From 760005fa84fe0ad4ce87e330ba7bc8ce845d5d24 Mon Sep 17 00:00:00 2001 From: Deepti Kulkarni Date: Sat, 3 Mar 2012 02:25:48 -0800 Subject: new branch --- .frlog | 1 + 1 file changed, 1 insertion(+) diff --git a/.frlog b/.frlog index 4fbe4cb..2e805fd 100644 --- a/.frlog +++ b/.frlog @@ -1,3 +1,4 @@ Fri Nov 4 05:42:12 NOVT 2011: [Force build] at [debian/0.1] Wed Jan 4 01:55:59 NOVT 2012: [Force release] at [debian/0.26] Tue Jan 31 11:14:11 PST 2012: [reset epoch] at [debian/0.27] +Sat Mar 3 02:25:48 PST 2012: [new branch] at [debian/0.28] -- cgit v1.2.3 From a959a0af0ba7481c6b463c1d5d91fbbdfb81b695 Mon Sep 17 00:00:00 2001 From: Deepti Kulkarni Date: Sat, 3 Mar 2012 02:25:49 -0800 Subject: 0.29 --- debian/changelog | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/debian/changelog b/debian/changelog index 9934a86..1b374be 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,9 @@ +vyatta-conntrack (0.29) unstable; urgency=low + + * new branch + + -- Deepti Kulkarni Sat, 03 Mar 2012 02:25:49 -0800 + vyatta-conntrack (0.28) unstable; urgency=low * reset epoch -- cgit v1.2.3 From 9429da68867750d93ffe2e78c443c7ef8755680e Mon Sep 17 00:00:00 2001 From: Gaurav Sinha Date: Fri, 16 Mar 2012 15:41:31 -0700 Subject: fixing 7866 (cherry picked from commit e9e6c678e9f133ba8645b26f107650a9a103768c) --- scripts/vyatta-delete-conntrack.pl | 18 ++++++++++++++---- scripts/vyatta-show-conntrack.pl | 17 +++++++++++++---- 2 files changed, 27 insertions(+), 8 deletions(-) diff --git a/scripts/vyatta-delete-conntrack.pl b/scripts/vyatta-delete-conntrack.pl index 96f176d..ccd69de 100755 --- a/scripts/vyatta-delete-conntrack.pl +++ b/scripts/vyatta-delete-conntrack.pl @@ -99,10 +99,20 @@ sub print_data_from_xml { $timeout, $state_connection); $proto = $proto{original}; $protonum = $protonum{original}; - $in_src = "$src{original}"; - $in_src .= ":$sport{original}" if defined $sport{original}; - $in_dst = "$dst{original}"; - $in_dst .= ":$dport{original}" if defined $dport{original}; + if (( $family eq 'ipv6') and (defined $sport{original})) { + $in_src = "\[$src{original}]:$sport{original}"; + } else { + $in_src = "$src{original}"; + $in_src .= ":$sport{original}" if defined $sport{original}; + } + + if (( $family eq 'ipv6') and (defined $dport{original})) { + $in_dst = "\[$dst{original}]:$dport{original}"; + } else { + $in_dst = "$dst{original}"; + $in_dst .= ":$dport{original}" if defined $dport{original}; + } + $connection_id = "$connection_id_ref"; $timeout = "$timeout_ref"; diff --git a/scripts/vyatta-show-conntrack.pl b/scripts/vyatta-show-conntrack.pl index bfbc63e..57a9799 100755 --- a/scripts/vyatta-show-conntrack.pl +++ b/scripts/vyatta-show-conntrack.pl @@ -80,10 +80,19 @@ sub print_xml { $timeout, $state_connection); $proto = $proto{original}; $protonum = $protonum{original}; - $in_src = "$src{original}"; - $in_src .= ":$sport{original}" if defined $sport{original}; - $in_dst = "$dst{original}"; - $in_dst .= ":$dport{original}" if defined $dport{original}; + if (( $family eq 'ipv6') and (defined $sport{original})) { + $in_src = "\[$src{original}]:$sport{original}"; + } else { + $in_src = "$src{original}"; + $in_src .= ":$sport{original}" if defined $sport{original}; + } + + if (( $family eq 'ipv6') and (defined $dport{original})) { + $in_dst = "\[$dst{original}]:$dport{original}"; + } else { + $in_dst = "$dst{original}"; + $in_dst .= ":$dport{original}" if defined $dport{original}; + } $connection_id = "$connection_id_ref"; $timeout = "$timeout_ref"; -- cgit v1.2.3 From afb96b8c15b5ad9e6ae920faf79fe13049a871cb Mon Sep 17 00:00:00 2001 From: Gaurav Sinha Date: Fri, 16 Mar 2012 15:49:43 -0700 Subject: 0.30 --- debian/changelog | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/debian/changelog b/debian/changelog index 1b374be..34b2172 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,9 @@ +vyatta-conntrack (0.30) unstable; urgency=low + + * fixing 7866 + + -- Gaurav Sinha Fri, 16 Mar 2012 15:49:43 -0700 + vyatta-conntrack (0.29) unstable; urgency=low * new branch -- cgit v1.2.3 From 30e0a9401a49c21318403cdc9e6c3689f757ebbf Mon Sep 17 00:00:00 2001 From: Gaurav Sinha Date: Wed, 1 Feb 2012 16:21:28 -0800 Subject: Initial commit for per-flow timeout CLI (cherry picked from commit f7fc0b920516ecf03a7dcf3e73f39513d8fcfc1c) --- .../system/conntrack/timeout/custom/node.def | 1 + .../system/conntrack/timeout/custom/rule/node.def | 9 +++++++++ .../custom/rule/node.tag/description/node.def | 3 +++ .../rule/node.tag/destination/address/node.def | 10 ++++++++++ .../destination/group/address-group/node.def | 9 +++++++++ .../destination/group/network-group/node.def | 8 ++++++++ .../rule/node.tag/destination/group/node.def | 1 + .../node.tag/destination/group/port-group/node.def | 8 ++++++++ .../custom/rule/node.tag/destination/node.def | 1 + .../custom/rule/node.tag/destination/port/node.def | 10 ++++++++++ .../timeout/custom/rule/node.tag/protocol/node.def | 22 ++++++++++++++++++++++ .../custom/rule/node.tag/source/address/node.def | 8 ++++++++ .../node.tag/source/group/address-group/node.def | 8 ++++++++ .../node.tag/source/group/network-group/node.def | 8 ++++++++ .../custom/rule/node.tag/source/group/node.def | 1 + .../rule/node.tag/source/group/port-group/node.def | 8 ++++++++ .../rule/node.tag/source/mac-address/node.def | 3 +++ .../timeout/custom/rule/node.tag/source/node.def | 1 + .../custom/rule/node.tag/source/port/node.def | 8 ++++++++ 19 files changed, 127 insertions(+) create mode 100644 templates-cfg/system/conntrack/timeout/custom/node.def create mode 100644 templates-cfg/system/conntrack/timeout/custom/rule/node.def create mode 100644 templates-cfg/system/conntrack/timeout/custom/rule/node.tag/description/node.def create mode 100644 templates-cfg/system/conntrack/timeout/custom/rule/node.tag/destination/address/node.def create mode 100644 templates-cfg/system/conntrack/timeout/custom/rule/node.tag/destination/group/address-group/node.def create mode 100644 templates-cfg/system/conntrack/timeout/custom/rule/node.tag/destination/group/network-group/node.def create mode 100644 templates-cfg/system/conntrack/timeout/custom/rule/node.tag/destination/group/node.def create mode 100644 templates-cfg/system/conntrack/timeout/custom/rule/node.tag/destination/group/port-group/node.def create mode 100644 templates-cfg/system/conntrack/timeout/custom/rule/node.tag/destination/node.def create mode 100644 templates-cfg/system/conntrack/timeout/custom/rule/node.tag/destination/port/node.def create mode 100644 templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/node.def create mode 100644 templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/address/node.def create mode 100644 templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/group/address-group/node.def create mode 100644 templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/group/network-group/node.def create mode 100644 templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/group/node.def create mode 100644 templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/group/port-group/node.def create mode 100644 templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/mac-address/node.def create mode 100644 templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/node.def create mode 100644 templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/port/node.def diff --git a/templates-cfg/system/conntrack/timeout/custom/node.def b/templates-cfg/system/conntrack/timeout/custom/node.def new file mode 100644 index 0000000..c8e5841 --- /dev/null +++ b/templates-cfg/system/conntrack/timeout/custom/node.def @@ -0,0 +1 @@ +help: Define custom timeouts per flow diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.def new file mode 100644 index 0000000..c31dfbd --- /dev/null +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.def @@ -0,0 +1,9 @@ +tag: + +type: u32 + +help: Rule number (1-9999) + +syntax:expression: $VAR(@) > 0 && $VAR(@) <= 9999; "firewall rule number must be between 1 and 9999" + +val_help: u32:1-9999; Rule number diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/description/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/description/node.def new file mode 100644 index 0000000..90bf88b --- /dev/null +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/description/node.def @@ -0,0 +1,3 @@ +type: txt + +help: Rule description diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/destination/address/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/destination/address/node.def new file mode 100644 index 0000000..83d7514 --- /dev/null +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/destination/address/node.def @@ -0,0 +1,10 @@ +type: txt + +help: Destination IP address, subnet, or range + +val_help: ipv4; IP address to match +val_help: ipv4net; Subnet to match +val_help: ipv4range; IP range to match +val_help: !ipv4; Match everything except the specified address +val_help: !ipv4net; Match everything except the specified subnet +val_help: !ipv4range; Match everything except the specified range diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/destination/group/address-group/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/destination/group/address-group/node.def new file mode 100644 index 0000000..07e791c --- /dev/null +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/destination/group/address-group/node.def @@ -0,0 +1,9 @@ +type: txt +help: Group of addresses + +commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \ + --action=check-set-type \ + --set-name=$VAR(@) \ + --set-type=address;" + +allowed: cli-shell-api listActiveNodes firewall group address-group diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/destination/group/network-group/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/destination/group/network-group/node.def new file mode 100644 index 0000000..bf018a0 --- /dev/null +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/destination/group/network-group/node.def @@ -0,0 +1,8 @@ +type: txt +help: Group of networks + +commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \ + --action=check-set-type \ + --set-name=$VAR(@) \ + --set-type=network;" +allowed: cli-shell-api listActiveNodes firewall group network-group diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/destination/group/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/destination/group/node.def new file mode 100644 index 0000000..bb11dae --- /dev/null +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/destination/group/node.def @@ -0,0 +1 @@ +help: Destination group diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/destination/group/port-group/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/destination/group/port-group/node.def new file mode 100644 index 0000000..865d2c5 --- /dev/null +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/destination/group/port-group/node.def @@ -0,0 +1,8 @@ +type: txt +help: Group of ports + +commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \ + --action=check-set-type \ + --set-name=$VAR(@) \ + --set-type=port;" +allowed: cli-shell-api listActiveNodes firewall group port-group diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/destination/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/destination/node.def new file mode 100644 index 0000000..dc227b7 --- /dev/null +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/destination/node.def @@ -0,0 +1 @@ +help: Destination parameters diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/destination/port/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/destination/port/node.def new file mode 100644 index 0000000..2b2d8c7 --- /dev/null +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/destination/port/node.def @@ -0,0 +1,10 @@ +type: txt + +help: Destination port + +val_help: ; Named port (any name in /etc/services, e.g., http) +val_help: u32:1-65535; Numbered port +val_help: range; Numbered port range (e.g., 1001-1005) +comp_help: Multiple destination ports can be specified as a comma-separated list. +The whole list can also be "negated" using '!'. For example: + '!22,telnet,http,123,1001-1005' diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/node.def new file mode 100644 index 0000000..1f235f7 --- /dev/null +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/node.def @@ -0,0 +1,22 @@ +type: txt + +help: Protocol to match (protocol name in /etc/protocols or protocol number or "all") + +val_help: txt; IP protocol name from /etc/protocols (e.g. "tcp" or "udp") +val_help: u32:0-255; IP protocol number +val_help: tcp_udp; Both TCP and UDP +val_help: all; All IP protocols +val_help: !; All IP protocols except for the specified name or number + +syntax:expression: exec "if [ -n \"`/opt/vyatta/sbin/vyatta-validate-type.pl protocol_negate '$VAR(@)'`\" ] \ + && [ \"$VAR(@)\" != 'tcp_udp' ]; then \ + echo invalid protocol \"$VAR(@)\" ; \ + exit 1 ; \ + fi ; " + +# Provide some help for command completion. Doesn't return negated +# values or protocol numbers +allowed: + protos=`cat /etc/protocols | sed -e '/^#.*/d' | awk '{ print $1 }' | grep -v 'v6'` + protos="all $protos tcp_udp" + echo -n $protos diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/address/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/address/node.def new file mode 100644 index 0000000..72d6a17 --- /dev/null +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/address/node.def @@ -0,0 +1,8 @@ +type: txt +help: Source IP address, subnet, or range +val_help: ipv4; IP address to match +val_help: ipv4net; Subnet to match +val_help: ipv4range; IP range to match +val_help: !ipv4; Match everything except the specified address +val_help: !ipv4net; Match everything except the specified subnet +val_help: !ipv4range; Match everything except the specified range diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/group/address-group/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/group/address-group/node.def new file mode 100644 index 0000000..97c748d --- /dev/null +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/group/address-group/node.def @@ -0,0 +1,8 @@ +type: txt +help: Group of addresses + +commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \ + --action=check-set-type \ + --set-name=$VAR(@) \ + --set-type=address;" +allowed: cli-shell-api listActiveNodes firewall group address-group diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/group/network-group/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/group/network-group/node.def new file mode 100644 index 0000000..bf018a0 --- /dev/null +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/group/network-group/node.def @@ -0,0 +1,8 @@ +type: txt +help: Group of networks + +commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \ + --action=check-set-type \ + --set-name=$VAR(@) \ + --set-type=network;" +allowed: cli-shell-api listActiveNodes firewall group network-group diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/group/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/group/node.def new file mode 100644 index 0000000..7b36071 --- /dev/null +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/group/node.def @@ -0,0 +1 @@ +help: Source group diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/group/port-group/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/group/port-group/node.def new file mode 100644 index 0000000..865d2c5 --- /dev/null +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/group/port-group/node.def @@ -0,0 +1,8 @@ +type: txt +help: Group of ports + +commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \ + --action=check-set-type \ + --set-name=$VAR(@) \ + --set-type=port;" +allowed: cli-shell-api listActiveNodes firewall group port-group diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/mac-address/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/mac-address/node.def new file mode 100644 index 0000000..ad07881 --- /dev/null +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/mac-address/node.def @@ -0,0 +1,3 @@ +type: txt +help: Source MAC address +syntax:expression: exec "/opt/vyatta/sbin/vyatta-validate-type.pl macaddr_negate '$VAR(@)'" ; "invalid MAC address \"$VAR(@)\"" diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/node.def new file mode 100644 index 0000000..84cdc1f --- /dev/null +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/node.def @@ -0,0 +1 @@ +help: Source parameters diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/port/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/port/node.def new file mode 100644 index 0000000..adfae7a --- /dev/null +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/port/node.def @@ -0,0 +1,8 @@ +type: txt +help: Source port +val_help: ; Named port (any name in /etc/services, e.g., http) +val_help: u32:1-65535; Numbered port +val_help: range; Numbered port range (e.g., 1001-1005) +comp_help: Multiple source ports can be specified as a comma-separated list. +The whole list can also be "negated" using '!'