From e8cfc0ffaf81828adff544c66aa5b1082c8e75bb Mon Sep 17 00:00:00 2001 From: Ad Schellevis Date: Mon, 22 Dec 2014 20:33:23 +0000 Subject: [PATCH] remove non standard tracking feature from pf scripts --- src/etc/inc/filter.inc | 265 ++++++++++++++++------------------------- 1 file changed, 100 insertions(+), 165 deletions(-) diff --git a/src/etc/inc/filter.inc b/src/etc/inc/filter.inc index 059059dd1..c85056ac3 100644 --- a/src/etc/inc/filter.inc +++ b/src/etc/inc/filter.inc @@ -57,15 +57,7 @@ $filterdns = array(); /* Used for aliases and interface macros */ $aliases = ""; -global $tracker; -$tracker = 1000000000; -function filter_rule_tracker($tracker) { - global $tracker; - - return (++$tracker); - -} function fix_rule_label($descr) { $descr = str_replace('"', '', $descr); @@ -2595,8 +2587,6 @@ function filter_generate_user_rule($rule) } } - if (!empty($rule['tracker'])) - $aline['tracker'] = "tracker {$rule['tracker']} "; $line = ""; /* exception(s) to a user rules can go here. */ @@ -2607,7 +2597,7 @@ function filter_generate_user_rule($rule) $line .= $aline['type'] . $aline['direction'] . $aline['log'] . $aline['quick'] . $aline['interface'] . $aline['ipprotocol'] . $aline['prot'] . $aline['src'] . $aline['os'] . $negate_networks . $aline['icmp-type'] . $aline['icmp6-type'] . $aline['tag'] . $aline['tagged'] . - $aline['vlanprio'] . $aline['vlanprioset'] . $aline['dscp'] . $aline['tracker'] . $aline['allowopts'] . $aline['flags'] . + $aline['vlanprio'] . $aline['vlanprioset'] . $aline['dscp'] . $aline['allowopts'] . $aline['flags'] . $aline['queue'] . $aline['dnpipe'] . $aline['schedlabel'] . " label \"NEGATE_ROUTE: Negate policy routing for destination\"\n"; @@ -2615,7 +2605,7 @@ function filter_generate_user_rule($rule) /* piece together the actual user rule */ $line .= $aline['type'] . $aline['direction'] . $aline['log'] . $aline['quick'] . $aline['interface'] . $aline['reply'] . $aline['route'] . $aline['ipprotocol'] . $aline['prot'] . $aline['src'] . $aline['os'] . $aline['dst'] . - $aline['divert'] . $aline['icmp-type'] . $aline['icmp6-type'] . $aline['tag'] . $aline['tagged'] . $aline['dscp'] . $aline['tracker'] . + $aline['divert'] . $aline['icmp-type'] . $aline['icmp6-type'] . $aline['tag'] . $aline['tagged'] . $aline['dscp'] . $aline['vlanprio'] . $aline['vlanprioset'] . $aline['allowopts'] . $aline['flags'] . $aline['queue'] . $aline['dnpipe'] . $aline['schedlabel']; unset($aline); @@ -2625,10 +2615,9 @@ function filter_generate_user_rule($rule) function filter_rules_generate() { - global $config, $g, $FilterIflist, $time_based_rules, $GatewaysList, $tracker; + global $config, $g, $FilterIflist, $time_based_rules, $GatewaysList; $fix_rule_label = 'fix_rule_label'; - $increment_tracker = 'filter_rule_tracker'; update_filter_reload_status(gettext("Creating default rules")); @@ -2651,25 +2640,22 @@ function filter_rules_generate() if(isset($config['syslog']['nologdefaultpass'])) $log['pass'] = "log"; - $saved_tracker = $tracker; if(!isset($config['system']['ipv6allow'])) { $ipfrules .= "# Block all IPv6\n"; - $ipfrules .= "block in {$log['block']} quick inet6 all tracker {$increment_tracker($tracker)} label \"Block all IPv6\"\n"; - $ipfrules .= "block out {$log['block']} quick inet6 all tracker {$increment_tracker($tracker)} label \"Block all IPv6\"\n"; + $ipfrules .= "block in {$log['block']} quick inet6 all label \"Block all IPv6\"\n"; + $ipfrules .= "block out {$log['block']} quick inet6 all label \"Block all IPv6\"\n"; } - $saved_tracker += 100; - $tracker = $saved_tracker; $ipfrules .= << to any tracker {$increment_tracker($tracker)} label "Block snort2c hosts" -block {$log['block']} quick from any to tracker {$increment_tracker($tracker)} label "Block snort2c hosts" +block {$log['block']} quick from to any label "Block snort2c hosts" +block {$log['block']} quick from any to label "Block snort2c hosts" EOD; - $saved_tracker += 100; - $tracker = $saved_tracker; $ipfrules .= filter_process_carp_rules($log); - $saved_tracker += 100; - $tracker = $saved_tracker; $ipfrules .