mirror of https://github.com/hak5/openwrt-owl.git
firewall: various enhancements
- reduce mssfix related log spam (#10681) - separate src and dest terminal chains (#11453, #12945) - disable per-zone custom chains by default, they're rarely used Additionally introduce options "device", "subnet", "extra", "extra_src" and "extra_dest" to allow defining zones not related to uci interfaces, e.g. to match "ppp+" or any tcp traffic to and from a specific port. SVN-Revision: 35484owl
Jo-Philipp Wich
parent
8506964e6d
commit
e106f25ee7
|
|
@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
|
|||
PKG_NAME:=firewall
|
||||
|
||||
PKG_VERSION:=2
|
||||
PKG_RELEASE:=57
|
||||
PKG_RELEASE:=58
|
||||
|
||||
include $(INCLUDE_DIR)/package.mk
|
||||
|
||||
|
|
|
|||
|
|
@ -17,14 +17,14 @@ fw_load_forwarding() {
|
|||
|
||||
fw_callback pre forwarding
|
||||
|
||||
local chain=forward
|
||||
local chain=delegate_forward
|
||||
[ -n "$forwarding_src" ] && {
|
||||
chain=zone_${forwarding_src}_forward
|
||||
}
|
||||
|
||||
local target=ACCEPT
|
||||
[ -n "$forwarding_dest" ] && {
|
||||
target=zone_${forwarding_dest}_ACCEPT
|
||||
target=zone_${forwarding_dest}_dest_ACCEPT
|
||||
}
|
||||
|
||||
local mode
|
||||
|
|
|
|||
|
|
@ -115,13 +115,13 @@ fw_load_defaults() {
|
|||
fw add i n POSTROUTING postrouting_rule
|
||||
}
|
||||
|
||||
fw add i f input
|
||||
fw add i f output
|
||||
fw add i f forward
|
||||
fw add i f delegate_input
|
||||
fw add i f delegate_output
|
||||
fw add i f delegate_forward
|
||||
|
||||
fw add i f INPUT input
|
||||
fw add i f OUTPUT output
|
||||
fw add i f FORWARD forward
|
||||
fw add i f INPUT delegate_input
|
||||
fw add i f OUTPUT delegate_output
|
||||
fw add i f FORWARD delegate_forward
|
||||
|
||||
fw add i f reject
|
||||
fw add i f reject REJECT { --reject-with tcp-reset -p tcp }
|
||||
|
|
@ -138,21 +138,28 @@ fw_config_get_zone() {
|
|||
fw_config_get_section "$1" zone { \
|
||||
string name "$1" \
|
||||
string network "" \
|
||||
string device "" \
|
||||
string subnet "" \
|
||||
string input "$FW_DEFAULT_INPUT_POLICY" \
|
||||
string output "$FW_DEFAULT_OUTPUT_POLICY" \
|
||||
string forward "$FW_DEFAULT_FORWARD_POLICY" \
|
||||
boolean masq 0 \
|
||||
string masq_src "" \
|
||||
string masq_dest "" \
|
||||
string extra "" \
|
||||
string extra_src "" \
|
||||
string extra_dest "" \
|
||||
boolean conntrack 0 \
|
||||
boolean mtu_fix 0 \
|
||||
boolean custom_chains "$FW_ADD_CUSTOM_CHAINS" \
|
||||
boolean custom_chains 0 \
|
||||
boolean log 0 \
|
||||
string log_limit 10 \
|
||||
string family "" \
|
||||
} || return
|
||||
[ -n "$zone_name" ] || zone_name=$zone_NAME
|
||||
[ -n "$zone_network" ] || zone_network=$zone_name
|
||||
[ -n "$zone_extra_src" ] || zone_extra_src="$zone_extra"
|
||||
[ -n "$zone_extra_dest" ] || zone_extra_dest="$zone_extra"
