diff options
19 files changed, 471 insertions, 0 deletions
diff --git a/Makefile.am b/Makefile.am index bd2c2d9..f96e118 100644 --- a/Makefile.am +++ b/Makefile.am @@ -1,6 +1,11 @@ cfgdir = $(datadir)/vyatta-cfg/templates +opdir = $(datadir)/vyatta-op/templates curverdir = $(sysconfdir)/config-migrate/current modprobedir = /etc/modprobe.d +bin_sudo_usersdir = $(bindir)/sudo-users + +bin_sudo_users_SCRIPTS = scripts/vyatta-show-conntrack.pl +bin_sudo_users_SCRIPTS += scripts/vyatta-delete-conntrack.pl curver_DATA = cfg-version/conntrack@1 @@ -12,3 +17,5 @@ cpiop = find . ! -regex '\(.*~\|.*\.bak\|.*\.swp\|.*\#.*\#\)' -print0 | \ install-exec-hook: mkdir -p $(DESTDIR)$(cfgdir) cd templates-cfg; $(cpiop) $(DESTDIR)$(cfgdir) + mkdir -p $(DESTDIR)$(opdir) + cd templates-op; $(cpiop) $(DESTDIR)$(opdir) diff --git a/scripts/vyatta-delete-conntrack.pl b/scripts/vyatta-delete-conntrack.pl new file mode 100755 index 0000000..516635f --- /dev/null +++ b/scripts/vyatta-delete-conntrack.pl @@ -0,0 +1,211 @@ +#!/usr/bin/perl +# +# Module: vyatta-delete-conntrack.pl +# +# **** License **** +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 as +# published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# General Public License for more details. +# +# This code was originally developed by Vyatta, Inc. +# Portions created by Vyatta are Copyright (C) 2010 Vyatta, Inc. +# All Rights Reserved. +# +# Author: Gaurav Sinha +# Date: Oct 2011 +# Description: Script to delete conntrack entries based on the input +# delete command. +# +# **** End License **** +# + +use Getopt::Long; +use warnings; +use strict; +use XML::Simple; +use Data::Dumper; +use POSIX; +use lib "/opt/vyatta/share/perl5"; +use Vyatta::Misc; +use Sys::Syslog qw(:standard :macros); + +my $format = "Connection ID %-10s Source IP %-22s Destination IP %-22s Protocol %-12s\n"; + +sub add_xml_root { + my $xml = shift; + + $xml = "<data>\n" . $xml . '</data>'; + return $xml; +} + +sub print_data_from_xml { + my ($data, $cache) = @_; + + my $flow = 0; + + my %flowh; + my $tcount = 0; + print "Deleting following Conntrack entries\n\n"; + #open syslog + openlog($0, "", LOG_USER); + while (1) { + my $meta = 0; + last if ! defined $data->{flow}[$flow]; + my $flow_ref = $data->{flow}[$flow]; + my $flow_type = $flow_ref->{type}; + my (%src, %dst, %sport, %dport, %proto, %protonum, $timeout_ref, $connection_id_ref, + $state_connection_ref); + while (1) { + my $meta_ref = $flow_ref->{meta}[$meta]; + last if ! defined $meta_ref; + my $dir = $meta_ref->{direction}; + if ($dir eq 'original' or $dir eq 'reply') { + my $l3_ref = $meta_ref->{layer3}[0]; + my $l4_ref = $meta_ref->{layer4}[0]; + if (defined $l3_ref) { + $src{$dir} = $l3_ref->{src}[0]; + $dst{$dir} = $l3_ref->{dst}[0]; + if (defined $l4_ref) { + $sport{$dir} = $l4_ref->{sport}[0]; + $dport{$dir} = $l4_ref->{dport}[0]; + $proto{$dir} = $l4_ref->{protoname}; + $protonum{$dir} = $l4_ref->{protonum}; + } + } + } elsif ($dir eq 'independent') { + $timeout_ref = $meta_ref->{timeout}[0]; + $connection_id_ref = $meta_ref->{id}[0]; + $state_connection_ref = $meta_ref->{state}[0]; + } + $meta++; + } + my ($proto, $protonum, $in_src, $in_dst, $out_src, $out_dst, $connection_id, + $timeout, $state_connection); + $proto = $proto{original}; + $protonum = $protonum{original}; + $in_src = "$src{original}"; + $in_src .= ":$sport{original}" if defined $sport{original}; + $in_dst = "$dst{original}"; + $in_dst .= ":$dport{original}" if defined $dport{original}; + $connection_id = "$connection_id_ref"; + $timeout = "$timeout_ref"; + + if ($state_connection_ref) { + $state_connection = "$state_connection_ref"; + } + + # not using these for now + $out_src = "|$dst{reply}|"; + $out_src .