forked from extern/shorewall_code
Centralize iptables knowledge in the Chains module -- first phase
Signed-off-by: Tom Eastep <teastep@shorewall.net> git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@9742 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
teastep
parent
cc5c6b40aa
commit
d9622dabfe
@ -144,6 +144,8 @@ our %EXPORT_TAGS = (
|
||||
log_rule
|
||||
expand_rule
|
||||
addnatjump
|
||||
set_chain_variables
|
||||
mark_firewall_not_started
|
||||
get_interface_address
|
||||
get_interface_addresses
|
||||
get_interface_bcasts
|
||||
@ -152,6 +154,7 @@ our %EXPORT_TAGS = (
|
||||
get_interface_mac
|
||||
have_global_variables
|
||||
set_global_variables
|
||||
compile_stop_firewall
|
||||
create_netfilter_load
|
||||
create_chainlist_reload
|
||||
$section
|
||||
@ -2001,6 +2004,46 @@ sub mysplit( $ ) {
|
||||
@result;
|
||||
}
|
||||
|
||||
#
|
||||
# Set up the IPTABLES-related run-time variables
|
||||
#
|
||||
sub set_chain_variables() {
|
||||
if ( $family == F_IPV4 ) {
|
||||
if ( $config{IPTABLES} ) {
|
||||
emit( qq(IPTABLES="$config{IPTABLES}"),
|
||||
'[ -x "$IPTABLES" ] || startup_error "IPTABLES=$IPTABLES does not exist or is not executable"',
|
||||
);
|
||||
} else {
|
||||
emit( '[ -z "$IPTABLES" ] && IPTABLES=$(mywhich iptables) # /sbin/shorewall exports IPTABLES',
|
||||
'[ -n "$IPTABLES" -a -x "$IPTABLES" ] || startup_error "Can\'t find iptables executable"'
|
||||
);
|
||||
}
|
||||
|
||||
emit( 'IPTABLES_RESTORE=${IPTABLES}-restore',
|
||||
'[ -x "$IPTABLES_RESTORE" ] || startup_error "$IPTABLES_RESTORE does not exist or is not executable"' );
|
||||
} else {
|
||||
if ( $config{IP6TABLES} ) {
|
||||
emit( qq(IP6TABLES="$config{IP6TABLES}"),
|
||||
'[ -x "$IP6TABLES" ] || startup_error "IP6TABLES=$IP6TABLES does not exist or is not executable"',
|
||||
);
|
||||
} else {
|
||||
emit( '[ -z "$IP6TABLES" ] && IP6TABLES=$(mywhich ip6tables) # /sbin/shorewall6 exports IP6TABLES',
|
||||
'[ -n "$IP6TABLES" -a -x "$IP6TABLES" ] || startup_error "Can\'t find ip6tables executable"'
|
||||
);
|
||||
}
|
||||
|
||||
emit( 'IP6TABLES_RESTORE=${IP6TABLES}-restore',
|
||||
'[ -x "$IP6TABLES_RESTORE" ] || startup_error "$IP6TABLES_RESTORE does not exist or is not executable"' );
|
||||
}
|
||||
}
|
||||
|
||||
#
|
||||
# Emit code that marks the firewall as not started.
|
||||
#
|
||||
sub mark_firewall_not_started() {
|
||||
emit ( 'qt1 $IPTABLES -L shorewall -n && qt1 $IPTABLES -F shorewall && qt1 $IPTABLES -X shorewall' );
|
||||
}
|
||||
|
||||
####################################################################################################################
|
||||
# The following functions come in pairs. The first function returns the name of a run-time shell variable that
|
||||
# will hold a piece of interface-oriented data detected at run-time. The second creates a code fragment to detect
|
||||
|
||||
@ -208,33 +208,7 @@ sub generate_script_2() {
|
||||
''
|
||||
);
|
||||
|
||||
if ( $family == F_IPV4 ) {
|
||||
