3 ### Utility functions for firewall scripts
5 ### (c) 2008 Mark Wooding
8 ###----- Licensing notice ---------------------------------------------------
10 ### This program is free software; you can redistribute it and/or modify
11 ### it under the terms of the GNU General Public License as published by
12 ### the Free Software Foundation; either version 2 of the License, or
13 ### (at your option) any later version.
15 ### This program is distributed in the hope that it will be useful,
16 ### but WITHOUT ANY WARRANTY; without even the implied warranty of
17 ### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 ### GNU General Public License for more details.
20 ### You should have received a copy of the GNU General Public License
21 ### along with this program; if not, write to the Free Software Foundation,
22 ### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
25 ###--------------------------------------------------------------------------
26 ### Utility functions.
28 ## doit COMMAND ARGS...
30 ## If debugging, print the COMMAND and ARGS. If serious, execute them.
33 if [ "$FW_DEBUG" ]; then echo "* $*"; fi
34 if ! [ "$FW_NOACT" ]; then "$@"; fi
39 ## If debugging, print the MESSAGE.
42 if [ "$FW_DEBUG" ]; then echo "$*"; fi
45 ## defport NAME NUMBER
47 ## Define $port_NAME to be NUMBER.
50 eval port_$name=$number
53 ## defproto NAME NUMBER
55 ## Define $proto_NAME to be NUMBER.
58 eval proto_$name=$number
62 ###--------------------------------------------------------------------------
63 ### Utility chains (used by function definitions).
66 ###--------------------------------------------------------------------------
67 ### Basic chain constructions.
69 ## ip46tables ARGS ...
71 ## Do the same thing for `iptables' and `ip6tables'.
78 ## clearchain CHAIN CHAIN ...
80 ## Ensure that the named chains exist and are empty.
85 *:*) table=${chain%:*} chain=${chain#*:} ;;
88 run ip46tables -t $table -N $chain 2>/dev/null || :
92 ## makeset SET TYPE [PARAMS]
94 ## Ensure that the named ipset exists. Don't clear it.
98 if ipset -nL | grep -q "^Name: $name$"; then
101 ipset -N "$name" "$@"
105 ## errorchain CHAIN ACTION ARGS ...
107 ## Make a chain which logs a message and then invokes some other action,
108 ## typically REJECT. Log messages are prefixed by `fw: CHAIN'.
113 *:*) table=${chain%:*} chain=${chain#*:} ;;
116 clearchain $table:$chain
117 run ip46tables -t $table -A $chain -j LOG \
118 -m limit --limit 3/minute --limit-burst 10 \
119 --log-prefix "fw: $chain " --log-level notice
120 run ip46tables -t $table -A $chain -j "$@" \
121 -m limit --limit 20/second --limit-burst 100
122 run ip46tables -t $table -A $chain -j DROP
126 ###--------------------------------------------------------------------------
127 ### Basic option setting.
129 ## setopt OPTION VALUE
136 for ver in ipv4 ipv6; do
137 if [ -f /proc/sys/net/$ver/$opt ]; then
138 run sysctl -q net/$ver/$opt="$val"
143 nil) echo >&2 "$0: unknown IP option $opt"; exit 1 ;;
147 ## setdevopt OPTION VALUE [INTERFACES ...]
149 ## Set an IP interface-level sysctl.
152 opt=$1 val=$2; shift 2
157 for ver in ipv4 ipv6; do
158 cd /proc/sys/net/$ver/conf
160 [ -f $i/$opt ] || continue
161 case "$seen" in (*:$i:*) continue ;; esac
169 for ver in ipv4 ipv6; do
170 if [ -f /proc/sys/net/$ver/conf/$i/$opt ]; then
172 run sysctl -q net/ipv4/conf/$i/$opt="$val"
176 nil) echo >&2 "$0: unknown device option $opt"; exit 1 ;;
182 ###--------------------------------------------------------------------------
183 ### Packet filter construction.
187 ## Add connection tracking to CHAIN, and allow obvious stuff.
191 run ip46tables -A $chain -p tcp -m state \
192 --state ESTABLISHED,RELATED -j ACCEPT
193 run ip46tables -A $chain -p tcp ! --syn -g bad-tcp
198 ## Add standard IP filtering rules to the CHAIN.
203 ## Pass fragments through, assuming that the eventual destination will sort
204 ## things out properly. Except for TCP, that is, which should never be
205 ## fragmented. This is an extra pain for ip6tables, which doesn't provide
206 ## a pleasant way to detect non-initial fragments.
207 run iptables -A $chain -p tcp -f -g tcp-fragment
208 run iptables -A $chain -f -j ACCEPT
209 run ip6tables -A $chain -p tcp -g tcp-fragment \
210 -m ipv6header --soft --header frag
211 run ip6tables -A $chain -j accept-non-init-frag
215 ## Accept a non-initial fragment. This is only needed by IPv6, to work
216 ## around a deficiency in the option parser.
