1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
|
--[[
Filter module for Alpine Wall
Copyright (C) 2012-2019 Kaarle Ritvanen
See LICENSE file for license details
]]--
local loadclass = require('awall').loadclass
local FAMILIES = require('awall.family').ALL
local resolve = require('awall.host').resolve
local model = require('awall.model')
local class = model.class
local Rule = model.Rule
local combinations = require('awall.optfrag').combinations
local util = require('awall.util')
local contains = util.contains
local extend = util.extend
local listpairs = util.listpairs
local setdefault = util.setdefault
local function initmask(obj)
for _, attr in ipairs{'src-mask', 'dest-mask'} do
if obj[attr] then
obj:error('Attribute not allowed with a named limit: '..attr)
end
end
local limits = obj.root.limit
obj[(obj.addr or 'src')..'-mask'] = limits and limits[obj.name] or true
end
local RECENT_MAX_COUNT = 20
local FilterLimit = class(model.Limit)
function FilterLimit:initmask()
if self.name then initmask(self)
elseif self.update ~= nil then
self:error('Attribute allowed only with named limits: update')
end
FilterLimit.super(self):initmask()
if self.name and not self:recentofrags() then
self:error('Attribute allowed only with low-rate limits: name')
end
end
function FilterLimit:recentofrags(name)
local count = self.count
local interval = self.interval
if count > RECENT_MAX_COUNT then
count = self:intrate()
interval = 1
end
if count > RECENT_MAX_COUNT then return end
local update = self.update ~= false
local ofs = self:recentmask(name)
if not ofs then return end
return combinations(
ofs,
{
{match='--'..(update and 'update' or 'rcheck')..' --hitcount '..
count..' --seconds '..interval}
}
), update and combinations(ofs, {{match='--set'}}) or nil
end
local LimitReference = class(model.Maskable)
function LimitReference:initmask()
if not self.name then
if not self[1] then self:error('Limit name not defined') end
self.name = self[1]
end
initmask(self)
LimitReference.super(self):initmask()
end
function LimitReference:recentofrags()
local ofs = self:recentmask()
return ofs and combinations(ofs, {{match='--set'}}) or
self:error('Invalid address mask for limit')
end
local TranslatingRule = class(Rule)
function TranslatingRule:init(...)
TranslatingRule.super(self):init(...)
if type(self.dnat) == 'string' then self.dnat = {addr=self.dnat} end
end
function TranslatingRule:destoptfrags()
local ofrags = TranslatingRule.super(self):destoptfrags()
if not self.dnat then return ofrags end
ofrags = combinations(ofrags, {{family='inet6'}})
local natof = self:create(
model.Zone, {addr=self.dnat.addr}
):optfrags(self:direction('out'))
assert(#natof == 1)
table.insert(ofrags, natof[1])
return ofrags
end
function TranslatingRule:servoptfrags()
local ofrags = TranslatingRule.super(self):servoptfrags()
if not (self.dnat and self.dnat.port) then return ofrags end
ofrags = combinations(ofrags, {{family='inet6'}})
local protos = {}
for _, serv in listpairs(self.service) do
for _, sdef in listpairs(serv) do
if sdef.family ~= 'inet6' then
if not contains({'tcp', 'udp'}, sdef.proto) then
self:error('Cannot do port translation for '..sdef.proto)
end
protos[sdef.proto] = true
end
end
end
for proto, _ in pairs(protos) do
extend(
ofrags,
combinations(
self:create(
model.Rule, {service={proto=proto, port=self.dnat.port}}
):servoptfrags(),
{{family='inet'}}
)
)
end
return ofrags
end
local LoggingRule = class(TranslatingRule)
function LoggingRule:init(...)
LoggingRule.super(self):init(...)
setdefault(self, 'action', 'accept')
local custom = self:customtarget()
if type(self.log) ~= 'table' then
self.log = loadclass('log').get(
self, self.log, not custom and self:logdefault()
)
end
if custom and self.log then
self:error('Logging not allowed with custom action: '..self.action)
end
end
function LoggingRule:logdefault() return false end
function LoggingRule:target() return 'ACCEPT' end
function LoggingRule:actofrags(log, target)
local res = log and log:optfrags() or {}
if target ~= nil then table.insert(res, {target=target}) end
return res
end
function LoggingRule:combinelog(ofrags, log, action, target)
local actions = self:actofrags(log, target)
return actions[1] and
self:combine(
ofrags, actions, 'log'..action, log and #log:optfrags() > 0
) or ofrags
end
function LoggingRule:mangleoptfrags(ofrags)
return self:customtarget() and ofrags or
self:combinelog(ofrags, self.log, self.action, self:target())
end
local RelatedRule = class(TranslatingRule)
function RelatedRule:servoptfrags()
local helpers = {}
for i, serv in listpairs(self.service) do
for i, sdef in listpairs(serv) do
local helper = sdef['ct-helper']
if helper then
helpers[helper] = {
family=sdef.family,
match='-m conntrack --ctstate RELATED -m helper --helper '..