= ":$dport{reply}" if defined $dport{reply}; + $out_dst = "|$src{reply}|"; + $out_dst .= ":$sport{reply}" if defined $sport{reply}; + + my $protocol = $proto . ' [' . $protonum . ']'; + printf($format, $connection_id ,$in_src, $in_dst, $protocol); + syslog("info", "Deleting Conntrack entry:conn-id $connection_id, src. IP $in_src, dest. IP $in_dst, protocol $protocol"); + $flow++; + } + #close syslog + closelog(); + return $flow; +} + +# +# main +# + +my ($sourceIP, $destIP, $family, $connection_ID); + +GetOptions("source_IP=s" => \$sourceIP, + "dest_IP=s" => \$destIP, + "family=s" => \$family, + "id=i" => \$connection_ID, +); + +my $xs = XML::Simple->new(ForceArray => 1, KeepRoot => 0); +my ($xml1, $xml2, $data); + +my $command_prefix = "sudo conntrack -D"; +my ($command, $sourcePort, $destPort); + +if ($family) { + $command .= " --family $family"; +} + +if (defined($connection_ID)) { + $command .= " -i $connection_ID"; +} + +if ($family eq "ipv4") { + if ((defined $sourceIP) and $sourceIP =~ m/:/) { + #IP address and port entered, are of the form IP:port + my @address = split(/:/, $sourceIP); + $sourceIP = $address[0]; + $sourcePort = $address[1]; + my( $success, $err ) = isValidPortNumber($sourcePort); + if(!defined($success)) { + die "Please enter a valid source port number\n"; + } + $command .= " --orig-port-src $sourcePort"; + } + + if ((defined $destIP) and $destIP =~ m/:/) { + my @address = split(/:/, $destIP); + $destIP = $address[0]; + $destPort = $address[1]; + my( $success, $err ) = isValidPortNumber($destPort); + if(!defined($success)) { + die "Please enter a valid destination port number\n"; + } + $command .= " --orig-port-dst $destPort"; + } + + if ((defined $sourceIP) and !($sourceIP eq "0.0.0.0")) { + # Check if IP address is a valid IPv4 address + if (!(isIpAddress($sourceIP))) { + die "Please enter a valid source IPv4 address\n"; + } + #If IP is any, do not add anything to command. + $command .= " -s $sourceIP"; + } + + if ((defined $destIP) and !($destIP eq "0.0.0.0")) { + # Check if IP address is a valid IPv4 address + if (!(isIpAddress($destIP))) { + die "Please enter a valid destination IPv4 address\n"; + } + $command .= " -d $destIP"; + } +} else { + #family IPv6 not supported, placeholder for v6 code. +} + +$command .= " -o xml"; +if ((defined($destPort)) or (defined($sourcePort))) { + my $command_final = $command_prefix." -p tcp".$command; + $xml1 = `$command_final 2> /dev/null`; + + #Execute the command for UDP as well. + $command_final = $command_prefix." -p udp".$command; + $xml2 = `$command_final 2> /dev/null`; +} else { + my $command_final = $command_prefix.$command; + $xml1 = `$command_final 2> /dev/null`; +} +# print data received from conntrack command as xml. +if ($xml1) { + $xml1 = add_xml_root($xml1); + $data = $xs->XMLin($xml1); + print_data_from_xml($data); +} +if ($xml2) { + $xml2 = add_xml_root($xml2); + $data = $xs->XMLin($xml2); + print_data_from_xml($data); +} +# end of file diff --git a/scripts/vyatta-show-conntrack.pl b/scripts/vyatta-show-conntrack.pl new file mode 100755 index 0000000..6a461f8 --- /dev/null +++ b/scripts/vyatta-show-conntrack.pl @@ -0,0 +1,224 @@ +#!/usr/bin/perl +# +# Module: vyatta-show-conntrack.pl +# +# **** License **** +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 as +# published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# General Public License for more details. +# +# This code was originally developed by Vyatta, Inc. +# Portions created by Vyatta are Copyright (C) 2010 Vyatta, Inc. +# All Rights Reserved. +# +# Author: Gaurav Sinha +# Date: Oct 2011 +# Description: Script to show conntrack entries based on the input +# show command. +# +# **** End License **** +# +use Getopt::Long; +use XML::Simple; +use