forked from extern/shorewall_code
Rename 'Trigger' to 'Event' and document
Signed-off-by: Tom Eastep <teastep@shorewall.net>
This commit is contained in:
Tom Eastep
parent
3c6df56b57
commit
9535a7d7df
@ -5413,13 +5413,13 @@ sub get_configuration( $$$$ ) {
|
||||
}
|
||||
|
||||
#
|
||||
# It is okay if the trigger mark is outsize of the a 32-bit integer. We check that in IfTrigger"
|
||||
# It is okay if the event mark is outside of the a 32-bit integer. We check that in IfEvent"
|
||||
#
|
||||
fatal_error 'Invalid Packet Mark layout' if $config{ZONE_BITS} + $globals{ZONE_OFFSET} > 30;
|
||||
|
||||
$globals{EXCLUSION_MASK} = 1 << ( $globals{ZONE_OFFSET} + $config{ZONE_BITS} );
|
||||
$globals{TPROXY_MARK} = $globals{EXCLUSION_MASK} << 1;
|
||||
$globals{TRIGGER_MARK} = $globals{TPROXY_MARK} << 1;
|
||||
$globals{EVENT_MARK} = $globals{TPROXY_MARK} << 1;
|
||||
$globals{PROVIDER_MIN} = 1 << $config{PROVIDER_OFFSET};
|
||||
|
||||
$globals{TC_MAX} = make_mask( $config{TC_BITS} );
|
||||
|
||||
106
Shorewall/action.IfEvent
Normal file
106
Shorewall/action.IfEvent
Normal file
@ -0,0 +1,106 @@
|
||||
#
|
||||
# Shorewall version 4 - Perform an Action based on a Event
|
||||
#
|
||||
# /etc/shorewall/action.IfEvent
|
||||
#
|
||||
# Parameters:
|
||||
# Event: Must start with a letter and be composed of letters, digits, '-', and '_'.
|
||||
# Action: Anything that can appear in the ACTION column of a rule.
|
||||
# Duration: Duration in seconds over which the event is to be tested.
|
||||
# Hit Count: Number of packets seen within the duration -- default is 1
|
||||
# Src or Dest: 'src' (default) or 'dst'. Determines if the event is associated with the source
|
||||
# address (src) or destination address (dst)
|
||||
# Command: 'check' (default) 'reset', or 'update'. If 'reset', the event will be reset before
|
||||
# the Action is taken. If 'update', the timestamp associated with the event will
|
||||
# be updated and the action taken if the time limit/hitcount are matched.
|
||||
# If '-', the action will be taken if the limit/hitcount are matched but the
|
||||
# event's timestamp will not be updated.
|
||||
#
|
||||
# If a duration is specified, then 'checkreap' and 'updatereap' may also
|
||||
# be used. These are like 'check' and 'update' respectively, but they also
|
||||
# remove any event entries for the IP address that are older than <duration>
|
||||
# seconds.
|
||||
# Disposition: Disposition for any event generated.
|
||||
#
|
||||
# For additional information, see http://www.shorewall.net/Events.html
|
||||
#
|
||||
#######################################################################################################
|
||||
# DO NOT REMOVE THE FOLLOWING LINE
|
||||
?format 2
|
||||
#################################################################################################################################################################################################
|
||||
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH HELPER
|
||||
# PORT PORT(S) DEST LIMIT GROUP
|
||||
|
||||
DEFAULTS -,ACCEPT,-,1,src,check,-
|
||||
|
||||
?begin perl
|
||||
|
||||
use Shorewall::Config qw(:DEFAULT :internal);
|
||||
use Shorewall::Chains;
|
||||
use Shorewall::Rules;
|
||||
use strict;
|
||||
|
||||
my ( $event, $action, $duration, $hitcount, $destination, $command, $disposition ) = get_action_params( 7 );
|
||||
|
||||
fatal_error "An event name is required" unless supplied $event;
|
||||
fatal_error "Invalid event name ($event)" unless $event =~ /^[a-zA-z][-\w]*$/;
|
||||
|
||||
if ( supplied $duration ) {
|
||||
fatal_error "Invalid time limit ($duration)" unless $duration =~ /^\d+$/;
|
||||
$duration = "--second $duration ";
|
||||
} else {
|
||||
$duration = '';
|
||||
}
|
||||
|
||||
fatal_error "Invalid hit count ($hitcount)" unless $hitcount =~ /^\d+$/;
|
||||
fatal_error "Invalid Src or Dest ($destination)" unless $destination =~ /^(?:src|dst)$/;
|
||||
fatal_error "Invalid reset flag ($command)" unless $command =~ /^(?:reset|update|updatereap|check|checkreap)$/;
|
||||
|
||||
set_action_disposition( $disposition) if supplied $disposition;
|
||||
set_action_name_to_caller;
|
||||
|
||||
require_capability 'RECENT_MATCH', 'Use of events', 's';
|
||||
|
||||
my $reap;
|
||||
|
||||
fatal_error "${command}reap requires a time limit" if ( $reap = $command =~ s/reap$// ? '--reap ' : '' ) && ! $duration;
|
||||
|
||||
$duration .= $reap;
|
||||
|
||||
if ( $command eq 'reset' ) {
|
||||
require_capability 'MARK_ANYWHERE', 'Resetting an event', 's';
|
||||
|
||||
print "Resetting....\n";
|
||||
|
||||
my $mark = $globals{EVENT_MARK};
|
||||
#
|
||||
# The event mark bit must be within 32 bits
|
||||
#
|
||||
fatal_error "The mark layout does not permit resetting of events" unless $mark & 0xffffffff;
|
||||
#
|
||||
# Reset the event mark bit
|
||||
#
|
||||
perl_action_helper( 'INLINE', '-j MARK --and-mark '. in_hex( (~ $mark ) & 0xffffffff ) );
|
||||
|
||||
$mark = in_hex $mark;
|
||||
#
|
||||
# Mark the packet if event is armed
|
||||
#
|
||||
if ( $destination eq 'dst' ) {
|
||||
perl_action_helper( 'INLINE', "-m recent --rcheck ${duration}--hitcount $hitcount --name $event --rdest -j MARK --or-mark $mark" );
|
||||
} else {
|
||||
perl_action_helper( 'INLINE', "-m recent --rcheck ${duration}--hitcount $hitcount --name $event --rsource -j MARK --or-mark $mark" );
|
||||
}
|
||||
#
|
||||
# if the event is armed, remove it and perform the action
|
||||
#
|
||||
perl_action_helper( $action , "-m mark --mark $mark/$mark -m recent --remove --name $event" );
|
||||
} elsif ( $command eq 'update' ) {
|
||||
perl_action_helper( $action, "-m recent --update ${duration}--hitcount $hitcount --name $event" );
|
||||
} else {
|
||||
perl_action_helper( $action, "-m recent --rcheck ${duration}--hitcount $hitcount --name $event" );
|
||||
}
|
||||
|
||||
1;
