Skip to content

ruleset: do not reject invalid (out of state) packets #49

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
brada4 wants to merge 1 commit into
base: master
Choose a base branch
from
Open

ruleset: do not reject invalid (out of state) packets #49

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 6 additions & 3 deletions root/usr/share/firewall4/templates/ruleset.uc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -126,7 +126,7 @@ table inet fw4 {
{%+ include("zone-jump.uc", { fw4, zone, rule, direction: "input" }) %}
{% endfor; endfor %}
{% if (fw4.input_policy() == "reject"): %}
jump handle_reject
goto handle_reject
{% endif %}
{% fw4.includes('chain-append', 'input') %}
}
Expand All @@ -147,7 +147,7 @@ table inet fw4 {
{% endfor; endfor %}
{% fw4.includes('chain-append', 'forward') %}
{% if (fw4.forward_policy() == "reject"): %}
jump handle_reject
goto handle_reject
{% endif %}
}

Expand Down Expand Up @@ -175,7 +175,7 @@ table inet fw4 {
{% endfor %}
{% fw4.includes('chain-append', 'output') %}
{% if (fw4.output_policy() == "reject"): %}
jump handle_reject
goto handle_reject
{% endif %}
}

Expand All @@ -195,6 +195,9 @@ table inet fw4 {
}

chain handle_reject {
{% if (!fw4.default_option("drop_invalid")): %}
ct state invalid counter drop comment "!fw4: drop invalid packets before reject"
{% endif %}
meta l4proto tcp reject with {{
(fw4.default_option("tcp_reject_code") != "tcp-reset")
? `icmpx type ${fw4.default_option("tcp_reject_code")}`
Expand Down
2 changes: 1 addition & 1 deletion root/usr/share/firewall4/templates/zone-verdict.uc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
{%+ if (verdict != "accept" && (zone.log & 1)): -%}
log prefix "{{ verdict }} {{ zone.name }} {{ egress ? "out" : "in" }}: " {%+ endif -%}
{% if (verdict == "reject"): -%}
jump handle_reject comment "!fw4: reject {{ zone.name }} {{ fw4.nfproto(rule.family, true) }} traffic"
goto handle_reject comment "!fw4: reject {{ zone.name }} {{ fw4.nfproto(rule.family, true) }} traffic"
{% else -%}
{{ verdict }} comment "!fw4: {{ verdict }} {{ zone.name }} {{ fw4.nfproto(rule.family, true) }} traffic"
{% endif -%}
Expand Down
9 changes: 5 additions & 4 deletions tests/01_configuration/01_ruleset
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -116,7 +116,7 @@ table inet fw4 {
tcp flags & (fin | syn | rst | ack) == syn jump syn_flood comment "!fw4: Rate limit TCP syn packets"
iifname "br-lan" jump input_lan comment "!fw4: Handle lan IPv4/IPv6 input traffic"
iifname "pppoe-wan" jump input_wan comment "!fw4: Handle wan IPv4/IPv6 input traffic"
jump handle_reject
goto handle_reject
}

chain forward {
Expand All @@ -126,7 +126,7 @@ table inet fw4 {
ct state vmap { established : accept, related : accept } comment "!fw4: Handle forwarded flows"
iifname "br-lan" jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic"
iifname "pppoe-wan" jump forward_wan comment "!fw4: Handle wan IPv4/IPv6 forward traffic"
jump handle_reject
goto handle_reject
}

chain output {
Expand All @@ -146,6 +146,7 @@ table inet fw4 {
}

chain handle_reject {
ct state invalid counter drop comment "!fw4: drop invalid packets before reject"
meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
}
Expand Down Expand Up @@ -220,11 +221,11 @@ table inet fw4 {
}

chain reject_from_wan {
iifname "pppoe-wan" counter jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
iifname "pppoe-wan" counter goto handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
}

chain reject_to_wan {
oifname "pppoe-wan" counter jump handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
oifname "pppoe-wan" counter goto handle_reject comment "!fw4: reject wan IPv4/IPv6 traffic"
}


