3 ### Utility functions for firewall scripts
5 ### (c) 2008 Mark Wooding
8 ###----- Licensing notice ---------------------------------------------------
10 ### This program is free software; you can redistribute it and/or modify
11 ### it under the terms of the GNU General Public License as published by
12 ### the Free Software Foundation; either version 2 of the License, or
13 ### (at your option) any later version.
15 ### This program is distributed in the hope that it will be useful,
16 ### but WITHOUT ANY WARRANTY; without even the implied warranty of
17 ### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 ### GNU General Public License for more details.
20 ### You should have received a copy of the GNU General Public License
21 ### along with this program; if not, write to the Free Software Foundation,
22 ### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
25 ###--------------------------------------------------------------------------
26 ### Utility functions.
28 ## doit COMMAND ARGS...
30 ## If debugging, print the COMMAND and ARGS. If serious, execute them.
33 if [ "$FW_DEBUG" ]; then echo "* $*"; fi
34 if ! [ "$FW_NOACT" ]; then "$@"; fi
39 ## If debugging, print the MESSAGE.
42 if [ "$FW_DEBUG" ]; then echo "$*"; fi
45 ## defport NAME NUMBER
47 ## Define $port_NAME to be NUMBER.
50 eval port_$name=$number
53 ## defproto NAME NUMBER
55 ## Define $proto_NAME to be NUMBER.
58 eval proto_$name=$number
63 ## Adds WORD to the value of the shell variable VAR, if it's not there
64 ## already. Words are separated by a single space; no leading or trailing
65 ## spaces are introduced.
71 *) eval "$var=\${$var:+\$val }\$word" ;;
76 ###--------------------------------------------------------------------------
77 ### Utility chains (used by function definitions).
80 ###--------------------------------------------------------------------------
81 ### Basic chain constructions.
83 ## ip46tables ARGS ...
85 ## Do the same thing for `iptables' and `ip6tables'.
92 ## clearchain CHAIN CHAIN ...
94 ## Ensure that the named chains exist and are empty.
99 *:*) table=${_chain%:*} _chain=${_chain#*:} ;;
102 run ip46tables -t $table -N $_chain 2>/dev/null || :
106 ## makeset SET TYPE [PARAMS]
108 ## Ensure that the named ipset exists. Don't clear it.
116 if ipset -nL | grep -q "^Name: $name\$"; then createp=nil; fi
119 if ipset -n -L | grep -q "^$name\$"; then createp=nil; fi
123 t) ipset -N "$name" "$@" ;;
127 ## errorchain CHAIN ACTION ARGS ...
129 ## Make a chain which logs a message and then invokes some other action,
130 ## typically REJECT. Log messages are prefixed by `fw: CHAIN'.
135 *:*) table=${chain%:*} chain=${chain#*:} ;;
138 clearchain $table:$chain
139 run ip46tables -t $table -A $chain -j LOG \
140 -m limit --limit 3/minute --limit-burst 10 \
141 --log-prefix "fw: $chain " --log-level notice || :
142 run ip46tables -t $table -A $chain -j "$@" \
143 -m limit --limit 20/second --limit-burst 100
144 run ip46tables -t $table -A $chain -j DROP
148 ###--------------------------------------------------------------------------
149 ### Basic option setting.
151 ## setopt OPTION VALUE
158 for ver in ipv4 ipv6; do
159 if [ -f /proc/sys/net/$ver/$opt ]; then
160 run sysctl -q net/$ver/$opt="$val"
165 nil) echo >&2 "$0: unknown IP option $opt"; exit 1 ;;
169 ## setdevopt OPTION VALUE [INTERFACES ...]
171 ## Set an IP interface-level sysctl.
174 opt=$1 val=$2; shift 2
179 for ver in ipv4 ipv6; do
180 cd /proc/sys/net/$ver/conf
182 [ -f $i/$opt ] || continue
183 case "$seen" in (*:$i:*) continue ;; esac
191 for ver in ipv4 ipv6; do
192 if [ -f /proc/sys/net/$ver/conf/$i/$opt ]; then
194 run sysctl -q net/$ver/conf/$i/$opt="$val"
198 nil) echo >&2 "$0: unknown device option $opt"; exit 1 ;;
204 ###--------------------------------------------------------------------------
205 ### Packet filter construction.
