defaults.c

   1 /*
   2  * firewall3 - 3rd OpenWrt UCI firewall implementation
   3  *
   4  *   Copyright (C) 2013 Jo-Philipp Wich <jow@openwrt.org>
   5  *
   6  * Permission to use, copy, modify, and/or distribute this software for any
   7  * purpose with or without fee is hereby granted, provided that the above
   8  * copyright notice and this permission notice appear in all copies.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17  */
  18
  19 #include "defaults.h"
  20
  21
  22 #define C(f, tbl, def, name) \
  23         { FW3_FAMILY_##f, FW3_TABLE_##tbl, FW3_DEFAULT_##def, name }
  24
  25 struct chain {
  26         enum fw3_family family;
  27         enum fw3_table table;
  28         enum fw3_default flag;
  29         const char *name;
  30 };
  31
  32 static const struct chain default_chains[] = {
  33         C(ANY, FILTER, UNSPEC,        "delegate_input"),
  34         C(ANY, FILTER, UNSPEC,        "delegate_output"),
  35         C(ANY, FILTER, UNSPEC,        "delegate_forward"),
  36         C(ANY, FILTER, CUSTOM_CHAINS, "input_rule"),
  37         C(ANY, FILTER, CUSTOM_CHAINS, "output_rule"),
  38         C(ANY, FILTER, CUSTOM_CHAINS, "forwarding_rule"),
  39         C(ANY, FILTER, UNSPEC,        "reject"),
  40         C(ANY, FILTER, SYN_FLOOD,     "syn_flood"),
  41
  42         C(V4,  NAT,    UNSPEC,        "delegate_prerouting"),
  43         C(V4,  NAT,    UNSPEC,        "delegate_postrouting"),
  44         C(V4,  NAT,    CUSTOM_CHAINS, "prerouting_rule"),
  45         C(V4,  NAT,    CUSTOM_CHAINS, "postrouting_rule"),
  46
  47         C(ANY, MANGLE, UNSPEC,        "mssfix"),
  48         C(ANY, RAW,    UNSPEC,        "notrack"),
  49 };
  50
  51 static const struct chain toplevel_rules[] = {
  52         C(ANY, FILTER, UNSPEC,        "INPUT -j delegate_input"),
  53         C(ANY, FILTER, UNSPEC,        "OUTPUT -j delegate_output"),
  54         C(ANY, FILTER, UNSPEC,        "FORWARD -j delegate_forward"),
  55
  56         C(V4,  NAT,    UNSPEC,        "PREROUTING -j delegate_prerouting"),
  57         C(V4,  NAT,    UNSPEC,        "POSTROUTING -j delegate_postrouting"),
  58
  59         C(ANY, MANGLE, UNSPEC,        "FORWARD -j mssfix"),
  60         C(ANY, RAW,    UNSPEC,        "PREROUTING -j notrack"),
  61 };
  62
  63 static struct fw3_option default_opts[] = {
  64         FW3_OPT("input",               target,   defaults, policy_input),
  65         FW3_OPT("forward",             target,   defaults, policy_forward),
  66         FW3_OPT("output",              target,   defaults, policy_output),
  67
  68         FW3_OPT("drop_invalid",        bool,     defaults, drop_invalid),
  69
  70         FW3_OPT("syn_flood",           bool,     defaults, syn_flood),
  71         FW3_OPT("synflood_protect",    bool,     defaults, syn_flood),
  72         FW3_OPT("synflood_rate",       limit,    defaults, syn_flood_rate),
  73         FW3_OPT("synflood_burst",      int,      defaults, syn_flood_rate.burst),
  74
  75         FW3_OPT("tcp_syncookies",      bool,     defaults, tcp_syncookies),
  76         FW3_OPT("tcp_ecn",             bool,     defaults, tcp_ecn),
  77         FW3_OPT("tcp_westwood",        bool,     defaults, tcp_westwood),
  78         FW3_OPT("tcp_window_scaling",  bool,     defaults, tcp_window_scaling),
  79
  80         FW3_OPT("accept_redirects",    bool,     defaults, accept_redirects),
  81         FW3_OPT("accept_source_route", bool,     defaults, accept_source_route),
  82
  83         FW3_OPT("custom_chains",       bool,     defaults, custom_chains),
  84         FW3_OPT("disable_ipv6",        bool,     defaults, disable_ipv6),
  85 };
  86
  87
  88 static bool
  89 print_chains(enum fw3_table table, enum fw3_family family,
  90              const char *fmt, uint8_t flags,
  91              const struct chain *chains, int n)
  92 {
  93         bool rv = false;
  94         const struct chain *c;
  95
  96         for (c = chains; n > 0; c++, n--)
  97         {
  98                 if (!fw3_is_family(c, family))
  99                         continue;
 100
 101                 if (c->table != table)