if ( $config{IPTABLES} ) {
|
||||
emit( qq(IPTABLES="$config{IPTABLES}"),
|
||||
'[ -x "$IPTABLES" ] || startup_error "IPTABLES=$IPTABLES does not exist or is not executable"',
|
||||
);
|
||||
} else {
|
||||
emit( '[ -z "$IPTABLES" ] && IPTABLES=$(mywhich iptables) # /sbin/shorewall exports IPTABLES',
|
||||
'[ -n "$IPTABLES" -a -x "$IPTABLES" ] || startup_error "Can\'t find iptables executable"'
|
||||
);
|
||||
}
|
||||
|
||||
emit( 'IPTABLES_RESTORE=${IPTABLES}-restore',
|
||||
'[ -x "$IPTABLES_RESTORE" ] || startup_error "$IPTABLES_RESTORE does not exist or is not executable"' );
|
||||
} else {
|
||||
if ( $config{IP6TABLES} ) {
|
||||
emit( qq(IP6TABLES="$config{IP6TABLES}"),
|
||||
'[ -x "$IP6TABLES" ] || startup_error "IP6TABLES=$IP6TABLES does not exist or is not executable"',
|
||||
);
|
||||
} else {
|
||||
emit( '[ -z "$IP6TABLES" ] && IP6TABLES=$(mywhich ip6tables) # /sbin/shorewall6 exports IP6TABLES',
|
||||
'[ -n "$IP6TABLES" -a -x "$IP6TABLES" ] || startup_error "Can\'t find ip6tables executable"'
|
||||
);
|
||||
}
|
||||
|
||||
emit( 'IP6TABLES_RESTORE=${IP6TABLES}-restore',
|
||||
'[ -x "$IP6TABLES_RESTORE" ] || startup_error "$IP6TABLES_RESTORE does not exist or is not executable"' );
|
||||
}
|
||||
set_chain_variables;
|
||||
|
||||
append_file 'params' if $config{EXPORTPARAMS};
|
||||
|
||||
@ -294,354 +268,11 @@ sub generate_script_2() {
|
||||
|
||||
}
|
||||
|
||||
sub compile_stop_firewall() {
|
||||
|
||||
emit <<'EOF';
|
||||
#
|
||||
# Stop/restore the firewall after an error or because of a 'stop' or 'clear' command
|
||||
#
|
||||
stop_firewall() {
|
||||
EOF
|
||||
|
||||
if ( $family == F_IPV4 ) {
|
||||
emit( ' deletechain() {',
|
||||
' qt $IPTABLES -L $1 -n && qt $IPTABLES -F $1 && qt $IPTABLES -X $1' );
|
||||
} else {
|
||||
emit( ' deletechain() {',
|
||||
' qt $IP6TABLES -L $1 -n && qt $IP6TABLES -F $1 && qt $IP6TABLES -X $1' );
|
||||
}
|
||||
|
||||
emit <<'EOF';
|
||||
}
|
||||
|
||||
deleteallchains() {
|
||||
do_iptables -F
|
||||
do_iptables -X
|
||||
}
|
||||
|
||||
delete_nat() {
|
||||
do_iptables -t nat -F
|
||||
do_iptables -t nat -X
|
||||
|
||||
if [ -f ${VARDIR}/nat ]; then
|
||||
while read external interface; do
|
||||
del_ip_addr $external $interface
|
||||
done < ${VARDIR}/nat
|
||||
|
||||
rm -f ${VARDIR}/nat
|
||||
fi
|
||||
}
|
||||
|
||||
case $COMMAND in
|
||||
stop|clear|restore)
|
||||
;;
|
||||
*)
|
||||
set +x
|
||||
|
||||
case $COMMAND in
|
||||
start)
|
||||
logger -p kern.err "ERROR:$PRODUCT start failed"
|
||||
;;
|
||||
restart)
|
||||
logger -p kern.err "ERROR:$PRODUCT restart failed"
|
||||
;;
|
||||
restore)
|
||||
logger -p kern.err "ERROR:$PRODUCT restore failed"
|
||||
;;
|
||||
esac
|
||||
|
||||
if [ "$RESTOREFILE" = NONE ]; then
|
||||
COMMAND=clear
|
||||
clear_firewall
|
||||
echo "$PRODUCT Cleared"
|
||||
|
||||
kill $$
|
||||
exit 2
|
||||
else
|
||||
RESTOREPATH=${VARDIR}/$RESTOREFILE
|
||||
|
||||
if [ -x $RESTOREPATH ]; then
|
||||
echo Restoring ${PRODUCT:=Shorewall}...