209 ## Add connection tracking to CHAIN, and allow obvious stuff.
213 run ip46tables -A $chain -p tcp -m state \
214 --state ESTABLISHED,RELATED -j ACCEPT
215 run ip46tables -A $chain -p tcp ! --syn -g bad-tcp
220 ## Add standard IP filtering rules to the CHAIN.
225 ## Pass fragments through, assuming that the eventual destination will sort
226 ## things out properly. Except for TCP, that is, which should never be
227 ## fragmented. This is an extra pain for ip6tables, which doesn't provide
228 ## a pleasant way to detect non-initial fragments.
229 run iptables -A $chain -p tcp -f -g tcp-fragment
230 run iptables -A $chain -f -j ACCEPT
231 run ip6tables -A $chain -p tcp -g tcp-fragment \
232 -m ipv6header --soft --header frag
233 run ip6tables -A $chain -j accept-non-init-frag
237 ## Accept a non-initial fragment. This is only needed by IPv6, to work
238 ## around a deficiency in the option parser.
239 run ip6tables -N accept-non-init-frag
240 run ip6tables -A accept-non-init-frag -j RETURN \
242 run ip6tables -A accept-non-init-frag -j ACCEPT \
243 -m ipv6header --header frag
246 ## allowservices CHAIN PROTO SERVICE ...
248 ## Add rules to allow the SERVICES on the CHAIN.
251 chain=$1 proto=$2; shift 2
258 left=${svc%:*} right=${svc#*:}
259 case $left in *[!0-9]*) eval left=\$port_$left ;; esac
260 case $right in *[!0-9]*) eval right=\$port_$right ;; esac
265 case $svc in *[!0-9]*) eval svc=\$port_$svc ;; esac
269 *: | :* | "" | *[!0-9:]*)
270 echo >&2 "Bad service name"
274 count=$(( $count + $n ))
275 if [ $count -gt 15 ]; then
276 run ip46tables -A $chain -p $proto -m multiport -j ACCEPT \
277 --destination-ports ${list#,}
286 run ip46tables -A $chain -p $proto -m multiport -j ACCEPT \
287 --destination-ports ${list#,}
290 run ip46tables -A $chain -p $proto -j ACCEPT \
291 --destination-port ${list#,}
296 ## ntpclient CHAIN NTPSERVER ...
298 ## Add rules to CHAIN to allow NTP with NTPSERVERs.
303 clearchain ntp-servers
305 case $ntp in *:*) ipt=ip6tables ;; *) ipt=iptables ;; esac
306 run $ipt -A ntp-servers -j ACCEPT -s $ntp;
308 run ip46tables -A $ntpchain -j ntp-servers \
309 -p udp --source-port 123 --destination-port 123
314 ## Add rules to allow CHAIN to be a DNS resolver.
319 run ip46tables -A $chain -j ACCEPT \
320 -m state --state ESTABLISHED \
321 -p $p --source-port 53
327 ## Add rules to allow CHAIN to be a DNS server.
332 ## Allow TCP access. Hitting us with SYNs will make us deploy SYN cookies,
333 ## but that's tolerable.
334 run ip46tables -A $chain -j ACCEPT -p tcp --destination-port 53
336 ## Avoid being a DDoS amplifier by rate-limiting incoming DNS queries.
337 clearchain $chain-udp-dns
338 run ip46tables -A $chain-udp-dns -j ACCEPT \
339 -m limit --limit 20/second --limit-burst 300
340 run ip46tables -A $chain-udp-dns -g dns-rate-limit
341 run ip46tables -A $chain -j $chain-udp-dns \
342 -p udp --destination-port 53
345 ## openports CHAIN [MIN MAX]
347 ## Add rules to CHAIN to allow the open ports.
351 [ $# -eq 0 ] && set -- $open_port_min $open_port_max
352 run ip46tables -A $chain -p tcp -g interesting --destination-port $1:$2
353 run ip46tables -A $chain -p udp -g interesting --destination-port $1:$2
358 ipv=$1 ifname=$2; shift 2
359 ## Add rules for BCP38 egress filtering for IP version IPV (either 4 or 6).
