Skip to content

Commit 770edf0

Browse files
nicolas-fortnicolas-fort
committed
T3900: T6394: extend functionalities in firewall; move netfilter sysctl timeout parameters defined in conntrack to firewall global-opton section.
1 parent 6871c55 commit 770edf0

File tree

12 files changed

+193
-123
lines changed

12 files changed

+193
-123
lines changed

‎data/templates/conntrack/sysctl.conf.j2

Lines changed: 1 addition & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -3,25 +3,7 @@
33

44
net.netfilter.nf_conntrack_expect_max = {{ expect_table_size }}
55
net.netfilter.nf_conntrack_max = {{ table_size }}
6-
76
net.ipv4.tcp_max_syn_backlog = {{ tcp.half_open_connections }}
8-
97
net.netfilter.nf_conntrack_tcp_loose = {{ '1' if tcp.loose is vyos_defined('enable') else '0' }}
108
net.netfilter.nf_conntrack_tcp_max_retrans = {{ tcp.max_retrans }}
11-
12-
net.netfilter.nf_conntrack_icmp_timeout = {{ timeout.icmp }}
13-
net.netfilter.nf_conntrack_generic_timeout = {{ timeout.other }}
14-
15-
net.netfilter.nf_conntrack_tcp_timeout_close_wait = {{ timeout.tcp.close_wait }}
16-
net.netfilter.nf_conntrack_tcp_timeout_close = {{ timeout.tcp.close }}
17-
net.netfilter.nf_conntrack_tcp_timeout_established = {{ timeout.tcp.established }}
18-
net.netfilter.nf_conntrack_tcp_timeout_fin_wait = {{ timeout.tcp.fin_wait }}
19-
net.netfilter.nf_conntrack_tcp_timeout_last_ack = {{ timeout.tcp.last_ack }}
20-
net.netfilter.nf_conntrack_tcp_timeout_syn_recv = {{ timeout.tcp.syn_recv }}
21-
net.netfilter.nf_conntrack_tcp_timeout_syn_sent = {{ timeout.tcp.syn_sent }}
22-
net.netfilter.nf_conntrack_tcp_timeout_time_wait = {{ timeout.tcp.time_wait }}
23-
24-
net.netfilter.nf_conntrack_udp_timeout = {{ timeout.udp.other }}
25-
net.netfilter.nf_conntrack_udp_timeout_stream = {{ timeout.udp.stream }}
26-
27-
net.netfilter.nf_conntrack_acct = {{ '1' if flow_accounting is vyos_defined else '0' }}
9+
net.netfilter.nf_conntrack_acct = {{ '1' if flow_accounting is vyos_defined else '0' }}

