diff options
Diffstat (limited to 'scripts/zone-mgmt/vyatta-zone.pl')
| -rwxr-xr-x | scripts/zone-mgmt/vyatta-zone.pl | 800 |
1 files changed, 0 insertions, 800 deletions
diff --git a/scripts/zone-mgmt/vyatta-zone.pl b/scripts/zone-mgmt/vyatta-zone.pl deleted file mode 100755 index 0c058427..00000000 --- a/scripts/zone-mgmt/vyatta-zone.pl +++ /dev/null @@ -1,800 +0,0 @@ -#!/usr/bin/perl -# -# Module: vyatta-zone.pl -# -# **** License **** -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License version 2 as -# published by the Free Software Foundation. -# -# This program is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -# General Public License for more details. -# -# This code was originally developed by Vyatta, Inc. -# Portions created by Vyatta are Copyright (C) 2009 Vyatta, Inc. -# All Rights Reserved. -# -# Author: Mohit Mehta -# Date: April 2009 -# Description: Script for Zone Based Firewall -# -# **** End License **** -# - -use Getopt::Long; -use POSIX; - -use lib "/opt/vyatta/share/perl5"; -use Vyatta::Zone; -use Vyatta::IpTables::Mgr; - -use warnings; -use strict; - -# for future ease, when we add modify, these hashes will just be extended -# firewall mapping from config node to iptables command. -my %cmd_hash = ( 'name' => '/sbin/iptables', - 'ipv6-name' => '/sbin/ip6tables'); - -# firewall mapping from config node to iptables/ip6tables table -my %table_hash = ( 'name' => 'filter', - 'ipv6-name' => 'filter'); - -# mapping from vyatta 'default-policy' to iptables jump target -my %policy_hash = ( 'drop' => 'DROP', - 'reject' => 'REJECT' ); - -sub setup_default_policy { - my ($zone_name, $default_policy, $localoutchain) = @_; - my ($cmd, $error); - my $zone_chain=Vyatta::Zone::get_zone_chain("exists", - $zone_name, $localoutchain); - - # add default policy for zone chains in filter, ip6filter tables - foreach my $tree (keys %cmd_hash) { - - # set default policy for zone chain - $cmd = "sudo $cmd_hash{$tree} -t $table_hash{$tree} -A " . - "$zone_chain -j $policy_hash{$default_policy}"; - $error = Vyatta::Zone::run_cmd("$cmd"); - return "Error: set default policy $zone_chain failed [$error]" if $error; - - my $rule_cnt = Vyatta::IpTables::Mgr::count_iptables_rules($cmd_hash{$tree}, - $table_hash{$tree}, $zone_chain); - - # if there's a drop|reject rule at rule_cnt - 1 then remove that - # in zone chain a drop|reject target can only be for default policy - if ($rule_cnt > 1) { - my $penultimate_rule_num=$rule_cnt-1; - $cmd = "sudo $cmd_hash{$tree} -t $table_hash{$tree} " . - "-L $zone_chain $penultimate_rule_num -v | awk {'print \$3'}"; - my $target=`$cmd`; - chomp $target; - if (defined $target && ($target eq 'REJECT' || $target eq 'DROP')) { - $cmd = "sudo $cmd_hash{$tree} -t $table_hash{$tree} -D " . - "$zone_chain $penultimate_rule_num"; - $error = Vyatta::Zone::run_cmd("$cmd"); - return "Error: delete rule $penultimate_rule_num with $target -in $zone_name chain failed [$error]" if $error; - } - } - } - return; -} - -sub create_zone_chain { - my ($zone_name, $localoutchain) = @_; - my ($cmd, $error); - my $zone_chain=Vyatta::Zone::get_zone_chain("exists", - $zone_name, $localoutchain); - - # create zone chains in filter, ip6filter tables - foreach my $tree (keys %cmd_hash) { - $cmd = "sudo $cmd_hash{$tree} -t $table_hash{$tree} " . - "-L $zone_chain >&/dev/null"; - $error = Vyatta::Zone::run_cmd($cmd); - if ($error) { - # chain does not exist, go ahead create it - $cmd = "sudo $cmd_hash{$tree} -t $table_hash{$tree} -N $zone_chain"; - $error = Vyatta::Zone::run_cmd($cmd); - return "Error: create $zone_name chain with failed [$error]" if $error; - } - } - - return; -} - -sub