|
||||
|
||||
?end perl
|
||||
@ -1,86 +0,0 @@
|
||||
#
|
||||
# Shorewall version 4 - Perform an Action based on a Trigger
|
||||
#
|
||||
# /etc/shorewall/action.IfTrigger
|
||||
#
|
||||
# Parameters:
|
||||
# Trigger: Must start with a letter and be composed of letters, digits, '-', and '_'.
|
||||
# Action: Anything that can appear in the ACTION column of a rule.
|
||||
# Time Limit: Amount of time the trigger is to remain armed in seconds"
|
||||
# Hit Count: Number of packets seen within the Timelimit -- default is 1
|
||||
# Src or Dest: 'src' (default) or 'dst'. Determines if the trigger is associated with the source
|
||||
# address (src) or destination address (dst)
|
||||
# Reset/update: '-' (default) 'reset', or 'update'. If 'reset', the trigger will be reset before
|
||||
# the Action is taken. If 'update', the timestamp associated with the trigger will
|
||||
# be updated and the action taken if the time limit/hitcount are matched.
|
||||
# If '-', the action will be taken if the limit/hitcount are matched but the
|
||||
# trigger's timestamp will not be updated.
|
||||
# Disposition: Disposition for any event generated.
|
||||
#
|
||||
#######################################################################################################
|
||||
# DO NOT REMOVE THE FOLLOWING LINE
|
||||
?format 2
|
||||
#################################################################################################################################################################################################
|
||||
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH HELPER
|
||||
# PORT PORT(S) DEST LIMIT GROUP
|
||||
|
||||
DEFAULTS -,ACCEPT,60,1,src,check,-
|
||||
|
||||
?begin perl
|
||||
|
||||
use Shorewall::Config qw(:DEFAULT :internal);
|
||||
use Shorewall::Chains;
|
||||
use Shorewall::Rules;
|
||||
use strict;
|
||||
|
||||
my ( $trigger, $action, $timeout, $hitcount, $destination, $reset, $disposition ) = get_action_params( 7 );
|
||||
|
||||
fatal_error "A trigger name is required" unless supplied $trigger;
|
||||
fatal_error "Invalid trigger name ($trigger)" unless $trigger =~ /^[a-zA-z][-\w]*$/;
|
||||
fatal_error "Invalid time limit ($timeout)" unless $timeout =~ /^\d+$/;
|
||||
fatal_error "Invalid hit count ($hitcount)" unless $hitcount =~ /^\d+$/;
|
||||
fatal_error "Invalid Src or Dest ($destination)" unless $destination =~ /^(?:src|dst)$/;
|
||||
fatal_error "Invalid reset flag ($reset)" unless $reset =~ /^(?:reset|update|check)$/;
|
||||
|
||||
set_action_disposition( $disposition) if supplied $disposition;
|
||||
set_action_name_to_caller;
|
||||
|
||||
require_capability 'RECENT_MATCH', 'Use of triggers', 's';
|
||||
|
||||
if ( $reset eq 'reset' ) {
|
||||
require_capability 'MARK_ANYWHERE', 'Resetting a trigger', 's';
|
||||
|
||||
print "Resetting....\n";
|
||||
|
||||
my $mark = $globals{TRIGGER_MARK};
|
||||
#
|
||||
# The trigger mark bit must be within 32 bits
|
||||
#
|
||||
fatal_error "The mark layout does not permit resetting of triggers" unless $mark & 0xffffffff;
|
||||
#
|
||||
# Reset the trigger mark bit
|
||||
#
|
||||
perl_action_helper( 'INLINE', '-j MARK --and-mark '. in_hex( (~ $mark ) & 0xffffffff ) );
|
||||
|
||||
$mark = in_hex $mark;
|
||||
#
|
||||
# Mark the packet if trigger is armed
|
||||
#
|
||||
if ( $destination eq 'dst' ) {
|
||||
perl_action_helper( 'INLINE', "-m recent --rcheck --seconds $timeout --hitcount $hitcount --name $trigger --rdest -j MARK --or-mark $mark" );
|
||||
} else {
|
||||
perl_action_helper( 'INLINE', "-m recent --rcheck --seconds $timeout --hitcount $hitcount --name $trigger --rsource -j MARK --or-mark $mark" );
|
||||
}
|
||||
#
|
||||
# if the trigger is armed, remove it and perform the action
|
||||
#
|
||||
perl_action_helper( $action , "-m mark --mark $mark/$mark -m recent --remove --name $trigger" );
|
||||
} elsif ( $reset eq 'update' ) {
|
||||
perl_action_helper( $action, "-m recent --update --seconds $timeout --hitcount $hitcount --name $trigger" );
|
||||
} else {
|
||||
perl_action_helper( $action, "-m recent --rcheck --seconds $timeout --hitcount $hitcount --name $trigger" );
|
||||
}
|
||||
|
||||
1;