‎data/templates/firewall/sysctl-firewall.conf.j2

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# Autogenerated by firewall.py
2+
3+
# gloabl options
4+
net.ipv4.icmp_echo_ignore_all = {{ 0 if global_options.all_ping == 'enable' else 1 }}
5+
net.ipv4.icmp_echo_ignore_broadcasts = {{ 0 if global_options.broadcast_ping == 'enable' else 1 }}
6+
net.ipv4.conf.all.bc_forwarding = {{ 1 if global_options.directed_broadcast == 'enable' else 0 }}
7+
net.ipv4.conf.*.accept_source_route = {{ 1 if global_options.ip_src_route == 'enable' else 0 }}
8+
net.ipv6.conf.*.accept_redirects = {{ 1 if global_options.ipv6_receive_redirects == 'enable' else 0 }}
9+
net.ipv6.conf.*.accept_source_route = {{ 0 if global_options.ipv6_src_route == 'enable' else -1 }}
10+
net.ipv4.conf.all.log_martians = {{ 1 if global_options.log_martians == 'enable' else 0 }}
11+
net.ipv4.conf.*.accept_redirects = {{ 1 if global_options.receive_redirects == 'enable' else 0 }}
12+
net.ipv4.conf.*.send_redirects = {{ 1 if global_options.send_redirects == 'enable' else 0 }}
13+
net.ipv4.tcp_syncookies = {{ 1 if global_options.syn_cookies == 'enable' else 0 }}
14+
net.ipv4.tcp_rfc1337 = {{ 1 if global_options.twa_hazards_protection == 'enable' else 0 }}
15+
16+
## Timeout values:
17+
net.netfilter.nf_conntrack_icmp_timeout = {{ global_options.timeout.icmp }}
18+
net.netfilter.nf_conntrack_generic_timeout = {{ global_options.timeout.other }}
19+
net.netfilter.nf_conntrack_tcp_timeout_close_wait = {{ global_options.timeout.tcp.close_wait }}
20+
net.netfilter.nf_conntrack_tcp_timeout_close = {{ global_options.timeout.tcp.close }}
21+
net.netfilter.nf_conntrack_tcp_timeout_established = {{ global_options.timeout.tcp.established }}
22+
net.netfilter.nf_conntrack_tcp_timeout_fin_wait = {{ global_options.timeout.tcp.fin_wait }}
23+
net.netfilter.nf_conntrack_tcp_timeout_last_ack = {{ global_options.timeout.tcp.last_ack }}
24+
net.netfilter.nf_conntrack_tcp_timeout_syn_recv = {{ global_options.timeout.tcp.syn_recv }}
25+
net.netfilter.nf_conntrack_tcp_timeout_syn_sent = {{ global_options.timeout.tcp.syn_sent }}
26+
net.netfilter.nf_conntrack_tcp_timeout_time_wait = {{ global_options.timeout.tcp.time_wait }}
27+
net.netfilter.nf_conntrack_udp_timeout = {{ global_options.timeout.udp.other }}
28+
net.netfilter.nf_conntrack_udp_timeout_stream = {{ global_options.timeout.udp.stream }}

‎interface-definitions/include/firewall/action-and-notrack.xml.i

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@
3535
</valueHelp>
3636
<valueHelp>
3737
<format>notrack</format>
38-
<description>Igone connection tracking</description>
38+
<description>Ignore connection tracking</description>
3939
</valueHelp>
4040
<constraint>
4141
<regex>(accept|continue|jump|notrack|reject|return|drop|queue)</regex>

‎interface-definitions/include/firewall/global-options.xml.i

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -244,6 +244,14 @@
244244
</properties>
245245
<defaultValue>enable</defaultValue>
246246
</leafNode>
247+
<node name="timeout">
248+
<properties>
249+
<help>Connection timeout options</help>
250+
</properties>
251+
<children>
252+
#include <include/firewall/timeout-common-protocols.xml.i>
253+
</children>
254+
</node>
247255
<leafNode name="twa-hazards-protection">
248256
<properties>
249257
<help>RFC1337 TCP TIME-WAIT assasination hazards protection</help>

‎interface-definitions/include/conntrack/timeout-common-protocols.xml.i renamed to ‎interface-definitions/include/firewall/timeout-common-protocols.xml.i

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
<!-- include start from conntrack/timeout-common-protocols.xml.i -->
1+
<!-- include start from firewall/timeout-common-protocols.xml.i -->
22
<leafNode name="icmp">
33
<properties>
44
<help>ICMP timeout in seconds</help>
@@ -169,4 +169,3 @@
169169
</leafNode>
170170
</children>
171171
</node>
172-
<!-- include end -->

‎interface-definitions/include/version/firewall-version.xml.i

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,3 @@
11
<!-- include start from include/version/firewall-version.xml.i -->
2-
<syntaxVersion component='firewall' version='15'></syntaxVersion>
2+
<syntaxVersion component='firewall' version='16'></syntaxVersion>
33
<!-- include end -->

‎interface-definitions/system_conntrack.xml.in

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -509,7 +509,6 @@
509509
</node>
510510
</children>
511511
</node>
512-
#include <include/conntrack/timeout-common-protocols.xml.i>
513512
</children>
514513
</node>
515514
</children>