delete_zone_chain { - my ($zone_name, $localoutchain) = @_; - my ($cmd, $error); - my $zone_chain=Vyatta::Zone::get_zone_chain("existsOrig", - $zone_name, $localoutchain); - # delete zone chains from filter, ip6filter tables - foreach my $tree (keys %cmd_hash) { - # flush all rules from zone chain - $cmd = "sudo $cmd_hash{$tree} -t $table_hash{$tree} -F $zone_chain"; - $error = Vyatta::Zone::run_cmd($cmd); - return "Error: flush all rules in $zone_name chain failed [$error]" if $error; - - # delete zone chain - $cmd = "sudo $cmd_hash{$tree} -t $table_hash{$tree} -X $zone_chain"; - $error = Vyatta::Zone::run_cmd($cmd); - return "Error: delete $zone_name chain failed [$error]" if $error; - } - return; -} - -sub insert_from_rule { - my ($zone_name, $from_zone, $interface, $ruleset_type, $ruleset, - $direction, $zone_chain) = @_; - my ($cmd, $error); - my $ruleset_name; - - if (defined $ruleset) { # called from node.def - $ruleset_name=$ruleset; - } else { # called from do_firewall_interface_zone() - $ruleset_name=Vyatta::Zone::get_firewall_ruleset("returnValue", - $zone_name, $from_zone, $ruleset_type); - } - - if (defined $ruleset_name) { - # get number of rules in ruleset_name - my $rule_cnt = Vyatta::IpTables::Mgr::count_iptables_rules($cmd_hash{$ruleset_type}, - $table_hash{$ruleset_type}, "$zone_chain"); - # append rules before last drop all rule - my $insert_at_rule_num=1; - if ( $rule_cnt > 1 ) { - $insert_at_rule_num=$rule_cnt; - } - my $result = Vyatta::Zone::rule_exists ($cmd_hash{$ruleset_type}, - $table_hash{$ruleset_type}, "$zone_chain", $ruleset_name, $interface); - if ($result < 1) { - # append rule before drop rule to jump to ruleset for in\out interface - $cmd = "sudo $cmd_hash{$ruleset_type} -t $table_hash{$ruleset_type} " . -"-I $zone_chain $insert_at_rule_num $direction $interface -j $ruleset_name"; - $error = Vyatta::Zone::run_cmd($cmd); - return "Error: insert rule for $direction $interface into zone-chain -$zone_chain with target $ruleset_name failed [$error]" if $error; - - # insert the RETURN rule next - $insert_at_rule_num++; - $cmd = "sudo $cmd_hash{$ruleset_type} -t $table_hash{$ruleset_type} " . - "-I $zone_chain $insert_at_rule_num $direction $interface -j RETURN"; - $error = Vyatta::Zone::run_cmd($cmd); - return "Error: insert rule for $direction $interface into zone chain -$zone_chain with target RETURN failed [$error]" if $error; - } - } - - return; -} - - -sub add_fromzone_intf_ruleset { - my ($zone_name, $from_zone, $interface, $ruleset_type, $ruleset) = @_; - my $zone_chain=Vyatta::Zone::get_zone_chain("exists", $zone_name); - my $error = insert_from_rule ($zone_name, $from_zone, $interface, - $ruleset_type, $ruleset, '-i', $zone_chain); - return ($error, ) if $error; - return; -} - -sub add_fromlocalzone_ruleset { - my ($zone_name, $from_zone, $interface, $ruleset_type, $ruleset) = @_; - my $zone_chain=Vyatta::Zone::get_zone_chain("exists", $from_zone, "localout"); - - my $error = insert_from_rule ($zone_name, $from_zone, $interface, - $ruleset_type, $ruleset, '-o', $zone_chain); - return ($error, ) if $error; - - return; -} - -sub delete_from_rule { - - my ($zone_name, $from_zone, $interface, $ruleset_type, $ruleset, - $direction, $zone_chain) = @_; - my ($cmd, $error); - my $ruleset_name; - - if (defined $ruleset) { # called from node.def - $ruleset_name=$ruleset; - } else { # called from undo_firewall_interface_zone() - $ruleset_name=Vyatta::Zone::get_firewall_ruleset("returnOrigValue", - $zone_name, $from_zone, $ruleset_type); - } - - if (defined $ruleset_name) { - # delete rule to jump to ruleset for in|out interface in zone