Skip to content

Commit 85da43a

Browse files
dmbaturindmbaturin
authored
Merge pull request #3578 from nicolas-fort/raw-hook
T3900: Add support for raw tables in firewall
2 parents 1c57ed8 + 770edf0 commit 85da43a

36 files changed

+813
-906
lines changed

‎data/templates/conntrack/sysctl.conf.j2

Lines changed: 1 addition & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -3,25 +3,7 @@
33

44
net.netfilter.nf_conntrack_expect_max = {{ expect_table_size }}
55
net.netfilter.nf_conntrack_max = {{ table_size }}
6-
76
net.ipv4.tcp_max_syn_backlog = {{ tcp.half_open_connections }}
8-
97
net.netfilter.nf_conntrack_tcp_loose = {{ '1' if tcp.loose is vyos_defined('enable') else '0' }}
108
net.netfilter.nf_conntrack_tcp_max_retrans = {{ tcp.max_retrans }}
11-
12-
net.netfilter.nf_conntrack_icmp_timeout = {{ timeout.icmp }}
13-
net.netfilter.nf_conntrack_generic_timeout = {{ timeout.other }}
14-
15-
net.netfilter.nf_conntrack_tcp_timeout_close_wait = {{ timeout.tcp.close_wait }}
16-
net.netfilter.nf_conntrack_tcp_timeout_close = {{ timeout.tcp.close }}
17-
net.netfilter.nf_conntrack_tcp_timeout_established = {{ timeout.tcp.established }}
18-
net.netfilter.nf_conntrack_tcp_timeout_fin_wait = {{ timeout.tcp.fin_wait }}
19-
net.netfilter.nf_conntrack_tcp_timeout_last_ack = {{ timeout.tcp.last_ack }}
20-
net.netfilter.nf_conntrack_tcp_timeout_syn_recv = {{ timeout.tcp.syn_recv }}
21-
net.netfilter.nf_conntrack_tcp_timeout_syn_sent = {{ timeout.tcp.syn_sent }}
22-
net.netfilter.nf_conntrack_tcp_timeout_time_wait = {{ timeout.tcp.time_wait }}
23-
24-
net.netfilter.nf_conntrack_udp_timeout = {{ timeout.udp.other }}
25-
net.netfilter.nf_conntrack_udp_timeout_stream = {{ timeout.udp.stream }}
26-
27-
net.netfilter.nf_conntrack_acct = {{ '1' if flow_accounting is vyos_defined else '0' }}
9+
net.netfilter.nf_conntrack_acct = {{ '1' if flow_accounting is vyos_defined else '0' }}

‎data/templates/firewall/nftables.j2

Lines changed: 32 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ table ip vyos_filter {
5757
{% endif %}
5858
{% endfor %}
5959
{% endif %}
60-
{{ conf | nft_default_rule('FWD-filter', 'ipv4') }}
60+
{{ conf | nft_default_rule('FWD-' + prior, 'ipv4') }}
6161
}
6262
{% endfor %}
6363
{% endif %}
@@ -77,7 +77,7 @@ table ip vyos_filter {
7777
{% endif %}
7878
{% endfor %}
7979
{% endif %}
80-
{{ conf | nft_default_rule('INP-filter', 'ipv4') }}
80+
{{ conf | nft_default_rule('INP-' + prior, 'ipv4') }}
8181
}
8282
{% endfor %}
8383
{% endif %}
@@ -97,14 +97,11 @@ table ip vyos_filter {
9797
{% endif %}
9898
{% endfor %}
9999
{% endif %}
100-
{{ conf | nft_default_rule('OUT-filter', 'ipv4') }}
100+
{{ conf | nft_default_rule('OUT-' + prior, 'ipv4') }}
101101
}
102102
{% endfor %}
103103
{% endif %}
104-
chain VYOS_FRAG_MARK {
105-
type filter hook prerouting priority -450; policy accept;
106-
ip frag-off & 0x3fff != 0 meta mark set 0xffff1 return
107-
}
104+
108105
{% if ipv4.prerouting is vyos_defined %}
109106
{% for prior, conf in ipv4.prerouting.items() %}
110107
chain VYOS_PREROUTING_{{ prior }} {
@@ -117,11 +114,16 @@ table ip vyos_filter {
117114
{% endif %}
118115
{% endfor %}
119116
{% endif %}
120-
{{ conf | nft_default_rule('PRE-filter', 'ipv4') }}
117+
{{ conf | nft_default_rule('PRE-' + prior, 'ipv4') }}
121118
}
122119
{% endfor %}
123120
{% endif %}
124121