helper
}
end
end
end
return util.values(helpers)
end
function RelatedRule:target() return 'ACCEPT' end
local Filter = class(LoggingRule)
function Filter:init(...)
local ul = self['update-limit']
if ul then setdefault(self, 'action', 'pass') end
Filter.super(self):init(...)
-- alpine v2.4 compatibility
if contains({'logdrop', 'logreject'}, self.action) then
self:warning('Deprecated action: '..self.action)
self.action = self.action:sub(4, -1)
end
local limit = self:limit()
if limit then
if limit == 'conn-limit' and self['no-track'] then
self:error('Tracking required with connection limit')
end
if type(self[limit]) ~= 'table' then
self[limit] = {count=self[limit]}
end
self[limit].log = loadclass('log').get(self, self[limit].log, true)
end
if ul and self.action ~= 'pass' then
self:error('Cannot specify action with update-limit')
end
end
function Filter:updatelimit()
local ul = util.copy(self['update-limit'])
if type(ul) == 'table' then
if not contains({'conn', 'flow'}, setdefault(ul, 'measure', 'conn')) then
self:error('Invalid value for measure: '..ul.measure)
end
if self['no-track'] and ul.measure == 'conn' then
self:error('Tracking required when measuring connection rate')
end
end
return ul and self:create(LimitReference, ul, 'update-limit')
end
function Filter:extratrules()
local res = {}
local function extrarules(label, cls, options)
options = options or {}
options.attrs = 'dnat'
extend(res, self:extrarules(label, cls, options))
end
if self.dnat then
if self.action ~= 'accept' then
self:error('dnat option not allowed with '..self.action..' action')
end
if self['no-track'] then
self:error('dnat option not allowed with no-track')
end
if self.ipset then
self:error('dnat and ipset options cannot be used simultaneously')
end
if self.dnat.addr:find('/') then
self:error('DNAT target cannot be a network address')
end
local dnataddr
for i, addr in ipairs(resolve(self.dnat.addr, self)) do
if addr[1] == 'inet' then
if dnataddr then
self:error(
self.dnat.addr..' resolves to multiple IPv4 addresses'
)
end
dnataddr = addr[2]
end
end
if not dnataddr then
self:error(self.dnat.addr..' does not resolve to any IPv4 address')
end
extrarules(
'dnat',
'dnat',
{
update={['to-addr']=dnataddr, ['to-port']=self.dnat.port},
discard='out'
}
)
end
if self.action == 'tarpit' or self['no-track'] then
extrarules('no-track', 'no-track')
end
if self.action == 'accept' then
if self:position() == 'prepend' then
extrarules('final', LoggingRule, {update={log=self.log}})
end
local nr = #res
if self.related then
for i, rule in listpairs(self.related) do
extrarules(
'related',
RelatedRule,
{index=i, src=rule, update={service=self.service}}
)
end
else
-- TODO avoid creating unnecessary RELATED rules by introducing
-- helper direction attributes to service definitions
extrarules('related', RelatedRule)
extrarules('related-reply', RelatedRule, {update={reverse=true}})
end
if self['no-track'] then
if #res > nr then
self:error('Tracking required by service')
end
extrarules('no-track-reply', 'no-track', {update={reverse=true}})
extrarules('reply', 'filter', {update={reverse=true}})
end
end
return res
end
function Filter:limit()
local res
for i, limit in ipairs({'conn-limit', 'flow-limit'}) do
if self[limit] then
if res then
self:error('Cannot specify multiple limits for a single filter rule')
end
res = limit
end
end
return res
end
function Filter:position()
local ul = self:updatelimit()
return not self['no-track'] and (
self:limit() == 'flow-limit' or (ul and ul.measure == 'flow')
) and 'prepend' or 'append'
end
function Filter:logdefault()
return contains({'drop', 'reject', 'tarpit'}, self.action)
end
function Filter:target()
if self.action == 'pass' then return end