. For example: + '!22,telnet,http,123,1001-1005' -- cgit v1.2.3 From b5e891c97c391f7a6b20c7676883dd9b1e894ef4 Mon Sep 17 00:00:00 2001 From: Gaurav Sinha Date: Wed, 1 Feb 2012 16:34:36 -0800 Subject: Removed unwanted address-group/network group etc. from CLI (cherry picked from commit 50f07ece2595c05179e8ccffa5dd2b28fc8cfc99) --- .../rule/node.tag/destination/group/address-group/node.def | 9 --------- .../rule/node.tag/destination/group/network-group/node.def | 8 -------- .../timeout/custom/rule/node.tag/destination/group/node.def | 1 - .../custom/rule/node.tag/destination/group/port-group/node.def | 8 -------- .../custom/rule/node.tag/source/group/address-group/node.def | 8 -------- .../custom/rule/node.tag/source/group/network-group/node.def | 8 -------- .../conntrack/timeout/custom/rule/node.tag/source/group/node.def | 1 - .../custom/rule/node.tag/source/group/port-group/node.def | 8 -------- .../timeout/custom/rule/node.tag/source/mac-address/node.def | 3 --- 9 files changed, 54 deletions(-) delete mode 100644 templates-cfg/system/conntrack/timeout/custom/rule/node.tag/destination/group/address-group/node.def delete mode 100644 templates-cfg/system/conntrack/timeout/custom/rule/node.tag/destination/group/network-group/node.def delete mode 100644 templates-cfg/system/conntrack/timeout/custom/rule/node.tag/destination/group/node.def delete mode 100644 templates-cfg/system/conntrack/timeout/custom/rule/node.tag/destination/group/port-group/node.def delete mode 100644 templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/group/address-group/node.def delete mode 100644 templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/group/network-group/node.def delete mode 100644 templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/group/node.def delete mode 100644 templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/group/port-group/node.def delete mode 100644 templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/mac-address/node.def diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/destination/group/address-group/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/destination/group/address-group/node.def deleted file mode 100644 index 07e791c..0000000 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/destination/group/address-group/node.def +++ /dev/null @@ -1,9 +0,0 @@ -type: txt -help: Group of addresses - -commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \ - --action=check-set-type \ - --set-name=$VAR(@) \ - --set-type=address;" - -allowed: cli-shell-api listActiveNodes firewall group address-group diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/destination/group/network-group/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/destination/group/network-group/node.def deleted file mode 100644 index bf018a0..0000000 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/destination/group/network-group/node.def +++ /dev/null @@ -1,8 +0,0 @@ -type: txt -help: Group of networks - -commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \ - --action=check-set-type \ - --set-name=$VAR(@) \ - --set-type=network;" -allowed: cli-shell-api listActiveNodes firewall group network-group diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/destination/group/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/destination/group/node.def deleted file mode 100644 index bb11dae..0000000 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/destination/group/node.def +++ /dev/null @@ -1 +0,0 @@ -help: Destination group diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/destination/group/port-group/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/destination/group/port-group/node.def deleted file mode 100644 index 865d2c5..0000000 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/destination/group/port-group/node.def +++ /dev/null @@ -1,8 +0,0 @@ -type: txt -help: Group of ports - -commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \ - --action=check-set-type \ - --set-name=$VAR(@) \ - --set-type=port;" -allowed: cli-shell-api listActiveNodes firewall group port-group diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/group/address-group/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/group/address-group/node.def deleted file mode 100644 index 97c748d..0000000 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/group/address-group/node.def +++ /dev/null @@ -1,8 +0,0 @@ -type: txt -help: Group of addresses - -commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \ - --action=check-set-type \ - --set-name=$VAR(@) \ - --set-type=address;" -allowed: cli-shell-api listActiveNodes firewall group address-group diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/group/network-group/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/group/network-group/node.def deleted file mode 100644 index bf018a0..0000000 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/group/network-group/node.def +++ /dev/null @@ -1,8 +0,0 @@ -type: txt -help: Group of networks - -commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \ - --action=check-set-type \ - --set-name=$VAR(@) \ - --set-type=network;" -allowed: cli-shell-api listActiveNodes firewall group network-group diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/group/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/group/node.def deleted file mode 100644 index 7b36071..0000000 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/group/node.def +++ /dev/null @@ -1 +0,0 @@ -help: Source group diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/group/port-group/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/group/port-group/node.def deleted file mode 100644 index 865d2c5..0000000 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/group/port-group/node.def +++ /dev/null @@ -1,8 +0,0 @@ -type: txt -help: Group of ports - -commit:expression: exec "sudo /opt/vyatta/sbin/vyatta-ipset.pl \ - --action=check-set-type \ - --set-name=$VAR(@) \ - --set-type=port;" -allowed: cli-shell-api listActiveNodes firewall group port-group diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/mac-address/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/mac-address/node.def deleted file mode 100644 index ad07881..0000000 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/source/mac-address/node.def +++ /dev/null @@ -1,3 +0,0 @@ -type: txt -help: Source MAC address -syntax:expression: exec "/opt/vyatta/sbin/vyatta-validate-type.pl macaddr_negate '$VAR(@)'" ; "invalid MAC address \"$VAR(@)\"" -- cgit v1.2.3 From fe3908e77451c419c9e4b8351cb72cde9c875312 Mon Sep 17 00:00:00 2001 From: Gaurav Sinha Date: Mon, 6 Feb 2012 17:19:00 -0800 Subject: adding an initial version of conntrack-timeouts script (cherry picked from commit 8235f2a9a3b3e1a5a289c4365d809bb09f941ee4) --- Makefile.am | 1 + templates-cfg/system/conntrack/timeout/custom/node.def | 12 ++++++++++++ templates-cfg/system/conntrack/timeout/custom/rule/node.def | 2 +- 3 files changed, 14 insertions(+), 1 deletion(-) diff --git a/Makefile.am b/Makefile.am index 46e3603..1e53937 100644 --- a/Makefile.am +++ b/Makefile.am @@ -21,6 +21,7 @@ sbin_SCRIPTS = scripts/vyatta-update-conntrack-log.pl bin_sudo_usersdir = $(bindir)/sudo-users bin_sudo_users_SCRIPTS = scripts/vyatta-show-conntrack.pl bin_sudo_users_SCRIPTS += scripts/vyatta-delete-conntrack.pl +bin_sudo_users_SCRIPTS += scripts/vyatta-conntrack-timeouts.pl curver_DATA = cfg-version/conntrack@1 diff --git a/templates-cfg/system/conntrack/timeout/custom/node.def b/templates-cfg/system/conntrack/timeout/custom/node.def index c8e5841..7967ead 100644 --- a/templates-cfg/system/conntrack/timeout/custom/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/node.def @@ -1 +1,13 @@ help: Define custom timeouts per flow +end: if sudo /opt/vyatta/bin/sudo-users/vyatta-conntrack-timeouts.pl --update 'true'; + then + if [ ${COMMIT_ACTION} = 'DELETE' ] ; + then + sudo /opt/vyatta/bin/sudo-users/vyatta-conntrack-timeouts.pl --delete 'true'; + fi + else + exit 1; + fi + +create: sudo /opt/vyatta/bin/sudo-users/vyatta-conntrack-timeouts.pl --create 'true' + diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.def index c31dfbd..077603e 100644 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.def @@ -4,6 +4,6 @@ type: u32 help: Rule number (1-9999) -syntax:expression: $VAR(@) > 0 && $VAR(@) <= 9999; "firewall rule number must be between 1 and 9999" +syntax:expression: $VAR(@) > 0 && $VAR(@) <= 9999; "Custom timeout rule number must be between 1 and 9999" val_help: u32:1-9999; Rule number -- cgit v1.2.3 From a78433c8796593aad8e18be6216ea007d08dcaff Mon Sep 17 00:00:00 2001 From: Gaurav Sinha Date: Tue, 14 Feb 2012 15:23:28 -0800 Subject: timeouts script, and new nodes (cherry picked from commit e49e60bca2262760575b2a4b488e6acfe1dc0cb6) --- scripts/vyatta-conntrack-timeouts.pl | 34 ++++++++++++++++++++++ .../custom/rule/node.tag/protocol/icmp/node.def | 10 +++++++ .../timeout/custom/rule/node.tag/protocol/node.def | 22 +------------- .../custom/rule/node.tag/protocol/other/node.def | 10 +++++++ .../rule/node.tag/protocol/tcp/close-wait/node.def | 13 +++++++++ .../rule/node.tag/protocol/tcp/close/node.def | 13 +++++++++ .../node.tag/protocol/tcp/established/node.def | 13 +++++++++ .../rule/node.tag/protocol/tcp/fin-wait/node.def | 13 +++++++++ .../rule/node.tag/protocol/tcp/last-ack/node.def | 13 +++++++++ .../custom/rule/node.tag/protocol/tcp/node.def | 1 + .../rule/node.tag/protocol/tcp/syn-recv/node.def | 13 +++++++++ .../rule/node.tag/protocol/tcp/syn-sent/node.def | 13 +++++++++ .../rule/node.tag/protocol/tcp/time-wait/node.def | 13 +++++++++ .../custom/rule/node.tag/protocol/udp/node.def | 1 + .../rule/node.tag/protocol/udp/other/node.def | 10 +++++++ .../rule/node.tag/protocol/udp/stream/node.def | 10 +++++++ 16 files changed, 181 insertions(+), 21 deletions(-) create mode 100644 scripts/vyatta-conntrack-timeouts.pl create mode 100644 templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/icmp/node.def create mode 100644 templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/other/node.def create mode 100644 templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/close-wait/node.def create mode 100644 templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/close/node.def create mode 100644 templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/established/node.def create mode 100644 templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/fin-wait/node.def create mode 100644 templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/last-ack/node.def create mode 100644 templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/node.def create mode 100644 templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/syn-recv/node.def create mode 100644 templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/syn-sent/node.def create mode 100644 templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/time-wait/node.def create mode 100644 templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/udp/node.def create mode 100644 templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/udp/other/node.def create mode 100644 templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/udp/stream/node.def diff --git a/scripts/vyatta-conntrack-timeouts.pl b/scripts/vyatta-conntrack-timeouts.pl new file mode 100644 index 0000000..7725a3b --- /dev/null +++ b/scripts/vyatta-conntrack-timeouts.pl @@ -0,0 +1,34 @@ +#!/usr/bin/perl + +use lib "/opt/vyatta/share/perl5"; +use warnings; +use strict; + +use Vyatta::Config; +use Vyatta::IpTables::Rule; +use Vyatta::IpTables::AddressFilter; +use Vyatta::IpTables::Mgr; +use Getopt::Long; +use Vyatta::Zone; +use Sys::Syslog qw(:standard :macros); + +my ($create, $delete, $update); + +GetOptions("create=s" => \$create, + "delete=s" => \$delete, + "update=s" => \$update, +); + +if ($create and ($create eq 'true')) { + print "create\n"; + # create a nfct-timeout policy based on protocol specific timers + # check if the rule has protocol configured + # if configured, check what the protocol is and get the appropriate timers. +} + +if ($delete and ($delete eq 'true')) { + print "delete"; +} +if ($update and ($update eq 'true')) { + print "update"; +} diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/icmp/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/icmp/node.def new file mode 100644 index 0000000..2997e58 --- /dev/null +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/icmp/node.def @@ -0,0 +1,10 @@ +type: u32 + +help: ICMP timeout in seconds + +default: 30 + +val_help: u32:1-21474836; ICMP timeout in seconds + +syntax:expression: ($VAR(@) >= 1 && $VAR(@) <= 21474836) ; "Value must be between 1 and 21474836" + diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/node.def index 1f235f7..6fffc43 100644 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/node.def @@ -1,22 +1,2 @@ -type: txt +help: Customize protocol specific timers -help: Protocol to match (protocol name in /etc/protocols or protocol number or "all") - -val_help: txt; IP protocol name from /etc/protocols (e.g. "tcp" or "udp") -val_help: u32:0-255; IP protocol number -val_help: tcp_udp; Both TCP and UDP -val_help: all; All IP protocols -val_help: !; All IP protocols except for the specified name or number - -syntax:expression: exec "if [ -n \"`/opt/vyatta/sbin/vyatta-validate-type.pl protocol_negate '$VAR(@)'`\" ] \ - && [ \"$VAR(@)\" != 'tcp_udp' ]; then \ - echo invalid protocol \"$VAR(@)\" ; \ - exit 1 ; \ - fi ; " - -# Provide some help for command completion. Doesn't return negated -# values or protocol numbers -allowed: - protos=`cat /etc/protocols | sed -e '/^#.*/d' | awk '{ print $1 }' | grep -v 'v6'` - protos="all $protos tcp_udp" - echo -n $protos diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/other/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/other/node.def new file mode 100644 index 0000000..5653056 --- /dev/null +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/other/node.def @@ -0,0 +1,10 @@ +type: u32 + +help: Generic connection timeout in seconds + +default: 600 + +val_help: u32:1-21474836; Generic connection timeout in seconds + +syntax:expression: ($VAR(@) >= 1 && $VAR(@) <= 21474836) ; "Value must be between 1 and 21474836" + diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/close-wait/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/close-wait/node.def new file mode 100644 index 0000000..0491b68 --- /dev/null +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/close-wait/node.def @@ -0,0 +1,13 @@ +type: u32 + +help: TCP CLOSE-WAIT timeout in seconds + +default: 60 + +val_help: u32:1-21474836; TCP CLOSE-WAIT timeout in seconds + +syntax:expression: ($VAR(@) >= 1 && $VAR(@) <= 21474836) ; "Value must be between 1 and 21474836" + +update: sudo sysctl -q -w net/netfilter/nf_conntrack_tcp_timeout_close_wait=$VAR(@) + +delete: sudo sysctl -q -w net/netfilter/nf_conntrack_tcp_timeout_close_wait=60 diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/close/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/close/node.def new file mode 100644 index 0000000..38317d5 --- /dev/null +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/close/node.def @@ -0,0 +1,13 @@ +type: u32 + +help: TCP CLOSE timeout in seconds + +default: 10 + +val_help: u32:1-21474836; TCP CLOSE timeout in seconds + +syntax:expression: ($VAR(@) >= 1 && $VAR(@) <= 21474836) ; "Value must be between 1 and 21474836" + +update: sudo sysctl -q -w net/netfilter/nf_conntrack_tcp_timeout_close=$VAR(@) + +delete: sudo sysctl -q -w net/netfilter/nf_conntrack_tcp_timeout_close=10 diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/established/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/established/node.def new file mode 100644 index 0000000..9e47f1e --- /dev/null +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/established/node.def @@ -0,0 +1,13 @@ +type: u32 + +help: TCP ESTABLISHED timeout in seconds + +default: 432000 + +val_help: u32:1-21474836; TCP ESTABLISHED timeout in seconds + +syntax:expression: ($VAR(@) >= 1 && $VAR(@) <= 21474836) ; "Value must be between 1 and 21474836" + +update: sudo sysctl -q -w net/netfilter/nf_conntrack_tcp_timeout_established=$VAR(@) + +delete: sudo sysctl -q -w net/netfilter/nf_conntrack_tcp_timeout_established=432000 diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/fin-wait/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/fin-wait/node.def new file mode 100644 index 0000000..985a6a4 --- /dev/null +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/fin-wait/node.def @@ -0,0 +1,13 @@ +type: u32 + +help: TCP FIN-WAIT timeout in seconds + +default: 120 + +val_help: u32:1-21474836; TCP FIN-WAIT timeout in seconds + +syntax:expression: ($VAR(@) >= 1 && $VAR(@) <= 21474836) ; "Value must be between 1 and 21474836" + +update: sudo sysctl -q -w net/netfilter/nf_conntrack_tcp_timeout_fin_wait=$VAR(@) + +delete: sudo sysctl -q -w net/netfilter/nf_conntrack_tcp_timeout_fin_wait=120 diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/last-ack/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/last-ack/node.def new file mode 100644 index 0000000..3e07fe4 --- /dev/null +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/last-ack/node.def @@ -0,0 +1,13 @@ +type: u32 + +help: TCP LAST-ACK timeout in seconds + +default: 30 + +val_help: u32:1-21474836; TCP LAST-ACK timeout in seconds + +syntax:expression: ($VAR(@) >= 1 && $VAR(@) <= 21474836) ; "Value must be between 1 and 21474836" + +update: sudo sysctl -q -w net/netfilter/nf_conntrack_tcp_timeout_last_ack=$VAR(@) + +delete: sudo sysctl -q -w net/netfilter/nf_conntrack_tcp_timeout_last_ack=30 diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/node.def new file mode 100644 index 0000000..2b67c51 --- /dev/null +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/node.def @@ -0,0 +1 @@ +help: TCP connection timeout options \ No newline at end of file diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/syn-recv/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/syn-recv/node.def new file mode 100644 index 0000000..50c5512 --- /dev/null +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/syn-recv/node.def @@ -0,0 +1,13 @@ +type: u32 + +help: TCP SYN-RECEIVED timeout in seconds + +default: 60 + +val_help: u32:1-21474836; TCP SYN-RECEIVED timeout in seconds + +syntax:expression: ($VAR(@) >= 1 && $VAR(@) <= 21474836) ; "Value must be between 1 and 21474836" + +update: sudo sysctl -q -w net/netfilter/nf_conntrack_tcp_timeout_syn_recv=$VAR(@) + +delete: sudo sysctl -q -w net/netfilter/nf_conntrack_tcp_timeout_syn_recv=60 diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/syn-sent/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/syn-sent/node.def new file mode 100644 index 0000000..5856ba7 --- /dev/null +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/syn-sent/node.def @@ -0,0 +1,13 @@ +type: u32 + +help: TCP SYN-SENT timeout in seconds + +default: 120 + +val_help: u32:1-21474836; TCP SYN-SENT timeout in seconds + +syntax:expression: ($VAR(@) >= 1 && $VAR(@) <= 21474836) ; "Value must be between 1 and 21474836" + +update: sudo sysctl -q -w net/netfilter/nf_conntrack_tcp_timeout_syn_sent=$VAR(@) + +delete: sudo sysctl -q -w net/netfilter/nf_conntrack_tcp_timeout_syn_sent=120 diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/time-wait/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/time-wait/node.def new file mode 100644 index 0000000..f6bd1c8 --- /dev/null +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/time-wait/node.def @@ -0,0 +1,13 @@ +type: u32 + +help: TCP TIME-WAIT timeout in seconds + +default: 120 + +val_help: u32:1-21474836; TCP TIME-WAIT timeout in seconds + +syntax:expression: ($VAR(@) >= 1 && $VAR(@) <= 21474836) ; "Value must be between 1 and 21474836" + +update: sudo sysctl -q -w net/netfilter/nf_conntrack_tcp_timeout_time_wait=$VAR(@) + +delete: sudo sysctl -q -w net/netfilter/nf_conntrack_tcp_timeout_time_wait=120 diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/udp/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/udp/node.def new file mode 100644 index 0000000..7ee8fd3 --- /dev/null +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/udp/node.def @@ -0,0 +1 @@ +help: UDP timeout \ No newline at end of file diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/udp/other/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/udp/other/node.def new file mode 100644 index 0000000..c0c1824 --- /dev/null +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/udp/other/node.def @@ -0,0 +1,10 @@ +type: u32 + +help: UDP generic timeout in seconds + +default: 30 + +val_help: u32:1-21474836; UDP generic timeout in seconds + +syntax:expression: ($VAR(@) >= 1 && $VAR(@) <= 21474836) ; "Value must be between 1 and 21474836" + diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/udp/stream/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/udp/stream/node.def new file mode 100644 index 0000000..0670477 --- /dev/null +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/udp/stream/node.def @@ -0,0 +1,10 @@ +type: u32 + +help: UDP stream timeout in seconds + +default: 180 + +val_help: u32:1-21474836; UDP stream timeout in seconds + +syntax:expression: ($VAR(@) >= 1 && $VAR(@) <= 21474836) ; "Value must be between 1 and 21474836" + -- cgit v1.2.3 From f0118dc081cfa4e4efd9cbfe6f008cd322539b10 Mon Sep 17 00:00:00 2001 From: Gaurav Date: Wed, 15 Feb 2012 16:57:34 -0800 Subject: timeout script, similar to firewall one, with a few differences. (cherry picked from commit 23a5a4ee111ab1519be62841bf03d555a674b371) --- scripts/vyatta-conntrack-timeouts.pl | 25 +++++++++++++++---------- 1 file changed, 15 insertions(+), 10 deletions(-) diff --git a/scripts/vyatta-conntrack-timeouts.pl b/scripts/vyatta-conntrack-timeouts.pl index 7725a3b..09d24ce 100644 --- a/scripts/vyatta-conntrack-timeouts.pl +++ b/scripts/vyatta-conntrack-timeouts.pl @@ -12,6 +12,10 @@ use Getopt::Long; use Vyatta::Zone; use Sys::Syslog qw(:standard :macros); +#for future use when v6 timeouts need to be set +my %cmd_hash = ( 'ipv4' => 'iptables', + 'ipv6' => 'ip6tables'); + my ($create, $delete, $update); GetOptions("create=s" => \$create, @@ -19,16 +23,17 @@ GetOptions("create=s" => \$create, "update=s" => \$update, ); -if ($create and ($create eq 'true')) { - print "create\n"; - # create a nfct-timeout policy based on protocol specific timers - # check