|
||||
|
||||
if $RESTOREPATH restore; then
|
||||
echo "$PRODUCT restored from $RESTOREPATH"
|
||||
set_state "Started"
|
||||
else
|
||||
set_state "Unknown"
|
||||
fi
|
||||
|
||||
kill $$
|
||||
exit 2
|
||||
fi
|
||||
fi
|
||||
;;
|
||||
esac
|
||||
|
||||
set_state "Stopping"
|
||||
|
||||
STOPPING="Yes"
|
||||
|
||||
TERMINATOR=
|
||||
|
||||
deletechain shorewall
|
||||
|
||||
run_stop_exit
|
||||
EOF
|
||||
|
||||
if ( $capabilities{MANGLE_ENABLED} && $config{MANGLE_ENABLED} ) {
|
||||
emit <<'EOF';
|
||||
run_iptables -t mangle -F
|
||||
run_iptables -t mangle -X
|
||||
for chain in PREROUTING INPUT FORWARD POSTROUTING; do
|
||||
qt1 $IPTABLES -t mangle -P $chain ACCEPT
|
||||
done
|
||||
EOF
|
||||
}
|
||||
|
||||
if ( $capabilities{RAW_TABLE} ) {
|
||||
if ( $family == F_IPV4 ) {
|
||||
emit <<'EOF';
|
||||
run_iptables -t raw -F
|
||||
run_iptables -t raw -X
|
||||
for chain in PREROUTING OUTPUT; do
|
||||
qt1 $IPTABLES -t raw -P $chain ACCEPT
|
||||
done
|
||||
EOF
|
||||
} else {
|
||||
emit <<'EOF';
|
||||
run_iptables -t raw -F
|
||||
run_iptables -t raw -X
|
||||
for chain in PREROUTING OUTPUT; do
|
||||
qt1 $IP6TABLES -t raw -P $chain ACCEPT
|
||||
done
|
||||
EOF
|
||||
}
|
||||
}
|
||||
|
||||
if ( $capabilities{NAT_ENABLED} ) {
|
||||
emit <<'EOF';
|
||||
delete_nat
|
||||
for chain in PREROUTING POSTROUTING OUTPUT; do
|
||||
qt1 $IPTABLES -t nat -P $chain ACCEPT
|
||||
done
|
||||
EOF
|
||||
}
|
||||
|
||||
if ( $family == F_IPV4 ) {
|
||||
emit <<'EOF';
|
||||
if [ -f ${VARDIR}/proxyarp ]; then
|
||||
while read address interface external haveroute; do
|
||||
qt arp -i $external -d $address pub
|
||||
[ -z "${haveroute}${NOROUTES}" ] && qt ip route del $address dev $interface
|
||||
f=/proc/sys/net/ipv4/conf/$interface/proxy_arp
|
||||
[ -f $f ] && echo 0 > $f
|
||||
done < ${VARDIR}/proxyarp
|
||||
fi
|
||||
|
||||
rm -f ${VARDIR}/proxyarp
|
||||
EOF
|
||||
}
|
||||
|
||||
push_indent;
|
||||
|
||||
emit 'delete_tc1' if $config{CLEAR_TC};
|
||||
|
||||
emit( 'undo_routing',
|
||||
'restore_default_route'
|
||||
);
|
||||
|
||||
my $criticalhosts = process_criticalhosts;
|
||||
|
||||
if ( @$criticalhosts ) {
|
||||
if ( $config{ADMINISABSENTMINDED} ) {
|
||||
emit ( 'for chain in INPUT OUTPUT; do',
|
||||
' setpolicy $chain ACCEPT',
|
||||
'done',
|
||||
'',
|
||||
'setpolicy FORWARD DROP',
|
||||
'',
|
||||
'deleteallchains',
|
||||
''
|
||||
);
|
||||
|
||||
for my $hosts ( @$criticalhosts ) {
|
||||
my ( $interface, $host, $seq ) = ( split /\|/, $hosts );
|
||||
my $source = match_source_net $host;
|
||||
my $dest = match_dest_net $host;
|
||||
|
||||
emit( "do_iptables -A INPUT -i $interface $source -j ACCEPT",
|
||||
"do_iptables -A OUTPUT -o $interface $dest -j ACCEPT"
|
||||
);
|
||||
}
|
||||
|
||||
emit( '',
|
||||
'for chain in INPUT OUTPUT; do',
|
||||
' setpolicy $chain DROP',
|
||||
"done\n"
|
||||
);
|
||||
} else {
|
||||
emit( '',
|
||||
'for chain in INPUT OUTPUT; do',
|
||||
' setpolicy $chain ACCEPT',
|
||||
'done',
|
||||
'',
|
||||
'setpolicy FORWARD DROP',
|
||||
'',
|
||||
"deleteallchains\n"
|
||||
);
|
||||
|
||||
for my $hosts ( @$criticalhosts ) {
|
||||
