diff options
Diffstat (limited to 'lib/Vyatta')
| -rwxr-xr-x | lib/Vyatta/IpTables/AddressFilter.pm | 448 | ||||
| -rwxr-xr-x | lib/Vyatta/IpTables/IpSet.pm | 412 | ||||
| -rwxr-xr-x | lib/Vyatta/IpTables/Mgr.pm | 377 | ||||
| -rwxr-xr-x | lib/Vyatta/IpTables/Rule.pm | 1404 |
4 files changed, 1314 insertions, 1327 deletions
diff --git a/lib/Vyatta/IpTables/AddressFilter.pm b/lib/Vyatta/IpTables/AddressFilter.pm index 8916712..9100c24 100755 --- a/lib/Vyatta/IpTables/AddressFilter.pm +++ b/lib/Vyatta/IpTables/AddressFilter.pm @@ -6,12 +6,12 @@ # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License version 2 as # published by the Free Software Foundation. -# +# # This program is distributed in the hope that it will be useful, but # WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU # General Public License for more details. -# +# # This code was originally developed by Vyatta, Inc. # Portions created by Vyatta are Copyright (C) 2006-2009 Vyatta, Inc. # All Rights Reserved. @@ -28,276 +28,268 @@ use strict; use warnings; my %_protocolswithports = ( - tcp_udp => 1, - # 'tcp_udp' is to be allowed for nat and firewall rules only. - # features should have syntax checks for allowing or forbiding - # the use of 'tcp_udp' as protocol. to allow tcp_udp see syntax check - # in protocol/node.def for NAT rules and to forbid tcp_udp see syntax - # check in protocol/node.def for load-balancing rules - # when allowed : tcp_udp creates 2 iptable rules - one for tcp, other for udp - tcp => 1, - udp => 1, - 6 => 1, - 17 => 1, + tcp_udp => 1, + + # 'tcp_udp' is to be allowed for nat and firewall rules only. + # features should have syntax checks for allowing or forbiding + # the use of 'tcp_udp' as protocol. to allow tcp_udp see syntax check + # in protocol/node.def for NAT rules and to forbid tcp_udp see syntax + # check in protocol/node.def for load-balancing rules + # when allowed : tcp_udp creates 2 iptable rules - one for tcp, other for udp + tcp => 1, + udp => 1, + 6 => 1, + 17 => 1, ); my %fields = ( - _srcdst => undef, - _range_start => undef, - _range_stop => undef, - _network => undef, - _address => undef, - _port => undef, - _protocol => undef, - _src_mac => undef, - _ip_version => undef, - _address_group => undef, - _network_group => undef, - _port_group => undef, + _srcdst => undef, + _range_start => undef, + _range_stop => undef, + _network => undef, + _address => undef, + _port => undef, + _protocol => undef, + _src_mac => undef, + _ip_version => undef, + _address_group => undef, + _network_group => undef, + _port_group => undef, ); sub new { - my $that = shift; - my $class = ref ($that) || $that; - my $self = { - %fields, - }; - - bless $self, $class; - return $self; + my $that = shift; + my $class = ref($that) || $that; + my $self = {%fields,}; + + bless $self, $class; + return $self; } sub set_ip_version { - my ($self, $ip_version) = @_; + my ($self, $ip_version) = @_; - $self->{_ip_version} = $ip_version; + $self->{_ip_version} = $ip_version; } sub setup_base { - my ($self, $level, $func) = @_; - my $config = new Vyatta::Config; - - $config->setLevel("$level"); - - # Default to IPv4. - $self->{_ip_version} = "ipv4"; - - # setup needed parent nodes - $self->{_srcdst} = $config->returnParent(".."); - $self->{_protocol} = $config->$func(".. protocol"); - - # setup address filter nodes - $self->{_address} = $config->$func("address"); - $self->{_network} = undef; - $self->{_range_start} = undef; - $self->{_range_stop} = undef; - if (defined($self->{_address})) { - if ($self->{_address} =~ /\//) { - $self->{_network} = $self->{_address}; - $self->{_address} = undef; - } elsif ($self->{_address} =~ /^([^-]+)-([^-]+)$/) { - $self->{_range_start} = $1; - $self->{_range_stop} = $2; - $self->{_address} = undef; + my ($self, $level, $func) = @_; + my $config = new Vyatta::Config; + + $config->setLevel("$level"); + + # Default to IPv4. + $self->{_ip_version} = "ipv4"; + + # setup needed parent nodes + $self->{_srcdst} = $config->returnParent(".."); + $self->{_protocol} = $config->$func(".. protocol"); + + # setup address filter nodes + $self->{_address} = $config->$func("address"); + $self->{_network} = undef; + $self->{_range_start} = undef; + $self->{_range_stop} = undef; + if (defined($self->{_address})) { + if ($self->{_address} =~ /\//) { + $self->{_network} = $self->{_address}; + $self->{_address} = undef; + } elsif ($self->{_address} =~ /^([^-]+)-([^-]+)$/) { + $self->{_range_start} = $1; + $self->{_range_stop} = $2; + $self->{_address} = undef; + } } - } - $self->{_port} = $config->$func("port"); - $self->{_src_mac} = $config->$func("mac-address"); - $self->{_address_group} = $config->$func("group address-group"); - $self->{_network_group} = $config->$func("group network-group"); - $self->{_port_group} = $config->$func("group port-group"); + $self->{_port} = $config->$func("port"); + $self->{_src_mac} = $config->$func("mac-address"); + $self->{_address_group} = $config->$func("group address-group"); + $self->{_network_group} = $config->$func("group network-group"); + $self->{_port_group} = $config->$func("group port-group"); - return 0; + return 0; } sub setup { - my ($self, $level) = @_; + my ($self, $level) = @_; - $self->setup_base($level, 'returnValue'); - return 0; + $self->setup_base($level, 'returnValue'); + return 0; } sub setupOrig { - my ($self, $level) = @_; + my ($self, $level) = @_; - $self->setup_base($level, 'returnOrigValue'); - return 0; + $self->setup_base($level, 'returnOrigValue'); + return 0; } sub print { - my ($self) = @_; - - print "srcdst: $self->{_srcdst}\n" if defined $self->{_srcdst}; - print "range start: $self->{_range_start}\n" if defined $self->{_range_start}; - print "range stop: $self->{_range_stop}\n" if defined $self->{_range_stop}; - print "network: $self->{_network}\n" if defined $self->{_network}; - print "address: $self->{_address}\n" if defined $self->{_address}; - print "port: $self->{_port}\n" if defined $self->{_port}; - print "protocol: $self->{_protocol}\n" if defined $self->{_protocol}; - print "src-mac: $self->{_src_mac}\n" if defined $self->{_src_mac}; - - return 0; + my ($self) = @_; + + print "srcdst: $self->{_srcdst}\n" if defined $self->{_srcdst}; + print "range start: $self->{_range_start}\n" if defined $self->{_range_start}; + print "range stop: $self->{_range_stop}\n" if defined $self->{_range_stop}; + print "network: $self->{_network}\n" if defined $self->{_network}; + print "address: $self->{_address}\n" if defined $self->{_address}; + print "port: $self->{_port}\n" if defined $self->{_port}; + print "protocol: $self->{_protocol}\n" if defined $self->{_protocol}; + print "src-mac: $self->{_src_mac}\n" if defined $self->{_src_mac}; + + return 0; } sub rule { - my ($self) = @_; - my $rule = ""; - my $can_use_port = 1; - - my $addr_checker; - my $prefix_checker; - my $pure_addr_checker; - my $ip_term; - my $prefix_term; - - if ($self->{_ip_version} eq "ipv4") { - # This is an IPv4 rule - - $addr_checker = 'ipv4_negate'; - $prefix_checker = 'ipv4net_negate'; - $pure_addr_checker = 'ipv4'; - $ip_term = "IPv4"; - $prefix_term = "subnet"; - } elsif ($self->{_ip_version} eq "ipv6") { - # This is an IPv6 rule - - $addr_checker = 'ipv6_negate'; - $prefix_checker = 'ipv6net_negate'; - $pure_addr_checker = 'ipv6'; - $ip_term = "IPv6"; - $prefix_term = "prefix" - } else { - return (undef, "Invalid IP version: $self->{_ip_version}"); - } - - if (!defined($self->{_protocol}) - || !defined($_protocolswithports{$self->{_protocol}})) { - $can_use_port = 0; - } - - if (($self->{_srcdst} eq "source") && (defined($self->{_src_mac}))) { - # handle src mac - my $str = $self->{_src_mac}; - my $negate = ''; - if ($str =~ /^\!(.*)$/) { - $str = $1; - $negate = '! '; - } - $rule .= "-m mac $negate --mac-source $str "; - } - - my %group_ok; - foreach my $group_type ('address', 'network', 'port') { - $group_ok{$group_type} = 1; - } - # set the address filter parameters - if (defined($self->{_network})) { - my $str = $self->{_network}; - return (undef, "\"$str\" is not a valid $ip_term $prefix_term") - if (!Vyatta::TypeChecker::validateType($prefix_checker, $str, 1)); - my $negate = ''; - if ($str =~ /^\!(.*)$/) { - $str = $1; - $negate = '! '; + my ($self) = @_; + my $rule = ""; + my $can_use_port = 1; + + my $addr_checker; + my $prefix_checker; + my $pure_addr_checker; + my $ip_term; + my $prefix_term; + + if ($self->{_ip_version} eq "ipv4") { + # This is an IPv4 rule + $addr_checker = 'ipv4_negate'; + $prefix_checker = 'ipv4net_negate'; + $pure_addr_checker = 'ipv4'; + $ip_term = "IPv4"; + $prefix_term = "subnet"; + } elsif ($self->{_ip_version} eq "ipv6") { + # This is an IPv6 rule + $addr_checker = 'ipv6_negate'; + $prefix_checker = 'ipv6net_negate'; + $pure_addr_checker = 'ipv6'; + $ip_term = "IPv6"; + $prefix_term = "prefix"; + } else { + return (undef, "Invalid IP version: $self->{_ip_version}"); } - $rule .= "$negate --$self->{_srcdst} $str "; - $group_ok{network} = 0; - } elsif (defined($self->{_address})) { - my $str = $self->{_address}; - return (undef, "\"$str\" is not a valid $ip_term address") - if (!Vyatta::TypeChecker::validateType($addr_checker, $str, 1)); - my $negate = ''; - if ($str =~ /^\!(.*)$/) { - $str = $1; - $negate = '! '; + + if ( !defined($self->{_protocol}) + || !defined($_protocolswithports{$self->{_protocol}})) + { + $can_use_port = 0; } - $rule .= "$negate --$self->{_srcdst} $str "; - $group_ok{address} = 0; - } elsif ((defined $self->{_range_start}) && (defined $self->{_range_stop})) { - my $start = $self->{_range_start}; - my $stop = $self->{_range_stop}; - return (undef, "\"$start-$stop\" is not a valid IP range") - if (!Vyatta::TypeChecker::validateType($addr_checker, $start, 1) - || !Vyatta::TypeChecker::validateType($pure_addr_checker, $stop, 1)); - my $negate = ''; - if ($self->{_range_start} =~ /^!(.*)$/) { - $start = $1; - $negate = '! '; + + if (($self->{_srcdst} eq "source") && (defined($self->{_src_mac}))) { + + # handle src mac + my $str = $self->{_src_mac}; + my $negate = ''; + if ($str =~ /^\!(.*)$/) { + $str = $1; + $negate = '! '; + } + $rule .= "-m mac $negate --mac-source $str "; } - if ("$self->{_srcdst}" eq "source") { - $rule .= ("-m iprange $negate --src-range $start-$self->{_range_stop} "); + + my %group_ok; + foreach my $group_type ('address', 'network', 'port') { + $group_ok{$group_type} = 1; } - elsif ("$self->{_srcdst}" eq "destination") { - $rule .= ("-m iprange $negate --dst-range $start-$self->{_range_stop} "); + + # set the address filter parameters + if (defined($self->{_network})) { + my $str = $self->{_network}; + return (undef, "\"$str\" is not a valid $ip_term $prefix_term") + if (!Vyatta::TypeChecker::validateType($prefix_checker, $str, 1)); + my $negate = ''; + if ($str =~ /^\!(.*)$/) { + $str = $1; + $negate = '! '; + } + $rule .= "$negate --$self->{_srcdst} $str "; + $group_ok{network} = 0; + } elsif (defined($self->{_address})) { + my $str = $self->{_address}; + return (undef, "\"$str\" is not a valid $ip_term address") + if (!Vyatta::TypeChecker::validateType($addr_checker, $str, 1)); + my $negate = ''; + if ($str =~ /^\!(.*)$/) { + $str = $1; + $negate = '! '; + } + $rule .= "$negate --$self->{_srcdst} $str "; + $group_ok{address} = 0; + } elsif ((defined $self->{_range_start}) && (defined $self->{_range_stop})) { + my $start = $self->{_range_start}; + my $stop = $self->{_range_stop}; + return (undef, "\"$start-$stop\" is not a valid IP range") + if ( !Vyatta::TypeChecker::validateType($addr_checker, $start, 1) + || !Vyatta::TypeChecker::validateType($pure_addr_checker, $stop, 1)); + my $negate = ''; + if ($self->{_range_start} =~ /^!(.*)$/) { + $start = $1; + $negate = '! '; + } + if ("$self->{_srcdst}" eq "source") { + $rule .= ("-m iprange $negate --src-range $start-$self->{_range_stop} "); + }elsif ("$self->{_srcdst}" eq "destination") { + $rule .= ("-m iprange $negate --dst-range $start-$self->{_range_stop} "); + } + $group_ok{address} = 0; + $group_ok{network} = 0; } - $group_ok{address} = 0; - $group_ok{network} = 0; - } - - $group_ok{port} = 0 if defined $self->{_port}; - my ($port_str, $port_err) - = getPortRuleString($self->{_port}, $can_use_port, - ($self->{_srcdst} eq "source") ? "s" : "d", - $self->{_protocol}); - return (undef, $port_err) if (!defined($port_str)); - $rule .