UFW easy feature additions request

[Stephen T Satchell]

ufw 0.36

Recommendations are delimited by "=="
==

Add parameter PUBLIC=<interface> to /etc/ufw/uwf.conf

add "ufw-user-input-broadcast", and add syntax to direct rules to
one of these two chains.

:ufw-before-input-broadcast - [0:0]
-A INPUT -m addrtype --dst-type BROADCAST -j ufw-user-input-broadcast
-A INPUT -m addrtype --dst-type UNICAST -j ufw-user-input

Add "broadcast=yes" to parser for files in /etc/ufw/applications.d
(so far, I only see dhcpd needing this flag)

REASON: make it easier to define rules only for an Internet-facing ("public") interface; make it easier to block inbound amplification attacks on common ports like http/UDP, ping/ICMP, domain/UDP and ntp/UDP, while still allowing dhcpd/UDP broadcast. Documentation can include in its examples how to limit dhcpd to local interfaces.
==

Add TCP flag filtering, either standard or as an option:
:ufw-test-tcp-flags - [0:0]
-A INPUT -i PUBLIC -m conntrack -ctstate NEW -m tcp -p tcp -j ufw-test-tcp-flags
-A ufw-test-tcp-flags --tcp-flags ALL NONE -j DROP --comment>ALL-NONE
-A ufw-test-tcp-flags --tcp-flags ALL ALL -j DROP --comment>ALL-ALL
-A ufw-test-tcp-flags --tcp-flags SYN,FIN SYN,FIN -j DROP --comment>SYN,FIN-SYN,FIN
-A ufw-test-tcp-flags --tcp-flags SYN,RST SYN,RST -j DROP --comment>SYN,RST-SYN,RST
-A ufw-test-tcp-flags --tcp-flags FIN,RST FIN,RST -j DROP --comment>FIN,RST-FIN,RST
-A ufw-test-tcp-flags --tcp-flags ACK,FIN FIN -j DROP --comment>ACK,FIN-FIN
-A ufw-test-tcp-flags --tcp-flags ACK,PSH PSH -j DROP --comment>ACK,PSH-PSH
-A ufw-test-tcp-flags tcp --tcp-flags ACK,URG URG -j DROP --comment>ACK,URG-URG

REASON: limits certain forms of pen (penetration) testing as well as certain denial of service attacks by ne'er-do-wells.
==

In before.rules, add rate-limiting to ping:
-A ufw-before-input -m -p icmp --icmp-type echo-request -m limit --limit 3/s -j ACCEPT

REASON: reduces denial of service attacks both from the local LAN and from the public Internet.
===

Documentation: leave short note encouraging people to use sysctl.conf "rd_filter=2" for interfaces running on the public internet, and include RFC 1918 et seq black hole routes in the Linux routing table. FYI, I've attached a YAML file for netplan(5,8) that installs these blackhole routes; need to discuss how to make these available to everyone running Ubuntu 20.04 server edition at least. I also have a version that runs under NetworkManager, but it's only tested in CentOS -- I need to test it on Ubuntu 20.04 desktop edition.

REASON: limits the CPU load caused by certain DDoS attacks that use unrouteable source addresses.

[Stephen T Satchell (satch89521)]

In reviewing my script to add blackhole routes for NetworkManager, it's required that the script know what interface the blackhole routes need to be associated with. This makes it difficult to use the Package Manager to distribute the script for NetworkManager. For netplan, the package will need to select an interface to which to associate the blackhole routes.

It's possible in both netplan and NetworkManager that the blackhole routes can be associated with the "lo" interface, which gets around this problem. If that works, then the blackhole route data can be packaged separately, say "netplan-rfc1918" and "NetworkManager-rfc1918"

[Stephen T Satchell (satch89521)]

Good news, this works:
network:
  version: 2
  ethernets:
    lo:
      routes:
        - to: 10.0.0.0/8
          via: 0.0.0.0
          metric: 240
          type: blackhole
...

[Jamie Strandboge (jdstrand)]

Thanks for filing a bug. Normally it would be good to do feature requests as separate bugs, but I'll answer here. As a preface regarding the design, the 'ufw' command is meant to 'provide an easy to use interface for the user' and its primarily aimed at bastion hosts (leaf servers, laptops, containers, vms, etc). It has some support for managing a routing firewall, but it is full-featured. The ufw framework does support this sort of thing through various means so the admin can add as much fine-grained, low-level functionality as is desired and for using ufw as a full routing firewall (see 'man ufw-framework' for details).

> add "ufw-user-input-broadcast", and add syntax to direct rules to one of these two chains.

This is an interesting idea to make working with sorts of rules easier. I've filed https://bugs.launchpad.net/ufw/+bug/1944058 to track this.

> Add TCP flag filtering, either standard or as an option:

Considering the 'ufw' command's design objectives (see above), this falls outside of its design (but again, interested parties can still use the 'ufw-framework' for this sort of thing.

> In before.rules, add rate-limiting to ping

I've filed https://bugs.launchpad.net/ufw/+bug/1944059 for this.

>Documentation: leave short note encouraging people to use sysctl.conf "rd_filter=2" ...

I'm going to assume you meant 'rp_filter' here. This is going to be addressed as part of the fix for https://bugs.launchpad.net/ufw/+bug/1782969, which is in progress.

Since there are (now) other bugs that address these issues, I'm going to close this bug as Invalid (due to lack of a better status name in Launchpad).

[Jamie Strandboge (jdstrand)]

>> Add TCP flag filtering, either standard or as an option:

> Considering the 'ufw' command's design objectives (see above), this falls outside of its design (but again, interested parties can still use the 'ufw-framework' for this sort of thing.

I read this more carefully and I think I'll re-open your dupe'd https://bugs.launchpad.net/ufw/+bug/1925248 instead.