 102                         continue;
 103
 104                 if ((c->flag != FW3_DEFAULT_UNSPEC) && !(flags & (1 << c->flag)))
 105                         continue;
 106
 107                 fw3_pr(fmt, c->name);
 108
 109                 rv = true;
 110         }
 111
 112         return rv;
 113 }
 114
 115 static void
 116 check_policy(struct uci_element *e, enum fw3_target *pol, const char *name)
 117 {
 118         if (*pol == FW3_TARGET_UNSPEC)
 119         {
 120                 warn_elem(e, "has no %s policy specified, defaulting to DROP", name);
 121                 *pol = FW3_TARGET_DROP;
 122         }
 123         else if (*pol > FW3_TARGET_DROP)
 124         {
 125                 warn_elem(e, "has invalid %s policy, defaulting to DROP", name);
 126                 *pol = FW3_TARGET_DROP;
 127         }
 128 }
 129
 130 void
 131 fw3_load_defaults(struct fw3_state *state, struct uci_package *p)
 132 {
 133         struct uci_section *s;
 134         struct uci_element *e;
 135         struct fw3_defaults *defs = &state->defaults;
 136
 137         bool seen = false;
 138
 139         defs->syn_flood_rate.rate  = 25;
 140         defs->syn_flood_rate.burst = 50;
 141         defs->tcp_syncookies       = true;
 142         defs->tcp_window_scaling   = true;
 143         defs->custom_chains        = true;
 144
 145         uci_foreach_element(&p->sections, e)
 146         {
 147                 s = uci_to_section(e);
 148
 149                 if (strcmp(s->type, "defaults"))
 150                         continue;
 151
 152                 if (seen)
 153                 {
 154                         warn_elem(e, "ignoring duplicate section");
 155                         continue;
 156                 }
 157
 158                 fw3_parse_options(&state->defaults,
 159                                   default_opts, ARRAY_SIZE(default_opts), s);
 160
 161                 check_policy(e, &defs->policy_input, "input");
 162                 check_policy(e, &defs->policy_output, "output");
 163                 check_policy(e, &defs->policy_forward, "forward");
 164
 165                 if (defs->custom_chains)
 166                         defs->has_flag |= (1 << FW3_DEFAULT_CUSTOM_CHAINS);
 167
 168                 if (defs->syn_flood)
 169                         defs->has_flag |= (1 << FW3_DEFAULT_SYN_FLOOD);
 170         }
 171 }
 172
 173 void
 174 fw3_print_default_chains(enum fw3_table table, enum fw3_family family,
 175                          struct fw3_state *state)
 176 {
 177         struct fw3_defaults *defs = &state->defaults;
 178         const char *policy[] = {
 179                 "(bug)",
 180                 "ACCEPT",
 181                 "DROP",
 182                 "DROP",
 183                 "(bug)",
 184                 "(bug)",
 185                 "(bug)",
 186         };
 187
 188         if (table == FW3_TABLE_FILTER)
 189         {
 190                 fw3_pr(":INPUT %s [0:0]\n", policy[defs->policy_input]);
 191                 fw3_pr(":FORWARD %s [0:0]\n", policy[defs->policy_forward]);
 192                 fw3_pr(":OUTPUT %s [0:0]\n", policy[defs->policy_output]);
 193         }
 194
 195         print_chains(table, family, ":%s - [0:0]\n", defs->has_flag,
 196                      default_chains, ARRAY_SIZE(default_chains));
 197 }
 198
 199 void
 200 fw3_print_default_head_rules(enum fw3_table table, enum fw3_family family,
 201                              struct fw3_state *state)
 202 {
 203         int i;
 204         struct fw3_defaults *defs = &state->defaults;
 205         const char *chains[] = {
 206                 "input",
 207                 "output",
 208                 "forward",
 209         };
 210
 211         print_chains(table, family, "-A %s\n", 0,
 212                      toplevel_rules, ARRAY_SIZE(toplevel_rules));
 213
 214         switch (table)
 215         {
 216         case FW3_TABLE_FILTER:
 217                 fw3_pr("-A delegate_input -i lo -j ACCEPT\n");
 218                 fw3_pr("-A delegate_output -o lo -j ACCEPT\n");
 219
 220                 if (defs->custom_chains)
