forked from extern/shorewall_code
Add copyright notices to all files; move rest of rule generation to Rules module
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@5549 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep
parent
f6f45a792e
commit
40535515d5
@ -1,3 +1,27 @@
|
||||
#
|
||||
# Shorewall 3.9 -- /usr/share/shorewall/Shorewall/Accounting.pm
|
||||
#
|
||||
# This program is under GPL [http://www.gnu.org/copyleft/gpl.htm]
|
||||
#
|
||||
# (c) 2007 - Tom Eastep (teastep@shorewall.net)
|
||||
#
|
||||
# Complete documentation is available at http://shorewall.net
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of Version 2 of the GNU General Public License
|
||||
# as published by the Free Software Foundation.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA
|
||||
#
|
||||
#
|
||||
|
||||
package Shorewall::Accounting;
|
||||
require Exporter;
|
||||
use Shorewall::Common;
|
||||
|
||||
@ -1,3 +1,26 @@
|
||||
#
|
||||
# Shorewall 3.9 -- /usr/share/shorewall/Shorewall/Actions.pm
|
||||
#
|
||||
# This program is under GPL [http://www.gnu.org/copyleft/gpl.htm]
|
||||
#
|
||||
# (c) 2007 - Tom Eastep (teastep@shorewall.net)
|
||||
#
|
||||
# Complete documentation is available at http://shorewall.net
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of Version 2 of the GNU General Public License
|
||||
# as published by the Free Software Foundation.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA
|
||||
#
|
||||
#
|
||||
package Shorewall::Actions;
|
||||
require Exporter;
|
||||
use Shorewall::Common;
|
||||
|
||||
@ -1,3 +1,26 @@
|
||||
#
|
||||
# Shorewall 3.9 -- /usr/share/shorewall/Shorewall/Chains.pm
|
||||
#
|
||||
# This program is under GPL [http://www.gnu.org/copyleft/gpl.htm]
|
||||
#
|
||||
# (c) 2007 - Tom Eastep (teastep@shorewall.net)
|
||||
#
|
||||
# Complete documentation is available at http://shorewall.net
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of Version 2 of the GNU General Public License
|
||||
# as published by the Free Software Foundation.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA
|
||||
#
|
||||
#
|
||||
package Shorewall::Chains;
|
||||
require Exporter;
|
||||
|
||||
|
||||
@ -1,3 +1,26 @@
|
||||
#
|
||||
# Shorewall 3.9 -- /usr/share/shorewall/Shorewall/Common.pm
|
||||
#
|
||||
# This program is under GPL [http://www.gnu.org/copyleft/gpl.htm]
|
||||
#
|
||||
# (c) 2007 - Tom Eastep (teastep@shorewall.net)
|
||||
#
|
||||
# Complete documentation is available at http://shorewall.net
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of Version 2 of the GNU General Public License
|
||||
# as published by the Free Software Foundation.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA
|
||||
#
|
||||
#
|
||||
package Shorewall::Common;
|
||||
require Exporter;
|
||||
use File::Basename;
|
||||
|
||||
@ -1,3 +1,26 @@
|
||||
#
|
||||
# Shorewall 3.9 -- /usr/share/shorewall/Shorewall/Config.pm
|
||||
#
|
||||
# This program is under GPL [http://www.gnu.org/copyleft/gpl.htm]
|
||||
#
|
||||
# (c) 2007 - Tom Eastep (teastep@shorewall.net)
|
||||
#
|
||||
# Complete documentation is available at http://shorewall.net
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of Version 2 of the GNU General Public License
|
||||
# as published by the Free Software Foundation.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA
|
||||
#
|
||||
#
|
||||
package Shorewall::Config;
|
||||
|
||||
use strict;
|
||||
|
||||
@ -1,3 +1,26 @@
|
||||
#
|
||||
# Shorewall 3.9 -- /usr/share/shorewall/Shorewall/Hosts.pm
|
||||
#
|
||||
# This program is under GPL [http://www.gnu.org/copyleft/gpl.htm]
|
||||
#
|
||||
# (c) 2007 - Tom Eastep (teastep@shorewall.net)
|
||||
#
|
||||
# Complete documentation is available at http://shorewall.net
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of Version 2 of the GNU General Public License
|
||||
# as published by the Free Software Foundation.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA
|
||||
#
|
||||
#
|
||||
package Shorewall::Hosts;
|
||||
require Exporter;
|
||||
use Shorewall::Common;
|
||||
|
||||
@ -1,3 +1,26 @@
|
||||
#
|
||||
# Shorewall 3.9 -- /usr/share/shorewall/Shorewall/Interfaces.pm
|
||||
#
|
||||
# This program is under GPL [http://www.gnu.org/copyleft/gpl.htm]
|
||||
#
|
||||
# (c) 2007 - Tom Eastep (teastep@shorewall.net)
|
||||
#
|
||||
# Complete documentation is available at http://shorewall.net
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of Version 2 of the GNU General Public License
|
||||
# as published by the Free Software Foundation.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA
|
||||
#
|
||||
#
|
||||
package Shorewall::Interfaces;
|
||||
require Exporter;
|
||||
use Shorewall::Common;
|
||||
|
||||
@ -1,3 +1,26 @@
|
||||
#
|
||||
# Shorewall 3.9 -- /usr/share/shorewall/Shorewall/Macros.pm
|
||||
#
|
||||
# This program is under GPL [http://www.gnu.org/copyleft/gpl.htm]
|
||||
#
|
||||
# (c) 2007 - Tom Eastep (teastep@shorewall.net)
|
||||
#
|
||||
# Complete documentation is available at http://shorewall.net
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of Version 2 of the GNU General Public License
|
||||
# as published by the Free Software Foundation.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA
|
||||
#
|
||||
#
|
||||
package Shorewall::Macros;
|
||||
require Exporter;
|
||||
use Shorewall::Common;
|
||||
|
||||
@ -1,3 +1,26 @@
