@takodotid/circuit 0.16.0 → 0.17.0

package/dist/cli/index.js

@@ -2021,6 +2021,7 @@ function helpers(out, ctx) {
   }
 }
 function switchAcls(out, ctx) {
+  const each = (ports) => ports === undefined ? [undefined] : [ports].flat();
   for (const [port, settings] of Object.entries(ctx.ports)) {
     if (!settings.acl)
       continue;
@@ -2028,20 +2029,24 @@ function switchAcls(out, ctx) {
       const match = rule.match ?? {};
       const ipv6 = match.family === "ipv6" || [match.src, match.dst].some((address2) => address2 && familyOf(address2) === "ipv6");
       const address = (prefix) => prefix && !ipv6 ? dottedMask(prefix) : prefix;
-      out.add("/interface ethernet switch rule", command("add", {
-        comment: rule.description,
-        [ipv6 ? "dst-address6" : "dst-address"]: address(match.dst),
-        "dst-port": portList(match.dst_port),
-        "mac-protocol": ipv6 ? "ipv6" : "ip",
-        "new-dst-ports": rule.action === "drop" ? "" : undefined,
-        ports: ctx.name(port),
-        protocol: match.protocol,
-        rate: rule.rate && bitrate(rule.rate),
-        [ipv6 ? "src-address6" : "src-address"]: address(match.src),
-        "src-port": portList(match.src_port),
-        switch: "switch1",
-        "vlan-id": match.vlan && ctx.vlanId(match.vlan)
-      }));
+      for (const srcPort of each(match.src_port)) {
+        for (const dstPort of each(match.dst_port)) {
+          out.add("/interface ethernet switch rule", command("add", {
+            comment: rule.description,
+            [ipv6 ? "dst-address6" : "dst-address"]: address(match.dst),
+            "dst-port": dstPort,
+            "mac-protocol": ipv6 ? "ipv6" : "ip",
+            "new-dst-ports": rule.action === "drop" ? "" : undefined,
+            ports: ctx.name(port),
+            protocol: match.protocol,
+            rate: rule.rate && bitrate(rule.rate),
+            [ipv6 ? "src-address6" : "src-address"]: address(match.src),
+            "src-port": srcPort,
+            switch: "switch1",
+            "vlan-id": match.vlan && ctx.vlanId(match.vlan)
+          }));
+        }
+      }
     }
   }
 }

package/dist/presets/index.js

@@ -11,6 +11,40 @@ var antiSpoofing = (vlan, sources) => sources.map((src) => ({
   match: { vlan, src },
   action: "drop"
 }));
+var AMPLIFIERS = {
+  qotd: 17,
+  chargen: 19,
+  dns: 53,
+  portmap: 111,
+  ntp: 123,
+  netbios: 137,
+  snmp: 161,
+  cldap: 389,
+  slp: 427,
+  rip: 520,
+  "ms-sql": 1434,
+  ssdp: 1900,
+  ard: 3283,
+  "ws-discovery": 3702,
+  mdns: 5353,
+  coap: 5683,
+  ubiquiti: 10001,
+  memcached: 11211,
+  dvr: 37810
+};
+var antiAmplification = (destinations, trusted = []) => destinations.flatMap((dst) => [
+  ...trusted.map((src) => ({
+    description: `UDP to ${dst} from ${src}`,
+    match: { protocol: "udp", src, dst },
+    action: "accept"
+  })),
+  { description: `UDP fragments to ${dst}`, match: { protocol: "udp", dst, src_port: 0 }, action: "drop" },
+  ...Object.entries(AMPLIFIERS).map(([name, port]) => ({
+    description: `UDP to ${dst} from ${name}`,
+    match: { protocol: "udp", dst, src_port: port },
+    action: "drop"
+  }))
+]);
 var BAD_TCP_FLAGS = [
   ["FIN+SYN", ["fin", "syn"], []],
   ["SYN+RST", ["syn", "rst"], []],
@@ -337,6 +371,8 @@ export {
   bgpSanity,
   badTcpFlags,
   antiSpoofing,
+  antiAmplification,
   PRIVATE_RANGES,
-  MARTIANS
+  MARTIANS,
+  AMPLIFIERS
 };