my ( $interface, $host , $seq ) = ( split /|/, $hosts );
|
||||
my $source = match_source_net $host;
|
||||
my $dest = match_dest_net $host;
|
||||
|
||||
emit( "do_iptables -A INPUT -i $interface $source -j ACCEPT",
|
||||
"do_iptables -A OUTPUT -o $interface $dest -j ACCEPT"
|
||||
);
|
||||
}
|
||||
|
||||
emit( "\nsetpolicy INPUT DROP",
|
||||
'',
|
||||
'for chain in INPUT FORWARD; do',
|
||||
' setcontinue $chain',
|
||||
"done\n"
|
||||
);
|
||||
}
|
||||
} elsif ( $config{ADMINISABSENTMINDED} ) {
|
||||
emit( 'for chain in INPUT FORWARD; do',
|
||||
' setpolicy $chain DROP',
|
||||
'done',
|
||||
'',
|
||||
'setpolicy OUTPUT ACCEPT',
|
||||
'',
|
||||
'deleteallchains',
|
||||
'',
|
||||
'for chain in INPUT FORWARD; do',
|
||||
' setcontinue $chain',
|
||||
"done\n",
|
||||
);
|
||||
} else {
|
||||
emit( 'for chain in INPUT OUTPUT FORWARD; do',
|
||||
' setpolicy $chain DROP',
|
||||
'done',
|
||||
'',
|
||||
"deleteallchains\n"
|
||||
);
|
||||
}
|
||||
|
||||
if ( $family == F_IPV6 ) {
|
||||
emit <<'EOF';
|
||||
#
|
||||
# Enable link local and multi-cast
|
||||
#
|
||||
run_iptables -A INPUT -s ff80::/10 -j ACCEPT
|
||||
run_iptables -A INPUT -d ff80::/10 -j ACCEPT
|
||||
run_iptables -A INPUT -d ff00::/10 -j ACCEPT
|
||||
EOF
|
||||
|
||||
emit <<'EOF' unless $config{ADMINISABSENTMINDED};
|
||||
run_iptables -A OUTPUT -d ff80::/10 -j ACCEPT
|
||||
run_iptables -A OUTPUT -d ff00::/10 -j ACCEPT
|
||||
|
||||
EOF
|
||||
}
|
||||
|
||||
process_routestopped;
|
||||
|
||||
emit( 'do_iptables -A INPUT -i lo -j ACCEPT',
|
||||
'do_iptables -A OUTPUT -o lo -j ACCEPT'
|
||||
);
|
||||
|
||||
emit 'do_iptables -A OUTPUT -o lo -j ACCEPT' unless $config{ADMINISABSENTMINDED};
|
||||
|
||||
my $interfaces = find_interfaces_by_option 'dhcp';
|
||||
|
||||
if ( @$interfaces ) {
|
||||
my $ports = $family == F_IPV4 ? '67:68' : '546:547';
|
||||
|
||||
for my $interface ( @$interfaces ) {
|
||||
emit "do_iptables -A INPUT -p udp -i $interface --dport $ports -j ACCEPT";
|
||||
emit "do_iptables -A OUTPUT -p udp -o $interface --dport $ports -j ACCEPT" unless $config{ADMINISABSENTMINDED};
|
||||
#
|
||||
# This might be a bridge
|
||||
#
|
||||
emit "do_iptables -A FORWARD -p udp -i $interface -o $interface --dport $ports -j ACCEPT";
|
||||
}
|
||||
}
|
||||
|
||||
emit '';
|
||||
|
||||
if ( $family == F_IPV4 ) {
|
||||
if ( $config{IP_FORWARDING} eq 'on' ) {
|
||||
emit( 'echo 1 > /proc/sys/net/ipv4/ip_forward',
|
||||
'progress_message2 IPv4 Forwarding Enabled' );
|
||||
} elsif ( $config{IP_FORWARDING} eq 'off' ) {
|
||||
emit( 'echo 0 > /proc/sys/net/ipv4/ip_forward',
|
||||
'progress_message2 IPv4 Forwarding Disabled!'
|
||||
);
|
||||
}
|
||||
} else {
|
||||
for my $interface ( all_bridges ) {
|
||||
emit "do_iptables -A FORWARD -p 58 -i $interface -o $interface -j ACCEPT";
|
||||
}
|
||||
|
||||
if ( $config{IP_FORWARDING} eq 'on' ) {
|
||||
emit( 'echo 1 > /proc/sys/net/ipv6/conf/all/forwarding',
|
||||
'progress_message2 IPv6 Forwarding Enabled' );
|
||||
} elsif ( $config{IP_FORWARDING} eq 'off' ) {
|
||||
emit( 'echo 0 > /proc/sys/net/ipv6/conf/all/forwarding',
|
||||
'progress_message2 IPv6 Forwarding Disabled!'
