hsist
/
freifunkist-firmware
6
1
Fork 0
Code Issues Pull Requests Releases Wiki Activity

firewall: various enhancements

Browse Source 
- reduce mssfix related log spam (#10681)
	- separate src and dest terminal chains (#11453, #12945)
	- disable per-zone custom chains by default, they're rarely used

Additionally introduce options "device", "subnet", "extra", "extra_src" and "extra_dest"
to allow defining zones not related to uci interfaces, e.g. to match "ppp+" or any tcp
traffic to and from a specific port.

SVN-Revision: 35484
master
Jo-Philipp Wich 12 years ago
parent 8506964e6d
commit e106f25ee7
7 changed files with 133 additions and 97 deletions
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Show Stats Download Patch File Download Diff File
  1. 2
      package/network/config/firewall/Makefile
  2. 4
      package/network/config/firewall/files/lib/core_forwarding.sh
  3. 67
      package/network/config/firewall/files/lib/core_init.sh
  4. 134
      package/network/config/firewall/files/lib/core_interface.sh
  5. 4
      package/network/config/firewall/files/lib/core_redirect.sh
  6. 17
      package/network/config/firewall/files/lib/core_rule.sh
  7. 2
      package/network/config/firewall/files/lib/fw.sh

2
package/network/config/firewall/Makefile
Unescape View File

@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
PKG_NAME:=firewall
PKG_VERSION:=2
PKG_RELEASE:=57
PKG_RELEASE:=58
include $(INCLUDE_DIR)/package.mk

4
package/network/config/firewall/files/lib/core_forwarding.sh
Unescape View File

@ -17,14 +17,14 @@ fw_load_forwarding() {
fw_callback pre forwarding
local chain=forward
local chain=delegate_forward
[ -n "$forwarding_src" ] && {
chain=zone_${forwarding_src}_forward
}
local target=ACCEPT
[ -n "$forwarding_dest" ] && {
target=zone_${forwarding_dest}_ACCEPT
target=zone_${forwarding_dest}_dest_ACCEPT
}
local mode