package/dist/types/presets/index.d.ts

@@ -6,6 +6,32 @@ export declare const MARTIANS: readonly ["127.0.0.0/8", "169.254.0.0/16", "0.0.0
 export declare const PRIVATE_RANGES: readonly ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"];
 /** Hardware ACL rules dropping traffic arriving on a VLAN from sources that cannot be there: your own space, martians, private ranges. One rule per source. */
 export declare const antiSpoofing: <V extends string>(vlan: V, sources: readonly Prefix[]) => AclRule<V>[];
+/** UDP ports of services that answer a small request with a much larger reply, which attackers use to reflect floods at a victim. A reflected flood arrives from these ports. */
+export declare const AMPLIFIERS: {
+    readonly qotd: 17;
+    readonly chargen: 19;
+    readonly dns: 53;
+    readonly portmap: 111;
+    readonly ntp: 123;
+    readonly netbios: 137;
+    readonly snmp: 161;
+    readonly cldap: 389;
+    readonly slp: 427;
+    readonly rip: 520;
+    readonly "ms-sql": 1434;
+    readonly ssdp: 1900;
+    readonly ard: 3283;
+    readonly "ws-discovery": 3702;
+    readonly mdns: 5353;
+    readonly coap: 5683;
+    readonly ubiquiti: 10001;
+    readonly memcached: 11211;
+    readonly dvr: 37810;
+};
+/**
+ * Hardware ACL rules dropping reflected UDP floods toward `destinations`: replies from the ports in `AMPLIFIERS`, and the fragments after the first, which carry no port and which a switch chip reads as port 0. UDP from `trusted` sources, the resolvers and time servers your own hosts ask, is accepted before anything is dropped. Traffic that matches is dropped whole and everything else passes untouched, so nothing legitimate is slowed.
+ */
+export declare const antiAmplification: (destinations: readonly Prefix[], trusted?: readonly Prefix[]) => AclRule<never>[];
 /** Firewall rules dropping packets with a TCP flag combination no legitimate packet carries, for a forward chain. */
 export declare const badTcpFlags: () => FilterRule<never, never>[];
 /** The prefix lengths a BGP import accepts. */

package/dist/types/schema/firewall.d.ts

@@ -113,6 +113,6 @@ export type AclRule<V extends string> = {
     };
     /** What happens to a matching packet. */
     action: "accept" | "drop";
-    /** Accepted traffic above this rate is dropped. */
+    /** Accepted traffic above this rate is dropped. On RouterOS it did not limit traffic the CPU routes; see its TRAPS.md. */
     rate?: Rate;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@takodotid/circuit",
-    "version": "0.16.0",
+    "version": "0.17.0",
     "description": "Declarative, vendor-neutral network configuration: describe each device in TypeScript, and Circuit makes the device match. Alpha.",
     "keywords": [
         "network",

package/src/adapters/devices/routeros/TRAPS.md

@@ -14,6 +14,9 @@ Behaviour that looks like something else. Each one has been hit on a real device
 - `tcp-md5-key` set from the CLI has been seen discarded without an error, and a mismatch logs nothing. Confirm with `/tool sniffer quick port=179`.
 - Incoming GRE is subject to the input chain. Accept it before testing the tunnel.
 - Switch-chip rules have no address lists and no connection state. A drop is an empty `new-dst-ports`.
+- A switch-chip rule's `rate` did not limit traffic the CPU routes. On a CCR2216 on 7.23.5, under a 12 Gbps flood, a rule at `2G` and then at `100M` changed nothing that reached the CPU, while a drop with the same match left 3 Mbps. Drop what you can recognise instead of limiting it.
+- The switch chip reads a UDP fragment after the first as port 0. `src-port=0` drops the rest of a fragmented flood whose first fragments another rule dropped by port; without it they reach the CPU, which holds them waiting for a first fragment that never comes.
+- A switch-chip rule takes one port or a range, `1900-1901`; a list is refused. The render makes one rule for each port in a list.
 - With hardware offload on, routed traffic bypasses the forward chain entirely. `hardware_offload: false` on an interface is what makes the firewall apply to it, at the cost of CPU. The only proof of offload is the `H` flag on a route.
 - `/ip cloud ddns-enabled` cannot be turned off on 7.23.5.
 - `mac-server` and `mac-winbox` work at layer 2 and ignore the IP firewall; they are limited by interface list.

package/src/adapters/devices/routeros/render.ts

@@ -836,9 +836,11 @@ function helpers(out: Output, ctx: Context): void {
 }
 
 /**
- * ACLs run in the switch chip on the port traffic arrives on. The chip matches addresses with a dotted mask on IPv4, drops by forwarding to no port, and limits by rate.
+ * ACLs run in the switch chip on the port traffic arrives on. The chip matches addresses with a dotted mask on IPv4, drops by forwarding to no port, and limits by rate. A rule takes one port, so a list of ports becomes one rule for each.
  */
 function switchAcls(out: Output, ctx: Context): void {
+    const each = (ports: number | readonly number[] | undefined) => (ports === undefined ? [undefined] : [ports].flat());
+
     for (const [port, settings] of Object.entries(ctx.ports)) {
         if (!settings.acl) continue;
 