= $port_str; - - # Handle groups last so we can check $group_ok - if ($self->{_ip_version} eq "ipv4") { - # so far ipset only supports IPv4 - my %group_used = ('address' => 0, 'network' => 0); - foreach my $group_type ('address', 'network', 'port') { - my $var_name = '_' . $group_type . '_group'; - if (defined($self->{$var_name})) { - $group_used{$group_type} = 1; - my $name = $self->{$var_name}; - if (! $group_ok{$group_type}) { - return (undef, "Can't mix $self->{_srcdst} $group_type group " . - "[$name] and $group_type"); + + $group_ok{port} = 0 if defined $self->{_port}; + my ($port_str, $port_err)= getPortRuleString($self->{_port}, $can_use_port,($self->{_srcdst} eq "source") ? "s" : "d",$self->{_protocol}); + return (undef, $port_err) if (!defined($port_str)); + $rule .= $port_str; + + # Handle groups last so we can check $group_ok + if ($self->{_ip_version} eq "ipv4") { + + # so far ipset only supports IPv4 + my %group_used = ('address' => 0, 'network' => 0); + foreach my $group_type ('address', 'network', 'port') { + my $var_name = '_' . $group_type . '_group'; + if (defined($self->{$var_name})) { + $group_used{$group_type} = 1; + my $name = $self->{$var_name}; + if (!$group_ok{$group_type}) { + return (undef, "Can't mix $self->{_srcdst} $group_type group [$name] and $group_type"); + } + my $group = new Vyatta::IpTables::IpSet($name, $group_type); + my ($set_rule, $err_str) = $group->rule($self->{_srcdst}); + return ($err_str,) if !defined $set_rule; + $rule .= $set_rule; + } + } + if ($group_used{address} and $group_used{network}) { + return (undef,"Can't combine network and address group for $self->{_srcdst}\n"); } - my $group = new Vyatta::IpTables::IpSet($name, $group_type); - my ($set_rule, $err_str) = $group->rule($self->{_srcdst}); - return ($err_str, ) if ! defined $set_rule; - $rule .= $set_rule; - } - } - if ($group_used{address} and $group_used{network}) { - return (undef, - "Can't combine network and address group for $self->{_srcdst}\n"); } - } - return ($rule, undef); + return ($rule, undef); } sub outputXmlElem { - my ($name, $value, $fh) = @_; - return if ! defined $value; - print $fh " <$name>$value</$name>\n"; + my ($name, $value, $fh) = @_; + return if !defined $value; + print $fh " <$name>$value</$name>\n"; } sub outputXml { - my ($self, $prefix, $fh) = @_; - if (!defined($self->{_address}) && !defined($self->{_network}) - && !defined($self->{_range_start}) && !defined($self->{_range_stop})) { - if (($self->{_ip_version} eq "ipv4")) { - $self->{_address} = "0.0.0.0/0"; - } else { - $self->{_address} = "::/0"; - } - } - outputXmlElem("${prefix}_addr", $self->{_address}, $fh); - outputXmlElem("${prefix}_net", $self->{_network}, $fh); - outputXmlElem("${prefix}_addr_start", $self->{_range_start}, $fh); - outputXmlElem("${prefix}_addr_stop", $self->{_range_stop}, $fh); - outputXmlElem("${prefix}_port", $self->{_port}, $fh); + my ($self, $prefix, $fh) = @_; + if ( !defined($self->{_address}) + && !defined($self->{_network}) + && !defined($self->{_range_start}) + && !defined($self->{_range_stop})) + { + if (($self->{_ip_version} eq "ipv4")) { + $self->{_address} = "0.0.0.0/0"; + } else { + $self->{_address} = "::/0"; + } + } + outputXmlElem("${prefix}_addr", $self->{_address}, $fh); + outputXmlElem("${prefix}_net", $self->{_network}, $fh); + outputXmlElem("${prefix}_addr_start", $self->{_range_start}, $fh); + outputXmlElem("${prefix}_addr_stop", $self->{_range_stop}, $fh); + outputXmlElem("${prefix}_port", $self->{_port}, $fh); } 1; - -# Local Variables: -# mode: perl -# indent-tabs-mode: nil -# perl-indent-level: 2 -# End: diff --git a/lib/Vyatta/IpTables/IpSet.pm b/lib/Vyatta/IpTables/IpSet.pm index 5222edc..37bbb37 100755 --- a/lib/Vyatta/IpTables/IpSet.pm +++ b/lib/Vyatta/IpTables/IpSet.pm @@ -1,24 +1,24 @@ # # Module: IpSet.pm -# +# # **** License **** # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License version 2 as # published by the Free Software Foundation. -# +# # This program is distributed in the hope that it will be useful, but # WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU # General Public License for more details. -# +# # This code was originally developed by Vyatta, Inc. # Portions created by Vyatta are Copyright (C) 2009-2010 Vyatta, Inc. # All Rights Reserved. -# +# # Author: Stig Thormodsrud # Date: January 2009 # Description: vyatta interface to ipset -# +# # **** End License **** # @@ -48,7 +48,7 @@ our %grouptype_hash = ( my $logger = 'logger -t IpSet.pm -p local0.warn --'; -# Currently we restrict an address range to a /24 even +# Currently we restrict an address range to a /24 even # though ipset would support a /16. The main reason is # due to the long time it takes to make that many calls # to add each individual member to the set. @@ -67,17 +67,15 @@ $SIG{'INT'} = 'INT_handler'; sub new { my ($that, $name, $type) = @_; - my $class = ref ($that) || $that; - my $self = { - %fields, - }; + my $class = ref($that) || $that; + my $self = {%fields,}; if ($name =~ m/^!/) { - $self->{_negate} = 1; - $name =~ s/^!(.*)$/$1/; + $self->{_negate} = 1; + $name =~ s/^!(.*)$/$1/; } $self->{_name} = $name; $self->{_type} = $type; - + bless $self, $class; return $self; } @@ -94,8 +92,8 @@ sub run_cmd { my $rc = system("sudo $cmd"); if (defined $self->{_debug}) { - my $func = (caller(1))[3]; - system("$logger [$func] [$cmd] = [$rc]"); + my $func = (caller(1))[3]; + system("$logger [$func] [$cmd] = [$rc]"); } return $rc; } @@ -104,12 +102,12 @@ sub exists { my ($self) = @_; return 1 if defined $self->{_exists}; - return 0 if ! defined $self->{_name}; + return 0 if !defined $self->{_name}; my $cmd = "ipset -L $self->{_name} > /dev/null 2>&1"; my $rc = $self->run_cmd($cmd); if ($rc eq 0) { - $self->{_exists} = 1; - $self->get_type() if ! defined $self->{_type}; + $self->{_exists} = 1; + $self->get_type() if !defined $self->{_type}; } return $rc ? 0 : 1; } @@ -118,21 +116,21 @@ sub get_type { my ($self) = @_; return $self->{_type} if defined $self->{_type}; - return if ! $self->exists(); + return if !$self->exists(); my @lines = `ipset -L $self->{_name}`; my $type; foreach my $line (@lines) { - if ($line =~ /^Type:\s+([\w:]+)$/) { - $type = $1; - last; - } + if ($line =~ /^Type:\s+([\w:]+)$/) { + $type = $1; + last; + } } - return if ! defined $type; + return if !defined $type; foreach my $vtype (keys(%grouptype_hash)) { - if ($grouptype_hash{$vtype} eq $type) { - $self->{_type} = $vtype; - last; - } + if ($grouptype_hash{$vtype} eq $type) { + $self->{_type} = $vtype; + last; + } } return $self->{_type}; } @@ -147,54 +145,54 @@ sub natural_order { my ($a, $b) = @_; my @a = alphanum_split($a); my @b = alphanum_split($b); - + while (@a && @b) { - my $a_seg = shift @a; - my $b_seg = shift @b; - my $val; - if (($a_seg =~ /\d/) && ($b_seg =~ /\d/)) { - $val = $a_seg <=> $b_seg; - } else { - $val = $a_seg cmp $b_seg; - } - if ($val != 0) { - return $val; - } + my $a_seg = shift @a; + my $b_seg = shift @b; + my $val; + if (($a_seg =~ /\d/) && ($b_seg =~ /\d/)) { + $val = $a_seg <=> $b_seg; + } else { + $val = $a_seg cmp $b_seg; + } + if ($val != 0) { + return $val; + } } return @a <=> @b; } sub get_members { my ($self) = @_; - + my @members = (); - return @members if ! $self->exists(); + return @members if !$self->exists(); my @lines = `ipset -L $self->{_name} -s`; foreach my $line (@lines) { - push @members, $line if $line =~ /^\d/; + push @members, $line if $line =~ /^\d/; } if ($self->{_type} ne 'port') { - @members = sort { natural_order($a,$b) } @members; + @members = sort {natural_order($a,$b)} @members; } return @members; } sub create { my ($self) = @_; - - return "Error: undefined group name" if ! defined $self->{_name}; - return "Error: undefined group type" if ! defined $self->{_type}; + + return "Error: undefined group name" if !defined $self->{_name}; + return "Error: undefined group type" if !defined $self->{_type}; return if $self->exists(); # treat as nop if already exists my $ipset_param = $grouptype_hash{$self->{_type}}; - return "Error: invalid group type\n" if ! defined $ipset_param; + return "Error: invalid group type\n" if !defined $ipset_param; if ($self->{_type} eq 'port') { - $ipset_param .= ' --from 1 --to 65535'; - } + $ipset_param .= ' --from 1 --to 65535'; + } - my $cmd = "ipset -N $self->{_name} $ipset_param"; + my $cmd = "ipset -N $self->{_name} $ipset_param"; my $rc = $self->run_cmd($cmd); return "Error: call to ipset failed [$rc]" if $rc; return; # undef @@ -203,45 +201,47 @@ sub create { sub references { my ($self) = @_; - return 0 if ! $self->exists(); + return 0 if !$self->exists(); my @lines = `ipset -L $self->{_name}`; foreach my $line (@lines) { - if ($line =~ /^References:\s+(\d+)$/) { - return $1; - } + if ($line =~ /^References:\s+(\d+)$/) { + return $1; + } } return 0; } sub flush { - my ($self) = @_; - my $cmd = "ipset flush $self->{_name}"; - my $rc = $self->run_cmd($cmd); - return "Error: call to ipset failed [$rc]" if $rc; - return; + my ($self) = @_; + my $cmd = "ipset flush $self->{_name}"; + my $rc = $self->run_cmd($cmd); + return "Error: call to ipset failed [$rc]" if $rc; + return; } sub rebuild_ipset() { - my ($self) = @_; - my $name = $self->{_name}; - my $type = $self->{_type}; - my $config = new Vyatta::Config; - - my @members = $config->returnOrigValues("firewall group $type-group $name $type"); - # go through the firewall group config with this name, - my $member; - foreach $member (@members) { - $self->add_member($member, $name); - } + my ($self) = @_; + my $name = $self->{_name}; + my $type = $self->{_type}; + my $config = new Vyatta::Config; + + my @members = $config->returnOrigValues("firewall group $type-group $name $type"); + + # go through the firewall group config with this name, + my $member; + foreach $member (@members) { + $self->add_member($member, $name); + } } sub reset_ipset_named { - my ($self) = @_; - my $name = $self->{_name}; - # flush the ipset group first, then re-build the group from configuration - $self->flush(); - - $self->rebuild_ipset(); + my ($self) = @_; + my $name = $self->{_name}; + + # flush the ipset group first, then re-build the group from configuration + $self->flush(); + + $self->rebuild_ipset(); } sub reset_ipset_all { @@ -249,57 +249,61 @@ sub reset_ipset_all { my @pgroups = $config->listOrigNodes("firewall group port-group"); my @adgroups = $config->listOrigNodes("firewall group address-group"); my @nwgroups = $config->listOrigNodes("firewall group network-group"); - my $group; + my $group; foreach $group (@pgroups) { - my $grp = new Vyatta::IpTables::IpSet($group, "port"); - $grp->reset_ipset_named(); + my $grp = new Vyatta::IpTables::IpSet($group, "port"); + $grp->reset_ipset_named(); } foreach $group (@adgroups) { - my $grp = new Vyatta::IpTables::IpSet($group, "address"); - $grp->reset_ipset_named(); + my $grp = new Vyatta::IpTables::IpSet($group, "address"); + $grp->reset_ipset_named(); } foreach $group (@nwgroups) { - my $grp = new Vyatta::IpTables::IpSet($group, "network"); - $grp->reset_ipset_named(); + my $grp = new Vyatta::IpTables::IpSet($group, "network"); + $grp->reset_ipset_named(); } } sub reset_ipset { - # main function to do the reset operation - my ($self) = @_; - my $name = $self->{_name}; - - my $lockcmd = "touch $lockfile"; - my $unlockcmd = "rm -f $lockfile"; - $self->run_cmd($lockcmd); - - # reset one rule or all? - if ($name eq 'all') { - $self->reset_ipset_all(); - } else { - $self->reset_ipset_named(); - } - my $rc = $self->run_cmd($unlockcmd); - return "Error: call to ipset failed [$rc]" if $rc; - return; # undef + + # main function to do the reset operation + my ($self) = @_; + my $name = $self->{_name}; + + my $lockcmd = "touch $lockfile"; + my $unlockcmd = "rm -f $lockfile"; + $self->run_cmd($lockcmd); + + # reset one rule or all? + if ($name eq 'all') { + $self->reset_ipset_all(); + } else { + $self->reset_ipset_named(); + } + my $rc = $self->run_cmd($unlockcmd); + return "Error: call to ipset failed [$rc]" if $rc; + return; # undef } sub delete { my ($self) = @_; - return "Error: undefined group name" if ! defined $self->{_name}; + return "Error: undefined group name" if !defined $self->{_name}; return "Error: group [$self->{_name}] doesn't exists\n" if !