chain - $cmd = "sudo $cmd_hash{$ruleset_type} -t $table_hash{$ruleset_type} " . - "-D $zone_chain $direction $interface -j $ruleset_name"; - $error = Vyatta::Zone::run_cmd($cmd); - return "Error: call to delete rule for $direction $interface -in zone chain $zone_chain with target $ruleset_name failed [$error]" if $error; - - # delete RETURN rule for same interface - $cmd = "sudo $cmd_hash{$ruleset_type} -t $table_hash{$ruleset_type} " . - "-D $zone_chain $direction $interface -j RETURN"; - $error = Vyatta::Zone::run_cmd($cmd); - return "Error: call to delete rule for $direction $interface into zone -chain $zone_chain with target RETURN for $zone_name failed [$error]" if $error; - } - - return; -} - -sub delete_fromzone_intf_ruleset { - my ($zone_name, $from_zone, $interface, $ruleset_type, $ruleset) = @_; - my $zone_chain=Vyatta::Zone::get_zone_chain("existsOrig", $zone_name); - my $error = delete_from_rule ($zone_name, $from_zone, $interface, - $ruleset_type, $ruleset, '-i', $zone_chain); - return ($error, ) if $error; - return; -} - -sub delete_fromlocalzone_ruleset { - my ($zone_name, $from_zone, $interface, $ruleset_type, $ruleset) = @_; - my $zone_chain=Vyatta::Zone::get_zone_chain("existsOrig", - $from_zone, "localout"); - - my ($cmd, $error); - $error = delete_from_rule ($zone_name, $from_zone, $interface, - $ruleset_type, $ruleset, '-o', $zone_chain); - return ($error, ) if $error; - - return; -} - -sub do_firewall_interface_zone { - my ($zone_name, $interface) = @_; - my $zone_chain=Vyatta::Zone::get_zone_chain("exists", $zone_name); - my ($cmd, $error); - foreach my $tree (keys %cmd_hash) { - - my $result = Vyatta::Zone::rule_exists ($cmd_hash{$tree}, - $table_hash{$tree}, "$zone_chain", "RETURN", $interface); - if ($result < 1) { - # add rule to allow same zone to same zone traffic - $cmd = "sudo $cmd_hash{$tree} -t $table_hash{$tree} -I $zone_chain " . - "-i $interface -j RETURN"; - $error = Vyatta::Zone::run_cmd($cmd); - return "Error: call to add $interface to its zone-chain $zone_chain -failed [$error]" if $error; - } - - # need to do this as an append before VYATTA_POST_FW_*_HOOK - my $rule_cnt = Vyatta::IpTables::Mgr::count_iptables_rules($cmd_hash{$tree}, - $table_hash{$tree}, "FORWARD"); - my $insert_at_rule_num=1; - if ( $rule_cnt > 1 ) { - $insert_at_rule_num=$rule_cnt; - } - $result = Vyatta::Zone::rule_exists ($cmd_hash{$tree}, $table_hash{$tree}, - "FORWARD", "$zone_chain", $interface); - if ($result < 1) { - $cmd = "sudo $cmd_hash{$tree} -t $table_hash{$tree} -I FORWARD " . - "$insert_at_rule_num -o $interface -j $zone_chain"; - $error = Vyatta::Zone::run_cmd($cmd); - return "Error: call to add jump rule for outgoing interface $interface -to its $zone_chain chain failed [$error]" if $error; - } - } - - # get all zones in which this zone is being used as a from zone - # then in chains for those zones, add rules for this incoming interface - my @all_zones = Vyatta::Zone::get_all_zones("listNodes"); - foreach my $zone (@all_zones) { - if (!($zone eq $zone_name)) { - my @from_zones = Vyatta::Zone::get_from_zones("listEffectiveNodes", - $zone); - if (scalar(grep(/^$zone_name$/, @from_zones)) > 0) { - foreach my $tree (keys %cmd_hash) { - # call function to append rules to $zone's chain - $error = add_fromzone_intf_ruleset($zone, $zone_name, - $interface, $tree); - return "Error: $error" if $error; - } - } - } - } - - # if this zone has a local from zone, add interface to local zone out chain - my @my_from_zones = Vyatta::Zone::get_from_zones("listEffectiveNodes", - $zone_name); - foreach my $fromzone (@my_from_zones) { - if (defined(Vyatta::Zone::is_local_zone("exists", $fromzone))) { - foreach