@@ -847,23 +849,27 @@ function switchAcls(out: Output, ctx: Context): void {
             const ipv6 = match.family === "ipv6" || [match.src, match.dst].some((address) => address && familyOf(address) === "ipv6");
             const address = (prefix: string | undefined) => (prefix && !ipv6 ? dottedMask(prefix) : prefix);
 
-            out.add(
-                "/interface ethernet switch rule",
-                command("add", {
-                    comment: rule.description,
-                    [ipv6 ? "dst-address6" : "dst-address"]: address(match.dst),
-                    "dst-port": portList(match.dst_port),
-                    "mac-protocol": ipv6 ? "ipv6" : "ip",
-                    "new-dst-ports": rule.action === "drop" ? "" : undefined,
-                    ports: ctx.name(port),
-                    protocol: match.protocol,
-                    rate: rule.rate && bitrate(rule.rate),
-                    [ipv6 ? "src-address6" : "src-address"]: address(match.src),
-                    "src-port": portList(match.src_port),
-                    switch: "switch1",
-                    "vlan-id": match.vlan && ctx.vlanId(match.vlan),
-                })
-            );
+            for (const srcPort of each(match.src_port)) {
+                for (const dstPort of each(match.dst_port)) {
+                    out.add(
+                        "/interface ethernet switch rule",
+                        command("add", {
+                            comment: rule.description,
+                            [ipv6 ? "dst-address6" : "dst-address"]: address(match.dst),
+                            "dst-port": dstPort,
+                            "mac-protocol": ipv6 ? "ipv6" : "ip",
+                            "new-dst-ports": rule.action === "drop" ? "" : undefined,
+                            ports: ctx.name(port),
+                            protocol: match.protocol,
+                            rate: rule.rate && bitrate(rule.rate),
+                            [ipv6 ? "src-address6" : "src-address"]: address(match.src),
+                            "src-port": srcPort,
+                            switch: "switch1",
+                            "vlan-id": match.vlan && ctx.vlanId(match.vlan),
+                        })
+                    );
+                }
+            }
         }
     }
 }

package/src/presets/index.ts

@@ -18,6 +18,47 @@ export const antiSpoofing = <V extends string>(vlan: V, sources: readonly Prefix
         action: "drop",
     }));
 
+/** UDP ports of services that answer a small request with a much larger reply, which attackers use to reflect floods at a victim. A reflected flood arrives from these ports. */
+export const AMPLIFIERS = {
+    qotd: 17,
+    chargen: 19,
+    dns: 53,
+    portmap: 111,
+    ntp: 123,
+    netbios: 137,
+    snmp: 161,
+    cldap: 389,
+    slp: 427,
+    rip: 520,
+    "ms-sql": 1434,
+    ssdp: 1900,
+    ard: 3283,
+    "ws-discovery": 3702,
+    mdns: 5353,
+    coap: 5683,
+    ubiquiti: 10001,
+    memcached: 11211,
+    dvr: 37810,
+} as const satisfies Record<string, number>;
+
+/**
+ * Hardware ACL rules dropping reflected UDP floods toward `destinations`: replies from the ports in `AMPLIFIERS`, and the fragments after the first, which carry no port and which a switch chip reads as port 0. UDP from `trusted` sources, the resolvers and time servers your own hosts ask, is accepted before anything is dropped. Traffic that matches is dropped whole and everything else passes untouched, so nothing legitimate is slowed.
+ */
+export const antiAmplification = (destinations: readonly Prefix[], trusted: readonly Prefix[] = []): AclRule<never>[] =>
+    destinations.flatMap((dst) => [
+        ...trusted.map((src): AclRule<never> => ({
+            description: `UDP to ${dst} from ${src}`,
+            match: { protocol: "udp", src, dst },
+            action: "accept",
+        })),
+        { description: `UDP fragments to ${dst}`, match: { protocol: "udp", dst, src_port: 0 }, action: "drop" },
+        ...Object.entries(AMPLIFIERS).map(([name, port]): AclRule<never> => ({
+            description: `UDP to ${dst} from ${name}`,
+            match: { protocol: "udp", dst, src_port: port },
+            action: "drop",
+        })),
+    ]);
+
 /** TCP flag combinations no legitimate packet carries: name, flags set, flags unset. */
 const BAD_TCP_FLAGS = [
     ["FIN+SYN", ["fin", "syn"], []],

package/src/schema/firewall.ts

@@ -123,6 +123,6 @@ export type AclRule<V extends string> = {
     };
     /** What happens to a matching packet. */
     action: "accept" | "drop";
-    /** Accepted traffic above this rate is dropped. */
+    /** Accepted traffic above this rate is dropped. On RouterOS it did not limit traffic the CPU routes; see its TRAPS.md. */
     rate?: Rate;
 };