|
||||
|
||||
?end perl
|
||||
51
Shorewall/action.ResetEvent
Normal file
51
Shorewall/action.ResetEvent
Normal file
@ -0,0 +1,51 @@
|
||||
#
|
||||
# Shorewall version 4 - Reset an Event
|
||||
#
|
||||
# /etc/shorewall/action.ResetEvent
|
||||
#
|
||||
# Parameters:
|
||||
# Event: Must start with a letter and be composed of letters, digits, '-', and '_'.
|
||||
# Action: Action to perform after setting the event. Default is ACCEPT
|
||||
# Src or Dest: 'src' (default) or 'dst'. Determines if the event is associated with the source
|
||||
# address (src) or destination address (dst)
|
||||
# Disposition: Disposition for any rule generated.
|
||||
#
|
||||
# For additional information, see http://www.shorewall.net/Events.html
|
||||
#
|
||||
#######################################################################################################
|
||||
# DO NOT REMOVE THE FOLLOWING LINE
|
||||
?format 2
|
||||
#################################################################################################################################################################################################
|
||||
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH HELPER
|
||||
# PORT PORT(S) DEST LIMIT GROUP
|
||||
|
||||
DEFAULTS -,ACCEPT,src,-
|
||||
|
||||
?begin perl
|
||||
|
||||
use Shorewall::Config;
|
||||
use Shorewall::Chains;
|
||||
use Shorewall::Rules;
|
||||
use strict;
|
||||
|
||||
my ( $event, $action, $destination, $disposition ) = get_action_params( 4 );
|
||||
|
||||
require_capability 'RECENT_MATCH', 'Use of events', 's';
|
||||
require_capability 'MARK_ANYWHERE', 'Use of events', 's';
|
||||
|
||||
fatal_error "An event name is required" unless supplied $event;
|
||||
fatal_error "Invalid event name ($event)" unless $event =~ /^[a-zA-z][-\w]*$/;
|
||||
fatal_error "Invalid Src or Dest ($destination)" unless $destination =~ /^(?:src|dst)$/;
|
||||
|
||||
set_action_disposition( $disposition) if supplied $disposition;
|
||||
set_action_name_to_caller;
|
||||
|
||||
if ( $destination eq 'dst' ) {
|
||||
perl_action_helper( $action, "-m recent --name $event --remove --rdest" );
|
||||
} else {
|
||||
perl_action_helper( $action, "-m recent --name $event --remove --rsource" );
|
||||
}
|
||||
|
||||
1;
|
||||
|
||||
?end perl
|
||||
@ -1,49 +0,0 @@
|
||||
#
|
||||
# Shorewall version 4 - Reset a Trigger
|
||||
#
|
||||
# /etc/shorewall/action.ResetTrigger
|
||||
#
|
||||
# Parameters:
|
||||
# Trigger: Must start with a letter and be composed of letters, digits, '-', and '_'.
|
||||
# Action: Action to perform after setting the trigger. Default is ACCEPT
|
||||
# Src or Dest: 'src' (default) or 'dst'. Determines if the trigger is associated with the source
|
||||
# address (src) or destination address (dst)
|
||||
# Disposition: Disposition for any event generated.
|
||||
#
|
||||
#######################################################################################################
|
||||
# DO NOT REMOVE THE FOLLOWING LINE
|
||||
?format 2
|
||||
#################################################################################################################################################################################################
|
||||
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH HELPER
|
||||
# PORT PORT(S) DEST LIMIT GROUP
|
||||
|
||||
DEFAULTS -,ACCEPT,src,-
|
||||
|
||||
?begin perl
|
||||
|
||||
use Shorewall::Config;
|
||||
use Shorewall::Chains;
|
||||
use Shorewall::Rules;
|
||||
use strict;
|
||||
|
||||
my ( $trigger, $action, $destination, $disposition ) = get_action_params( 4 );
|
||||
|
||||
require_capability 'RECENT_MATCH', 'Use of triggers', 's';
|
||||
require_capability 'MARK_ANYWHERE', 'Use of triggers', 's';
|
||||
|
||||
fatal_error "A trigger name is required" unless supplied $trigger;
|
||||
fatal_error "Invalid trigger name ($trigger)" unless $trigger =~ /^[a-zA-z][-\w]*$/;
|
||||
fatal_error "Invalid Src or Dest ($destination)" unless $destination =~ /^(?:src|dst)$/;
|
||||
|
||||
set_action_disposition( $disposition) if supplied $disposition;
|
||||
set_action_name_to_caller;
|
||||
|
||||
if ( $destination eq 'dst' ) {
|
||||
perl_action_helper( $action, "-m recent --name $trigger --remove --rdest" );
|
||||
} else {
|
||||
perl_action_helper( $action, "-m recent --name $trigger --remove --rsource" );
|
||||
}
|
||||
|
||||
1;