Expand Down
1 change: 1 addition & 0 deletions tests/01_configuration/02_rule_order
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -121,6 +121,7 @@ table inet fw4 {
}

chain handle_reject {
ct state invalid counter drop comment "!fw4: drop invalid packets before reject"
meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
}
Expand Down
5 changes: 3 additions & 2 deletions tests/02_zones/01_policies
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,6 +129,7 @@ table inet fw4 {
}

chain handle_reject {
ct state invalid counter drop comment "!fw4: drop invalid packets before reject"
meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
}
Expand Down Expand Up @@ -195,11 +196,11 @@ table inet fw4 {
}

chain reject_from_test3 {
iifname "zone3" counter jump handle_reject comment "!fw4: reject test3 IPv4/IPv6 traffic"
iifname "zone3" counter goto handle_reject comment "!fw4: reject test3 IPv4/IPv6 traffic"
}

chain reject_to_test3 {
oifname "zone3" counter jump handle_reject comment "!fw4: reject test3 IPv4/IPv6 traffic"
oifname "zone3" counter goto handle_reject comment "!fw4: reject test3 IPv4/IPv6 traffic"
}


Expand Down
5 changes: 3 additions & 2 deletions tests/02_zones/02_masq
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,6 +130,7 @@ table inet fw4 {
}

chain handle_reject {
ct state invalid counter drop comment "!fw4: drop invalid packets before reject"
meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
}
Expand Down Expand Up @@ -188,11 +189,11 @@ table inet fw4 {
}

chain reject_from_test3 {
iifname "zone3" counter jump handle_reject comment "!fw4: reject test3 IPv4/IPv6 traffic"
iifname "zone3" counter goto handle_reject comment "!fw4: reject test3 IPv4/IPv6 traffic"
}

chain reject_to_test3 {
oifname "zone3" counter jump handle_reject comment "!fw4: reject test3 IPv4/IPv6 traffic"
oifname "zone3" counter goto handle_reject comment "!fw4: reject test3 IPv4/IPv6 traffic"
}


Expand Down
1 change: 1 addition & 0 deletions tests/02_zones/03_masq_src_dest_restrictions
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -150,6 +150,7 @@ table inet fw4 {
}

chain handle_reject {
ct state invalid counter drop comment "!fw4: drop invalid packets before reject"
meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
}
Expand Down
1 change: 1 addition & 0 deletions tests/02_zones/04_masq_allow_invalid
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,6 +96,7 @@ table inet fw4 {
}

chain handle_reject {
ct state invalid counter drop comment "!fw4: drop invalid packets before reject"
meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
}
Expand Down
1 change: 1 addition & 0 deletions tests/02_zones/04_wildcard_devices
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,6 +179,7 @@ table inet fw4 {
}

chain handle_reject {
ct state invalid counter drop comment "!fw4: drop invalid packets before reject"
meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
}
Expand Down
1 change: 1 addition & 0 deletions tests/02_zones/05_subnet_mask_matches
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,6 +118,7 @@ table inet fw4 {
}

chain handle_reject {
ct state invalid counter drop comment "!fw4: drop invalid packets before reject"
meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
}
Expand Down
1 change: 1 addition & 0 deletions tests/02_zones/06_family_selections
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -177,6 +177,7 @@ table inet fw4 {
}

chain handle_reject {
ct state invalid counter drop comment "!fw4: drop invalid packets before reject"
meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
}
Expand Down
1 change: 1 addition & 0 deletions tests/02_zones/07_helpers
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -206,6 +206,7 @@ table inet fw4 {
}

chain handle_reject {
ct state invalid counter drop comment "!fw4: drop invalid packets before reject"
meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
}
Expand Down
1 change: 1 addition & 0 deletions tests/02_zones/08_log_limit
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -281,6 +281,7 @@ table inet fw4 {
}

chain handle_reject {
ct state invalid counter drop comment "!fw4: drop invalid packets before reject"
meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
}
Expand Down
1 change: 1 addition & 0 deletions tests/03_rules/01_direction
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,6 +97,7 @@ table inet fw4 {
}

chain handle_reject {
ct state invalid counter drop comment "!fw4: drop invalid packets before reject"
meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
}
Expand Down
1 change: 1 addition & 0 deletions tests/03_rules/02_enabled
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,6 +92,7 @@ table inet fw4 {
}

chain handle_reject {
ct state invalid counter drop comment "!fw4: drop invalid packets before reject"
meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
}
Expand Down
1 change: 1 addition & 0 deletions tests/03_rules/03_constraints
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -131,6 +131,7 @@ table inet fw4 {
}

chain handle_reject {
ct state invalid counter drop comment "!fw4: drop invalid packets before reject"
meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
}
Expand Down
1 change: 1 addition & 0 deletions tests/03_rules/04_icmp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -104,6 +104,7 @@ table inet fw4 {
}