= "\n# SSH lockout\n"; if(is_array($config['system']['ssh']) && !empty($config['system']['ssh']['port'])) { $ipfrules .= "block in {$log['block']} quick proto tcp from to (self) port "; $ipfrules .= $config['system']['ssh']['port']; - $ipfrules .= " tracker {$increment_tracker($tracker)} label \"sshlockout\"\n"; + $ipfrules .= " label \"sshlockout\"\n"; } else { if($config['system']['ssh']['port'] <> "") $sshport = $config['system']['ssh']['port']; else $sshport = 22; if($sshport) - $ipfrules .= "block in {$log['block']} quick proto tcp from to (self) port {$sshport} tracker {$increment_tracker($tracker)} label \"sshlockout\"\n"; + $ipfrules .= "block in {$log['block']} quick proto tcp from to (self) port {$sshport} label \"sshlockout\"\n"; } - $saved_tracker += 50; - $tracker = $saved_tracker; $ipfrules .= "\n# webConfigurator lockout\n"; if(!$config['system']['webgui']['port']) { @@ -2737,19 +2717,15 @@ EOD; $webConfiguratorlockoutport = $config['system']['webgui']['port']; } if($webConfiguratorlockoutport) - $ipfrules .= "block in {$log['block']} quick proto tcp from to (self) port {$webConfiguratorlockoutport} tracker {$increment_tracker($tracker)} label \"webConfiguratorlockout\"\n"; + $ipfrules .= "block in {$log['block']} quick proto tcp from to (self) port {$webConfiguratorlockoutport} label \"webConfiguratorlockout\"\n"; - $saved_tracker += 100; - $tracker = $saved_tracker; /* * Support for allow limiting of TCP connections by establishment rate * Useful for protecting against sudden outburts, etc. */ - $ipfrules .= "block in {$log['block']} quick from to any tracker 1000000400 label \"virusprot overload table\"\n"; + $ipfrules .= "block in {$log['block']} quick from to any label \"virusprot overload table\"\n"; - $saved_tracker += 100; - $tracker = $saved_tracker; /* if captive portal is enabled, ensure that access to this port * is allowed on a locked down interface @@ -2790,18 +2766,14 @@ EOD; $listenporthttp = $cpcfg['listenporthttp'] ? $cpcfg['listenporthttp'] : $cpcfg['zoneid']; $portalias = $listenporthttps; $portalias .= " {$listenporthttp}"; - $ipfrules .= "pass in {$log['pass']} quick on { {$cpinterface} } proto tcp from any to { {$cpaddresses} } port { {$portalias} } tracker {$increment_tracker($tracker)} keep state(sloppy)\n"; - $ipfrules .= "pass out {$log['pass']} quick on { {$cpinterface} } proto tcp from any to any flags any tracker {$increment_tracker($tracker)} keep state(sloppy)\n"; + $ipfrules .= "pass in {$log['pass']} quick on { {$cpinterface} } proto tcp from any to { {$cpaddresses} } port { {$portalias} } keep state(sloppy)\n"; + $ipfrules .= "pass out {$log['pass']} quick on { {$cpinterface} } proto tcp from any to any flags any keep state(sloppy)\n"; } } } $bogontableinstalled = 0; foreach ($FilterIflist as $on => $oc) { - /* XXX: Not static but give a step of 1000 for each interface to at least be able to match rules. */ - $saved_tracker += 1000; - $tracker = $saved_tracker; - /* block bogon networks */ /* http://www.cymru.com/Documents/bogon-bn-nonagg.txt */ /* file is automatically in cron every 3000 minutes */ @@ -2814,7 +2786,7 @@ EOD; $ipfrules .= << to any tracker {$increment_tracker($tracker)} label "{$fix_rule_label("block bogon IPv4 networks from {$oc['descr']}")}" +block in $bogonlog quick on \${$oc['descr']} from to any label "{$fix_rule_label("block bogon IPv4 networks from {$oc['descr']}")}" EOD; @@ -2822,29 +2794,23 @@ EOD; $ipfrules .= << to any tracker {$increment_tracker($tracker)} label "{$fix_rule_label("block bogon IPv6 networks from {$oc['descr']}")}" +block in $bogonlog quick on \${$oc['descr']} from to any label "{$fix_rule_label("block bogon IPv6 networks from {$oc['descr']}")}" EOD; } } - $saved_tracker += 10; - $tracker = $saved_tracker; - if(isset($config['system']['ipv6allow']) && ($oc['type6'] == "slaac" || $oc['type6'] == "dhcp6")) { $ipfrules .= << "") { $ipfrules .= << $ifcfg) { if(isset($ifcfg['virtual'])) continue; $gw = get_interface_gateway($ifdescr); if (is_ipaddrv4($gw) && is_ipaddrv4($ifcfg['ip'])) { - $ipfrules .