|
||||
|
||||
?end perl
|
||||
51
Shorewall/action.SetEvent
Normal file
51
Shorewall/action.SetEvent
Normal file
@ -0,0 +1,51 @@
|
||||
#
|
||||
# Shorewall version 4 - Set an Event
|
||||
#
|
||||
# /etc/shorewall/action.SetEvent
|
||||
#
|
||||
# Parameters:
|
||||
# Event: Must start with a letter and be composed of letters, digits, '-', and '_'.
|
||||
# Action: Action to perform after setting the event. Default is ACCEPT
|
||||
# Src or Dest: 'src' (default) or 'dst'. Determines if the event is associated with the source
|
||||
# address (src) or destination address (dst)
|
||||
# Disposition: Disposition for any event generated.
|
||||
#
|
||||
# For additional information, see http://www.shorewall.net/Events.html
|
||||
#
|
||||
#######################################################################################################
|
||||
# DO NOT REMOVE THE FOLLOWING LINE
|
||||
?format 2
|
||||
#################################################################################################################################################################################################
|
||||
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH HELPER
|
||||
# PORT PORT(S) DEST LIMIT GROUP
|
||||
|
||||
DEFAULTS -,ACCEPT,src
|
||||
|
||||
?begin perl
|
||||
|
||||
use Shorewall::Config;
|
||||
use Shorewall::Chains;
|
||||
use Shorewall::Rules;
|
||||
use strict;
|
||||
|
||||
my ( $event, $action, $destination, $disposition ) = get_action_params( 4 );
|
||||
|
||||
require_capability 'RECENT_MATCH', 'Use of events', 's';
|
||||
require_capability 'MARK_ANYWHERE', 'Use of events', 's';
|
||||
|
||||
fatal_error "An event name is required" unless supplied $event;
|
||||
fatal_error "Invalid event name ($event)" unless $event =~ /^[a-zA-z][-\w]*$/;
|
||||
fatal_error "Invalid Src or Dest ($destination)" unless $destination =~ /^(?:src|dst)$/;
|
||||
|
||||
set_action_disposition( $disposition) if supplied $disposition;
|
||||
set_action_name_to_caller;
|
||||
|
||||
if ( $destination eq 'dst' ) {
|
||||
perl_action_helper( $action, "-m recent --name $event --set --rdest" );
|
||||
} else {
|
||||
perl_action_helper( $action, "-m recent --name $event --set --rsource" );
|
||||
}
|
||||
|
||||
1;
|
||||
|
||||
?end perl
|
||||
@ -1,49 +0,0 @@
|
||||
#
|
||||
# Shorewall version 4 - Set a Trigger
|
||||
#
|
||||
# /etc/shorewall/action.SetTrigger
|
||||
#
|
||||
# Parameters:
|
||||
# Trigger: Must start with a letter and be composed of letters, digits, '-', and '_'.
|
||||
# Action: Action to perform after setting the trigger. Default is ACCEPT
|
||||
# Src or Dest: 'src' (default) or 'dst'. Determines if the trigger is associated with the source
|
||||
# address (src) or destination address (dst)
|
||||
# Disposition: Disposition for any event generated.
|
||||
#
|
||||
#######################################################################################################
|
||||
# DO NOT REMOVE THE FOLLOWING LINE
|
||||
?format 2
|
||||
#################################################################################################################################################################################################
|
||||
#ACTION SOURCE DEST PROTO DEST SOURCE ORIGINAL RATE USER/ MARK CONNLIMIT TIME HEADERS SWITCH HELPER
|
||||
# PORT PORT(S) DEST LIMIT GROUP
|
||||
|
||||
DEFAULTS -,ACCEPT,src
|
||||
|
||||
?begin perl
|
||||
|
||||
use Shorewall::Config;
|
||||
use Shorewall::Chains;
|
||||
use Shorewall::Rules;
|
||||
use strict;
|
||||
|
||||
my ( $trigger, $action, $destination, $disposition ) = get_action_params( 4 );
|
||||
|
||||
require_capability 'RECENT_MATCH', 'Use of triggers', 's';
|
||||
require_capability 'MARK_ANYWHERE', 'Use of triggers', 's';
|
||||
|
||||
fatal_error "A trigger name is required" unless supplied $trigger;
|
||||
fatal_error "Invalid trigger name ($trigger)" unless $trigger =~ /^[a-zA-z][-\w]*$/;
|
||||
fatal_error "Invalid Src or Dest ($destination)" unless $destination =~ /^(?:src|dst)$/;
|
||||
|
||||
set_action_disposition( $disposition) if supplied $disposition;
|
||||
set_action_name_to_caller;
|
||||
|
||||
if ( $destination eq 'dst' ) {
|
||||
perl_action_helper( $action, "-m recent --name $trigger --set --rdest" );
|
||||
} else {
|
||||
perl_action_helper( $action, "-m recent --name $trigger --set --rsource" );
|
||||
}
|
||||
|
||||
1;
|
||||
|
||||
?end perl
|
||||
@ -33,14 +33,14 @@ Drop # Default Action for DROP policy
|
||||
dropInvalid inline # Drops packets in the INVALID conntrack state
|
||||
DropSmurfs noinline # Drop smurf packets
|
||||
Established inline # Handles packets in the ESTABLISHED state
|
||||
IfTrigger noinline # Perform an action if a trigger is set
|
||||
IfEvent noinline # Perform an action based on an event
|
||||
Invalid inline # Handles packets in the INVALID conntrack state
|
||||
New inline # Handles packets in the NEW conntrack state
|
||||
NotSyn inline # Handles TCP packets which do not have SYN=1 and ACK=0
|
||||
Reject # Default Action for REJECT policy
|
||||
Related inline # Handles packets in the RELATED conntrack state
|
||||
ResetTrigger inline # Reset a Trigger
|
||||
ResetEvent inline # Reset an Event
|
||||
RST inline # Handle packets with RST set
|
||||
SetTrigger inline # Set a trigger for the packet's source IP
|
||||
SetEvent inline # Initialize an event
|
||||
TCPFlags # Handle bad flag combinations.