122+
chain VYOS_FRAG_MARK {
123+
type filter hook prerouting priority -450; policy accept;
124+
ip frag-off & 0x3fff != 0 meta mark set 0xffff1 return
125+
}
126+
125127
{% if ipv4.name is vyos_defined %}
126128
{% for name_text, conf in ipv4.name.items() %}
127129
chain NAME_{{ name_text }} {
@@ -202,13 +204,13 @@ table ip6 vyos_filter {
202204
{% endif %}
203205
{% if conf.rule is vyos_defined %}
204206
{% for rule_id, rule_conf in conf.rule.items() if rule_conf.disable is not vyos_defined %}
205-
{{ rule_conf | nft_rule('FWD', prior, rule_id ,'ip6') }}
207+
{{ rule_conf | nft_rule('FWD', prior, rule_id, 'ip6') }}
206208
{% if rule_conf.recent is vyos_defined %}
207209
{% set ns.sets = ns.sets + ['FWD_' + prior + '_' + rule_id] %}
208210
{% endif %}
209211
{% endfor %}
210212
{% endif %}
211-
{{ conf | nft_default_rule('FWD-filter', 'ipv6') }}
213+
{{ conf | nft_default_rule('FWD-' + prior, 'ipv6') }}
212214
}
213215
{% endfor %}
214216
{% endif %}
@@ -222,13 +224,13 @@ table ip6 vyos_filter {
222224
{% endif %}
223225
{% if conf.rule is vyos_defined %}
224226
{% for rule_id, rule_conf in conf.rule.items() if rule_conf.disable is not vyos_defined %}
225-
{{ rule_conf | nft_rule('INP', prior, rule_id ,'ip6') }}
227+
{{ rule_conf | nft_rule('INP', prior, rule_id, 'ip6') }}
226228
{% if rule_conf.recent is vyos_defined %}
227229
{% set ns.sets = ns.sets + ['INP_' + prior + '_' + rule_id] %}
228230
{% endif %}
229231
{% endfor %}
230232
{% endif %}
231-
{{ conf | nft_default_rule('INP-filter', 'ipv6') }}
233+
{{ conf | nft_default_rule('INP-' + prior, 'ipv6') }}
232234
}
233235
{% endfor %}
234236
{% endif %}
@@ -242,17 +244,33 @@ table ip6 vyos_filter {
242244
{% endif %}
243245
{% if conf.rule is vyos_defined %}
244246
{% for rule_id, rule_conf in conf.rule.items() if rule_conf.disable is not vyos_defined %}
245-
{{ rule_conf | nft_rule('OUT', prior, rule_id ,'ip6') }}
247+
{{ rule_conf | nft_rule('OUT', prior, rule_id, 'ip6') }}
246248
{% if rule_conf.recent is vyos_defined %}
247249
{% set ns.sets = ns.sets + ['OUT_ ' + prior + '_' + rule_id] %}
248250
{% endif %}
249251
{% endfor %}
250252
{% endif %}
251-
{{ conf | nft_default_rule('OUT-filter', 'ipv6') }}
253+
{{ conf | nft_default_rule('OUT-' + prior, 'ipv6') }}
252254
}
253255
{% endfor %}
254256
{% endif %}
255257