|
||||
#
|
||||
# Shorewall 3.9 -- /usr/share/shorewall/Shorewall/Nat.pm
|
||||
#
|
||||
# This program is under GPL [http://www.gnu.org/copyleft/gpl.htm]
|
||||
#
|
||||
# (c) 2007 - Tom Eastep (teastep@shorewall.net)
|
||||
#
|
||||
# Complete documentation is available at http://shorewall.net
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of Version 2 of the GNU General Public License
|
||||
# as published by the Free Software Foundation.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA
|
||||
#
|
||||
#
|
||||
package Shorewall::Nat;
|
||||
require Exporter;
|
||||
use Shorewall::Common;
|
||||
|
||||
@ -1,3 +1,26 @@
|
||||
#
|
||||
# Shorewall 3.9 -- /usr/share/shorewall/Shorewall/Policy.pm
|
||||
#
|
||||
# This program is under GPL [http://www.gnu.org/copyleft/gpl.htm]
|
||||
#
|
||||
# (c) 2007 - Tom Eastep (teastep@shorewall.net)
|
||||
#
|
||||
# Complete documentation is available at http://shorewall.net
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of Version 2 of the GNU General Public License
|
||||
# as published by the Free Software Foundation.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA
|
||||
#
|
||||
#
|
||||
package Shorewall::Policy;
|
||||
require Exporter;
|
||||
use Shorewall::Common;
|
||||
|
||||
@ -1,3 +1,26 @@
|
||||
#
|
||||
# Shorewall 3.9 -- /usr/share/shorewall/Shorewall/Providers.pm
|
||||
#
|
||||
# This program is under GPL [http://www.gnu.org/copyleft/gpl.htm]
|
||||
#
|
||||
# (c) 2007 - Tom Eastep (teastep@shorewall.net)
|
||||
#
|
||||
# Complete documentation is available at http://shorewall.net
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of Version 2 of the GNU General Public License
|
||||
# as published by the Free Software Foundation.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA
|
||||
#
|
||||
#
|
||||
package Shorewall::Providers;
|
||||
require Exporter;
|
||||
use Shorewall::Common;
|
||||
|
||||
@ -1,18 +1,42 @@
|
||||
#
|
||||
# Shorewall 3.9 -- /usr/share/shorewall/Shorewall/Rules.pm
|
||||
#
|
||||
# This program is under GPL [http://www.gnu.org/copyleft/gpl.htm]
|
||||
#
|
||||
# (c) 2007 - Tom Eastep (teastep@shorewall.net)
|
||||
#
|
||||
# Complete documentation is available at http://shorewall.net
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of Version 2 of the GNU General Public License
|
||||
# as published by the Free Software Foundation.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA
|
||||
#
|
||||
#
|
||||
package Shorewall::Rules;
|
||||
require Exporter;
|
||||
use Shorewall::Common;
|
||||
use Shorewall::Config;
|
||||
use Shorewall::Zones;
|
||||
use Shorewall::Interfaces;
|
||||
use Shorewall::Chains;
|
||||
use Shorewall::Hosts;
|
||||
use Shorewall::Actions;
|
||||
use Shorewall::Macros;
|
||||
use Shorewall::Interfaces;
|
||||
use Shorewall::Policy;
|
||||
|
||||
use strict;
|
||||
|
||||
our @ISA = qw(Exporter);
|
||||
our @EXPORT = qw( process_rules generate_matrix );
|
||||
our @EXPORT = qw( add_common_rules setup_mac_lists process_rules generate_matrix );
|
||||
our @EXPORT_OK = qw( process_rule process_rule1 );
|
||||
our @VERSION = 1.00;
|
||||
|
||||
@ -21,6 +45,470 @@ our @VERSION = 1.00;
|
||||
#
|
||||
my $sectioned = 0;
|
||||
|
||||
sub process_tos() {
|
||||
my $chain = 'pretos';
|
||||
my $stdchain = 'PREROUTING';
|
||||
|
||||
if ( -s "$ENV{TMP_DIR}/tos" ) {
|
||||
progress_message2 'Setting up TOS...';
|
||||
|
||||
my $pretosref = new_chain 'mangle' , 'pretos';
|
||||
my $outtosref = new_chain 'mangle' , 'outtos';
|
||||
|
||||
open TOS, "$ENV{TMP_DIR}/tos" or fatal_error "Unable to open stripped tos file: $!";
|
||||
|
||||
while ( $line = <TOS> ) {
|
||||
|
||||
chomp $line;
|
||||
$line =~ s/\s+/ /g;
|
||||
|
||||
my ($source, $dest, $proto, $sports, $ports, $extra) = split /\s+/, $line;
|
||||
|
||||
fatal_error "Invalid tos file entry: \"$line\"" if $extra;
|
||||
}
|
||||
|
||||
close TOS;
|
||||
|
||||
$comment = '';
|
||||
}
|
||||
}
|
||||
|
||||
sub add_rule_pair( $$$$ ) {
|
||||
my ($chainref , $predicate , $target , $level ) = @_;
|
||||
|
||||
log_rule $level, $chainref, $target, , $predicate, if $level;
|
||||
add_rule $chainref , "${predicate}-j $target";
|
||||
}
|
||||
|
||||
sub setup_rfc1918_filteration( $ ) {
|
||||
|
||||
my $listref = $_[0];
|
||||
my $norfc1918ref = new_standard_chain 'norfc1918';
|
||||
my $rfc1918ref = new_standard_chain 'rfc1918';
|
||||
my $chainref = $norfc1918ref;
|
||||
|
||||
log_rule $config{RFC1918_LOG_LEVEL} , $rfc1918ref , 'DROP' , '';
|
||||
|
||||
add_rule $rfc1918ref , '-j DROP';
|
||||
|
||||
if ( $config{RFC1918_STRICT} ) {
|
||||
$chainref = new_standard_chain 'rfc1918d';
|
||||
}
|
||||
|
||||
open RFC, "$ENV{TMP_DIR}/rfc1918" or fatal_error "Unable to open stripped rfc1918 file: $!";
|
||||
|
||||
while ( $line = <RFC> ) {
|
||||
chomp $line;
|
||||
$line =~ s/\s+/ /g;
|
||||
|
||||
my ( $networks, $target, $extra ) = split /\s+/, $line;
|
||||
|
||||
my $s_target;
|
||||
|
||||
if ( $target eq 'logdrop' ) {
|
||||
$target = 'rfc1918';
|
||||
$s_target = 'rfc1918';
|
||||
} elsif ( $target eq 'DROP' ) {
|
||||
$s_target = 'DROP';
|
||||
} elsif ( $target eq 'RETURN' ) {
|
||||
$s_target = $config{RFC1918_LOG_LEVEL} ? 'rfc1918d' : 'RETURN';
|
||||
} else {
|
||||
fatal_error "Invalid target ($target) for $networks";
|
||||
}
|
||||
|
||||
for my $network ( split /,/, $networks ) {
|
||||