if the rule has protocol configured - # if configured, check what the protocol is and get the appropriate timers. +if (($create eq 'true') or ($update eq 'true')) { + update_config(); } -if ($delete and ($delete eq 'true')) { - print "delete"; -} -if ($update and ($update eq 'true')) { - print "update"; +sub update_config { + my $config = new Vyatta::Config; + my %rules = (); #hash of timeout config rules + my $iptables_cmd = $cmd_hash{'ipv4'}; + + $config->setLevel("system conntrack timeout custom rule"); + %rules = $config->listNodeStatus(); + print %rules; } + -- cgit v1.2.3 From 4c2e2d79f28734c97a0e374ca217e24ff954fe96 Mon Sep 17 00:00:00 2001 From: Gaurav Date: Thu, 16 Feb 2012 15:03:55 -0800 Subject: Adding rule and address setup/parsing libraries (cherry picked from commit 2f59f3ef67d70981ff0501868d5ea206eb9359ae) --- Makefile.am | 2 + lib/Vyatta/Conntrack/AddressFilterCT.pm | 204 +++++++++++++++ lib/Vyatta/Conntrack/RuleCT.pm | 431 ++++++++++++++++++++++++++++++++ scripts/vyatta-conntrack-timeouts.pl | 19 +- 4 files changed, 650 insertions(+), 6 deletions(-) create mode 100644 lib/Vyatta/Conntrack/AddressFilterCT.pm create mode 100644 lib/Vyatta/Conntrack/RuleCT.pm diff --git a/Makefile.am b/Makefile.am index 1e53937..0080498 100644 --- a/Makefile.am +++ b/Makefile.am @@ -16,6 +16,8 @@ checkparamsonreboot_SCRIPTS += scripts/check-params-on-reboot.d/conntrack-hash-s share_perl5_DATA = lib/Vyatta/Conntrack/Config.pm share_perl5_DATA += lib/Vyatta/Conntrack/ConntrackUtil.pm +share_perl5_DATA += lib/Vyatta/Conntrack/RuleCT.pm +share_perl5_DATA += lib/Vyatta/Conntrack/AddressFilterCT.pm sbin_SCRIPTS = scripts/vyatta-update-conntrack-log.pl bin_sudo_usersdir = $(bindir)/sudo-users diff --git a/lib/Vyatta/Conntrack/AddressFilterCT.pm b/lib/Vyatta/Conntrack/AddressFilterCT.pm new file mode 100644 index 0000000..c7dac8d --- /dev/null +++ b/lib/Vyatta/Conntrack/AddressFilterCT.pm @@ -0,0 +1,204 @@ +# Author: Vyatta +# Date: 2007 +# Description: IP tables address filter +# +# Gaurav Sinha: Re-using AddressFilter.pm from vyatta-cfg-firewall package. +# + +# **** License **** +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License version 2 as +# published by the Free Software Foundation. +# +# This program is distributed in the hope that it will be useful, but +# WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +# General Public License for more details. +# +# This code was originally developed by Vyatta, Inc. +# Portions created by Vyatta are Copyright (C) 2006-2009 Vyatta, Inc. +# All Rights Reserved. +# **** End License **** + +package Vyatta::Conntrack::AddressFilterCT; + +require Vyatta::Config; +require Vyatta::IpTables::IpSet; +use Vyatta::Misc qw(getPortRuleString); +use Vyatta::TypeChecker; + +use strict; +use warnings; + +my %_protocolswithports = ( + tcp_udp => 1, + # 'tcp_udp' is to be allowed for nat and firewall rules only. + # features should have syntax checks for allowing or forbiding + # the use of 'tcp_udp' as protocol. to allow tcp_udp see syntax check + # in protocol/node.def for NAT rules and to forbid tcp_udp see syntax + # check in protocol/node.def for load-balancing rules + # when allowed : tcp_udp creates 2 iptable rules - one for tcp, other for udp + tcp => 1, + udp => 1, + 6 => 1, + 17 => 1, +); + +my %fields = ( + _srcdst => undef, + _range_start => undef, + _range_stop => undef, + _network => undef, + _address => undef, + _port => undef, + _protocol => undef, + _port_group => undef, +); + +sub new { + my $that = shift; + my $class = ref ($that) || $that; + my $self = { + %fields, + }; + + bless $self, $class; + return $self; +} + +sub setup_base { + my ($self, $level, $func) = @_; + my $config = new Vyatta::Config; + + $config->setLevel("$level"); + + # setup needed parent nodes + $self->{_srcdst} = $config->returnParent(".."); +# $self->{_protocol} = $config->$func(".. protocol"); + + # setup address filter nodes + $self->{_address} = $config->$func("address"); + $self->{_network} = undef; + $self->{_range_start} = undef; + $self->{_range_stop} = undef; + if (defined($self->{_address})) { + if ($self->{_address} =~ /\//) { + $self->{_network} = $self->{_address}; + $self->{_address} = undef; + } elsif ($self->{_address} =~ /^([^-]+)-([^-]+)$/) { + $self->{_range_start} = $1; + $self->{_range_stop} = $2; + $self->{_address} = undef; + } + } + $self->{_port} = $config->$func("port"); + + return 0; +} + +sub setup { + my ($self, $level) = @_; + + $self->setup_base($level, 'returnValue'); + return 0; +} + +sub setupOrig { + my ($self, $level) = @_; + + $self->setup_base($level, 'returnOrigValue'); + return 0; +} + +sub print { + my ($self) = @_; + + print "srcdst: $self->{_srcdst}\n" if defined $self->{_srcdst}; + print "range start: $self->{_range_start}\n" if defined $self->{_range_start}; + print "range stop: $self->{_range_stop}\n" if defined $self->{_range_stop}; + print "network: $self->{_network}\n" if defined $self->{_network}; + print "address: $self->{_address}\n" if defined $self->{_address}; + print "port: $self->{_port}\n" if defined $self->{_port}; + print "protocol: $self->{_protocol}\n" if defined $self->{_protocol}; + + return 0; +} + +sub rule { + my ($self) = @_; + my $rule = ""; + my $can_use_port = 1; + + my $addr_checker; + my $prefix_checker; + my $pure_addr_checker; + my $ip_term; + my $prefix_term; + + $addr_checker = 'ipv4_negate'; + $prefix_checker = 'ipv4net_negate'; + $pure_addr_checker = 'ipv4'; + $ip_term = "IPv4"; + $prefix_term = "subnet"; + + if (!defined($self->{_protocol}) + || !defined($_protocolswithports{$self->{_protocol}})) { + $can_use_port = 0; + } + + # set the address filter parameters + if (defined($self->{_network})) { + my $str = $self->{_network}; + return (undef, "\"$str\" is not a valid $ip_term $prefix_term") + if (!Vyatta::TypeChecker::validateType($prefix_checker, $str, 1)); + my $negate = ''; + if ($str =~ /^\!(.*)$/) { + $str = $1; + $negate = '! '; + } + $rule .= "$negate --$self->{_srcdst} $str "; + } elsif (defined($self->{_address})) { + my $str = $self->{_address}; + return (undef, "\"$str\" is not a valid $ip_term address") + if (!Vyatta::TypeChecker::validateType($addr_checker, $str, 1)); + my $negate = ''; + if ($str =~ /^\!(.*)$/) { + $str = $1; + $negate = '! '; + } + $rule .= "$negate --$self->{_srcdst} $str "; + } elsif ((defined $self->{_range_start}) && (defined $self->{_range_stop})) { + my $start = $self->{_range_start}; + my $stop = $self->{_range_stop}; + return (undef, "\"$start-$stop\" is not a valid IP range") + if (!Vyatta::TypeChecker::validateType($addr_checker, $start, 1) + || !Vyatta::TypeChecker::validateType($pure_addr_checker, $stop, 1)); + my $negate = ''; + if ($self->{_range_start} =~ /^!(.*)$/) { + $start = $1; + $negate = '! '; + } + if ("$self->{_srcdst}" eq "source") { + $rule .= ("-m iprange $negate --src-range $start-$self->{_range_stop} "); + } + elsif ("$self->{_srcdst}" eq "destination") { + $rule .= ("-m iprange $negate --dst-range $start-$self->{_range_stop} "); + } + } + + my ($port_str, $port_err) + = getPortRuleString($self->{_port}, $can_use_port, + ($self->{_srcdst} eq "source") ? "s" : "d", + $self->{_protocol}); + return (undef, $port_err) if (!defined($port_str)); + $rule .= $port_str; + + return ($rule, undef); +} +1; + +# Local Variables: +# mode: perl +# indent-tabs-mode: nil +# perl-indent-level: 2 +# End: diff --git a/lib/Vyatta/Conntrack/RuleCT.pm b/lib/Vyatta/Conntrack/RuleCT.pm new file mode 100644 index 0000000..9329603 --- /dev/null +++ b/lib/Vyatta/Conntrack/RuleCT.pm @@ -0,0 +1,431 @@ +package Vyatta::Conntrack::RuleCT; + +use strict; +use Vyatta::Config; +require Vyatta::Conntrack::AddressFilterCT; + +my $src = new Vyatta::Conntrack::AddressFilterCT; +my $dst = new Vyatta::Conntrack::AddressFilterCT; + +my %fields = ( + _rule_number => undef, + _protocol => undef, + _state => { + _established => undef, + _new => undef, + _related => undef, + _invalid => undef, + }, +); + +my %dummy_rule = ( + _rule_number => 10000, + _protocol => "all", + _state => { + _established => undef, + _new => undef, + _related => undef, + _invalid => undef, + }, +); + +my $DEBUG = 'false'; + +sub new { + my $that = shift; + my $class = ref ($that) || $that; + my $self = { + %fields, + }; + + bless $self, $class; + return $self; +} + +sub setupDummy { + my ($self, $level) = @_; + + %{$self} = %dummy_rule; + $src = new Vyatta::Conntrack::AddressFilterCT; + $dst = new Vyatta::Conntrack::AddressFilterCT; + + # set the default policy + my $config = new Vyatta::Config; + $config->setLevel("$level"); +} + +sub setup_base { + my ($self, $level, $val_func, $exists_func, $addr_setup) = @_; + my $config = new Vyatta::Config; + + $config->setLevel("$level"); + + $self->{_rule_number} = $config->returnParent(".."); + $self->{_protocol} = $config->$val_func("protocol"); + $self->{_state}->{_established} = $config->$val_func("state established"); + $self->{_state}->{_new} = $config->$val_func("state new"); + $self->{_state}->{_related} = $config->$val_func("state related"); + $self->{_state}->{_invalid} = $config->$val_func("state invalid"); + + $src->$addr_setup("$level source"); + $dst->$addr_setup("$level destination"); + + return 0; +} + +sub setup { + my ($self, $level) = @_; + + $self->setup_base($level, 'returnValue', 'exists', 'setup'); + return 0; +} + +sub setupOrig { + my ($self, $level) = @_; + $self->setup_base($level, 'returnOrigValue', 'existsOrig', 'setupOrig'); + return 0; +} + +sub print { + my ( $self ) = @_; + + print "rulenum: $self->{_rule_number}\n" if defined $self->{_rule_number}; + print "protocol: $self->{_protocol}\n" if defined $self->{_protocol}; + print "state: $self->{_state}\n" if defined $self->{_state}; + $src->print(); + $dst->print(); + +} + +sub rule { + my ( $self ) = @_; + my ($rule, $srcrule, $dstrule, $err_str); + my $tcp_and_udp = 0; + + # set CLI rule num as comment + my @level_nodes = split (' ', $self->{_comment}); + $rule .= "-m comment --comment \"$level_nodes[2]-$level_nodes[4]\" "; + + # set the protocol + if (defined($self->{_protocol})) { + my $str = $self->{_protocol}; + my $negate = ''; + if ($str =~ /^\!(.*)$/) { + $str = $1; + $negate = '! '; + } + if ($str eq 'tcp_udp') { + $tcp_and_udp = 1; + $rule .= " $negate -p tcp "; # we'll add the '-p udp' to 2nd rule later + } else { + $rule .= " $negate -p $str "; + } + } + + my $state_str = uc (get_state_str($self)); + if ($state_str ne "") { + $rule .= "-m state --state $state_str "; + } + + # set tcp flags if applicable + my $tcp_flags = undef; + if (defined $self->{_tcp_flags}) { + if (($self->{_protocol} eq "tcp") || ($self->{_protocol} eq "6")) { + $tcp_flags = get_tcp_flags_string($self->{_tcp_flags}); + } else { + return ("TCP flags can only be set if protocol is set to TCP", ); + } + } + if (defined($tcp_flags)) { + $rule .= " -m tcp --tcp-flags $tcp_flags "; + } + + # set the icmp code and type if applicable + if (($self->{_protocol} eq "icmp") || ($self->{_protocol} eq "1")) { + if (defined $self->{_icmp_name}) { + if (defined($self->{_icmp_type}) || defined($self->{_icmp_code})){ + return ("Cannot use ICMP type/code with ICMP type-name", ); + } + $rule .= "--icmp-type $self->{_icmp_name} "; + } elsif (defined $self->{_icmp_type}) { + $rule .= "--icmp-type $self->{_icmp_type}"; + if (defined $self->{_icmp_code}) { + $rule .= "/$self->{_icmp_code}"; + } + $rule .= " "; + } elsif (defined $self->{_icmp_code}) { + return ("ICMP code can only be defined if ICMP type is defined", ); + } + } elsif (defined($self->{_icmp_type}) || defined($self->{_icmp_code}) + || defined($self->{_icmp_name})) { + return ("ICMP type/code or type-name can only be defined if protocol is ICMP", ); + } + + # Setup ICMPv6 rule if configured + # ICMPv6 parameters are only valid if the rule is matching on the + # ICMPv6 protocol ID. + # + if (($self->{_protocol} eq "icmpv6") || + ($self->{_protocol} eq "ipv6-icmp") || + ($self->{_protocol} eq "58")) { + if (defined($self->{_icmpv6_type})) { + $rule .= "-m icmpv6 --icmpv6-type $self->{_icmpv6_type}"; + } + } + + # add the source and destination rules + ($srcrule, $err_str) = $src->rule(); + return ($err_str, ) if (!defined($srcrule)); + ($dstrule, $err_str) = $dst->rule(); + return ($err_str, ) if (!defined($dstrule)); + if ((grep /multiport/, $srcrule) ^ (grep /multiport/, $dstrule)) { + if ((grep /sport/, $srcrule) && (grep /dport/, $dstrule)) { + return ('Cannot specify multiple ports when both ' + . 'source and destination ports are specified', ); + } + } + $rule .= " $srcrule $dstrule "; + + return ('Cannot specify both "match-frag" and "match-non-frag"', ) + if (defined($self->{_frag}) && defined($self->{_non_frag})); + if (defined($self->{_frag})) { + $rule .= ' -f '; + } elsif (defined($self->{_non_frag})) { + $rule .= ' ! -f '; + } + + # note: "out" is not valid in the INPUT chain. + return ('Cannot specify both "match-ipsec" and "match-none"', ) + if (defined($self->{_ipsec}) && defined($self->{_non_ipsec})); + if (defined($self->{_ipsec})) { + $rule .= ' -m policy --pol ipsec --dir in '; + } elsif (defined($self->{_non_ipsec})) { + $rule .= ' -m policy --pol none --dir in '; + } + + my $p2p = undef; + if (defined($self->{_p2p}->{_all})) { + $p2p = '--apple --bit --dc --edk --gnu --kazaa '; + } else { + my @apps = qw(apple bit dc edk gnu kazaa); + foreach (@apps) { + if (defined($self->{_p2p}->{"_$_"})) { + $p2p .= "--$_ "; + } + } + } + if (defined($p2p)) { + $rule .= " -m ipp2p $p2p "; + } + + my $time = undef; + if (defined($self->{_time}->{_utc})) { + $time .= " --utc "; + } + if (defined($self->{_time}->{_startdate})) { + my $check_date = validate_date($self->{_time}->{_startdate}, "startdate"); + if (!($check_date eq "")) { + return ($check_date, ); + } + $time .= " --datestart $self->{_time}->{_startdate} "; + } + if (defined($self->{_time}->{_stopdate})) { + my $check_date = validate_date($self->{_time}->{_stopdate}, "stopdate"); + if (!($check_date eq "")) { + return ($check_date, ); + } + $time .= " --datestop $self->{_time}->{_stopdate} "; + } + if (defined($self->{_time}->{_starttime})) { + return ("Invalid starttime $self->{_time}->{_starttime}. +Time should use 24 hour notation hh:mm:ss and lie in between 00:00:00 and 23:59:59", ) + if (!validate_timevalues($self->{_time}->{_starttime}, "time")); + $time .= " --timestart $self->{_time}->{_starttime} "; + } + if (defined($self->{_time}->{_stoptime})) { + return ("Invalid stoptime $self->{_time}->{_stoptime}. +Time should use 24 hour notation hh:mm:ss and lie in between 00:00:00 and 23:59:59", ) + if (!validate_timevalues($self->{_time}->{_stoptime}, "time")); + $time .= " --timestop $self->{_time}->{_stoptime} "; + } + if (defined($self->{_time}->{_monthdays})) { + my $negate = " "; + if ($self->{_time}->{_monthdays} =~ m/^!/) { + $negate = "! "; + $self->{_time}->{_monthdays} = substr $self->{_time}->{_monthdays}, 1; + } + return ("Invalid monthdays value $self->{_time}->{_monthdays}. +Monthdays should have values between 1 and 31 with multiple days separated by commas +eg. 2,12,21 For negation, add ! in front eg. !2,12,21", ) + if (!validate_timevalues($self->{_time}->{_monthdays}, "monthdays")); + $time .= " $negate --monthdays $self->{_time}->{_monthdays} "; + } + if (defined($self->{_time}->{_weekdays})) { + my $negate = " "; + if ($self->{_time}->{_weekdays} =~ m/^!/) { + $negate = "! "; + $self->{_time}->{_weekdays} = substr $self->{_time}->{_weekdays}, 1; + } + return ("Invalid weekdays value $self->{_time}->{_weekdays}. +Weekdays should be specified using the first three characters of the day with the +first character capitalized eg. Mon,Thu,Sat For negation, add ! in front eg. !Mon,Thu,Sat", ) + if (!validate_timevalues($self->{_time}->{_weekdays}, "weekdays")); + $time .= " $negate --weekdays $self->{_time}->{_weekdays} "; + } + if (defined($time)) { + $rule .= " -m time $time "; + } + + my $limit = undef; + if (defined $self->{_limit}->{_rate}) { + my $rate_integer = $self->{_limit}->{_rate}; + $rate_integer =~ s/\/(second|minute|hour|day)//; + if ($rate_integer < 1) { + return ("integer value in rate cannot be less than 1", ); + } + $limit = "--limit $self->{_limit}->{_rate} --limit-burst $self->{_limit}->{_burst}"; + } + $rule .= " -m limit $limit " if defined $limit; + + # recent match condition SHOULD BE DONE IN THE LAST so + # all options in $rule are copied to $recent_rule below + my $recent_rule = undef; + if (defined($self->{_recent_time}) || defined($self->{_recent_cnt})) { + my $recent_rule1 = undef; + my $recent_rule2 = undef; + $recent_rule1 .= ' -m recent --update '; + $recent_rule2 .= ' -m recent --set '; + if (defined($self->{_recent_time})) { + $recent_rule1 .= " --seconds $self->{_recent_time} "; + } + if (defined($self->{_recent_cnt})) { + $recent_rule1 .= " --hitcount $self->{_recent_cnt} "; + } + + $recent_rule = $rule; + + if ($rule =~ m/\-m\s+set\s+\-\-match\-set/) { + # firewall group being used in this rule. iptables complains if recent + # match condition is placed after group match conditions [see bug 5744] + # so instead of appending recent match place it before group match + my @split_rules = (); + + @split_rules = split(/(\-m\s+set\s+\-\-match\-set)/, $rule, 2); + $rule = $split_rules[0] . $recent_rule1 . + $split_rules[1] . $split_rules[2]; + + @split_rules = split(/(\-m\s+set\s+\-\-match\-set)/, $recent_rule, 2); + $recent_rule = $split_rules[0] . $recent_rule2 . + $split_rules[1] . $split_rules[2]; + } else { + # append recent match conditions to the two rules needed for recent match + $rule .= $recent_rule1; + $recent_rule .= $recent_rule2; + } + } + + my $chain = $self->{_name}; + my $rule_num = $self->{_rule_number}; + my $rule2 = undef; + # set the jump target. Depends on action and log + if ("$self->{_log}" eq "enable") { + $rule2 = $rule; + my $log_prefix = get_log_prefix($chain, $rule_num, $self->{_action}); + $rule2 .= "-j LOG --log-prefix \"$log_prefix\" "; + } + if ("$self->{_action}" eq "drop") { + $rule .= "-j DROP "; + } elsif ("$self->{_action}" eq "accept") { + $rule .= "-j RETURN "; + } elsif ("$self->{_action}" eq "reject") { + $rule .= "-j REJECT "; + } elsif ("$self->{_action}" eq 'inspect') { + my $target = ipt_get_queue_target('SNORT'); + return ('Undefined target for inspect', ) if ! defined $target; + $rule .= "-j $target "; + } elsif ("$self->{_action}" eq 'modify') { + # mangle actions + my $count = 0; + if (defined($self->{_mod_mark})) { + # MARK + $rule .= "-j MARK --set-mark $self->{_mod_mark} "; + $count++; + } + if (defined($self->{_mod_dscp})) { + # DSCP + $rule .= "-j DSCP --set-dscp $self->{_mod_dscp} "; + $count++; + } + if (defined($self->{_mod_tcpmss})) { + # TCP-MSS + # check for SYN flag + if (!defined $self->{_tcp_flags} || + !(($self->{_tcp_flags} =~ m/SYN/) && !($self->{_tcp_flags} =~ m/!SYN/))) { + return ('need to set TCP SYN flag to modify TCP MSS', ); + } + + if ($self->{_mod_tcpmss} =~ m/\d/) { + $rule .= "-j TCPMSS --set-mss $self->{_mod_tcpmss} "; + } else { + $rule .= "-j TCPMSS --clamp-mss-to-pmtu "; + } + $count++; + } + + # others + + if ($count == 0) { + return ('Action "modify" requires more specific configuration under ' + . 'the "modify" node', ); + } elsif ($count > 1) { + return ('Cannot define more than one modification under ' + . 