= "pass out {$log['pass']} route-to ( {$ifcfg['if']} {$gw} ) from {$ifcfg['ip']} to !{$ifcfg['sa']}/{$ifcfg['sn']} tracker {$increment_tracker($tracker)} keep state allow-opts label \"let out anything from firewall host itself\"\n"; + $ipfrules .= "pass out {$log['pass']} route-to ( {$ifcfg['if']} {$gw} ) from {$ifcfg['ip']} to !{$ifcfg['sa']}/{$ifcfg['sn']} keep state allow-opts label \"let out anything from firewall host itself\"\n"; if (is_array($ifcfg['vips'])) { foreach ($ifcfg['vips'] as $vip) if (ip_in_subnet($vip['ip'], "{$ifcfg['sa']}/{$ifcfg['sn']}")) - $ipfrules .= "pass out {$log['pass']} route-to ( {$ifcfg['if']} {$gw} ) from {$vip['ip']} to !{$ifcfg['sa']}/{$ifcfg['sn']} tracker {$increment_tracker($tracker)} keep state allow-opts label \"let out anything from firewall host itself\"\n"; + $ipfrules .= "pass out {$log['pass']} route-to ( {$ifcfg['if']} {$gw} ) from {$vip['ip']} to !{$ifcfg['sa']}/{$ifcfg['sn']} keep state allow-opts label \"let out anything from firewall host itself\"\n"; else - $ipfrules .= "pass out {$log['pass']} route-to ( {$ifcfg['if']} {$gw} ) from {$vip['ip']} to !" . gen_subnet($vip['ip'], $vip['sn']) . "/{$vip['sn']} tracker {$increment_tracker($tracker)} keep state allow-opts label \"let out anything from firewall host itself\"\n"; + $ipfrules .= "pass out {$log['pass']} route-to ( {$ifcfg['if']} {$gw} ) from {$vip['ip']} to !" . gen_subnet($vip['ip'], $vip['sn']) . "/{$vip['sn']} keep state allow-opts label \"let out anything from firewall host itself\"\n"; } } @@ -3041,23 +2994,19 @@ EOD; $stf = get_real_interface($ifdescr, "inet6"); $pdlen = 64 - calculate_ipv6_delegation_length($ifdescr); if (is_ipaddrv6($gwv6) && is_ipaddrv6($ifcfg['ipv6'])) { - $ipfrules .= "pass out {$log['pass']} route-to ( {$stf} {$gwv6} ) inet6 from {$ifcfg['ipv6']} to !{$ifcfg['ipv6']}/{$pdlen} tracker {$increment_tracker($tracker)} keep state allow-opts label \"let out anything from firewall host itself\"\n"; + $ipfrules .= "pass out {$log['pass']} route-to ( {$stf} {$gwv6} ) inet6 from {$ifcfg['ipv6']} to !{$ifcfg['ipv6']}/{$pdlen} keep state allow-opts label \"let out anything from firewall host itself\"\n"; if (is_array($ifcfg['vips6'])) { foreach ($ifcfg['vips6'] as $vip) - $ipfrules .= "pass out {$log['pass']} route-to ( {$stf} {$gwv6} ) inet6 from {$vip['ip']} to !{$vip['ip']}/{$pdlen} tracker {$increment_tracker($tracker)} keep state allow-opts label \"let out anything from firewall host itself\"\n"; + $ipfrules .= "pass out {$log['pass']} route-to ( {$stf} {$gwv6} ) inet6 from {$vip['ip']} to !{$vip['ip']}/{$pdlen} keep state allow-opts label \"let out anything from firewall host itself\"\n"; } } } - $saved_tracker += 300; - $tracker = $saved_tracker; /* add ipsec interfaces */ if(isset($config['ipsec']['enable']) || isset($config['ipsec']['client']['enable'])) - $ipfrules .= "pass out {$log['pass']} on \$IPsec all tracker {$increment_tracker($tracker)} tracker {$increment_tracker($tracker)} keep state label \"IPsec internal host to host\"\n"; + $ipfrules .= "pass out {$log['pass']} on \$IPsec all keep state label \"IPsec internal host to host\"\n"; - $saved_tracker += 10; - $tracker = $saved_tracker; if(is_array($config['system']['webgui']) && !isset($config['system']['webgui']['noantilockout'])) { $alports = filter_get_antilockout_ports(); @@ -3068,7 +3017,7 @@ EOD; $lanif = $FilterIflist['lan']['if']; $ipfrules .= <<Advanced.\n"; } - $increment_tracker = 'filter_rule_tracker'; $ipfrules = "\n# VPN Rules\n"; /* Is IP Compression enabled? */ @@ -3533,7 +3469,6 @@ function filter_generate_ipsec_rules($log = array()) is_array($config['ipsec']['phase1'])) { /* step through all phase1 entries */ foreach ($config['ipsec']['phase1'] as $ph1ent) { - $tracker += 10; if(isset ($ph1ent['disabled'])) continue; @@ -3607,30 +3542,30 @@ function filter_generate_ipsec_rules($log = array()) /* Add rules to allow IKE to pass */ $shorttunneldescr = substr($descr, 0, 35); $ipfrules .= <<