Add nobogons interface option

git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@1197 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb

Shorewall2/bogons

@@ -0,0 +1,60 @@
+#
+# Shorewall 2.0-- Bogons File
+#
+# /etc/shorewall/bogons
+#
+# Lists the subnetworks that are blocked by the 'nobogons' interface option.
+#
+# The default list includes those those ip ADDRESSES listed
+# as 'reserved' by the IANA, the DHCP Autoconfig class B, and the class C
+# reserved for use in documentation and examples.
+#
+# Columns are:
+#
+# 	SUBNET		The subnet (host addresses also allowed)
+#	TARGET		Where to send packets to/from this subnet
+#			RETURN	- let the packet be processed normally
+#			DROP	- silently drop the packet
+#			logdrop - log then drop
+#
+###############################################################################
+#SUBNET			TARGET
+255.255.255.255		RETURN		# We need to allow limited broadcast
+169.254.0.0/16		DROP		# DHCP autoconfig
+192.0.2.0/24		logdrop		# Example addresses (RFC 3330)
+#
+# The following are generated with the help of the Python program found at:
+#
+#	http://www.shorewall.net/pub/shorewall/contrib/iana_reserved/
+#
+# The program was contributed by Andy Wiggin
+#
+0.0.0.0/7		logdrop		# Reserved
+2.0.0.0/8		logdrop		# Reserved
+5.0.0.0/8		logdrop		# Reserved
+7.0.0.0/8		logdrop		# Reserved
+23.0.0.0/8		logdrop		# Reserved
+27.0.0.0/8		logdrop		# Reserved
+31.0.0.0/8		logdrop		# Reserved
+36.0.0.0/7		logdrop		# Reserved
+39.0.0.0/8		logdrop		# Reserved
+41.0.0.0/8		logdrop		# Reserved
+42.0.0.0/8		logdrop		# Reserved
+49.0.0.0/8		logdrop		# JTC - Returned to IANA Mar 98
+50.0.0.0/8		logdrop		# JTC - Returned to IANA Mar 98
+58.0.0.0/7		logdrop		# Reserved
+70.0.0.0/7		logdrop		# Reserved
+72.0.0.0/5		logdrop		# Reserved
+85.0.0.0/8		logdrop		# Reserved
+86.0.0.0/7		logdrop		# Reserved
+88.0.0.0/5		logdrop		# Reserved
+96.0.0.0/3		logdrop		# Reserved
+127.0.0.0/8		logdrop		# Loopback
+197.0.0.0/8		logdrop		# Reserved
+198.18.0.0/15		logdrop		# Reserved
+223.0.0.0/8		logdrop		# Reserved - Returned by APNIC in 2003
+240.0.0.0/4		logdrop		# Reserved
+#
+# End of generated entries
+#
+#LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE

Shorewall2/fallback.sh

@@ -116,6 +116,8 @@ restore_file /etc/shorewall/whitelist
 restore_file /etc/shorewall/rfc1918
 restore_file /usr/share/shorewall/rfc1918
 
+restore_file /usr/share/shorewall/bogons
+
 restore_file /etc/shorewall/init
 
 restore_file /etc/shorewall/start

Shorewall2/firewall

@@ -659,7 +659,7 @@ validate_interfaces_file() {
 
 	for option in $options; do
 	    case $option in
-		dhcp|norfc1918|tcpflags|newnotsyn|arp_filter|routefilter|blacklist|proxyarp|maclist|nosmurfs|-)
+		dhcp|norfc1918|nobogons|tcpflags|newnotsyn|arp_filter|routefilter|blacklist|proxyarp|maclist|nosmurfs|-)
 		    ;;
 		dropunclean|logunclean)
 		    if [ -z "$found_obsolete_option" ]; then
@@ -4655,6 +4655,46 @@ add_common_rules() {
 	    [ -n "$MANGLE_ENABLED" -a -z "$CONNTRACK_MATCH" ] && \
 		run_iptables -t mangle -A PREROUTING -m state --state NEW -i $interface -j man1918
 	done
+    fi
+    #
+    # Bogons
+    #
+    nobogon_interfaces="$(find_interfaces_by_option norfc1918)"
+    
+    if [ -n "$nobogon_interfaces" ]; then
+	echo "Enabling Bogon Filtering"
+
+	strip_file bogons
+
+	createchain nobogons no
+
+	createchain bogons no
+	
+	log_rule $BOGON_LOG_LEVEL bogons DROP
+	
+	run_iptables -A bogons -j DROP
+
+	while read subnet target; do
+	    case $target in
+		logdrop)
+		    target=bogons
+		    ;;
+		DROP|RETURN)
+		    ;;
+		*)
+		    fatal_error "Invalid target ($target) for $subnet"
+		    ;;
+	    esac
+
+	    run_iptables2 -A nobogons -s $subnet -j $target
+
+	done < $TMP_DIR/bogons
+
+	for interface in $nobogon_interfaces; do
+	    for chain in $(first_chains $interface); do
+		run_iptables -A $chain -m state --state NEW -j nobogons
+	    done
+	done
 
     fi
 
@@ -5599,6 +5639,7 @@ do_initialize() {
     TCP_FLAGS_DISPOSITION=
     TCP_FLAGS_LOG_LEVEL=
     RFC1918_LOG_LEVEL=
+    BOGON_LOG_LEVEL=
     MARK_IN_FORWARD_CHAIN=
     SHARED_DIR=/usr/share/shorewall
     FUNCTIONS=
@@ -5732,6 +5773,8 @@ do_initialize() {
     fi
 