'the "modify" node', ); + } + } else { + return ("\"action\" must be defined", ); + } + if (defined($rule2)) { + my $tmp = $rule2; + $rule2 = $rule; + $rule = $tmp; + } elsif (defined($recent_rule)) { + $rule2 = $recent_rule; + $recent_rule = undef; + } + + return (undef, undef) if defined $self->{_disable}; + + my ($udp_rule, $udp_rule2, $udp_recent_rule) = (undef, undef, undef); + if ($tcp_and_udp == 1) { + # create udp rules + $udp_rule = $rule; + $udp_rule2 = $rule2 if defined $rule2; + $udp_recent_rule = $recent_rule if defined $recent_rule; + foreach my $each_udprule ($udp_rule, $udp_rule2, $udp_recent_rule) { + $each_udprule =~ s/ \-p tcp / -p udp / if defined $each_udprule; + } + } + + if ($DEBUG eq 'true') { + # print all potential iptables rules that could be formed for + # a single CLI rule. see get_num_ipt_rules to see exact count + print "rule :\n$rule\n" if defined $rule; + print "rule2 :\n$rule2\n" if defined $rule2; + print "recent rule :\n$recent_rule\n" if defined $recent_rule; + print "udp rule :\n$udp_rule\n" if defined $udp_rule; + print "udp rule2 :\n$udp_rule2\n" if defined $udp_rule2; + print "udp recent rule :\n$udp_recent_rule\n" if defined $udp_recent_rule; + } + + return (undef, $rule, $rule2, $recent_rule, $udp_rule, $udp_rule2, $udp_recent_rule); +} + + + +1; + +# Local Variables: +# mode: perl +# indent-tabs-mode: nil +# perl-indent-level: 2 +# End: diff --git a/scripts/vyatta-conntrack-timeouts.pl b/scripts/vyatta-conntrack-timeouts.pl index 09d24ce..7de1a02 100644 --- a/scripts/vyatta-conntrack-timeouts.pl +++ b/scripts/vyatta-conntrack-timeouts.pl @@ -5,9 +5,8 @@ use warnings; use strict; use Vyatta::Config; -use Vyatta::IpTables::Rule; -use Vyatta::IpTables::AddressFilter; -use Vyatta::IpTables::Mgr; +use Vyatta::Conntrack::RuleCT; +use Vyatta::Conntrack::AddressFilterCT; use Getopt::Long; use Vyatta::Zone; use Sys::Syslog qw(:standard :macros); @@ -23,9 +22,7 @@ GetOptions("create=s" => \$create, "update=s" => \$update, ); -if (($create eq 'true') or ($update eq 'true')) { - update_config(); -} +update_config(); sub update_config { my $config = new Vyatta::Config; @@ -35,5 +32,15 @@ sub update_config { $config->setLevel("system conntrack timeout custom rule"); %rules = $config->listNodeStatus(); print %rules; + foreach my $rule (sort keys %rules) { + if ("$rules{$rule}" eq 'static') { + } elsif ("$rules{$rule}" eq 'added') { + my $node = new Vyatta::Conntrack::RuleCT; + $node->setup("system conntrack timeout custom rule $rule"); + $node->print(); + } elsif ("$rules{$rule}" eq 'changed') { + } elsif ("$rules{$rule}" eq 'deleted'){ + } + } } -- cgit v1.2.3 From eda48ea36f8b5602dd68ee8ce99a95f9e00878d2 Mon Sep 17 00:00:00 2001 From: Gaurav Date: Tue, 21 Feb 2012 11:38:46 -0800 Subject: Removing newly added file AddressFilterCT.pm. (cherry picked from commit 0ccdf73e1f7211aed9df214a65f8e953dbfdef42) --- lib/Vyatta/Conntrack/RuleCT.pm | 35 ++++++++++++++++++----------------- scripts/vyatta-conntrack-timeouts.pl | 10 +++++++++- 2 files changed, 27 insertions(+), 18 deletions(-) diff --git a/lib/Vyatta/Conntrack/RuleCT.pm b/lib/Vyatta/Conntrack/RuleCT.pm index 9329603..3a0377b 100644 --- a/lib/Vyatta/Conntrack/RuleCT.pm +++ b/lib/Vyatta/Conntrack/RuleCT.pm @@ -9,23 +9,29 @@ my $dst = new Vyatta::Conntrack::AddressFilterCT; my %fields = ( _rule_number => undef, - _protocol => undef, - _state => { - _established => undef, - _new => undef, - _related => undef, - _invalid => undef, + _protocol => { + _tcp => { + _close => undef, + _close_wait => undef, + _syn_sent => undef, + }, + _udp => undef, + _other => undef, + _icmp => undef , }, ); my %dummy_rule = ( _rule_number => 10000, - _protocol => "all", - _state => { - _established => undef, - _new => undef, - _related => undef, - _invalid => undef, + _protocol => { + _tcp => { + _close => undef, + _close_wait => undef, + _syn_sent => undef, + }, + _udp => undef, + _other => undef, + _icmp => undef , }, ); @@ -62,11 +68,6 @@ sub setup_base { $self->{_rule_number} = $config->returnParent(".."); $self->{_protocol} = $config->$val_func("protocol"); - $self->{_state}->{_established} = $config->$val_func("state established"); - $self->{_state}->{_new} = $config->$val_func("state new"); - $self->{_state}->{_related} = $config->$val_func("state related"); - $self->{_state}->{_invalid} = $config->$val_func("state invalid"); - $src->$addr_setup("$level source"); $dst->$addr_setup("$level destination"); diff --git a/scripts/vyatta-conntrack-timeouts.pl b/scripts/vyatta-conntrack-timeouts.pl index 7de1a02..8ab322d 100644 --- a/scripts/vyatta-conntrack-timeouts.pl +++ b/scripts/vyatta-conntrack-timeouts.pl @@ -39,7 +39,15 @@ sub update_config { $node->setup("system conntrack timeout custom rule $rule"); $node->print(); } elsif ("$rules{$rule}" eq 'changed') { - } elsif ("$rules{$rule}" eq 'deleted'){ + } elsif ("$rules{$rule}" eq 'deleted') { +# my $node = new Vyatta::Conntrack::RuleCT; +# $node->setupOrig("system conntrack timeout custom rule $rule"); +# my $ipt_rules = $node->get_num_ipt_rules(); +# for (1 .. $ipt_rules) { +# print "deleting 1\n"; +# run_cmd("$iptables_cmd -t $table --delete $name $iptablesrule"); +# die "$iptables_cmd error: $! - $rule" if ($? >> 8); +# } } } } -- cgit v1.2.3 From 15bb1ba78ade472e8dea5d1f4dd8f8a15af78a3c Mon Sep 17 00:00:00 2001 From: Gaurav Date: Tue, 21 Feb 2012 11:43:17 -0800 Subject: removing AddressFilterCT.pm (cherry picked from commit 796fc0e8654683733a473f46d3029032bc648f05) --- lib/Vyatta/Conntrack/AddressFilterCT.pm | 204 -------------------------------- 1 file changed, 204 deletions(-) delete mode 100644 lib/Vyatta/Conntrack/AddressFilterCT.pm diff --git a/lib/Vyatta/Conntrack/AddressFilterCT.pm b/lib/Vyatta/Conntrack/AddressFilterCT.pm deleted file mode 100644 index c7dac8d..0000000 --- a/lib/Vyatta/Conntrack/AddressFilterCT.pm +++ /dev/null @@ -1,204 +0,0 @@ -# Author: Vyatta -# Date: 2007 -# Description: IP tables address filter -# -# Gaurav Sinha: Re-using AddressFilter.pm from vyatta-cfg-firewall package. -# - -# **** License **** -# This program is free software; you can redistribute it and/or modify -# it under the terms of the GNU General Public License version 2 as -# published by the Free Software Foundation. -# -# This program is distributed in the hope that it will be useful, but -# WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -# General Public License for more details. -# -# This code was originally developed by Vyatta, Inc. -# Portions created by Vyatta are Copyright (C) 2006-2009 Vyatta, Inc. -# All Rights Reserved. -# **** End License **** - -package Vyatta::Conntrack::AddressFilterCT; - -require Vyatta::Config; -require Vyatta::IpTables::IpSet; -use Vyatta::Misc qw(getPortRuleString); -use Vyatta::TypeChecker; - -use strict; -use warnings; - -my %_protocolswithports = ( - tcp_udp => 1, - # 'tcp_udp' is to be allowed for nat and firewall rules only. - # features should have syntax checks for allowing or forbiding - # the use of 'tcp_udp' as protocol. to allow tcp_udp see syntax check - # in protocol/node.def for NAT rules and to forbid tcp_udp see syntax - # check in protocol/node.def for load-balancing rules - # when allowed : tcp_udp creates 2 iptable rules - one for tcp, other for udp - tcp => 1, - udp => 1, - 6 => 1, - 17 => 1, -); - -my %fields = ( - _srcdst => undef, - _range_start => undef, - _range_stop => undef, - _network => undef, - _address => undef, - _port => undef, - _protocol => undef, - _port_group => undef, -); - -sub new { - my $that = shift; - my $class = ref ($that) || $that; - my $self = { - %fields, - }; - - bless $self, $class; - return $self; -} - -sub setup_base { - my ($self, $level, $func) = @_; - my $config = new Vyatta::Config; - - $config->setLevel("$level"); - - # setup needed parent nodes - $self->{_srcdst} = $config->returnParent(".."); -# $self->{_protocol} = $config->$func(".. protocol"); - - # setup address filter nodes - $self->{_address} = $config->$func("address"); - $self->{_network} = undef; - $self->{_range_start} = undef; - $self->{_range_stop} = undef; - if (defined($self->{_address})) { - if ($self->{_address} =~ /\//) { - $self->{_network} = $self->{_address}; - $self->{_address} = undef; - } elsif ($self->{_address} =~ /^([^-]+)-([^-]+)$/) { - $self->{_range_start} = $1; - $self->{_range_stop} = $2; - $self->{_address} = undef; - } - } - $self->{_port} = $config->$func("port"); - - return 0; -} - -sub setup { - my ($self, $level) = @_; - - $self->setup_base($level, 'returnValue'); - return 0; -} - -sub setupOrig { - my ($self, $level) = @_; - - $self->setup_base($level, 'returnOrigValue'); - return 0; -} - -sub print { - my ($self) = @_; - - print "srcdst: $self->{_srcdst}\n" if defined $self->{_srcdst}; - print "range start: $self->{_range_start}\n" if defined $self->{_range_start}; - print "range stop: $self->{_range_stop}\n" if defined $self->{_range_stop}; - print "network: $self->{_network}\n" if defined $self->{_network}; - print "address: $self->{_address}\n" if defined $self->{_address}; - print "port: $self->{_port}\n" if defined $self->{_port}; - print "protocol: $self->{_protocol}\n" if defined $self->{_protocol}; - - return 0; -} - -sub rule { - my ($self) = @_; - my $rule = ""; - my $can_use_port = 1; - - my $addr_checker; - my $prefix_checker; - my $pure_addr_checker; - my $ip_term; - my $prefix_term; - - $addr_checker = 'ipv4_negate'; - $prefix_checker = 'ipv4net_negate'; - $pure_addr_checker = 'ipv4'; - $ip_term = "IPv4"; - $prefix_term = "subnet"; - - if (!defined($self->{_protocol}) - || !defined($_protocolswithports{$self->{_protocol}})) { - $can_use_port = 0; - } - - # set the address filter parameters - if (defined($self->{_network})) { - my $str = $self->{_network}; - return (undef, "\"$str\" is not a valid $ip_term $prefix_term") - if (!Vyatta::TypeChecker::validateType($prefix_checker, $str, 1)); - my $negate = ''; - if ($str =~ /^\!(.*)$/) { - $str = $1; - $negate = '! '; - } - $rule .= "$negate --$self->{_srcdst} $str "; - } elsif (defined($self->{_address})) { - my $str = $self->{_address}; - return (undef, "\"$str\" is not a valid $ip_term address") - if (!Vyatta::TypeChecker::validateType($addr_checker, $str, 1)); - my $negate = ''; - if ($str =~ /^\!(.*)$/) { - $str = $1; - $negate = '! '; - } - $rule .= "$negate --$self->{_srcdst} $str "; - } elsif ((defined $self->{_range_start}) && (defined $self->{_range_stop})) { - my $start = $self->{_range_start}; - my $stop = $self->{_range_stop}; - return (undef, "\"$start-$stop\" is not a valid IP range") - if (!Vyatta::TypeChecker::validateType($addr_checker, $start, 1) - || !Vyatta::TypeChecker::validateType($pure_addr_checker, $stop, 1)); - my $negate = ''; - if ($self->{_range_start} =~ /^!(.*)$/) { - $start = $1; - $negate = '! '; - } - if ("$self->{_srcdst}" eq "source") { - $rule .= ("-m iprange $negate --src-range $start-$self->{_range_stop} "); - } - elsif ("$self->{_srcdst}" eq "destination") { - $rule .= ("-m iprange $negate --dst-range $start-$self->{_range_stop} "); - } - } - - my ($port_str, $port_err) - = getPortRuleString($self->{_port}, $can_use_port, - ($self->{_srcdst} eq "source") ? "s" : "d", - $self->{_protocol}); - return (undef, $port_err) if (!defined($port_str)); - $rule .= $port_str; - - return ($rule, undef); -} -1; - -# Local Variables: -# mode: perl -# indent-tabs-mode: nil -# perl-indent-level: 2 -# End: -- cgit v1.2.3 From 0f242d1a1fa363b19229b886622ef9ca3a4f50b5 Mon Sep 17 00:00:00 2001 From: Gaurav Date: Tue, 21 Feb 2012 13:46:20 -0800 Subject: modified to use AddressFilter from IpTables (cherry picked from commit 1392750b600cec991e24e7ab0cc211c621e4430a) --- Makefile.am | 1 - lib/Vyatta/Conntrack/RuleCT.pm | 10 +++++----- scripts/vyatta-conntrack-timeouts.pl | 2 +- 3 files changed, 6 insertions(+), 7 deletions(-) diff --git a/Makefile.am b/Makefile.am index 0080498..39a08b2 100644 --- a/Makefile.am +++ b/Makefile.am @@ -17,7 +17,6 @@ checkparamsonreboot_SCRIPTS += scripts/check-params-on-reboot.d/conntrack-hash-s share_perl5_DATA = lib/Vyatta/Conntrack/Config.pm share_perl5_DATA += lib/Vyatta/Conntrack/ConntrackUtil.pm share_perl5_DATA += lib/Vyatta/Conntrack/RuleCT.pm -share_perl5_DATA += lib/Vyatta/Conntrack/AddressFilterCT.pm sbin_SCRIPTS = scripts/vyatta-update-conntrack-log.pl bin_sudo_usersdir = $(bindir)/sudo-users diff --git a/lib/Vyatta/Conntrack/RuleCT.pm b/lib/Vyatta/Conntrack/RuleCT.pm index 3a0377b..e407f42 100644 --- a/lib/Vyatta/Conntrack/RuleCT.pm +++ b/lib/Vyatta/Conntrack/RuleCT.pm @@ -2,10 +2,10 @@ package Vyatta::Conntrack::RuleCT; use strict; use Vyatta::Config; -require Vyatta::Conntrack::AddressFilterCT; +require Vyatta::IpTables::AddressFilter; -my $src = new Vyatta::Conntrack::AddressFilterCT; -my $dst = new Vyatta::Conntrack::AddressFilterCT; +my $src = new Vyatta::IpTables::AddressFilter; +my $dst = new Vyatta::IpTables::AddressFilter; my %fields = ( _rule_number => undef, @@ -52,8 +52,8 @@ sub setupDummy { my ($self, $level) = @_; %{$self} = %dummy_rule; - $src = new Vyatta::Conntrack::AddressFilterCT; - $dst = new Vyatta::Conntrack::AddressFilterCT; + $src = new Vyatta::IpTables::AddressFilter; + $dst = new Vyatta::IpTables::AddressFilter; # set the default policy my $config = new Vyatta::Config; diff --git a/scripts/vyatta-conntrack-timeouts.pl b/scripts/vyatta-conntrack-timeouts.pl index 8ab322d..7395b06 100644 --- a/scripts/vyatta-conntrack-timeouts.pl +++ b/scripts/vyatta-conntrack-timeouts.pl @@ -6,7 +6,7 @@ use strict; use Vyatta::Config; use Vyatta::Conntrack::RuleCT; -use Vyatta::Conntrack::AddressFilterCT; +use Vyatta::IpTables::AddressFilter; use Getopt::Long; use Vyatta::Zone; use Sys::Syslog qw(:standard :macros); -- cgit v1.2.3 From e02c2bf7724c050e348dba14fa964375ba92a37b Mon Sep 17 00:00:00 2001 From: Gaurav Date: Wed, 22 Feb 2012 10:30:52 -0800 Subject: adding various timers in custom rule template (cherry picked from commit ebae932dd450c23d90d1f9d497e2715af535577f) --- lib/Vyatta/Conntrack/RuleCT.pm | 46 +++++++++++++++++++++++++++++++----- scripts/vyatta-conntrack-timeouts.pl | 12 +++------- 2 files changed, 43 insertions(+), 15 deletions(-) diff --git a/lib/Vyatta/Conntrack/RuleCT.pm b/lib/Vyatta/Conntrack/RuleCT.pm index e407f42..e53e07f 100644 --- a/lib/Vyatta/Conntrack/RuleCT.pm +++ b/lib/Vyatta/Conntrack/RuleCT.pm @@ -13,12 +13,20 @@ my %fields = ( _tcp => { _close => undef, _close_wait => undef, + _established => undef, + _fin_wait => undef, + _last_ack => undef, _syn_sent => undef, - }, - _udp => undef, + _syn_recv => undef, + _time_wait => undef, + }, + _udp => { + _other => undef, + _stream => undef, + }, _other => undef, _icmp => undef , - }, + }, ); my %dummy_rule = ( @@ -27,9 +35,17 @@ my %dummy_rule = ( _tcp => { _close => undef, _close_wait => undef, + _established => undef, + _fin_wait => undef, + _last_ack => undef, _syn_sent => undef, - }, - _udp => undef, + _syn_recv => undef, + _time_wait => undef, + }, + _udp => { + _other => undef, + _stream => undef, + }, _other => undef, _icmp => undef , }, @@ -67,7 +83,25 @@ sub setup_base { $config->setLevel("$level"); $self->{_rule_number} = $config->returnParent(".."); - $self->{_protocol} = $config->$val_func("protocol"); + if (($config->existsOrig("protocol tcp")) or + ($config->existsOrig("protocol udp")) or + ($config->existsOrig("protocol icmp")) or + ($config->existsOrig("protocol other"))) { + die "Error: Only one protocol per rule\n" + } + if ($config->$exists_func("protocol tcp")) { + $self->{_protocol} = "tcp"; + } elsif ($config->$exists_func("protocol icmp")) { + $self->{_protocol} = "icmp"; + } elsif ($config->$exists_func("protocol udp")) { + $self->{_protocol} = "udp"; + } elsif ($config->$exists_func("protocol other")) { + $self->{_protocol} = "other"; + } + + print "protocol is [\n"; + print $self->{_protocol}; + print "]\n"; $src->$addr_setup("$level source"); $dst->$addr_setup("$level destination"); diff --git a/scripts/vyatta-conntrack-timeouts.pl b/scripts/vyatta-conntrack-timeouts.pl index 7395b06..a079ed1 100644 --- a/scripts/vyatta-conntrack-timeouts.pl +++ b/scripts/vyatta-conntrack-timeouts.pl @@ -31,7 +31,6 @@ sub update_config { $config->setLevel("system conntrack timeout custom rule"); %rules = $config->listNodeStatus(); - print %rules; foreach my $rule (sort keys %rules) { if ("$rules{$rule}" eq 'static') { } elsif ("$rules{$rule}" eq 'added') { @@ -39,15 +38,10 @@ sub update_config { $node->setup("system conntrack timeout custom rule $rule"); $node->print(); } elsif ("$rules{$rule}" eq 'changed') { + my $node = new Vyatta::Conntrack::RuleCT; + $node->setup("system conntrack timeout custom rule $rule"); + $node->print(); } elsif ("$rules{$rule}" eq 'deleted') { -# my $node = new Vyatta::Conntrack::RuleCT; -# $node->setupOrig("system conntrack timeout custom rule $rule"); -# my $ipt_rules = $node->get_num_ipt_rules(); -# for (1 .. $ipt_rules) { -# print "deleting 1\n"; -# run_cmd("$iptables_cmd -t $table --delete $name $iptablesrule"); -# die "$iptables_cmd error: $! - $rule" if ($? >> 8); -# } } } } -- cgit v1.2.3 From 5572257844e071451dffa5b76bf459b18c27c23a Mon Sep 17 00:00:00 2001 From: Gaurav Date: Wed, 22 Feb 2012 11:52:37 -0800 Subject: changing structure of hashes kept for timeouts (cherry picked from commit 3fd99241f39f7482e35c0d4e4a91342fd8d9d4ad) --- lib/Vyatta/Conntrack/RuleCT.pm | 92 ++++++++++++++++++++---------------- scripts/vyatta-conntrack-timeouts.pl | 3 ++ 2 files changed, 55 insertions(+), 40 deletions(-) diff --git a/lib/Vyatta/Conntrack/RuleCT.pm b/lib/Vyatta/Conntrack/RuleCT.pm index e53e07f..f1d17f9 100644 --- a/lib/Vyatta/Conntrack/RuleCT.pm +++ b/lib/Vyatta/Conntrack/RuleCT.pm @@ -9,46 +9,44 @@ my $dst = new Vyatta::IpTables::AddressFilter; my %fields = ( _rule_number => undef, - _protocol => { - _tcp => { - _close => undef, - _close_wait => undef, - _established => undef, - _fin_wait => undef, - _last_ack => undef, - _syn_sent => undef, - _syn_recv => undef, - _time_wait => undef, - }, - _udp => { - _other => undef, - _stream => undef, - }, - _other => undef, - _icmp => undef , - }, + _protocol => undef, + _tcp => { + _close => undef, + _close_wait => undef, + _established => undef, + _fin_wait => undef, + _last_ack => undef, + _syn_sent => undef, + _syn_recv => undef, + _time_wait => undef, + }, + _udp => { + _other => undef, + _stream => undef, + }, + _other => undef, + _icmp => undef , ); my %dummy_rule = ( _rule_number => 10000, - _protocol => { - _tcp => { - _close => undef, - _close_wait => undef, - _established => undef, - _fin_wait => undef, - _last_ack => undef, - _syn_sent => undef, - _syn_recv => undef, - _time_wait => undef, - }, - _udp => { - _other => undef, - _stream => undef, - }, - _other => undef, - _icmp => undef , - }, + _protocol => undef, + _tcp => { + _close => undef, + _close_wait => undef, + _established => undef, + _fin_wait => undef, + _last_ack => undef, + _syn_sent => undef, + _syn_recv => undef, + _time_wait => undef, + }, + _udp => { + _other => undef, + _stream => undef, + }, + _other => undef, + _icmp => undef , ); my $DEBUG = 'false'; @@ -91,17 +89,26 @@ sub setup_base { } if ($config->$exists_func("protocol tcp")) { $self->{_protocol} = "tcp"; + $self->{_tcp}->{_close} = $config->$val_func("protocol tcp close"); + $self->{_tcp}->{_close_wait} = $config->$val_func("protocol tcp close-wait"); + $self->{_tcp}->{_time_wait} = $config->$val_func("protocol tcp time_wait"); + $self->{_tcp}->{_syn_recv} = $config->$val_func("protocol tcp syn-recv"); + $self->{_tcp}->{_syn_sent} = $config->$val_func("protocol tcp syn-sent"); + $self->{_tcp}->{_last_ack} = $config->$val_func("protocol tcp last-ack"); + $self->{_tcp}->{_fin_wait} = $config->$val_func("protocol tcp fin-wait"); + $self->{_tcp}->{_established} = $config->$val_func("protocol tcp established"); } elsif ($config->$exists_func("protocol icmp")) { $self->{_protocol} = "icmp"; + $self->{_icmp} = $config->$val_func("protocol icmp"); } elsif ($config->$exists_func("protocol udp")) { $self->{_protocol} = "udp"; + $self->{_udp}->{_other} = $config->$val_func("protocol udp other"); + $self->{_udp}->{_stream} = $config->$val_func("protocol udp stream"); } elsif ($config->$exists_func("protocol