fixup! WIP on emergency: 7a108d1 Makefile: New target for tracking diversions.

[firewall] / functions.m4

### -*-sh-*-
###
### Utility functions for firewall scripts
###
### (c) 2008 Mark Wooding
###

###----- Licensing notice ---------------------------------------------------
###
### This program is free software; you can redistribute it and/or modify
### it under the terms of the GNU General Public License as published by
### the Free Software Foundation; either version 2 of the License, or
### (at your option) any later version.
###
### This program is distributed in the hope that it will be useful,
### but WITHOUT ANY WARRANTY; without even the implied warranty of
### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
### GNU General Public License for more details.
###
### You should have received a copy of the GNU General Public License
### along with this program; if not, write to the Free Software Foundation,
### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.

m4_divert(20)m4_dnl
###--------------------------------------------------------------------------
### Utility functions.

## doit COMMAND ARGS...
##
## If debugging, print the COMMAND and ARGS.  If serious, execute them.
run () {
  set -e
  if [ "$FW_DEBUG" ]; then echo "* $*"; fi
  if ! [ "$FW_NOACT" ]; then "$@"; fi
}

## trace MESSAGE...
##
## If debugging, print the MESSAGE.
trace () {
  set -e
  if [ "$FW_DEBUG" ]; then echo "$*"; fi
}

## defport NAME NUMBER
##
## Define $port_NAME to be NUMBER.
defport () {
  name=$1 number=$2
  eval port_$name=$number
}

## defproto NAME NUMBER
##
## Define $proto_NAME to be NUMBER.
defproto () {
  name=$1 number=$2
  eval proto_$name=$number
}

m4_divert(38)m4_dnl
###--------------------------------------------------------------------------
### Utility chains (used by function definitions).

m4_divert(22)m4_dnl
###--------------------------------------------------------------------------
### Basic chain constructions.

## ip46tables ARGS ...
##
## Do the same thing for `iptables' and `ip6tables'.
ip46tables () {
  set -e
  iptables "$@"
  ip6tables "$@"
}

## clearchain CHAIN CHAIN ...
##
## Ensure that the named chains exist and are empty.
clearchain () {
  set -e
  for chain; do
    case $chain in
      *:*) table=${chain%:*} chain=${chain#*:} ;;
      *) table=filter ;;
    esac
    run ip46tables -t $table -N $chain 2>/dev/null || :
  done
}

## makeset SET TYPE [PARAMS]
##
## Ensure that the named ipset exists.  Don't clear it.
makeset () {
  set -e
  name=$1; shift
  if ipset -nL | grep -q "^Name: $name$"; then
    :
  else
    ipset -N "$name" "$@"
  fi
}

## errorchain CHAIN ACTION ARGS ...
##
## Make a chain which logs a message and then invokes some other action,
## typically REJECT.  Log messages are prefixed by `fw: CHAIN'.
errorchain () {
  set -e
  chain=$1; shift
  case $chain in
    *:*) table=${chain%:*} chain=${chain#*:} ;;
    *) table=filter ;;
  esac
  clearchain $table:$chain
  run ip46tables -t $table -A $chain -j LOG \
	  -m limit --limit 3/minute --limit-burst 10 \
	  --log-prefix "fw: $chain " --log-level notice
  run ip46tables -t $table -A $chain -j "$@" \
	  -m limit --limit 20/second --limit-burst 100
  run ip46tables -t $table -A $chain -j DROP
}

m4_divert(24)m4_dnl
###--------------------------------------------------------------------------
### Basic option setting.

## setopt OPTION VALUE
##
## Set an IP sysctl.
setopt () {
  set -e
  opt=$1 val=$2
  any=nil
  for ver in ipv4 ipv6; do
    if [ -f /proc/sys/net/$ver/$opt ]; then
      run sysctl -q net/$ver/$opt="$val"
      any=t
    fi
  done
  case $any in
    nil) echo >&2 "$0: unknown IP option $opt"; exit 1 ;;
  esac
}

## setdevopt OPTION VALUE [INTERFACES ...]
##
## Set an IP interface-level sysctl.
setdevopt () {
  set -e
  opt=$1 val=$2; shift 2
  case "$#,$1" in
    0, | 1,all)
      set -- $(
	seen=:
	for ver in ipv4 ipv6; do
	  cd /proc/sys/net/$ver/conf
	  for i in *; do
	    [ -f $i/$opt ] || continue
	    case "$seen" in (*:$i:*) continue ;; esac
	    echo $i
	  done
	done)
      ;;
  esac
  for i in "$@"; do
    any=nil
    for ver in ipv4 ipv6; do
      if [ -f /proc/sys/net/$ver/conf/$i/$opt ]; then
	any=t
	run sysctl -q net/ipv4/conf/$i/$opt="$val"
      fi
    done
    case $any in
      nil) echo >&2 "$0: unknown device option $opt"; exit 1 ;;
    esac
  done
}

m4_divert(26)m4_dnl
###--------------------------------------------------------------------------
### Packet filter construction.

