]>
Commit | Line | Data |
---|---|---|
98146c00 MT |
1 | #!/bin/bash |
2 | ############################################################################### | |
3 | # # | |
4 | # IPFire.org - A linux based firewall # | |
5 | # Copyright (C) 2012 IPFire Network Development Team # | |
6 | # # | |
7 | # This program is free software: you can redistribute it and/or modify # | |
8 | # it under the terms of the GNU General Public License as published by # | |
9 | # the Free Software Foundation, either version 3 of the License, or # | |
10 | # (at your option) any later version. # | |
11 | # # | |
12 | # This program is distributed in the hope that it will be useful, # | |
13 | # but WITHOUT ANY WARRANTY; without even the implied warranty of # | |
14 | # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # | |
15 | # GNU General Public License for more details. # | |
16 | # # | |
17 | # You should have received a copy of the GNU General Public License # | |
18 | # along with this program. If not, see <http://www.gnu.org/licenses/>. # | |
19 | # # | |
20 | ############################################################################### | |
21 | ||
22 | # High-level function which will create a ruleset for the current firewall | |
23 | # configuration and load it into the kernel. | |
24 | function firewall_start() { | |
afb7d704 MT |
25 | # Test mode. |
26 | local test="false" | |
27 | ||
28 | while [ $# -gt 0 ]; do | |
29 | case "${1}" in | |
30 | --test) | |
31 | test="true" | |
32 | ;; | |
33 | esac | |
34 | shift | |
35 | done | |
36 | ||
37 | if enabled test; then | |
38 | log INFO "Test mode enabled." | |
39 | log INFO "The firewall ruleset will not be loaded." | |
40 | fi | |
41 | ||
98146c00 MT |
42 | firewall_lock_acquire |
43 | ||
44 | # Initialize an empty iptables ruleset. | |
45 | iptables_init DROP | |
46 | ||
47 | # Add default chains. | |
48 | firewall_tcp_state_flags | |
49 | firewall_connection_tracking | |
c2d2d2a9 | 50 | firewall_tcp_clamp_mss |
98146c00 MT |
51 | |
52 | # Add policies for every zone. | |
53 | policy_add_localhost | |
54 | ||
55 | local zone | |
56 | for zone in $(zones_get_all); do | |
57 | policy_add_zone ${zone} | |
58 | done | |
59 | ||
afb7d704 MT |
60 | # Load the new ruleset. |
61 | iptables_load ${test} | |
98146c00 MT |
62 | |
63 | firewall_lock_release | |
64 | } | |
65 | ||
66 | function firewall_stop() { | |
67 | firewall_lock_acquire | |
68 | ||
69 | # Initialize an empty firewall ruleset | |
70 | # with default policy ACCEPT. | |
71 | iptables_init ACCEPT | |
72 | ||
afb7d704 MT |
73 | # Load it. |
74 | iptables_load | |
75 | ||
76 | firewall_lock_release | |
77 | } | |
78 | ||
79 | function firewall_show() { | |
80 | # Shows the ruleset that is currently loaded. | |
81 | iptables_status | |
82 | ||
83 | return ${EXIT_OK} | |
84 | } | |
85 | ||
86 | function firewall_panic() { | |
87 | local admin_hosts="$@" | |
88 | ||
89 | firewall_lock_acquire | |
90 | ||
91 | # Drop all communications. | |
92 | iptables_init DROP | |
93 | ||
94 | # If an admin host is provided, some administrative | |
95 | # things will be allowed from there. | |
96 | local admin_host | |
97 | for admin_host in ${admin_hosts}; do | |
98 | iptables -A INPUT -s ${admin_host} -j ACCEPT | |
99 | iptables -A OUTPUT -d ${admin_host} -j ACCEPT | |
100 | done | |
101 | ||
102 | # Load it. | |
103 | iptables_load | |
98146c00 MT |
104 | |
105 | firewall_lock_release | |
106 | } | |
107 | ||
108 | function firewall_lock_acquire() { | |
109 | lock_acquire ${RUN_DIR}/.firewall_lock | |
110 | ||
