|
 |
66253d |
From e6a56f32e2eced533a8edbc97652de6b436df63a Mon Sep 17 00:00:00 2001
|
|
|
66253d |
From: Eric Garver <eric@garver.life>
|
|
|
66253d |
Date: Sun, 19 Jan 2020 16:16:59 -0500
|
|
|
66253d |
Subject: [PATCH 32/37] feat: ipXtables: support AllowZoneDrifting=yes
|
|
|
66253d |
|
|
|
66253d |
(cherry picked from commit 1f7b5ffcd40daf2a7f2ef1ec0cccb95080e74fb6)
|
|
|
66253d |
(cherry picked from commit c6b6ab1c0625bfd906a7783e3924b676b514cf6b)
|
|
|
66253d |
---
|
|
|
66253d |
src/firewall/core/ipXtables.py | 93 +++++++++++++++++++---------------
|
|
|
66253d |
1 file changed, 51 insertions(+), 42 deletions(-)
|
|
|
66253d |
|
|
|
66253d |
diff --git a/src/firewall/core/ipXtables.py b/src/firewall/core/ipXtables.py
|
|
|
66253d |
index 973bf5bbae04..61c307d0e05a 100644
|
|
|
66253d |
--- a/src/firewall/core/ipXtables.py
|
|
|
66253d |
+++ b/src/firewall/core/ipXtables.py
|
|
|
66253d |
@@ -323,8 +323,11 @@ class ip4tables(object):
|
|
|
66253d |
|
|
|
66253d |
index = zone_source_index_cache.index(zone_source)
|
|
|
66253d |
else:
|
|
|
66253d |
- index = len(zone_source_index_cache)
|
|
|
66253d |
-
|
|
|
66253d |
+ if self._fw._allow_zone_drifting:
|
|
|
66253d |
+ index = 0
|
|
|
66253d |
+ else:
|
|
|
66253d |
+ index = len(zone_source_index_cache)
|
|
|
66253d |
+
|
|
|
66253d |
rule[0] = "-I"
|
|
|
66253d |
rule.insert(2, "%d" % (index + 1))
|
|
|
66253d |
|
|
|
66253d |
@@ -666,9 +669,10 @@ class ip4tables(object):
|
|
|
66253d |
self.our_chains["raw"].add("%s_direct" % chain)
|
|
|
66253d |
|
|
|
66253d |
if chain == "PREROUTING":
|
|
|
66253d |
- default_rules["raw"].append("-N %s_ZONES" % chain)
|
|
|
66253d |
- default_rules["raw"].append("-A %s -j %s_ZONES" % (chain, chain))
|
|
|
66253d |
- self.our_chains["raw"].update(set(["%s_ZONES" % chain]))
|
|
|
66253d |
+ for dispatch_suffix in ["ZONES_SOURCE", "ZONES"] if self._fw._allow_zone_drifting else ["ZONES"]:
|
|
|
66253d |
+ default_rules["raw"].append("-N %s_%s" % (chain, dispatch_suffix))
|
|
|
66253d |
+ default_rules["raw"].append("-A %s -j %s_%s" % (chain, chain, dispatch_suffix))
|
|
|
66253d |
+ self.our_chains["raw"].update(set(["%s_%s" % (chain, dispatch_suffix)]))
|
|
|
66253d |
|
|
|
66253d |
if self.get_available_tables("mangle"):
|
|
|
66253d |
default_rules["mangle"] = [ ]
|
|
|
66253d |
@@ -679,9 +683,10 @@ class ip4tables(object):
|
|
|
66253d |
self.our_chains["mangle"].add("%s_direct" % chain)
|
|
|
66253d |
|
|
|
66253d |
if chain == "PREROUTING":
|
|
|
66253d |
- default_rules["mangle"].append("-N %s_ZONES" % chain)
|
|
|
66253d |
- default_rules["mangle"].append("-A %s -j %s_ZONES" % (chain, chain))
|
|
|
66253d |
- self.our_chains["mangle"].update(set(["%s_ZONES" % chain]))
|
|
|
66253d |
+ for dispatch_suffix in ["ZONES_SOURCE", "ZONES"] if self._fw._allow_zone_drifting else ["ZONES"]:
|
|
|
66253d |
+ default_rules["mangle"].append("-N %s_%s" % (chain, dispatch_suffix))
|
|
|
66253d |
+ default_rules["mangle"].append("-A %s -j %s_%s" % (chain, chain, dispatch_suffix))
|
|
|
66253d |
+ self.our_chains["mangle"].update(set(["%s_%s" % (chain, dispatch_suffix)]))
|
|
|
66253d |
|
|
|
66253d |
if self.get_available_tables("nat"):
|
|
|
66253d |
default_rules["nat"] = [ ]
|
|
|
66253d |
@@ -692,19 +697,22 @@ class ip4tables(object):