$self->exists(); my $refs = $self->references(); if ($refs > 0) { - # still in use - if (scalar($self->get_firewall_references(1)) > 0) { - # still referenced by config - return "Error: group [$self->{_name}] still in use.\n"; - } - # not referenced by config => simultaneous deletes. just do flush. - return $self->flush(); + + # still in use + if (scalar($self->get_firewall_references(1)) > 0) { + + # still referenced by config + return "Error: group [$self->{_name}] still in use.\n"; + } + + # not referenced by config => simultaneous deletes. just do flush. + return $self->flush(); } my $cmd = "ipset -X $self->{_name}"; @@ -312,10 +316,10 @@ sub check_member_address { my $member = shift; if (!Vyatta::TypeChecker::validateType('ipv4', $member, 1)) { - return "Error: [$member] isn't valid IPv4 address\n"; + return "Error: [$member] isn't valid IPv4 address\n"; } if ($member eq '0.0.0.0') { - return "Error: zero IP address not valid in address-group\n"; + return "Error: zero IP address not valid in address-group\n"; } return; } @@ -323,8 +327,8 @@ sub check_member_address { sub check_member { my ($self, $member) = @_; - return "Error: undefined group name" if ! defined $self->{_name}; - return "Error: undefined group type" if ! defined $self->{_type}; + return "Error: undefined group name" if !defined $self->{_name}; + return "Error: undefined group type" if !defined $self->{_type}; # We can't call $self->member_exists() here since this is a # syntax check and the group may not have been created yet @@ -332,72 +336,72 @@ sub check_member { # exists check to $self->add_member(). if ($self->{_type} eq 'address') { - if ($member =~ /^([^-]+)-([^-]+)$/) { - foreach my $address ($1, $2) { - my $rc = check_member_address($address); - return $rc if defined $rc; - } - my $start_ip = new NetAddr::IP($1); - my $stop_ip = new NetAddr::IP($2); - if ($stop_ip <= $start_ip) { - return "Error: $1 must be less than $2\n"; - } - my $start_net = new NetAddr::IP("$1/$addr_range_mask"); - if (! $start_net->contains($stop_ip)) { - return "Error: address range must be within /$addr_range_mask\n"; - } - - } else { - my $rc = check_member_address($member); - return $rc if defined $rc; - } + if ($member =~ /^([^-]+)-([^-]+)$/) { + foreach my $address ($1, $2) { + my $rc = check_member_address($address); + return $rc if defined $rc; + } + my $start_ip = new NetAddr::IP($1); + my $stop_ip = new NetAddr::IP($2); + if ($stop_ip <= $start_ip) { + return "Error: $1 must be less than $2\n"; + } + my $start_net = new NetAddr::IP("$1/$addr_range_mask"); + if (!$start_net->contains($stop_ip)) { + return "Error: address range must be within /$addr_range_mask\n"; + } + + } else { + my $rc = check_member_address($member); + return $rc if defined $rc; + } } elsif ($self->{_type} eq 'network') { - if (!Vyatta::TypeChecker::validateType('ipv4net', $member, 1)) { - return "Error: [$member] isn't a valid IPv4 network\n"; - } - if ($member =~ /([\d.]+)\/(\d+)/) { - my ($net, $mask) = ($1, $2); - return "Error: zero net invalid in network-group\n" - if $net eq '0.0.0.0'; - return "Error: invalid mask [$mask] - must be between 1-31\n" - if $mask < 1 or $mask > 31; - } else { - return "Error: Invalid network group [$member]\n"; - } + if (!Vyatta::TypeChecker::validateType('ipv4net', $member, 1)) { + return "Error: [$member] isn't a valid IPv4 network\n"; + } + if ($member =~ /([\d.]+)\/(\d+)/) { + my ($net, $mask) = ($1, $2); + return "Error: zero net invalid in network-group\n" + if $net eq '0.0.0.0'; + return "Error: invalid mask [$mask] - must be between 1-31\n" + if $mask < 1 or $mask > 31; + } else { + return "Error: Invalid network group [$member]\n"; + } } elsif ($self->{_type} eq 'port') { - my ($success, $err) = (undef, "invalid port [$member]"); - if ($member =~ /^(\d+)-(\d+)$/) { - ($success, $err) = Vyatta::Misc::isValidPortRange($member, '-'); - } elsif ($member =~ /^\d/) { - ($success, $err) = Vyatta::Misc::isValidPortNumber($member); - } else { - ($success, $err) = Vyatta::Misc::isValidPortName($member); - } - return "Error: $err\n" if defined $err; + my ($success, $err) = (undef, "invalid port [$member]"); + if ($member =~ /^(\d+)-(\d+)$/) { + ($success, $err) = Vyatta::Misc::isValidPortRange($member, '-'); + } elsif ($member =~ /^\d/) { + ($success, $err) = Vyatta::Misc::isValidPortNumber($member); + } else { + ($success, $err) = Vyatta::Misc::isValidPortName($member); + } + return "Error: $err\n" if defined $err; } else { - return "Error: invalid set type [$self->{_type}]"; + return "Error: invalid set type [$self->{_type}]"; } - return; #undef + return; #undef } sub member_exists { my ($self, $member) = @_; - + my $cmd = "ipset -T $self->{_name} $member -q"; my $rc = $self->run_cmd($cmd); - return $rc ? 0 : 1; + return $rc ? 0 : 1; } sub add_member { my ($self, $member, $alias, $hyphenated_port) = @_; - return "Error: undefined group name" if ! defined $self->{_name}; + return "Error: undefined group name" if !defined $self->{_name}; return "Error: group [$self->{_name}] doesn't exists\n" if !$self->exists(); if ($self->member_exists($member)) { my $set_name = $alias; - $set_name = $self->{_name} if ! defined $set_name; - return "Error: member [$member] already exists in [$set_name]\n"; + $set_name = $self->{_name} if !defined $set_name; + return "Error: member [$member] already exists in [$set_name]\n"; } my $cmd = "ipset -A $self->{_name} $member"; my $rc = $self->run_cmd($cmd); @@ -406,21 +410,21 @@ sub add_member { } sub delete_member_range { - my ($self, $start, $stop) = @_; - + my ($self, $start, $stop) = @_; + if ($self->{_type} eq 'port') { - foreach my $member ($start .. $stop) { - my $rc = $self->delete_member($member); - return $rc if defined $rc; - } + foreach my $member ($start .. $stop) { + my $rc = $self->delete_member($member); + return $rc if defined $rc; + } } elsif ($self->{_type} eq 'address') { - my $start_ip = new NetAddr::IP("$start/$addr_range_mask"); - my $stop_ip = new NetAddr::IP("$stop/$addr_range_mask"); - for (; $start_ip <= $stop_ip; $start_ip++) { - my $rc = $self->delete_member($start_ip->addr()); - return $rc if defined $rc; + my $start_ip = new NetAddr::IP("$start/$addr_range_mask"); + my $stop_ip = new NetAddr::IP("$stop/$addr_range_mask"); + for (; $start_ip <= $stop_ip; $start_ip++) { + my $rc = $self->delete_member($start_ip->addr()); + return $rc if defined $rc; last if $start_ip->cidr() eq $start_ip->broadcast(); - } + } } return; } @@ -428,17 +432,17 @@ sub delete_member_range { sub delete_member { my ($self, $member, $hyphenated_port) = @_; - return "Error: undefined group name" if ! defined $self->{_name}; + return "Error: undefined group name" if !defined $self->{_name}; return "Error: group [$self->{_name}] doesn't exists\n" if !$self->exists(); # service name or port name may contain a hyphen, which needs to be escaped # using square brackets in ipset, to avoid confusion with port ranges if (($member =~ /^([^-]+)-([^-]+)$/) and ((defined($hyphenated_port)) and ($hyphenated_port eq 'false'))) { - return $self->delete_member_range($1, $2); + return $self->delete_member_range($1, $2); } if (!$self->member_exists($member)) { - return "Error: member [$member] doesn't exists in [$self->{_name}]\n"; + return "Error: member [$member] doesn't exists in [$self->{_name}]\n"; } my $cmd = "ipset -D $self->{_name} $member"; my $rc = $self->run_cmd($cmd); @@ -449,10 +453,10 @@ sub delete_member { sub get_description { my ($self) = @_; - return if ! $self->exists(); + return if !$self->exists(); my $config = new Vyatta::Config; my $group_type = "$self->{_type}-group"; - $config->setLevel("firewall group $group_type $self->{_name}"); + $config->setLevel("firewall group $group_type $self->{_name}"); return $config->returnOrigValue('description'); } @@ -463,29 +467,29 @@ sub get_firewall_references { ($lfunc, $vfunc) = qw(listNodes returnValue); } my @fw_refs = (); - return @fw_refs if ! $self->exists(); + return @fw_refs if !$self->exists(); my $config = new Vyatta::Config; foreach my $tree ('name', 'modify') { - my $path = "firewall $tree "; - $config->setLevel($path); - my @names = $config->$lfunc(); - foreach my $name (@names) { - my $name_path = "$path $name rule "; - $config->setLevel($name_path); - my @rules = $config->$lfunc(); - foreach my $rule (@rules) { - foreach my $dir ('source', 'destination') { - my $rule_path = "$name_path $rule $dir group"; - $config->setLevel($rule_path); - my $group_type = "$self->{_type}-group"; - my $value = $config->$vfunc($group_type); - $value =~ s/^!(.*)$/$1/ if defined $value; - if (defined $value and $self->{_name} eq $value) { - push @fw_refs, "$name-$rule-$dir"; - } - } # foreach $dir - } # foreach $rule - } # foreach $name + my $path = "firewall $tree "; + $config->setLevel($path); + my @names = $config->$lfunc(); + foreach my $name (@names) { + my $name_path = "$path $name rule "; + $config->setLevel($name_path); + my @rules = $config->$lfunc(); + foreach my $rule (@rules) { + foreach my $dir ('source', 'destination') { + my $rule_path = "$name_path $rule $dir group"; + $config->setLevel($rule_path); + my $group_type = "$self->{_type}-group"; + my $value = $config->$vfunc($group_type); + $value =~ s/^!(.*)$/$1/ if defined $value; + if (defined $value and $self->{_name} eq $value) { + push @fw_refs, "$name-$rule-$dir"; + } + } # foreach $dir + } # foreach $rule + } # foreach $name } # foreach $tree return @fw_refs; } @@ -493,10 +497,10 @@ sub get_firewall_references { sub rule { my ($self, $direction) = @_; - if (! $self->exists()) { - my $name = $self->{_name}; - $name = 'undefined' if ! defined $name; - return (undef, "Undefined group [$name]"); + if (!$self->exists()) { + my $name = $self->{_name}; + $name = 'undefined' if !defined $name; + return (undef, "Undefined group [$name]"); } my $srcdst; @@ -504,10 +508,10 @@ sub rule { $srcdst = 'src' if $direction eq 'source'; $srcdst = 'dst' if $direction eq 'destination'; - return (undef, "Invalid direction [$direction]") if ! defined $srcdst; + return (undef, "Invalid direction [$direction]") if !defined $srcdst; my $opt = ''; $opt = '!' if $self->{_negate}; - return (" -m set $opt --match-set $grp $srcdst ", ); + return (" -m set $opt --match-set $grp $srcdst ",); } 1; diff --git a/lib/Vyatta/IpTables/Mgr.pm b/lib/Vyatta/IpTables/Mgr.pm index 6723bc3..39a03f1 100755 --- a/lib/Vyatta/IpTables/Mgr.pm +++ b/lib/Vyatta/IpTables/Mgr.pm @@ -1,24 +1,24 @@ # # Module: Vyatta::IpTables::Mgr.pm -# +# # **** License **** # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License version 2 as # published by the Free Software Foundation. -# +# # This program is distributed in the hope that it will be useful, but # WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU # General Public License for more details. -# +# # This code was originally developed by Vyatta, Inc. # Portions created by Vyatta are Copyright (C) 2010 Vyatta, Inc. # All Rights Reserved. -# +# # Author: Stig Thormodsrud # Date: June 2010 # Description: common iptables routines -# +# # **** End License **** # @@ -29,251 +29,248 @@ use warnings; use base 'Exporter'; our @EXPORT = qw(ipt_find_chain_rule ipt_enable_conntrack - ipt_disable_conntrack count_iptables_rules - chain_referenced ipt_get_queue_target - run_ipt_cmd create_ipt_chain delete_ipt_chain - flush_ipt_chain insert_ipt_rule append_ipt_rule - delete_ipt_rule delete_ipt_rulenum ipt_find_comment_rule); + ipt_disable_conntrack count_iptables_rules + chain_referenced ipt_get_queue_target + run_ipt_cmd create_ipt_chain delete_ipt_chain + flush_ipt_chain insert_ipt_rule append_ipt_rule + delete_ipt_rule delete_ipt_rulenum ipt_find_comment_rule); ## TODO - in future, we could use perl's libiptc module instead of ## running system commands in the following function for