     [ -z "$RFC1918_LOG_LEVEL" ] && RFC1918_LOG_LEVEL=info
+    [ -z "$BOGON_LOG_LEVEL" ]   && BOGON_LOG_LEVEL=info
+
     MARK_IN_FORWARD_CHAIN=$(added_param_value_no MARK_IN_FORWARD_CHAIN $MARK_IN_FORWARD_CHAIN)
     [ -n "$MARK_IN_FORWARD_CHAIN" ] && marking_chain=tcfor || marking_chain=tcpre
     if [ -n "$TC_ENABLED" ]; then

Shorewall2/install.sh

@@ -384,6 +384,12 @@ install_file_with_backup rfc1918 ${PREFIX}/usr/share/shorewall/rfc1918 0600
 echo
 echo "RFC 1918 file installed as ${PREFIX}/etc/shorewall/rfc1918"
 #
+# Install the bogons file
+#
+install_file_with_backup bogons ${PREFIX}/usr/share/shorewall/bogons 0600
+echo
+echo "Bogon file installed as ${PREFIX}/etc/shorewall/bogons"
+#
 # Install the init file
 #
 if [ -f ${PREFIX}/etc/shorewall/init ]; then

Shorewall2/rfc1918

@@ -5,9 +5,7 @@
 #
 # Lists the subnetworks that are blocked by the 'norfc1918' interface option.
 #
-# The default list includes those IP addresses listed in RFC 1918, those listed
+# The default list includes those IP addresses listed in RFC 1918.
-# as 'reserved' by the IANA, the DHCP Autoconfig class B, and the class C
-# reserved for use in documentation and examples.
 #
 # Columns are:
 #
@@ -19,45 +17,7 @@
 #
 ###############################################################################
 #SUBNET			TARGET
-255.255.255.255		RETURN		# We need to allow limited broadcast
-169.254.0.0/16		DROP		# DHCP autoconfig
 172.16.0.0/12		logdrop		# RFC 1918
-192.0.2.0/24		logdrop		# Example addresses (RFC 3330)
 192.168.0.0/16		logdrop		# RFC 1918
-#
+10.0.0.0/8		logdrop		# RFC 1918
-# The following are generated with the help of the Python program found at:
-#
-#	http://www.shorewall.net/pub/shorewall/contrib/iana_reserved/
-#
-# The program was contributed by Andy Wiggin
-#
-0.0.0.0/7		logdrop		# Reserved
-2.0.0.0/8		logdrop		# Reserved
-5.0.0.0/8		logdrop		# Reserved
-7.0.0.0/8		logdrop		# Reserved
-10.0.0.0/8		logdrop		# Reserved
-23.0.0.0/8		logdrop		# Reserved
-27.0.0.0/8		logdrop		# Reserved
-31.0.0.0/8		logdrop		# Reserved
-36.0.0.0/7		logdrop		# Reserved
-39.0.0.0/8		logdrop		# Reserved
-41.0.0.0/8		logdrop		# Reserved
-42.0.0.0/8		logdrop		# Reserved
-49.0.0.0/8		logdrop		# JTC - Returned to IANA Mar 98
-50.0.0.0/8		logdrop		# JTC - Returned to IANA Mar 98
-58.0.0.0/7		logdrop		# Reserved
-70.0.0.0/7		logdrop		# Reserved
-72.0.0.0/5		logdrop		# Reserved
-85.0.0.0/8		logdrop		# Reserved
-86.0.0.0/7		logdrop		# Reserved
-88.0.0.0/5		logdrop		# Reserved
-96.0.0.0/3		logdrop		# Reserved
-127.0.0.0/8		logdrop		# Loopback
-197.0.0.0/8		logdrop		# Reserved
-198.18.0.0/15		logdrop		# Reserved
-223.0.0.0/8		logdrop		# Reserved - Returned by APNIC in 2003
-240.0.0.0/4		logdrop		# Reserved
-#
-# End of generated entries
-#
 #LAST LINE -- ADD YOUR ENTRIES BEFORE THIS ONE -- DO NOT REMOVE

Shorewall2/shorewall.spec

@@ -133,10 +133,13 @@ fi
 %attr(0544,root,root) /usr/share/shorewall/firewall
 %attr(0544,root,root) /usr/share/shorewall/help
 %attr(0600,root,root) /usr/share/shorewall/rfc1918
+%attr(0600,root,root) /usr/share/shorewall/bogons
 
 %doc COPYING INSTALL changelog.txt releasenotes.txt tunnel
 
 %changelog
+* Web Mar 17 2004 Tom Eastep <tom@shorewall.net>
+- Add bogons file
 * Sat Mar 13 2004 Tom Eastep <tom@shorewall.net>
 - Update for 2.0.0 Final
 * Sat Mar 06 2004 Tom Eastep <tom@shorewall.net>