|
||||
Untracked inline # Handles packets in the UNTRACKED conntrack state
|
||||
|
||||
@ -18,7 +18,7 @@
|
||||
<pubdate><?dbtimestamp format="Y/m/d"?></pubdate>
|
||||
|
||||
<copyright>
|
||||
<year>2001-2012</year>
|
||||
<year>2001-2013</year>
|
||||
|
||||
<holder>Thomas M. Eastep</holder>
|
||||
</copyright>
|
||||
@ -271,9 +271,7 @@
|
||||
</row>
|
||||
|
||||
<row>
|
||||
<entry><ulink url="ECN.html"><ulink
|
||||
url="shorewall_extension_scripts.htm">Extension Scripts</ulink>
|
||||
(User Exits)</ulink></entry>
|
||||
<entry><ulink url="Events.html">Events</ulink></entry>
|
||||
|
||||
<entry><ulink url="PacketMarking.html">Packet
|
||||
Marking</ulink></entry>
|
||||
@ -282,8 +280,9 @@
|
||||
</row>
|
||||
|
||||
<row>
|
||||
<entry><ulink
|
||||
url="fallback.htm">Fallback/Uninstall</ulink></entry>
|
||||
<entry><ulink url="ECN.html"><ulink
|
||||
url="shorewall_extension_scripts.htm">Extension Scripts</ulink>
|
||||
(User Exits)</ulink></entry>
|
||||
|
||||
<entry><ulink url="PacketHandling.html">Packet Processing in a
|
||||
Shorewall-based Firewall</ulink></entry>
|
||||
@ -292,7 +291,8 @@
|
||||
</row>
|
||||
|
||||
<row>
|
||||
<entry><ulink url="FAQ.htm">FAQs</ulink></entry>
|
||||
<entry><ulink
|
||||
url="fallback.htm">Fallback/Uninstall</ulink></entry>
|
||||
|
||||
<entry><ulink url="ping.html">'Ping' Management</ulink></entry>
|
||||
|
||||
@ -301,8 +301,7 @@
|
||||
</row>
|
||||
|
||||
<row>
|
||||
<entry><ulink
|
||||
url="shorewall_features.htm">Features</ulink></entry>
|
||||
<entry><ulink url="FAQ.htm">FAQs</ulink></entry>
|
||||
|
||||
<entry><ulink url="two-interface.htm#DNAT">Port
|
||||
Forwarding</ulink></entry>
|
||||
@ -312,8 +311,8 @@
|
||||
</row>
|
||||
|
||||
<row>
|
||||
<entry><ulink url="Multiple_Zones.html">Forwarding Traffic on the
|
||||
Same Interface</ulink></entry>
|
||||
<entry><ulink
|
||||
url="shorewall_features.htm">Features</ulink></entry>
|
||||
|
||||
<entry><ulink url="ports.htm">Port Information</ulink></entry>
|
||||
|
||||
@ -321,11 +320,21 @@
|
||||
Xen Dom0</ulink></entry>
|
||||
</row>
|
||||
|
||||
<row>
|
||||
<entry><ulink url="Multiple_Zones.html">Forwarding Traffic on the
|
||||
Same Interface</ulink></entry>
|
||||
|
||||
<entry><ulink url="PortKnocking.html">Port Knocking
|
||||
(deprecated)</ulink></entry>
|
||||
|
||||
<entry></entry>
|
||||
</row>
|
||||
|
||||
<row>
|
||||
<entry><ulink url="FTP.html">FTP and Shorewall</ulink></entry>
|
||||
|
||||
<entry><ulink url="PortKnocking.html">Port Knocking and Other Uses
|
||||
of the 'Recent Match'</ulink></entry>
|
||||
<entry><ulink url="Events.html">Port Knocking, Auto Blacklisting
|
||||
and Other Uses of the 'Recent Match'</ulink></entry>
|
||||
|
||||
<entry></entry>
|
||||
</row>
|
||||
@ -406,8 +415,7 @@
|
||||
<entry><ulink url="Shorewall_and_Kazaa.html">Kazaa
|
||||
Filtering</ulink></entry>
|
||||
|
||||
<entry><ulink url="Shorewall-init.html">Shorewall
|
||||
Init</ulink></entry>
|
||||
<entry><ulink url="Events.html">Shorewall Events</ulink></entry>
|
||||
|
||||
<entry></entry>
|
||||
</row>
|
||||
@ -416,8 +424,8 @@
|
||||
<entry><ulink url="kernel.htm">Kernel
|
||||
Configuration</ulink></entry>
|
||||
|
||||
<entry><ulink url="Shorewall-Lite.html">Shorewall
|
||||
Lite</ulink></entry>
|
||||
<entry><ulink url="Shorewall-init.html">Shorewall
|
||||
Init</ulink></entry>
|
||||
|
||||
<entry></entry>
|
||||
</row>
|
||||
@ -426,7 +434,8 @@
|
||||
<entry><ulink url="KVM.html">KVM (Kernel-mode Virtual
|
||||
Machine)</ulink></entry>
|
||||
|
||||
<entry></entry>
|
||||
<entry><ulink url="Shorewall-Lite.html">Shorewall
|
||||
Lite</ulink></entry>
|
||||
|
||||
<entry></entry>
|
||||
</row>
|
||||
|
||||
509
docs/Events.xml
Normal file
509
docs/Events.xml
Normal file
@ -0,0 +1,509 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<!DOCTYPE article PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
|
||||
"http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd">
|
||||
<article>
|
||||
<!--$Id$-->
|
||||
|
||||
<articleinfo>
|
||||
<title>Shorewall Events</title>
|
||||
|
||||
<authorgroup>
|
||||
<author>
|
||||
<firstname>Tom</firstname>
|
||||
|
||||
<surname>Eastep</surname>
|
||||
</author>
|
||||
</authorgroup>
|
||||
|
||||
<pubdate><?dbtimestamp format="Y/m/d"?></pubdate>
|
||||
|
||||
<copyright>
|
||||
<year>2013</year>
|
||||
|
||||
<holder>Thomas M. Eastep</holder>
|
||||
</copyright>
|
||||
|
||||
<legalnotice>
|
||||
<para>Permission is granted to copy, distribute and/or modify this
|
||||
document under the terms of the GNU Free Documentation License, Version
|
||||
1.2 or any later version published by the Free Software Foundation; with
|
||||
no Invariant Sections, with no Front-Cover, and with no Back-Cover
|
||||
Texts. A copy of the license is included in the section entitled
|
||||
<quote><ulink url="GnuCopyright.htm">GNU Free Documentation
|
||||
License</ulink></quote>.</para>
|
||||
</legalnotice>
|
||||
</articleinfo>
|
||||
|
||||
<caution>
|
||||
<para>This article applies to Shorewall 4.5.19 and later and supercedes
|
||||
<ulink url="PortKnocking.html">this article.</ulink></para>
|
||||
</caution>
|
||||
|
||||
<section>
|
||||