iptables. ## However, that would need integrating the libiptc module into the system ## and also adding other functionality to it, including IPv6 support. sub run_ipt_cmd { - my ($cmd) = shift; - my $error = system("$cmd"); - - my $debug = "false"; - my $syslog = "false"; - my $logger = "sudo logger -t Vyatta::IPTables::Mgr -p local0.warn --"; - - if ($syslog eq "true") { - my $func = (caller(1))[3]; - system("$logger [$func] [$cmd] = [$error]"); - } - if ($debug eq "true") { - my $func = (caller(1))[3]; - print "\n[$func] [$cmd] = [$error]"; - } - return $error; + my ($cmd) = shift; + my $error = system("$cmd"); + + my $debug = "false"; + my $syslog = "false"; + my $logger = "sudo logger -t Vyatta::IPTables::Mgr -p local0.warn --"; + + if ($syslog eq "true") { + my $func = (caller(1))[3]; + system("$logger [$func] [$cmd] = [$error]"); + } + if ($debug eq "true") { + my $func = (caller(1))[3]; + print "\n[$func] [$cmd] = [$error]"; + } + return $error; } sub create_ipt_chain { - my ($ipt_cmd, $table, $chain) = @_; - my ($cmd, $error); + my ($ipt_cmd, $table, $chain) = @_; + my ($cmd, $error); - $cmd = "sudo $ipt_cmd -t $table -N $chain"; - $error = run_ipt_cmd($cmd); - return "create_ipt_chain [$ipt_cmd -t $table -N $chain] -failed: [error code - $error]" if $error; + $cmd = "sudo $ipt_cmd -t $table -N $chain"; + $error = run_ipt_cmd($cmd); + return "create_ipt_chain [$ipt_cmd -t $table -N $chain] failed: [error code - $error]" if $error; - return; + return; } sub flush_ipt_chain { - my ($ipt_cmd, $table, $chain) = @_; - my ($cmd, $error); + my ($ipt_cmd, $table, $chain) = @_; + my ($cmd, $error); - $cmd = "sudo $ipt_cmd -t $table -F $chain"; - $error = run_ipt_cmd($cmd); - return "flush_ipt_chain [$ipt_cmd -t $table -F $chain] -failed: [error code - $error]" if $error; + $cmd = "sudo $ipt_cmd -t $table -F $chain"; + $error = run_ipt_cmd($cmd); + return "flush_ipt_chain [$ipt_cmd -t $table -F $chain] failed: [error code - $error]" if $error; - return; + return; } sub delete_ipt_chain { - my ($ipt_cmd, $table, $chain) = @_; - my ($cmd, $error); + my ($ipt_cmd, $table, $chain) = @_; + my ($cmd, $error); - $cmd = "sudo $ipt_cmd -t $table -X $chain"; - $error = run_ipt_cmd($cmd); - return "delete_ipt_chain [$ipt_cmd -t $table -X $chain] -failed: [error code - $error]" if $error; + $cmd = "sudo $ipt_cmd -t $table -X $chain"; + $error = run_ipt_cmd($cmd); + return "delete_ipt_chain [$ipt_cmd -t $table -X $chain] failed: [error code - $error]" if $error; - return; + return; } sub insert_ipt_rule { - my ($ipt_cmd, $table, $chain, $jump_target, $insert_num, $append_options) = @_; - my ($cmd, $error); + my ($ipt_cmd, $table, $chain, $jump_target, $insert_num, $append_options) = @_; + my ($cmd, $error); - $insert_num = 1 if (!defined $insert_num); - $cmd = "sudo $ipt_cmd -t $table -I $chain $insert_num -j $jump_target "; - $cmd .= $append_options if defined $append_options; - $error = run_ipt_cmd($cmd); - return "insert_ipt_rule [$ipt_cmd -t $table -I $chain $insert_num -j $jump_target] -failed: [error code - $error]" if $error; + $insert_num = 1 if (!defined $insert_num); + $cmd = "sudo $ipt_cmd -t $table -I $chain $insert_num -j $jump_target "; + $cmd .= $append_options if defined $append_options; + $error = run_ipt_cmd($cmd); + return "insert_ipt_rule [$ipt_cmd -t $table -I $chain $insert_num -j $jump_target] failed: [error code - $error]" if $error; - return; + return; } sub append_ipt_rule { - my ($ipt_cmd, $table, $chain, $jump_target, $append_options) = @_; - my ($cmd, $error); + my ($ipt_cmd, $table, $chain, $jump_target, $append_options) = @_; + my ($cmd, $error); - $cmd = "sudo $ipt_cmd -t $table -A $chain -j $jump_target "; - $cmd .= $append_options if defined $append_options; - $error = run_ipt_cmd($cmd); - return "append_ipt_rule [$ipt_cmd -t $table -A $chain -j $jump_target] -failed: [error code - $error]" if $error; + $cmd = "sudo $ipt_cmd -t $table -A $chain -j $jump_target "; + $cmd .= $append_options if defined $append_options; + $error = run_ipt_cmd($cmd); + return "append_ipt_rule [$ipt_cmd -t $table -A $chain -j $jump_target] failed: [error code - $error]" if $error; - return; + return; } # delete rule based on jump target. should only be used if jump_target is unique in that chain sub delete_ipt_rule { - my ($ipt_cmd, $table, $chain, $jump_target) = @_; - my ($cmd, $error); + my ($ipt_cmd, $table, $chain, $jump_target) = @_; + my ($cmd, $error); - $cmd = "sudo $ipt_cmd -t $table -D $chain -j $jump_target"; - $error = run_ipt_cmd($cmd); - return "delete_ipt_rule [$ipt_cmd -t $table -D $chain -j $jump_target] -failed: [error code - $error]" if $error; + $cmd = "sudo $ipt_cmd -t $table -D $chain -j $jump_target"; + $error = run_ipt_cmd($cmd); + return "delete_ipt_rule [$ipt_cmd -t $table -D $chain -j $jump_target] failed: [error code - $error]" if $error; - return; + return; } # delete rule based on rule number sub delete_ipt_rulenum { - my ($ipt_cmd, $table, $chain, $delete_num) = @_; - my ($cmd, $error); + my ($ipt_cmd, $table, $chain, $delete_num) = @_; + my ($cmd, $error); - $cmd = "sudo $ipt_cmd -t $table -D $chain $delete_num"; - $error = run_ipt_cmd($cmd); - return "delete_ipt_rulenum [$ipt_cmd -t $table -D $chain $delete_num] -failed: [error code - $error]" if $error; + $cmd = "sudo $ipt_cmd -t $table -D $chain $delete_num"; + $error = run_ipt_cmd($cmd); + return "delete_ipt_rulenum [$ipt_cmd -t $table -D $chain $delete_num] failed: [error code - $error]" if $error; - return; + return; } # searches and returns first found rule based on jump target sub ipt_find_chain_rule { - my ($iptables_cmd, $table, $chain, $search) = @_; - - my ($num, $chain2) = (undef, undef); - my $cmd = "$iptables_cmd -t $table -L $chain -vn --line"; - my @lines = `sudo $cmd 2> /dev/null | egrep ^[0-9]`; - if (scalar(@lines) < 1) { + my ($iptables_cmd, $table, $chain, $search) = @_; + + my ($num, $chain2) = (undef, undef); + my $cmd = "$iptables_cmd -t $table -L $chain -vn --line"; + my @lines = `sudo $cmd 2> /dev/null | egrep ^[0-9]`; + if (scalar(@lines) < 1) { + return; + } + foreach my $line (@lines) { + ($num, undef, undef, $chain2) = split /\s+/, $line; + last if $chain2 eq $search; + ($num, $chain2) = (undef, undef); + } + + return $num if defined $num; return; - } - foreach my $line (@lines) { - ($num, undef, undef, $chain2) = split /\s+/, $line; - last if $chain2 eq $search; - ($num, $chain2) = (undef, undef); - } - - return $num if defined $num; - return; } # searches and returns first found rule based on matching text in rule comment sub ipt_find_comment_rule { - my ($iptables_cmd, $table, $chain, $search) = @_; + my ($iptables_cmd, $table, $chain, $search) = @_; - my $cmd = "$iptables_cmd -t $table -L $chain -vn --line"; - my @lines = `sudo $cmd 2> /dev/null | egrep ^[0-9]`; - if (scalar(@lines) < 1) { - return; - } - - my ($num, $rule_txt, $comment) = (undef, undef); - foreach my $line (@lines) { - ($rule_txt, $comment) = split /\/\*/, $line; - #print "rule_txt : $rule_txt, comment : $comment\n"; - if (defined $comment && $comment =~ m/$search/) { - #print "found $search in $comment \n"; - ($num) = split /\s+/, $rule_txt if defined $rule_txt; - return $num; + my $cmd = "$iptables_cmd -t $table -L $chain -vn --line"; + my @lines = `sudo $cmd 2> /dev/null | egrep ^[0-9]`; + if (scalar(@lines) < 1) { + return; + } + + my ($num, $rule_txt, $comment) = (undef, undef); + foreach my $line (@lines) { + ($rule_txt, $comment) = split /\/\*/, $line; + + #print "rule_txt : $rule_txt, comment : $comment\n"; + if (defined $comment && $comment =~ m/$search/) { + + #print "found $search in $comment \n"; + ($num) = split /\s+/, $rule_txt if defined $rule_txt; + return $num; + } + ($rule_txt, $comment) = (undef, undef); } - ($rule_txt, $comment) = (undef, undef); - } - return; + return; } -my %conntrack_hook_hash = - ('PREROUTING' => 'VYATTA_CT_PREROUTING_HOOK', +my %conntrack_hook_hash =( + 'PREROUTING' => 'VYATTA_CT_PREROUTING_HOOK', 'OUTPUT' => 'VYATTA_CT_OUTPUT_HOOK', - ); +); sub ipt_enable_conntrack { my ($iptables_cmd, $chain) = @_; my $hookCtHelper = 'false'; if (($chain eq 'FW_CONNTRACK') or ($chain eq 'NAT_CONNTRACK')) { - $hookCtHelper = 'true'; + $hookCtHelper = 'true'; } system("sudo $iptables_cmd -t raw -L $chain -n >& /dev/null"); if ($? >> 8) { - # chain does not exist yet. set up conntrack. - system("sudo $iptables_cmd -t raw -N $chain"); - system("sudo $iptables_cmd -t raw -A $chain -j ACCEPT"); - + + # chain does not exist yet. set up conntrack. + system("sudo $iptables_cmd -t raw -N $chain"); + system("sudo $iptables_cmd -t raw -A $chain -j ACCEPT"); + foreach my $label ('PREROUTING', 'OUTPUT') { my $index; my $conntrack_hook = $conntrack_hook_hash{$label}; - $index = ipt_find_chain_rule($iptables_cmd, 'raw', - $label, $conntrack_hook); - if (! defined($index)) { + $index = ipt_find_chain_rule($iptables_cmd, 'raw',$label, $conntrack_hook); + if (!defined($index)) { print "Error: unable to find [$label] [$conntrack_hook]\n"; return 1; } $index++; system("sudo $iptables_cmd -t raw -I $label $index -j $chain"); - + if ($hookCtHelper eq 'true') { - # we want helper hook only for Firewall / NAT. - $conntrack_hook = "VYATTA_CT_HELPER"; - $index = ipt_find_chain_rule($iptables_cmd, 'raw', - $label, $conntrack_hook); - if (! defined($index)) { - # this index does not change now but maybe later we change it, so being defensive. - my $cttimeout_index = ipt_find_chain_rule($iptables_cmd, 'raw', $label, "VYATTA_CT_TIMEOUT"); - if (defined($cttimeout_index)) { - # $cttimeout_index++; fixing 8173 - # currently we have cttimeout at 1 index, it might change in future. - # helper chain should be before timeout chain - system("sudo $iptables_cmd -t raw -I $label $cttimeout_index -j VYATTA_CT_HELPER"); + + # we want helper hook only for Firewall / NAT. + $conntrack_hook = "VYATTA_CT_HELPER"; + $index = ipt_find_chain_rule($iptables_cmd, 'raw',$label, $conntrack_hook); + if (!defined($index)) { + + # this index does not change now but maybe later we change it, so being defensive. + my $cttimeout_index = ipt_find_chain_rule($iptables_cmd, 'raw', $label, "VYATTA_CT_TIMEOUT"); + if (defined($cttimeout_index)) { + + # $cttimeout_index++; fixing 8173 + # currently we have cttimeout at 1 index, it might change in future. + # helper chain should be before timeout chain + system("sudo $iptables_cmd -t raw -I $label $cttimeout_index -j VYATTA_CT_HELPER"); + } } - } - } + } } } return 0; } -sub -remove_cthelper_hook { - my ($iptables_cmd, $label, $chain) =@_; - #label is PREROUTING / OUTPUT, chain is FW_CONNTRACK/NAT_CONNTRACK etc. - my $index; - - # find if we need to remove VYATTA_CT_HELPER - my $cthelper_index = ipt_find_chain_rule($iptables_cmd, 'raw', - $label, 'VYATTA_CT_HELPER'); - if(! defined($cthelper_index)) { - # not an error: this hook is only for FW / NAT - return 0; - } - - # if this chain is FW_CONNTRACK, look if NAT is using it, else remove - if ($chain eq 'FW_CONNTRACK') { - $index = ipt_find_chain_rule($iptables_cmd, 'raw', - $label, 'NAT_CONNTRACK'); - if (! defined($index)) { - # NAT, only other user of helpers, not enabled, can remove VYATTA_CT_HELPER - system("sudo $iptables_cmd -t raw -D $label $cthelper_index"); - return 0; +sub remove_cthelper_hook { + my ($iptables_cmd, $label, $chain) =@_; + + #label is PREROUTING / OUTPUT, chain is FW_CONNTRACK/NAT_CONNTRACK etc. + my $index; + + # find if we need to remove VYATTA_CT_HELPER + my $cthelper_index = ipt_find_chain_rule($iptables_cmd, 'raw',$label, 'VYATTA_CT_HELPER'); + if(!defined($cthelper_index)) { + + # not an error: this hook is only for FW / NAT + return 0; + } + + # if this chain is FW_CONNTRACK, look if NAT is using it, else remove + if ($chain eq 'FW_CONNTRACK') { + $index = ipt_find_chain_rule($iptables_cmd, 'raw',$label, 'NAT_CONNTRACK'); + if (!defined($index)) { + + # NAT, only other user of helpers, not enabled, can remove VYATTA_CT_HELPER + system("sudo $iptables_cmd -t raw -D $label $cthelper_index"); + return 0; + } + } elsif ($chain eq 'NAT_CONNTRACK') { + $index = ipt_find_chain_rule($iptables_cmd, 'raw',$label, 'FW_CONNTRACK'); + if (!defined($index)) { + + # Firewall, only other user of helpers, not enabled, can remove VYATTA_CT_HELPER + system("sudo $iptables_cmd -t raw -D $label $cthelper_index"); + return 0; + } } - } elsif ($chain eq 'NAT_CONNTRACK') { - $index = ipt_find_chain_rule($iptables_cmd, 'raw', - $label, 'FW_CONNTRACK'); - if (! defined($index)) { - # Firewall, only other user of helpers, not enabled, can remove VYATTA_CT_HELPER - system("sudo $iptables_cmd -t raw -D $label $cthelper_index"); - return 0; - } - } } sub ipt_disable_conntrack { @@ -284,34 +281,32 @@ sub ipt_disable_conntrack { foreach my $label ('PREROUTING', 'OUTPUT') { my $index; my $conntrack_hook = $conntrack_hook_hash{$label}; - $index = ipt_find_chain_rule($iptables_cmd, 'raw', - $label, $chain); - if (! defined($index)) { + $index = ipt_find_chain_rule($iptables_cmd, 'raw',$label, $chain); + if (!defined($index)) { if ($debug > 0) { - print "Error: ipt_disable_conntrack failed to find " - . "[$label][$chain]\n"; + print "Error: ipt_disable_conntrack failed to find ". "[$label][$chain]\n"; } return 1; } system("sudo $iptables_cmd -t raw -D $label $index"); - + remove_cthelper_hook($iptables_cmd, $label, $chain); } - + system("sudo $iptables_cmd -t raw -F $chain >& /dev/null"); system("sudo $iptables_cmd -t raw -X $chain >& /dev/null"); return 0; } -my %queue_target_hash = - ('SNORT' => 'NFQUEUE', +my %queue_target_hash =( + 'SNORT' => 'NFQUEUE', 'VG_HTTPS' => 'NFQUEUE --queue-num 1', - ); +); sub ipt_get_queue_target { my ($app) = @_; - + my $target = $queue_target_hash{$app}; return $target; } @@ -323,24 +318,24 @@ sub count_iptables_rules { my @lines = `sudo $cmd 2> /dev/null`; my $cnt = 0; foreach my $line (@lines) { - $cnt++ if $line =~ /^\d/; + $cnt++ if $line =~ /^\d/; } return $cnt; } sub chain_referenced { - my ( $table, $chain, $iptables_cmd ) = @_; - - my $cmd = "$iptables_cmd -t $table -n -L $chain"; - my $line = `sudo $cmd 2>/dev/null |head -n1`; - chomp $line; - my $found = 0; - if ( $line =~ m/^Chain $chain \((\d+) references\)$/ ) { - if ( $1 > 0 ) { - $found = 1; + my ($table, $chain, $iptables_cmd) = @_; + + my $cmd = "$iptables_cmd -t $table -n -L $chain"; + my $line = `sudo $cmd 2>/dev/null |head -n1`; + chomp $line; + my $found = 0; + if ($line =~ m/^Chain $chain \((\d+) references\)$/) { + if ($1 > 0) { + $found = 1; + } } - } - return $found; + return $found; } 1; diff --git a/lib/Vyatta/IpTables/Rule.pm b/lib/Vyatta/IpTables/Rule.pm index 3c266f6..08772a1 100755 --- a/lib/Vyatta/IpTables/Rule.pm +++ b/lib/Vyatta/IpTables/Rule.pm @@ -9,786 +9,782 @@ my $src = new Vyatta::IpTables::AddressFilter; my $dst = new Vyatta::IpTables::AddressFilter; my %fields = ( - _name => undef, - _rule_number => undef, - _protocol => undef, - _state => { - _established => undef, - _new => undef, - _related => undef, - _invalid => undef, - }, - _action => undef, - _log => undef, - _tcp_flags => undef, - _icmp_code => undef, - _icmp_type => undef, - _icmp_name => undef, - _icmpv6_type => undef, - _mod_mark => undef, - _mod_table => undef, - _mod_dscp => undef, - _mod_tcpmss => undef, - _ipsec => undef, - _non_ipsec => undef, - _frag => undef, - _non_frag => undef, - _recent_time => undef, - _recent_cnt => undef, - _p2p => { - _all => undef, - _apple => undef, - _bit => undef, - _dc => undef, - _edk => undef, - _gnu => undef, - _kazaa => undef, - }, - _time => { - _startdate => undef, - _stopdate => undef, - _starttime => undef, - _stoptime => undef, - _monthdays => undef, - _weekdays => undef, - _utc => undef, - }, - _limit => { - _rate => undef, - _burst => undef, - }, - _disable => undef, - _ip_version => undef, - _comment => undef + _name => undef, + _rule_number => undef, + _protocol => undef, + _state => { + _established => undef, + _new => undef, + _related => undef, + _invalid => undef, + }, + _action => undef, + _log => undef, + _tcp_flags => undef, + _icmp_code => undef, + _icmp_type => undef, + _icmp_name => undef, + _icmpv6_type => undef, + _mod_mark => undef, + _mod_table => undef, + _mod_dscp => undef, + _mod_tcpmss => undef, + _ipsec => undef, + _non_ipsec => undef, + _frag => undef, + _non_frag => undef, + _recent_time => undef, + _recent_cnt => undef, + _p2p => { + _all => undef, + _apple => undef, + _bit => undef, + _dc => undef, + _edk => undef, + _gnu => undef, + _kazaa => undef, + }, + _time => { + _startdate => undef, + _stopdate => undef, + _starttime => undef, + _stoptime => undef, + _monthdays => undef, + _weekdays => undef, + _utc => undef, + }, + _limit => { + _rate => undef, + _burst => undef, + }, + _disable => undef, + _ip_version => undef, + _comment => undef ); my %dummy_rule = ( - _rule_number => 10000, - _protocol => "all", - _state => { - _established => undef, - _new => undef, - _related => undef, - _invalid => undef, - }, - _action => "DROP", - _log => undef, - _tcp_flags => undef, - _icmp_code => undef, - _icmp_type => undef, - _icmp_name => undef, - _icmpv6_type => undef, - _mod_mark => undef, - _mod_table => undef, - _mod_dscp => undef, - _mod_tcpmss => undef, - _ipsec => undef, - _non_ipsec => undef, - _frag => undef, - _non_frag => undef, - _recent_time => undef, - _recent_cnt => undef, - _p2p => { - _all => undef, - _apple => undef, - _bit => undef, - _dc => undef, - _edk => undef, - _gnu => undef, - _kazaa => undef, - }, - _time => { - _startdate => undef, - _stopdate => undef, - _starttime => undef, - _stoptime => undef, - _monthdays => undef, - _weekdays => undef, - _utc => undef, - }, - _limit => { - _rate => undef, - _burst => undef, - }, - _disable => undef, - _ip_version => undef, - _comment => undef + _rule_number => 10000, + _protocol => "all", + _state => { + _established => undef, + _new => undef, + _related => undef, + _invalid => undef, + }, + _action => "DROP", + _log => undef, + _tcp_flags => undef, + _icmp_code => undef, + _icmp_type => undef, + _icmp_name => undef, + _icmpv6_type => undef, + _mod_mark => undef, + _mod_table => undef, + _mod_dscp => undef, + _mod_tcpmss => undef, + _ipsec => undef, + _non_ipsec => undef, + _frag => undef, + _non_frag => undef, + _recent_time => undef, + _recent_cnt => undef, + _p2p => { + _all => undef, + _apple => undef, + _bit => undef, + _dc => undef, + _edk => undef, + _gnu => undef, + _kazaa => undef, + }, + _time => { + _startdate => undef, + _stopdate => undef, + _starttime => undef, + _stoptime => undef, + _monthdays => undef, + _weekdays => undef, + _utc => undef, + }, + _limit => { + _rate => undef, + _burst => undef, + }, + _disable => undef, + _ip_version => undef, + _comment => undef ); my $DEBUG = 'false'; sub new { - my $that = shift; - my $class = ref ($that) || $that; - my $self = { - %fields, - }; - - bless $self, $class; - return $self; + my $that = shift; + my $class = ref($that) || $that; + my $self = {%fields,}; + + bless $self, $class; + return $self; } sub setupDummy { - my ($self, $level) = @_; - - %{$self} = %dummy_rule; - $src = new Vyatta::IpTables::AddressFilter; - $dst = new Vyatta::IpTables::AddressFilter; - - # set the default policy - my $config = new Vyatta::Config; - $config->setLevel("$level"); - my $policy = $config->returnOrigValue('default-action'); - $policy = 'drop' if ! defined $policy; - $self->{_action} = $policy; - my $log = $config->existsOrig('enable-default-log'); - $log = 'enable' if defined $log; - $self->{_log} = $log; + my ($self, $level) = @_; + + %{$self} = %dummy_rule; + $src = new Vyatta::IpTables::AddressFilter; + $dst = new Vyatta::IpTables::AddressFilter; + + # set the default policy + my $config = new Vyatta::Config; + $config->setLevel("$level"); + my $policy = $config->returnOrigValue('default-action'); + $policy = 'drop' if !defined $policy; + $self->{_action} = $policy; + my $log = $config->existsOrig('enable-default-log'); + $log = 'enable' if defined $log; + $self->{_log} = $log; } sub setup_base { - my ($self, $level, $val_func, $exists_func, $addr_setup) = @_; - my $config = new Vyatta::Config; - - $self->{_comment} = $level; - $config->setLevel("$level"); - - # for documentation sake. nodes returns an array so must transform - # and ".. .. .." means go up three levels in the current hierarchy - $self->{_name} = $config->returnParent(".. .. .."); - $self->{_rule_number} = $config->returnParent(".."); - - $self->{_protocol} = $config->$val_func("protocol"); - - $self->{_state}->{_established} = $config->$val_func("state established"); - $self->{_state}->{_new} = $config->$val_func("state new"); - $self->{_state}->{_related} = $config->$val_func("state related"); - $self->{_state}->{_invalid} = $config->$val_func("state invalid"); - - $self->{_action} = $config->$val_func("action"); - $self->{_log} = $config->$val_func("log"); - $self->{_tcp_flags} = $config->$val_func("tcp flags"); - $self->{_icmp_code} = $config->$val_func("icmp code"); - $self->{_icmp_type} = $config->$val_func("icmp type"); - $self->{_icmp_name} = $config->$val_func("icmp type-name"); - $self->{_icmpv6_type} = $config->$val_func("icmpv6 type"); - $self->{_mod_mark} = $config->$val_func("set mark"); - $self->{_mod_table} = $config->$val_func("set table"); - if ($self->{_mod_table} eq 'main') { - $self->{_mod_table} = 254; - } - $self->{_mod_dscp} = $config->$val_func("set dscp"); - $self->{_mod_tcpmss} = $config->$val_func("set tcp-mss"); - $self->{_ipsec} = $config->$exists_func("ipsec match-ipsec"); - $self->{_non_ipsec} = $config->$exists_func("ipsec match-none"); - $self->{_frag} = $config->$exists_func("fragment match-frag"); - $self->{_non_frag} = $config->$exists_func("fragment match-non-frag"); - $self->{_recent_time} = $config->$val_func('recent time'); - $self->{_recent_cnt} = $config->$val_func('recent count'); - - $self->{_p2p}->{_all} = $config->$exists_func("p2p all"); - $self->{_p2p}->{_apple} = $config->$exists_func("p2p applejuice"); - $self->{_p2p}->{_bit} = $config->$exists_func("p2p bittorrent"); - $self->{_p2p}->{_dc} = $config->$exists_func("p2p directconnect"); - $self->{_p2p}->{_edk} = $config->$exists_func("p2p edonkey"); - $self->{_p2p}->{_gnu} = $config->$exists_func("p2p gnutella"); - $self->{_p2p}->{_kazaa} = $config->$exists_func("p2p kazaa"); - - $self->{_time}->{_startdate} = $config->$val_func("time startdate"); - $self->{_time}->{_stopdate} = $config->$val_func("time stopdate"); - $self->{_time}->{_starttime} = $config->$val_func("time starttime"); - $self->{_time}->{_stoptime} = $config->$val_func("time stoptime"); - $self->{_time}->{_monthdays} = $config->$val_func("time monthdays"); - $self->{_time}->{_weekdays} = $config->$val_func("time weekdays"); - $self->{_time}->{_utc} = $config->$exists_func("time utc"); - - $self->{_limit}->{_rate} = $config->$val_func("limit rate"); - $self->{_limit}->{_burst} = $config->$val_func("limit burst"); - - $self->{_disable} = $config->$exists_func("disable"); - - # TODO: need $config->exists("$level source") in Vyatta::Config.pm - $src->$addr_setup("$level source"); - $dst->$addr_setup("$level destination"); - - # Default to IPv4 - $self->{_ip_version} = "ipv4"; - return 0; + my ($self, $level, $val_func, $exists_func, $addr_setup) = @_; + my $config = new Vyatta::Config; + + $self->{_comment} = $level; + $config->setLevel("$level"); + + # for documentation sake. nodes returns an array so must transform + # and ".. .. .." means go up three levels in the current hierarchy + $self->{_name} = $config->returnParent(".. .. .."); + $self->{_rule_number} = $config->returnParent(".."); + + $self->{_protocol} = $config->$val_func("protocol"); + + $self->{_state}->{_established} = $config->$val_func("state established"); + $self->{_state}->{_new} = $config->$val_func("state new"); + $self->{_state}->{_related} = $config->$val_func("state related"); + $self->{_state}->{_invalid} = $config->$val_func("state invalid"); + + $self->{_action} = $config->$val_func("action"); + $self->{_log} = $config->$val_func("log"); + $self->{_tcp_flags} = $config->$val_func("tcp flags"); + $self->{_icmp_code} = $config->$val_func("icmp code"); + $self->{_icmp_type} = $config->$val_func("icmp type"); + $self->{_icmp_name} = $config->$val_func("icmp