my $tree (keys %cmd_hash) { - $error = add_fromlocalzone_ruleset($zone_name, $fromzone, - $interface, $tree); - return "Error: $error" if $error; - } - } - } - - return; -} - -sub undo_firewall_interface_zone { - my ($zone_name, $interface) = @_; - my ($cmd, $error); - my $zone_chain=Vyatta::Zone::get_zone_chain("existsOrig", $zone_name); - - foreach my $tree (keys %cmd_hash) { - - # delete rule to allow same zone to same zone traffic - $cmd = "sudo $cmd_hash{$tree} -t $table_hash{$tree} -D FORWARD " . - "-o $interface -j $zone_chain"; - $error = Vyatta::Zone::run_cmd($cmd); - return "Error: call to delete jump rule for outgoing interface $interface -to $zone_chain chain failed [$error]" if $error; - - # delete ruleset jump for this in interface - $cmd = "sudo $cmd_hash{$tree} -t $table_hash{$tree} -D $zone_chain " . - "-i $interface -j RETURN"; - $error = Vyatta::Zone::run_cmd($cmd); - return "Error: call to delete interface $interface from zone-chain -$zone_chain with failed [$error]" if $error; - } - - # delete rules for this intf where this zone is being used as a from zone - my @all_zones = Vyatta::Zone::get_all_zones("listOrigNodes"); - foreach my $zone (@all_zones) { - if (!($zone eq $zone_name)) { - my @from_zones = Vyatta::Zone::get_from_zones("listEffectiveNodes", - $zone); - if (scalar(grep(/^$zone_name$/, @from_zones)) > 0) { - foreach my $tree (keys %cmd_hash) { - # call function to delete rules from $zone's chain - $error = delete_fromzone_intf_ruleset($zone, $zone_name, - $interface, $tree); - return "Error: $error" if $error; - } - } - } - } - - # if you have local from zone, delete interface to local zone out chain - my @my_from_zones = Vyatta::Zone::get_from_zones("listEffectiveNodes", - $zone_name); - foreach my $fromzone (@my_from_zones) { - if (defined(Vyatta::Zone::is_local_zone("existsOrig", $fromzone))) { - foreach my $tree (keys %cmd_hash) { - $error = delete_fromlocalzone_ruleset($zone_name, $fromzone, - $interface, $tree); - return "Error: $error" if $error; - } - } - } - - return; -} - -sub do_firewall_localzone { - my ($zone_name) = @_; - my ($cmd, $error); - my $zone_chain=Vyatta::Zone::get_zone_chain("exists", $zone_name); - foreach my $tree (keys %cmd_hash) { - - my $rule_cnt = Vyatta::IpTables::Mgr::count_iptables_rules($cmd_hash{$tree}, - $table_hash{$tree}, "INPUT"); - my $insert_at_rule_num=1; - if ( $rule_cnt > 1 ) { - $insert_at_rule_num=$rule_cnt; - } - my $result = Vyatta::Zone::rule_exists ($cmd_hash{$tree}, - $table_hash{$tree}, "INPUT", $zone_chain); - - if ($result < 1) { - # insert rule to filter local traffic from interface per ruleset - $cmd = "sudo $cmd_hash{$tree} -t $table_hash{$tree} -I INPUT " . - "$insert_at_rule_num -j $zone_chain"; - $error = Vyatta::Zone::run_cmd($cmd); - return "Error: call to add jump rule for local zone -$zone_chain chain failed [$error]" if $error; - } - } - - # get all zones in which local zone is being used as a from zone - # filter traffic from local zone to those zones - my @all_zones = Vyatta::Zone::get_all_zones("listNodes"); - foreach my $zone (@all_zones) { - if (!