other")) { $self->{_protocol} = "other"; + $self->{_other} = $config->$val_func("protocol other"); } - print "protocol is [\n"; - print $self->{_protocol}; - print "]\n"; $src->$addr_setup("$level source"); $dst->$addr_setup("$level destination"); @@ -129,7 +136,12 @@ sub print { print "state: $self->{_state}\n" if defined $self->{_state}; $src->print(); $dst->print(); - + print "$self->{_tcp}->{_close}\n"; + print "$self->{_tcp}->{_close_wait}\n"; + print "$self->{_tcp}->{_established}\n"; + print "$self->{_tcp}->{_fin_wait}\n"; + print "$self->{_tcp}->{_syn_sent}\n"; + print "$self->{_tcp}->{_syn_recv}\n"; } sub rule { diff --git a/scripts/vyatta-conntrack-timeouts.pl b/scripts/vyatta-conntrack-timeouts.pl index a079ed1..9b69f0a 100644 --- a/scripts/vyatta-conntrack-timeouts.pl +++ b/scripts/vyatta-conntrack-timeouts.pl @@ -34,14 +34,17 @@ sub update_config { foreach my $rule (sort keys %rules) { if ("$rules{$rule}" eq 'static') { } elsif ("$rules{$rule}" eq 'added') { + print $rules{$rule}; my $node = new Vyatta::Conntrack::RuleCT; $node->setup("system conntrack timeout custom rule $rule"); $node->print(); } elsif ("$rules{$rule}" eq 'changed') { + print $rules{$rule}; my $node = new Vyatta::Conntrack::RuleCT; $node->setup("system conntrack timeout custom rule $rule"); $node->print(); } elsif ("$rules{$rule}" eq 'deleted') { + print $rules{$rule}; } } } -- cgit v1.2.3 From df2d9327d38a65ed281b74934e4b6a20d568079b Mon Sep 17 00:00:00 2001 From: Gaurav Date: Wed, 22 Feb 2012 14:38:42 -0800 Subject: Add function to create nfct-timeout policy (cherry picked from commit d15993bc83942d5841886c0f290430530b009174) --- lib/Vyatta/Conntrack/RuleCT.pm | 51 ++++++++++++++++++++++++++++++------ scripts/vyatta-conntrack-timeouts.pl | 2 ++ 2 files changed, 45 insertions(+), 8 deletions(-) diff --git a/lib/Vyatta/Conntrack/RuleCT.pm b/lib/Vyatta/Conntrack/RuleCT.pm index f1d17f9..5071087 100644 --- a/lib/Vyatta/Conntrack/RuleCT.pm +++ b/lib/Vyatta/Conntrack/RuleCT.pm @@ -1,3 +1,8 @@ +# +# The timeouts are implemented using nfct-timeout policies that are +# later applied to the corresponding iptables rules. The rules and +# policies are distinguished based on the rule number. + package Vyatta::Conntrack::RuleCT; use strict; @@ -26,6 +31,7 @@ my %fields = ( }, _other => undef, _icmp => undef , + _comment => undef, ); my %dummy_rule = ( @@ -47,6 +53,7 @@ my %dummy_rule = ( }, _other => undef, _icmp => undef , + _comment => undef, ); my $DEBUG = 'false'; @@ -79,14 +86,8 @@ sub setup_base { my $config = new Vyatta::Config; $config->setLevel("$level"); - + $self->{_comment} = $level; $self->{_rule_number} = $config->returnParent(".."); - if (($config->existsOrig("protocol tcp")) or - ($config->existsOrig("protocol udp")) or - ($config->existsOrig("protocol icmp")) or - ($config->existsOrig("protocol other"))) { - die "Error: Only one protocol per rule\n" - } if ($config->$exists_func("protocol tcp")) { $self->{_protocol} = "tcp"; $self->{_tcp}->{_close} = $config->$val_func("protocol tcp close"); @@ -142,6 +143,39 @@ sub print { print "$self->{_tcp}->{_fin_wait}\n"; print "$self->{_tcp}->{_syn_sent}\n"; print "$self->{_tcp}->{_syn_recv}\n"; + print "Comment is: $self->{_comment}\n"; +} + +# return a string that has the nfct-timeout command to create +# a timeout policy. +sub get_policy_command { + my ($self ) = @_; + my $command; + my @level_nodes = split (' ', $self->{_comment}); + $command .= "policy$level_nodes[2]-$level_nodes[5]"; + if ($self->{_protocol} eq 'tcp') { + $command .= " tcp"; + $command .= " close $self->{_tcp}->{_close}"; + $command .= " close-wait $self->{_tcp}->{_close_wait}"; + $command .= " time-wait $self->{_tcp}->{_time_wait}"; + $command .= " syn-recv $self->{_tcp}->{_syn_recv}"; + $command .= " syn-sent $self->{_tcp}->{_syn_sent}"; + $command .= " last-ack $self->{_tcp}->{_last_ack}"; + $command .= " fin-wait $self->{_tcp}->{_fin_wait}"; + $command .= " established $self->{_tcp}->{_established}"; + } elsif ($self->{_protocol} eq 'udp') { + $command .= " udp"; + $command .= " other $self->{_udp}->{_other}"; + $command .= " stream $self->{_udp}->{_stream}"; + } elsif ($self->{_protocol} eq 'icmp') { + $command .= " icmp"; + $command .= " icmp $self->{_icmp}"; + } elsif ($self->{_protocol} eq 'other') { + $command .= " other"; + $command .= " other $self->{_other}"; + } + print "\n $command\n\n"; + return $command; } sub rule { @@ -151,7 +185,8 @@ sub rule { # set CLI rule num as comment my @level_nodes = split (' ', $self->{_comment}); - $rule .= "-m comment --comment \"$level_nodes[2]-$level_nodes[4]\" "; + $rule .= "-m comment --comment \"$level_nodes[2]-$level_nodes[5]\" "; + print "rule is $rule\n"; # set the protocol if (defined($self->{_protocol})) { diff --git a/scripts/vyatta-conntrack-timeouts.pl b/scripts/vyatta-conntrack-timeouts.pl index 9b69f0a..20bdc52 100644 --- a/scripts/vyatta-conntrack-timeouts.pl +++ b/scripts/vyatta-conntrack-timeouts.pl @@ -38,6 +38,8 @@ sub update_config { my $node = new Vyatta::Conntrack::RuleCT; $node->setup("system conntrack timeout custom rule $rule"); $node->print(); +# $node->rule(); + $node->get_policy_command(); #nfct-tiemout command string } elsif ("$rules{$rule}" eq 'changed') { print $rules{$rule}; my $node = new Vyatta::Conntrack::RuleCT; -- cgit v1.2.3 From 821ec86eba3cef12188c060f1813aa3989b3b9f7 Mon Sep 17 00:00:00 2001 From: Gaurav Date: Wed, 22 Feb 2012 17:08:47 -0800 Subject: Fixing templates to avoid defaults since these rules override the global defaults (cherry picked from commit d94051fce5433de66860d762fc0a7aa7186564d9) --- .../timeout/custom/rule/node.tag/protocol/tcp/close-wait/node.def | 5 ----- .../timeout/custom/rule/node.tag/protocol/tcp/close/node.def | 5 ----- .../timeout/custom/rule/node.tag/protocol/tcp/established/node.def | 5 ----- .../timeout/custom/rule/node.tag/protocol/tcp/fin-wait/node.def | 5 ----- .../timeout/custom/rule/node.tag/protocol/tcp/last-ack/node.def | 5 ----- .../timeout/custom/rule/node.tag/protocol/tcp/syn-recv/node.def | 5 ----- .../timeout/custom/rule/node.tag/protocol/tcp/syn-sent/node.def | 5 ----- .../timeout/custom/rule/node.tag/protocol/tcp/time-wait/node.def | 5 ----- 8 files changed, 40 deletions(-) diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/close-wait/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/close-wait/node.def index 0491b68..c8b12d7 100644 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/close-wait/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/close-wait/node.def @@ -2,12 +2,7 @@ type: u32 help: TCP CLOSE-WAIT timeout in seconds -default: 60 - val_help: u32:1-21474836; TCP CLOSE-WAIT timeout in seconds syntax:expression: ($VAR(@) >= 1 && $VAR(@) <= 21474836) ; "Value must be between 1 and 21474836" -update: sudo sysctl -q -w net/netfilter/nf_conntrack_tcp_timeout_close_wait=$VAR(@) - -delete: sudo sysctl -q -w net/netfilter/nf_conntrack_tcp_timeout_close_wait=60 diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/close/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/close/node.def index 38317d5..fc6929f 100644 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/close/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/close/node.def @@ -2,12 +2,7 @@ type: u32 help: TCP CLOSE timeout in seconds -default: 10 - val_help: u32:1-21474836; TCP CLOSE timeout in seconds syntax:expression: ($VAR(@) >= 1 && $VAR(@) <= 21474836) ; "Value must be between 1 and 21474836" -update: sudo sysctl -q -w net/netfilter/nf_conntrack_tcp_timeout_close=$VAR(@) - -delete: sudo sysctl -q -w net/netfilter/nf_conntrack_tcp_timeout_close=10 diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/established/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/established/node.def index 9e47f1e..9acfd15 100644 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/established/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/established/node.def @@ -2,12 +2,7 @@ type: u32 help: TCP ESTABLISHED timeout in seconds -default: 432000 - val_help: u32:1-21474836; TCP ESTABLISHED timeout in seconds syntax:expression: ($VAR(@) >= 1 && $VAR(@) <= 21474836) ; "Value must be between 1 and 21474836" -update: sudo sysctl -q -w net/netfilter/nf_conntrack_tcp_timeout_established=$VAR(@) - -delete: sudo sysctl -q -w net/netfilter/nf_conntrack_tcp_timeout_established=432000 diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/fin-wait/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/fin-wait/node.def index 985a6a4..f11f16b 100644 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/fin-wait/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/fin-wait/node.def @@ -2,12 +2,7 @@ type: u32 help: TCP FIN-WAIT timeout in seconds -default: 120 - val_help: u32:1-21474836; TCP FIN-WAIT timeout in seconds syntax:expression: ($VAR(@) >= 1 && $VAR(@) <= 21474836) ; "Value must be between 1 and 21474836" -update: sudo sysctl -q -w net/netfilter/nf_conntrack_tcp_timeout_fin_wait=$VAR(@) - -delete: sudo sysctl -q -w net/netfilter/nf_conntrack_tcp_timeout_fin_wait=120 diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/last-ack/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/last-ack/node.def index 3e07fe4..1beb31f 100644 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/last-ack/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/last-ack/node.def @@ -2,12 +2,7 @@ type: u32 help: TCP LAST-ACK timeout in seconds -default: 30 - val_help: u32:1-21474836; TCP LAST-ACK timeout in seconds syntax:expression: ($VAR(@) >= 1 && $VAR(@) <= 21474836) ; "Value must be between 1 and 21474836" -update: sudo sysctl -q -w net/netfilter/nf_conntrack_tcp_timeout_last_ack=$VAR(@) - -delete: sudo sysctl -q -w net/netfilter/nf_conntrack_tcp_timeout_last_ack=30 diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/syn-recv/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/syn-recv/node.def index 50c5512..6d98386 100644 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/syn-recv/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/syn-recv/node.def @@ -2,12 +2,7 @@ type: u32 help: TCP SYN-RECEIVED timeout in seconds -default: 60 - val_help: u32:1-21474836; TCP SYN-RECEIVED timeout in seconds syntax:expression: ($VAR(@) >= 1 && $VAR(@) <= 21474836) ; "Value must be between 1 and 21474836" -update: sudo sysctl -q -w net/netfilter/nf_conntrack_tcp_timeout_syn_recv=$VAR(@) - -delete: sudo sysctl -q -w net/netfilter/nf_conntrack_tcp_timeout_syn_recv=60 diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/syn-sent/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/syn-sent/node.def index 5856ba7..3343bdb 100644 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/syn-sent/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/syn-sent/node.def @@ -2,12 +2,7 @@ type: u32 help: TCP SYN-SENT timeout in seconds -default: 120 - val_help: u32:1-21474836; TCP SYN-SENT timeout in seconds syntax:expression: ($VAR(@) >= 1 && $VAR(@) <= 21474836) ; "Value must be between 1 and 21474836" -update: sudo sysctl -q -w net/netfilter/nf_conntrack_tcp_timeout_syn_sent=$VAR(@) - -delete: sudo sysctl -q -w net/netfilter/nf_conntrack_tcp_timeout_syn_sent=120 diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/time-wait/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/time-wait/node.def index f6bd1c8..1342cc5 100644 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/time-wait/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/time-wait/node.def @@ -2,12 +2,7 @@ type: u32 help: TCP TIME-WAIT timeout in seconds -default: 120 - val_help: u32:1-21474836; TCP TIME-WAIT timeout in seconds syntax:expression: ($VAR(@) >= 1 && $VAR(@) <= 21474836) ; "Value must be between 1 and 21474836" -update: sudo sysctl -q -w net/netfilter/nf_conntrack_tcp_timeout_time_wait=$VAR(@) - -delete: sudo sysctl -q -w net/netfilter/nf_conntrack_tcp_timeout_time_wait=120 -- cgit v1.2.3 From 953d1039cbf8fb42ee5140c3a09ba7e6915008da Mon Sep 17 00:00:00 2001 From: Gaurav Date: Thu, 23 Feb 2012 09:57:17 -0800 Subject: Fixing nfct-command string:only modified timer is included in the command (cherry picked from commit 9e17315753bb98c677ec5b11c9e52f6a9f5d80a8) --- lib/Vyatta/Conntrack/RuleCT.pm | 43 ++++++++++++++++------ .../rule/node.tag/protocol/tcp/syn-sent/node.def | 1 - 2 files changed, 31 insertions(+), 13 deletions(-) diff --git a/lib/Vyatta/Conntrack/RuleCT.pm b/lib/Vyatta/Conntrack/RuleCT.pm index 5071087..594c784 100644 --- a/lib/Vyatta/Conntrack/RuleCT.pm +++ b/lib/Vyatta/Conntrack/RuleCT.pm @@ -143,7 +143,6 @@ sub print { print "$self->{_tcp}->{_fin_wait}\n"; print "$self->{_tcp}->{_syn_sent}\n"; print "$self->{_tcp}->{_syn_recv}\n"; - print "Comment is: $self->{_comment}\n"; } # return a string that has the nfct-timeout command to create @@ -152,21 +151,41 @@ sub get_policy_command { my ($self ) = @_; my $command; my @level_nodes = split (' ', $self->{_comment}); - $command .= "policy$level_nodes[2]-$level_nodes[5]"; + $command .= "policy_$level_nodes[2]_$level_nodes[5]"; if ($self->{_protocol} eq 'tcp') { $command .= " tcp"; - $command .= " close $self->{_tcp}->{_close}"; - $command .= " close-wait $self->{_tcp}->{_close_wait}"; - $command .= " time-wait $self->{_tcp}->{_time_wait}"; - $command .= " syn-recv $self->{_tcp}->{_syn_recv}"; - $command .= " syn-sent $self->{_tcp}->{_syn_sent}"; - $command .= " last-ack $self->{_tcp}->{_last_ack}"; - $command .= " fin-wait $self->{_tcp}->{_fin_wait}"; - $command .= " established $self->{_tcp}->{_established}"; + if ($self->{_tcp}->{_close}) { + $command .= " close $self->{_tcp}->{_close}"; + } + if ($self->{_tcp}->{_close_wait}) { + $command .= " close-wait $self->{_tcp}->{_close_wait}"; + } + if ($self->{_tcp}->{_time_wait}) { + $command .= " time-wait $self->{_tcp}->{_time_wait}"; + } + if ($self->{_tcp}->{_syn_recv}) { + $command .= " syn-recv $self->{_tcp}->{_syn_recv}"; + } + if ($self->{_tcp}->{_syn_sent}) { + $command .= " syn-sent $self->{_tcp}->{_syn_sent}"; + } + if ($self->{_tcp}->{_last_ack}) { + $command .= " last-ack $self->{_tcp}->{_last_ack}"; + } + if ($self->{_tcp}->{_fin_wait}) { + $command .= " fin-wait $self->{_tcp}->{_fin_wait}"; + } + if ($self->{_tcp}->{_established}) { + $command .= " established $self->{_tcp}->{_established}"; + } } elsif ($self->{_protocol} eq 'udp') { $command .= " udp"; - $command .= " other $self->{_udp}->{_other}"; - $command .= " stream $self->{_udp}->{_stream}"; + if ($self->{_udp}->{_other}) { + $command .= " other $self->{_udp}->{_other}"; + } + if ($self->{_udp}->{_stream}) { + $command .= " stream $self->{_udp}->{_stream}"; + } } elsif ($self->{_protocol} eq 'icmp') { $command .= " icmp"; $command .= " icmp $self->{_icmp}"; diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/syn-sent/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/syn-sent/node.def index 3343bdb..c5edde3 100644 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/syn-sent/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/syn-sent/node.def @@ -5,4 +5,3 @@ help: TCP SYN-SENT timeout in seconds val_help: u32:1-21474836; TCP SYN-SENT timeout in seconds syntax:expression: ($VAR(@) >= 1 && $VAR(@) <= 21474836) ; "Value must be between 1 and 21474836" - -- cgit v1.2.3 From a3b4d1895d26436a98475dd2588c700d7541eff0 Mon Sep 17 00:00:00 2001 From: Gaurav Date: Thu, 23 Feb 2012 10:12:46 -0800 Subject: Removed default timeouts for override udp/icmp/other, fixed minor bugs (cherry picked from commit 57353c5720699e641d2ab85a0ed8a9eae09520e7) --- .../conntrack/timeout/custom/rule/node.tag/protocol/icmp/node.def | 2 -- .../conntrack/timeout/custom/rule/node.tag/protocol/other/node.def | 2 -- .../conntrack/timeout/custom/rule/node.tag/protocol/udp/other/node.def | 2 -- .../conntrack/timeout/custom/rule/node.tag/protocol/udp/stream/node.def | 2 -- 4 files changed, 8 deletions(-) diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/icmp/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/icmp/node.def index 2997e58..5fd267f 100644 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/icmp/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/icmp/node.def @@ -2,8 +2,6 @@ type: u32 help: ICMP timeout in seconds -default: 30 - val_help: u32:1-21474836; ICMP timeout in seconds syntax:expression: ($VAR(@) >= 1 && $VAR(@) <= 21474836) ; "Value must be between 1 and 21474836" diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/other/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/other/node.def index 5653056..7a7ae98 100644 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/other/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/other/node.def @@ -2,8 +2,6 @@ type: u32 help: Generic connection timeout in seconds -default: 600 - val_help: u32:1-21474836; Generic connection timeout in seconds syntax:expression: ($VAR(@) >= 1 && $VAR(@) <= 21474836) ; "Value must be between 1 and 21474836" diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/udp/other/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/udp/other/node.def index c0c1824..b71294c 100644 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/udp/other/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/udp/other/node.def @@ -2,8 +2,6 @@ type: u32 help: UDP generic timeout in seconds -default: 30 - val_help: u32:1-21474836; UDP generic timeout in seconds syntax:expression: ($VAR(@) >= 1 && $VAR(@) <= 21474836) ; "Value must be between 1 and 21474836" diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/udp/stream/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/udp/stream/node.def index 0670477..31830e1 100644 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/udp/stream/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/udp/stream/node.def @@ -2,8 +2,6 @@ type: u32 help: UDP stream timeout in seconds -default: 180 - val_help: u32:1-21474836; UDP stream timeout in seconds syntax:expression: ($VAR(@) >= 1 && $VAR(@) <= 21474836) ; "Value must be between 1 and 21474836" -- cgit v1.2.3 From d3296d0d9376a67983871736e74409fabfc20634 Mon Sep 17 00:00:00 2001 From: Gaurav Date: Thu, 23 Feb 2012 12:01:05 -0800 Subject: Error checks for ports with other/icmp, as not allowed (cherry picked from commit 8059ed8d3cfa033dc6b48e79dd66cdcd1ecc5ae9) --- lib/Vyatta/Conntrack/RuleCT.pm | 351 +++-------------------------------- scripts/vyatta-conntrack-timeouts.pl | 5 +- 2 files changed, 28 insertions(+), 328 deletions(-) diff --git a/lib/Vyatta/Conntrack/RuleCT.pm b/lib/Vyatta/Conntrack/RuleCT.pm index 594c784..421b746 100644 --- a/lib/Vyatta/Conntrack/RuleCT.pm +++ b/lib/Vyatta/Conntrack/RuleCT.pm @@ -58,6 +58,21 @@ my %dummy_rule = ( my $DEBUG = 'false'; +sub rule { + my ( $self ) = @_; + my ($rule, $srcrule, $dstrule, $err_str); + my $tcp_and_udp = 0; + # set CLI rule num as comment + my @level_nodes = split (' ', $self->{_comment}); + $rule .= "-m comment --comment \"$level_nodes[2]-$level_nodes[5]\" "; + ($srcrule, $err_str) = $src->rule(); + return ($err_str, ) if (!defined($srcrule)); + ($dstrule, $err_str) = $dst->rule(); + return ($err_str, ) if (!defined($dstrule)); + $rule .= " $srcrule $dstrule "; + print "rule is $rule\n"; +} + sub new { my $that = shift; my $class = ref ($that) || $that; @@ -110,8 +125,18 @@ sub setup_base { $self->{_other} = $config->$val_func("protocol other"); } + #FIXME: AddressFilter.pm needs a change to accomodate other and + # icmp protocols as it does port checks unconditionally. $src->$addr_setup("$level source"); + $src->{_protocol} = $self->{_protocol};#needed to use address filter + if ( (($src->{_protocol} eq 'icmp') or ($src->{_protocol} eq 'other')) and (defined($src->{_port})) ) { + die "Error: Cannot specify port with protocol $src->{_protocol}\n"; + } $dst->$addr_setup("$level destination"); + $dst->{_protocol} = $self->{_protocol};#needed to use address filter + if ( (($dst->{_protocol} eq 'icmp') or ($dst->{_protocol} eq 'other')) and (defined($dst->{_port})) ) { + die "Error: Cannot specify port with protocol $dst->{_protocol}\n"; + } return 0; } @@ -187,340 +212,14 @@ sub get_policy_command { $command .