## conntrack CHAIN
##
## Add connection tracking to CHAIN, and allow obvious stuff.
conntrack () {
  set -e
  chain=$1
  run ip46tables -A $chain -p tcp -m state \
	  --state ESTABLISHED,RELATED -j ACCEPT
  run ip46tables -A $chain -p tcp ! --syn -g bad-tcp
}

## commonrules CHAIN
##
## Add standard IP filtering rules to the CHAIN.
commonrules () {
  set -e
  chain=$1

  ## Pass fragments through, assuming that the eventual destination will sort
  ## things out properly.  Except for TCP, that is, which should never be
  ## fragmented.  This is an extra pain for ip6tables, which doesn't provide
  ## a pleasant way to detect non-initial fragments.
  run iptables -A $chain -p tcp -f -g tcp-fragment
  run iptables -A $chain -f -j ACCEPT
  run ip6tables -A $chain -p tcp -g tcp-fragment \
	  -m ipv6header --soft --header frag
  run ip6tables -A $chain -j accept-non-init-frag
}

m4_divert(38)m4_dnl
## Accept a non-initial fragment.  This is only needed by IPv6, to work
## around a deficiency in the option parser.
run ip6tables -N accept-non-init-frag
run ip6tables -A accept-non-init-frag -j RETURN \
	-m frag --fragfirst
run ip6tables -A accept-non-init-frag -j ACCEPT

m4_divert(26)m4_dnl
## allowservices CHAIN PROTO SERVICE ...
##
## Add rules to allow the SERVICES on the CHAIN.
allowservices () {
  set -e
  chain=$1 proto=$2; shift 2
  count=0
  list=
  for svc; do
    case $svc in
      *:*)
	n=2
	left=${svc%:*} right=${svc#*:}
	case $left in *[!0-9]*) eval left=\$port_$left ;; esac
	case $right in *[!0-9]*) eval right=\$port_$right ;; esac
	svc=$left:$right
	;;
      *)
	n=1
	case $svc in *[!0-9]*) eval svc=\$port_$svc ;; esac
	;;
    esac
    case $svc in
      *: | :* | "" | *[!0-9:]*)
	echo >&2 "Bad service name"
	exit 1
	;;
    esac
    count=$(( $count + $n ))
    if [ $count -gt 15 ]; then
      run ip46tables -A $chain -p $proto -m multiport -j ACCEPT \
	     --destination-ports ${list#,}
      list= count=$n
    fi
    list=$list,$svc
  done
  case $list in
    "")
      ;;
    ,*,*)
      run ip46tables -A $chain -p $proto -m multiport -j ACCEPT \
	      --destination-ports ${list#,}
      ;;
    *)
      run ip46tables -A $chain -p $proto -j ACCEPT \
	      --destination-port ${list#,}
      ;;
  esac
}

## ntpclient CHAIN NTPSERVER ...
##
## Add rules to CHAIN to allow NTP with NTPSERVERs.
ntpclient () {
  set -e
  chain=$1; shift
  for ntp; do
    run iptables -A $chain -s $ntp -j ACCEPT \
	    -p udp --source-port 123 --destination-port 123
  done
}

## dnsresolver CHAIN
##
## Add rules to allow CHAIN to be a DNS resolver.
dnsresolver () {
  set -e
  chain=$1
  for p in tcp udp; do
    run ip46tables -A $chain -j ACCEPT \
	     -m state --state ESTABLISHED \
	     -p $p --source-port 53
  done
}

## openports CHAIN [MIN MAX]
##
## Add rules to CHAIN to allow the open ports.
openports () {
  set -e
  chain=$1; shift
  [ $# -eq 0 ] && set -- $open_port_min $open_port_max
  run ip46tables -A $chain -p tcp -g interesting --destination-port $1:$2
  run ip46tables -A $chain -p udp -g interesting --destination-port $1:$2
}

m4_divert(28)m4_dnl
###--------------------------------------------------------------------------
### Packet classification.

## defbitfield NAME WIDTH
##
## Defines MASK_NAME and BIT_NAME symbolic constants for dealing with
## bitfields: x << BIT_NAME yields the value x in the correct position, and
## ff & MASK_NAME extracts the corresponding value.
defbitfield () {
  set -e
  name=$1 width=$2
  eval MASK_$name=$(( (1 << $width) - 1 << $bitindex ))
  eval BIT_$name=$bitindex
  bitindex=$(( $bitindex + $width ))
}