|
|
|
66253d |
self.our_chains["nat"].add("%s_direct" % chain)
|
|
|
66253d |
|
|
|
66253d |
if chain in [ "PREROUTING", "POSTROUTING" ]:
|
|
|
66253d |
- default_rules["nat"].append("-N %s_ZONES" % chain)
|
|
|
66253d |
- default_rules["nat"].append("-A %s -j %s_ZONES" % (chain, chain))
|
|
|
66253d |
- self.our_chains["nat"].update(set(["%s_ZONES" % chain]))
|
|
|
66253d |
-
|
|
|
66253d |
- default_rules["filter"] = [
|
|
|
66253d |
- "-N INPUT_direct",
|
|
|
66253d |
- "-N INPUT_ZONES",
|
|
|
66253d |
-
|
|
|
66253d |
- "-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPT",
|
|
|
66253d |
- "-A INPUT -i lo -j ACCEPT",
|
|
|
66253d |
- "-A INPUT -j INPUT_direct",
|
|
|
66253d |
- "-A INPUT -j INPUT_ZONES",
|
|
|
66253d |
- ]
|
|
|
66253d |
+ for dispatch_suffix in ["ZONES_SOURCE", "ZONES"] if self._fw._allow_zone_drifting else ["ZONES"]:
|
|
|
66253d |
+ default_rules["nat"].append("-N %s_%s" % (chain, dispatch_suffix))
|
|
|
66253d |
+ default_rules["nat"].append("-A %s -j %s_%s" % (chain, chain, dispatch_suffix))
|
|
|
66253d |
+ self.our_chains["nat"].update(set(["%s_%s" % (chain, dispatch_suffix)]))
|
|
|
66253d |
+
|
|
|
66253d |
+ default_rules["filter"] = []
|
|
|
66253d |
+ self.our_chains["filter"] = set()
|
|
|
66253d |
+ default_rules["filter"].append("-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPT")
|
|
|
66253d |
+ default_rules["filter"].append("-A INPUT -i lo -j ACCEPT")
|
|
|
66253d |
+ default_rules["filter"].append("-N INPUT_direct")
|
|
|
66253d |
+ default_rules["filter"].append("-A INPUT -j INPUT_direct")
|
|
|
66253d |
+ self.our_chains["filter"].update(set("INPUT_direct"))
|
|
|
66253d |
+ for dispatch_suffix in ["ZONES_SOURCE", "ZONES"] if self._fw._allow_zone_drifting else ["ZONES"]:
|
|
|
66253d |
+ default_rules["filter"].append("-N INPUT_%s" % (dispatch_suffix))
|
|
|
66253d |
+ default_rules["filter"].append("-A INPUT -j INPUT_%s" % (dispatch_suffix))
|
|
|
66253d |
+ self.our_chains["filter"].update(set("INPUT_%s" % (dispatch_suffix)))
|
|
|
66253d |
if log_denied != "off":
|
|
|
66253d |
default_rules["filter"].append("-A INPUT -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: '")
|
|
|
66253d |
default_rules["filter"].append("-A INPUT -m conntrack --ctstate INVALID -j DROP")
|
|
|
66253d |
@@ -712,17 +720,16 @@ class ip4tables(object):
|
|
|
66253d |
default_rules["filter"].append("-A INPUT %%LOGTYPE%% -j LOG --log-prefix 'FINAL_REJECT: '")
|
|
|
66253d |
default_rules["filter"].append("-A INPUT -j %%REJECT%%")
|
|
|
66253d |
|
|
|
66253d |
- default_rules["filter"] += [
|
|
|
66253d |
- "-N FORWARD_direct",
|
|
|
66253d |
- "-N FORWARD_IN_ZONES",
|
|
|
66253d |
- "-N FORWARD_OUT_ZONES",
|
|
|
66253d |
-
|
|
|
66253d |
- "-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPT",
|
|
|
66253d |
- "-A FORWARD -i lo -j ACCEPT",
|
|
|
66253d |
- "-A FORWARD -j FORWARD_direct",
|
|
|
66253d |
- "-A FORWARD -j FORWARD_IN_ZONES",
|
|
|
66253d |
- "-A FORWARD -j FORWARD_OUT_ZONES",
|
|
|
66253d |
- ]
|
|
|
66253d |
+ default_rules["filter"].append("-A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED,DNAT -j ACCEPT")
|
|
|
66253d |
+ default_rules["filter"].append("-A FORWARD -i lo -j ACCEPT")
|
|
|
66253d |
+ default_rules["filter"].append("-N FORWARD_direct")
|