‎smoketest/scripts/cli/test_firewall.py

Lines changed: 92 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323

2424
from vyos.configsession import ConfigSessionError
2525
from vyos.utils.process import run
26+
from vyos.utils.file import read_file
2627

2728
sysfs_config = {
2829
'all_ping': {'sysfs': '/proc/sys/net/ipv4/icmp_echo_ignore_all', 'default': '0', 'test_value': 'disable'},
@@ -38,6 +39,10 @@
3839
'twa_hazards_protection': {'sysfs': '/proc/sys/net/ipv4/tcp_rfc1337', 'default': '0', 'test_value': 'enable'}
3940
}
4041

42+
def get_sysctl(parameter):
43+
tmp = parameter.replace(r'.', r'/')
44+
return read_file(f'/proc/sys/{tmp}')
45+
4146
class TestFirewall(VyOSUnitTestSHIM.TestCase):
4247
@classmethod
4348
def setUpClass(cls):
@@ -240,7 +245,7 @@ def test_ipv4_basic_rules(self):
240245
self.cli_set(['firewall', 'ipv4', 'output', 'raw', 'rule', '1', 'action', 'accept'])
241246
self.cli_set(['firewall', 'ipv4', 'output', 'raw', 'rule', '1', 'protocol', 'udp'])
242247

243-
self.cli_set(['firewall', 'ipv4', 'prerouting', 'raw', 'rule', '1', 'action', 'drop'])
248+
self.cli_set(['firewall', 'ipv4', 'prerouting', 'raw', 'rule', '1', 'action', 'notrack'])
244249
self.cli_set(['firewall', 'ipv4', 'prerouting', 'raw', 'rule', '1', 'protocol', 'tcp'])
245250
self.cli_set(['firewall', 'ipv4', 'prerouting', 'raw', 'rule', '1', 'destination', 'port', '23'])
246251

@@ -270,7 +275,7 @@ def test_ipv4_basic_rules(self):
270275
['OUT-raw default-action drop', 'drop'],
271276
['chain VYOS_PREROUTING_raw'],
272277
['type filter hook prerouting priority raw; policy accept;'],
273-
['tcp dport 23', 'drop'],
278+
['tcp dport 23', 'notrack'],
274279
['PRE-raw default-action accept', 'accept'],
275280
['chain NAME_smoketest'],
276281
['saddr 172.16.20.10', 'daddr 172.16.10.10', 'log prefix "[ipv4-NAM-smoketest-1-A]" log level debug', 'ip ttl 15', 'accept'],
@@ -474,7 +479,7 @@ def test_ipv6_basic_rules(self):
474479
self.cli_set(['firewall', 'ipv6', 'output', 'filter', 'rule', '3', 'outbound-interface', 'name', interface])
475480

476481
self.cli_set(['firewall', 'ipv6', 'output', 'raw', 'default-action', 'drop'])
477-
self.cli_set(['firewall', 'ipv6', 'output', 'raw', 'rule', '1', 'action', 'accept'])
482+
self.cli_set(['firewall', 'ipv6', 'output', 'raw', 'rule', '1', 'action', 'notrack'])
478483
self.cli_set(['firewall', 'ipv6', 'output', 'raw', 'rule', '1', 'protocol', 'udp'])
479484

480485
self.cli_set(['firewall', 'ipv6', 'prerouting', 'raw', 'rule', '1', 'action', 'drop'])
@@ -498,7 +503,7 @@ def test_ipv6_basic_rules(self):
498503
['log prefix "[ipv6-OUT-filter-default-D]"','OUT-filter default-action drop', 'drop'],
499504
['chain VYOS_IPV6_OUTPUT_raw'],
500505
['type filter hook output priority raw; policy accept;'],
501-
['udp', 'accept'],
506+
['udp', 'notrack'],
502507
['OUT-raw default-action drop', 'drop'],
503508
['chain VYOS_IPV6_PREROUTING_raw'],
504509
['type filter hook prerouting priority raw; policy accept;'],
@@ -770,6 +775,89 @@ def test_sysfs(self):
770775
with open(path, 'r') as f:
771776
self.assertNotEqual(f.read().strip(), conf['default'], msg=path)
772777

