When importing ipset definitions from published ubus data, do not
overwrite the name attribute with an autogenerated string like it
is being done for rules or redirects.

Ref: https://forum.openwrt.org/t/fw3-ipset-procd-objects/44044


Signed-off-by: Jo-Philipp Wich <jo@mein.io>

Alin Nastac authored 5 years ago and ynezz committed 5 years ago

Problem can be reproduced with a rule like this:
   option src 'wan'
   option family 'ipv6'
   option proto 'icmp'
   option icmp_type '128'
   option target 'DROP'
The resulted rule will set --icmpv6-type to 128/255.

Signed-off-by: Alin Nastac <alin.nastac@gmail.com>

Fix the format string to match the size_t type, this fixes a build
problem on 64 bit platforms.

Fixes: 4d0c703e ("firewall3: Fix some format string problems")
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

This adds annotations for the format strings to the print functions and
fixes the newly found problems. One of them is a format security
problem.

Coverity: #1412532
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>

When using fw3 together with other applications or scripts a race
conditions might occur. When fw3 is preparing the new tables, another
application can use the executable `iptables` which modifies the
kernel-tables.  libxtables will notify this and fails when fw3 is
committing the changes resulting in a failed firewall.

Now waits in a while loop until the lock is gone, activate the lock
itself and applies changes.

To reproduce the bug the following two scripts should run in parrallel,
after a few seconds the latter stop and leaves a broken firewall:

    while true; do iptables -N locking; done

and

    while [ "$(iptables -w -L OUTPUT | wc -l)" -gt 2 ]; do fw3 reload; done

The following message will appear

        Warning: iptc_commit(): Resource temporarily unavailable

and connectivity is gone.

Tested in an LXC and Qemu container.

Signed-off-by: Alexander Couzens <lynxis@fe80.eu>
[fixed waiting for unlock and commit message]
Signed-off-by: Paul Spooren <mail@aparcar.org>

To lock a second lock file at the same time, introduce fw3_{un,}lock_path.
fw3_lock_path support the path as parameter in difference to fw3_lock which
only locks the fw3 lock file (/var/run/fw3.lock)

Signed-off-by: Alexander Couzens <lynxis@fe80.eu>

The reload_set option was added in commit 509e673d ("firewall3:
Improve ipset support"), and the purpose of the option is to control if
a set should be flushed or not on a firewall reload.

In some cases, the option unfortunately does not work properly. I had
fixed the errors locally, but failed to submit a v2 of "Improve ipset
support". This patch contains my local fixes, and after the following
changes are applied then the option (as well as ipset support) works as
at least I expect.

The following errors have been fixed:

* "family" was not written to the state file, causing all sets read from
this file was considered as ipv4. Save family to ensure that sets are
handled correctly on firewall reload.

* The default value of "reload_set" is false, meaning that the
reload-check in "fw3_create_ipsets()" is always true (on reload). A
consequence of this is that new sets are never created on firewall
reload. In order to ensure that new sets are created, only consider
"reload_set" if the set exists. If a set (from configuration) does not
exist, we always want to create it.

* On reload and before "fw3_destroy_ipsets()" are called, we need to
update run_state to ensure that sets are updated correctly. We need to
check if the sets in run_state is found in cfg_state, if not the set
should be destroyed (done by forcing reload_set to true). If the set is
found, then we copy the value of reload_set to the set in run_state so
that the elements are updated as the user expects.

Since we now always copy the value of reload_set from cfg_state, there
is no need to write reload_set to run_state.

Signed-off-by: Kristian Evensen <kristian.evensen@gmail.com>

This patch is an attempt at improving the ipset support in firewall3.
The following changes have been made:

* The enabled option did not work properly for ipsets, as it was not
checked on create/destroy of a set. After this commit, sets are only
created/destroyed if enabled is set to true.

* Add support for reloading, or recreating, ipsets on firewall reload.
By setting "reload_set" to true, the set will be destroyed and then
re-created when the firewall is reloaded. My use-case for "reload_set"
was to reset sets populated by dnsmasq, without having to restart the
firewall or resort to scripts.

* Add support for the counters and comment extensions. By setting
"counters" or "comment" to true, then counters or comments are added to
the set.