Data::Dumper; +use POSIX; +use lib "/opt/vyatta/share/perl5"; +use Vyatta::Misc; +use warnings; +use strict; +use Switch; + +my $format = "%-10s %-22s %-22s %-12s %-20s\n"; + +sub print_xml { + my ($data, $cache) = @_; + + my $flow = 0; + + my %flowh; + my $tcount = 0; + while (1) { + my $meta = 0; + last if ! defined $data->{flow}[$flow]; + my $flow_ref = $data->{flow}[$flow]; + my $flow_type = $flow_ref->{type}; + my (%src, %dst, %sport, %dport, %proto, %protonum, $timeout_ref, $connection_id_ref, + $state_connection_ref); + while (1) { + my $meta_ref = $flow_ref->{meta}[$meta]; + last if ! defined $meta_ref; + my $dir = $meta_ref->{direction}; + if ($dir eq 'original' or $dir eq 'reply') { + my $l3_ref = $meta_ref->{layer3}[0]; + my $l4_ref = $meta_ref->{layer4}[0]; + if (defined $l3_ref) { + $src{$dir} = $l3_ref->{src}[0]; + $dst{$dir} = $l3_ref->{dst}[0]; + if (defined $l4_ref) { + $sport{$dir} = $l4_ref->{sport}[0]; + $dport{$dir} = $l4_ref->{dport}[0]; + $proto{$dir} = $l4_ref->{protoname}; + $protonum{$dir} = $l4_ref->{protonum}; + } + } + } elsif ($dir eq 'independent') { + $timeout_ref = $meta_ref->{timeout}[0]; + $connection_id_ref = $meta_ref->{id}[0]; + $state_connection_ref = $meta_ref->{state}[0]; + } + $meta++; + } + my ($proto, $protonum, $in_src, $in_dst, $out_src, $out_dst, $connection_id, + $timeout, $state_connection); + $proto = $proto{original}; + $protonum = $protonum{original}; + $in_src = "$src{original}"; + $in_src .= ":$sport{original}" if defined $sport{original}; + $in_dst = "$dst{original}"; + $in_dst .= ":$dport{original}" if defined $dport{original}; + $connection_id = "$connection_id_ref"; + $timeout = "$timeout_ref"; + + if ($state_connection_ref) { + $state_connection = "$state_connection_ref"; + } + + # not using these for now + $out_src = "|$dst{reply}|"; + $out_src .= ":$dport{reply}" if defined $dport{reply}; + $out_dst = "|$src{reply}|"; + $out_dst .= ":$sport{reply}" if defined $sport{reply}; + + my $protocol = $proto . ' [' . $protonum . ']'; + if ($state_connection) { + switch($state_connection) { + case ("ESTABLISHED") { + $protocol .= " ES"; + } + case ("SYN_SENT") { + $protocol .= " SS"; + } + case ("SYN_RECV") { + $protocol .= " SR"; + } + case ("FIN_WAIT") { + $protocol .= " FW"; + } + case ("CLOSE_WAIT") { + $protocol .= " CW"; + } + case ("LAST_ACK") { + $protocol .= " LA"; + } + case ("TIME_WAIT") { + $protocol .= " TW"; + } + case ("CLOSED") { + $protocol .= " CL"; + } + case ("LISTEN") { + $protocol .= " LI"; + } + } + } + printf($format, $connection_id ,$in_src, $in_dst, $protocol, $timeout); + $flow++; + } + return $flow; +} + +# +# main +# + +my ($sourceIP, $destIP, $family); + +GetOptions("source_IP=s" => \$sourceIP, + "dest_IP=s" => \$destIP, + "family=s" => \$family, +); + +my $xs = XML::Simple->new(ForceArray => 1, KeepRoot => 0); +my ($xml1, $xml2, $data); + +#build command string using <command_prefix><command>. +my $command_prefix = "sudo conntrack -L"; +my $command = " --family $family"; + +my ($sourcePort, $destPort); +if ($family eq "ipv4") { + if ((defined $sourceIP) and $sourceIP =~ m/:/) { + #IP address and port entered, are of the form IP:port + my @address = split(/:/, $sourceIP); + $sourceIP = $address[0]; + $sourcePort = $address[1]; + my( $success, $err ) = isValidPortNumber($sourcePort); + if(!defined($success)) { + die "Please enter a valid source port number\n"; + } + $command .= " --orig-port-src $sourcePort"; + } + + if ((defined $destIP) and $destIP =~ m/:/) { + my @address = split(/:/, $destIP); + $destIP = $address[0]; + $destPort = $address[1]; + my( $success, $err ) = isValidPortNumber($destPort); + if(!defined($success)) { + die "Please enter a valid destination port number\n"; + } + $command .