<title>Overview</title>
|
||||
|
||||
<para>Shorewall events were introduced in Shorewall 4.5.19 and provide a
|
||||
high-level interface to the Netfilter<firstterm> recent match</firstterm>
|
||||
capability. An event is actually a list of (IP address, timestamp) pairs,
|
||||
and can be tested in a number of different ways:</para>
|
||||
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>Has event E ever occurred for IP address A (is the IP address in
|
||||
the list)? </para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>Has event E occurred M or more times for IP address A?</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>Has Event E occurred in the last N seconds for IP Address A (is
|
||||
there an entry for the address with a timestamp falling within the
|
||||
last N seconds)?</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>Has Event E occurred M or more times in the last N seconds for
|
||||
IP address A (are there M or more entries for the address with
|
||||
timestamps falling within the last N seconds)?</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
|
||||
<para>The event interface is implemented as three parameterized Shorewall
|
||||
<ulink url="Actions.html">Actions</ulink>:</para>
|
||||
|
||||
<variablelist>
|
||||
<varlistentry>
|
||||
<term>SetEvent</term>
|
||||
|
||||
<listitem>
|
||||
<para>This action initializes an event list for either the source or
|
||||
destination IP address in the current packets. The list will contain
|
||||
a single entry for the address that will have the current
|
||||
timestamp.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>ResetEvent</term>
|
||||
|
||||
<listitem>
|
||||
<para>This action removes all entries for either the source or
|
||||
destination IP address from an event list.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>IfEvent</term>
|
||||
|
||||
<listitem>
|
||||
<para>This action tests an event in one of the ways listed above,
|
||||
and performs an action based on the result.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
</variablelist>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<title>Details</title>
|
||||
|
||||
<para>Because these are parameterized actions, optional parameters may be
|
||||
omitted. Trailing omitted parameters may be omitted entirely while
|
||||
embedded omitted parameters are represented by a hyphen ("-").</para>
|
||||
|
||||
<para>Each event is given a name. Event names:</para>
|
||||
|
||||
<itemizedlist>
|
||||
<listitem>
|
||||
<para>Must begin with a letter.</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>May be composed of letters, digits, hyphens ('-') or underscores
|
||||
('_').</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>May be at most 29 characters in length.</para>
|
||||
</listitem>
|
||||
</itemizedlist>
|
||||
|
||||
<section>
|
||||
<title>SetEvent</title>
|
||||
|
||||
<para><emphasis role="bold">SetEvent</emphasis>(
|
||||
<replaceable>event</replaceable>, [ <replaceable>action</replaceable> ],
|
||||
[ <replaceable>src-dst</replaceable> ], [
|
||||
<replaceable>disposition</replaceable> ] )</para>
|
||||
|
||||
<variablelist>
|
||||
<varlistentry>
|
||||
<term>event</term>
|
||||
|
||||
<listitem>
|
||||
<para>Name of the event.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>action</term>
|
||||
|
||||
<listitem>
|
||||
<para>An action to perform after the event is initialized. May be
|
||||
any action that may appear in the ACTION column of <ulink
|
||||
url="manpages/shorewall-rules.html">shorewall-rules</ulink> (5).
|
||||
If no action is to be performed, use COUNT.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>src-dst</term>
|
||||
|
||||
<listitem>
|
||||
<para>Specifies whether the source IP address (<emphasis
|
||||
role="bold">src</emphasis>) or destination IP address (<emphasis
|
||||
role="bold">dst</emphasis>) is to be added to the event. The
|
||||
default is <emphasis role="bold">src</emphasis>.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>disposition</term>
|
||||
|
||||
<listitem>
|
||||
<para>If the <replaceable>action</replaceable> involves logging,
|
||||
then this parameter specifies the disposition that will appear in
|
||||
the log entry prefix. If no <replaceable>disposition</replaceable>
|
||||
is given, the log prefix is determines normally. The default is
|
||||
ACCEPT.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
</variablelist>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<title>ResetEvent</title>
|
||||
|
||||
<para><emphasis role="bold">ResetEvent</emphasis>(
|
||||
<replaceable>event</replaceable>, [ <replaceable>action</replaceable> ],
|
||||
[ <replaceable>src-dst</replaceable> ], [
|
||||
<replaceable>disposition</replaceable> ] )</para>
|
||||
|
||||
<variablelist>
|
||||
<varlistentry>
|
||||
<term>event</term>
|
||||
|
||||
<listitem>
|
||||
<para>Name of the event.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>action</term>
|
||||
|
||||
<listitem>
|
||||
<para>An action to perform after the event is reset. May be any
|
||||
action that may appear in the ACTION column of <ulink
|
||||
url="manpages/shorewall-rules.html">shorewall-rules</ulink> (5).