Signed-off-by: Kristian Evensen <kristian.evensen@gmail.com>
re-ordered additional variables
dropped enum OPT_COMMENT & OPT_COUNTERS as unused
implemented exponential delay whilst waiting for ipset deletion/creation
fixed delays made firewall unresponsive for too long on reloads
Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>

solve coverity reported resource leak (socket handle)

Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>

Add zone chains identifying local generated traffic; either by configuring
a loopback device or as subnet a loopback address; in the raw OUTPUT chain
as local generated traffic is passing this chain.
This allows helpers to be used for local generated traffic.

Signed-off-by: Alin Nastac <alin.nastac@gmail.com>
Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
Acked-by: Jo-Philipp Wich <jo@mein.io>

args was not freed after leaving this function.

Fixes Coverity issue 1412470 Resource leak

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Acked-by: Jo-Philipp Wich <jo@mein.io>

This fixes two possible situations where strncpy() produces a not null
terminated buffer.

Coverity IDs:
* 1412247 Buffer not null terminated
* 1412279 Buffer not null terminated

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Acked-by: Jo-Philipp Wich <jo@mein.io>

In case of SNAT rules the src_dport parameter is used both as a rewrite
parameter as well as a matching parameter which is not the expected
behavior.
The latter is caused by port_redir being set to src_dport in case dest_port
parameter is not.
As this logic is in place to mimic the old shell script based firewall
behavior for DNAT only set port_redir in case the redirect rule is
a DNAT rule.

Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>
Acked-by: Jo-Philipp Wich <jo@mein.io>

Fixes 06fa692c ("defaults: use a generic check_kmod() function")
Signed-off-by: Jo-Philipp Wich <jo@mein.io>

Rather than having functions for check_offloading() et al, replace it with a
generic function.

Signed-off-by: Joe Holden <jwh@zorins.co.uk>

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

Invoking ubus methods with NULL message is not supported anymore, so
make sure that network.interface/dump is called with an empty blob buffer
argument.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

RFC 6092 recommends in section 3.3.1 that an IPv6 CPE must respond to
unsolicited inbound SYNs with an ICMPv6 Destination Unreachable error
code 1 (Communication with destination administratively prohibited).

Signed-off-by: Alin Nastac <alin.nastac@gmail.com>
Acked-by: Jo-Philipp Wich <jo@mein.io>

error: ‘%u’ directive writing between 1 and 10 bytes into a region of size
between 7 and 11 [-Werror=format-overflow=]
sprintf(buf, "%u-%u", port->port_min, port->port_max);
                 ^~
note: directive argument in the range [0, 2147483647]
sprintf(buf, "%u-%u", port->port_min, port->port_max);
             ^~~~~~~
note: ‘sprintf’ output between 4 and 17 bytes into a destination of size
13
sprintf(buf, "%u-%u", port->port_min, port->port_max);

Signed-off-by: Rosen Penev <rosenp@gmail.com>

Emit LOG rules bound to the source/destination device or subnet to match the
same traffic handled by the terminal REJECT/DROP rules.

This fixes superflous logging of unrelated traffic.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

When parsing user supplied time strings, calculate an UTC time instant by
substracting the current zone offset from the result of mktime(3), then use
gmtime_r(3) to turn the time_t value back into a sanitized time structure.

This ensures that user supplied dates are not interpreted as local time.

Fixes FS#1483.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

The set_helper field has to be set by set_helper and not helper.

Signed-off-by: Pierre Lebleu <pme.lebleu@gmail.com>

Signed-off-by: Pierre Lebleu <pme.lebleu@gmail.com>

The field proto in the struct fw3_cthelper should be implemented
as a list in order to support multiple protocols.