($zone eq $zone_name)) { - my @from_zones = Vyatta::Zone::get_from_zones("listEffectiveNodes", - $zone); - if (scalar(grep(/^$zone_name$/, @from_zones)) > 0) { - foreach my $tree (keys %cmd_hash) { - my @zone_interfaces = - Vyatta::Zone::get_zone_interfaces("returnValues", $zone); - foreach my $intf (@zone_interfaces) { - $error = add_fromlocalzone_ruleset($zone, $zone_name, - $intf, $tree); - return "Error: $error" if $error; - } - } - } - } - } - return; -} - -sub undo_firewall_localzone { - my ($zone_name) = @_; - my ($cmd, $error); - my $zone_chain=Vyatta::Zone::get_zone_chain("existsOrig", $zone_name); - - foreach my $tree (keys %cmd_hash) { - - # delete rule to filter traffic destined for system - $cmd = "sudo $cmd_hash{$tree} -t $table_hash{$tree} -D INPUT " . - "-j $zone_chain"; - $error = Vyatta::Zone::run_cmd($cmd); - return "Error: call to delete local zone -$zone_chain chain failed [$error]" if $error; - } - - # get all zones in which local zone is being used as a from zone - # remove filter for traffic from local zone to those zones - my @all_zones = Vyatta::Zone::get_all_zones("listOrigNodes"); - foreach my $zone (@all_zones) { - if (!($zone eq $zone_name)) { - my @from_zones = Vyatta::Zone::get_from_zones("listEffectiveNodes", - $zone); - if (scalar(grep(/^$zone_name$/, @from_zones)) > 0) { - foreach my $tree (keys %cmd_hash) { - my @zone_interfaces = - Vyatta::Zone::get_zone_interfaces("returnOrigValues", $zone); - foreach my $intf (@zone_interfaces) { - $error = delete_fromlocalzone_ruleset($zone, $zone_name, - $intf, $tree); - return "Error: $error" if $error; - } - } - } - } - } - return; -} - -sub add_zone { - my $zone_name = shift; - # perform firewall related actions for this zone - my $error = create_zone_chain ($zone_name); - return ($error, ) if $error; - - if (defined(Vyatta::Zone::is_local_zone("exists", $zone_name))) { - # make local out chain as well - $error = create_zone_chain ($zone_name, "localout"); - return ($error, ) if $error; - - # allow traffic sourced from and destined to localhost - my $cmd; - my @localchains=(); - $localchains[0] = Vyatta::Zone::get_zone_chain("exists", $zone_name); - $localchains[1] = Vyatta::Zone::get_zone_chain("exists", $zone_name, - 'localout'); - - foreach my $tree (keys %cmd_hash) { - foreach my $chain (@localchains) { - my $loopback_intf = ''; - if ($chain =~ m/_IN/) { - - # if the chain is INPUT chain - $loopback_intf = '$6'; - - # set IPv6 params if using ip6tables - if ($cmd_hash{$tree} =~ '6') { - $loopback_intf = '$5'; - } - - } else { - - # if the chain is OUTPUT chain - $loopback_intf = '$7'; - - # set IPv6 params if using ip6tables - if ($cmd_hash{$tree} =~ '6') { - $loopback_intf = '$6'; - } - - } - - $cmd = "sudo $cmd_hash{$tree} -t $table_hash{$tree} -L $chain 1 -vn " . - "| awk {'print \$3 \" \" $loopback_intf'} ". - "| grep 'RETURN lo\$' | wc -l"; - - my $result=`$cmd`; - if ($result < 1) { - - $cmd = "sudo $cmd_hash{$tree} -t $table_hash{$tree} -I $chain "; - - if ($chain =~ m/_IN/) { - - # rule for INPUT chain - $cmd .= "-i lo -j RETURN"; - - } else { - - # rule for OUTPUT chain - $cmd .= "-o lo -j RETURN"; - - } - - $error = Vyatta::Zone::run_cmd($cmd); - return "Error: adding rule to allow localhost traffic failed [$error]" if $error; - - } - } - } - - } - - # set default policy - my $default_policy = Vyatta::Zone::get_zone_default_policy("returnValue", - $zone_name); - $error = set_default_policy($zone_name, $default_policy); - return $error if $error; - return; -} - -sub delete_zone { - my $zone_name = shift; - # undo firewall related actions for this zone - my $error = delete_zone_chain ($zone_name); - return ($error, ) if $error; - if (defined(Vyatta::Zone::is_local_zone("existsOrig", $zone_name))) { - # delete local out chain as well - $error = delete_zone_chain ($zone_name, "localout"); - return ($error, ) if $error; - } - return; -} - -sub add_localzone { - my ($zone_name) = @_; - my $error; - # do firewall related stuff - $error = do_firewall_localzone ($zone_name); - return ($error, ) if $error; - return; -} - -sub delete_localzone { - my ($zone_name) = @_; - my $error; - # undo firewall