778+
def test_timeout_sysctl(self):
779+
timeout_config = {
780+
'net.netfilter.nf_conntrack_icmp_timeout' :{
781+
'cli' : ['global-options', 'timeout', 'icmp'],
782+
'test_value' : '180',
783+
'default_value' : '30',
784+
},
785+
'net.netfilter.nf_conntrack_generic_timeout' :{
786+
'cli' : ['global-options', 'timeout', 'other'],
787+
'test_value' : '1200',
788+
'default_value' : '600',
789+
},
790+
'net.netfilter.nf_conntrack_tcp_timeout_close_wait' :{
791+
'cli' : ['global-options', 'timeout', 'tcp', 'close-wait'],
792+
'test_value' : '30',
793+
'default_value' : '60',
794+
},
795+
'net.netfilter.nf_conntrack_tcp_timeout_close' :{
796+
'cli' : ['global-options', 'timeout', 'tcp', 'close'],
797+
'test_value' : '20',
798+
'default_value' : '10',
799+
},
800+
'net.netfilter.nf_conntrack_tcp_timeout_established' :{
801+
'cli' : ['global-options', 'timeout', 'tcp', 'established'],
802+
'test_value' : '1000',
803+
'default_value' : '432000',
804+
},
805+
'net.netfilter.nf_conntrack_tcp_timeout_fin_wait' :{
806+
'cli' : ['global-options', 'timeout', 'tcp', 'fin-wait'],
807+
'test_value' : '240',
808+
'default_value' : '120',
809+
},
810+
'net.netfilter.nf_conntrack_tcp_timeout_last_ack' :{
811+
'cli' : ['global-options', 'timeout', 'tcp', 'last-ack'],
812+
'test_value' : '300',
813+
'default_value' : '30',
814+
},
815+
'net.netfilter.nf_conntrack_tcp_timeout_syn_recv' :{
816+
'cli' : ['global-options', 'timeout', 'tcp', 'syn-recv'],
817+
'test_value' : '100',
818+
'default_value' : '60',
819+
},
820+
'net.netfilter.nf_conntrack_tcp_timeout_syn_sent' :{
821+
'cli' : ['global-options', 'timeout', 'tcp', 'syn-sent'],
822+
'test_value' : '300',
823+
'default_value' : '120',
824+
},
825+
'net.netfilter.nf_conntrack_tcp_timeout_time_wait' :{
826+
'cli' : ['global-options', 'timeout', 'tcp', 'time-wait'],
827+
'test_value' : '303',
828+
'default_value' : '120',
829+
},
830+
'net.netfilter.nf_conntrack_udp_timeout' :{
831+
'cli' : ['global-options', 'timeout', 'udp', 'other'],
832+
'test_value' : '90',
833+
'default_value' : '30',
834+
},
835+
'net.netfilter.nf_conntrack_udp_timeout_stream' :{
836+
'cli' : ['global-options', 'timeout', 'udp', 'stream'],
837+
'test_value' : '200',
838+
'default_value' : '180',
839+
},
840+
}
841+
842+
for parameter, parameter_config in timeout_config.items():
843+
self.cli_set(['firewall'] + parameter_config['cli'] + [parameter_config['test_value']])
844+
845+
# commit changes
846+
self.cli_commit()
847+
848+
# validate configuration
849+
for parameter, parameter_config in timeout_config.items():
850+
tmp = parameter_config['test_value']
851+
self.assertEqual(get_sysctl(f'{parameter}'), tmp)
852+
853+
# delete all configuration options and revert back to defaults
854+
self.cli_delete(['firewall', 'global-options', 'timeout'])
855+
self.cli_commit()
856+
857+
# validate configuration
858+
for parameter, parameter_config in timeout_config.items():
859+
self.assertEqual(get_sysctl(f'{parameter}'), parameter_config['default_value'])
860+
773861
### Zone
774862
def test_zone_basic(self):
775863
self.cli_set(['firewall', 'ipv4', 'name', 'smoketest', 'default-action', 'drop'])

