mirror of
https://github.com/jmcorgan/fips.git
synced 2026-10-30 07:37:36 +00:00
Johnathan Corgan
5510c14688
fips0 was a member of the lan zone, and an include inserted head-of-chain accepts for it, so every FIPS peer could reach the router's own services such as LuCI, SSH and DNS. fips0 now has a zone of its own, fips, that admits only replies, ping and fips-gateway's port forwards, with a forwarding from lan for the gateway's path into the mesh. A second fw4 include refuses ICMPv6 from wan into fips0, which OpenWrt's stock Allow-ICMPv6-Forward rule would otherwise forward into the mesh. Upgrades move fips0 out of lan, remove the old include, script and hotplug hook, and reload the firewall. The reload's exit status does not show whether fw4 loaded the new ruleset, so the setup checks the loaded ruleset. If the load failed or cannot be checked, or the firewall configuration cannot be saved, including a save that a full overlay cut short, new connections from fips0 are blocked in the running ruleset until the firewall next reloads, and the upgrade says why and how to clear it. A configuration that could not be saved is migrated again at the next boot. When fips0 stays exposed (in lan through a network interface, in a zone that accepts input, or in no zone under an accepting default), or sits in an operator's own zone that now needs its own port-forward and forwarding rules, the upgrade prints a line saying so. The new firewall scenarios run the setup against the real uci, fw4 and nft in four OpenWrt rootfs images, and the package checks cover the includes and the removed files.
34 lines
1.2 KiB
Bash
34 lines
1.2 KiB
Bash
#!/bin/sh
|
|
# FIPS firewall rules — accept all traffic on the FIPS TUN interface.
|
|
#
|
|
# Called by:
|
|
# - /etc/hotplug.d/net/99-fips when fips0 comes up
|
|
# - the UCI firewall include on every firewall reload
|
|
#
|
|
# Supports both fw4 (nftables, OpenWrt 22.03+) and older iptables builds.
|
|
|
|
TUN="fips0"
|
|
|
|
if command -v nft >/dev/null 2>&1 && nft list table inet fw4 >/dev/null 2>&1; then
|
|
for chain in input output forward; do
|
|
case "$chain" in
|
|
input|forward) match="iifname \"$TUN\"" ;;
|
|
output) match="oifname \"$TUN\"" ;;
|
|
esac
|
|
nft list chain inet fw4 "$chain" 2>/dev/null | grep -q "$match" || \
|
|
nft insert rule inet fw4 "$chain" $match accept comment "\"fips\""
|
|
done
|
|
# Also accept forwarded traffic leaving via fips0
|
|
nft list chain inet fw4 forward 2>/dev/null | grep -q "oifname \"$TUN\"" || \
|
|
nft insert rule inet fw4 forward oifname "$TUN" accept comment '"fips"'
|
|
fi
|
|
|
|
if command -v iptables >/dev/null 2>&1; then
|
|
iptables -C INPUT -i "$TUN" -j ACCEPT 2>/dev/null || \
|
|
iptables -I INPUT 1 -i "$TUN" -j ACCEPT
|
|
iptables -C OUTPUT -o "$TUN" -j ACCEPT 2>/dev/null || \
|
|
iptables -I OUTPUT 1 -o "$TUN" -j ACCEPT
|
|
iptables -C FORWARD -i "$TUN" -j ACCEPT 2>/dev/null || \
|
|
iptables -I FORWARD 1 -i "$TUN" -j ACCEPT
|
|
fi
|