67
package/network/config/firewall/files/lib/core_init.sh
Unescape View File

@ -115,13 +115,13 @@ fw_load_defaults() {
fw add i n POSTROUTING postrouting_rule
}
fw add i f input
fw add i f output
fw add i f forward
fw add i f delegate_input
fw add i f delegate_output
fw add i f delegate_forward
fw add i f INPUT input
fw add i f OUTPUT output
fw add i f FORWARD forward
fw add i f INPUT delegate_input
fw add i f OUTPUT delegate_output
fw add i f FORWARD delegate_forward
fw add i f reject
fw add i f reject REJECT { --reject-with tcp-reset -p tcp }
@ -138,21 +138,28 @@ fw_config_get_zone() {
fw_config_get_section "$1" zone { \
string name "$1" \
string network "" \
string device "" \
string subnet "" \
string input "$FW_DEFAULT_INPUT_POLICY" \
string output "$FW_DEFAULT_OUTPUT_POLICY" \
string forward "$FW_DEFAULT_FORWARD_POLICY" \
boolean masq 0 \
string masq_src "" \
string masq_dest "" \
string extra "" \
string extra_src "" \
string extra_dest "" \
boolean conntrack 0 \
boolean mtu_fix 0 \
boolean custom_chains "$FW_ADD_CUSTOM_CHAINS" \
boolean custom_chains 0 \
boolean log 0 \
string log_limit 10 \
string family "" \
} || return
[ -n "$zone_name" ] || zone_name=$zone_NAME
[ -n "$zone_network" ] || zone_network=$zone_name
[ -n "$zone_extra_src" ] || zone_extra_src="$zone_extra"
[ -n "$zone_extra_dest" ] || zone_extra_dest="$zone_extra"
[ -n "$zone_network$zone_subnet$zone_device$zone_extra_src$zone_extra_dest" ] || zone_network=$zone_name
}
fw_load_zone() {
@ -192,19 +199,22 @@ fw_load_zone() {
local chain=zone_${zone_name}
fw add $mode f ${chain}_ACCEPT
fw add $mode f ${chain}_DROP
fw add $mode f ${chain}_REJECT
fw add $mode f ${chain}_src_ACCEPT
fw add $mode f ${chain}_src_DROP
fw add $mode f ${chain}_src_REJECT
# TODO: Rename to ${chain}_input
fw add $mode f ${chain}
fw add $mode f ${chain} ${chain}_${zone_input} $
fw add $mode f ${chain}_dest_ACCEPT
fw add $mode f ${chain}_dest_DROP
fw add $mode f ${chain}_dest_REJECT
fw add $mode f ${chain}_input
fw add $mode f ${chain}_input ${chain}_src_${zone_input} $
fw add $mode f ${chain}_forward
fw add $mode f ${chain}_forward ${chain}_${zone_forward} $
fw add $mode f ${chain}_forward ${chain}_dest_${zone_forward} $
# TODO: add ${chain}_output
fw add $mode f output ${chain}_${zone_output} $
fw add $mode f ${chain}_output
fw add $mode f ${chain}_output ${chain}_dest_${zone_output} $
# TODO: Rename to ${chain}_MASQUERADE
fw add $mode n ${chain}_nat
@ -223,7 +233,7 @@ fw_load_zone() {
fw_die "zone ${zone_name}: custom_chains globally disabled"
fw add $mode f input_${zone_name}
fw add $mode f ${chain} input_${zone_name} ^
fw add $mode f ${chain}_input input_${zone_name} ^
fw add $mode f forwarding_${zone_name}
fw add $mode f ${chain}_forward forwarding_${zone_name} ^
@ -238,13 +248,16 @@ fw_load_zone() {
local t
for t in REJECT DROP; do
fw add $mode f ${chain}_${t} LOG ^ \
{ -m limit --limit $zone_log_limit --log-prefix "$t($zone_name): " }
local d
for d in src dest; do
fw add $mode f ${chain}_${d}_${t} LOG ^ \
{ -m limit --limit $zone_log_limit --log-prefix "$t($d $zone_name): " }
done
done
[ $zone_mtu_fix == 1 ] && \
fw add $mode m ${chain}_MSSFIX LOG ^ \
{ -m limit --limit $zone_log_limit --log-prefix "MSSFIX($zone_name): " }
{ -p tcp --tcp-flags SYN,RST SYN -m limit --limit $zone_log_limit --log-prefix "MSSFIX($zone_name): " }
}
# NB: if MASQUERADING for IPv6 becomes available we'll need a family check here
@ -267,6 +280,16 @@ fw_load_zone() {
done
fi
local dev
for dev in ${zone_device:-""}; do
local net
for net in ${zone_subnet:-""}; do
[ -n "$dev" ] || [ -n "$net" ] || continue
fw_do_interface_rules add "${zone_name}" "$dev" "$net" \
"${zone_extra_src}" "${zone_extra_dest}"
done
done
fw_callback post zone
}
@ -293,7 +316,7 @@ fw_load_include() {
fw_log error "You cannot use UCI in firewall includes!" >&2
exit 1
}
. $path
. $path
)
}

134
package/network/config/firewall/files/lib/core_interface.sh
Unescape View File