## Define the layout of the bitfield.
bitindex=0
defbitfield MASK 16
defbitfield FROM 4
defbitfield TO 4

## defnetclass NAME FORWARD-TO...
##
## Defines a netclass called NAME, which is allowed to forward to the
## FORWARD-TO netclasses.
##
## For each netclass, constants from_NAME and to_NAME are defined as the
## appropriate values in the FROM and TO fields (i.e., not including any mask
## bits).
##
## This function also establishes mangle chains mark-from-NAME and
## mark-to-NAME for applying the appropriate mark bits to the packet.
##
## Because it needs to resolve forward references, netclasses must be defined
## in a two-pass manner, using a loop of the form
##
##   for pass in 1 2; do netclassindex=0; ...; done
netclassess=
defnetclass () {
  set -e
  name=$1; shift
  case $pass in
    1)

      ## Pass 1.  Establish the from_NAME and to_NAME constants, and the
      ## netclass's mask bit.
      eval from_$name=$(( $netclassindex << $BIT_FROM ))
      eval to_$name=$(( $netclassindex << $BIT_TO ))
      eval _mask_$name=$(( 1 << ($netclassindex + $BIT_MASK) ))
      nets="$nets $name"
      ;;
    2)

      ## Pass 2.  Compute the actual from and to values.  We're a little bit
      ## clever during source classification, and set the TO field to
      ## all-bits-one, so that destination classification needs only a single
      ## AND operation.
      from=$(( ($netclassindex << $BIT_FROM) + (0xf << $BIT_TO) ))
      for net; do
	eval bit=\$_mask_$net
	from=$(( $from + $bit ))
      done
      to=$(( ($netclassindex << $BIT_TO) + \
	     (0xf << $BIT_FROM) + \
	     (1 << ($netclassindex + $BIT_MASK)) ))
      trace "from $name --> set $(printf %x $from)"
      trace "  to $name --> and $(printf %x $from)"

      ## Now establish the mark-from-NAME and mark-to-NAME chains.
      clearchain mangle:mark-from-$name mangle:mark-to-$name
      run ip46tables -t mangle -A mark-from-$name -j MARK --set-mark $from
      run ip46tables -t mangle -A mark-to-$name -j MARK --and-mark $to
      ;;
  esac
  netclassindex=$(( $netclassindex + 1 ))
}

## defiface NAME[,NAME,...] NETCLASS:NETWORK/MASK...
##
## Declares network interfaces with the given NAMEs and associates with them
## a number of reachable networks.  During source classification, a packet
## arriving on interface NAME from an address in NETWORK/MASK is classified
## as coming from to NETCLASS.  During destination classification, all
## packets going to NETWORK/MASK are classified as going to NETCLASS,
## regardless of interface (which is good, because the outgoing interface
## hasn't been determined yet).
##
## As a special case, the NETWORK/MASK can be the string `default', which
## indicates that all addresses not matched elsewhere should be considered.
ifaces=:
defaultifaces=""
allnets= allnets6=
defiface () {
  set -e
  names=$1; shift
  seen=:
  for name in $(echo $names | sed 'y/,/ /'); do
    case $seen in *:"$name":*) continue ;; esac
    seen=$seen$name:
    case $ifaces in
      *:"$name":*) ;;
      *)
	clearchain mangle:in-$name
	run ip46tables -t mangle -A in-classify -i $name -g in-$name
	;;
    esac
    ifaces=$ifaces$name:
    for item; do
      netclass=${item%:*} addr=${item#*:}
      case $addr in
	default)
	  case "$defaultifaces,$defaultclass" in
	    ,* | *,$netclass)
	      defaultifaces="$defaultifaces $name"
	      defaultclass=$netclass
	      ;;
	    *)
	      echo >&2 "$0: inconsistent default netclasses"
	      exit 1
	      ;;
	  esac
	  ;;
	*:*)
	  run ip6tables -t mangle -A in-$name -g mark-from-$netclass \
		-s $addr
	  run ip6tables -t mangle -A out-classify -g mark-to-$netclass \
		-d $addr
	  allnets6="$allnets6 $name:$addr"
	  ;;
	*)
	  run iptables -t mangle -A in-$name -g mark-from-$netclass \
		-s $addr
	  run iptables -t mangle -A out-classify -g mark-to-$netclass \
		-d $addr
	  allnets="$allnets $name:$addr"
	  ;;
      esac
    done
  done
}

## defvpn IFACE CLASS NET HOST:ADDR ...
##
## Defines a VPN interface.  If the interface has the form `ROOT+' (i.e., a
## netfilter wildcard) then define a separate interface ROOTHOST routing to
## ADDR; otherwise just write a blanket rule allowing the whole NET.  All
## addresses concerned are put in the named CLASS.
defvpn () {
  set -e
  iface=$1 class=$2 net=$3; shift 3
  case $iface in
    *-+)
      root=${iface%+}
      for host; do
	name=${host%%:*} addr=${host#*:}
	defiface $root$name $class:$addr
      done
      ;;
    *)
      defiface $iface $class:$net
      ;;
  esac
}

m4_divert(-1)
###----- That's all, folks --------------------------------------------------