111 | # Make sure the lock is released after the firewall | |
112 | # script has crashed or exited early. | |
113 | trap firewall_lock_release EXIT TERM KILL | |
114 | ||
115 | # Create a directory where we can put our | |
116 | # temporary data in the most secure way as possible. | |
117 | IPTABLES_TMPDIR=$(mktemp -d) | |
118 | } | |
119 | ||
120 | function firewall_lock_release() { | |
121 | if isset IPTABLES_TMPDIR; then | |
122 | # Remove all temporary data. | |
123 | rm -rf ${IPTABLES_TMPDIR} | |
124 | ||
125 | # Reset the tempdir variable. | |
126 | IPTABLES_TMPDIR= | |
127 | fi | |
128 | ||
129 | # Reset the trap. | |
130 | trap true EXIT TERM KILL | |
131 | ||
132 | lock_release ${RUN_DIR}/.firewall_lock | |
133 | } | |
134 | ||
135 | function firewall_tcp_state_flags() { | |
136 | log INFO "Creating TCP State Flags chain..." | |
137 | iptables_chain_create BADTCP_LOG | |
138 | iptables -A BADTCP_LOG -p tcp -j $(iptables_LOG "Illegal TCP state: ") | |
139 | iptables -A BADTCP_LOG -j DROP | |
140 | ||
141 | iptables_chain_create BADTCP | |
142 | iptables -A BADTCP -p tcp --tcp-flags ALL NONE -j BADTCP_LOG | |
143 | iptables -A BADTCP -p tcp --tcp-flags SYN,FIN SYN,FIN -j BADTCP_LOG | |
144 | iptables -A BADTCP -p tcp --tcp-flags SYN,RST SYN,RST -j BADTCP_LOG | |
145 | iptables -A BADTCP -p tcp --tcp-flags FIN,RST FIN,RST -j BADTCP_LOG | |
146 | iptables -A BADTCP -p tcp --tcp-flags ACK,FIN FIN -j BADTCP_LOG | |
147 | iptables -A BADTCP -p tcp --tcp-flags ACK,PSH PSH -j BADTCP_LOG | |
148 | iptables -A BADTCP -p tcp --tcp-flags ACK,URG URG -j BADTCP_LOG | |
149 | ||
150 | iptables -A INPUT -p tcp -j BADTCP | |
151 | iptables -A OUTPUT -p tcp -j BADTCP | |
152 | iptables -A FORWARD -p tcp -j BADTCP | |
153 | } | |
154 | ||
c2d2d2a9 | 155 | function firewall_tcp_clamp_mss() { |
fc323fc4 MT |
156 | # Do nothing if this has been disabled. |
157 | enabled FIREWALL_CLAMP_PATH_MTU || return ${EXIT_OK} | |
158 | ||
c2d2d2a9 MT |
159 | log DEBUG "Adding rules to clamp MSS to path MTU..." |
160 | iptables -t mangle -A FORWARD \ | |
161 | -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu | |
162 | } | |
163 | ||
98146c00 MT |
164 | function firewall_connection_tracking() { |
165 | log INFO "Creating Connection Tracking chain..." | |
166 | iptables_chain_create CONNTRACK | |
167 | iptables -A CONNTRACK -m state --state ESTABLISHED,RELATED -j ACCEPT | |
168 | iptables -A CONNTRACK -m state --state INVALID -j $(iptables_LOG "INVALID packet: ") | |
169 | iptables -A CONNTRACK -m state --state INVALID -j DROP | |
170 | ||
171 | iptables -A INPUT -j CONNTRACK | |
172 | iptables -A OUTPUT -j CONNTRACK | |
173 | iptables -A FORWARD -j CONNTRACK | |
174 | } | |
3647b19f | 175 | |
afb7d704 | 176 | function firewall_import_rules() { |
3647b19f MT |
177 | local zone=${1} |
178 | shift | |
179 | ||
180 | local protocol="ipv6" | |
afb7d704 | 181 | local table="filter" |
3647b19f MT |
182 | |
183 | while [ $# -gt 0 ]; do | |
184 | case "${1}" in | |
afb7d704 MT |
185 | --table=*) |
186 | table=$(cli_get_val ${1}) | |
3647b19f MT |
187 | ;; |
188 | --protocol=*) | |
189 | protocol=$(cli_get_val ${1}) | |
190 | ;; | |
191 | esac | |
192 | done | |
193 | ||
194 | assert isoneof protocol ipv4 ipv6 | |
afb7d704 | 195 | assert isoneof table $(iptables_table ${protocol}) |
3647b19f MT |
196 | |
197 | # XXX TODO | |
198 | ||
199 | local src dst proto | |
200 | while read src dst proto; do | |
201 | case "${chain}" in | |
202 | filter) | |
203 | ;; | |
204 | nat) | |
205 | ;; | |
206 | esac | |
afb7d704 | 207 | done < ${FIREWALL_CONFIG_RULES} |
3647b19f | 208 | } |