258+
{% if ipv6.prerouting is vyos_defined %}
259+
{% for prior, conf in ipv6.prerouting.items() %}
260+
chain VYOS_IPV6_PREROUTING_{{ prior }} {
261+
type filter hook prerouting priority {{ prior }}; policy accept;
262+
{% if conf.rule is vyos_defined %}
263+
{% for rule_id, rule_conf in conf.rule.items() if rule_conf.disable is not vyos_defined %}
264+
{{ rule_conf | nft_rule('PRE', prior, rule_id, 'ip6') }}
265+
{% if rule_conf.recent is vyos_defined %}
266+
{% set ns.sets = ns.sets + ['PRE_' + prior + '_' + rule_id] %}
267+
{% endif %}
268+
{% endfor %}
269+
{% endif %}
270+
{{ conf | nft_default_rule('PRE-' + prior, 'ipv6') }}
271+
}
272+
{% endfor %}
273+
{% endif %}
256274
chain VYOS_FRAG6_MARK {
257275
type filter hook prerouting priority -450; policy accept;
258276
exthdr frag exists meta mark set 0xffff1 return

‎data/templates/firewall/sysctl-firewall.conf.j2

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# Autogenerated by firewall.py
2+
3+
# gloabl options
4+
net.ipv4.icmp_echo_ignore_all = {{ 0 if global_options.all_ping == 'enable' else 1 }}
5+
net.ipv4.icmp_echo_ignore_broadcasts = {{ 0 if global_options.broadcast_ping == 'enable' else 1 }}
6+
net.ipv4.conf.all.bc_forwarding = {{ 1 if global_options.directed_broadcast == 'enable' else 0 }}
7+
net.ipv4.conf.*.accept_source_route = {{ 1 if global_options.ip_src_route == 'enable' else 0 }}
8+
net.ipv6.conf.*.accept_redirects = {{ 1 if global_options.ipv6_receive_redirects == 'enable' else 0 }}
9+
net.ipv6.conf.*.accept_source_route = {{ 0 if global_options.ipv6_src_route == 'enable' else -1 }}
10+
net.ipv4.conf.all.log_martians = {{ 1 if global_options.log_martians == 'enable' else 0 }}
11+
net.ipv4.conf.*.accept_redirects = {{ 1 if global_options.receive_redirects == 'enable' else 0 }}
12+
net.ipv4.conf.*.send_redirects = {{ 1 if global_options.send_redirects == 'enable' else 0 }}
13+
net.ipv4.tcp_syncookies = {{ 1 if global_options.syn_cookies == 'enable' else 0 }}
14+
net.ipv4.tcp_rfc1337 = {{ 1 if global_options.twa_hazards_protection == 'enable' else 0 }}
15+
16+
## Timeout values:
17+
net.netfilter.nf_conntrack_icmp_timeout = {{ global_options.timeout.icmp }}
18+
net.netfilter.nf_conntrack_generic_timeout = {{ global_options.timeout.other }}
19+
net.netfilter.nf_conntrack_tcp_timeout_close_wait = {{ global_options.timeout.tcp.close_wait }}
20+
net.netfilter.nf_conntrack_tcp_timeout_close = {{ global_options.timeout.tcp.close }}
21+
net.netfilter.nf_conntrack_tcp_timeout_established = {{ global_options.timeout.tcp.established }}
22+
net.netfilter.nf_conntrack_tcp_timeout_fin_wait = {{ global_options.timeout.tcp.fin_wait }}
23+
net.netfilter.nf_conntrack_tcp_timeout_last_ack = {{ global_options.timeout.tcp.last_ack }}
24+
net.netfilter.nf_conntrack_tcp_timeout_syn_recv = {{ global_options.timeout.tcp.syn_recv }}
25+
net.netfilter.nf_conntrack_tcp_timeout_syn_sent = {{ global_options.timeout.tcp.syn_sent }}
26+
net.netfilter.nf_conntrack_tcp_timeout_time_wait = {{ global_options.timeout.tcp.time_wait }}
27+
net.netfilter.nf_conntrack_udp_timeout = {{ global_options.timeout.udp.other }}
28+
net.netfilter.nf_conntrack_udp_timeout_stream = {{ global_options.timeout.udp.stream }}