360 ## IFNAME is the outgoing interface; the remaining arguments are network
363 ## Sort out which command we're using
367 *) echo >&2 "Unknown IP version $ipv"; exit 1 ;;
370 ## If we've not set up the error chain then do that.
373 errorchain bcp38 DROP
374 clearchain bcp38-check
375 ip46tables -A bcp38-check -g bcp38
379 ## Stitch our egress filter into the outbound chains if we haven't done
380 ## that yet. Do this for both IP versions: if we're only ever given
381 ## IPv6 addresses for a particular interface then we assume that IPv4
382 ## packets aren't allowed on it at all.
386 run ip46tables -A OUTPUT -j bcp38-check -o $ifname
388 1) run ip46tables -A FORWARD -j bcp38-check -o $ifname ;;
390 bcp38_setup=$bcp38_setup$ifname:
394 ## Finally, add in our allowed networks.
396 run $ipt -I bcp38-check -j RETURN -s $i
401 ###--------------------------------------------------------------------------
402 ### Packet classification.
404 ### See `classify.m4' for an explanation of how the firewall machinery for
405 ### packet classification works.
407 ### A list of all network names is kept in `allnets'. For each network NET,
408 ### shell variables are defined describing their properties.
410 ### net_class_NET The class of the network, as defined by
412 ### net_inet_NET List of IPv4 address ranges in the network.
413 ### net_inet6_NET List of IPv6 address ranges in the network.
414 ### net_via_NET List of other networks that this one forwards via.
415 ### net_hosts_NET List of hosts known to be in the network.
416 ### host_inet_HOST IPv4 address of the named HOST.
417 ### host_inet6_HOST IPv6 address of the named HOST.
419 ### Similarly, a list of hosts is kept in `allhosts', and for each host HOST,
420 ### a shell variables are defined:
422 ### host_ifaces_HOST List of interfaces for this host and the networks
423 ### they attach to, in the form IFACE=NET.
425 ## defbitfield NAME WIDTH
427 ## Defines MASK_NAME and BIT_NAME symbolic constants for dealing with
428 ## bitfields: x << BIT_NAME yields the value x in the correct position, and
429 ## ff & MASK_NAME extracts the corresponding value.
433 eval MASK_$name=$(( (1 << $width) - 1 << $bitindex ))
434 eval BIT_$name=$bitindex
435 bitindex=$(( $bitindex + $width ))
438 ## Define the layout of the bitfield.
444 ## defnetclass NAME FORWARD-TO...
446 ## Defines a netclass called NAME, which is allowed to forward to the
447 ## FORWARD-TO netclasses.
449 ## For each netclass, constants from_NAME and to_NAME are defined as the
450 ## appropriate values in the FROM and TO fields (i.e., not including any mask
453 ## This function also establishes mangle chains mark-from-NAME and
454 ## mark-to-NAME for applying the appropriate mark bits to the packet.
456 ## Because it needs to resolve forward references, netclasses must be defined
457 ## in a two-pass manner, using a loop of the form
459 ## for pass in 1 2; do netclassindex=0; ...; done
467 ## Pass 1. Establish the from_NAME and to_NAME constants, and the
468 ## netclass's mask bit.
469 trace "netclass $name = $netclassindex"
470 eval from_$name=$(( $netclassindex << $BIT_FROM ))
471 eval to_$name=$(( $netclassindex << $BIT_TO ))
472 eval fwd_$name=$(( 1 << ($netclassindex + $BIT_MASK) ))
477 ## Pass 2. Compute the actual from and to values. This is fiddly:
478 ## we want to preserve the other flags.
479 from=$(( ($netclassindex << $BIT_FROM) ))
480 frommask=$(( $MASK_FROM | $MASK_MASK ))
483 from=$(( $from + $bit ))
485 to=$(( ($netclassindex << $BIT_TO) ))
486 tomask=$(( $MASK_TO | $MASK_MASK ^ (1 << ($netclassindex + $BIT_MASK)) ))
487 trace "from $name --> set $(printf %08x/%08x $from $frommask)"
488 trace " to $name --> set $(printf %08x/%08x $to $tomask)"
490 ## Now establish the mark-from-NAME and mark-to-NAME chains.