add_rule $norfc1918ref , match_source_net( $network ) . "-j $s_target";
|
||||
add_rule $chainref , match_orig_dest( $network ) . "-j $target" ;
|
||||
}
|
||||
}
|
||||
|
||||
close RFC;
|
||||
|
||||
add_rule $norfc1918ref , '-j rfc1918d' if $config{RFC1918_STRICT};
|
||||
|
||||
for my $hostref ( @$listref ) {
|
||||
my $interface = $hostref->[0];
|
||||
my $ipsec = $hostref->[1];
|
||||
my $policy = $capabilities{POLICY_MATCH} ? "-m policy --pol $ipsec --dir in " : '';
|
||||
for my $chain ( @{first_chains $interface}) {
|
||||
add_rule $filter_table->{$chain} , '-m state --state NEW ' . match_source_net( $hostref->[2]) . "${policy}-j norfc1918";
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
sub setup_syn_flood_chains() {
|
||||
for my $chainref ( @policy_chains ) {
|
||||
my $limit = $chainref->{synparams};
|
||||
if ( $limit ) {
|
||||
my $level = $chainref->{loglevel};
|
||||
( $limit, my $burst ) = split ':', $limit;
|
||||
$burst = $burst ? "--limit-burst $burst " : '';
|
||||
my $synchainref = new_chain 'filter' , syn_chain $chainref->{name};
|
||||
add_rule $synchainref , "-m limit --limit $limit ${burst}-j RETURN";
|
||||
log_rule_limit $level , $synchainref , $chainref->{name} , 'DROP', '-m limit --limit 5/min --limit-burst 5' , '' , 'add' , '' if $level;
|
||||
add_rule $synchainref, '-j DROP';
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
sub setup_blacklist() {
|
||||
|
||||
my ( $level, $disposition ) = @config{'BLACKLIST_LOGLEVEL', 'BLACKLIST_DISPOSITION' };
|
||||
|
||||
progress_message2 " Setting up Blacklist...";
|
||||
|
||||
open BL, "$ENV{TMP_DIR}/blacklist" or fatal_error "Unable to open stripped blacklist file: $!";
|
||||
|
||||
progress_message( " Processing " . find_file 'blacklist' . '...' );
|
||||
|
||||
while ( $line = <BL> ) {
|
||||
|
||||
chomp $line;
|
||||
$line =~ s/\s+/ /g;
|
||||
|
||||
my ( $networks, $protocol, $ports , $extra ) = split /\s+/, $line;
|
||||
|
||||
fatal_error "Invalid blacklist entry: \"$line\"" if $extra;
|
||||
|
||||
expand_rule
|
||||
ensure_filter_chain( 'blacklst' , 0 ) ,
|
||||
do_proto( $protocol , $ports, '' ) ,
|
||||
$networks ,
|
||||
'' ,
|
||||
'' ,
|
||||
'-j ' . ($disposition eq 'REJECT' ? 'reject' : $disposition),
|
||||
$level ,
|
||||
$disposition ,
|
||||
'';
|
||||
|
||||
progress_message " \"$line\" added to blacklist";
|
||||
}
|
||||
|
||||
close BL;
|
||||
|
||||
my $hosts = find_hosts_by_option 'blacklist';
|
||||
|
||||
my $state = $config{BLACKLISTNEWONLY} ? '-m state --state NEW,INVALID ' : '';
|
||||
|
||||
for my $hostref ( @$hosts ) {
|
||||
my $interface = $hostref->[0];
|
||||
my $ipsec = $hostref->[1];
|
||||
my $policy = $capabilities{POLICY_MATCH} ? "-m policy --pol $ipsec --dir in " : '';
|
||||
my $network = $hostref->[2];
|
||||
my $source = match_source_net $network;
|
||||
|
||||
for my $chain ( @{first_chains $interface}) {
|
||||
add_rule $filter_table->{$chain} , "${source}${state}${policy}-j blacklst";
|
||||
}
|
||||
|
||||
progress_message " Blacklisting enabled on ${interface}:${network}";
|
||||
}
|
||||
}
|
||||
|
||||
sub setup_forwarding() {
|
||||
if ( "\L$config{IP_FORWARDING}" eq 'on' ) {
|
||||
emit 'echo 1 > /proc/sys/net/ipv4/ip_forward';
|
||||
emit 'progress_message2 IP Forwarding Enabled';
|
||||
} elsif ( "\L$config{IP_FORWARDING}" eq 'off' ) {
|
||||
emit 'echo 0 > /proc/sys/net/ipv4/ip_forward';
|
||||
emit 'progress_message2 IP Forwarding Disabled!';
|
||||
}
|
||||
|
||||
emit '';
|
||||
}
|
||||
|
||||
sub add_common_rules() {
|
||||
my $interface;
|
||||
my $chainref;
|
||||
my $level;
|
||||
my $target;
|
||||
my $rule;
|
||||
my $list;
|
||||
my $chain;
|
||||
|
||||
my $rejectref = new_standard_chain 'reject';
|
||||
|
||||
new_standard_chain 'dynamic';
|
||||
|
||||
my $state = $config{BLACKLISTNEWONLY} ? '-m state --state NEW,INVALID' : '';
|
||||
|
||||
for $interface ( @interfaces ) {
|
||||
for $chain ( input_chain $interface , forward_chain $interface ) {
|
||||
add_rule new_standard_chain( $chain ) , "$state -j dynamic";
|
||||
}
|
||||
|
||||
new_standard_chain output_chain( $interface );
|
||||
}
|
||||
|
||||
$level = $env{BLACKLIST_LOG_LEVEL} || 'info';
|
||||
|
||||
add_rule_pair new_standard_chain( 'logdrop' ), ' ' , 'DROP' , $level ;
|
||||
add_rule_pair new_standard_chain( 'logreject' ), ' ' , 'REJECT' , $level ;
|
||||
|
||||
setup_blacklist;
|
||||
|
||||
$list = find_hosts_by_option 'nosmurfs';
|
||||
|
||||
if ( $capabilities{ADDRTYPE} ) {
|
||||
$chainref = new_standard_chain 'smurfs';
|
||||
|
||||
add_rule_pair $chainref, '-m addrtype --src-type BROADCAST ', 'DROP', $config{SMURF_LOG_LEVEL} ;
|
||||
add_rule_pair $chainref, '-m addrtype --src-type MULTICAST ', 'DROP', $config{SMURF_LOG_LEVEL} ;
|
||||
|
||||
add_rule $rejectref , '-m addrtype --src-type BROADCAST -j DROP';
|
||||
add_rule $rejectref , '-m addrtype --src-type MULTICAST -j DROP';
|
||||
} elsif ( @$list ) {
|
||||
fatal_error "The nosmurfs option requires Address Type Match in your kernel and iptables";
|
||||
}
|
||||
|
||||
if ( @$list ) {
|
||||
progress_message2 ' Adding Anti-smurf Rules';
|
||||
for my $hostref ( @$list ) {
|
||||
$interface = $hostref->[0];
|
||||
my $ipsec = $hostref->[1];
|
||||
my $policy = $capabilities{POLICY_MATCH} ? "-m policy --pol $ipsec --dir in " : '';
|
||||
for $chain ( @{first_chains $interface}) {
|
||||
add_rule $filter_table->{$chain} , '-m state --state NEW,INVALID ' . match_source_net( $hostref->[2]) . "${policy}-j smurfs";