= " stream $self->{_udp}->{_stream}"; } } elsif ($self->{_protocol} eq 'icmp') { - $command .= " icmp"; $command .= " icmp $self->{_icmp}"; } elsif ($self->{_protocol} eq 'other') { - $command .= " other"; $command .= " other $self->{_other}"; } print "\n $command\n\n"; return $command; } -sub rule { - my ( $self ) = @_; - my ($rule, $srcrule, $dstrule, $err_str); - my $tcp_and_udp = 0; - - # set CLI rule num as comment - my @level_nodes = split (' ', $self->{_comment}); - $rule .= "-m comment --comment \"$level_nodes[2]-$level_nodes[5]\" "; - print "rule is $rule\n"; - - # set the protocol - if (defined($self->{_protocol})) { - my $str = $self->{_protocol}; - my $negate = ''; - if ($str =~ /^\!(.*)$/) { - $str = $1; - $negate = '! '; - } - if ($str eq 'tcp_udp') { - $tcp_and_udp = 1; - $rule .= " $negate -p tcp "; # we'll add the '-p udp' to 2nd rule later - } else { - $rule .= " $negate -p $str "; - } - } - - my $state_str = uc (get_state_str($self)); - if ($state_str ne "") { - $rule .= "-m state --state $state_str "; - } - - # set tcp flags if applicable - my $tcp_flags = undef; - if (defined $self->{_tcp_flags}) { - if (($self->{_protocol} eq "tcp") || ($self->{_protocol} eq "6")) { - $tcp_flags = get_tcp_flags_string($self->{_tcp_flags}); - } else { - return ("TCP flags can only be set if protocol is set to TCP", ); - } - } - if (defined($tcp_flags)) { - $rule .= " -m tcp --tcp-flags $tcp_flags "; - } - - # set the icmp code and type if applicable - if (($self->{_protocol} eq "icmp") || ($self->{_protocol} eq "1")) { - if (defined $self->{_icmp_name}) { - if (defined($self->{_icmp_type}) || defined($self->{_icmp_code})){ - return ("Cannot use ICMP type/code with ICMP type-name", ); - } - $rule .= "--icmp-type $self->{_icmp_name} "; - } elsif (defined $self->{_icmp_type}) { - $rule .= "--icmp-type $self->{_icmp_type}"; - if (defined $self->{_icmp_code}) { - $rule .= "/$self->{_icmp_code}"; - } - $rule .= " "; - } elsif (defined $self->{_icmp_code}) { - return ("ICMP code can only be defined if ICMP type is defined", ); - } - } elsif (defined($self->{_icmp_type}) || defined($self->{_icmp_code}) - || defined($self->{_icmp_name})) { - return ("ICMP type/code or type-name can only be defined if protocol is ICMP", ); - } - - # Setup ICMPv6 rule if configured - # ICMPv6 parameters are only valid if the rule is matching on the - # ICMPv6 protocol ID. - # - if (($self->{_protocol} eq "icmpv6") || - ($self->{_protocol} eq "ipv6-icmp") || - ($self->{_protocol} eq "58")) { - if (defined($self->{_icmpv6_type})) { - $rule .= "-m icmpv6 --icmpv6-type $self->{_icmpv6_type}"; - } - } - - # add the source and destination rules - ($srcrule, $err_str) = $src->rule(); - return ($err_str, ) if (!defined($srcrule)); - ($dstrule, $err_str) = $dst->rule(); - return ($err_str, ) if (!defined($dstrule)); - if ((grep /multiport/, $srcrule) ^ (grep /multiport/, $dstrule)) { - if ((grep /sport/, $srcrule) && (grep /dport/, $dstrule)) { - return ('Cannot specify multiple ports when both ' - . 'source and destination ports are specified', ); - } - } - $rule .= " $srcrule $dstrule "; - - return ('Cannot specify both "match-frag" and "match-non-frag"', ) - if (defined($self->{_frag}) && defined($self->{_non_frag})); - if (defined($self->{_frag})) { - $rule .= ' -f '; - } elsif (defined($self->{_non_frag})) { - $rule .= ' ! -f '; - } - - # note: "out" is not valid in the INPUT chain. - return ('Cannot specify both "match-ipsec" and "match-none"', ) - if (defined($self->{_ipsec}) && defined($self->{_non_ipsec})); - if (defined($self->{_ipsec})) { - $rule .= ' -m policy --pol ipsec --dir in '; - } elsif (defined($self->{_non_ipsec})) { - $rule .= ' -m policy --pol none --dir in '; - } - - my $p2p = undef; - if (defined($self->{_p2p}->{_all})) { - $p2p = '--apple --bit --dc --edk --gnu --kazaa '; - } else { - my @apps = qw(apple bit dc edk gnu kazaa); - foreach (@apps) { - if (defined($self->{_p2p}->{"_$_"})) { - $p2p .= "--$_ "; - } - } - } - if (defined($p2p)) { - $rule .= " -m ipp2p $p2p "; - } - - my $time = undef; - if (defined($self->{_time}->{_utc})) { - $time .= " --utc "; - } - if (defined($self->{_time}->{_startdate})) { - my $check_date = validate_date($self->{_time}->{_startdate}, "startdate"); - if (!($check_date eq "")) { - return ($check_date, ); - } - $time .= " --datestart $self->{_time}->{_startdate} "; - } - if (defined($self->{_time}->{_stopdate})) { - my $check_date = validate_date($self->{_time}->{_stopdate}, "stopdate"); - if (!($check_date eq "")) { - return ($check_date, ); - } - $time .= " --datestop $self->{_time}->{_stopdate} "; - } - if (defined($self->{_time}->{_starttime})) { - return ("Invalid starttime $self->{_time}->{_starttime}. -Time should use 24 hour notation hh:mm:ss and lie in between 00:00:00 and 23:59:59", ) - if (!validate_timevalues($self->{_time}->{_starttime}, "time")); - $time .= " --timestart $self->{_time}->{_starttime} "; - } - if (defined($self->{_time}->{_stoptime})) { - return ("Invalid stoptime $self->{_time}->{_stoptime}. -Time should use 24 hour notation hh:mm:ss and lie in between 00:00:00 and 23:59:59", ) - if (!validate_timevalues($self->{_time}->{_stoptime}, "time")); - $time .= " --timestop $self->{_time}->{_stoptime} "; - } - if (defined($self->{_time}->{_monthdays})) { - my $negate = " "; - if ($self->{_time}->{_monthdays} =~ m/^!/) { - $negate = "! "; - $self->{_time}->{_monthdays} = substr $self->{_time}->{_monthdays}, 1; - } - return ("Invalid monthdays value $self->{_time}->{_monthdays}. -Monthdays should have values between 1 and 31 with multiple days separated by commas -eg. 2,12,21 For negation, add ! in front eg. !2,12,21", ) - if (!validate_timevalues($self->{_time}->{_monthdays}, "monthdays")); - $time .= " $negate --monthdays $self->{_time}->{_monthdays} "; - } - if (defined($self->{_time}->{_weekdays})) { - my $negate = " "; - if ($self->{_time}->{_weekdays} =~ m/^!/) { - $negate = "! "; - $self->{_time}->{_weekdays} = substr $self->{_time}->{_weekdays}, 1; - } - return ("Invalid weekdays value $self->{_time}->{_weekdays}. -Weekdays should be specified using the first three characters of the day with the -first character capitalized eg. Mon,Thu,Sat For negation, add ! in front eg. !Mon,Thu,Sat", ) - if (!validate_timevalues($self->{_time}->{_weekdays}, "weekdays")); - $time .= " $negate --weekdays $self->{_time}->{_weekdays} "; - } - if (defined($time)) { - $rule .= " -m time $time "; - } - - my $limit = undef; - if (defined $self->{_limit}->{_rate}) { - my $rate_integer = $self->{_limit}->{_rate}; - $rate_integer =~ s/\/(second|minute|hour|day)//; - if ($rate_integer < 1) { - return ("integer value in rate cannot be less than 1", ); - } - $limit = "--limit $self->{_limit}->{_rate} --limit-burst $self->{_limit}->{_burst}"; - } - $rule .= " -m limit $limit " if defined $limit; - - # recent match condition SHOULD BE DONE IN THE LAST so - # all options in $rule are copied to $recent_rule below - my $recent_rule = undef; - if (defined($self->{_recent_time}) || defined($self->{_recent_cnt})) { - my $recent_rule1 = undef; - my $recent_rule2 = undef; - $recent_rule1 .= ' -m recent --update '; - $recent_rule2 .= ' -m recent --set '; - if (defined($self->{_recent_time})) { - $recent_rule1 .= " --seconds $self->{_recent_time} "; - } - if (defined($self->{_recent_cnt})) { - $recent_rule1 .= " --hitcount $self->{_recent_cnt} "; - } - - $recent_rule = $rule; - - if ($rule =~ m/\-m\s+set\s+\-\-match\-set/) { - # firewall group being used in this rule. iptables complains if recent - # match condition is placed after group match conditions [see bug 5744] - # so instead of appending recent match place it before group match - my @split_rules = (); - - @split_rules = split(/(\-m\s+set\s+\-\-match\-set)/, $rule, 2); - $rule = $split_rules[0] . $recent_rule1 . - $split_rules[1] . $split_rules[2]; - - @split_rules = split(/(\-m\s+set\s+\-\-match\-set)/, $recent_rule, 2); - $recent_rule = $split_rules[0] . $recent_rule2 . - $split_rules[1] . $split_rules[2]; - } else { - # append recent match conditions to the two rules needed for recent match - $rule .= $recent_rule1; - $recent_rule .= $recent_rule2; - } - } - - my $chain = $self->{_name}; - my $rule_num = $self->{_rule_number}; - my $rule2 = undef; - # set the jump target. Depends on action and log - if ("$self->{_log}" eq "enable") { - $rule2 = $rule; - my $log_prefix = get_log_prefix($chain, $rule_num, $self->{_action}); - $rule2 .= "-j LOG --log-prefix \"$log_prefix\" "; - } - if ("$self->{_action}" eq "drop") { - $rule .= "-j DROP "; - } elsif ("$self->{_action}" eq "accept") { - $rule .= "-j RETURN "; - } elsif ("$self->{_action}" eq "reject") { - $rule .= "-j REJECT "; - } elsif ("$self->{_action}" eq 'inspect') { - my $target = ipt_get_queue_target('SNORT'); - return ('Undefined target for inspect', ) if ! defined $target; - $rule .= "-j $target "; - } elsif ("$self->{_action}" eq 'modify') { - # mangle actions - my $count = 0; - if (defined($self->{_mod_mark})) { - # MARK - $rule .= "-j MARK --set-mark $self->{_mod_mark} "; - $count++; - } - if (defined($self->{_mod_dscp})) { - # DSCP - $rule .= "-j DSCP --set-dscp $self->{_mod_dscp} "; - $count++; - } - if (defined($self->{_mod_tcpmss})) { - # TCP-MSS - # check for SYN flag - if (!defined $self->{_tcp_flags} || - !(($self->{_tcp_flags} =~ m/SYN/) && !($self->{_tcp_flags} =~ m/!SYN/))) { - return ('need to set TCP SYN flag to modify TCP MSS', ); - } - - if ($self->{_mod_tcpmss} =~ m/\d/) { - $rule .= "-j TCPMSS --set-mss $self->{_mod_tcpmss} "; - } else { - $rule .= "-j TCPMSS --clamp-mss-to-pmtu "; - } - $count++; - } - - # others - - if ($count == 0) { - return ('Action "modify" requires more specific configuration under ' - . 'the "modify" node', ); - } elsif ($count > 1) { - return ('Cannot define more than one modification under ' - . 'the "modify" node', ); - } - } else { - return ("\"action\" must be defined", ); - } - if (defined($rule2)) { - my $tmp = $rule2; - $rule2 = $rule; - $rule = $tmp; - } elsif (defined($recent_rule)) { - $rule2 = $recent_rule; - $recent_rule = undef; - } - - return (undef, undef) if defined $self->{_disable}; - - my ($udp_rule, $udp_rule2, $udp_recent_rule) = (undef, undef, undef); - if ($tcp_and_udp == 1) { - # create udp rules - $udp_rule = $rule; - $udp_rule2 = $rule2 if defined $rule2; - $udp_recent_rule = $recent_rule if defined $recent_rule; - foreach my $each_udprule ($udp_rule, $udp_rule2, $udp_recent_rule) { - $each_udprule =~ s/ \-p tcp / -p udp / if defined $each_udprule; - } - } - - if ($DEBUG eq 'true') { - # print all potential iptables rules that could be formed for - # a single CLI rule. see get_num_ipt_rules to see exact count - print "rule :\n$rule\n" if defined $rule; - print "rule2 :\n$rule2\n" if defined $rule2; - print "recent rule :\n$recent_rule\n" if defined $recent_rule; - print "udp rule :\n$udp_rule\n" if defined $udp_rule; - print "udp rule2 :\n$udp_rule2\n" if defined $udp_rule2; - print "udp recent rule :\n$udp_recent_rule\n" if defined $udp_recent_rule; - } - - return (undef, $rule, $rule2, $recent_rule, $udp_rule, $udp_rule2, $udp_recent_rule); -} - 1; diff --git a/scripts/vyatta-conntrack-timeouts.pl b/scripts/vyatta-conntrack-timeouts.pl index 20bdc52..bf7165e 100644 --- a/scripts/vyatta-conntrack-timeouts.pl +++ b/scripts/vyatta-conntrack-timeouts.pl @@ -38,8 +38,9 @@ sub update_config { my $node = new Vyatta::Conntrack::RuleCT; $node->setup("system conntrack timeout custom rule $rule"); $node->print(); -# $node->rule(); - $node->get_policy_command(); #nfct-tiemout command string + $node->rule(); + $node->get_policy_command(); #nfct-timeout command string + } elsif ("$rules{$rule}" eq 'changed') { print $rules{$rule}; my $node = new Vyatta::Conntrack::RuleCT; -- cgit v1.2.3 From 516e4988be28dd2441e915fe7d4c6a2efb5bd0c6 Mon Sep 17 00:00:00 2001 From: Gaurav Date: Fri, 24 Feb 2012 11:22:41 -0800 Subject: Adding deletion, error handling etc. (cherry picked from commit 6a59a800acf9a9f6a21677e6187a33647ceb3539) --- lib/Vyatta/Conntrack/RuleCT.pm | 14 ++++++++++---- scripts/vyatta-conntrack-timeouts.pl | 31 +++++++++++++++++++++++-------- 2 files changed, 33 insertions(+), 12 deletions(-) diff --git a/lib/Vyatta/Conntrack/RuleCT.pm b/lib/Vyatta/Conntrack/RuleCT.pm index 421b746..d2c6409 100644 --- a/lib/Vyatta/Conntrack/RuleCT.pm +++ b/lib/Vyatta/Conntrack/RuleCT.pm @@ -11,7 +11,7 @@ require Vyatta::IpTables::AddressFilter; my $src = new Vyatta::IpTables::AddressFilter; my $dst = new Vyatta::IpTables::AddressFilter; - +my $CTERROR = "Conntrack Timeout Error:"; my %fields = ( _rule_number => undef, _protocol => undef, @@ -66,11 +66,17 @@ sub rule { my @level_nodes = split (' ', $self->{_comment}); $rule .= "-m comment --comment \"$level_nodes[2]-$level_nodes[5]\" "; ($srcrule, $err_str) = $src->rule(); - return ($err_str, ) if (!defined($srcrule)); + if (defined($err_str)) { + Vyatta::Config::outputError(["Conntrack"], "Conntrack config error: $err_str"); + exit 1; + } ($dstrule, $err_str) = $dst->rule(); - return ($err_str, ) if (!defined($dstrule)); + if (defined($err_str)) { + Vyatta::Config::outputError(["Conntrack"], "Conntrack config error: $err_str"); + exit 1; + } $rule .= " $srcrule $dstrule "; - print "rule is $rule\n"; + return $rule; } sub new { diff --git a/scripts/vyatta-conntrack-timeouts.pl b/scripts/vyatta-conntrack-timeouts.pl index bf7165e..ac9b56d 100644 --- a/scripts/vyatta-conntrack-timeouts.pl +++ b/scripts/vyatta-conntrack-timeouts.pl @@ -23,6 +23,19 @@ GetOptions("create=s" => \$create, ); update_config(); +sub remove_timeout_policy { + my ($rule_string, $timeout_policy) = @_; + print "removing with $rule_string and $timeout_policy\n"; + # function to apply the policy and then apply the policy to + # the iptables rule. + # Do nothing as of now. +} +sub apply_timeout_policy { + # function to apply the policy and then apply the policy to + # the iptables rule. + # Do nothing as of now. +} + sub update_config { my $config = new Vyatta::Config; @@ -34,20 +47,22 @@ sub update_config { foreach my $rule (sort keys %rules) { if ("$rules{$rule}" eq 'static') { } elsif ("$rules{$rule}" eq 'added') { - print $rules{$rule}; my $node = new Vyatta::Conntrack::RuleCT; + my ($rule_string, $timeout_policy); $node->setup("system conntrack timeout custom rule $rule"); - $node->print(); - $node->rule(); - $node->get_policy_command(); #nfct-timeout command string - + $rule_string = $node->rule(); + $timeout_policy = $node->get_policy_command(); #nfct-timeout command string + apply_timeout_policy($rule_string, $timeout_policy); } elsif ("$rules{$rule}" eq 'changed') { - print $rules{$rule}; my $node = new Vyatta::Conntrack::RuleCT; $node->setup("system conntrack timeout custom rule $rule"); - $node->print(); } elsif ("$rules{$rule}" eq 'deleted') { - print $rules{$rule}; + my $node = new Vyatta::Conntrack::RuleCT; + my ($rule_string, $timeout_policy); + $node->setupOrig("system conntrack timeout custom rule $rule"); + $rule_string = $node->rule(); + $timeout_policy = $node->get_policy_command(); #nfct-timeout command string + remove_timeout_policy($rule_string, $timeout_policy); } } } -- cgit v1.2.3 From 2c01ae23d707c984e2f6587da9218e5e63d55e30 Mon Sep 17 00:00:00 2001 From: Gaurav Date: Fri, 24 Feb 2012 12:07:59 -0800 Subject: adding apply/remove policy function, still dummy (cherry picked from commit bc000f9a538e67545dd7b1edb49385e158067639) --- lib/Vyatta/Conntrack/RuleCT.pm | 1 - scripts/vyatta-conntrack-timeouts.pl | 26 +++++++++++++++++++------- 2 files changed, 19 insertions(+), 8 deletions(-) diff --git a/lib/Vyatta/Conntrack/RuleCT.pm b/lib/Vyatta/Conntrack/RuleCT.pm index d2c6409..d75c85e 100644 --- a/lib/Vyatta/Conntrack/RuleCT.pm +++ b/lib/Vyatta/Conntrack/RuleCT.pm @@ -222,7 +222,6 @@ sub get_policy_command { } elsif ($self->{_protocol} eq 'other') { $command .= " other $self->{_other}"; } - print "\n $command\n\n"; return $command; } diff --git a/scripts/vyatta-conntrack-timeouts.pl b/scripts/vyatta-conntrack-timeouts.pl index ac9b56d..a98de86 100644 --- a/scripts/vyatta-conntrack-timeouts.pl +++ b/scripts/vyatta-conntrack-timeouts.pl @@ -23,17 +23,29 @@ GetOptions("create=s" => \$create, ); update_config(); + sub remove_timeout_policy { my ($rule_string, $timeout_policy) = @_; - print "removing with $rule_string and $timeout_policy\n"; - # function to apply the policy and then apply the policy to - # the iptables rule. - # Do nothing as of now. + my @tokens = split (' ', $timeout_policy); + # First remove the iptables rules before removing policy. + my $iptables_cmd1 = "iptables -D PREROUTING -t raw $rule_string -j CT --timeout $tokens[0]"; + my $iptables_cmd2 = "iptables -D OUTPUT -t raw $rule_string -j CT --timeout $tokens[0]"; + my $nfct_timeout_cmd = "nfct-timeout remove $timeout_policy"; + print "$iptables_cmd1\n$iptables_cmd2\n"; + print "$nfct_timeout_cmd\n"; } + +# nfct-timeout create policy1 tcp established 1200 close-wait 100 fin-wait 10 +# iptables -I PREROUTING -t raw -s 1.1.1.1 -d 2.2.2.2 -j CT --timeout policy1 sub apply_timeout_policy { - # function to apply the policy and then apply the policy to - # the iptables rule. - # Do nothing as of now. + my ($rule_string, $timeout_policy) = @_; + my $nfct_timeout_cmd = "nfct-timeout create $timeout_policy"; + my @tokens = split (' ', $timeout_policy); + my $iptables_cmd1 = "iptables -I PREROUTING -t raw $rule_string -j CT --timeout $tokens[0]"; + my $iptables_cmd2 = "iptables -I OUTPUT -t raw $rule_string -j CT --timeout $tokens[0]"; + + print "$nfct_timeout_cmd\n"; + print "$iptables_cmd1\n$iptables_cmd2\n"; } -- cgit v1.2.3 From 0c077f247ad6fbce6c8cc7a2a664ac682a56ed4c Mon Sep 17 00:00:00 2001 From: Gaurav Date: Fri, 24 Feb 2012 14:17:23 -0800 Subject: add run_cmd function with error checking (cherry picked from commit 10cd7d81497d87aed44287244f112990768cdfe2) --- lib/Vyatta/Conntrack/RuleCT.pm | 1 - scripts/vyatta-conntrack-timeouts.pl | 70 ++++++++++++++++++++++++++++++++---- 2 files changed, 64 insertions(+), 7 deletions(-) diff --git a/lib/Vyatta/Conntrack/RuleCT.pm b/lib/Vyatta/Conntrack/RuleCT.pm index d75c85e..9953291 100644 --- a/lib/Vyatta/Conntrack/RuleCT.pm +++ b/lib/Vyatta/Conntrack/RuleCT.pm @@ -11,7 +11,6 @@ require Vyatta::IpTables::AddressFilter; my $src = new Vyatta::IpTables::AddressFilter; my $dst = new Vyatta::IpTables::AddressFilter; -my $CTERROR = "Conntrack Timeout Error:"; my %fields = ( _rule_number => undef, _protocol => undef, diff --git a/scripts/vyatta-conntrack-timeouts.pl b/scripts/vyatta-conntrack-timeouts.pl index a98de86..61830ab 100644 --- a/scripts/vyatta-conntrack-timeouts.pl +++ b/scripts/vyatta-conntrack-timeouts.pl @@ -14,9 +14,14 @@ use Sys::Syslog qw(:standard :macros); #for future use when v6 timeouts need to be set my %cmd_hash = ( 'ipv4' => 'iptables', 'ipv6' => 'ip6tables'); +# Enable printing debug output to stdout. +my $debug_flag = 0; -my ($create, $delete, $update); +# Enable sending debug output to syslog. +my $syslog_flag = 0; +my ($create, $delete, $update); +my $CTERROR = "Conntrack timeout error:"; GetOptions("create=s" => \$create, "delete=s" => \$delete, "update=s" => \$update, @@ -24,6 +29,40 @@ GetOptions("create=s" => \$create, update_config(); +openlog("vyatta-conntrack", "pid", "local0"); + +sub log_msg { + my $message = shift; + + print "DEBUG: $message\n" if $debug_flag; + syslog(LOG_DEBUG, "%s", $message) if $syslog_flag; +} +# Run command and capture output +# run_cmd("$iptables_cmd -t $table -F $name", 1); +# if command fails, then send output to syslog +sub run_cmd { + my ($cmd_to_run, $redirect) = @_; + + log_msg("Running: $cmd_to_run"); + print "$cmd_to_run\n"; + + if ($redirect) { + open (my $out, '-|', $cmd_to_run . ' 2>&1') + or die "Can't run command \"$cmd_to_run\": $!"; + my @cmd_out = <$out>; + + # if command suceeds to do nothing. + return if (close ($out)); + + foreach my $line (@cmd_out) { + chomp $line; + syslog(LOG_INFO, "%s", $line); + } + } else { + system($cmd_to_run); + } +} + sub remove_timeout_policy { my ($rule_string, $timeout_policy) = @_; my @tokens = split (' ', $timeout_policy); @@ -31,8 +70,18 @@ sub remove_timeout_policy { my $iptables_cmd1 = "iptables -D PREROUTING -t raw $rule_string -j CT --timeout $tokens[0]"; my $iptables_cmd2 = "iptables -D OUTPUT -t raw $rule_string -j CT --timeout $tokens[0]"; my $nfct_timeout_cmd = "nfct-timeout remove $timeout_policy"; - print "$iptables_cmd1\n$iptables_cmd2\n"; - print "$nfct_timeout_cmd\n"; + run_cmd($iptables_cmd2); + if ($? >> 8) { + print "$CTERROR failed to run $iptables_cmd2\n"; + } + run_cmd($iptables_cmd1); + if ($? >> 8) { + print "$CTERROR failed to run $iptables_cmd1\n"; + } + run_cmd($nfct_timeout_cmd); + if ($? >> 8) { + print "$CTERROR failed to run $nfct_timeout_cmd\n"; + } } # nfct-timeout create policy1 tcp established 1200 close-wait 100 fin-wait 10 @@ -43,9 +92,18 @@ sub apply_timeout_policy { my @tokens = split (' ', $timeout_policy); my $iptables_cmd1 = "iptables -I PREROUTING -t raw $rule_string -j CT --timeout $tokens[0]"; my $iptables_cmd2 = "iptables -I OUTPUT -t raw $rule_string -j CT --timeout $tokens[0]"; - - print "$nfct_timeout_cmd\n"; - print "$iptables_cmd1\n$iptables_cmd2\n"; + run_cmd($nfct_timeout_cmd); + if ($? >> 8) { + print "$CTERROR failed to run $nfct_timeout_cmd\n"; + } + run_cmd($iptables_cmd1); + if ($? >> 8) { + print "$CTERROR failed to run $iptables_cmd1\n"; + } + run_cmd($iptables_cmd2); + if ($? >> 8) { + print "$CTERROR failed to run $iptables_cmd2\n"; + } } -- cgit v1.2.3 From ad151e1acc2a432a5e6b1294a6713af045cce2e7 Mon Sep 17 00:00:00 2001 From: Gaurav Date: Fri, 24 Feb 2012 14:48:44 -0800 Subject: re-factored (cherry picked from commit a4a349b09923e797e2dbb24c50a151ddec91473d) --- scripts/vyatta-conntrack-timeouts.pl | 41 +++++++++++++++++++++++++----------- 1 file changed, 29 insertions(+), 12 deletions(-) diff --git a/scripts/vyatta-conntrack-timeouts.pl b/scripts/vyatta-conntrack-timeouts.pl index 61830ab..4ea3a9f 100644 --- a/scripts/vyatta-conntrack-timeouts.pl +++ b/scripts/vyatta-conntrack-timeouts.pl @@ -73,6 +73,7 @@ sub remove_timeout_policy { run_cmd($iptables_cmd2); if ($? >> 8) { print "$CTERROR failed to run $iptables_cmd2\n"; + #dont exit, try to clean as much. } run_cmd($iptables_cmd1); if ($? >> 8) { @@ -95,17 +96,43 @@ sub apply_timeout_policy { run_cmd($nfct_timeout_cmd); if ($? >> 8) { print "$CTERROR failed to run $nfct_timeout_cmd\n"; + exit 1; } run_cmd($iptables_cmd1); if ($? >> 8) { + #cleanup the policy before exit. + run_cmd("nfct-timeout remove $timeout_policy"); print "$CTERROR failed to run $iptables_cmd1\n"; + exit 1; } run_cmd($iptables_cmd2); if ($? >> 8) { + run_cmd("nfct-timeout remove $timeout_policy"); + run_cmd("iptables -D PREROUTING -t raw $rule_string -j CT --timeout $tokens[0]"); print "$CTERROR failed to run $iptables_cmd2\n"; + exit 1; } } +sub handle_rule_creation { + my ($rule) = @_; + my $node = new Vyatta::Conntrack::RuleCT; + my ($rule_string, $timeout_policy); + $node->setup("system conntrack timeout custom rule $rule"); + $rule_string = $node->rule(); + $timeout_policy = $node->get_policy_command(); #nfct-timeout command string + apply_timeout_policy($rule_string, $timeout_policy); +} + +sub handle_rule_deletion { + my ($rule) = @_; + my $node = new Vyatta::Conntrack::RuleCT; + my ($rule_string, $timeout_policy); + $node->setupOrig("system conntrack timeout custom rule $rule"); + $rule_string = $node->rule(); + $timeout_policy = $node->get_policy_command(); #nfct-timeout command string + remove_timeout_policy($rule_string, $timeout_policy); +} sub update_config { my $config = new Vyatta::Config; @@ -117,22 +144,12 @@ sub update_config { foreach my $rule (sort keys %rules) { if ("$rules{$rule}" eq 'static') { } elsif ("$rules{$rule}" eq 'added') { - my $node = new Vyatta::Conntrack::RuleCT; - my ($rule_string, $timeout_policy); - $node->setup("system conntrack timeout custom rule $rule"); - $rule_string = $node->rule(); - $timeout_policy = $node->get_policy_command(); #nfct-timeout command string - apply_timeout_policy($rule_string, $timeout_policy); + handle_rule_creation($rule); } elsif ("$rules{$rule}" eq 'changed') { my $node = new Vyatta::Conntrack::RuleCT; $node->setup("system conntrack timeout custom rule $rule"); } elsif ("$rules{$rule}" eq 'deleted') { - my $node = new Vyatta::Conntrack::RuleCT; - my ($rule_string, $timeout_policy); - $node->setupOrig("system conntrack timeout custom rule $rule"); - $rule_string = $node->rule(); - $timeout_policy = $node->get_policy_command(); #nfct-timeout command string - remove_timeout_policy($rule_string, $timeout_policy); + handle_rule_deletion($rule); } } } -- cgit v1.2.3 From 8d658062ead15365b40e144fe5c24a26a1d4a24c Mon Sep 17 00:00:00 2001 From: Gaurav Date: Fri, 24 Feb 2012 15:38:04 -0800 Subject: handle modification, disabled error handling for now as iptables does not support timeout target yet (cherry picked from commit f2a6927d2a500142e71aa098491f9b72c802d418) --- scripts/vyatta-conntrack-timeouts.pl | 40 +++++++++++++++++++++++------------- 1 file changed, 26 insertions(+), 14 deletions(-) diff --git a/scripts/vyatta-conntrack-timeouts.pl b/scripts/vyatta-conntrack-timeouts.pl index 4ea3a9f..ffc66d3 100644 --- a/scripts/vyatta-conntrack-timeouts.pl +++ b/scripts/vyatta-conntrack-timeouts.pl @@ -72,16 +72,19 @@ sub remove_timeout_policy { my $nfct_timeout_cmd = "nfct-timeout remove $timeout_policy"; run_cmd($iptables_cmd2); if ($? >> 8) { - print "$CTERROR failed to run $iptables_cmd2\n"; + # FIXME: as of now, dont print/handle/exit as these always fail in iptables. + #print "$CTERROR failed to run $iptables_cmd2\n"; #dont exit, try to clean as much. } run_cmd($iptables_cmd1); if ($? >> 8) { - print "$CTERROR failed to run $iptables_cmd1\n"; + # FIXME: as of now, dont print/handle/exit as these always fail in iptables. + #print "$CTERROR failed to run $iptables_cmd1\n"; } run_cmd($nfct_timeout_cmd); if ($? >> 8) { - print "$CTERROR failed to run $nfct_timeout_cmd\n"; + # FIXME: as of now, dont print/handle/exit as these always fail in iptables. + #print "$CTERROR failed to run $nfct_timeout_cmd\n"; } } @@ -95,22 +98,25 @@ sub apply_timeout_policy { my $iptables_cmd2 = "iptables -I OUTPUT -t raw $rule_string -j CT --timeout $tokens[0]"; run_cmd($nfct_timeout_cmd); if ($? >> 8) { - print "$CTERROR failed to run $nfct_timeout_cmd\n"; - exit 1; + # FIXME: as of now, dont print/handle/exit as these always fail in iptables. +# print "$CTERROR failed to run $nfct_timeout_cmd\n"; +# exit 1; } run_cmd($iptables_cmd1); if ($? >> 8) { #cleanup the policy before exit. - run_cmd("nfct-timeout remove $timeout_policy"); - print "$CTERROR failed to run $iptables_cmd1\n"; - exit 1; + # FIXME: as of now, dont print/handle/exit as these always fail in iptables. +# run_cmd("nfct-timeout remove $timeout_policy"); +# print "$CTERROR failed to run $iptables_cmd1\n"; +# exit 1; } run_cmd($iptables_cmd2); if ($? >> 8) { - run_cmd("nfct-timeout remove $timeout_policy"); - run_cmd("iptables -D PREROUTING -t raw $rule_string -j CT --timeout $tokens[0]"); - print "$CTERROR failed to run $iptables_cmd2\n"; - exit 1; + # FIXME: as of now, dont print/handle/exit as these always fail in iptables. +# run_cmd("nfct-timeout remove $timeout_policy"); +# run_cmd("iptables -D PREROUTING -t raw $rule_string -j CT --timeout $tokens[0]"); +# print "$CTERROR failed to run $iptables_cmd2\n"; +# exit 1; } } @@ -124,6 +130,13 @@ sub handle_rule_creation { apply_timeout_policy($rule_string, $timeout_policy); } + +sub handle_rule_modification { + my ($rule) = @_; + handle_rule_deletion($rule); + handle_rule_creation($rule); +} + sub handle_rule_deletion { my ($rule) = @_; my $node = new Vyatta::Conntrack::RuleCT; @@ -146,8 +159,7 @@ sub update_config { } elsif ("$rules{$rule}" eq 'added') { handle_rule_creation($rule); } elsif ("$rules{$rule}" eq 'changed') { - my $node = new Vyatta::Conntrack::RuleCT; - $node->setup("system conntrack timeout custom rule $rule"); + handle_rule_modification($rule); } elsif ("$rules{$rule}" eq 'deleted') { handle_rule_deletion($rule); } -- cgit v1.2.3 From a7f35e8c7db79faa471b560d832732e58d8e75ec Mon Sep 17 00:00:00 2001 From: Gaurav Date: Mon, 27 Feb 2012 11:14:14 -0800 Subject: do_protocol_check function, mandates one protocol subtree per rule max (cherry picked from commit c69383c5187f1e702a7146d3762834b70874a344) --- scripts/vyatta-conntrack-timeouts.pl | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/scripts/vyatta-conntrack-timeouts.pl b/scripts/vyatta-conntrack-timeouts.pl index ffc66d3..ce115e0 100644 --- a/scripts/vyatta-conntrack-timeouts.pl +++ b/scripts/vyatta-conntrack-timeouts.pl @@ -124,15 +124,27 @@ sub handle_rule_creation { my ($rule) = @_; my $node = new Vyatta::Conntrack::RuleCT; my ($rule_string, $timeout_policy); + do_protocol_check($rule); $node->setup("system conntrack timeout custom rule $rule"); $rule_string = $node->rule(); $timeout_policy = $node->get_policy_command(); #nfct-timeout command string apply_timeout_policy($rule_string, $timeout_policy); } +# we mandate only one protocol configuration per rule +sub do_protocol_check { + my ($rule) = @_; + my $config = new Vyatta::Config; + my $protocol_nos = $config->listNodes("system conntrack timeout custom rule $rule protocol"); + if ($protocol_nos > 1) { + Vyatta::Config::outputError(["Conntrack"], "Conntrack config error: more than one protocol in rule $rule"); + exit 1; + } +} sub handle_rule_modification { my ($rule) = @_; + do_protocol_check($rule); handle_rule_deletion($rule); handle_rule_creation($rule); } -- cgit v1.2.3 From 86524b38252bfcc4f143247947adbd280d98a222 Mon Sep 17 00:00:00 2001 From: Gaurav Date: Mon, 27 Feb 2012 11:59:10 -0800 Subject: Updated help strings to avoid confusion with global timeouts (cherry picked from commit a9d6f31725efc5fa28af0b9df00b277054a5f45f) --- .../conntrack/timeout/custom/rule/node.tag/protocol/icmp/node.def | 2 +- .../system/conntrack/timeout/custom/rule/node.tag/protocol/node.def | 2 +- .../conntrack/timeout/custom/rule/node.tag/protocol/other/node.def | 2 +- .../timeout/custom/rule/node.tag/protocol/tcp/close-wait/node.def | 2 +- .../conntrack/timeout/custom/rule/node.tag/protocol/tcp/close/node.def | 2 +- .../timeout/custom/rule/node.tag/protocol/tcp/established/node.def | 2 +- .../timeout/custom/rule/node.tag/protocol/tcp/fin-wait/node.def | 2 +- .../timeout/custom/rule/node.tag/protocol/tcp/last-ack/node.def | 2 +- .../system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/node.def | 2 +- .../timeout/custom/rule/node.tag/protocol/tcp/syn-recv/node.def | 2 +- .../timeout/custom/rule/node.tag/protocol/tcp/syn-sent/node.def | 2 +- .../timeout/custom/rule/node.tag/protocol/tcp/time-wait/node.def | 2 +- .../system/conntrack/timeout/custom/rule/node.tag/protocol/udp/node.def | 2 +- .../conntrack/timeout/custom/rule/node.tag/protocol/udp/other/node.def | 2 +- .../conntrack/timeout/custom/rule/node.tag/protocol/udp/stream/node.def | 2 +- 15 files changed, 15 insertions(+), 15 deletions(-) diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/icmp/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/icmp/node.def index 5fd267f..1adf950 100644 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/icmp/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/icmp/node.def @@ -1,6 +1,6 @@ type: u32 -help: ICMP timeout in seconds +help: ICMP timeout for matching flow(s) in seconds val_help: u32:1-21474836; ICMP timeout in seconds diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/node.def index 6fffc43..7f26da6 100644 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/node.def @@ -1,2 +1,2 @@ -help: Customize protocol specific timers +help: Customize protocol specific timers, one protocol configuration per rule diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/other/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/other/node.def index 7a7ae98..09c433f 100644 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/other/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/other/node.def @@ -1,6 +1,6 @@ type: u32 -help: Generic connection timeout in seconds +help: Generic connection timeout for matching flow(s) in seconds val_help: u32:1-21474836; Generic connection timeout in seconds diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/close-wait/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/close-wait/node.def index c8b12d7..a998533 100644 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/close-wait/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/close-wait/node.def @@ -1,6 +1,6 @@ type: u32 -help: TCP CLOSE-WAIT timeout in seconds +help: TCP CLOSE-WAIT timeout for matching flow(s) in seconds val_help: u32:1-21474836; TCP CLOSE-WAIT timeout in seconds diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/close/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/close/node.def index fc6929f..ce41b0f 100644 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/close/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/close/node.def @@ -1,6 +1,6 @@ type: u32 -help: TCP CLOSE timeout in seconds +help: TCP CLOSE timeout for matching flow(s) in seconds val_help: u32:1-21474836; TCP CLOSE timeout in seconds diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/established/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/established/node.def index 9acfd15..6ebaae5 100644 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/established/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/established/node.def @@ -1,6 +1,6 @@ type: u32 -help: TCP ESTABLISHED timeout in seconds +help: TCP ESTABLISHED timeout for matching flow(s) in seconds val_help: u32:1-21474836; TCP ESTABLISHED timeout in seconds diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/fin-wait/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/fin-wait/node.def index f11f16b..1b25e89 100644 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/fin-wait/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/fin-wait/node.def @@ -1,6 +1,6 @@ type: u32 -help: TCP FIN-WAIT timeout in seconds +help: TCP FIN-WAIT timeout for matching flow(s) in seconds val_help: u32:1-21474836; TCP FIN-WAIT timeout in seconds diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/last-ack/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/last-ack/node.def index 1beb31f..3d99efe 100644 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/last-ack/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/last-ack/node.def @@ -1,6 +1,6 @@ type: u32 -help: TCP LAST-ACK timeout in seconds +help: TCP LAST-ACK timeout for matching flow(s) in seconds val_help: u32:1-21474836; TCP LAST-ACK timeout in seconds diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/node.def index 2b67c51..bd0e39c 100644 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/node.def @@ -1 +1 @@ -help: TCP connection timeout options \ No newline at end of file +help: TCP connection per flow timeout options diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/syn-recv/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/syn-recv/node.def index 6d98386..070a185 100644 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/syn-recv/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/syn-recv/node.def @@ -1,6 +1,6 @@ type: u32 -help: TCP SYN-RECEIVED timeout in seconds +help: TCP SYN-RECEIVED timeout for matching flow(s) in seconds val_help: u32:1-21474836; TCP SYN-RECEIVED timeout in seconds diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/syn-sent/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/syn-sent/node.def index c5edde3..87a69e0 100644 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/syn-sent/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/syn-sent/node.def @@ -1,6 +1,6 @@ type: u32 -help: TCP SYN-SENT timeout in seconds +help: TCP SYN-SENT timeout for matching flow(s) in seconds val_help: u32:1-21474836; TCP SYN-SENT timeout in seconds diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/time-wait/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/time-wait/node.def index 1342cc5..ef9ed4f 100644 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/time-wait/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/time-wait/node.def @@ -1,6 +1,6 @@ type: u32 -help: TCP TIME-WAIT timeout in seconds +help: TCP TIME-WAIT timeout for matching flow(s) in seconds val_help: u32:1-21474836; TCP TIME-WAIT timeout in seconds diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/udp/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/udp/node.def index 7ee8fd3..6a1e149 100644 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/udp/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/udp/node.def @@ -1 +1 @@ -help: UDP timeout \ No newline at end of file +help: UDP per flow timeout configuration options diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/udp/other/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/udp/other/node.def index b71294c..3c3e2ec 100644 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/udp/other/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/udp/other/node.def @@ -1,6 +1,6 @@ type: u32 -help: UDP generic timeout in seconds +help: UDP generic timeout for matching flow(s) in seconds val_help: u32:1-21474836; UDP generic timeout in seconds diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/udp/stream/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/udp/stream/node.def index 31830e1..7bb8619 100644 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/udp/stream/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/udp/stream/node.def @@ -1,6 +1,6 @@ type: u32 -help: UDP stream timeout in seconds +help: UDP stream timeout for matching flow(s) in seconds val_help: u32:1-21474836; UDP stream timeout in seconds -- cgit v1.2.3 From 0ce737072a77c6e173df223722b023f529bfb00d Mon Sep 17 00:00:00 2001 From: Gaurav Date: Mon, 27 Feb 2012 13:32:49 -0800 Subject: check presence of protocol config subtree (cherry picked from commit 54ca4cdaa0c665763f6d14d94c3ef16fbdf014ed) --- scripts/vyatta-conntrack-timeouts.pl | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scripts/vyatta-conntrack-timeouts.pl b/scripts/vyatta-conntrack-timeouts.pl index ce115e0..f1aa790 100644 --- a/scripts/vyatta-conntrack-timeouts.pl +++ b/scripts/vyatta-conntrack-timeouts.pl @@ -136,8 +136,8 @@ sub do_protocol_check { my ($rule) = @_; my $config = new Vyatta::Config; my $protocol_nos = $config->listNodes("system conntrack timeout custom rule $rule protocol"); - if ($protocol_nos > 1) { - Vyatta::Config::outputError(["Conntrack"], "Conntrack config error: more than one protocol in rule $rule"); + if (($protocol_nos > 1) or ($protocol_nos < 1)) { + Vyatta::Config::outputError(["Conntrack"], "Conntrack config error: please configure exactly one protocol in rule $rule"); exit 1; } } -- cgit v1.2.3 From 0b89edb15676df97868d853aea1128ab6401f17f Mon Sep 17 00:00:00 2001 From: Gaurav Date: Mon, 27 Feb 2012 14:20:01 -0800 Subject: Using connection instead of flow to refer to 5 tuple in help strings (cherry picked from commit 43bf1c43f253f67ff195b0bd831d6903d2ddcefe) --- templates-cfg/system/conntrack/timeout/custom/node.def | 2 +- .../conntrack/timeout/custom/rule/node.tag/protocol/icmp/node.def | 2 +- .../conntrack/timeout/custom/rule/node.tag/protocol/other/node.def | 2 +- .../timeout/custom/rule/node.tag/protocol/tcp/close-wait/node.def | 2 +- .../conntrack/timeout/custom/rule/node.tag/protocol/tcp/close/node.def | 2 +- .../timeout/custom/rule/node.tag/protocol/tcp/established/node.def | 2 +- .../timeout/custom/rule/node.tag/protocol/tcp/fin-wait/node.def | 2 +- .../timeout/custom/rule/node.tag/protocol/tcp/last-ack/node.def | 2 +- .../system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/node.def | 2 +- .../timeout/custom/rule/node.tag/protocol/tcp/syn-recv/node.def | 2 +- .../timeout/custom/rule/node.tag/protocol/tcp/syn-sent/node.def | 2 +- .../timeout/custom/rule/node.tag/protocol/tcp/time-wait/node.def | 2 +- .../system/conntrack/timeout/custom/rule/node.tag/protocol/udp/node.def | 2 +- .../conntrack/timeout/custom/rule/node.tag/protocol/udp/other/node.def | 2 +- .../conntrack/timeout/custom/rule/node.tag/protocol/udp/stream/node.def | 2 +- 15 files changed, 15 insertions(+), 15 deletions(-) diff --git a/templates-cfg/system/conntrack/timeout/custom/node.def b/templates-cfg/system/conntrack/timeout/custom/node.def index 7967ead..94039fe 100644 --- a/templates-cfg/system/conntrack/timeout/custom/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/node.def @@ -1,4 +1,4 @@ -help: Define custom timeouts per flow +help: Define custom timeouts per connection end: if sudo /opt/vyatta/bin/sudo-users/vyatta-conntrack-timeouts.pl --update 'true'; then if [ ${COMMIT_ACTION} = 'DELETE' ] ; diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/icmp/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/icmp/node.def index 1adf950..16c9224 100644 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/icmp/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/icmp/node.def @@ -1,6 +1,6 @@ type: u32 -help: ICMP timeout for matching flow(s) in seconds +help: ICMP timeout for matching connection(s) in seconds val_help: u32:1-21474836; ICMP timeout in seconds diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/other/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/other/node.def index 09c433f..4d50136 100644 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/other/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/other/node.def @@ -1,6 +1,6 @@ type: u32 -help: Generic connection timeout for matching flow(s) in seconds +help: Generic connection timeout for matching connection(s) in seconds val_help: u32:1-21474836; Generic connection timeout in seconds diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/close-wait/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/close-wait/node.def index a998533..7b9b089 100644 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/close-wait/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/close-wait/node.def @@ -1,6 +1,6 @@ type: u32 -help: TCP CLOSE-WAIT timeout for matching flow(s) in seconds +help: TCP CLOSE-WAIT timeout for matching connection(s) in seconds val_help: u32:1-21474836; TCP CLOSE-WAIT timeout in seconds diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/close/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/close/node.def index ce41b0f..c37bb68 100644 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/close/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/close/node.def @@ -1,6 +1,6 @@ type: u32 -help: TCP CLOSE timeout for matching flow(s) in seconds +help: TCP CLOSE timeout for matching connection(s) in seconds val_help: u32:1-21474836; TCP CLOSE timeout in seconds diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/established/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/established/node.def index 6ebaae5..dfc575d 100644 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/established/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/established/node.def @@ -1,6 +1,6 @@ type: u32 -help: TCP ESTABLISHED timeout for matching flow(s) in seconds +help: TCP ESTABLISHED timeout for matching connection(s) in seconds val_help: u32:1-21474836; TCP ESTABLISHED timeout in seconds diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/fin-wait/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/fin-wait/node.def index 1b25e89..4514d6a 100644 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/fin-wait/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/fin-wait/node.def @@ -1,6 +1,6 @@ type: u32 -help: TCP FIN-WAIT timeout for matching flow(s) in seconds +help: TCP FIN-WAIT timeout for matching connection(s) in seconds val_help: u32:1-21474836; TCP FIN-WAIT timeout in seconds diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/last-ack/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/last-ack/node.def index 3d99efe..5c1cc25 100644 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/last-ack/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/last-ack/node.def @@ -1,6 +1,6 @@ type: u32 -help: TCP LAST-ACK timeout for matching flow(s) in seconds +help: TCP LAST-ACK timeout for matching connection(s) in seconds val_help: u32:1-21474836; TCP LAST-ACK timeout in seconds diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/node.def index bd0e39c..2d58f9c 100644 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/node.def @@ -1 +1 @@ -help: TCP connection per flow timeout options +help: TCP per connection timeout options diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/syn-recv/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/syn-recv/node.def index 070a185..a9c5a57 100644 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/syn-recv/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/syn-recv/node.def @@ -1,6 +1,6 @@ type: u32 -help: TCP SYN-RECEIVED timeout for matching flow(s) in seconds +help: TCP SYN-RECEIVED timeout for matching connection(s) in seconds val_help: u32:1-21474836; TCP SYN-RECEIVED timeout in seconds diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/syn-sent/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/syn-sent/node.def index 87a69e0..af71067 100644 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/syn-sent/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/syn-sent/node.def @@ -1,6 +1,6 @@ type: u32 -help: TCP SYN-SENT timeout for matching flow(s) in seconds +help: TCP SYN-SENT timeout for matching connection(s) in seconds val_help: u32:1-21474836; TCP SYN-SENT timeout in seconds diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/time-wait/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/time-wait/node.def index ef9ed4f..1b85ba1 100644 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/time-wait/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/tcp/time-wait/node.def @@ -1,6 +1,6 @@ type: u32 -help: TCP TIME-WAIT timeout for matching flow(s) in seconds +help: TCP TIME-WAIT timeout for matching connection(s) in seconds val_help: u32:1-21474836; TCP TIME-WAIT timeout in seconds diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/udp/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/udp/node.def index 6a1e149..321f684 100644 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/udp/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/udp/node.def @@ -1 +1 @@ -help: UDP per flow timeout configuration options +help: UDP per connection timeout configuration options diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/udp/other/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/udp/other/node.def index 3c3e2ec..abfdc7e 100644 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/udp/other/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/udp/other/node.def @@ -1,6 +1,6 @@ type: u32 -help: UDP generic timeout for matching flow(s) in seconds +help: UDP generic timeout for matching connection(s) in seconds val_help: u32:1-21474836; UDP generic timeout in seconds diff --git a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/udp/stream/node.def b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/udp/stream/node.def index 7bb8619..431c94a 100644 --- a/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/udp/stream/node.def +++ b/templates-cfg/system/conntrack/timeout/custom/rule/node.tag/protocol/udp/stream/node.def @@ -1,6 +1,6 @@ type: u32 -help: UDP stream timeout for matching flow(s) in seconds +help: UDP stream timeout for matching connection(s) in seconds val_help: u32:1-21474836; UDP stream timeout in seconds -- cgit v1.2.3 From cbc1f51d4de447adf497464ca7b9d44459e867d3 Mon Sep 17 00:00:00 2001 From: Gaurav Date: Wed, 29 Feb 2012 14:02:28 -0800 Subject: changing nfct-timeout to nfct timeout (cherry picked from commit 0cd705236af16e8517b11478366f9fde4ea5c94b) --- scripts/vyatta-conntrack-timeouts.pl | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/scripts/vyatta-conntrack-timeouts.pl b/scripts/vyatta-conntrack-timeouts.pl index f1aa790..ad3f5c0 100644 --- a/scripts/vyatta-conntrack-timeouts.pl +++ b/scripts/vyatta-conntrack-timeouts.pl @@ -69,7 +69,7 @@ sub remove_timeout_policy { # First remove the iptables rules before removing policy. my $iptables_cmd1 = "iptables -D PREROUTING -t raw $rule_string -j CT --timeout $tokens[0]"; my $iptables_cmd2 = "iptables -D OUTPUT -t raw $rule_string -j CT --timeout $tokens[0]"; - my $nfct_timeout_cmd = "nfct-timeout remove $timeout_policy"; + my $nfct_timeout_cmd = "nfct timeout remove $timeout_policy"; run_cmd($iptables_cmd2); if ($? >> 8) { # FIXME: as of now, dont print/handle/exit as these always fail in iptables. @@ -92,7 +92,7 @@ sub remove_timeout_policy { # iptables -I PREROUTING -t raw -s 1.1.1.1 -d 2.2.2.2 -j CT --timeout policy1 sub apply_timeout_policy { my ($rule_string, $timeout_policy) = @_; - my $nfct_timeout_cmd = "nfct-timeout create $timeout_policy"; + my $nfct_timeout_cmd = "nfct timeout create $timeout_policy"; my @tokens = split (' ', $timeout_policy); my $iptables_cmd1 = "iptables -I PREROUTING -t raw $rule_string -j CT --timeout $tokens[0]"; my $iptables_cmd2 = "iptables -I OUTPUT -t raw $rule_string -j CT --timeout $tokens[0]"; @@ -106,14 +106,14 @@ sub apply_timeout_policy { if ($? >> 8) { #cleanup the policy before exit. # FIXME: as of now, dont print/handle/exit as these always fail in iptables. -# run_cmd("nfct-timeout remove $timeout_policy"); +# run_cmd("nfct timeout remove $timeout_policy"); # print "$CTERROR failed to run $iptables_cmd1\n"; # exit 1; } run_cmd($iptables_cmd2); if ($? >> 8) { # FIXME: as of now, dont print/handle/exit as these always fail in iptables. -# run_cmd("nfct-timeout remove $timeout_policy"); +# run_cmd("nfct timeout remove $timeout_policy"); # run_cmd("iptables -D PREROUTING -t raw $rule_string -j CT --timeout $tokens[0]"); # print "$CTERROR failed to run $iptables_cmd2\n"; # exit 1; -- cgit v1.2.3 From b791c5f35b7723c139b83b492dd20406cdd42784 Mon Sep 17 00:00:00 2001 From: Gaurav Date: Thu, 8 Mar 2012 16:50:58 -0800 Subject: use right path of the nfct executable (cherry picked from commit 2a54181a2a4117ecfa681cde22c527e043303607) --- scripts/vyatta-conntrack-timeouts.pl | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/scripts/vyatta-conntrack-timeouts.pl b/scripts/vyatta-conntrack-timeouts.pl index ad3f5c0..24aa4ac 100644 --- a/scripts/vyatta-conntrack-timeouts.pl +++ b/scripts/vyatta-conntrack-timeouts.pl @@ -19,7 +19,7 @@ my $debug_flag = 0; # Enable sending debug output to syslog. my $syslog_flag = 0; - +my $nfct = "/opt/vyatta/sbin/nfct"; my ($create, $delete, $update); my $CTERROR = "Conntrack timeout error:"; GetOptions("create=s" => \$create, @@ -69,7 +69,7 @@ sub remove_timeout_policy { # First remove the iptables rules before removing policy. my $iptables_cmd1 = "iptables -D PREROUTING -t raw $rule_string -j CT --timeout $tokens[0]"; my $iptables_cmd2 = "iptables -D OUTPUT -t raw $rule_string -j CT --timeout $tokens[0]"; - my $nfct_timeout_cmd = "nfct timeout remove $timeout_policy"; + my $nfct_timeout_cmd = "$nfct timeout remove $timeout_policy"; run_cmd($iptables_cmd2); if ($? >> 8) { # FIXME: as of now, dont print/handle/exit as these always fail in iptables. @@ -92,7 +92,7 @@ sub remove_timeout_policy { # iptables -I PREROUTING -t raw -s 1.1.1.1 -d 2.2.2.2 -j CT --timeout policy1 sub apply_timeout_policy { my ($rule_string, $timeout_policy) = @_; - my $nfct_timeout_cmd = "nfct timeout create $timeout_policy"; + my $nfct_timeout_cmd = "$nfct timeout create $timeout_policy"; my @tokens = split (' ', $timeout_policy); my $iptables_cmd1 = "iptables -I PREROUTING -t raw $rule_string -j CT --timeout $tokens[0]"; my $iptables_cmd2 = "iptables -I OUTPUT -t raw $rule_string -j CT --timeout $tokens[0]"; -- cgit v1.2.3 From b4c313d953660b8a70ccfda0b260fd81a6089976 Mon Sep 17 00:00:00 2001 From: Gaurav Sinha Date: Fri, 16 Mar 2012 21:03:51 -0700 Subject: use add instead of create, use inet, pre-pend protocol to iptables rule --- lib/Vyatta/Conntrack/RuleCT.pm | 7 ++++++- scripts/vyatta-conntrack-timeouts.pl | 4 ++-- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/lib/Vyatta/Conntrack/RuleCT.pm b/lib/Vyatta/Conntrack/RuleCT.pm index 9953291..5c59b93 100644 --- a/lib/Vyatta/Conntrack/RuleCT.pm +++ b/lib/Vyatta/Conntrack/RuleCT.pm @@ -74,6 +74,11 @@ sub rule { Vyatta::Config::outputError(["Conntrack"], "Conntrack config error: $err_str"); exit 1; } + if ($self->{_protocol} = "tcp") { + $rule .= " -p tcp"; + } elsif ($self->{_protocol} = "udp") { + $rule .= " -p udp"; + } $rule .= " $srcrule $dstrule "; return $rule; } @@ -181,7 +186,7 @@ sub get_policy_command { my ($self ) = @_; my $command; my @level_nodes = split (' ', $self->{_comment}); - $command .= "policy_$level_nodes[2]_$level_nodes[5]"; + $command .= "policy_$level_nodes[2]_$level_nodes[5] inet"; if ($self->{_protocol} eq 'tcp') { $command .= " tcp"; if ($self->{_tcp}->{_close}) { diff --git a/scripts/vyatta-conntrack-timeouts.pl b/scripts/vyatta-conntrack-timeouts.pl index 24aa4ac..7d0295f 100644 --- a/scripts/vyatta-conntrack-timeouts.pl +++ b/scripts/vyatta-conntrack-timeouts.pl @@ -19,7 +19,7 @@ my $debug_flag = 0; # Enable sending debug output to syslog. my $syslog_flag = 0; -my $nfct = "/opt/vyatta/sbin/nfct"; +my $nfct = "sudo /opt/vyatta/sbin/nfct"; my ($create, $delete, $update); my $CTERROR = "Conntrack timeout error:"; GetOptions("create=s" => \$create, @@ -92,7 +92,7 @@ sub remove_timeout_policy { # iptables -I PREROUTING -t raw -s 1.1.1.1 -d 2.2.2.2 -j CT --timeout policy1 sub apply_timeout_policy { my ($rule_string, $timeout_policy) = @_; - my $nfct_timeout_cmd = "$nfct timeout create $timeout_policy"; + my $nfct_timeout_cmd = "$nfct timeout add $timeout_policy"; my @tokens = split (' ', $timeout_policy); my $iptables_cmd1 = "iptables -I PREROUTING -t raw $rule_string -j CT --timeout $tokens[0]"; my $iptables_cmd2 = "iptables -I OUTPUT -t raw $rule_string -j CT --timeout $tokens[0]"; -- cgit v1.2.3 From ec409015bfa33a4e33b7437f3ce7093c2b58d21a Mon Sep 17 00:00:00 2001 From: Gaurav Sinha Date: Fri, 16 Mar 2012 22:02:44 -0700 Subject: fixed generic timeout, udp stream->replied and other->unreplied, fixed bug with protocol string comparision --- lib/Vyatta/Conntrack/RuleCT.pm | 16 +++++++++------- scripts/vyatta-conntrack-timeouts.pl | 2 +- 2 files changed, 10 insertions(+), 8 deletions(-) diff --git a/lib/Vyatta/Conntrack/RuleCT.pm b/lib/Vyatta/Conntrack/RuleCT.pm index 5c59b93..ee52ce3 100644 --- a/lib/Vyatta/Conntrack/RuleCT.pm +++ b/lib/Vyatta/Conntrack/RuleCT.pm @@ -74,10 +74,14 @@ sub rule { Vyatta::Config::outputError(["Conntrack"], "Conntrack config error: $err_str"); exit 1; } - if ($self->{_protocol} = "tcp") { + if ($self->{_protocol} eq "tcp") { $rule .= " -p tcp"; - } elsif ($self->{_protocol} = "udp") { + } elsif ($self->{_protocol} eq "udp") { $rule .= " -p udp"; + } elsif ($self->{_protocol} eq "icmp") { + $rule .= " -p icmp"; + } elsif ($self->{_protocol} eq "other") { + $rule .= " -p 255"; } $rule .= " $srcrule $dstrule "; return $rule; @@ -135,8 +139,6 @@ sub setup_base { $self->{_other} = $config->$val_func("protocol other"); } - #FIXME: AddressFilter.pm needs a change to accomodate other and - # icmp protocols as it does port checks unconditionally. $src->$addr_setup("$level source"); $src->{_protocol} = $self->{_protocol};#needed to use address filter if ( (($src->{_protocol} eq 'icmp') or ($src->{_protocol} eq 'other')) and (defined($src->{_port})) ) { @@ -216,15 +218,15 @@ sub get_policy_command { } elsif ($self->{_protocol} eq 'udp') { $command .= " udp"; if ($self->{_udp}->{_other}) { - $command .= " other $self->{_udp}->{_other}"; + $command .= " unreplied $self->{_udp}->{_other}"; } if ($self->{_udp}->{_stream}) { - $command .= " stream $self->{_udp}->{_stream}"; + $command .= " replied $self->{_udp}->{_stream}"; } } elsif ($self->{_protocol} eq 'icmp') { $command .= " icmp $self->{_icmp}"; } elsif ($self->{_protocol} eq 'other') { - $command .= " other $self->{_other}"; + $command .= " generic timeout $self->{_other}"; } return $command; } diff --git a/scripts/vyatta-conntrack-timeouts.pl b/scripts/vyatta-conntrack-timeouts.pl index 7d0295f..81e5fff 100644 --- a/scripts/vyatta-conntrack-timeouts.pl +++ b/scripts/vyatta-conntrack-timeouts.pl @@ -69,7 +69,7 @@ sub remove_timeout_policy { # First remove the iptables rules before removing policy. my $iptables_cmd1 = "iptables -D PREROUTING -t raw $rule_string -j CT --timeout $tokens[0]"; my $iptables_cmd2 = "iptables -D OUTPUT -t raw $rule_string -j CT --timeout $tokens[0]"; - my $nfct_timeout_cmd = "$nfct timeout remove $timeout_policy"; + my $nfct_timeout_cmd = "$nfct timeout delete $timeout_policy"; run_cmd($iptables_cmd2); if ($? >> 8) { # FIXME: as of now, dont print/handle/exit as these always fail in iptables. -- cgit v1.2.3 From 0f71f18eaec8643d8f78b95bb1657734b3f5b368 Mon Sep 17 00:00:00 2001 From: Gaurav Sinha Date: Sat, 17 Mar 2012 12:42:05 -0700 Subject: delete nfct fixed, use only policy name, modified deletion function --- lib/Vyatta/Conntrack/RuleCT.pm | 8 ++++++-- scripts/vyatta-conntrack-timeouts.pl | 4 ++-- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/lib/Vyatta/Conntrack/RuleCT.pm b/lib/Vyatta/Conntrack/RuleCT.pm index ee52ce3..bab941e 100644 --- a/lib/Vyatta/Conntrack/RuleCT.pm +++ b/lib/Vyatta/Conntrack/RuleCT.pm @@ -185,10 +185,14 @@ sub print { # return a string that has the nfct-timeout command to create # a timeout policy. sub get_policy_command { - my ($self ) = @_; + my ($self, $is_delete) = @_; my $command; my @level_nodes = split (' ', $self->{_comment}); - $command .= "policy_$level_nodes[2]_$level_nodes[5] inet"; + $command .= "policy_$level_nodes[2]_$level_nodes[5] "; + if ($is_delete eq "delete") { + return $command; + } + $command .= " inet"; if ($self->{_protocol} eq 'tcp') { $command .= " tcp"; if ($self->{_tcp}->{_close}) { diff --git a/scripts/vyatta-conntrack-timeouts.pl b/scripts/vyatta-conntrack-timeouts.pl index 81e5fff..8fe2e39 100644 --- a/scripts/vyatta-conntrack-timeouts.pl +++ b/scripts/vyatta-conntrack-timeouts.pl @@ -127,7 +127,7 @@ sub handle_rule_creation { do_protocol_check($rule); $node->setup("system conntrack timeout custom rule $rule"); $rule_string = $node->rule(); - $timeout_policy = $node->get_policy_command(); #nfct-timeout command string + $timeout_policy = $node->get_policy_command("add"); #nfct-timeout command string apply_timeout_policy($rule_string, $timeout_policy); } @@ -155,7 +155,7 @@ sub handle_rule_deletion { my ($rule_string, $timeout_policy); $node->setupOrig("system conntrack timeout custom rule $rule"); $rule_string = $node->rule(); - $timeout_policy = $node->get_policy_command(); #nfct-timeout command string + $timeout_policy = $node->get_policy_command("delete"); #nfct-timeout command string remove_timeout_policy($rule_string, $timeout_policy); } -- cgit v1.2.3