491 clearchain mangle:mark-from-$name mangle:mark-to-$name
492 run ip46tables -t mangle -A mark-from-$name -j MARK \
493 --set-xmark $from/$frommask
494 run ip46tables -t mangle -A mark-to-$name -j MARK \
495 --set-xmark $to/$tomask
498 netclassindex=$(( $netclassindex + 1 ))
503 ## Define a network. Follow by calls to `addr', `via', etc. to define
504 ## properties of the network. Networks are processed in order, so if their
505 ## addresses overlap then the more specific addresses should be defined
510 eval net_class_$1=\$class
513 ## addr ADDRESS/LEN ...
515 ## Define addresses for the network being defined. ADDRESSes are in
516 ## colon-separated IPv6 or dotted-quad IPv4 form.
520 *:*) addword net_inet6_$net $i ;;
521 *) addword net_inet_$net $i ;;
528 ## Declare that packets from this network are forwarded to the other NETs.
530 eval "net_via_$net=\"$*\""
535 ## Declare that packets from this network must not be forwarded to the other
538 eval "net_noxit_$net=\"$*\""
541 ## host HOST ADDR ...
543 ## Define the address of an individual host on the current network. The
544 ## ADDRs may be full IPv4 or IPv6 addresses, or offsets from the containing
545 ## network address, which is a simple number for IPv4, or a suffix beginning
546 ## with `::' for IPv6. If an IPv6 base address is provided for the network
547 ## but not for the host then the host's IPv4 address is used as a suffix.
551 ## Work out which addresses we've actually been given.
554 case "$i" in ::*) a6=$i ;; *) a=$i ;; esac
558 *) echo >&2 "$0: no address for $name"; exit 1 ;;
560 case "${a6+t}" in t) ;; *) a6=::$a ;; esac
562 ## Work out the IPv4 address.
563 eval nn=\$net_inet_$net
568 case $a in *.*) aa=$a ;; *) aa=$base.$(( $offset + $a )) ;; esac
569 eval host_inet_$name=$aa
572 ## Work out the IPv6 address.
573 eval nn=\$net_inet6_$net
577 case $a6 in ::*) aa=$base$a6 ;; *) aa=$a6 ;; esac
578 eval host_inet6_$name=$aa
581 ## Remember the host in the list.
582 addword net_hosts_$net $name
587 ## Define a new host. Follow by calls to `iface' to define the host's
591 addword allhosts $host
592 eval host_type_$host=server
597 ## Declare the host to have the given type.
601 router | server | client) ;;
602 *) echo >&2 "$0: bad host type \`$type'"; exit 1 ;;
604 eval host_type_$host=$type
607 ## iface IFACE NET ...
609 ## Define a host's interfaces. Specifically, declares that the host has an
610 ## interface IFACE attached to the listed NETs.
614 addword host_ifaces_$host $name=$net
618 ## matchnets OPT WIN FLAGS PREPARE BASE SUFFIX NEXT NET [NET ...]
620 ## Build rules which match a particular collection of networks.
622 ## Specifically, use the address-comparison operator OPT (typically `-s' or
623 ## `-d') to match the addresses of each NET, writing the rules to the chain
624 ## BASESUFFIX. If we find a match, dispatch to WIN-CLASS, where CLASS is the
625 ## class of the matching network. In order to deal with networks containing
626 ## negative address ranges, more chains may need to be constructed; they will
627 ## be named BASE#Q for sequence numbers Q starting with NEXT. All of this
628 ## happens on the `mangle' table, and there isn't (currently) a way to tweak
631 ## The FLAGS gather additional interesting information about the job,
632 ## separated by colons. The only flag currently is :default: which means
633 ## that the default network was listed.
635 ## Finally, there is a hook PREPARE which is called just in advance of
636 ## processing the final network, passing it the argument FLAGS. (The PREPARE
637 ## string will be subjected to shell word-splitting, so it can provide some
638 ## arguments of its own if it wants.) It should set `mode' to indicate how
639 ## the chain should be finished.
641 ## goto If no networks matched, then issue a final `goto' to the
642 ## chain named by the variable `fail'.