chain handle_reject {
ct state invalid counter drop comment "!fw4: drop invalid packets before reject"
meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
}
Expand Down
1 change: 1 addition & 0 deletions tests/03_rules/05_mangle
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -208,6 +208,7 @@ table inet fw4 {
}

chain handle_reject {
ct state invalid counter drop comment "!fw4: drop invalid packets before reject"
meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
}
Expand Down
1 change: 1 addition & 0 deletions tests/03_rules/06_subnet_mask_matches
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -175,6 +175,7 @@ table inet fw4 {
}

chain handle_reject {
ct state invalid counter drop comment "!fw4: drop invalid packets before reject"
meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
}
Expand Down
1 change: 1 addition & 0 deletions tests/03_rules/07_redirect
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -196,6 +196,7 @@ table inet fw4 {
}

chain handle_reject {
ct state invalid counter drop comment "!fw4: drop invalid packets before reject"
meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
}
Expand Down
1 change: 1 addition & 0 deletions tests/03_rules/08_family_inheritance
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -227,6 +227,7 @@ table inet fw4 {
}

chain handle_reject {
ct state invalid counter drop comment "!fw4: drop invalid packets before reject"
meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
}
Expand Down
1 change: 1 addition & 0 deletions tests/03_rules/09_time
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -173,6 +173,7 @@ table inet fw4 {
}

chain handle_reject {
ct state invalid counter drop comment "!fw4: drop invalid packets before reject"
meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
}
Expand Down
1 change: 1 addition & 0 deletions tests/03_rules/10_notrack
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -137,6 +137,7 @@ table inet fw4 {
}

chain handle_reject {
ct state invalid counter drop comment "!fw4: drop invalid packets before reject"
meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
}
Expand Down
1 change: 1 addition & 0 deletions tests/03_rules/11_log
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -139,6 +139,7 @@ table inet fw4 {
}

chain handle_reject {
ct state invalid counter drop comment "!fw4: drop invalid packets before reject"
meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
}
Expand Down
1 change: 1 addition & 0 deletions tests/03_rules/12_mark
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -120,6 +120,7 @@ table inet fw4 {
}

chain handle_reject {
ct state invalid counter drop comment "!fw4: drop invalid packets before reject"
meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
}
Expand Down
1 change: 1 addition & 0 deletions tests/04_forwardings/01_family_selections
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -123,6 +123,7 @@ table inet fw4 {
}

chain handle_reject {
ct state invalid counter drop comment "!fw4: drop invalid packets before reject"
meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
}
Expand Down
1 change: 1 addition & 0 deletions tests/05_ipsets/01_declaration
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -110,6 +110,7 @@ table inet fw4 {
}

chain handle_reject {
ct state invalid counter drop comment "!fw4: drop invalid packets before reject"
meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
}
Expand Down
1 change: 1 addition & 0 deletions tests/05_ipsets/02_usage
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -190,6 +190,7 @@ table inet fw4 {
}

chain handle_reject {
ct state invalid counter drop comment "!fw4: drop invalid packets before reject"
meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
}
Expand Down
1 change: 1 addition & 0 deletions tests/06_includes/01_nft_includes
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -183,6 +183,7 @@ table inet fw4 {
}

chain handle_reject {
ct state invalid counter drop comment "!fw4: drop invalid packets before reject"
meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
}
Expand Down
1 change: 1 addition & 0 deletions tests/06_includes/02_firewall.user_include
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,6 +118,7 @@ table inet fw4 {
}

chain handle_reject {
ct state invalid counter drop comment "!fw4: drop invalid packets before reject"
meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
}
Expand Down
1 change: 1 addition & 0 deletions tests/06_includes/04_disabled_include
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -124,6 +124,7 @@ table inet fw4 {
}

chain handle_reject {
ct state invalid counter drop comment "!fw4: drop invalid packets before reject"
meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
}
Expand Down
1 change: 1 addition & 0 deletions tests/06_includes/05_automatic_includes
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -124,6 +124,7 @@ table inet fw4 {
}

chain handle_reject {
ct state invalid counter drop comment "!fw4: drop invalid packets before reject"
meta l4proto tcp reject with tcp reset comment "!fw4: Reject TCP traffic"
reject with icmpx type port-unreachable comment "!fw4: Reject any other traffic"
}
Expand Down