‎smoketest/scripts/cli/test_system_conntrack.py

Lines changed: 0 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -68,66 +68,6 @@ def test_conntrack_options(self):
6868
'test_value' : '128',
6969
'default_value' : '3',
7070
},
71-
'net.netfilter.nf_conntrack_icmp_timeout' :{
72-
'cli' : ['timeout', 'icmp'],
73-
'test_value' : '180',
74-
'default_value' : '30',
75-
},
76-
'net.netfilter.nf_conntrack_generic_timeout' :{
77-
'cli' : ['timeout', 'other'],
78-
'test_value' : '1200',
79-
'default_value' : '600',
80-
},
81-
'net.netfilter.nf_conntrack_tcp_timeout_close_wait' :{
82-
'cli' : ['timeout', 'tcp', 'close-wait'],
83-
'test_value' : '30',
84-
'default_value' : '60',
85-
},
86-
'net.netfilter.nf_conntrack_tcp_timeout_close' :{
87-
'cli' : ['timeout', 'tcp', 'close'],
88-
'test_value' : '20',
89-
'default_value' : '10',
90-
},
91-
'net.netfilter.nf_conntrack_tcp_timeout_established' :{
92-
'cli' : ['timeout', 'tcp', 'established'],
93-
'test_value' : '1000',
94-
'default_value' : '432000',
95-
},
96-
'net.netfilter.nf_conntrack_tcp_timeout_fin_wait' :{
97-
'cli' : ['timeout', 'tcp', 'fin-wait'],
98-
'test_value' : '240',
99-
'default_value' : '120',
100-
},
101-
'net.netfilter.nf_conntrack_tcp_timeout_last_ack' :{
102-
'cli' : ['timeout', 'tcp', 'last-ack'],
103-
'test_value' : '300',
104-
'default_value' : '30',
105-
},
106-
'net.netfilter.nf_conntrack_tcp_timeout_syn_recv' :{
107-
'cli' : ['timeout', 'tcp', 'syn-recv'],
108-
'test_value' : '100',
109-
'default_value' : '60',
110-
},
111-
'net.netfilter.nf_conntrack_tcp_timeout_syn_sent' :{
112-
'cli' : ['timeout', 'tcp', 'syn-sent'],
113-
'test_value' : '300',
114-
'default_value' : '120',
115-
},
116-
'net.netfilter.nf_conntrack_tcp_timeout_time_wait' :{
117-
'cli' : ['timeout', 'tcp', 'time-wait'],
118-
'test_value' : '303',
119-
'default_value' : '120',
120-
},
121-
'net.netfilter.nf_conntrack_udp_timeout' :{
122-
'cli' : ['timeout', 'udp', 'other'],
123-
'test_value' : '90',
124-
'default_value' : '30',
125-
},
126-
'net.netfilter.nf_conntrack_udp_timeout_stream' :{
127-
'cli' : ['timeout', 'udp', 'stream'],
128-
'test_value' : '200',
129-
'default_value' : '180',
130-
},
13171
}
13272

13373
for parameter, parameter_config in conntrack_config.items():

‎src/conf_mode/firewall.py

Lines changed: 5 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -33,27 +33,15 @@
3333
from vyos.utils.dict import dict_search_args
3434
from vyos.utils.dict import dict_search_recursive
3535
from vyos.utils.process import call
36+
from vyos.utils.process import cmd
3637
from vyos.utils.process import rc_cmd
3738
from vyos import ConfigError
3839
from vyos import airbag
3940