type-name"); + $self->{_icmpv6_type} = $config->$val_func("icmpv6 type"); + $self->{_mod_mark} = $config->$val_func("set mark"); + $self->{_mod_table} = $config->$val_func("set table"); + + if ($self->{_mod_table} eq 'main') { + $self->{_mod_table} = 254; + } + $self->{_mod_dscp} = $config->$val_func("set dscp"); + $self->{_mod_tcpmss} = $config->$val_func("set tcp-mss"); + $self->{_ipsec} = $config->$exists_func("ipsec match-ipsec"); + $self->{_non_ipsec} = $config->$exists_func("ipsec match-none"); + $self->{_frag} = $config->$exists_func("fragment match-frag"); + $self->{_non_frag} = $config->$exists_func("fragment match-non-frag"); + $self->{_recent_time} = $config->$val_func('recent time'); + $self->{_recent_cnt} = $config->$val_func('recent count'); + + $self->{_p2p}->{_all} = $config->$exists_func("p2p all"); + $self->{_p2p}->{_apple} = $config->$exists_func("p2p applejuice"); + $self->{_p2p}->{_bit} = $config->$exists_func("p2p bittorrent"); + $self->{_p2p}->{_dc} = $config->$exists_func("p2p directconnect"); + $self->{_p2p}->{_edk} = $config->$exists_func("p2p edonkey"); + $self->{_p2p}->{_gnu} = $config->$exists_func("p2p gnutella"); + $self->{_p2p}->{_kazaa} = $config->$exists_func("p2p kazaa"); + + $self->{_time}->{_startdate} = $config->$val_func("time startdate"); + $self->{_time}->{_stopdate} = $config->$val_func("time stopdate"); + $self->{_time}->{_starttime} = $config->$val_func("time starttime"); + $self->{_time}->{_stoptime} = $config->$val_func("time stoptime"); + $self->{_time}->{_monthdays} = $config->$val_func("time monthdays"); + $self->{_time}->{_weekdays} = $config->$val_func("time weekdays"); + $self->{_time}->{_utc} = $config->$exists_func("time utc"); + + $self->{_limit}->{_rate} = $config->$val_func("limit rate"); + $self->{_limit}->{_burst} = $config->$val_func("limit burst"); + + $self->{_disable} = $config->$exists_func("disable"); + + # TODO: need $config->exists("$level source") in Vyatta::Config.pm + $src->$addr_setup("$level source"); + $dst->$addr_setup("$level destination"); + + # Default to IPv4 + $self->{_ip_version} = "ipv4"; + return 0; } sub setup { - my ($self, $level) = @_; + my ($self, $level) = @_; - $self->setup_base($level, 'returnValue', 'exists', 'setup'); - return 0; + $self->setup_base($level, 'returnValue', 'exists', 'setup'); + return 0; } sub setupOrig { - my ($self, $level) = @_; + my ($self, $level) = @_; - $self->setup_base($level, 'returnOrigValue', 'existsOrig', 'setupOrig'); + $self->setup_base($level, 'returnOrigValue', 'existsOrig', 'setupOrig'); - $self->{_ip_version} = "ipv4"; - return 0; + $self->{_ip_version} = "ipv4"; + return 0; } sub set_ip_version { - my ($self, $ip_version) = @_; + my ($self, $ip_version) = @_; - $self->{_ip_version} = $ip_version; - $src->set_ip_version($ip_version); - $dst->set_ip_version($ip_version); + $self->{_ip_version} = $ip_version; + $src->set_ip_version($ip_version); + $dst->set_ip_version($ip_version); } sub print { - my ( $self ) = @_; - - print "name: $self->{_name}\n" if defined $self->{_name}; - print "rulenum: $self->{_rule_number}\n" if defined $self->{_rule_number}; - print "protocol: $self->{_protocol}\n" if defined $self->{_protocol}; - print "state: $self->{_state}\n" if defined $self->{_state}; - print "action: $self->{_action}\n" if defined $self->{_action}; - print "log: $self->{_log}\n" if defined $self->{_log}; - print "icmp code: $self->{_icmp_code}\n" if defined $self->{_icmp_code}; - print "icmp type: $self->{_icmp_type}\n" if defined $self->{_icmp_type}; - print "icmpv6 type: $self->{_icmpv6_type}\n" - if defined $self->{_icmpv6_type}; - print "mod mark: $self->{_mod_mark}\n" if defined $self->{_mod_mark}; - print "mod table: $self->{_mod_table}\n" if defined $self->{_mod_table}; - print "mod dscp: $self->{_mod_dscp}\n" if defined $self->{_mod_dscp}; - print "mod tcp-mss: $self->{_mod_tcpmss}\n" if defined $self->{_mod_tcpmss}; - - $src->print(); - $dst->print(); + my ($self) = @_; + + print "name: $self->{_name}\n" if defined $self->{_name}; + print "rulenum: $self->{_rule_number}\n" if defined $self->{_rule_number}; + print "protocol: $self->{_protocol}\n" if defined $self->{_protocol}; + print "state: $self->{_state}\n" if defined $self->{_state}; + print "action: $self->{_action}\n" if defined $self->{_action}; + print "log: $self->{_log}\n" if defined $self->{_log}; + print "icmp code: $self->{_icmp_code}\n" if defined $self->{_icmp_code}; + print "icmp type: $self->{_icmp_type}\n" if defined $self->{_icmp_type}; + print "icmpv6 type: $self->{_icmpv6_type}\n" if defined $self->{_icmpv6_type}; + print "mod mark: $self->{_mod_mark}\n" if defined $self->{_mod_mark}; + print "mod table: $self->{_mod_table}\n" if defined $self->{_mod_table}; + print "mod dscp: $self->{_mod_dscp}\n" if defined $self->{_mod_dscp}; + print "mod tcp-mss: $self->{_mod_tcpmss}\n" if defined $self->{_mod_tcpmss}; + + $src->print(); + $dst->print(); } sub is_stateful { - my $self = shift; - return 0 if defined $self->{_disable}; - my @states = qw(established new related invalid); - foreach (@states) { - if (defined($self->{_state}->{"_$_"}) - && $self->{_state}->{"_$_"} eq "enable") { - return 1; - } - } - return 0; + my $self = shift; + return 0 if defined $self->{_disable}; + my @states = qw(established new related invalid); + foreach (@states) { + if ( defined($self->{_state}->{"_$_"}) + && $self->{_state}->{"_$_"} eq "enable") { + return 1; + } + } + return 0; } sub is_disabled { - my $self = shift; - return 1 if defined $self->{_disable}; - return 0; + my $self = shift; + return 1 if defined $self->{_disable}; + return 0; } sub is_route_table { - my $self = shift; - return $self->{_mod_table}; + my $self = shift; + return $self->{_mod_table}; } sub get_state_str { - my $self = shift; - my @states = qw(established new related invalid); - my @add_states = (); - foreach (@states) { - if (defined($self->{_state}->{"_$_"}) - && $self->{_state}->{"_$_"} eq "enable") { - push @add_states, $_; - } - } - if ($#add_states >= 0) { - my $str = join ',', @add_states; - return $str; - } else { - return ""; - } + my $self = shift; + my @states = qw(established new related invalid); + my @add_states = (); + foreach (@states) { + if ( defined($self->{_state}->{"_$_"}) + && $self->{_state}->{"_$_"} eq "enable") { + push @add_states, $_; + } + } + if ($#add_states >= 0) { + my $str = join ',', @add_states; + return $str; + } else { + return ""; + } } sub get_log_prefix { - my ($chain, $rule_num, $action) = @_; - - # In iptables it allows a 29 character log_prefix, but we ideally - # want to include "[$chain-$rule_num-$action] " but that would require - # 1 29 1 4 1 1 11 = 39 - # so truncate the chain name so that it'll all fit. - my $action_char = uc(substr($action, 0, 1)); - if ( length($chain) > 19 ) { - $chain = substr($chain, 0, 19); - printf STDERR 'Firewall config warning: ' - . "rule $rule_num logging prefix will be truncated to [$chain-$rule_num-$action_char]\n"; - } - my $log_prefix = "[$chain-$rule_num-$action_char] "; - return $log_prefix; + my ($chain, $rule_num, $action) = @_; + + # In iptables it allows a 29 character log_prefix, but we ideally + # want to include "[$chain-$rule_num-$action] " but that would require + # 1 29 1 4 1 1 11 = 39 + # so truncate the chain name so that it'll all fit. + my $action_char = uc(substr($action, 0, 1)); + if (length($chain) > 19) { + $chain = substr($chain, 0, 19); + printf STDERR "Firewall config warning: rule $rule_num logging prefix will be truncated to [$chain-$rule_num-$action_char]\n"; + } + my $log_prefix = "[$chain-$rule_num-$action_char] "; + return $log_prefix; } sub get_num_ipt_rules { - my $self = shift; - my $ipt_rules = 1; - return 0 if defined $self->{_disable}; - my $protocol_tcpudp = 0; - if (defined $self->{_protocol} && $self->{_protocol} eq 'tcp_udp') { - $ipt_rules++; - $protocol_tcpudp = 1; - } - - if (("$self->{_log}" eq "enable") && (("$self->{_action}" eq "drop") - || ("$self->{_action}" eq "accept") - || ("$self->{_action}" eq "reject") - || ("$self->{_action}" eq "inspect") - || ("$self->{_action}" eq "modify"))) { - $ipt_rules += 1; - $ipt_rules++ if $protocol_tcpudp == 1; - } - if (defined($self->{_recent_time}) || defined($self->{_recent_cnt})) { - $ipt_rules += 1; - $ipt_rules++ if $protocol_tcpudp == 1; - } - return $ipt_rules; + my $self = shift; + my $ipt_rules = 1; + return 0 if defined $self->{_disable}; + my $protocol_tcpudp = 0; + if (defined $self->{_protocol} && $self->{_protocol} eq 'tcp_udp') { + $ipt_rules++; + $protocol_tcpudp = 1; + } + + if (( "$self->{_log}" eq "enable") + && ( ("$self->{_action}" eq "drop") + ||("$self->{_action}" eq "accept") + ||("$self->{_action}" eq "reject") + ||("$self->{_action}" eq "inspect") + ||("$self->{_action}" eq "modify"))){ + $ipt_rules += 1; + $ipt_rules++ if $protocol_tcpudp == 1; + } + if (defined($self->{_recent_time}) || defined($self->{_recent_cnt})) { + $ipt_rules += 1; + $ipt_rules++ if $protocol_tcpudp == 1; + } + return $ipt_rules; } sub rule { - my ( $self ) = @_; - my ($rule, $srcrule, $dstrule, $err_str); - my $tcp_and_udp = 0; - - # set CLI rule num as comment - my @level_nodes = split (' ', $self->{_comment}); - $rule .= "-m comment --comment \"$level_nodes[2]-$level_nodes[4]\" "; - - # set the protocol - if (defined($self->{_protocol})) { - my $str = $self->{_protocol}; - my $negate = ''; - if ($str =~ /^\!(.*)$/) { - $str = $1; - $negate = '! '; - } - if ($str eq 'tcp_udp') { - $tcp_and_udp = 1; - $rule .= " $negate -p tcp "; # we'll add the '-p udp' to 2nd rule later + my ($self) = @_; + my ($rule, $srcrule, $dstrule, $err_str); + my $tcp_and_udp = 0; + + # set CLI rule num as comment + my @level_nodes = split(' ', $self->{_comment}); + $rule .= "-m comment --comment \"$level_nodes[2]-$level_nodes[4]\" "; + + # set the protocol + if (defined($self->{_protocol})) { + my $str = $self->{_protocol}; + my $negate = ''; + if ($str =~ /^\!(.*)$/) { + $str = $1; + $negate = '! '; + } + if ($str eq 'tcp_udp') { + $tcp_and_udp = 1; + $rule .= " $negate -p tcp "; # we'll add the '-p udp' to 2nd rule later + } else { + $rule .= " $negate -p $str "; + } + } + + my $state_str = uc(get_state_str($self)); + if ($state_str ne "") { + $rule .= "-m state --state $state_str "; + } + + # set tcp flags if applicable + my $tcp_flags = undef; + if (defined $self->{_tcp_flags}) { + if (($self->{_protocol} eq "tcp") || ($self->{_protocol} eq "6")) { + $tcp_flags = get_tcp_flags_string($self->{_tcp_flags}); + } else { + return ("TCP flags can only be set if protocol is set to TCP",); + } + } + if (defined($tcp_flags)) { + $rule .= " -m tcp --tcp-flags $tcp_flags "; + } + + # set the icmp code and type if applicable + if (($self->{_protocol} eq "icmp") || ($self->{_protocol} eq "1")) { + if (defined $self->{_icmp_name}) { + if (defined($self->{_icmp_type}) || defined($self->{_icmp_code})){ + return ("Cannot use ICMP type/code with ICMP type-name",); + } + $rule .= "--icmp-type $self->{_icmp_name} "; + } elsif (defined $self->{_icmp_type}) { + $rule .= "--icmp-type $self->{_icmp_type}"; + if (defined $self->{_icmp_code}) { + $rule .= "/$self->{_icmp_code}"; + } + $rule .= " "; + } elsif (defined $self->{_icmp_code}) { + return ("ICMP code can only be defined if ICMP type is defined",); + } + } elsif (defined($self->{_icmp_type}) + || defined($self->{_icmp_code}) + || defined($self->{_icmp_name})) + { + return ("ICMP type/code or type-name can only be defined if protocol is ICMP",); + } + + # Setup ICMPv6 rule if configured + # ICMPv6 parameters are only valid if the rule is matching on the + # ICMPv6 protocol ID. + # + if ( ($self->{_protocol} eq "icmpv6") + ||($self->{_protocol} eq "ipv6-icmp") + ||($self->{_protocol} eq "58")) { + if (defined($self->{_icmpv6_type})) { + $rule .= "-m icmpv6 --icmpv6-type $self->{_icmpv6_type}"; + } + } + + # add the source and destination rules + ($srcrule, $err_str) = $src->rule(); + return ($err_str,) if (!defined($srcrule)); + ($dstrule, $err_str) = $dst->rule(); + return ($err_str,) if (!defined($dstrule)); + + # make sure multiport is always behind single port option + if ((grep /multiport/, $srcrule)) { + $rule .