|
||||
[ -n "$zone_network$zone_subnet$zone_device$zone_extra_src$zone_extra_dest" ] || zone_network=$zone_name
|
||||
}
|
||||
|
||||
fw_load_zone() {
|
||||
|
|
@ -192,19 +199,22 @@ fw_load_zone() {
|
|||
|
||||
local chain=zone_${zone_name}
|
||||
|
||||
fw add $mode f ${chain}_ACCEPT
|
||||
fw add $mode f ${chain}_DROP
|
||||
fw add $mode f ${chain}_REJECT
|
||||
fw add $mode f ${chain}_src_ACCEPT
|
||||
fw add $mode f ${chain}_src_DROP
|
||||
fw add $mode f ${chain}_src_REJECT
|
||||
|
||||
# TODO: Rename to ${chain}_input
|
||||
fw add $mode f ${chain}
|
||||
fw add $mode f ${chain} ${chain}_${zone_input} $
|
||||
fw add $mode f ${chain}_dest_ACCEPT
|
||||
fw add $mode f ${chain}_dest_DROP
|
||||
fw add $mode f ${chain}_dest_REJECT
|
||||
|
||||
fw add $mode f ${chain}_input
|
||||
fw add $mode f ${chain}_input ${chain}_src_${zone_input} $
|
||||
|
||||
fw add $mode f ${chain}_forward
|
||||
fw add $mode f ${chain}_forward ${chain}_${zone_forward} $
|
||||
fw add $mode f ${chain}_forward ${chain}_dest_${zone_forward} $
|
||||
|
||||
# TODO: add ${chain}_output
|
||||
fw add $mode f output ${chain}_${zone_output} $
|
||||
fw add $mode f ${chain}_output
|
||||
fw add $mode f ${chain}_output ${chain}_dest_${zone_output} $
|
||||
|
||||
# TODO: Rename to ${chain}_MASQUERADE
|
||||
fw add $mode n ${chain}_nat
|
||||
|
|
@ -223,7 +233,7 @@ fw_load_zone() {
|
|||
fw_die "zone ${zone_name}: custom_chains globally disabled"
|
||||
|
||||
fw add $mode f input_${zone_name}
|
||||
fw add $mode f ${chain} input_${zone_name} ^
|
||||
fw add $mode f ${chain}_input input_${zone_name} ^
|
||||
|
||||
fw add $mode f forwarding_${zone_name}
|
||||
fw add $mode f ${chain}_forward forwarding_${zone_name} ^
|
||||
|
|
@ -238,13 +248,16 @@ fw_load_zone() {
|
|||
|
||||
local t
|
||||
for t in REJECT DROP; do
|
||||
fw add $mode f ${chain}_${t} LOG ^ \
|
||||
{ -m limit --limit $zone_log_limit --log-prefix "$t($zone_name): " }
|
||||
local d
|
||||
for d in src dest; do
|
||||
fw add $mode f ${chain}_${d}_${t} LOG ^ \
|
||||
{ -m limit --limit $zone_log_limit --log-prefix "$t($d $zone_name): " }
|
||||
done
|
||||
done
|
||||
|
||||
[ $zone_mtu_fix == 1 ] && \
|
||||
fw add $mode m ${chain}_MSSFIX LOG ^ \
|
||||
{ -m limit --limit $zone_log_limit --log-prefix "MSSFIX($zone_name): " }
|
||||
{ -p tcp --tcp-flags SYN,RST SYN -m limit --limit $zone_log_limit --log-prefix "MSSFIX($zone_name): " }
|
||||
}
|
||||
|
||||
# NB: if MASQUERADING for IPv6 becomes available we'll need a family check here
|
||||
|
|
@ -267,6 +280,16 @@ fw_load_zone() {
|
|||
done
|
||||
fi
|
||||
|
||||
local dev
|
||||
for dev in ${zone_device:-""}; do
|
||||
local net
|
||||
for net in ${zone_subnet:-""}; do
|
||||
[ -n "$dev" ] || [ -n "$net" ] || continue
|
||||