@ -1,4 +1,4 @@
# Copyright (C) 2009-2012 OpenWrt.org
# Copyright (C) 2009-2013 OpenWrt.org
fw__uci_state_add() {
local var="$1"
@ -31,6 +31,73 @@ fw__uci_state_del() {
uci_toggle_state firewall core $var "$rest"
}
fw_do_interface_rules() {
local action=$1
local zone=$2
local chain=zone_${zone}
local ifname=$3
local subnet=$4
local extra_src="$5"
local extra_dest="$6"
local idev odev inet onet mode
fw_get_family_mode mode x $zone i
fw_get_negation idev '-i' "$ifname"
fw_get_negation odev '-o' "$ifname"
case "$mode/$subnet" in
# Zone supports v6 only or dual, need v6
G6/*:*|i/*:*)
fw_get_negation inet '-s' "$subnet"
fw_get_negation onet '-d' "$subnet"
mode=6
;;
# Zone supports v4 only or dual, need v4
G4/*.*.*.*|i/*.*.*.*)
fw_get_negation inet '-s' "$subnet"
fw_get_negation onet '-d' "$subnet"
mode=4
;;
# Need v6 while zone is v4
*/*:*) fw_log info "zone $zone does not support IPv6 address family, skipping"; return ;;
# Need v4 while zone is v6
*/*.*) fw_log info "zone $zone does not support IPv4 address family, skipping"; return ;;
# Strip prefix
*) mode="${mode#G}" ;;
esac
lock /var/run/firewall-interface.lock
fw $action $mode f ${chain}_dest_ACCEPT ACCEPT $ { $odev $onet $extra_dest }
fw $action $mode f ${chain}_src_ACCEPT ACCEPT $ { $idev $inet $extra_src }
fw $action $mode f ${chain}_dest_DROP DROP $ { $odev $onet $extra_dest }
fw $action $mode f ${chain}_src_DROP DROP $ { $idev $inet $extra_src }
fw $action $mode f ${chain}_dest_REJECT reject $ { $odev $onet $extra_dest }
fw $action $mode f ${chain}_src_REJECT reject $ { $idev $inet $extra_src }
[ "$(uci_get_state firewall core "${zone}_tcpmss")" == 1 ] && \
fw $action $mode m ${chain}_MSSFIX TCPMSS $ \
{ $odev -p tcp --tcp-flags SYN,RST SYN --clamp-mss-to-pmtu $onet $extra_dest }
fw $action $mode f delegate_input ${chain}_input $ { $idev $inet $extra_src }
fw $action $mode f delegate_forward ${chain}_forward $ { $idev $inet $extra_src }
fw $action $mode f delegate_output ${chain}_output $ { $odev $onet $extra_dest }
fw $action $mode n PREROUTING ${chain}_prerouting $ { $idev $inet $extra_src }
fw $action $mode r PREROUTING ${chain}_notrack $ { $idev $inet $extra_src }
fw $action $mode n POSTROUTING ${chain}_nat $ { $odev $onet $extra_dest }
# Flush conntrack table
echo f >/proc/net/nf_conntrack 2>/dev/null
lock -u /var/run/firewall-interface.lock
}
fw_configure_interface() {
local iface=$1
local action=$2
@ -52,66 +119,6 @@ fw_configure_interface() {
fw_callback pre interface
fw__do_rules() {
local action=$1
local zone=$2
local chain=zone_${zone}
local ifname=$3
local subnet=$4
local inet onet mode
fw_get_family_mode mode x $zone i
case "$mode/$subnet" in
# Zone supports v6 only or dual, need v6
G6/*:*|i/*:*)
inet="-s $subnet -d ::/0"
onet="-s ::/0 -d $subnet"
mode=6
;;
# Zone supports v4 only or dual, need v4
G4/*.*.*.*|i/*.*.*.*)
inet="-s $subnet -d 0.0.0.0/0"
onet="-s 0.0.0.0/0 -d $subnet"
mode=4
;;
# Need v6 while zone is v4
*/*:*) fw_log info "zone $zone does not support IPv6 address family, skipping"; return ;;
# Need v4 while zone is v6
*/*.*) fw_log info "zone $zone does not support IPv4 address family, skipping"; return ;;
# Strip prefix
*) mode="${mode#G}" ;;
esac
lock /var/run/firewall-interface.lock
fw $action $mode f ${chain}_ACCEPT ACCEPT $ { -o "$ifname" $onet }
fw $action $mode f ${chain}_ACCEPT ACCEPT $ { -i "$ifname" $inet }
fw $action $mode f ${chain}_DROP DROP $ { -o "$ifname" $onet }
fw $action $mode f ${chain}_DROP DROP $ { -i "$ifname" $inet }
fw $action $mode f ${chain}_REJECT reject $ { -o "$ifname" $onet }
fw $action $mode f ${chain}_REJECT reject $ { -i "$ifname" $inet }
[ "$(uci_get_state firewall core "${zone}_tcpmss")" == 1 ] && \
fw $action $mode m ${chain}_MSSFIX TCPMSS $ \
{ -o "$ifname" -p tcp --tcp-flags SYN,RST SYN --clamp-mss-to-pmtu $onet }
fw $action $mode f input ${chain} $ { -i "$ifname" $inet }
fw $action $mode f forward ${chain}_forward $ { -i "$ifname" $inet }
fw $action $mode n PREROUTING ${chain}_prerouting $ { -i "$ifname" $inet }
fw $action $mode r PREROUTING ${chain}_notrack $ { -i "$ifname" $inet }
fw $action $mode n POSTROUTING ${chain}_nat $ { -o "$ifname" $onet }
# Flush conntrack table
echo f >/proc/net/nf_conntrack 2>/dev/null
lock -u /var/run/firewall-interface.lock
}
local old_zones old_ifname old_subnets
config_get old_zones core "${iface}_zone"
[ -n "$old_zones" ] && {
@ -123,7 +130,7 @@ fw_configure_interface() {
local n
for n in ${old_subnets:-""}; do
fw_log info "removing $iface ($old_ifname${n:+ alias $n}) from zone $z"
fw__do_rules del $z $old_ifname $n
fw_do_interface_rules del $z $old_ifname $n
done
[ -n "$old_subnets" ] || {
@ -182,7 +189,7 @@ fw_configure_interface() {
list_contains zone_network "$iface" || return
fw_log info "adding $iface ($ifname${aliasnet:+ alias $aliasnet}) to zone $zone_name"
fw__do_rules add ${zone_name} "$ifname" "$aliasnet"
fw_do_interface_rules add ${zone_name} "$ifname" "$aliasnet"
append new_zones $zone_name
[ -n "$aliasnet" ] || {
@ -205,4 +212,3 @@ fw_sysctl_interface() {
sysctl -w net.ipv6.conf.${ifname}.accept_source_route=$FW_ACCEPT_SRC_ROUTE
} >/dev/null 2>/dev/null
}