|
|
66253d |
+ default_rules["filter"].append("-A FORWARD -j FORWARD_direct")
|
|
|
66253d |
+ self.our_chains["filter"].update(set("FORWARD_direct"))
|
|
|
66253d |
+ for direction in ["IN", "OUT"]:
|
|
|
66253d |
+ for dispatch_suffix in ["ZONES_SOURCE", "ZONES"] if self._fw._allow_zone_drifting else ["ZONES"]:
|
|
|
66253d |
+ default_rules["filter"].append("-N FORWARD_%s_%s" % (direction, dispatch_suffix))
|
|
|
66253d |
+ default_rules["filter"].append("-A FORWARD -j FORWARD_%s_%s" % (direction, dispatch_suffix))
|
|
|
66253d |
+ self.our_chains["filter"].update(set("FORWARD_%s_%s" % (direction, dispatch_suffix)))
|
|
|
66253d |
if log_denied != "off":
|
|
|
66253d |
default_rules["filter"].append("-A FORWARD -m conntrack --ctstate INVALID %%LOGTYPE%% -j LOG --log-prefix 'STATE_INVALID_DROP: '")
|
|
|
66253d |
default_rules["filter"].append("-A FORWARD -m conntrack --ctstate INVALID -j DROP")
|
|
|
66253d |
@@ -736,10 +743,7 @@ class ip4tables(object):
|
|
|
66253d |
"-A OUTPUT -o lo -j ACCEPT",
|
|
|
66253d |
"-A OUTPUT -j OUTPUT_direct",
|
|
|
66253d |
]
|
|
|
66253d |
-
|
|
|
66253d |
- self.our_chains["filter"] = set(["INPUT_direct", "INPUT_ZONES",
|
|
|
66253d |
- "FORWARD_direct", "FORWARD_IN_ZONES",
|
|
|
66253d |
- "FORWARD_OUT_ZONES", "OUTPUT_direct"])
|
|
|
66253d |
+ self.our_chains["filter"].update(set("OUTPUT_direct"))
|
|
|
66253d |
|
|
|
66253d |
final_default_rules = []
|
|
|
66253d |
for table in default_rules:
|
|
|
66253d |
@@ -805,6 +809,11 @@ class ip4tables(object):
|
|
|
66253d |
"OUTPUT": "-d",
|
|
|
66253d |
}[chain]
|
|
|
66253d |
|
|
|
66253d |
+ if self._fw._allow_zone_drifting:
|
|
|
66253d |
+ zone_dispatch_chain = "%s_ZONES_SOURCE" % (chain)
|
|
|
66253d |
+ else:
|
|
|
66253d |
+ zone_dispatch_chain = "%s_ZONES" % (chain)
|
|
|
66253d |
+
|
|
|
66253d |
target = DEFAULT_ZONE_TARGET.format(chain=SHORTCUTS[chain], zone=zone)
|
|
|
66253d |
action = "-g"
|
|
|
66253d |
|
|
|
66253d |
@@ -815,8 +824,8 @@ class ip4tables(object):
|
|
|
66253d |
else:
|
|
|
66253d |
opt = "src"
|
|
|
66253d |
flags = ",".join([opt] * self._fw.ipset.get_dimension(name))
|
|
|
66253d |
- rule = [ add_del,
|
|
|
66253d |
- "%s_ZONES" % chain, "%%ZONE_SOURCE%%", zone,
|
|
|
66253d |
+ rule = [ add_del, zone_dispatch_chain,
|
|
|
66253d |
+ "%%ZONE_SOURCE%%", zone,
|
|
|
66253d |
"-t", table,
|
|
|
66253d |
"-m", "set", "--match-set", name,
|
|
|
66253d |
flags, action, target ]
|
|
|
66253d |
@@ -825,14 +834,14 @@ class ip4tables(object):
|
|
|
66253d |
# outgoing can not be set
|
|
|
66253d |
if opt == "-d":
|
|
|
66253d |
return ""
|
|
|
66253d |
- rule = [ add_del,
|
|
|
66253d |
- "%s_ZONES" % chain, "%%ZONE_SOURCE%%", zone,
|
|
|
66253d |
+ rule = [ add_del, zone_dispatch_chain,
|
|
|
66253d |
+ "%%ZONE_SOURCE%%", zone,
|
|
|
66253d |
"-t", table,
|
|
|
66253d |
"-m", "mac", "--mac-source", address.upper(),
|
|
|
66253d |
action, target ]
|
|
|
66253d |
else:
|
|
|
66253d |
- rule = [ add_del,
|
|
|
66253d |
- "%s_ZONES" % chain, "%%ZONE_SOURCE%%", zone,
|
|
|
66253d |
+ rule = [ add_del, zone_dispatch_chain,
|
|
|
66253d |
+ "%%ZONE_SOURCE%%", zone,
|
|
|
66253d |
"-t", table,
|
|
|
66253d |
opt, address, action, target ]
|
|
|
66253d |
return [rule]
|
|
|
66253d |
--
|
|
|
66253d |
2.23.0
|
|
|
66253d |
|