From dcade04fba68152ceb131d93f329512844761877 Mon Sep 17 00:00:00 2001 From: Tom Eastep Date: Tue, 20 Dec 2016 08:38:49 -0800 Subject: [PATCH] Update Shorewall5 article for 5.1 Signed-off-by: Tom Eastep --- docs/Shorewall-5.xml | 188 ++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 186 insertions(+), 2 deletions(-) diff --git a/docs/Shorewall-5.xml b/docs/Shorewall-5.xml index 4a0c887e7..0e38a8863 100644 --- a/docs/Shorewall-5.xml +++ b/docs/Shorewall-5.xml @@ -20,6 +20,8 @@ 2015 + 2016 + Thomas M. Eastep @@ -37,8 +39,8 @@
Introduction - There are currently two principle groups of changes that distinguish - Shorewall 5 from Shorewall 4: + There are currently three principle groups of changes that + distinguish Shorewall 5 from Shorewall 4: @@ -54,6 +56,13 @@ commands have been renamed or the function that they perform has been changed. + + + CLI unification - Beginning with Shorewall 5.1.0, there is a + single CLI program (/sbin/shorewall or + /usr/sbin/shorewall depending on your + distribution). + Each of these groups is described in more detail in the sections @@ -120,6 +129,10 @@ LEGACY_FASTSTART + + + CHAIN_SCRIPTS (Removed in Shorewall 5.1). + A compilation warning is issued when any of these options are @@ -354,6 +367,57 @@
+
+ CLI Unification + + Prior to Shorewall 5.1, there were four separate CLI + programs: + + + + /sbin/shorewall or + /usr/sbin/shorewall depending on your + distribution. Packaged with Shorewall and used to control + Shorewall. + + + + /sbin/shorewall6 or + /usr/sbin/shorewall6 depending on your + distribution. Packaged with Shorewall6 and used to control + Shorewall6. + + + + /sbin/shorewall-lite or + /usr/sbin/shorewall-lite depending on your + distribution. Packaged with Shorewall-lite and used to control + Shorewall-lite. + + + + /sbin/shorewall6-lite or + /usr/sbin/shorewall6-lite depending on your + distribution. Packaged with Shorewall6-lite and used to control + Shorewall6-lite. + + + + Each of these programs had their own (largely duplicated) + manpage. + + Beginning with Shorewall 5.1, there is a single CLI program + (/sbin/shorewall or + /usr/sbin/shorewall) packaged with Shorewall-core. + The Shorewall6, Shorewall-lite and Shorewall6-lite packages create a + symbolic link to that program; the links are named shorewall6, + shorewall-lite and shorewall6-lite respectively. These symbolic links are + for backward compatibility only; all four products can be managed using + the single CLI program itself. The manpages shorewall6(8), + shorewall-lite(8) and shorewall6-lite(8) are skeletal and refer the reader + to shorewall(8). +
+
Upgrading to Shorewall 5 @@ -380,5 +444,125 @@ performed unconditionally. The and options have been retained - both enable checking for issues that could result if INLINE_MATCHES were to be set to Yes. + +
+ CHAIN_SCRIPTS Removal + + Prior to the availability of ?[BEGIN] PERL .... ?END PERL, the + only way to create Perl code to insert rules into a chain was to use a + per-Chain script with the same name as the chain. The most common use of + these scripts was with Actions where an action A would have an empty + action.A file and then a file named A that contained Perl code. This was + a hack, at best, and has been deprecated since embedded Perl has been + available in action files. + + In Shorewall 5.1, the compiler notices that action.A is empty and + looks for a file named A on the CONFIG_PATH. If that file is found, the + compiler raises a fatal error: + + ERROR: File action.A is empty and file A exists - the two must be combined as described in the Migration Considerations section of the Shorewall release notes + + To resolve this issue, one of two approaches can be taken + depending on what the script A does. + + + + If script A is simply inserting rules with ip[6]tables matches + and/or targets that Shorewall doesn't directly support, they can + probably be coded in the action.A file using the IP[6]TABLES action + and/or inline matches. For example, the following script + DNSDDOS + + use Shorewall::Chains; + +add_rule $chainref, q(-m string --algo bm --from 30 --to 31 --hex-string "|010000010000000000000000020001|" -j DROP); +add_rule $chainref, q(-m string --algo bm --from 30 --to 31 --hex-string "|000000010000000000000000020001|" -j DROP); +add_rule $chainref, q(-j ACCEPT); + +1; + + can be coded in action.DNSDDOS as: + + DROP - - ;; -m string --algo bm --from 30 --to 31 --hex-string "|010000010000000000000000020001|" +DROP - - ;; -m string --algo bm --from 30 --to 31 --hex-string "|000000010000000000000000020001|" +ACCEPT - - + + + + The other approach is to simply convert A into embedded Perl + in action.A. Consider this SSHKnock + script: + + use Shorewall::Chains; + +if ( $level ) { + log_rule_limit( $level, + $chainref, + 'SSHKnock', + 'ACCEPT', + '', + $tag, + 'add', + '-p tcp --dport 22 -m recent --rcheck --name SSH ' ); + log_rule_limit( $level, + $chainref, + 'SSHKnock', + 'DROP', + '', + $tag, + 'add', + '-p tcp --dport ! 22 ' ); +} +add_rule( $chainref, '-p tcp --dport 22 -m recent --rcheck --seconds 60 --name SSH -j ACCEPT' ); +add_rule( $chainref, '-p tcp --dport 632 -m recent --name SSH --remove -j DROP' ); +add_rule( $chainref, '-p tcp --dport 633 -m recent --name SSH --set -j DROP' ); +add_rule( $chainref, '-p tcp --dport 634 -m recent --name SSH --remove -j DROP' ); +1; + + Because this script uses the implicit $level and $tag + variables, it must remail in Perl. This mostly involves simply + moving the SSHKnock script into + action.SSHKnock, but requires some additional + code in action.SSHKnock as shown in bold font below: + + ?begin perl + +use Shorewall::Config; +use Shorewall::Chains; + +my $chainref = get_action_chain; +my ( $level, $tag ) = get_action_logging; + +if ( $level ) { + log_rule_limit( $level, + $chainref, + 'SSHKnock', + 'ACCEPT', + '', + $tag, + 'add', + '-p tcp --dport 22 -m recent --rcheck --name SSH ' ); + + log_rule_limit( $level, + $chainref, + 'SSHKnock', + 'DROP', + '', + $tag, + 'add', + '-p tcp --dport ! 22 ' ); +} + +add_rule( $chainref, '-p tcp --dport 22 -m recent --rcheck --seconds 60 --name SSH -j ACCEPT' ); +add_rule( $chainref, '-p tcp --dport 632 -m recent --name SSH --remove -j DROP' ); +add_rule( $chainref, '-p tcp --dport 633 -m recent --name SSH --set -j DROP' ); +add_rule( $chainref, '-p tcp --dport 634 -m recent --name SSH --remove -j DROP' ); +1; + +?end perl + + +