related stuff - $error = undo_firewall_localzone ($zone_name); - return ($error, ) if $error; - return; -} - -sub add_zone_interface { - my ($zone_name, $interface) = @_; - return("Error: undefined interface", ) if ! defined $interface; - my $error; - # do firewall related stuff - $error = do_firewall_interface_zone ($zone_name, $interface); - return ($error, ) if $error; - return; -} - -sub delete_zone_interface { - my ($zone_name, $interface) = @_; - return("Error: undefined interface", ) if ! defined $interface; - # undo firewall related stuff - my $error = undo_firewall_interface_zone ($zone_name, $interface); - return ($error, ) if $error; - return; -} - -sub add_fromzone_fw { - my ($zone, $from_zone, $ruleset_type, $ruleset_name) = @_; - my ($cmd, $error); - - # for all interfaces in from zone apply ruleset to filter traffic - # from this zone to specified zone (i.e. $zone) - my @from_zone_interfaces = - Vyatta::Zone::get_zone_interfaces("returnValues", $from_zone); - if (scalar(@from_zone_interfaces) > 0) { - foreach my $intf (@from_zone_interfaces) { - $error = add_fromzone_intf_ruleset($zone, $from_zone, $intf, - $ruleset_type, $ruleset_name); - return "Error: $error" if $error; - } - } else { - if (defined(Vyatta::Zone::is_local_zone("exists", $from_zone))) { - # local from zone - my @zone_interfaces = - Vyatta::Zone::get_zone_interfaces("returnValues", $zone); - foreach my $intf (@zone_interfaces) { - $error = add_fromlocalzone_ruleset($zone, $from_zone, $intf, - $ruleset_type, $ruleset_name); - return "Error: $error" if $error; - } - } - - my $zone_chain=Vyatta::Zone::get_zone_chain("exists", - $from_zone, 'localout'); - # add jump to local-zone-out chain in OUTPUT chains for [ip and ip6]tables - foreach my $tree (keys %cmd_hash) { - # if jump to localzoneout chain not inserted, then insert rule - my $rule_cnt = Vyatta::IpTables::Mgr::count_iptables_rules($cmd_hash{$tree}, - $table_hash{$tree}, "OUTPUT"); - my $insert_at_rule_num=1; - if ( $rule_cnt > 1 ) { - $insert_at_rule_num=$rule_cnt; - } - my $result = Vyatta::Zone::rule_exists ($cmd_hash{$tree}, - $table_hash{$tree}, "OUTPUT", $zone_chain); - if ($result < 1) { - my $cmd = "sudo $cmd_hash{$tree} -t $table_hash{$tree} " . - "-I OUTPUT $insert_at_rule_num -j $zone_chain"; - $error = Vyatta::Zone::run_cmd($cmd); - return "Error: call to add jump rule for local zone out -$zone_chain chain failed [$error]" if $error; - } - } - - } # end of else - - return; -} - -sub delete_fromzone_fw { - my ($zone, $from_zone, $ruleset_type, $ruleset_name) = @_; - my ($cmd, $error); - - # for all interfaces in from zone remove ruleset to filter traffic - # from this zone to specified zone (i.e. $zone) - my @from_zone_interfaces = - Vyatta::Zone::get_zone_interfaces("returnOrigValues", $from_zone); - if (scalar(@from_zone_interfaces) > 0) { - foreach my $intf (@from_zone_interfaces) { - $error = delete_fromzone_intf_ruleset($zone, $from_zone, $intf, - $ruleset_type, $ruleset_name); - return "Error: $error" if $error; - } - } else { - if (defined(Vyatta::Zone::is_local_zone("existsOrig", $from_zone))) { - # local from zone - my @zone_interfaces = - Vyatta::Zone::get_zone_interfaces("returnOrigValues", $zone); - foreach my $intf (@zone_interfaces) { - $error = delete_fromlocalzone_ruleset($zone, $from_zone, $intf, - $ruleset_type, $ruleset_name); - return "Error: $error" if $error; - } - } - - my $zone_chain=Vyatta::Zone::get_zone_chain("existsOrig", - $from_zone, 'localout'); - # if only drop rule & localhost allow rule in $zone_chain in both - # [ip and ip6]tables then delete jump from OUTPUT chain in both - foreach my $tree (keys %cmd_hash) { - my $rule_cnt = Vyatta::IpTables::Mgr::count_iptables_rules($cmd_hash{$tree}, - $table_hash{$tree}, $zone_chain); - if ($rule_cnt > 2) { - # atleast one of [ip or ip6]tables has local-zone as a from zone - return; - } - } - - foreach my $tree (keys %cmd_hash) { - $cmd = "sudo $cmd_hash{$tree} -t $table_hash{$tree} " . - "-D OUTPUT -j $zone_chain"; - $error = Vyatta::Zone::run_cmd($cmd); - return "Error: call to delete jump rule for local zone out -$zone_chain chain failed [$error]" if $error; - } - - } # end of else - return; -} - -sub set_default_policy { - my ($zone, $default_policy) = @_; - # setup default policy for zone - my $error = setup_default_policy ($zone, $default_policy); - return ($error, ) if $error; - if (defined(Vyatta::Zone::is_local_zone("exists", $zone))) { - # set default policy for local out chain as well - $error = setup_default_policy ($zone, $default_policy, "localout"); - return ($error, ) if $error; - } - return; -} - -sub check_zones_validity { - my $silent = shift; - my $error; - $error = Vyatta::Zone::validity_checks(); - if ($error) { - if ($silent eq 'true') { - # called from from/node.def which is a different transaction - # than everything else under zone-policy. We do not want to - # make chains or insert from rules into chains if we have a - # malfunctioning configuration. We fail in a silent way here - # so that when this function is called from zone-policy/node.def - # we will print the error and not repeat the same error twice - exit 1; - } else { - return ($error , ); - } - } - return; -} - -sub check_fwruleset_isActive { - my ($ruleset_type, $ruleset_name) = @_; - my $ret = Vyatta::Zone::is_fwruleset_active('isActive', $ruleset_type, - $ruleset_name); - return "Invalid firewall ruleset $ruleset_type $ruleset_name" if (!$ret); - return; -} - -# -# main -# - -my ($action, $zone_name, $interface, $from_zone, $ruleset_type, $ruleset_name, - $default_policy, $silent_validate); - -GetOptions("action=s" => \$action, - "zone-name=s" => \$zone_name, - "interface=s" => \$interface, - "from-zone=s" => \$from_zone, - "ruleset-type=s" => \$ruleset_type, - "ruleset-name=s" => \$ruleset_name, - "default-policy=s" => \$default_policy, - "silent-validate=s" => \$silent_validate, -); - -die "undefined action" if ! defined $action; -die "undefined zone" if ! defined $zone_name; - -my ($error, $warning); - -($error, $warning) = add_zone($zone_name) if $action eq 'add-zone'; - -($error, $warning) = delete_zone($zone_name) if $action eq 'delete-zone'; - -($error, $warning) = add_zone_interface($zone_name, $interface) - if $action eq 'add-zone-interface'; - -($error, $warning) = delete_zone_interface($zone_name, $interface) - if $action eq 'delete-zone-interface'; - -($error, $warning) = add_fromzone_fw($zone_name, $from_zone, $ruleset_type, - $ruleset_name) if $action eq 'add-fromzone-fw'; - -($error, $warning) = delete_fromzone_fw($zone_name, $from_zone, $ruleset_type, - $ruleset_name) if $action eq 'delete-fromzone-fw'; - -($error, $warning) = check_zones_validity($silent_validate) - if $action eq 'validity-checks'; - -($error, $warning) = add_localzone($zone_name) - if $action eq 'add-localzone'; - -($error, $warning) = delete_localzone($zone_name) - if $action eq 'delete-localzone'; - -($error, $warning) = set_default_policy($zone_name, $default_policy) - if $action eq 'set-default-policy'; - -($error, $warning) = check_fwruleset_isActive($ruleset_type, $ruleset_name) - if $action eq 'is-fwruleset-active'; - -if (defined $warning) { - print "$warning\n"; -} - -if (defined $error) { - print "$error\n"; - exit 1; -} - -exit 0; - -# end of file |