_new(handle);
 255                                 fw3_ipt_rule_extra(r, "-m conntrack --ctstate INVALID");
 256                                 fw3_ipt_rule_target(r, "DROP");
 257                                 fw3_ipt_rule_append(r, chains[i]);
 258                         }
 259                 }
 260
 261                 if (defs->syn_flood)
 262                 {
 263                         r = fw3_ipt_rule_create(handle, &tcp, NULL, NULL, NULL, NULL);
 264                         fw3_ipt_rule_extra(r, "--syn");
 265                         fw3_ipt_rule_limit(r, &defs->syn_flood_rate);
 266                         fw3_ipt_rule_target(r, "RETURN");
 267                         fw3_ipt_rule_append(r, "syn_flood");
 268
 269                         r = fw3_ipt_rule_new(handle);
 270                         fw3_ipt_rule_target(r, "DROP");
 271                         fw3_ipt_rule_append(r, "syn_flood");
 272
 273                         r = fw3_ipt_rule_create(handle, &tcp, NULL, NULL, NULL, NULL);
 274                         fw3_ipt_rule_extra(r, "--syn");
 275                         fw3_ipt_rule_target(r, "syn_flood");
 276                         fw3_ipt_rule_append(r, "INPUT");
 277                 }
 278
 279                 r = fw3_ipt_rule_create(handle, &tcp, NULL, NULL, NULL, NULL);
 280                 fw3_ipt_rule_target(r, "REJECT");
 281                 fw3_ipt_rule_addarg(r, false, "--reject-with", "tcp-reset");
 282                 fw3_ipt_rule_append(r, "reject");
 283
 284                 r = fw3_ipt_rule_new(handle);
 285                 fw3_ipt_rule_target(r, "REJECT");
 286                 fw3_ipt_rule_addarg(r, false, "--reject-with", "port-unreach");
 287                 fw3_ipt_rule_append(r, "reject");
 288
 289                 break;
 290
 291         case FW3_TABLE_NAT:
 292                 if (defs->custom_chains)
 293                 {
 294                         r = fw3_ipt_rule_new(handle);
 295                         fw3_ipt_rule_comment(r, "Custom prerouting rule chain");
 296                         fw3_ipt_rule_target(r, "prerouting_rule");
 297                         fw3_ipt_rule_append(r, "PREROUTING");
 298
 299                         r = fw3_ipt_rule_new(handle);
 300                         fw3_ipt_rule_comment(r, "Custom postrouting rule chain");
 301                         fw3_ipt_rule_target(r, "postrouting_rule");
 302                         fw3_ipt_rule_append(r, "POSTROUTING");
 303                 }
 304                 break;
 305
 306         default:
 307                 break;
 308         }
 309 }
 310
 311 void
 312 fw3_print_default_tail_rules(struct fw3_ipt_handle *handle,
 313                              struct fw3_state *state, bool reload)
 314 {
 315         struct fw3_defaults *defs = &state->defaults;
 316         struct fw3_ipt_rule *r;
 317
 318         if (handle->table != FW3_TABLE_FILTER)
 319                 return;
 320
 321         if (defs->policy_input == FW3_FLAG_REJECT)
 322         {
 323                 r = fw3_ipt_rule_new(handle);
 324
 325                 if (!r)
 326                         return;
 327
 328                 fw3_ipt_rule_target(r, "reject");
 329                 fw3_ipt_rule_append(r, "INPUT");
 330         }
 331
 332         if (defs->policy_output == FW3_FLAG_REJECT)
 333         {
 334                 r = fw3_ipt_rule_new(handle);
 335
 336                 if (!r)
 337                         return;
 338
 339                 fw3_ipt_rule_target(r, "reject");
 340                 fw3_ipt_rule_append(r, "OUTPUT");
 341         }
 342
 343         if (defs->policy_forward == FW3_FLAG_REJECT)
