| 374 | } |
| 375 | |
| 376 | std::string FirewallController::buildPfConf(const FirewallConfig &config, const std::string &disallowedDnsDef, const std::vector<std::string> &vpnTrafficRulesText) |
| 377 | { |
| 378 | std::string pf; |
| 379 | pf += "# Automatically generated by " WS_PRODUCT_NAME ". Any manual change will be overridden.\n"; |
| 380 | |
| 381 | // general options |
| 382 | pf += "set block-policy drop\n"; |
| 383 | pf += "set fingerprints '/etc/pf.os'\n"; |
| 384 | pf += "set skip on lo0\n"; |
| 385 | |
| 386 | // Apple anchor |
| 387 | pf += "scrub-anchor \"com.apple/*\"\n"; |
| 388 | pf += "nat-anchor \"com.apple/*\"\n"; |
| 389 | pf += "rdr-anchor \"com.apple/*\"\n"; |
| 390 | pf += "dummynet-anchor \"com.apple/*\"\n"; |
| 391 | pf += "anchor \"com.apple/*\"\n"; |
| 392 | pf += "load anchor \"com.apple\" from \"/etc/pf.anchors/com.apple\"\n"; |
| 393 | |
| 394 | // skip awdl and p2p interfaces (awdl Apple Wireless Direct Link and p2p related to AWDL features) |
| 395 | for (const auto &iface : getAwdlP2pInterfaces()) { |
| 396 | pf += "pass quick on " + iface + "\n"; |
| 397 | } |
| 398 | |
| 399 | // block malformed packets |
| 400 | pf += "block in quick from no-route to any\n"; |
| 401 | pf += "block in quick from urpf-failed\n"; |
| 402 | |
| 403 | // block inbound icmp echo requests |
| 404 | pf += "pass proto icmp\n"; |
| 405 | pf += "block in quick inet proto icmp all icmp-type echoreq\n"; |
| 406 | |
| 407 | // always allow DHCP |
| 408 | pf += "pass out quick proto {tcp, udp} from any port {68} to any port {67}\n"; |
| 409 | pf += "pass in quick proto {tcp, udp} from any port {67} to any port {68}\n"; |
| 410 | pf += "pass out quick inet6 proto udp from any to any port {546}\n"; |
| 411 | pf += "pass in quick inet6 proto udp from any to any port {547}\n"; |
| 412 | |
| 413 | // always allow igmp |
| 414 | pf += "pass quick proto igmp allow-opts\n"; |
| 415 | |
| 416 | // always allow esp/gre |
| 417 | pf += "pass quick proto {esp, gre} from any to any\n"; |
| 418 | |
| 419 | // block everything |
| 420 | pf += "block all\n"; |
| 421 | |
| 422 | // add app rules |
| 423 | pf += ipsTableDef(config.allowedIps) + "\n"; |
| 424 | |
| 425 | pf += "pass out quick inet from any to <" WS_PRODUCT_NAME_LOWER "_ips> no state\n"; |
| 426 | pf += "pass in quick inet from <" WS_PRODUCT_NAME_LOWER "_ips> to any no state\n"; |
| 427 | |
| 428 | // this table is filled in by the helper (loadDnsTable) |
| 429 | pf += "table <" WS_PRODUCT_NAME_LOWER "_dns> persist\n"; |
| 430 | // Allow VPN DNS, disallow other DNS |
| 431 | pf += "pass out quick proto udp from any to <" WS_PRODUCT_NAME_LOWER "_dns> port 53\n"; |
| 432 | pf += "pass in quick proto udp from <" WS_PRODUCT_NAME_LOWER "_dns> port 53 to any\n"; |
| 433 |
nothing calls this directly
no test coverage detected