4041
airbag.enable()
4142

4243
nftables_conf = '/run/nftables.conf'
43-
44-
sysfs_config = {
45-
'all_ping': {'sysfs': '/proc/sys/net/ipv4/icmp_echo_ignore_all', 'enable': '0', 'disable': '1'},
46-
'broadcast_ping': {'sysfs': '/proc/sys/net/ipv4/icmp_echo_ignore_broadcasts', 'enable': '0', 'disable': '1'},
47-
'directed_broadcast' : {'sysfs': '/proc/sys/net/ipv4/conf/all/bc_forwarding', 'enable': '1', 'disable': '0'},
48-
'ip_src_route': {'sysfs': '/proc/sys/net/ipv4/conf/*/accept_source_route'},
49-
'ipv6_receive_redirects': {'sysfs': '/proc/sys/net/ipv6/conf/*/accept_redirects'},
50-
'ipv6_src_route': {'sysfs': '/proc/sys/net/ipv6/conf/*/accept_source_route', 'enable': '0', 'disable': '-1'},
51-
'log_martians': {'sysfs': '/proc/sys/net/ipv4/conf/all/log_martians'},
52-
'receive_redirects': {'sysfs': '/proc/sys/net/ipv4/conf/*/accept_redirects'},
53-
'send_redirects': {'sysfs': '/proc/sys/net/ipv4/conf/*/send_redirects'},
54-
'syn_cookies': {'sysfs': '/proc/sys/net/ipv4/tcp_syncookies'},
55-
'twa_hazards_protection': {'sysfs': '/proc/sys/net/ipv4/tcp_rfc1337'}
56-
}
44+
sysctl_file = r'/run/sysctl/10-vyos-firewall.conf'
5745

5846
valid_groups = [
5947
'address_group',
@@ -467,33 +455,16 @@ def generate(firewall):
467455
local_zone_conf['from_local'][zone] = zone_conf['from'][local_zone]
468456

469457
render(nftables_conf, 'firewall/nftables.j2', firewall)
458+
render(sysctl_file, 'firewall/sysctl-firewall.conf.j2', firewall)
470459
return None
471460

472-
def apply_sysfs(firewall):
473-
for name, conf in sysfs_config.items():
474-
paths = glob(conf['sysfs'])
475-
value = None
476-
477-
if name in firewall['global_options']:
478-
conf_value = firewall['global_options'][name]
479-
if conf_value in conf:
480-
value = conf[conf_value]
481-
elif conf_value == 'enable':
482-
value = '1'
483-
elif conf_value == 'disable':
484-
value = '0'
485-
486-
if value:
487-
for path in paths:
488-
with open(path, 'w') as f:
489-
f.write(value)
490-
491461
def apply(firewall):
492462
install_result, output = rc_cmd(f'nft --file {nftables_conf}')
493463
if install_result == 1:
494464
raise ConfigError(f'Failed to apply firewall: {output}')
495465

496-
apply_sysfs(firewall)
466+
# Apply firewall global-options sysctl settings
467+
cmd(f'sysctl -f {sysctl_file}')
497468

498469
call_dependents()
499470

‎src/conf_mode/system_conntrack.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -166,7 +166,7 @@ def verify(conntrack):
166166
if not group_obj:
167167
Warning(f'{error_group} "{group_name}" has no members!')
168168

169-
Warning(f'It is prefered to defined {inet} conntrack ignore rules in the <firewall {inet} prerouting raw> section')
169+
Warning(f'It is prefered to define {inet} conntrack ignore rules in <firewall {inet} prerouting raw> section')
170170

171171
if dict_search_args(conntrack, 'timeout', 'custom', inet, 'rule') != None:
172172
for rule, rule_config in conntrack['timeout']['custom'][inet]['rule'].items():

0 commit comments

Comments
 (0)