|
||||
If no action is to be performed, use COUNT. The default is
|
||||
ACCEPT.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>src-dst</term>
|
||||
|
||||
<listitem>
|
||||
<para>Specifies whether the source IP address (<emphasis
|
||||
role="bold">src</emphasis>) or destination IP address (<emphasis
|
||||
role="bold">dst</emphasis>) is to be removed from the event. The
|
||||
default is <emphasis role="bold">src</emphasis>.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>disposition</term>
|
||||
|
||||
<listitem>
|
||||
<para>If the <replaceable>action</replaceable> involves logging,
|
||||
then this parameter specifies the disposition that will appear in
|
||||
the log entry prefix. If no <replaceable>disposition</replaceable>
|
||||
is given, the log prefix is determines normally.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
</variablelist>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<title>IfEvent</title>
|
||||
|
||||
<para><emphasis role="bold">IfEvent</emphasis>(
|
||||
<replaceable>event</replaceable>, [ <replaceable>action</replaceable> ],
|
||||
[ <replaceable>duration</replaceable> ], [
|
||||
<replaceable>hitcount</replaceable> ], [
|
||||
<replaceable>src-dst</replaceable>], [
|
||||
<replaceable>command</replaceable> ], [
|
||||
<replaceable>disposition</replaceable> ] )</para>
|
||||
|
||||
<variablelist>
|
||||
<varlistentry>
|
||||
<term>event</term>
|
||||
|
||||
<listitem>
|
||||
<para>Name of the event.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>action</term>
|
||||
|
||||
<listitem>
|
||||
<para>An action to perform if the test succeeds. May be any action
|
||||
that may appear in the ACTION column of <ulink
|
||||
url="manpages/shorewall-rules.html">shorewall-rules</ulink> (5).
|
||||
The default is ACCEPT.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>duration</term>
|
||||
|
||||
<listitem>
|
||||
<para>Number of seconds over which the event is to be tested. If
|
||||
not specified, the test is not constrained by time.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>hitcount</term>
|
||||
|
||||
<listitem>
|
||||
<para>Specifies the minimum number of packets required for the
|
||||
test to succeed. If not specified, 1 packet is assumed.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>src-dst</term>
|
||||
|
||||
<listitem>
|
||||
<para>Specifies whether the source IP address (<emphasis
|
||||
role="bold">src</emphasis>) or destination IP address (<emphasis
|
||||
role="bold">dst</emphasis>) is to be tested. The default is
|
||||
<emphasis role="bold">src</emphasis>.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>command</term>
|
||||
|
||||
<listitem>
|
||||
<para>May be one of the following:</para>
|
||||
|
||||
<variablelist>
|
||||
<varlistentry>
|
||||
<term>check</term>
|
||||
|
||||
<listitem>
|
||||
<para>Simply test if the
|
||||
<replaceable>duration</replaceable>/<replaceable>hitcount</replaceable>
|
||||
test is satisfied. If so, the
|
||||
<replaceable>action</replaceable> is performed.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>reset</term>
|
||||
|
||||
<listitem>
|
||||
<para>Like <emphasis role="bold">check</emphasis>. If the
|
||||
test succeeds, the <replaceable>event</replaceable> will be
|
||||
reset before the <replaceable>action</replaceable> is
|
||||
taken.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>update</term>
|
||||
|
||||
<listitem>
|
||||
<para>Like <emphasis role="bold">check</emphasis>.
|
||||
Regardless of whether the test succeeds, an entry with the
|
||||
current time and for the <replaceable>src-dst</replaceable>
|
||||
iP address will be added to the
|
||||
<replaceable>event</replaceable>.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>checkreap</term>
|
||||
|
||||
<listitem>
|
||||
<para>Requires a <replaceable>duration</replaceable>. Like
|
||||
<emphasis role="bold">check</emphasis> but regardless of
|
||||
whether the test succeeds, entries for the
|
||||
<replaceable>src-dst</replaceable> IP address that are older
|
||||
than <replaceable>duration</replaceable> seconds will be
|
||||
deleted from the <replaceable>event</replaceable>.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>updatereap</term>
|
||||
|
||||
<listitem>
|
||||
<para>Requires a <replaceable>duration</replaceable>. Like
|
||||
<emphasis role="bold">update</emphasis> but regardless of
|
||||
whether the test succeeds, entries for the
|
||||
<replaceable>src-dst</replaceable> IP address that are older
|
||||
than <replaceable>duration</replaceable> seconds will be
|
||||
deleted from the <replaceable>event</replaceable>.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
</variablelist>
|
||||
|
||||
<para>The default is <emphasis
|
||||
role="bold">check</emphasis>.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>disposition</term>
|
||||
|
||||
<listitem>
|
||||
<para>If the <replaceable>action</replaceable> involves logging,
|
||||
then this parameter specifies the disposition that will appear in
|
||||
the log entry prefix. If no <replaceable>disposition</replaceable>
|
||||
is given, the log prefix is determines normally.</para>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
</variablelist>
|
||||