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
pop_indent;
|
||||
|
||||
emit '
|
||||
run_stopped_exit';
|
||||
|
||||
my @ipsets = all_ipsets;
|
||||
|
||||
if ( @ipsets ) {
|
||||
emit <<'EOF'
|
||||
|
||||
if [ -n "$(mywhich ipset)" ]; then
|
||||
if ipset -S > ${VARDIR}/ipsets.tmp; then
|
||||
#
|
||||
# Don't save an 'empty' file
|
||||
#
|
||||
grep -q '^-N' ${VARDIR}/ipsets.tmp && mv -f ${VARDIR}/ipsets.tmp ${VARDIR}/ipsets.save
|
||||
fi
|
||||
fi
|
||||
EOF
|
||||
}
|
||||
|
||||
emit '
|
||||
set_state "Stopped"
|
||||
|
||||
logger -p kern.info "$PRODUCT Stopped"
|
||||
|
||||
case $COMMAND in
|
||||
stop|clear)
|
||||
;;
|
||||
*)
|
||||
#
|
||||
# The firewall is being stopped when we were trying to do something
|
||||
# else. Kill the shell in case we\'re running in a subshell
|
||||
#
|
||||
kill $$
|
||||
;;
|
||||
esac
|
||||
}
|
||||
';
|
||||
|
||||
}
|
||||
|
||||
#
|
||||
# Final stage of script generation.
|
||||
#
|
||||
# Copy prog.functions to the object file.
|
||||
# Generate code for loading the various files in /var/lib/shorewall[-lite]
|
||||
# Generate code for loading the various files in /var/lib/shorewall[6][-lite]
|
||||
# Generate code to add IP addresses under ADD_IP_ALIASES and ADD_SNAT_ALIASES
|
||||
#
|
||||
# Generate the 'setup_netfilter()' function that runs iptables-restore.
|
||||
@ -697,17 +328,6 @@ sub generate_script_3($) {
|
||||
}
|
||||
|
||||
if ( $family == F_IPV4 ) {
|
||||
emit ( '#',
|
||||
'# Recent kernels are difficult to configure -- we see state match omitted a lot so we check for it here',
|
||||
'#',
|
||||
'qt1 $IPTABLES -N foox1234',
|
||||
'qt1 $IPTABLES -A foox1234 -m state --state ESTABLISHED,RELATED -j ACCEPT',
|
||||
'result=$?',
|
||||
'qt1 $IPTABLES -F foox1234',
|
||||
'qt1 $IPTABLES -X foox1234',
|
||||
'[ $result = 0 ] || startup_error "Your kernel/iptables do not include state match support. No version of Shorewall will run on this system"',
|
||||
'' );
|
||||
|
||||
for my $interface ( @{find_interfaces_by_option 'norfc1918'} ) {
|
||||
emit ( "addr=\$(ip -f inet addr show $interface 2> /dev/null | grep 'inet\ ' | head -n1)",
|
||||
'if [ -n "$addr" ]; then',
|
||||
@ -759,9 +379,11 @@ sub generate_script_3($) {
|
||||
emit ( 'else' ,
|
||||
' run_init_exit',
|
||||
'fi',
|
||||
'',
|
||||
'qt1 $IPTABLES -L shorewall -n && qt1 $IPTABLES -F shorewall && qt1 $IPTABLES -X shorewall',
|
||||
'',
|
||||
'' );
|
||||
|
||||
mark_firewall_not_started;
|
||||
|
||||
emit ('',
|
||||
'delete_proxyarp',
|
||||
''
|
||||
);
|
||||
|
||||
@ -1850,6 +1850,9 @@ sub determine_capabilities( $ ) {
|
||||
qt1( "$iptables -N $sillyname" );
|
||||
qt1( "$iptables -N $sillyname1" );
|
||||
|
||||
fatal_error 'Your kernel/iptables do not include state match support. No version of Shorewall will run on this system'
|
||||
unless qt1( "$iptables -A $sillyname -m state --state ESTABLISHED,RELATED -j ACCEPT");
|
||||
|
||||
if ( $family == F_IPV4 ) {
|
||||
$capabilities{CONNTRACK_MATCH} = qt1( "$iptables -A $sillyname -m conntrack --ctorigdst 192.168.1.1 -j ACCEPT" );
|
||||
} else {
|
||||
|
||||
@ -188,8 +188,8 @@ None.
|
||||
/var/lib/shorewall[6]/firewall.
|
||||
|
||||
5) Dynamic zone support is once again available for IPv4. This support
|
||||
is built on top of ipsets so you must have installed the
|
||||
xtable-addons.
|
||||
is built on top of ipsets so you must have the xtables-addons
|
||||
installed on the firewall system.
|
||||
|
||||
Dynamic zones are available when Shorewall-lite is used as well.
|
||||
|
||||
|
||||
Loading…
Reference in New Issue
Block a user