= " --orig-port-dst $destPort"; + } + + if ((defined $sourceIP) and !($sourceIP eq "0.0.0.0")) { + # Check if IP address is a valid IPv4 address + if (!(isIpAddress($sourceIP))) { + die "Please enter a valid source IPv4 address\n"; + } + #If IP is any, do not add anything to command. + $command .= " -s $sourceIP"; + } + + if ((defined $destIP) and !($destIP eq "0.0.0.0")) { + # Check if IP address is a valid IPv4 address + if (!(isIpAddress($destIP))) { + die "Please enter a valid destination IPv4 address\n"; + } + $command .= " -d $destIP"; + } +} else { + #family IPv6 not supported, placeholder for v6 code. +} + +$command .= " -o xml"; +print "TCP state codes: SS - SYN SENT, SR - SYN RECEIVED, ES - ESTABLISHED,\n"; +print " FW - FIN WAIT, CW - CLOSE WAIT, LA - LAST ACK,\n"; +print " TW - TIME WAIT, CL - CLOSE, LI - LISTEN\n\n"; + +printf($format, 'CONN ID', 'Source', 'Destination', 'Protocol', 'TIMEOUT'); +if ((defined($destPort)) or (defined($sourcePort))) { + my $command_final = $command_prefix." -p tcp".$command; + $xml1 = `$command_final 2> /dev/null`; + + #Execute the command for UDP as well. + $command_final = $command_prefix." -p udp".$command; + $xml2 = `$command_final 2> /dev/null`; +} else { + my $command_final = $command_prefix.$command; + $xml1 = `$command_final 2> /dev/null`; +} + +if ($xml1) { + $data = $xs->XMLin($xml1); + print_xml($data); +} +if ($xml2) { + $data = $xs->XMLin($xml2); + print_xml($data); +} +# end of file diff --git a/templates-op/delete/conntrack/node.def b/templates-op/delete/conntrack/node.def new file mode 100644 index 0000000..842bdda --- /dev/null +++ b/templates-op/delete/conntrack/node.def @@ -0,0 +1 @@ +help: Delete Conntrack entries diff --git a/templates-op/delete/conntrack/table/ipv4/conn-id/node.def b/templates-op/delete/conntrack/table/ipv4/conn-id/node.def new file mode 100644 index 0000000..679cae2 --- /dev/null +++ b/templates-op/delete/conntrack/table/ipv4/conn-id/node.def @@ -0,0 +1 @@ +help: Delete Conntrack entry with connection ID diff --git a/templates-op/delete/conntrack/table/ipv4/conn-id/node.tag/node.def b/templates-op/delete/conntrack/table/ipv4/conn-id/node.tag/node.def new file mode 100644 index 0000000..d3f179e --- /dev/null +++ b/templates-op/delete/conntrack/table/ipv4/conn-id/node.tag/node.def @@ -0,0 +1,3 @@ +help: Delete Conntrack entry with the connection ID +allowed: echo -n 'Connection ID' +run: sudo ${vyatta_bindir}/sudo-users/vyatta-delete-conntrack.pl -family $4 -id $6 diff --git a/templates-op/delete/conntrack/table/ipv4/node.def b/templates-op/delete/conntrack/table/ipv4/node.def new file mode 100644 index 0000000..80ccc5d --- /dev/null +++ b/templates-op/delete/conntrack/table/ipv4/node.def @@ -0,0 +1 @@ +help: Delete Conntrack IPv4 entries diff --git a/templates-op/delete/conntrack/table/ipv4/source/node.def b/templates-op/delete/conntrack/table/ipv4/source/node.def new file mode 100644 index 0000000..10081cd --- /dev/null +++ b/templates-op/delete/conntrack/table/ipv4/source/node.def @@ -0,0 +1 @@ +help: Delete all Conntrack entries with specified source IP address diff --git a/templates-op/delete/conntrack/table/ipv4/source/node.tag/destination/node.def b/templates-op/delete/conntrack/table/ipv4/source/node.tag/destination/node.def new file mode 100644 index 0000000..aee21aa --- /dev/null +++ b/templates-op/delete/conntrack/table/ipv4/source/node.tag/destination/node.def @@ -0,0 +1 @@ +help: Delete all Conntrack entries with the specified destination IP address diff --git a/templates-op/delete/conntrack/table/ipv4/source/node.tag/destination/node.tag/node.def b/templates-op/delete/conntrack/table/ipv4/source/node.tag/destination/node.tag/node.def new file mode 100644 index 0000000..25c67e9 --- /dev/null +++ b/templates-op/delete/conntrack/table/ipv4/source/node.tag/destination/node.tag/node.def @@ -0,0 +1,3 @@ +help: Delete Conntrack entries with the specified destination IP +allowed: echo -n '<IP-address>' '<IP-address:port>' +run: sudo ${vyatta_bindir}/sudo-users/vyatta-delete-conntrack.pl -family $4 -source_IP $6 -dest_IP $8 diff --git a/templates-op/delete/conntrack/table/ipv4/source/node.tag/node.def b/templates-op/delete/conntrack/table/ipv4/source/node.tag/node.def new file mode 100644 index 0000000..e0004a9 --- /dev/null +++ b/templates-op/delete/conntrack/table/ipv4/source/node.tag/node.def @@ -0,0 +1,3 @@ +help: Delete Conntrack entries with the specified source IP address +allowed: echo -n '<IP-address>' '<IP-address:port>' +run: sudo ${vyatta_bindir}/sudo-users/vyatta-delete-conntrack.pl -family $4 -source_IP $6 diff --git a/templates-op/delete/conntrack/table/node.def b/templates-op/delete/conntrack/table/node.def new file mode 100644 index 0000000..340bb72 --- /dev/null +++ b/templates-op/delete/conntrack/table/node.def @@ -0,0 +1 @@ +help: Delete entries from Conntrack table diff --git a/templates-op/show/conntrack/node.def b/templates-op/show/conntrack/node.def new file mode 100644 index 0000000..300bc83 --- /dev/null +++ b/templates-op/show/conntrack/node.def @@ -0,0 +1 @@ +help: Show conntrack entries in the conntrack table diff --git a/templates-op/show/conntrack/table/ipv4/node.def b/templates-op/show/conntrack/table/ipv4/node.def new file mode 100644 index 0000000..5509c14 --- /dev/null +++ b/templates-op/show/conntrack/table/ipv4/node.def @@ -0,0 +1,2 @@ +help: Show Conntrack entries for IPv4 protocol +run: sudo ${vyatta_bindir}/sudo-users/vyatta-show-conntrack.pl -family $4 diff --git a/templates-op/show/conntrack/table/ipv4/source/node.def b/templates-op/show/conntrack/table/ipv4/source/node.def new file mode 100644 index 0000000..f3f6c84 --- /dev/null +++ b/templates-op/show/conntrack/table/ipv4/source/node.def @@ -0,0 +1 @@ +help: Show Conntrack entries for the source IP diff --git a/templates-op/show/conntrack/table/ipv4/source/node.tag/destination/node.def b/templates-op/show/conntrack/table/ipv4/source/node.tag/destination/node.def new file mode 100644 index 0000000..88b6eb1 --- /dev/null +++ b/templates-op/show/conntrack/table/ipv4/source/node.tag/destination/node.def @@ -0,0 +1,3 @@ +help: Show Conntrack entries for the destination IP +allowed: echo "<x.x.x.x:pp> + diff --git a/templates-op/show/conntrack/table/ipv4/source/node.tag/destination/node.tag/node.def b/templates-op/show/conntrack/table/ipv4/source/node.tag/destination/node.tag/node.def new file mode 100644 index 0000000..09bd8ef --- /dev/null +++ b/templates-op/show/conntrack/table/ipv4/source/node.tag/destination/node.tag/node.def @@ -0,0 +1,3 @@ +help: Show Conntrack entries for the destination IP +allowed: echo -n '<IPv4-address>' '<IPv4-address:port>' +run: sudo ${vyatta_bindir}/sudo-users/vyatta-show-conntrack.pl -family $4 -source_IP $6 -dest_IP $8 diff --git a/templates-op/show/conntrack/table/ipv4/source/node.tag/node.def b/templates-op/show/conntrack/table/ipv4/source/node.tag/node.def new file mode 100644 index 0000000..0d36700 --- /dev/null +++ b/templates-op/show/conntrack/table/ipv4/source/node.tag/node.def @@ -0,0 +1,3 @@ +help: Show Conntrack entries for the source IP +allowed: echo -n '<IPv4-address>' '<IPv4-address:port>' +run: sudo ${vyatta_bindir}/sudo-users/vyatta-show-conntrack.pl -family $4 -source_IP $6 diff --git a/templates-op/show/conntrack/table/node.def b/templates-op/show/conntrack/table/node.def new file mode 100644 index 0000000..c4767bf --- /dev/null +++ b/templates-op/show/conntrack/table/node.def @@ -0,0 +1 @@ +help: Show conntrack entries for table |