644 ## call Run `$finish CHAIN' to write final rules to the named CHAIN
645 ## (which may be suffixed from the original BASE argument if
646 ## this was necessary). This function will arrange to call
647 ## these rules if no networks match.
649 ## ret If no network matches then return (maybe by falling off the
650 ## end of the chain).
652 local opt win flags prepare base suffix next net lose splitp
653 opt=$1 win=$2 flags=$3 prepare=$4 base=$5 suffix=$6 next=$7 net=$8
656 ## If this is the default network, then set the flag.
657 case "$net" in default) flags=${flags}default: ;; esac
659 ## Do an initial pass over the addresses to see whether there are any
660 ## negative ranges. If so, we'll need to split. See also the standard
663 eval "addrs=\"\$net_inet_$net \$net_inet6_$net\""
664 for a in $addrs; do case $a in !*) splitp=t; break ;; esac; done
666 trace "MATCHNETS [splitp $splitp] $opt $win $flags [$prepare] $base $suffix $next : $net $*"
668 ## Work out how to handle matches against negative address ranges. If this
669 ## is the last network, invoke the PREPARE hook to find out. Otherwise, if
670 ## we have to split the chain, recursively build the target here.
674 case $splitp,$mode in
682 clearchain mangle:$base#$next
683 lose="-g $base#$next"
690 clearchain mangle:$base#$next
691 matchnets $opt $win $flags "$prepare" \
692 $base \#$next $(( $next + 1 )) "$@"
693 lose="-g $base#$next" mode=goto
700 ## Populate the chain with rules to match the necessary networks.
701 eval addr=\$net_inet_$net addr6=\$net_inet6_$net class=\$net_class_$net
704 !*) run iptables -t mangle -A $base$suffix $lose $opt ${a#!} ;;
705 *) run iptables -t mangle -A $base$suffix -g $win-$class $opt $a ;;
710 !*) run ip6tables -t mangle -A $base$suffix $lose $opt ${a#!} ;;
711 *) run ip6tables -t mangle -A $base$suffix -g $win-$class $opt $a ;;
715 ## Wrap up the chain appropriately. If we didn't split and there are more
716 ## networks to handle then append the necessary rules now. (If we did
717 ## split, then we already wrote the rules for them above.) If there are no
718 ## more networks then consult the `mode' setting to find out what to do.
719 case $splitp,$#,$mode in
721 *,*,goto) run ip46tables -t mangle -A $base$suffix $lose ;;
722 t,0,call) $finish $base#$next ;;
723 nil,0,call) $finish $base$suffix ;;
725 matchnets $opt $win $flags "$prepare" $base "$suffix" $next "$@"
730 ## net_interfaces HOST NET
732 ## Determine the interfaces on which packets may plausibly arrive from the
733 ## named NET. Returns `-' if no such interface exists.
735 ## This algorithm is not very clever. It's just about barely good enough to
736 ## deduce transitivity through a simple routed network; with complicated
737 ## networks, it will undoubtedly give wrong answers. Check the results
738 ## carefully, and, if necessary, list the connectivity explicitly; use the
739 ## special interface `-' for networks you know shouldn't send packets to a
744 ## Determine the locally attached networks.
746 eval ii=\$host_ifaces_$host
747 for i in $ii; do targets=$targets$i:; done
749 ## Determine the transitivity.
754 ## First pass. Determine whether any of the networks we're considering
755 ## are in the target set. If they are, then return the corresponding
764 n=${tg%=$net:*}; tg=${n%:*}:; n=${n##*:}
769 case $any in nil) break ;; esac
772 case "$found" in ?*) echo $found; return ;; esac
774 ## No joy. Determine the set of networks which (a) these ones can
775 ## forward to, and (b) that we've not considered already. These are the
776 ## nets we'll consider next time around.
780 eval via=\$net_via_$net
782 case $seen in *":$n:"*) continue ;; esac
784 eval noxit=\$net_noxit_$n
785 case " $noxit " in *" $startnet "*) continue ;; esac
786 case " $nextnets " in
788 *) addword nextnets $n; any=t ;;
793 ## If we've run out of networks then there's no reachability. Return a
795 case $any in nil) echo -; return ;; esac
801 ###----- That's all, folks --------------------------------------------------