‎interface-definitions/firewall.xml.in

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -378,6 +378,7 @@
378378
#include <include/firewall/ipv4-hook-forward.xml.i>
379379
#include <include/firewall/ipv4-hook-input.xml.i>
380380
#include <include/firewall/ipv4-hook-output.xml.i>
381+
#include <include/firewall/ipv4-hook-prerouting.xml.i>
381382
#include <include/firewall/ipv4-custom-name.xml.i>
382383
</children>
383384
</node>
@@ -389,6 +390,7 @@
389390
#include <include/firewall/ipv6-hook-forward.xml.i>
390391
#include <include/firewall/ipv6-hook-input.xml.i>
391392
#include <include/firewall/ipv6-hook-output.xml.i>
393+
#include <include/firewall/ipv6-hook-prerouting.xml.i>
392394
#include <include/firewall/ipv6-custom-name.xml.i>
393395
</children>
394396
</node>

‎interface-definitions/include/firewall/action-and-notrack.xml.i

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,16 @@
33
<properties>
44
<help>Rule action</help>
55
<completionHelp>
6-
<list>accept jump notrack reject return drop queue</list>
6+
<list>accept continue jump notrack reject return drop queue</list>
77
</completionHelp>
88
<valueHelp>
99
<format>accept</format>
1010
<description>Accept matching entries</description>
1111
</valueHelp>
12+
<valueHelp>
13+
<format>continue</format>
14+
<description>Continue parsing next rule</description>
15+
</valueHelp>
1216
<valueHelp>
1317
<format>jump</format>
1418
<description>Jump to another chain</description>
@@ -31,10 +35,10 @@
3135
</valueHelp>
3236
<valueHelp>
3337
<format>notrack</format>
34-
<description>Igone connection tracking</description>
38+
<description>Ignore connection tracking</description>
3539
</valueHelp>
3640
<constraint>
37-
<regex>(accept|jump|notrack|reject|return|drop|queue)</regex>
41+
<regex>(accept|continue|jump|notrack|reject|return|drop|queue)</regex>
3842
</constraint>
3943
</properties>
4044
</leafNode>

‎interface-definitions/include/firewall/add-addr-to-group-ipv4.xml.i

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
<!-- include start from firewall/add-addr-to-group-ipv4.xml.i -->
2+
<node name="add-address-to-group">
3+
<properties>
4+
<help>Add ip address to dynamic address-group</help>
5+
</properties>
6+
<children>
7+
<node name="source-address">
8+
<properties>
9+
<help>Add source ip addresses to dynamic address-group</help>
10+
</properties>
11+
<children>
12+
#include <include/firewall/add-dynamic-address-groups.xml.i>
13+
</children>
14+
</node>
15+
<node name="destination-address">
16+
<properties>
17+
<help>Add destination ip addresses to dynamic address-group</help>
18+
</properties>
19+
<children>
20+
#include <include/firewall/add-dynamic-address-groups.xml.i>
21+
</children>
22+
</node>
23+
</children>
24+
</node>
25+
<!-- include end -->

‎interface-definitions/include/firewall/add-addr-to-group-ipv6.xml.i

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
<!-- include start from firewall/add-addr-to-group-ipv6.xml.i -->
2+
<node name="add-address-to-group">
3+
<properties>
4+
<help>Add ipv6 address to dynamic ipv6-address-group</help>
5+
</properties>
6+
<children>
7+
<node name="source-address">
8+
<properties>
9+
<help>Add source ipv6 addresses to dynamic ipv6-address-group</help>
10+
</properties>
11+
<children>
12+
#include <include/firewall/add-dynamic-ipv6-address-groups.xml.i>
13+
</children>
14+
</node>
15+
<node name="destination-address">
16+
<properties>
17+
<help>Add destination ipv6 addresses to dynamic ipv6-address-group</help>
18+
</properties>
19+
<children>
20+
#include <include/firewall/add-dynamic-ipv6-address-groups.xml.i>
21+
</children>
22+
</node>
23+
</children>
24+
</node>
25+
<!-- include end -->

0 commit comments

Comments
 (0)