if self.action ~= 'accept' and not self:logdefault() then
self:error('Invalid filter action: '..self.action)
end
return self.action == 'tarpit' and 'tarpit' or self.action:upper()
end
function Filter:mangleoptfrags(ofrags)
local limit = self:limit()
local ul = self:updatelimit()
if not limit then
if ul then
ofrags = self:combine(ofrags, ul:recentofrags())
end
return Filter.super(self):mangleoptfrags(ofrags)
end
local function incompatible(item)
self:error('Limit incompatible with '..item)
end
if ul then incompatible('update-limit') end
if self:customtarget() or self:logdefault() then
incompatible('action: '..self.action)
end
local limitchain = self:uniqueid('limit')
local limitlog = self[limit].log
local limitobj = self:create(FilterLimit, self[limit], 'limit')
local ofs
local final = self:position() == 'append'
local target = self:target()
local ft = final and target
local pl = not target and self.log
local cofs, sofs = limitobj:recentofrags(limitchain)
if cofs then
ofs = self:combinelog(cofs, limitlog, 'drop', 'DROP')
local nxt
if ft then
extend(ofs, self:actofrags(self.log))
nxt = target
elseif sofs and not (pl and #pl:optfrags() > 0) then nxt = false end
extend(ofs, combinations(sofs, self:actofrags(pl, nxt)))
else
if pl then incompatible('action or log') end
local limofs = limitobj:limitofrags(limitchain)
ofs = ft and Filter.super(self):mangleoptfrags(limofs) or
combinations(limofs, {{target='RETURN'}})
extend(ofs, self:actofrags(limitlog, 'DROP'))
end
return self:combine(ofrags, ofs, 'limit', true)
end
local Policy = class(Filter)
function Policy:servoptfrags() return nil end
local fchains = {{chain='FORWARD'}, {chain='INPUT'}, {chain='OUTPUT'}}
local function stateful(config)
local res = {}
for _, family in ipairs(FAMILIES) do
local er = combinations(
fchains,
{{match='-m conntrack --ctstate ESTABLISHED'}}
)
for i, chain in ipairs({'INPUT', 'OUTPUT'}) do
table.insert(
er, {chain=chain, match='-'..chain:sub(1, 1):lower()..' lo'}
)
end
extend(
res,
combinations(er, {{family=family, table='filter', target='ACCEPT'}})
)
-- TODO avoid creating unnecessary CT rules by inspecting the
-- filter rules' target families and chains
local visited = {}
local ofrags = {}
for i, rule in listpairs(config.filter) do
for i, serv in listpairs(rule.service) do
if not visited[serv] then
for i, sdef in listpairs(serv) do
if sdef['ct-helper'] then
local of = combinations(
Rule.morph{service={sdef}}:servoptfrags(),
{{family=family}}
)
if of[1] then
assert(#of == 1)
of[1].target = 'CT --helper '..sdef['ct-helper']
table.insert(ofrags, of[1])
end
end
end
visited[serv] = true
end
end
end
extend(
res,
combinations(
{{table='raw'}},
{{chain='PREROUTING'}, {chain='OUTPUT'}},
ofrags
)
)
end
return res
end
local icmp = {{family='inet', table='filter', match='-p icmp'}}
local icmp6 = {{family='inet6', table='filter', match='-p icmpv6'}}
local ir = combinations(
icmp6,
{{chain='INPUT'}, {chain='OUTPUT'}},
{{target='ACCEPT'}}
)
extend(ir, combinations(icmp6, {{chain='FORWARD', target='icmp-routing'}}))
extend(ir, combinations(icmp, fchains, {{target='icmp-routing'}}))
local function icmprules(ofrag, oname, types)
extend(
ir,
combinations(
ofrag,
{{chain='icmp-routing', target='ACCEPT'}},
util.map(types, function(t) return {match='--'..oname..' '..t} end)
)
)
end
icmprules(icmp, 'icmp-type', {3, 11, 12})
icmprules(icmp6, 'icmpv6-type', {1, 2, 3, 4})
return {
export={
filter={class=Filter, before={'dnat', 'no-track'}},
policy={class=Policy, after='%filter-after'},
['%filter-before']={rules=stateful, before='filter'},
['%filter-after']={rules=ir, after='filter'}
},
achains=combinations(
{{chain='tarpit'}}, {{match='-p tcp', target='TARPIT'}, {target='DROP'}}
)
}
|