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
add_rule $rejectref , '-p tcp -j REJECT --reject-with tcp-reset';
|
||||
|
||||
if ( $capabilities{ENHANCED_REJECT} ) {
|
||||
add_rule $rejectref , '-p udp -j REJECT';
|
||||
add_rule $rejectref, '-p icmp -j REJECT --reject-with icmp-host-unreachable';
|
||||
add_rule $rejectref, '-j REJECT --reject-with icmp-host-prohibited';
|
||||
} else {
|
||||
add_rule $rejectref , '-j REJECT';
|
||||
}
|
||||
|
||||
$list = find_interfaces_by_option 'dhcp';
|
||||
|
||||
if ( @$list ) {
|
||||
progress_message2 ' Adding rules for DHCP';
|
||||
|
||||
for $interface ( @$list ) {
|
||||
for $chain ( @{first_chains $interface}) {
|
||||
add_rule $filter_table->{$chain} , '-p udp --dport 67:68 -j ACCEPT';
|
||||
}
|
||||
|
||||
add_rule $filter_table->{forward_chain $interface} , "-p udp -o $interface --dport 67:68 -j ACCEPT" if $interfaces{$interface}{options}{routeback};
|
||||
}
|
||||
}
|
||||
|
||||
$list = find_hosts_by_option 'norfc1918';
|
||||
|
||||
if ( @$list ) {
|
||||
progress_message2 ' Enabling RFC1918 Filtering';
|
||||
|
||||
setup_rfc1918_filteration $list;
|
||||
}
|
||||
|
||||
$list = find_hosts_by_option 'tcpflags';
|
||||
|
||||
if ( @$list ) {
|
||||
my $disposition;
|
||||
|
||||
progress_message2 " $doing TCP Flags checking...";
|
||||
|
||||
$chainref = new_standard_chain 'tcpflags';
|
||||
|
||||
if ( $config{TCP_FLAGS_LOG_LEVEL} ) {
|
||||
my $logflagsref = new_standard_chain 'logflags';
|
||||
|
||||
my $savelogparms = $env{LOGPARMS};
|
||||
|
||||
$env{LOGPARMS} = "$env{LOGPARMS} --log-ip-options" unless $config{TCP_FLAGS_LOG_LEVEL} eq 'ULOG';
|
||||
|
||||
log_rule $config{TCP_FLAGS_LOG_LEVEL} , $logflagsref , $config{TCP_FLAGS_DISPOSITION}, '';
|
||||
|
||||
$env{LOGPARMS} = $savelogparms;
|
||||
|
||||
if ( $config{TCP_FLAGS_DISPOSITION} eq 'REJECT' ) {
|
||||
add_rule $logflagsref , '-j REJECT --reject-with tcp-reset';
|
||||
} else {
|
||||
add_rule $logflagsref , "-j $config{TCP_FLAGS_DISPOSITION}";
|
||||
}
|
||||
|
||||
$disposition = 'logflags';
|
||||
} else {
|
||||
$disposition = $config{TCP_FLAGS_DISPOSITION};
|
||||
}
|
||||
|
||||
add_rule $chainref , "-p tcp --tcp-flags ALL FIN,URG,PSH -j $disposition";
|
||||
add_rule $chainref , "-p tcp --tcp-flags ALL NONE -j $disposition";
|
||||
add_rule $chainref , "-p tcp --tcp-flags SYN,RST SYN,RST -j $disposition";
|
||||
add_rule $chainref , "-p tcp --tcp-flags SYN,FIN SYN,FIN -j $disposition";
|
||||
add_rule $chainref , "-p tcp --syn --sport 0 -j $disposition";
|
||||
|
||||
for my $hostref ( @$list ) {
|
||||
$interface = $hostref->[0];
|
||||
my $ipsec = $hostref->[1];
|
||||
my $policy = $capabilities{POLICY_MATCH} ? "-m policy --pol $ipsec --dir in " : '';
|
||||
for $chain ( @{first_chains $interface}) {
|
||||
add_rule $filter_table->{$chain} , '-p tcp ' . match_source_net( $hostref->[2]) . "${policy}-j tcpflags";
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if ( $config{DYNAMIC_ZONES} ) {
|
||||
for $interface ( @interfaces) {
|
||||
for $chain ( @{dynamic_chains $interface} ) {
|
||||
new_standard_chain $chain;
|
||||
}
|
||||
}
|
||||
|
||||
(new_chain 'nat' , $chain = dynamic_in($interface) )->{referenced} = 1;
|
||||
|
||||
add_rule $filter_table->{input_chain $interface}, "-j $chain";
|
||||
add_rule $filter_table->{forward_chain $interface}, '-j ' . dynamic_fwd $interface;
|
||||
add_rule $filter_table->{output_chain $interface}, '-j ' . dynamic_out $interface;
|
||||
}
|
||||
|
||||
$list = find_interfaces_by_option 'upnp';
|
||||
|
||||
if ( @$list ) {
|
||||
progress_message2 ' $doing UPnP';
|
||||
|
||||
(new_chain 'nat', 'UPnP')->{referenced} = 1;
|
||||
|
||||
for $interface ( @$list ) {
|
||||
add_rule $nat_table->{PREROUTING} , "-i $interface -j UPnP";
|
||||
}
|
||||
}
|
||||
|
||||
setup_syn_flood_chains;
|
||||
|
||||
setup_forwarding;
|
||||
}
|
||||
|
||||
my %maclist_targets = ( ACCEPT => { target => 'RETURN' , mangle => 1 } ,
|
||||
REJECT => { target => 'reject' , mangle => 0 } ,
|
||||
DROP => { target => 'DROP' , mangle => 1 } );
|
||||
|
||||
sub setup_mac_lists( $ ) {
|
||||
|
||||
my $phase = $_[0];
|
||||
|
||||
my %maclist_interfaces;
|
||||
|
||||
my $table = $config{MACLIST_TABLE};
|
||||
|
||||
my $maclist_hosts = find_hosts_by_option 'maclist';
|
||||
|
||||
for my $hostref ( $maclist_hosts ) {
|
||||
$maclist_interfaces{ $hostref->[0][0] } = 1;
|
||||
}
|
||||
|
||||
my @maclist_interfaces = ( sort keys %maclist_interfaces );
|
||||
|
||||
progress_message " $doing MAC Verification for @maclist_interfaces -- Phase $phase...";
|
||||
|
||||
if ( $phase == 1 ) {
|
||||
for my $interface ( @maclist_interfaces ) {
|
||||
my $chainref = new_chain $table , mac_chain $interface;
|
||||
|
||||
add_rule $chainref , '-s 0.0.0.0 -d 255.255.255.255 -p udp --dport 67:68 -j RETURN'
|
||||
if ( $table eq 'mangle' ) && $interfaces{$interface}{options}{dhcp};
|
||||
|
||||
if ( $config{MACLIST_TTL} ) {
|
||||
my $chain1ref = new_chain $table, macrecent_target $interface;
|
||||
|
||||
my $chain = $chainref->{name};
|
||||
|
||||
add_rule $chainref, "-m recent --rcheck --seconds $config{MACLIST_TTL} --name $chain -j RETURN";
|
||||
add_rule $chainref, "-j $chain1ref->{name}";
|
||||
add_rule $chainref, "-m recent --update --name $chain -j RETURN";
|
||||
add_rule $chainref, "-m recent --set --name $chain";
