usrfwhomegwrules.c

firewall PNE 3.3 source code, running at more than vxworks6.x version.

                           1, FW_SRC_TRK_ON, 57) == ERROR)
            {
            printf("PRE:FLOOD2: Failed to set rate limit rule\n");
            return ERROR;
            }
        if (fwRuleFieldSet(ruleId, FW_FIELD_ACTION, FW_REJECT) == ERROR)
            {
            printf("PRE:FLOOD2: Failed to set action\n");
            return ERROR;
            }
        }
    
    if (pingFloodProtect == TRUE)
        {    
        /* Rule to block ping flood */
    
        ruleId = fwRuleCreate(groupId);
        if (ruleId == NULL)
            {
            printf("PRE:FLOOD3: Can't create rule\n");
            return ERROR;
            }          
        if (fwRuleFieldSet(ruleId, FW_FIELD_ICMP, ICMP_ECHO, 0)
	    == ERROR)
        {
        printf("PRE:FLOOD3: Can't set ICMP field\n");
        return ERROR;                
        }
        
        /* Rate limit per host up to 57 hosts */  
            
        if (fwRuleFieldSet(ruleId, FW_FIELD_RATELIMIT, FW_GT_OP, pingFloodRate, 
                           1, FW_SRC_TRK_ON, 57) == ERROR)
            {
            printf("PRE:FLOOD3: Failed to set rate limit rule\n");
            return ERROR;
            }
        if (fwRuleFieldSet(ruleId, FW_FIELD_ACTION, FW_REJECT) == ERROR)
            {
            printf("PRE:FLOOD3: Failed to set action\n");
            return ERROR;
            }  
        }
        
    return OK;                
    }                   
                    
/***************************************************************************
*
* forwardRulesSet - Set firewall rules for forwarded packets
*
* RETURNS: OK (success), or ERROR (failure)
*/

LOCAL STATUS forwardRulesSet()
    {
    void * groupId1;
    void * groupId2;
    void * groupId3;    
    void * ruleId;
    FW_SERVICE_DESC extServiceDesc;
    
    /*
     * Set the default action for ALL forwarded packets (from any
     * network interface) to reject 
     */
    
    if (fwRuleFilterInstall(FW_FORW_LOC, FW_REJECT, NULL, NULL, NULL, 0)
        == ERROR)
        {
        printf("FWD: Failed to install Rule Filter!\n");
        return ERROR;
        } 

    /*
     * Packets forwarded from Public network to Private network
     */
     
    /* Group for Public --> Private packets */
    
    groupId1 = fwRuleGroupCreate(FW_FORW_LOC, 
                                 "Packets Forwarded from Public to Private",
                                 pktLogLen);
    if (groupId1 == NULL)
        {
        printf("FWD-PUB: Can't create rule group\n");
        return ERROR;
        }
    if (fwRuleFieldSet(groupId1, FW_FIELD_NETIF, 
                       (UINT32) publicIfName, publicIfUnit,
                       (UINT32) privateIfName, privateIfUnit) == ERROR)
        {
        printf("FWD-PUB: Failed to set netif\n");
        return ERROR;
        }    

    /* Rule to allow packets that are part of established connections */
        
    ruleId = fwRuleCreate(groupId1);
    if (ruleId == NULL)
        {
        printf("FWD-PUB: Can't create rule\n");
        return ERROR;
        }           
    if (fwRuleFieldSet(ruleId, FW_FIELD_STATE, FW_CONN_RESPONDER,
                       FW_CONN_STATE_ESTABLISHED) == ERROR)
        {
        printf("FWD-PUB: Failed to set state\n");
        return ERROR;
        }
    if (fwRuleFieldSet(ruleId, FW_FIELD_ACTION, FW_ACCEPT | FW_LOG) 
        == ERROR)
        {
        printf("FWD-PUB: Failed to set action\n");
        return ERROR;
        }    
       
    /* Rule(s) to allow FTP Service on the private network */
    
    if (inFtpsAllow == TRUE)
        {
        if (inFtpsAllowRulesSet(groupId1) == ERROR)
            return ERROR;        
        }
        
    /* Rule(s) to allow HTTP Service on the private network */
    
    if (inHttpsAllow == TRUE)
        {
        if (inHttpsAllowRulesSet(groupId1) == ERROR)
            return ERROR;                
        }
        
    /* Rule(s) to allow Telnet Service on the private network */
    
    if (inTelnetsAllow == TRUE)
        {
        if (inTelnetsAllowRulesSet(groupId1) == ERROR)
            return ERROR;                
        }
        