4
package/network/config/firewall/files/lib/core_redirect.sh
Unescape View File

@ -41,7 +41,7 @@ fw_load_redirect() {
# in this case match only DNATed traffic and allow it on input, not forward
if [ -z "$redirect_dest_ip" ] || /sbin/ifconfig | grep -qE "addr:${redirect_dest_ip//./\\.}\b"; then
fwdopt="-m conntrack --ctstate DNAT"
fwdchain="zone_${redirect_src}"
fwdchain="zone_${redirect_src}_input"
else
fwdchain="zone_${redirect_src}_forward"
fi
@ -114,7 +114,7 @@ fw_load_redirect() {
$redirect_options \
}
fw add $mode f ${fwdchain:-forward} ACCEPT + \
fw add $mode f ${fwdchain:-delegate_forward} ACCEPT + \
{ $redirect_src_ip $redirect_dest_ip } { \
$srcaddr $destaddr \
$pr \

17
package/network/config/firewall/files/lib/core_rule.sh
Unescape View File

@ -34,7 +34,7 @@ fw_load_rule() {
fw_callback pre rule
local table=f
local chain=input
local chain=delegate_output
local target="${rule_target:-REJECT}"
if [ "$target" == "NOTRACK" ]; then
table=r
@ -42,16 +42,23 @@ fw_load_rule() {
else
if [ -n "$rule_src" ]; then
if [ "$rule_src" != "*" ]; then
chain="zone_${rule_src}${rule_dest:+_forward}"
if [ -n "$rule_dest" ]; then
chain="zone_${rule_src}_forward"
else
chain="zone_${rule_src}_input"
fi
else
chain="${rule_dest:+forward}"
chain="${chain:-input}"
chain="${rule_dest:+delegate_forward}"
chain="${chain:-delegate_input}"
fi
fi
if [ -n "$rule_dest" ]; then
if [ "$rule_dest" != "*" ]; then
target="zone_${rule_dest}_${target}"
target="zone_${rule_dest}_dest_${target}"
if [ -z "$rule_src" ]; then
chain="zone_${rule_dest}_output"
fi
elif [ "$target" = REJECT ]; then
target=reject
fi

2
package/network/config/firewall/files/lib/fw.sh
Unescape View File

@ -170,7 +170,7 @@ fw__exec() { # <action> <family> <table> <chain> <target> <position> { <rules> }
fw_log info "ICMP type '$2' is not valid for $fam address family, skipping rule"
return 1
fi
shift
shift
;;
*) cmdline="$cmdline $1" ;;
esac

Write Preview
Loading…
Cancel
Save