|
||||
}
|
||||
}
|
||||
|
||||
open MAC, "$ENV{TMP_DIR}/maclist" or fatal_error "Unable to open stripped maclist file: $!";
|
||||
|
||||
while ( $line = <MAC> ) {
|
||||
|
||||
chomp $line;
|
||||
$line =~ s/\s+/ /g;
|
||||
|
||||
my ( $disposition, $interface, $mac, $addresses , $extra ) = split /\s+/, $line;
|
||||
|
||||
if ( $disposition eq 'COMMENT' ) {
|
||||
if ( $capabilities{COMMENTS} ) {
|
||||
( $comment = $line ) =~ s/^\s*COMMENT\s*//;
|
||||
$comment =~ s/\s*$//;
|
||||
} else {
|
||||
warning_message "COMMENT ignored -- requires comment support in iptables/Netfilter";
|
||||
}
|
||||
} else {
|
||||
fatal_error "Invalid maclist entry: \"$line\"" if $extra;
|
||||
|
||||
( $disposition, my $level ) = split /:/, $disposition;
|
||||
|
||||
my $targetref = $maclist_targets{$disposition};
|
||||
|
||||
fatal_error "Invalid DISPOSITION ( $disposition) in rule \"$line\"" if ( $table eq 'mangle' ) && ! $targetref->{mangle};
|
||||
|
||||
fatal_error "No hosts on $interface have the maclist option specified: \"$line\"" unless $maclist_interfaces{$interface};
|
||||
|
||||
my $chainref = $chain_table{$table}{( $config{MACLIST_TTL} ? macrecent_target $interface : mac_chain $interface )};
|
||||
|
||||
$mac = '' unless $mac && ( $mac ne '-' );
|
||||
$addresses = '' unless $addresses && ( $addresses ne '-' );
|
||||
|
||||
fatal_error "You must specify a MAC address or an IP address" unless $mac || $addresses;
|
||||
|
||||
$mac = mac_match $mac if $mac;
|
||||
|
||||
if ( $addresses ) {
|
||||
for my $address ( split ',', $addresses ) {
|
||||
my $source = match_source_net $address;
|
||||
log_rule_limit $level, $chainref , mac_chain( $interface) , $disposition, '', '', 'add' , "${mac}${source}" if $level;
|
||||
add_rule $chainref , "${mac}${source}-j $targetref->{target}";
|
||||
}
|
||||
} else {
|
||||
log_rule_limit $level, $chainref , mac_chain( $interface) , $disposition, '', '', 'add' , $mac if $level;
|
||||
add_rule $chainref , "$mac-j $targetref->{target}";
|
||||
}
|
||||
|
||||
progress_message " Maclist entry \"$line\" $done";
|
||||
}
|
||||
}
|
||||
|
||||
close MAC;
|
||||
|
||||
$comment = '';
|
||||
#
|
||||
# Generate jumps from the input and forward chains
|
||||
#
|
||||
for my $hostref ( @$maclist_hosts ) {
|
||||
my $interface = $hostref->[0];
|
||||
my $ipsec = $hostref->[1];
|
||||
my $policy = $capabilities{POLICY_MATCH} ? "-m policy --pol $ipsec --dir in " : '';
|
||||
my $source = match_source_net $hostref->[2];
|
||||
my $target = mac_chain $interface;
|
||||
if ( $table eq 'filter' ) {
|
||||
for my $chain ( @{first_chains $interface}) {
|
||||
add_rule $filter_table->{$chain} , "${source}-m state --statue NEW ${policy}-j $target";
|
||||
}
|
||||
} else {
|
||||
add_rule $mangle_table->{PREROUTING}, "-i $interface ${source}-m state --state NEW ${policy}-j $target";
|
||||
}
|
||||
}
|
||||
} else {
|
||||
my $target = $env{MACLIST_TARGET};
|
||||
my $level = $config{MACLIST_LOG_LEVEL};
|
||||
my $disposition = $config{MACLIST_DISPOSITION};
|
||||
|
||||
for my $interface ( @maclist_interfaces ) {
|
||||
my $chainref = $chain_table{$table}{( $config{MACLIST_TTL} ? macrecent_target $interface : mac_chain $interface )};
|
||||
my $chain = mac_chain $interface;
|
||||
log_rule_limit $level, $chainref , $chain , $disposition, '', '', 'add', '';
|
||||
add_rule $chainref, "-j $target";
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
sub process_rule1 ( $$$$$$$$$ );
|
||||
|
||||
#
|
||||
|
||||
@ -1,3 +1,26 @@
|
||||
#
|
||||
# Shorewall 3.9 -- /usr/share/shorewall/Shorewall/Tc.pm
|
||||
#
|
||||
# This program is under GPL [http://www.gnu.org/copyleft/gpl.htm]
|
||||
#
|
||||
# (c) 2007 - Tom Eastep (teastep@shorewall.net)
|
||||
#
|
||||
# Complete documentation is available at http://shorewall.net
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of Version 2 of the GNU General Public License
|
||||
# as published by the Free Software Foundation.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA
|
||||
#
|
||||
#
|
||||
package Shorewall::Tc;
|
||||
require Exporter;
|
||||
use Shorewall::Common;
|
||||
|
||||
@ -1,3 +1,26 @@
|
||||
#
|
||||
# Shorewall 3.9 -- /usr/share/shorewall/Shorewall/Tunnels.pm
|
||||
#
|
||||
# This program is under GPL [http://www.gnu.org/copyleft/gpl.htm]
|
||||
#
|
||||
# (c) 2007 - Tom Eastep (teastep@shorewall.net)
|
||||
#
|
||||
# Complete documentation is available at http://shorewall.net
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of Version 2 of the GNU General Public License
|
||||
# as published by the Free Software Foundation.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA
|
||||
#
|
||||
#
|
||||
package Shorewall::Tunnels;
|
||||
require Exporter;
|
||||
use Shorewall::Common;
|
||||
|
||||
@ -1,3 +1,26 @@
|
||||
#
|
||||
# Shorewall 3.9 -- /usr/share/shorewall/Shorewall/Zones.pm
|
||||
#
|
||||
# This program is under GPL [http://www.gnu.org/copyleft/gpl.htm]
|
||||
#
|
||||
# (c) 2007 - Tom Eastep (teastep@shorewall.net)
|
||||
#
|
||||
# Complete documentation is available at http://shorewall.net
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of Version 2 of the GNU General Public License
|
||||
# as published by the Free Software Foundation.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA
|
||||
#
|
||||
#
|
||||
package Shorewall::Zones;
|
||||
require Exporter;
|
||||
use Shorewall::Common;