    /* Rule(s) to allow SMTP Service on the private network */
    
    if (inSmtpsAllow == TRUE)
        {
        if (inSmtpsAllowRulesSet(groupId1) == ERROR)
            return ERROR;                
        }
            
    /* Rule(s) to allow POP Service on the private network */
    
    if (inPopsAllow == TRUE)
        {
        if (inPopsAllowRulesSet(groupId1) == ERROR)
            return ERROR;                
        }

                                            
    /*
     * Packets forwarded from Private network to Public network
     */
         
    /* Group for Private --> Public packets */
    
    groupId2 = fwRuleGroupCreate(FW_FORW_LOC, 
                                 "Packets Forwarded from Private to Public",
                                 pktLogLen);
    if (groupId2 == NULL)
        {
        printf("FWD-PRI: Can't create rule group\n");
        return ERROR;
        }
    if (fwRuleFieldSet(groupId2, FW_FIELD_NETIF, 
                       (UINT32) privateIfName, privateIfUnit,
                       (UINT32) publicIfName, publicIfUnit) == ERROR)
        {
        printf("FWD-PRI: Failed to set netif\n");
        return ERROR;
        }    
        
    /* Rule to block HTTP traffic based on content */
    
    if (httpContentFilter == TRUE)
        {
        if (contentFilterRulesSet(groupId2) == ERROR)
            return ERROR;
        }        

    /* Rule to accept all other packets */
    
    ruleId = fwRuleCreate(groupId2);
    if (ruleId == NULL)
        {
        printf("FWD-PRI: Can't create rule\n");
        return ERROR;
        }       
    if (fwRuleFieldSet(ruleId, FW_FIELD_ACTION, FW_ACCEPT) == ERROR)
        {
        printf("FWD-PRI: Failed to set action\n");
        return ERROR;
        }  
         
    /*
     * For FTP Client on Private Network to talk to FTP Server on Public
     * Network in NORMAL (Active) mode, attach an extension handler
     * to the above rule to:
     *
     * a) inspect payload of FTP control channel to look for PORT command
     * b) get the client port of the FTP data channel
     * c) create rules to allow the incoming FTP data channel connection
     */
    extServiceDesc.proto = IPPROTO_TCP;
    extServiceDesc.srcPort = 0;
    extServiceDesc.dstPort = FTPS_PORT;
    if (fwExtHandlerInstall(ruleId, &extServiceDesc, fwExtFtpHandler, 
                            NULL, NULL) == ERROR)
        {
        printf("FWD-PRI: Failed to install FTP ext handler for Client\n");
        return ERROR;
        }

    if (inFtpsAllow == TRUE)
        {
        /*
         * For FTP Server on Private Network to talk to FTP Client on Public
         * Network in Passive mode, attach an extension handler to the
         * above rule to:
         *
         * a) inspect payload of FTP control channel to look for PASV command
         * b) get the server port of the FTP data channel
         * c) create rules to allow the incoming FTP data channel connection
         */ 
                        
        extServiceDesc.proto = IPPROTO_TCP;
        extServiceDesc.srcPort = FTPS_PORT;
        extServiceDesc.dstPort = 0;
        if (fwExtHandlerInstall(ruleId, &extServiceDesc, fwExtFtpHandler, 
                                NULL, NULL) == ERROR)
            {
            printf("FWD-PRI: Failed to install FTP ext handler for Server\n");
            return ERROR;
            }         
        }           

    /*
     * Packets sent in response to rejected packets at Public interface.
     *
     * At pre-input filter location, in addition to rejecting packets you
     * can also choose to send a TCP Reset or an ICMP packet in response
     * to the rejected packet. These packets will go through the
     * Forward filter location, and need to be allowed.
     */
     
    /* Group to allow response to rejected packets from public interface */
   
    groupId3 = fwRuleGroupCreate(FW_FORW_LOC,
                         "Response to Rejected packets from Public Interface",
                         pktLogLen);
    if (groupId3 == NULL)
        {
        printf("FWD-RESP: Can't create rule group\n");
        return ERROR;
        }
    if (fwRuleFieldSet(groupId3, FW_FIELD_NETIF,
                       (UINT32) publicIfName, publicIfUnit,
                       (UINT32) publicIfName, publicIfUnit) == ERROR)
        {
        printf("FWD-RESP: Failed to set netif\n");
        return ERROR;
        }
    if (fwRuleFieldSet(groupId3, FW_FIELD_ACTION, FW_ACCEPT) == ERROR)
        {
        printf("FWD-RESP: Failed to set action\n");
        return ERROR;
        }
                    
    return OK;   
    }
    
/***************************************************************************
*
* inGatewayRulesSet - Set firewall rules for packets incoming to
* gateway itself
*
* RETURNS: OK (success), or ERROR (failure)
*/