 344         {
 345                 r = fw3_ipt_rule_new(handle);
 346
 347                 if (!r)
 348                         return;
 349
 350                 fw3_ipt_rule_target(r, "reject");
 351                 fw3_ipt_rule_append(r, "FORWARD");
 352         }
 353 }
 354
 355 static void
 356 set_default(const char *name, int set)
 357 {
 358         FILE *f;
 359         char path[sizeof("/proc/sys/net/ipv4/tcp_window_scaling\0")];
 360
 361         snprintf(path, sizeof(path), "/proc/sys/net/ipv4/tcp_%s", name);
 362
 363         info(" * Set tcp_%s to %s", name, set ? "on" : "off", name);
 364
 365         if (!(f = fopen(path, "w")))
 366         {
 367                 info("   ! Unable to write value: %s", strerror(errno));
 368                 return;
 369         }
 370
 371         fprintf(f, "%u\n", set);
 372         fclose(f);
 373 }
 374
 375 void
 376 fw3_set_defaults(struct fw3_state *state)
 377 {
 378         set_default("ecn",            state->defaults.tcp_ecn);
 379         set_default("syncookies",     state->defaults.tcp_syncookies);
 380         set_default("window_scaling", state->defaults.tcp_window_scaling);
 381 }
 382
 383 void
 384 fw3_flush_rules(struct fw3_ipt_handle *handle, struct fw3_state *state,
 385                 bool reload)
 386 {
 387         enum fw3_flag policy = reload ? FW3_FLAG_DROP : FW3_FLAG_ACCEPT;
 388         struct fw3_defaults *defs = &state->defaults;
 389         const struct fw3_chain_spec *c;
 390
 391         if (!has(defs->flags, handle->family, handle->table))
 392                 return;
 393
 394         if (handle->table == FW3_TABLE_FILTER)
 395         {
 396                 fw3_ipt_set_policy(handle, "INPUT",   policy);
 397                 fw3_ipt_set_policy(handle, "OUTPUT",  policy);
 398                 fw3_ipt_set_policy(handle, "FORWARD", policy);
 399         }
 400
 401         fw3_ipt_delete_id_rules(handle, "INPUT");
 402         fw3_ipt_delete_id_rules(handle, "OUTPUT");
 403         fw3_ipt_delete_id_rules(handle, "FORWARD");
 404         fw3_ipt_delete_id_rules(handle, "PREROUTING");
 405         fw3_ipt_delete_id_rules(handle, "POSTROUTING");
 406
 407         for (c = default_chains; c->format; c++)
 408         {
 409                 /* don't touch user chains on selective stop */
 410                 if (reload && c->flag == FW3_FLAG_CUSTOM_CHAINS)
 411                         continue;
 412
 413                 if (!fw3_is_family(c, handle->family))
 414                         continue;
 415
 416                 if (c->table != handle->table)
 417                         continue;
 418
 419                 if (c->flag && !has(defs->flags, handle->family, c->flag))
 420                         continue;
 421
 422                 fw3_ipt_flush_chain(handle, c->format);
 423
 424                 /* keep certain basic chains that do not depend on any settings to
 425                    avoid purging unrelated user rules pointing to them */
 426                 if (reload && !c->flag)
 427                         continue;
 428
 429                 fw3_ipt_delete_chain(handle, c->format);
 430         }
 431
 432         del(defs->flags, handle->family, handle->table);
 433 }
 434
 435 void
 436 fw3_flush_all(struct fw3_ipt_handle *handle)
 437 {
 438         if (handle->table == FW3_TABLE_FILTER)
 439         {
 440                 fw3_ipt_set_policy(handle, "INPUT",   FW3_FLAG_ACCEPT);
 441                 fw3_ipt_set_policy(handle, "OUTPUT",  FW3_FLAG_ACCEPT);
 442                 fw3_ipt_set_policy(handle, "FORWARD", FW3_FLAG_ACCEPT);
 443         }
 444
 445         fw3_ipt_flush(handle);
 446 }