 221                 {
 222                         fw3_pr("-A delegate_input -j input_rule\n");
 223                         fw3_pr("-A delegate_output -j output_rule\n");
 224                         fw3_pr("-A delegate_forward -j forwarding_rule\n");
 225                 }
 226
 227                 for (i = 0; i < ARRAY_SIZE(chains); i++)
 228                 {
 229                         fw3_pr("-A delegate_%s -m conntrack --ctstate RELATED,ESTABLISHED "
 230                                "-j ACCEPT\n", chains[i]);
 231
 232                         if (defs->drop_invalid)
 233                         {
 234                                 fw3_pr("-A delegate_%s -m conntrack --ctstate INVALID -j DROP\n",
 235                                        chains[i]);
 236                         }
 237                 }
 238
 239                 if (defs->syn_flood)
 240                 {
 241                         fw3_pr("-A syn_flood -p tcp --syn");
 242                         fw3_format_limit(&defs->syn_flood_rate);
 243                         fw3_pr(" -j RETURN\n");
 244
 245                         fw3_pr("-A syn_flood -j DROP\n");
 246                         fw3_pr("-A delegate_input -p tcp --syn -j syn_flood\n");
 247                 }
 248
 249                 fw3_pr("-A reject -p tcp -j REJECT --reject-with tcp-reset\n");
 250                 fw3_pr("-A reject -j REJECT --reject-with port-unreach\n");
 251
 252                 break;
 253
 254         case FW3_TABLE_NAT:
 255                 if (defs->custom_chains)
 256                 {
 257                         fw3_pr("-A delegate_prerouting -j prerouting_rule\n");
 258                         fw3_pr("-A delegate_postrouting -j postrouting_rule\n");
 259                 }
 260                 break;
 261
 262         default:
 263                 break;
 264         }
 265 }
 266
 267 void
 268 fw3_print_default_tail_rules(enum fw3_table table, enum fw3_family family,
 269                              struct fw3_state *state)
 270 {
 271         struct fw3_defaults *defs = &state->defaults;
 272
 273         if (table != FW3_TABLE_FILTER)
 274                 return;
 275
 276         if (defs->policy_input == FW3_TARGET_REJECT)
 277                 fw3_pr("-A delegate_input -j reject\n");
 278
 279         if (defs->policy_output == FW3_TARGET_REJECT)
 280                 fw3_pr("-A delegate_output -j reject\n");
 281
 282         if (defs->policy_forward == FW3_TARGET_REJECT)
 283                 fw3_pr("-A delegate_forward -j reject\n");
 284 }
 285
 286 static void
 287 reset_policy(enum fw3_table table)
 288 {
 289         if (table != FW3_TABLE_FILTER)
 290                 return;
 291
 292         fw3_pr(":INPUT ACCEPT [0:0]\n");
 293         fw3_pr(":OUTPUT ACCEPT [0:0]\n");
 294         fw3_pr(":FORWARD ACCEPT [0:0]\n");
 295 }
 296
 297 void
 298 fw3_flush_rules(enum fw3_table table, enum fw3_family family,
 299                 bool pass2, struct list_head *statefile)
 300 {
 301         struct fw3_statefile_entry *e;
 302
 303         list_for_each_entry(e, statefile, list)
 304         {
 305                 if (e->type != FW3_TYPE_DEFAULTS)
 306                         continue;
 307
 308                 if (!pass2)
 309                 {
 310                         reset_policy(table);
 311
 312                         print_chains(table, family, "-D %s\n", e->flags[0],
 313                                      toplevel_rules, ARRAY_SIZE(toplevel_rules));
 314
 315                         print_chains(table, family, "-F %s\n", e->flags[0],
 316                                      default_chains, ARRAY_SIZE(default_chains));
 317                 }
 318                 else
 319                 {
 320                         print_chains(table, family, "-X %s\n", e->flags[0],
 321                                      default_chains, ARRAY_SIZE(default_chains));
 322                 }
 323         }
 324 }
 325
 326 void
 327 fw3_flush_all(enum fw3_table table)
 328 {
 329         reset_policy(table);
 330
 331         fw3_pr("-F\n");
 332         fw3_pr("-X\n");
 333 }