= " $dstrule $srcrule "; + } elsif ((grep /multiport/, $dstrule)) { + $rule .= " $srcrule $dstrule "; } else { - $rule .= " $negate -p $str "; + $rule .= " $srcrule $dstrule "; } - } - my $state_str = uc (get_state_str($self)); - if ($state_str ne "") { - $rule .= "-m state --state $state_str "; - } + return ('Cannot specify both "match-frag" and "match-non-frag"',) + if (defined($self->{_frag}) && defined($self->{_non_frag})); + if (defined($self->{_frag})) { + $rule .= ' -f '; + } elsif (defined($self->{_non_frag})) { + $rule .= ' ! -f '; + } - # set tcp flags if applicable - my $tcp_flags = undef; - if (defined $self->{_tcp_flags}) { - if (($self->{_protocol} eq "tcp") || ($self->{_protocol} eq "6")) { - $tcp_flags = get_tcp_flags_string($self->{_tcp_flags}); + # note: "out" is not valid in the INPUT chain. + return ('Cannot specify both "match-ipsec" and "match-none"',) + if (defined($self->{_ipsec}) && defined($self->{_non_ipsec})); + if (defined($self->{_ipsec})) { + $rule .= ' -m policy --pol ipsec --dir in '; + } elsif (defined($self->{_non_ipsec})) { + $rule .= ' -m policy --pol none --dir in '; + } + + my $p2p = undef; + if (defined($self->{_p2p}->{_all})) { + $p2p = '--apple --bit --dc --edk --gnu --kazaa '; } else { - return ("TCP flags can only be set if protocol is set to TCP", ); - } - } - if (defined($tcp_flags)) { - $rule .= " -m tcp --tcp-flags $tcp_flags "; - } - - # set the icmp code and type if applicable - if (($self->{_protocol} eq "icmp") || ($self->{_protocol} eq "1")) { - if (defined $self->{_icmp_name}) { - if (defined($self->{_icmp_type}) || defined($self->{_icmp_code})){ - return ("Cannot use ICMP type/code with ICMP type-name", ); - } - $rule .= "--icmp-type $self->{_icmp_name} "; - } elsif (defined $self->{_icmp_type}) { - $rule .= "--icmp-type $self->{_icmp_type}"; - if (defined $self->{_icmp_code}) { - $rule .= "/$self->{_icmp_code}"; - } - $rule .= " "; - } elsif (defined $self->{_icmp_code}) { - return ("ICMP code can only be defined if ICMP type is defined", ); - } - } elsif (defined($self->{_icmp_type}) || defined($self->{_icmp_code}) - || defined($self->{_icmp_name})) { - return ("ICMP type/code or type-name can only be defined if protocol is ICMP", ); - } - - # Setup ICMPv6 rule if configured - # ICMPv6 parameters are only valid if the rule is matching on the - # ICMPv6 protocol ID. - # - if (($self->{_protocol} eq "icmpv6") || - ($self->{_protocol} eq "ipv6-icmp") || - ($self->{_protocol} eq "58")) { - if (defined($self->{_icmpv6_type})) { - $rule .= "-m icmpv6 --icmpv6-type $self->{_icmpv6_type}"; - } - } - - # add the source and destination rules - ($srcrule, $err_str) = $src->rule(); - return ($err_str, ) if (!defined($srcrule)); - ($dstrule, $err_str) = $dst->rule(); - return ($err_str, ) if (!defined($dstrule)); - - # make sure multiport is always behind single port option - if ((grep /multiport/, $srcrule)) { - $rule .= " $dstrule $srcrule "; - } elsif ((grep /multiport/, $dstrule)) { - $rule .= " $srcrule $dstrule "; - } else { - $rule .= " $srcrule $dstrule "; - } - - return ('Cannot specify both "match-frag" and "match-non-frag"', ) - if (defined($self->{_frag}) && defined($self->{_non_frag})); - if (defined($self->{_frag})) { - $rule .= ' -f '; - } elsif (defined($self->{_non_frag})) { - $rule .= ' ! -f '; - } - - # note: "out" is not valid in the INPUT chain. - return ('Cannot specify both "match-ipsec" and "match-none"', ) - if (defined($self->{_ipsec}) && defined($self->{_non_ipsec})); - if (defined($self->{_ipsec})) { - $rule .= ' -m policy --pol ipsec --dir in '; - } elsif (defined($self->{_non_ipsec})) { - $rule .= ' -m policy --pol none --dir in '; - } - - my $p2p = undef; - if (defined($self->{_p2p}->{_all})) { - $p2p = '--apple --bit --dc --edk --gnu --kazaa '; - } else { - my @apps = qw(apple bit dc edk gnu kazaa); - foreach (@apps) { - if (defined($self->{_p2p}->{"_$_"})) { - $p2p .= "--$_ "; - } - } - } - if (defined($p2p)) { - $rule .= " -m ipp2p $p2p "; - } - - my $time = undef; - if (defined($self->{_time}->{_utc})) { - $time .= " --utc "; - } - if (defined($self->{_time}->{_startdate})) { - my $check_date = validate_date($self->{_time}->{_startdate}, "startdate"); - if (!($check_date eq "")) { - return ($check_date, ); - } - $time .= " --datestart $self->{_time}->{_startdate} "; - } - if (defined($self->{_time}->{_stopdate})) { - my $check_date = validate_date($self->{_time}->{_stopdate}, "stopdate"); - if (!($check_date eq "")) { - return ($check_date, ); - } - $time .= " --datestop $self->{_time}->{_stopdate} "; - } - if (defined($self->{_time}->{_starttime})) { - return ("Invalid starttime $self->{_time}->{_starttime}. -Time should use 24 hour notation hh:mm:ss and lie in between 00:00:00 and 23:59:59", ) - if (!validate_timevalues($self->{_time}->{_starttime}, "time")); - $time .= " --timestart $self->{_time}->{_starttime} "; - } - if (defined($self->{_time}->{_stoptime})) { - return ("Invalid stoptime $self->{_time}->{_stoptime}. -Time should use 24 hour notation hh:mm:ss and lie in between 00:00:00 and 23:59:59", ) - if (!validate_timevalues($self->{_time}->{_stoptime}, "time")); - $time .= " --timestop $self->{_time}->{_stoptime} "; - } - if (defined($self->{_time}->{_monthdays})) { - my $negate = " "; - if ($self->{_time}->{_monthdays} =~ m/^!/) { - $negate = "! "; - $self->{_time}->{_monthdays} = substr $self->{_time}->{_monthdays}, 1; - } - return ("Invalid monthdays value $self->{_time}->{_monthdays}. -Monthdays should have values between 1 and 31 with multiple days separated by commas -eg. 2,12,21 For negation, add ! in front eg. !2,12,21", ) - if (!validate_timevalues($self->{_time}->{_monthdays}, "monthdays")); - $time .= " $negate --monthdays $self->{_time}->{_monthdays} "; - } - if (defined($self->{_time}->{_weekdays})) { - my $negate = " "; - if ($self->{_time}->{_weekdays} =~ m/^!/) { - $negate = "! "; - $self->{_time}->{_weekdays} = substr $self->{_time}->{_weekdays}, 1; - } - return ("Invalid weekdays value $self->{_time}->{_weekdays}. -Weekdays should be specified using the first three characters of the day with the + my @apps = qw(apple bit dc edk gnu kazaa); + foreach (@apps) { + if (defined($self->{_p2p}->{"_$_"})) { + $p2p .= "--$_ "; + } + } + } + if (defined($p2p)) { + $rule .= " -m ipp2p $p2p "; + } + + my $time = undef; + if (defined($self->{_time}->{_utc})) { + $time .= " --utc "; + } + if (defined($self->{_time}->{_startdate})) { + my $check_date = validate_date($self->{_time}->{_startdate}, "startdate"); + if (!($check_date eq "")) { + return ($check_date,); + } + $time .= " --datestart $self->{_time}->{_startdate} "; + } + if (defined($self->{_time}->{_stopdate})) { + my $check_date = validate_date($self->{_time}->{_stopdate}, "stopdate"); + if (!($check_date eq "")) { + return ($check_date,); + } + $time .= " --datestop $self->{_time}->{_stopdate} "; + } + if (defined($self->{_time}->{_starttime})) { + return ("Invalid starttime $self->{_time}->{_starttime}. Time should use 24 hour notation hh:mm:ss and lie in between 00:00:00 and 23:59:59", ) + if (!validate_timevalues($self->{_time}->{_starttime}, "time")); + $time .= " --timestart $self->{_time}->{_starttime} "; + } + if (defined($self->{_time}->{_stoptime})) { + return ("Invalid stoptime $self->{_time}->{_stoptime}. Time should use 24 hour notation hh:mm:ss and lie in between 00:00:00 and 23:59:59", ) + if (!validate_timevalues($self->{_time}->{_stoptime}, "time")); + $time .= " --timestop $self->{_time}->{_stoptime} "; + } + if (defined($self->{_time}->{_monthdays})) { + my $negate = " "; + if ($self->{_time}->{_monthdays} =~ m/^!/) { + $negate = "! "; + $self->{_time}->{_monthdays} = substr $self->{_time}->{_monthdays}, 1; + } + return ("Invalid monthdays value $self->{_time}->{_monthdays}. Monthdays should have values between 1 and 31 with multiple days separated by commas eg. 2,12,21 For negation, add ! in front eg. !2,12,21", ) + if (!validate_timevalues($self->{_time}->{_monthdays}, "monthdays")); + $time .= " $negate --monthdays $self->{_time}->{_monthdays} "; + } + if (defined($self->{_time}->{_weekdays})) { + my $negate = " "; + if ($self->{_time}->{_weekdays} =~ m/^!/) { + $negate = "! "; + $self->{_time}->{_weekdays} = substr $self->{_time}->{_weekdays}, 1; + } + return ("Invalid weekdays value $self->{_time}->{_weekdays}. Weekdays should be specified using the first three characters of the day with the first character capitalized eg. Mon,Thu,Sat For negation, add ! in front eg. !Mon,Thu,Sat", ) - if (!validate_timevalues($self->{_time}->{_weekdays}, "weekdays")); - $time .= " $negate --weekdays $self->{_time}->{_weekdays} "; - } - if (defined($time)) { - $rule .= " -m time $time "; - } - - my $limit = undef; - if (defined $self->{_limit}->{_rate}) { - my $rate_integer = $self->{_limit}->{_rate}; - $rate_integer =~ s/\/(second|minute|hour|day)//; - if ($rate_integer < 1) { - return ("integer value in rate cannot be less than 1", ); - } - $limit = "--limit $self->{_limit}->{_rate} --limit-burst $self->{_limit}->{_burst}"; - } - $rule .= " -m limit $limit " if defined $limit; - - # recent match condition SHOULD BE DONE IN THE LAST so - # all options in $rule are copied to $recent_rule below - my $recent_rule = undef; - if (defined($self->{_recent_time}) || defined($self->{_recent_cnt})) { - my $recent_rule1 = undef; - my $recent_rule2 = undef; - $recent_rule1 .= ' -m recent --update '; - $recent_rule2 .= ' -m recent --set '; - if (defined($self->{_recent_time})) { - $recent_rule1 .= " --seconds $self->{_recent_time} "; - } - if (defined($self->{_recent_cnt})) { - $recent_rule1 .= " --hitcount $self->{_recent_cnt} "; - } - - $recent_rule = $rule; - - if ($rule =~ m/\-m\s+set\s+\-\-match\-set/) { - # firewall group being used in this rule. iptables complains if recent - # match condition is placed after group match conditions [see bug 5744] - # so instead of appending recent match place it before group match - my @split_rules = (); - - @split_rules = split(/(\-m\s+set\s+\-\-match\-set)/, $rule, 2); - $rule = $split_rules[0] . $recent_rule1 . - $split_rules[1] . $split_rules[2]; - - @split_rules = split(/(\-m\s+set\s+\-\-match\-set)/, $recent_rule, 2); - $recent_rule = $split_rules[0] . $recent_rule2 . - $split_rules[1] . $split_rules[2]; + if (!validate_timevalues($self->{_time}->{_weekdays}, "weekdays")); + $time .= " $negate --weekdays $self->{_time}->{_weekdays} "; + } + if (defined($time)) { + $rule .= " -m time $time "; + } + + my $limit = undef; + if (defined $self->{_limit}->{_rate}) { + my $rate_integer = $self->{_limit}->{_rate}; + $rate_integer =~ s/\/(second|minute|hour|day)//; + if ($rate_integer < 1) { + return ("integer value in rate cannot be less than 1",); + } + $limit = "--limit $self->{_limit}->{_rate} --limit-burst $self->{_limit}->{_burst}"; + } + $rule .= " -m limit $limit " if defined $limit; + + # recent match condition SHOULD BE DONE IN THE LAST so + # all options in $rule are copied to $recent_rule below + my $recent_rule = undef; + if (defined($self->{_recent_time}) || defined($self->{_recent_cnt})) { + my $recent_rule1 = undef; + my $recent_rule2 = undef; + $recent_rule1 .= ' -m recent --update '; + $recent_rule2 .= ' -m recent --set '; + if (defined($self->{_recent_time})) { + $recent_rule1 .= " --seconds $self->{_recent_time} "; + } + if (defined($self->{_recent_cnt})) { + $recent_rule1 .= " --hitcount $self->{_recent_cnt} "; + } + + $recent_rule = $rule; + + if ($rule =~ m/\-m\s+set\s+\-\-match\-set/) { + + # firewall group being used in this rule. iptables complains if recent + # match condition is placed after group match conditions [see bug 5744] + # so instead of appending recent match place it before group match + my @split_rules = (); + + @split_rules = split(/(\-m\s+set\s+\-\-match\-set)/, $rule, 2); + $rule = $split_rules[0] . $recent_rule1 .$split_rules[1] . $split_rules[2]; + + @split_rules = split(/(\-m\s+set\s+\-\-match\-set)/, $recent_rule, 2); + $recent_rule = $split_rules[0] . $recent_rule2 .