|
||||
|
||||
510
New/compiler.pl
510
New/compiler.pl
@ -1,7 +1,47 @@
|
||||
#! /usr/bin/perl -w
|
||||
#
|
||||
# The Shoreline Firewall (Shorewall) Packet Filtering Firewall Compiler - V3.9
|
||||
#
|
||||
# This program is under GPL [http://www.gnu.org/copyleft/gpl.htm]
|
||||
#
|
||||
# (c) 2007 - Tom Eastep (teastep@shorewall.net)
|
||||
#
|
||||
# Complete documentation is available at http://shorewall.net
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or modify
|
||||
# it under the terms of Version 2 of the GNU General Public License
|
||||
# as published by the Free Software Foundation.
|
||||
#
|
||||
# This program is distributed in the hope that it will be useful,
|
||||
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
# GNU General Public License for more details.
|
||||
#
|
||||
# You should have received a copy of the GNU General Public License
|
||||
# along with this program; if not, write to the Free Software
|
||||
# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA
|
||||
#
|
||||
# Commands are:
|
||||
#
|
||||
# compiler.pl Verify the configuration files.
|
||||
# compile <path name> Compile into <path name>
|
||||
#
|
||||
# Environmental Variables are set up by the Compiler wrapper ('compiler' program).
|
||||
#
|
||||
# EXPORT=Yes -e option specified to /sbin/shorewall
|
||||
# SHOREWALL_DIR A directory name was passed to /sbin/shorewall
|
||||
# VERBOSE Standard Shorewall verbosity control.
|
||||
# DEBUG=Yes Debugging Enabled
|
||||
# VERSION Shorewall Version
|
||||
# TMP_DIR Temporary Directory containing stripped copies
|
||||
# of all configuration files. Shell variable substitution
|
||||
# has been performed on these files.
|
||||
# TIMESTAMP=Yes -t option specified to /sbin/shorewall
|
||||
#
|
||||
# This program performs rudimentary shell variable expansion on action and macro files.
|
||||
|
||||
use strict;
|
||||
use lib "$ENV{HOME}/shorewall/trunk/New";
|
||||
use lib '/usr/share/shorewall/Shorewall';
|
||||
use Shorewall::Common;
|
||||
use Shorewall::Config;
|
||||
use Shorewall::Chains;
|
||||
@ -18,470 +58,6 @@ use Shorewall::Actions;
|
||||
use Shorewall::Accounting;
|
||||
use Shorewall::Rules;
|
||||
|
||||
sub process_tos() {
|
||||
my $chain = 'pretos';
|
||||
my $stdchain = 'PREROUTING';
|
||||
|
||||
if ( -s "$ENV{TMP_DIR}/tos" ) {
|
||||
progress_message2 'Setting up TOS...';
|
||||
|
||||
my $pretosref = new_chain 'mangle' , 'pretos';
|
||||
my $outtosref = new_chain 'mangle' , 'outtos';
|
||||
|
||||
open TOS, "$ENV{TMP_DIR}/tos" or fatal_error "Unable to open stripped tos file: $!";
|
||||
|
||||
while ( $line = <TOS> ) {
|
||||
|
||||
chomp $line;
|
||||
$line =~ s/\s+/ /g;
|
||||
|
||||
my ($source, $dest, $proto, $sports, $ports, $extra) = split /\s+/, $line;
|
||||
|
||||
fatal_error "Invalid tos file entry: \"$line\"" if $extra;
|
||||
}
|
||||
|
||||
close TOS;
|
||||
|
||||
$comment = '';
|
||||
}
|
||||
}
|
||||
|
||||
sub add_rule_pair( $$$$ ) {
|
||||
my ($chainref , $predicate , $target , $level ) = @_;
|
||||
|
||||
log_rule $level, $chainref, $target, , $predicate, if $level;
|
||||
add_rule $chainref , "${predicate}-j $target";
|
||||
}
|
||||
|
||||
sub setup_rfc1918_filteration( $ ) {
|
||||
|
||||
my $listref = $_[0];
|
||||
my $norfc1918ref = new_standard_chain 'norfc1918';
|
||||
my $rfc1918ref = new_standard_chain 'rfc1918';
|
||||
my $chainref = $norfc1918ref;
|
||||
|
||||
log_rule $config{RFC1918_LOG_LEVEL} , $rfc1918ref , 'DROP' , '';
|
||||
|
||||
add_rule $rfc1918ref , '-j DROP';
|
||||
|
||||
if ( $config{RFC1918_STRICT} ) {
|
||||
$chainref = new_standard_chain 'rfc1918d';
|
||||
}
|
||||
|
||||
open RFC, "$ENV{TMP_DIR}/rfc1918" or fatal_error "Unable to open stripped rfc1918 file: $!";
|
||||
|
||||
while ( $line = <RFC> ) {
|
||||
chomp $line;
|
||||
$line =~ s/\s+/ /g;
|
||||
|
||||
my ( $networks, $target, $extra ) = split /\s+/, $line;
|
||||
|
||||
my $s_target;
|
||||
|
||||
if ( $target eq 'logdrop' ) {
|
||||
$target = 'rfc1918';
|
||||
$s_target = 'rfc1918';
|
||||
} elsif ( $target eq 'DROP' ) {
|
||||
$s_target = 'DROP';
|
||||
} elsif ( $target eq 'RETURN' ) {
|
||||
$s_target = $config{RFC1918_LOG_LEVEL} ? 'rfc1918d' : 'RETURN';
|
||||
} else {
|
||||
fatal_error "Invalid target ($target) for $networks";
|
||||
}
|
||||
|
||||
for my $network ( split /,/, $networks ) {
|
||||
add_rule $norfc1918ref , match_source_net( $network ) . "-j $s_target";
|
||||
add_rule $chainref , match_orig_dest( $network ) . "-j $target" ;
|
||||
}
|
||||
}
|
||||
|
||||
close RFC;
|
||||
|
||||
add_rule $norfc1918ref , '-j rfc1918d' if $config{RFC1918_STRICT};
|
||||
|
||||
for my $hostref ( @$listref ) {
|
||||
my $interface = $hostref->[0];
|
||||
my $ipsec = $hostref->[1];
|
||||
my $policy = $capabilities{POLICY_MATCH} ? "-m policy --pol $ipsec --dir in " : '';
|
||||
for my $chain ( @{first_chains $interface}) {
|
||||
add_rule $filter_table->{$chain} , '-m state --state NEW ' . match_source_net( $hostref->[2]) . "${policy}-j norfc1918";
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
sub setup_syn_flood_chains() {
|
||||
for my $chainref ( @policy_chains ) {
|
||||
my $limit = $chainref->{synparams};
|
||||
if ( $limit ) {
|
||||
my $level = $chainref->{loglevel};
|
||||
( $limit, my $burst ) = split ':', $limit;
|
||||
$burst = $burst ? "--limit-burst $burst " : '';
|
||||
my $synchainref = new_chain 'filter' , syn_chain $chainref->{name};
|
||||
add_rule $synchainref , "-m limit --limit $limit ${burst}-j RETURN";
|
||||
log_rule_limit $level , $synchainref , $chainref->{name} , 'DROP', '-m limit --limit 5/min --limit-burst 5' , '' , 'add' , '' if $level;
|
||||
add_rule $synchainref, '-j DROP';
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
sub setup_blacklist() {
|
||||
|
||||
my ( $level, $disposition ) = @config{'BLACKLIST_LOGLEVEL', 'BLACKLIST_DISPOSITION' };
|
||||
|
||||
progress_message2 " Setting up Blacklist...";
|
||||
|
||||
open BL, "$ENV{TMP_DIR}/blacklist" or fatal_error "Unable to open stripped blacklist file: $!";
|
||||
|
||||
progress_message( " Processing " . find_file 'blacklist' . '...' );
|
||||
|
||||
while ( $line = <BL> ) {
|
||||
|
||||
chomp $line;
|
||||
$line =~ s/\s+/ /g;
|
||||
|
||||
my ( $networks, $protocol, $ports , $extra ) = split /\s+/, $line;
|
||||
|
||||
fatal_error "Invalid blacklist entry: \"$line\"" if $extra;
|
||||
|
||||
expand_rule
|
||||
ensure_filter_chain( 'blacklst' , 0 ) ,
|
||||
do_proto( $protocol , $ports, '' ) ,
|
||||
$networks ,