For example, the helper for SIP should be able to support both
TCP and UDP within only one entry in the config file.

config helper
        option name 'sip'
        option description 'SIP VoIP connection tracking'
        option module 'nf_conntrack_sip'
        option family 'any'
        option proto 'tcpudp'
        option port '5060'

Signed-off-by: Pierre Lebleu <pme.lebleu@gmail.com>

Enables hardware offload support where supported

Signed-off-by: Felix Fietkau <nbd@nbd.name>

Add rtsp conntrack helper listening on IPv4 tcp port 554

Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>

Reword various rule comments to be more explicit and also annotate the flow
offloading rule while we're at it.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

Introduce a new defaults section option "flow_offloading" which,
when enabled, causes fw3 to emit a -j FLOWOFFLOAD rule in the
forwarding chain.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

Introduce a new list option "entry" which can be used to specify entries
to add to the ipset, e.g.

    config ipset
      option name test
      ...
      list entry 1.2.3.4,8080
      list entry 5.6.7.8,8081

Also introduce a new option "loadfile" which refers to an external file
containing set entries to add, with one item per line.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

Due to a misplaced parenthesis, rule_mask() may try to access
r->target->userspacesize through a r->target NULL pointer.

Fix this problem by correcting the parenthesis placement in the memset
expression, using the originally intented operator precedence.

Spotted in the cz.nic fork of firewall3.
Signed-off-by: Jo-Philipp Wich <jo@mein.io>

When enabling logging for a zone, logging is enabled in the filter and
mangle tables. The log rule in the mangle table enables mtu_fix logging,
which has the tendency to flood logs. Allow per-table log control by
making the log boolean a bit field that can be used to enabled logging
in the filter and/or mangle tables.

Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>

Implement support for explicit per-zone conntrack helper assignment in
the raw table in order to compensate for the now disabled automatic
helper assignment in recent Linux kernels.

This commit adds, along with the required infrastructure, a new per-
zone uci option "helper" which can be used to tie one or more CT helpers
to a given zone.

For example the following configuration:

    config zone
      option name lan
      option network lan
      list helper ftp
      list helper sip

... will assign the FTP and SIP conntrack helpers as specified in
/usr/share/fw3/helpers.conf to traffic originating from the LAN zone.

Additionally, a new boolean option "auto_helper" has been defined for
both "config defaults" and "config zone" sections, with the former
option overruling the latter.

When the default true "option auto_helper" is set, all available helpers
are automatically attached to each non-masq zone (i.e. "lan" by default).

When one or more "list helper" options are specified, the zone has
masquerading enabled or "auto_helper" is set to false, then the automatic
helper attachment is disabled for the corresponding zone.

Furthermore, this commit introduces support for a new 'HELPER' target in
"config rule" sections, along with "option helper" to match helper traffic
and "option set_helper" to assign CT helpers to a stream.

Finally, "config redirect" sections support "option helper" too now,
which causes fw3 to emit helper setting rules for forwarded DNAT traffic.

When "option helper" is not defined for a redirect and when the global
option "auto_helper" is not disabled, fw3 will pick a suitable helper
based on the destination protocol and port and assign it to DNATed traffic.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

Avoid generating 0.0.0.0/0 masquerade rules when resolving of the
corresponding symbolic masq_src or masq_dest value failed.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

Adjust fw3_parse_network() to emit an empty address item with
.set = false, .resolved = true when we failed to resolve the network
name into any ip address.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

Change fw3_ubus_address() to return the number of addresses resolved from
the given network name, this will be required to handle failed resolving
in higher layers later on.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

It gives the ability to create firewall rules within the service
itself and independently of the instances.

Signed-off-by: Pierre Lebleu <pme.lebleu@gmail.com>

The continue statement was mistakingly copy-pasted from other error
handling code.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

Improve the space separated list parser to interprete "val1 ! val2"
as ("val1", "!val2") instead of ("val1", "!", "val2").

This corrects parsing of sections like ...

    config rule
        option sec_ip '! 1.1.1.0/24'

... which previously errored out with:

    Warning: Option @rule[0].src_ip has invalid value '!'

Fixes FS#806.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

Allow "option extra" to specify "-i", "-o", "-s" and "-d" arguments which
previously caused rules to get rejected with "Bad argument" errors.

Partially fixes FS#806.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

When netifd is being stressed (eg doing reconfig using multiple interfaces)
ubus timeouts can be observed when invoking network interface dump.
Increase the ubus timeout to 2000 msec similar to the service ubus timeout.

Signed-off-by: Hans Dedecker <dedeckeh@gmail.com>