</section>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<title>Examples</title>
|
||||
|
||||
<section>
|
||||
<title>Automatic Blacklisting</title>
|
||||
|
||||
<para>This example is taken from <ulink
|
||||
url="http://www.briandowney.net/blog/2009/08/20/firewalling-brute-force-attempts-with-iptables/">this
|
||||
article</ulink> which explains the nice benifits of this approach. This
|
||||
example is for ssh, but it can be adapted for any application.</para>
|
||||
|
||||
<para>The name SSH has been changed to SSHLIMIT so as not to override
|
||||
the Shorewall macro of the same name.</para>
|
||||
|
||||
<para><filename>/etc/shorewall/actions</filename>:</para>
|
||||
|
||||
<programlisting>#ACTION OPTION DESCRIPTION
|
||||
SSHLIMIT #Automatically blacklist hosts who exceed SSH connection limits
|
||||
SSH_BLACKLIST #Helper for SSH</programlisting>
|
||||
|
||||
<para><filename>/etc/shorewall/action.SSH_BLACKLIST</filename>:</para>
|
||||
|
||||
<programlisting>#
|
||||
# Shorewall version 4 - SSH_BLACKLIST Action
|
||||
#
|
||||
?format 2
|
||||
###############################################################################
|
||||
#TARGET SOURCE DEST PROTO DPORT SPORT
|
||||
#
|
||||
# Log the Reject
|
||||
#
|
||||
LOG:$LOG:REJECT
|
||||
#
|
||||
# And set the SSH_COUNTER trigger for the SOURCE IP address
|
||||
#
|
||||
SetEvent(SSH_COUNTER,REJECT,src)</programlisting>
|
||||
|
||||
<para><filename>/etc/shorewall/action.SSH</filename>LIMIT:</para>
|
||||
|
||||
<programlisting>#
|
||||
# Shorewall version 4 - SSHLIMIT Action
|
||||
#
|
||||
?format 2
|
||||
###############################################################################
|
||||
#TARGET SOURCE DEST PROTO DPORT SPORT
|
||||
#
|
||||
# Silently reject the client if blacklisted
|
||||
#
|
||||
IfEvent(SSH_COUNTER,REJECT,300,1)
|
||||
#
|
||||
# Blacklist if 5 attempts in the last minute
|
||||
#
|
||||
IfEvent(SSH,SSH_BLACKLIST,60,5,src,checkreap)
|
||||
#
|
||||
# Log and reject if the client has tried to connect
|
||||
# in the last two seconds
|
||||
#
|
||||
IfEvent(SSH,REJECT:$LOG:,2,1,-,update,Added)
|
||||
#
|
||||
# Un-blacklist the client
|
||||
#
|
||||
ResetEvent(SSH_COUNTER,LOG:$LOG,-,Removed)
|
||||
#
|
||||
# Set the 'SSH' trigger and accept the connection
|
||||
#
|
||||
SetEvent(SSH,ACCEPT,src)</programlisting>
|
||||
|
||||
<para><filename>etc/shorewall/rules</filename>:</para>
|
||||
|
||||
<programlisting>#ACTION SOURCE DEST PROTO DEST
|
||||
# PORT(S)
|
||||
SSHLIMIT net $FW tcp 22 </programlisting>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
<title>Port Knocking</title>
|
||||
|
||||
<para>This example shows a different implementation of the one shown in
|
||||
the <ulink url="PortKnocking.html">Port Knocking</ulink> article.</para>
|
||||
|
||||
<para>In this example:</para>
|
||||
|
||||
<orderedlist>
|
||||
<listitem>
|
||||
<para>Attempting to connect to port 1600 enables SSH access. Access
|
||||
is enabled for 60 seconds.</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>Attempting to connect to port 1601 disables SSH access (note
|
||||
that in the article linked above, attempting to connect to port 1599
|
||||
also disables access. This is an port scan defence as explained in
|
||||
the article).</para>
|
||||
</listitem>
|
||||
</orderedlist>
|
||||
|
||||
<para>To implement that approach:</para>
|
||||
|
||||
<para><filename>/etc/shorewall/actions</filename>:</para>
|
||||
|
||||
<programlisting>#ACTION OPTION DESCRIPTION
|
||||
Knock #Port Knocking</programlisting>
|
||||
|
||||
<para><filename>/etc/shorewall/action.Knock</filename>:</para>
|
||||
|
||||
<programlisting>#
|
||||
# Shorewall version 4 - SSH_BLACKLIST Action
|
||||
#
|
||||
?format 2
|
||||
###############################################################################
|
||||
#ACTION SOURCE DEST PROTO DEST
|
||||
# PORT(S)
|
||||
IfEvent(SSH,ACCEPT:info,60,1,src,reset)\
|
||||
- - tcp 22
|
||||
SetEvent(SSH,ACCEPT) - - tcp 1600
|
||||
ResetEvent(SSH,DROP:info) </programlisting>
|
||||
|
||||
<para><filename>etc/shorewall/rules</filename>:</para>
|
||||
|
||||
<programlisting>#ACTION SOURCE DEST PROTO DEST
|
||||
# PORT(S)
|
||||
Knock net $FW tcp 22,1599-1601 </programlisting>
|
||||
</section>
|
||||
</section>
|
||||
</article>
|
||||
@ -24,6 +24,8 @@
|
||||
|
||||
<year>2009</year>
|
||||
|
||||
<year>2013</year>
|
||||
|
||||
<holder>Thomas M. Eastep</holder>
|
||||
</copyright>
|
||||
|
||||
@ -38,6 +40,11 @@
|
||||
</legalnotice>
|
||||
</articleinfo>
|
||||
|
||||
<note>
|
||||
<para>The techniques described in this article were superceded in
|
||||
Shorewall 4.5.19 with the introduction of Shorewall Events.</para>
|
||||
</note>
|
||||
|
||||
<note>
|
||||
<para>The feature described in this article require '<ulink
|
||||
url="http://snowman.net/projects/ipt_recent/">Recent Match</ulink>' in
|
||||
|
||||
@ -66,6 +66,11 @@
|
||||
existing connections.</para>
|
||||
</listitem>
|
||||
</orderedlist>
|
||||
|
||||
<important>
|
||||
<para>For automatic blacklisting based on exceeding defined threshholds,
|
||||
see <ulink url="Events.html">Events</ulink>.</para>
|
||||
</important>
|
||||
</section>
|
||||
|
||||
<section>
|
||||
|
||||
Loading…
Reference in New Issue
Block a user