|
||||
'' ,
|
||||
'' ,
|
||||
'-j ' . ($disposition eq 'REJECT' ? 'reject' : $disposition),
|
||||
$level ,
|
||||
$disposition ,
|
||||
'';
|
||||
|
||||
progress_message " \"$line\" added to blacklist";
|
||||
}
|
||||
|
||||
close BL;
|
||||
|
||||
my $hosts = find_hosts_by_option 'blacklist';
|
||||
|
||||
my $state = $config{BLACKLISTNEWONLY} ? '-m state --state NEW,INVALID ' : '';
|
||||
|
||||
for my $hostref ( @$hosts ) {
|
||||
my $interface = $hostref->[0];
|
||||
my $ipsec = $hostref->[1];
|
||||
my $policy = $capabilities{POLICY_MATCH} ? "-m policy --pol $ipsec --dir in " : '';
|
||||
my $network = $hostref->[2];
|
||||
my $source = match_source_net $network;
|
||||
|
||||
for my $chain ( @{first_chains $interface}) {
|
||||
add_rule $filter_table->{$chain} , "${source}${state}${policy}-j blacklst";
|
||||
}
|
||||
|
||||
progress_message " Blacklisting enabled on ${interface}:${network}";
|
||||
}
|
||||
}
|
||||
|
||||
sub setup_forwarding() {
|
||||
if ( "\L$config{IP_FORWARDING}" eq 'on' ) {
|
||||
emit 'echo 1 > /proc/sys/net/ipv4/ip_forward';
|
||||
emit 'progress_message2 IP Forwarding Enabled';
|
||||
} elsif ( "\L$config{IP_FORWARDING}" eq 'off' ) {
|
||||
emit 'echo 0 > /proc/sys/net/ipv4/ip_forward';
|
||||
emit 'progress_message2 IP Forwarding Disabled!';
|
||||
}
|
||||
|
||||
emit '';
|
||||
}
|
||||
|
||||
sub add_common_rules() {
|
||||
my $interface;
|
||||
my $chainref;
|
||||
my $level;
|
||||
my $target;
|
||||
my $rule;
|
||||
my $list;
|
||||
my $chain;
|
||||
|
||||
my $rejectref = new_standard_chain 'reject';
|
||||
|
||||
new_standard_chain 'dynamic';
|
||||
|
||||
my $state = $config{BLACKLISTNEWONLY} ? '-m state --state NEW,INVALID' : '';
|
||||
|
||||
for $interface ( @interfaces ) {
|
||||
for $chain ( input_chain $interface , forward_chain $interface ) {
|
||||
add_rule new_standard_chain( $chain ) , "$state -j dynamic";
|
||||
}
|
||||
|
||||
new_standard_chain output_chain( $interface );
|
||||
}
|
||||
|
||||
$level = $env{BLACKLIST_LOG_LEVEL} || 'info';
|
||||
|
||||
add_rule_pair new_standard_chain( 'logdrop' ), ' ' , 'DROP' , $level ;
|
||||
add_rule_pair new_standard_chain( 'logreject' ), ' ' , 'REJECT' , $level ;
|
||||
|
||||
setup_blacklist;
|
||||
|
||||
$list = find_hosts_by_option 'nosmurfs';
|
||||
|
||||
if ( $capabilities{ADDRTYPE} ) {
|
||||
$chainref = new_standard_chain 'smurfs';
|
||||
|
||||
add_rule_pair $chainref, '-m addrtype --src-type BROADCAST ', 'DROP', $config{SMURF_LOG_LEVEL} ;
|
||||
add_rule_pair $chainref, '-m addrtype --src-type MULTICAST ', 'DROP', $config{SMURF_LOG_LEVEL} ;
|
||||
|
||||
add_rule $rejectref , '-m addrtype --src-type BROADCAST -j DROP';
|
||||
add_rule $rejectref , '-m addrtype --src-type MULTICAST -j DROP';
|
||||
} elsif ( @$list ) {
|
||||
fatal_error "The nosmurfs option requires Address Type Match in your kernel and iptables";
|
||||
}
|
||||
|
||||
if ( @$list ) {
|
||||
progress_message2 ' Adding Anti-smurf Rules';
|
||||
for my $hostref ( @$list ) {
|
||||
$interface = $hostref->[0];
|
||||
my $ipsec = $hostref->[1];
|
||||
my $policy = $capabilities{POLICY_MATCH} ? "-m policy --pol $ipsec --dir in " : '';
|
||||
for $chain ( @{first_chains $interface}) {
|
||||
add_rule $filter_table->{$chain} , '-m state --state NEW,INVALID ' . match_source_net( $hostref->[2]) . "${policy}-j smurfs";
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
add_rule $rejectref , '-p tcp -j REJECT --reject-with tcp-reset';
|
||||
|
||||
if ( $capabilities{ENHANCED_REJECT} ) {
|
||||
add_rule $rejectref , '-p udp -j REJECT';
|
||||
add_rule $rejectref, '-p icmp -j REJECT --reject-with icmp-host-unreachable';
|
||||
add_rule $rejectref, '-j REJECT --reject-with icmp-host-prohibited';
|
||||
} else {
|
||||
add_rule $rejectref , '-j REJECT';
|
||||
}
|
||||
|
||||
$list = find_interfaces_by_option 'dhcp';
|
||||
|
||||
if ( @$list ) {
|
||||
progress_message2 ' Adding rules for DHCP';
|
||||
|
||||
for $interface ( @$list ) {
|
||||
for $chain ( @{first_chains $interface}) {
|
||||
add_rule $filter_table->{$chain} , '-p udp --dport 67:68 -j ACCEPT';
|
||||
}
|
||||
|
||||
add_rule $filter_table->{forward_chain $interface} , "-p udp -o $interface --dport 67:68 -j ACCEPT" if $interfaces{$interface}{options}{routeback};
|
||||
}
|
||||
}
|
||||
|
||||
$list = find_hosts_by_option 'norfc1918';
|
||||
|
||||
if ( @$list ) {
|
||||
progress_message2 ' Enabling RFC1918 Filtering';
|
||||
|
||||
setup_rfc1918_filteration $list;
|
||||
}
|
||||
|
||||
$list = find_hosts_by_option 'tcpflags';
|
||||
|
||||
if ( @$list ) {
|
||||
my $disposition;
|
||||
|
||||
progress_message2 " $doing TCP Flags checking...";
|
||||
|
||||
$chainref = new_standard_chain 'tcpflags';
|
||||
|
||||
if ( $config{TCP_FLAGS_LOG_LEVEL} ) {
|
||||
my $logflagsref = new_standard_chain 'logflags';
|
||||
|
||||
my $savelogparms = $env{LOGPARMS};
|
||||
|
||||
$env{LOGPARMS} = "$env{LOGPARMS} --log-ip-options" unless $config{TCP_FLAGS_LOG_LEVEL} eq 'ULOG';
|
||||
|
||||
log_rule $config{TCP_FLAGS_LOG_LEVEL} , $logflagsref , $config{TCP_FLAGS_DISPOSITION}, '';
|
||||
|
||||
$env{LOGPARMS} = $savelogparms;
|
||||
|
||||
if ( $config{TCP_FLAGS_DISPOSITION} eq 'REJECT' ) {
|
||||
add_rule $logflagsref , '-j REJECT --reject-with tcp-reset';
|
||||
} else {
|
||||
add_rule $logflagsref , "-j $config{TCP_FLAGS_DISPOSITION}";
|
||||
}
|
||||
|
||||
$disposition = 'logflags';
|
||||
} else {
|
||||
$disposition = $config{TCP_FLAGS_DISPOSITION};
|
||||
}
|
||||
|
||||
add_rule $chainref , "-p tcp --tcp-flags ALL FIN,URG,PSH -j $disposition";
|
||||
add_rule $chainref , "-p tcp --tcp-flags ALL NONE -j $disposition";
|
||||
add_rule $chainref , "-p tcp --tcp-flags SYN,RST SYN,RST -j $disposition";
|
||||
add_rule $chainref , "-p tcp --tcp-flags SYN,FIN SYN,FIN -j $disposition";
|
||||
add_rule $chainref , "-p tcp --syn --sport 0 -j $disposition";
|
||||
|
||||
for my $hostref ( @$list ) {
|
||||
$interface = $hostref->[0];
|
||||
my $ipsec = $hostref->[1];
|
||||
my $policy = $capabilities{POLICY_MATCH} ? "-m policy --pol $ipsec --dir in " : '';
|
||||
for $chain ( @{first_chains $interface}) {
|
||||
add_rule $filter_table->{$chain} , '-p tcp ' . match_source_net( $hostref->[2]) . "${policy}-j tcpflags";
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if ( $config{DYNAMIC_ZONES} ) {
|
||||
for $interface ( @interfaces) {
|
||||
for $chain ( @{dynamic_chains $interface} ) {
|
||||
new_standard_chain $chain;
|
||||
}
|
||||
}
|
||||
|
||||