fw_do_interface_rules add "${zone_name}" "$dev" "$net" \
|
||||
"${zone_extra_src}" "${zone_extra_dest}"
|
||||
done
|
||||
done
|
||||
|
||||
fw_callback post zone
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# Copyright (C) 2009-2012 OpenWrt.org
|
||||
# Copyright (C) 2009-2013 OpenWrt.org
|
||||
|
||||
fw__uci_state_add() {
|
||||
local var="$1"
|
||||
|
|
@ -31,6 +31,73 @@ fw__uci_state_del() {
|
|||
uci_toggle_state firewall core $var "$rest"
|
||||
}
|
||||
|
||||
fw_do_interface_rules() {
|
||||
local action=$1
|
||||
local zone=$2
|
||||
local chain=zone_${zone}
|
||||
local ifname=$3
|
||||
local subnet=$4
|
||||
local extra_src="$5"
|
||||
local extra_dest="$6"
|
||||
|
||||
local idev odev inet onet mode
|
||||
fw_get_family_mode mode x $zone i
|
||||
|
||||
fw_get_negation idev '-i' "$ifname"
|
||||
fw_get_negation odev '-o' "$ifname"
|
||||
|
||||
case "$mode/$subnet" in
|
||||
# Zone supports v6 only or dual, need v6
|
||||
G6/*:*|i/*:*)
|
||||
fw_get_negation inet '-s' "$subnet"
|
||||
fw_get_negation onet '-d' "$subnet"
|
||||
mode=6
|
||||
;;
|
||||
|
||||
# Zone supports v4 only or dual, need v4
|
||||
G4/*.*.*.*|i/*.*.*.*)
|
||||
fw_get_negation inet '-s' "$subnet"
|
||||
fw_get_negation onet '-d' "$subnet"
|
||||
mode=4
|
||||
;;
|
||||
|
||||
# Need v6 while zone is v4
|
||||
*/*:*) fw_log info "zone $zone does not support IPv6 address family, skipping"; return ;;
|
||||
|
||||
# Need v4 while zone is v6
|
||||
*/*.*) fw_log info "zone $zone does not support IPv4 address family, skipping"; return ;;
|
||||
|
||||
# Strip prefix
|
||||
*) mode="${mode#G}" ;;
|
||||
esac
|
||||
|
||||
lock /var/run/firewall-interface.lock
|
||||
|
||||
fw $action $mode f ${chain}_dest_ACCEPT ACCEPT $ { $odev $onet $extra_dest }
|
||||
fw $action $mode f ${chain}_src_ACCEPT ACCEPT $ { $idev $inet $extra_src }
|
||||
fw $action $mode f ${chain}_dest_DROP DROP $ { $odev $onet $extra_dest }
|
||||
fw $action $mode f ${chain}_src_DROP DROP $ { $idev $inet $extra_src }
|
||||
fw $action $mode f ${chain}_dest_REJECT reject $ { $odev $onet $extra_dest }
|
||||
fw $action $mode f ${chain}_src_REJECT reject $ { $idev $inet $extra_src }
|
||||
|
||||
[ "$(uci_get_state firewall core "${zone}_tcpmss")" == 1 ] && \
|
||||
fw $action $mode m ${chain}_MSSFIX TCPMSS $ \
|
||||
{ $odev -p tcp --tcp-flags SYN,RST SYN --clamp-mss-to-pmtu $onet $extra_dest }
|
||||
|
||||
fw $action $mode f delegate_input ${chain}_input $ { $idev $inet $extra_src }
|
||||
fw $action $mode f delegate_forward ${chain}_forward $ { $idev $inet $extra_src }
|
||||
fw $action $mode f delegate_output ${chain}_output $ { $odev $onet $extra_dest }
|
||||
|
||||
fw $action $mode n PREROUTING ${chain}_prerouting $ { $idev $inet $extra_src }
|
||||
fw $action $mode r PREROUTING ${chain}_notrack $ { $idev $inet $extra_src }