LOCAL STATUS inGatewayRulesSet()
    {
    void * groupId1;
    void * groupId2;
    void * groupId3;
    
    /*
     * Set the default action for ALL incoming packets to Gateway 
     * (from any network interface) to reject 
     */
    
    if (fwRuleFilterInstall(FW_IN_LOC, FW_REJECT, NULL, NULL, NULL, 0)
        == ERROR)
        {
        printf("IN: Failed to install Rule Filter!\n");
        return ERROR;
        }

    /* Group to allow packets ONLY if they are part of established connection */

    groupId1 = fwRuleGroupCreate(FW_IN_LOC, 
                                 "Packets from Public to Gateway",
                                  pktLogLen);
    if (groupId1 == NULL)
        {
        printf("IN-PUB: Can't create rule group\n");
        return ERROR;
        }
    if (fwRuleFieldSet(groupId1, FW_FIELD_NETIF, 
                       (UINT32) publicIfName, publicIfUnit, 0, 0) == ERROR)
        {
        printf("IN-PUB: Failed to set netif\n");
        return ERROR;
        }     
    if (fwRuleFieldSet(groupId1, FW_FIELD_STATE, FW_CONN_RESPONDER,
                       FW_CONN_STATE_ESTABLISHED) == ERROR)
        {
        printf("IN-PUB: Failed to set state\n");
        return ERROR;
        }

    if (fwRuleFieldSet(groupId1, FW_FIELD_ACTION, FW_ACCEPT | FW_LOG) 
        == ERROR)
        {
        printf("IN-PUB: Failed to set action\n");
        return ERROR;
        }
    
    /* Group to allow ALL packets from private network */
    
    groupId2 = fwRuleGroupCreate(FW_IN_LOC, 
                                 "Packets from Private to Gateway",
                                  pktLogLen);
    if (groupId2 == NULL)
        {
        printf("IN-PRI: Can't create rule group\n");
        return ERROR;
        }
    if (fwRuleFieldSet(groupId2, FW_FIELD_NETIF, 
                       (UINT32) privateIfName, privateIfUnit, 0, 0) == ERROR)
        {
        printf("IN-PRI: Failed to set netif\n");
        return ERROR;
        } 
    if (fwRuleFieldSet(groupId2, FW_FIELD_ACTION, FW_ACCEPT) == ERROR)
        {
        printf("IN-PRI: Failed to set action\n");
        return ERROR;
        }
                        
    /* Group to allow ALL packets from Loopback interface */  
    
    groupId3 = fwRuleGroupCreate(FW_IN_LOC, 
                                 "Packets from Loopback Interface",
                                 pktLogLen);
    if (groupId3 == NULL)
        {
        printf("IN-LO: Can't create rule group\n");
        return ERROR;
        }
    if (fwRuleFieldSet(groupId3, FW_FIELD_NETIF, 
                       (UINT32) loIfName, loIfUnit, 0, 0) == ERROR)
        {
        printf("IN-LO: Failed to set netif\n");
        return ERROR;
        } 
    if (fwRuleFieldSet(groupId3, FW_FIELD_ACTION, FW_ACCEPT) == ERROR)
        {
        printf("IN-LO: Failed to set action\n");
        return ERROR;
        }          
            
    return OK;
    }
    

/***************************************************************************
*
* outRulesSet - Set firewall rules for all outgoing packets 
*
* RETURNS: OK (success), or ERROR (failure)
*/

LOCAL STATUS outRulesSet()
    {
    void * groupId;
    
    /*
     * Set the default action for ALL outgoing packets (to any
     * network interface) to accept for performance 
     */
    
    if (fwRuleFilterInstall(FW_OUT_LOC, FW_ACCEPT, NULL, NULL, NULL, 0)
        == ERROR)
        {
        printf("OUT: Failed to install Rule Filter!\n");
        return ERROR;
        }

    /*
     * Group to allow ALL packets outgoing to the public network 
     * and keep state
     */

    groupId = fwRuleGroupCreate(FW_OUT_LOC, 
                                "Outgoing Packets to Public Network",
                                pktLogLen);
    if (groupId == NULL)
        {
        printf("OUT-PUB: Can't create rule group\n");
        return ERROR;
        }
    if (fwRuleFieldSet(groupId, FW_FIELD_NETIF, 0, 0, 
                       (UINT32) publicIfName, publicIfUnit) == ERROR)
        {