firewall ipchains

Andrzej Krzysztofowicz ankry w green.mif.pg.gda.pl
Pon, 20 Paź 2003, 23:57:34 CEST


Wkurzyl mnie dzisiaj w koncu malo elastyczny parser konfiguracji firewalla w
RA. Jesli krtos ma ochote potestowac, to dolaczam wersje z lekka rozbudowana.
Glowne jej "ficzery", to:

- akceptowanie "any" jako protokolu
- mozliwosc dopisywania wykrzyknikow przy wszystkich polach zezwalajacych na
  to bez koniecznosci cytowania nastepujacych po nich spacji / tabulacji
- tolerowanie pominiecia pola "port" (zrodlowy / docelowy) w niektorych
  sytuacjach, gdy nie rodzi to niejednoznacznosci.

Komentarze i testetowanie mile widziane.

===============================================================
#!/bin/sh
#
# firewall	This script sets up firewall/masquerade/accounting
#
# chkconfig: 345 09 98
# description: Firewall-init is meant to provide an easy to use
#              interface to start and stopping the kernel IP packet
#              filters and accounting through ipchains(8).
# config: /etc/sysconfig/firewall
# config: /etc/sysconfig/firewall-rules/forward
# config: /etc/sysconfig/firewall-rules/input
# config: /etc/sysconfig/firewall-rules/output

# Source function library.
. /etc/rc.d/init.d/functions

# Check that networking is up.
[ "${NETWORKING}" = "no" ] && exit 0

. /etc/sysconfig/firewall

[ ${FIREWALL} = 'no' ] && exit 0

[ -f /sbin/ipchains ] || exit 0

syntax_error ()
{
	echo $2: "$(nls "$1")"
	echo "$3"
}

ipv4_forward_set ()
{
	# Turn IP forwarding on or off. We do this before bringing up the
	# interfaces to make sure we don't forward when we shouldn't, and
	# we do it even if networking isn't configured (why not?).
	if [ -d /proc/sys/net/ipv4 ]; then
		value=$1
		if [ $value != 1 ]; then
			value=0
			message="Disabling IPv4 packet forwarding"
		else
			value=1
			message="Enabling IPv4 packet forwarding"
		fi
		show "$message"
		busy
		if [ ! -f /proc/sys/net/ipv4/ip_forward ] ; then
			deltext
			fail
			exit 1
		else
			echo "$value" > /proc/sys/net/ipv4/ip_forward
			deltext
			ok
		fi
	fi
}

ipv4_spoof_protection ()
{
	# This is the best method: turn on Source Address Verification and get
	# spoof protection on all current and future interfaces.
	if [ -e /proc/sys/net/ipv4/conf/all/rp_filter ]; then
		show "Setting up IP spoofing protection"
		busy
		for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
			echo 1 > $f
		done
		deltext
		ok
	else
		deltext
		fail
		echo "PROBLEMS SETTING UP IP SPOOFING PROTECTION.  BE WORRIED!"
	fi
}

# See how we were called.
case "$1" in
  start)
  	ipv4_forward_set 1
	ipv4_spoof_protection

	show "Starting firewall"
	busy

	rm -f /tmp/.firewall

	cd /etc/sysconfig/firewall-rules
	FILES=''
	if [ ${FIREWALL} = 'yes' ]; then
		FILES="input output forward"
		
		/sbin/ipchains -F
		/sbin/ipchains -X
		
		/sbin/ipchains -P input ${INPUT}
		/sbin/ipchains -P output ${OUTPUT}
		/sbin/ipchains -P forward ${FORWARD}
	fi