|
||||
fw $action $mode n POSTROUTING ${chain}_nat $ { $odev $onet $extra_dest }
|
||||
|
||||
# Flush conntrack table
|
||||
echo f >/proc/net/nf_conntrack 2>/dev/null
|
||||
|
||||
lock -u /var/run/firewall-interface.lock
|
||||
}
|
||||
|
||||
fw_configure_interface() {
|
||||
local iface=$1
|
||||
local action=$2
|
||||
|
|
@ -52,66 +119,6 @@ fw_configure_interface() {
|
|||
|
||||
fw_callback pre interface
|
||||
|
||||
fw__do_rules() {
|
||||
local action=$1
|
||||
local zone=$2
|
||||
local chain=zone_${zone}
|
||||
local ifname=$3
|
||||
local subnet=$4
|
||||
|
||||
local inet onet mode
|
||||
fw_get_family_mode mode x $zone i
|
||||
|
||||
case "$mode/$subnet" in
|
||||
# Zone supports v6 only or dual, need v6
|
||||
G6/*:*|i/*:*)
|
||||
inet="-s $subnet -d ::/0"
|
||||
onet="-s ::/0 -d $subnet"
|
||||
mode=6
|
||||
;;
|
||||
|
||||
# Zone supports v4 only or dual, need v4
|
||||
G4/*.*.*.*|i/*.*.*.*)
|
||||
inet="-s $subnet -d 0.0.0.0/0"
|
||||
onet="-s 0.0.0.0/0 -d $subnet"
|
||||
mode=4
|
||||
;;
|
||||
|
||||
# Need v6 while zone is v4
|
||||
*/*:*) fw_log info "zone $zone does not support IPv6 address family, skipping"; return ;;
|
||||
|
||||
# Need v4 while zone is v6
|
||||
*/*.*) fw_log info "zone $zone does not support IPv4 address family, skipping"; return ;;
|
||||
|
||||
# Strip prefix
|
||||
*) mode="${mode#G}" ;;
|
||||
esac
|
||||
|
||||
lock /var/run/firewall-interface.lock
|
||||
|
||||
fw $action $mode f ${chain}_ACCEPT ACCEPT $ { -o "$ifname" $onet }
|
||||
fw $action $mode f ${chain}_ACCEPT ACCEPT $ { -i "$ifname" $inet }
|
||||
fw $action $mode f ${chain}_DROP DROP $ { -o "$ifname" $onet }
|
||||
fw $action $mode f ${chain}_DROP DROP $ { -i "$ifname" $inet }
|
||||
fw $action $mode f ${chain}_REJECT reject $ { -o "$ifname" $onet }
|
||||
fw $action $mode f ${chain}_REJECT reject $ { -i "$ifname" $inet }
|
||||
|
||||
[ "$(uci_get_state firewall core "${zone}_tcpmss")" == 1 ] && \
|
||||
fw $action $mode m ${chain}_MSSFIX TCPMSS $ \
|
||||
{ -o "$ifname" -p tcp --tcp-flags SYN,RST SYN --clamp-mss-to-pmtu $onet }
|
||||
|
||||
fw $action $mode f input ${chain} $ { -i "$ifname" $inet }
|
||||
fw $action $mode f forward ${chain}_forward $ { -i "$ifname" $inet }
|
||||
fw $action $mode n PREROUTING ${chain}_prerouting $ { -i "$ifname" $inet }
|
||||
fw $action $mode r PREROUTING ${chain}_notrack $ { -i "$ifname" $inet }
|
||||
fw $action $mode n POSTROUTING ${chain}_nat $ { -o "$ifname" $onet }
|
||||
|
||||
# Flush conntrack table
|
||||
echo f >/proc/net/nf_conntrack 2>/dev/null
|
||||
|
||||
lock -u /var/run/firewall-interface.lock
|
||||
}
|
||||
|
||||
local old_zones old_ifname old_subnets
|
||||
config_get old_zones core "${iface}_zone"
|
||||
[ -n "$old_zones" ] && {
|
||||
|
|
@ -123,7 +130,7 @@ fw_configure_interface() {