(new_chain 'nat' , $chain = dynamic_in($interface) )->{referenced} = 1;
|
||||
|
||||
add_rule $filter_table->{input_chain $interface}, "-j $chain";
|
||||
add_rule $filter_table->{forward_chain $interface}, '-j ' . dynamic_fwd $interface;
|
||||
add_rule $filter_table->{output_chain $interface}, '-j ' . dynamic_out $interface;
|
||||
}
|
||||
|
||||
$list = find_interfaces_by_option 'upnp';
|
||||
|
||||
if ( @$list ) {
|
||||
progress_message2 ' $doing UPnP';
|
||||
|
||||
(new_chain 'nat', 'UPnP')->{referenced} = 1;
|
||||
|
||||
for $interface ( @$list ) {
|
||||
add_rule $nat_table->{PREROUTING} , "-i $interface -j UPnP";
|
||||
}
|
||||
}
|
||||
|
||||
setup_syn_flood_chains;
|
||||
|
||||
setup_forwarding;
|
||||
}
|
||||
|
||||
my %maclist_targets = ( ACCEPT => { target => 'RETURN' , mangle => 1 } ,
|
||||
REJECT => { target => 'reject' , mangle => 0 } ,
|
||||
DROP => { target => 'DROP' , mangle => 1 } );
|
||||
|
||||
sub setup_mac_lists( $ ) {
|
||||
|
||||
my $phase = $_[0];
|
||||
|
||||
my %maclist_interfaces;
|
||||
|
||||
my $table = $config{MACLIST_TABLE};
|
||||
|
||||
my $maclist_hosts = find_hosts_by_option 'maclist';
|
||||
|
||||
for my $hostref ( $maclist_hosts ) {
|
||||
$maclist_interfaces{ $hostref->[0][0] } = 1;
|
||||
}
|
||||
|
||||
my @maclist_interfaces = ( sort keys %maclist_interfaces );
|
||||
|
||||
progress_message " $doing MAC Verification for @maclist_interfaces -- Phase $phase...";
|
||||
|
||||
if ( $phase == 1 ) {
|
||||
for my $interface ( @maclist_interfaces ) {
|
||||
my $chainref = new_chain $table , mac_chain $interface;
|
||||
|
||||
add_rule $chainref , '-s 0.0.0.0 -d 255.255.255.255 -p udp --dport 67:68 -j RETURN'
|
||||
if ( $table eq 'mangle' ) && $interfaces{$interface}{options}{dhcp};
|
||||
|
||||
if ( $config{MACLIST_TTL} ) {
|
||||
my $chain1ref = new_chain $table, macrecent_target $interface;
|
||||
|
||||
my $chain = $chainref->{name};
|
||||
|
||||
add_rule $chainref, "-m recent --rcheck --seconds $config{MACLIST_TTL} --name $chain -j RETURN";
|
||||
add_rule $chainref, "-j $chain1ref->{name}";
|
||||
add_rule $chainref, "-m recent --update --name $chain -j RETURN";
|
||||
add_rule $chainref, "-m recent --set --name $chain";
|
||||
}
|
||||
}
|
||||
|
||||
open MAC, "$ENV{TMP_DIR}/maclist" or fatal_error "Unable to open stripped maclist file: $!";
|
||||
|
||||
while ( $line = <MAC> ) {
|
||||
|
||||
chomp $line;
|
||||
$line =~ s/\s+/ /g;
|
||||
|
||||
my ( $disposition, $interface, $mac, $addresses , $extra ) = split /\s+/, $line;
|
||||
|
||||
if ( $disposition eq 'COMMENT' ) {
|
||||
if ( $capabilities{COMMENTS} ) {
|
||||
( $comment = $line ) =~ s/^\s*COMMENT\s*//;
|
||||
$comment =~ s/\s*$//;
|
||||
} else {
|
||||
warning_message "COMMENT ignored -- requires comment support in iptables/Netfilter";
|
||||
}
|
||||
} else {
|
||||
fatal_error "Invalid maclist entry: \"$line\"" if $extra;
|
||||
|
||||
( $disposition, my $level ) = split /:/, $disposition;
|
||||
|
||||
my $targetref = $maclist_targets{$disposition};
|
||||
|
||||
fatal_error "Invalid DISPOSITION ( $disposition) in rule \"$line\"" if ( $table eq 'mangle' ) && ! $targetref->{mangle};
|
||||
|
||||
fatal_error "No hosts on $interface have the maclist option specified: \"$line\"" unless $maclist_interfaces{$interface};
|
||||
|
||||
my $chainref = $chain_table{$table}{( $config{MACLIST_TTL} ? macrecent_target $interface : mac_chain $interface )};
|
||||
|
||||
$mac = '' unless $mac && ( $mac ne '-' );
|
||||
$addresses = '' unless $addresses && ( $addresses ne '-' );
|
||||
|
||||
fatal_error "You must specify a MAC address or an IP address" unless $mac || $addresses;
|
||||
|
||||
$mac = mac_match $mac if $mac;
|
||||
|
||||
if ( $addresses ) {
|
||||
for my $address ( split ',', $addresses ) {
|
||||
my $source = match_source_net $address;
|
||||
log_rule_limit $level, $chainref , mac_chain( $interface) , $disposition, '', '', 'add' , "${mac}${source}" if $level;
|
||||
add_rule $chainref , "${mac}${source}-j $targetref->{target}";
|
||||
}
|
||||
} else {
|
||||
log_rule_limit $level, $chainref , mac_chain( $interface) , $disposition, '', '', 'add' , $mac if $level;
|
||||
add_rule $chainref , "$mac-j $targetref->{target}";
|
||||
}
|
||||
|
||||
progress_message " Maclist entry \"$line\" $done";
|
||||
}
|
||||
}
|
||||
|
||||
close MAC;
|
||||
|
||||
$comment = '';
|
||||
#
|
||||
# Generate jumps from the input and forward chains
|
||||
#
|
||||
for my $hostref ( @$maclist_hosts ) {
|
||||
my $interface = $hostref->[0];
|
||||
my $ipsec = $hostref->[1];
|
||||
my $policy = $capabilities{POLICY_MATCH} ? "-m policy --pol $ipsec --dir in " : '';
|
||||
my $source = match_source_net $hostref->[2];
|
||||
my $target = mac_chain $interface;
|
||||
if ( $table eq 'filter' ) {
|
||||
for my $chain ( @{first_chains $interface}) {
|
||||
add_rule $filter_table->{$chain} , "${source}-m state --statue NEW ${policy}-j $target";
|
||||
}
|
||||
} else {
|
||||
add_rule $mangle_table->{PREROUTING}, "-i $interface ${source}-m state --state NEW ${policy}-j $target";
|
||||
}
|
||||
}
|
||||
} else {
|
||||
my $target = $env{MACLIST_TARGET};
|
||||
my $level = $config{MACLIST_LOG_LEVEL};
|
||||
my $disposition = $config{MACLIST_DISPOSITION};
|
||||
|
||||
for my $interface ( @maclist_interfaces ) {
|
||||
my $chainref = $chain_table{$table}{( $config{MACLIST_TTL} ? macrecent_target $interface : mac_chain $interface )};
|
||||
my $chain = mac_chain $interface;
|
||||
log_rule_limit $level, $chainref , $chain , $disposition, '', '', 'add', '';
|
||||
add_rule $chainref, "-j $target";
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
sub generate_script_1 {
|
||||
copy find_file 'prog.header';
|
||||
|
||||
@ -789,9 +365,7 @@ sub compile_firewall( $ ) {
|
||||
#
|
||||
progress_message2 "Setting UP Accounting...";
|
||||
setup_accounting;
|
||||
#
|
||||
# Do the BIG UGLY...
|
||||
#
|
||||
|
||||
unless ( $command eq 'check' ) {
|
||||
#
|
||||
# Finish the script.
|
||||
|
||||
@ -151,7 +151,9 @@ stop_firewall() {
|
||||
undo_routing
|
||||
|
||||
restore_default_route
|
||||
|
||||
#
|
||||
# Fixme -- CRITICALHOSTS handling broken
|
||||
#
|
||||
if [ -n "$CRITICALHOSTS" ]; then
|
||||
if [ -z "$ADMINISABSENTMINDED" ]; then
|
||||
|
||||
@ -162,7 +164,7 @@ stop_firewall() {
|
||||
setpolicy FORWARD DROP
|
||||
|
||||
deleteallchains
|
||||
|
||||
|
||||
for host in $CRITICALHOSTS; do
|
||||
interface=${host%:*}
|
||||
networks=${host#*:}
|
||||
|
||||
Loading…
Reference in New Issue
Block a user