$split_rules[1] . $split_rules[2]; + } else { + + # append recent match conditions to the two rules needed for recent match + $rule .= $recent_rule1; + $recent_rule .= $recent_rule2; + } + } + + my $chain = $self->{_name}; + my $rule_num = $self->{_rule_number}; + my $rule2 = undef; + + # set the jump target. Depends on action and log + if ("$self->{_log}" eq "enable") { + $rule2 = $rule; + my $log_prefix = get_log_prefix($chain, $rule_num, $self->{_action}); + $rule2 .= "-j LOG --log-prefix \"$log_prefix\" "; + } + if ("$self->{_action}" eq "drop") { + $rule .= "-j DROP "; + } elsif ("$self->{_action}" eq "accept") { + $rule .= "-j RETURN "; + } elsif ("$self->{_action}" eq "reject") { + $rule .= "-j REJECT "; + } elsif ("$self->{_action}" eq 'inspect') { + my $target = ipt_get_queue_target('SNORT'); + return ('Undefined target for inspect',) if !defined $target; + $rule .= "-j $target "; + } elsif ($self->{_comment} =~ m/^policy/) { + + # mangle actions + my $count = 0; + if (defined($self->{_mod_mark})) { + # MARK + $rule .= "-j MARK --set-mark $self->{_mod_mark} "; + $count++; + } + if (defined($self->{_mod_table})) { + # Route table + $rule .= "-j VYATTA_PBR_$self->{_mod_table} "; + $count++; + } + if (defined($self->{_mod_dscp})) { + # DSCP + $rule .= "-j DSCP --set-dscp $self->{_mod_dscp} "; + $count++; + } + if (defined($self->{_mod_tcpmss})) { + # TCP-MSS + # check for SYN flag + if ( !defined $self->{_tcp_flags} + ||!(($self->{_tcp_flags} =~ m/SYN/) && !($self->{_tcp_flags} =~ m/!SYN/))) + { + return ('need to set TCP SYN flag to modify TCP MSS',); + } + + if ($self->{_mod_tcpmss} =~ m/\d/) { + $rule .= "-j TCPMSS --set-mss $self->{_mod_tcpmss} "; + } else { + $rule .= "-j TCPMSS --clamp-mss-to-pmtu "; + } + $count++; + } + + # others + if ($count == 0) { + return ('Policy route requires "action drop" or "set" parameters be defined.'); + } elsif ($count > 1) { + return ('Can not define more than one "set" parameter per policy route'); + } } else { - # append recent match conditions to the two rules needed for recent match - $rule .= $recent_rule1; - $recent_rule .= $recent_rule2; - } - } - - my $chain = $self->{_name}; - my $rule_num = $self->{_rule_number}; - my $rule2 = undef; - # set the jump target. Depends on action and log - if ("$self->{_log}" eq "enable") { - $rule2 = $rule; - my $log_prefix = get_log_prefix($chain, $rule_num, $self->{_action}); - $rule2 .= "-j LOG --log-prefix \"$log_prefix\" "; - } - if ("$self->{_action}" eq "drop") { - $rule .= "-j DROP "; - } elsif ("$self->{_action}" eq "accept") { - $rule .= "-j RETURN "; - } elsif ("$self->{_action}" eq "reject") { - $rule .= "-j REJECT "; - } elsif ("$self->{_action}" eq 'inspect') { - my $target = ipt_get_queue_target('SNORT'); - return ('Undefined target for inspect', ) if ! defined $target; - $rule .= "-j $target "; - } elsif ($self->{_comment} =~ m/^policy/) { - # mangle actions - my $count = 0; - if (defined($self->{_mod_mark})) { - # MARK - $rule .= "-j MARK --set-mark $self->{_mod_mark} "; - $count++; - } - if (defined($self->{_mod_table})) { - # Route table - $rule .= "-j VYATTA_PBR_$self->{_mod_table} "; - $count++; - } - if (defined($self->{_mod_dscp})) { - # DSCP - $rule .= "-j DSCP --set-dscp $self->{_mod_dscp} "; - $count++; - } - if (defined($self->{_mod_tcpmss})) { - # TCP-MSS - # check for SYN flag - if (!defined $self->{_tcp_flags} || - !(($self->{_tcp_flags} =~ m/SYN/) && !($self->{_tcp_flags} =~ m/!SYN/))) { - return ('need to set TCP SYN flag to modify TCP MSS', ); - } - - if ($self->{_mod_tcpmss} =~ m/\d/) { - $rule .= "-j TCPMSS --set-mss $self->{_mod_tcpmss} "; - } else { - $rule .= "-j TCPMSS --clamp-mss-to-pmtu "; - } - $count++; - } - - # others - - if ($count == 0) { - return ('Policy route requires "action drop" or "set" parameters be defined.'); - } elsif ($count > 1) { - return ('Can not define more than one "set" parameter per policy route'); - } - } else { - return ("\"action\" must be defined in rule $rule_num", ); - } - if (defined($rule2)) { - my $tmp = $rule2; - $rule2 = $rule; - $rule = $tmp; - } elsif (defined($recent_rule)) { - $rule2 = $recent_rule; - $recent_rule = undef; - } - - return (undef, undef) if defined $self->{_disable}; - - my ($udp_rule, $udp_rule2, $udp_recent_rule) = (undef, undef, undef); - if ($tcp_and_udp == 1) { - # create udp rules - $udp_rule = $rule; - $udp_rule2 = $rule2 if defined $rule2; - $udp_recent_rule = $recent_rule if defined $recent_rule; - foreach my $each_udprule ($udp_rule, $udp_rule2, $udp_recent_rule) { - $each_udprule =~ s/ \-p tcp / -p udp / if defined $each_udprule; - } - } - - if ($DEBUG eq 'true') { - # print all potential iptables rules that could be formed for - # a single CLI rule. see get_num_ipt_rules to see exact count - print "rule :\n$rule\n" if defined $rule; - print "rule2 :\n$rule2\n" if defined $rule2; - print "recent rule :\n$recent_rule\n" if defined $recent_rule; - print "udp rule :\n$udp_rule\n" if defined $udp_rule; - print "udp rule2 :\n$udp_rule2\n" if defined $udp_rule2; - print "udp recent rule :\n$udp_recent_rule\n" if defined $udp_recent_rule; - } - - return (undef, $rule, $rule2, $recent_rule, $udp_rule, $udp_rule2, $udp_recent_rule); + return ("\"action\" must be defined in rule $rule_num",); + } + if (defined($rule2)) { + my $tmp = $rule2; + $rule2 = $rule; + $rule = $tmp; + } elsif (defined($recent_rule)) { + $rule2 = $recent_rule; + $recent_rule = undef; + } + + return (undef, undef) if defined $self->{_disable}; + + my ($udp_rule, $udp_rule2, $udp_recent_rule) = (undef, undef, undef); + if ($tcp_and_udp == 1) { + + # create udp rules + $udp_rule = $rule; + $udp_rule2 = $rule2 if defined $rule2; + $udp_recent_rule = $recent_rule if defined $recent_rule; + foreach my $each_udprule ($udp_rule, $udp_rule2, $udp_recent_rule) { + $each_udprule =~ s/ \-p tcp / -p udp / if defined $each_udprule; + } + } + + if ($DEBUG eq 'true') { + + # print all potential iptables rules that could be formed for + # a single CLI rule. see get_num_ipt_rules to see exact count + print "rule :\n$rule\n" if defined $rule; + print "rule2 :\n$rule2\n" if defined $rule2; + print "recent rule :\n$recent_rule\n" if defined $recent_rule; + print "udp rule :\n$udp_rule\n" if defined $udp_rule; + print "udp rule2 :\n$udp_rule2\n" if defined $udp_rule2; + print "udp recent rule :\n$udp_recent_rule\n" if defined $udp_recent_rule; + } + + return (undef, $rule, $rule2, $recent_rule, $udp_rule, $udp_rule2, $udp_recent_rule); } sub outputXmlElem { - my ($name, $value, $fh) = @_; - print $fh " <$name>$value</$name>\n"; + my ($name, $value, $fh) = @_; + print $fh " <$name>$value</$name>\n"; } sub outputXml { - my ($self, $fh) = @_; - if (!defined($self->{_protocol})) { - $self->{_protocol} = "all"; - } - outputXmlElem("protocol", $self->{_protocol}, $fh); - my $state_str = get_state_str($self); - if ($state_str ne "") { - $state_str =~ s/,/%2C/g; - $state_str .= "+"; - } - outputXmlElem("state", $state_str, $fh); - outputXmlElem("action", uc($self->{_action}), $fh); - outputXmlElem("log", $self->{_log}, $fh); - outputXmlElem("icmp_type", $self->{_icmp_type}, $fh); - outputXmlElem("icmp_code", $self->{_icmp_code}, $fh); - - $src->outputXml("src", $fh); - $dst->outputXml("dst", $fh); + my ($self, $fh) = @_; + if (!defined($self->{_protocol})) { + $self->{_protocol} = "all"; + } + outputXmlElem("protocol", $self->{_protocol}, $fh); + my $state_str = get_state_str($self); + if ($state_str ne "") { + $state_str =~ s/,/%2C/g; + $state_str .= "+"; + } + outputXmlElem("state", $state_str, $fh); + outputXmlElem("action", uc($self->{_action}), $fh); + outputXmlElem("log", $self->{_log}, $fh); + outputXmlElem("icmp_type", $self->{_icmp_type}, $fh); + outputXmlElem("icmp_code", $self->{_icmp_code}, $fh); + + $src->outputXml("src", $fh); + $dst->outputXml("dst", $fh); } sub validate_timevalues { - my ($string, $type) = @_; - use Switch; - use Time::Local; - switch ($type) { - case "date" { $string =~ s/-//g; - my ($year, $month, $day) = unpack "A4 A2 A2", $string; - eval { timelocal(0,0,0,$day, $month-1, $year); - 1; - } or return 0; - } - - case "time" { $string =~ s/://g; - my ($hour, $min, $sec) = unpack "A2 A2 A2", $string; - eval { timelocal($sec,$min,$hour, 1, 0, 1970); - 1; - } or return 0; - } - - case "monthdays" { while($string =~ m/(\d+)/g) { - if ($1 < 1 || $1 > 31) { - return 0; - } - } - } - - case "weekdays" { my @weekdays = ("Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun"); - while($string =~ m/(\w+)/g) { - if (!grep(/$1/,@weekdays)) { - return 0; - } - } - } - - else { print - "Invalid type '$type' passed to sub validate_timevalues()\n"; - return 0; - } - } - return 1; + my ($string, $type) = @_; + use Switch; + use Time::Local; + switch ($type) { + case "date" { + $string =~ s/-//g; + my ($year, $month, $day) = unpack "A4 A2 A2", $string; + eval { + timelocal(0,0,0,$day, $month-1, $year); + 1; + } or return 0; + } + + case "time" { + $string =~ s/://g; + my ($hour, $min, $sec) = unpack "A2 A2 A2", $string; + eval { + timelocal($sec,$min,$hour, 1, 0, 1970); + 1; + } or return 0; + } + + case "monthdays" { + while($string =~ m/(\d+)/g) { + if ($1 < 1 || $1 > 31) { + return 0; + } + } + } + + case "weekdays" { + my @weekdays = ("Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun"); + while($string =~ m/(\w+)/g) { + if (!grep(/$1/,@weekdays)) { + return 0; + } + } + } + + else { + print"Invalid type '$type' passed to sub validate_timevalues()\n"; + return 0; + } + } + return 1; } sub validate_date { - my ($date, $string) = @_; - if ($date =~ m/T/) { - my $actualdate = substr $date, 0 , 10; - my $datetime = substr $date, 11; - return ("Invalid $string $actualdate. -Date should use yyyy-mm-dd format and lie in between 1970-01-01 and 2038-01-19") - if (!validate_timevalues($actualdate, "date")); - return ("Invalid time $datetime for $string $actualdate. -Time should use 24 hour notation hh:mm:ss and lie in between 00:00:00 and 23:59:59") - if (!validate_timevalues($datetime, "time")); - } else { - return ("Invalid $string $date. -Date should use yyyy-mm-dd format and lie in between 1970-01-01 and 2038-01-19") - if (!validate_timevalues($date, "date")); - } - return (""); + my ($date, $string) = @_; + if ($date =~ m/T/) { + my $actualdate = substr $date, 0, 10; + my $datetime = substr $date, 11; + return ("Invalid $string $actualdate. Date should use yyyy-mm-dd format and lie in between 1970-01-01 and 2038-01-19") + if (!validate_timevalues($actualdate, "date")); + return ("Invalid time $datetime for $string $actualdate. Time should use 24 hour notation hh:mm:ss and lie in between 00:00:00 and 23:59:59") + if (!validate_timevalues($datetime, "time")); + } else { + return ("Invalid $string $date. Date should use yyyy-mm-dd format and lie in between 1970-01-01 and 2038-01-19") + if (!validate_timevalues($date, "date")); + } + return (""); } sub get_tcp_flags_string { - my $string = shift; - my @list_of_flags = (); # list of tcp flags to be examined - my @list_of_set_flags = (); # list of flags which must be set - - my @string_list = split(/,/, $string); - while(@string_list) { - if (!grep(/!/,$string_list[0])) { - push @list_of_flags, $string_list[0]; - push @list_of_set_flags, $string_list[0]; - } else { - $string_list[0] =~ s/!//g; - push @list_of_flags, $string_list[0]; - } - shift(@string_list); - } - - push @list_of_set_flags, 'NONE' if @list_of_set_flags == (); - return join(",",@list_of_flags) . " " . join(",",@list_of_set_flags); + my $string = shift; + my @list_of_flags = (); # list of tcp flags to be examined + my @list_of_set_flags = (); # list of flags which must be set + + my @string_list = split(/,/, $string); + while(@string_list) { + if (!grep(/!/,$string_list[0])) { + push @list_of_flags, $string_list[0]; + push @list_of_set_flags, $string_list[0]; + } else { + $string_list[0] =~ s/!//g; + push @list_of_flags, $string_list[0]; + } + shift(@string_list); + } + + push @list_of_set_flags, 'NONE' if @list_of_set_flags == (); + return join(",",@list_of_flags) . " " . join(",",@list_of_set_flags); } 1; - -# Local Variables: -# mode: perl -# indent-tabs-mode: nil -# perl-indent-level: 2 -# End: |