|
|||
local n
|
||||
for n in ${old_subnets:-""}; do
|
||||
fw_log info "removing $iface ($old_ifname${n:+ alias $n}) from zone $z"
|
||||
fw__do_rules del $z $old_ifname $n
|
||||
fw_do_interface_rules del $z $old_ifname $n
|
||||
done
|
||||
|
||||
[ -n "$old_subnets" ] || {
|
||||
|
|
@ -182,7 +189,7 @@ fw_configure_interface() {
|
|||
list_contains zone_network "$iface" || return
|
||||
|
||||
fw_log info "adding $iface ($ifname${aliasnet:+ alias $aliasnet}) to zone $zone_name"
|
||||
fw__do_rules add ${zone_name} "$ifname" "$aliasnet"
|
||||
fw_do_interface_rules add ${zone_name} "$ifname" "$aliasnet"
|
||||
append new_zones $zone_name
|
||||
|
||||
[ -n "$aliasnet" ] || {
|
||||
|
|
@ -205,4 +212,3 @@ fw_sysctl_interface() {
|
|||
sysctl -w net.ipv6.conf.${ifname}.accept_source_route=$FW_ACCEPT_SRC_ROUTE
|
||||
} >/dev/null 2>/dev/null
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -41,7 +41,7 @@ fw_load_redirect() {
|
|||
# in this case match only DNATed traffic and allow it on input, not forward
|
||||
if [ -z "$redirect_dest_ip" ] || /sbin/ifconfig | grep -qE "addr:${redirect_dest_ip//./\\.}\b"; then
|
||||
fwdopt="-m conntrack --ctstate DNAT"
|
||||
fwdchain="zone_${redirect_src}"
|
||||
fwdchain="zone_${redirect_src}_input"
|
||||
else
|
||||
fwdchain="zone_${redirect_src}_forward"
|
||||
fi
|
||||
|
|
@ -114,7 +114,7 @@ fw_load_redirect() {
|
|||
$redirect_options \
|
||||
}
|
||||
|
||||
fw add $mode f ${fwdchain:-forward} ACCEPT + \
|
||||
fw add $mode f ${fwdchain:-delegate_forward} ACCEPT + \
|
||||
{ $redirect_src_ip $redirect_dest_ip } { \
|
||||
$srcaddr $destaddr \
|
||||
$pr \
|
||||
|
|
|
|||
|
|
@ -34,7 +34,7 @@ fw_load_rule() {
|
|||
fw_callback pre rule
|
||||
|
||||
local table=f
|
||||
local chain=input
|
||||
local chain=delegate_output
|
||||
local target="${rule_target:-REJECT}"
|
||||
if [ "$target" == "NOTRACK" ]; then
|
||||
table=r
|
||||
|
|
@ -42,16 +42,23 @@ fw_load_rule() {
|
|||
else
|
||||
if [ -n "$rule_src" ]; then
|
||||
if [ "$rule_src" != "*" ]; then
|
||||
chain="zone_${rule_src}${rule_dest:+_forward}"
|
||||
if [ -n "$rule_dest" ]; then
|
||||
chain="zone_${rule_src}_forward"
|
||||
else
|
||||
chain="${rule_dest:+forward}"
|
||||
chain="${chain:-input}"
|
||||
chain="zone_${rule_src}_input"
|
||||
fi
|
||||
else
|
||||
chain="${rule_dest:+delegate_forward}"
|
||||
chain="${chain:-delegate_input}"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ -n "$rule_dest" ]; then
|
||||
if [ "$rule_dest" != "*" ]; then
|
||||
target="zone_${rule_dest}_${target}"
|
||||
target="zone_${rule_dest}_dest_${target}"
|
||||
if [ -z "$rule_src" ]; then
|
||||
chain="zone_${rule_dest}_output"
|
||||
fi
|
||||
elif [ "$target" = REJECT ]; then
|
||||
target=reject
|
||||
fi
|
||||
|
|
|
|||
Loading…
Reference in New Issue