	for CHAIN in ${FILES}; do
	    if [ -s ${CHAIN} ]; then
		grep -v '^#' ${CHAIN} | grep -v '^$' | \
		while read LINE; do
		#POLICY PROTO SADDR SPORT DADDR DPORT IFACE OPTIONS
		    LINE2=`echo $LINE`
		    POLICY=${LINE2%% *}
		    LINE2=${LINE2#$POLICY}; LINE2=${LINE2# }
		    case "${POLICY}" in
		      [Nn][Oo][Nn][Ee])
			    POLICY=''
			    ;;
		      *)
		     	    POLICY="-j ${POLICY}"
			    ;;
		    esac
		    PROTO=${LINE2%% *}
		    LINE2=${LINE2#$PROTO}; LINE2=${LINE2# }
		    case "${PROTO}" in
		      [Aa][Nn][Yy])
			    PROTO=''
			    ;;
		      !)
			    PROTO2=${LINE2%% *}
			    LINE2=${LINE2#$PROTO2}; LINE2=${LINE2# }
			    PROTO="-p ! ${PROTO2}"
			    ;;
		      *)
			    PROTO="-p ${PROTO}"
		    esac
		    SADDR=${LINE2%% *}
		    LINE2=${LINE2#$SADDR}; LINE2=${LINE2# }
		    case "${SADDR}" in
		      !)
			    SADDR2=${LINE2%% *}
			    LINE2=${LINE2#$SADDR2}; LINE2=${LINE2# }
			    SADDR="! ${SADDR2}"
			    ;;
		    esac
		    SPORT=${LINE2%% *}
		    LINE2=${LINE2#$SPORT}; LINE2=${LINE2# }
		    DADDR=''
		    case "${SPORT}" in
		      0:65535|[Aa][Nn][Yy])
			    SPORT=''
			    ;;
		      */*|*.*.*.*)
			    DADDR="${SPORT}"
			    SPORT=''
			    ;;
		      !)
			    SPORT2=${LINE2%% *}
			    LINE2=${LINE2#$SPORT2}; LINE2=${LINE2# }
			    case "${SPORT2}" in
			      */*|*.*.*.*)
				    DADDR="! ${SPORT2}"
				    SPORT=''
				    ;;
			      *)
				    if [ -z "$PROTO" ]; then
					syntax_error "Source port is illegal in line:" "$CHAIN" "$LINE"
				    else
					SPORT="! ${SPORT2}"
				    fi
			    esac
			    ;;
		      *)
			    if [ -z "$PROTO" ]; then
				syntax_error "Source port is illegal in line:" "$CHAIN" "$LINE"
			    fi
		    esac
		    if [ -z "${DADDR}" ]; then
			DADDR=${LINE2%% *}
			LINE2=${LINE2#$DADDR}; LINE2=${LINE2# }
		    fi
		    case "${DADDR}" in
		      !)
			    DADDR2=${LINE2%% *}
			    LINE2=${LINE2#$DADDR2}; LINE2=${LINE2# }
			    DADDR="! ${DADDR2}"
			    ;;
		    esac
		    DPORT=${LINE2%% *}
		    LINE2=${LINE2#$DPORT}; LINE2=${LINE2# }
		    IFACE=''
		    case "${DPORT}" in
		      0:65535|[Aa][Nn][Yy])
			    DPORT=''
			    ;;
		      eth[+0-9]*|lo|ppp[+0-9]*|tunl[+0-9]*)
			    IFACE="${DPORT}"
			    DPORT=''
			    ;;
		      !)
			    DPORT2=${LINE2%% *}
			    LINE2=${LINE2#$DPORT2}; LINE2=${LINE2# }
			    case "${DPORT2}" in
			      eth[+0-9]*|lo|ppp[+0-9]*|tunl[+0-9]*)
				    IFACE="! ${DPORT2}"
				    DPORT=''
				    ;;
			      *)
				    if [ -z "$PROTO" ]; then
					syntax_error "Destination port is illegal in line:" "$CHAIN" "$LINE"
				    else
					DPORT="! ${DPORT2}"
				    fi
			    esac
			    ;;
		      *)
			    if [ -z "$PROTO" ]; then
				syntax_error "Destination port is illegal in line:" "$CHAIN" "$LINE"
			    fi
		    esac
		    if [ -z "${IFACE}" ]; then
			IFACE=${LINE2%% *}
			LINE2=${LINE2#$IFACE}; LINE2=${LINE2# }
		    fi
		    case "${IFACE}" in
		      [Aa][Nn][Yy])
			    IFACE=''
			    ;;
		      !)
			    IFACE2=${LINE2%% *}
			    LINE2=${LINE2#$IFACE2}; LINE2=${LINE2# }
			    IFACE="-i ! ${IFACE2}"
			    ;;
		      *)
			    IFACE="-i ${IFACE}"
			    ;;
		    esac
		    OPTIONS=$LINE2
		    /sbin/ipchains -A ${CHAIN} ${PROTO} ${IFACE} \
		    		-s ${SADDR} ${SPORT} -d ${DADDR} ${DPORT} ${POLICY} ${OPTIONS} 2>> /tmp/.firewall
		done
	    fi
	done
	
	for MODNAME in ${MASQ_MODS}; do
	    insmod ${MODNAME} > /dev/null 2> /dev/null
	done
	
	if [ -s /tmp/.firewall ]; then
	    grep -v '^Try' < /tmp/.firewall | logger -t 'firewall' -p user.notice
	    deltext
	    fail
	    echo $(nls 'PROBLEMS SETTING UP FIREWALL.  CHECK /var/log/messages!')
	else
	    deltext
	    ok
	fi
	;;
  stop)
  	ipv4_forward_set 0
	show "Shutting down firewall"
	/sbin/ipchains -P input ACCEPT
	/sbin/ipchains -P output ACCEPT
	/sbin/ipchains -P forward ACCEPT

	/sbin/ipchains -F
	/sbin/ipchains -X

	for MODNAME in ${MASQ_MODS}; do
	    rmmod ${MODNAME} > /dev/null 2> /dev/null
	done

	deltext
	ok
	;;
  restart)
	$0 stop
	$0 start
	;;
  status)
	/sbin/ipchains -L -n
	;;
  extstatus)
	/sbin/ipchains -L -n -v
	;;
  masqstatus)
	/sbin/ipchains -L -M -n
	;;
  masqextstatus)
	/sbin/ipchains -L -M -n -v
	;;
  *)
	echo "Usage: $0 {start|stop|restart|status|extstatus|masqstatus|masqextstatus}"
	exit 1
esac

exit 0
===============================================================

-- 
=======================================================================
  Andrzej M. Krzysztofowicz               ankry w mif.pg.gda.pl
  phone (48)(58) 347 14 61
Faculty of Applied Phys. & Math.,   Gdansk University of Technology



Więcej informacji o liście dyskusyjnej pld-betatesters