217 run ip6tables -N accept-non-init-frag
218 run ip6tables -A accept-non-init-frag -j RETURN \
220 run ip6tables -A accept-non-init-frag -j ACCEPT
223 ## allowservices CHAIN PROTO SERVICE ...
225 ## Add rules to allow the SERVICES on the CHAIN.
228 chain=$1 proto=$2; shift 2
235 left=${svc%:*} right=${svc#*:}
236 case $left in *[!0-9]*) eval left=\$port_$left ;; esac
237 case $right in *[!0-9]*) eval right=\$port_$right ;; esac
242 case $svc in *[!0-9]*) eval svc=\$port_$svc ;; esac
246 *: | :* | "" | *[!0-9:]*)
247 echo >&2 "Bad service name"
251 count=$(( $count + $n ))
252 if [ $count -gt 15 ]; then
253 run ip46tables -A $chain -p $proto -m multiport -j ACCEPT \
254 --destination-ports ${list#,}
263 run ip46tables -A $chain -p $proto -m multiport -j ACCEPT \
264 --destination-ports ${list#,}
267 run ip46tables -A $chain -p $proto -j ACCEPT \
268 --destination-port ${list#,}
273 ## ntpclient CHAIN NTPSERVER ...
275 ## Add rules to CHAIN to allow NTP with NTPSERVERs.
280 run iptables -A $chain -s $ntp -j ACCEPT \
281 -p udp --source-port 123 --destination-port 123
287 ## Add rules to allow CHAIN to be a DNS resolver.
292 run ip46tables -A $chain -j ACCEPT \
293 -m state --state ESTABLISHED \
294 -p $p --source-port 53
298 ## openports CHAIN [MIN MAX]
300 ## Add rules to CHAIN to allow the open ports.
304 [ $# -eq 0 ] && set -- $open_port_min $open_port_max
305 run ip46tables -A $chain -p tcp -g interesting --destination-port $1:$2
306 run ip46tables -A $chain -p udp -g interesting --destination-port $1:$2
310 ###--------------------------------------------------------------------------
311 ### Packet classification.
313 ## defbitfield NAME WIDTH
315 ## Defines MASK_NAME and BIT_NAME symbolic constants for dealing with
316 ## bitfields: x << BIT_NAME yields the value x in the correct position, and
317 ## ff & MASK_NAME extracts the corresponding value.
321 eval MASK_$name=$(( (1 << $width) - 1 << $bitindex ))
322 eval BIT_$name=$bitindex
323 bitindex=$(( $bitindex + $width ))
326 ## Define the layout of the bitfield.
332 ## defnetclass NAME FORWARD-TO...
334 ## Defines a netclass called NAME, which is allowed to forward to the
335 ## FORWARD-TO netclasses.
337 ## For each netclass, constants from_NAME and to_NAME are defined as the
338 ## appropriate values in the FROM and TO fields (i.e., not including any mask
341 ## This function also establishes mangle chains mark-from-NAME and
342 ## mark-to-NAME for applying the appropriate mark bits to the packet.
344 ## Because it needs to resolve forward references, netclasses must be defined
345 ## in a two-pass manner, using a loop of the form
347 ## for pass in 1 2; do netclassindex=0; ...; done
355 ## Pass 1. Establish the from_NAME and to_NAME constants, and the
356 ## netclass's mask bit.
357 eval from_$name=$(( $netclassindex << $BIT_FROM ))
358 eval to_$name=$(( $netclassindex << $BIT_TO ))
359 eval _mask_$name=$(( 1 << ($netclassindex + $BIT_MASK) ))
364 ## Pass 2. Compute the actual from and to values. We're a little bit
365 ## clever during source classification, and set the TO field to
366 ## all-bits-one, so that destination classification needs only a single
368 from=$(( ($netclassindex << $BIT_FROM) + (0xf << $BIT_TO) ))
370 eval bit=\$_mask_$net
371 from=$(( $from + $bit ))
373 to=$(( ($netclassindex << $BIT_TO) + \
374 (0xf << $BIT_FROM) + \
375 (1 << ($netclassindex + $BIT_MASK)) ))
376 trace "from $name --> set $(printf %x $from)"
377 trace " to $name --> and $(printf %x $from)"
379 ## Now establish the mark-from-NAME and mark-to-NAME chains.
380 clearchain mangle:mark-from-$name mangle:mark-to-$name
381 run ip46tables -t mangle -A mark-from-$name -j MARK --set-mark $from
382 run ip46tables -t mangle -A mark-to-$name -j MARK --and-mark $to
385 netclassindex=$(( $netclassindex + 1 ))
388 ## defiface NAME[,NAME,...] NETCLASS:NETWORK/MASK...
390 ## Declares network interfaces with the given NAMEs and associates with them
391 ## a number of reachable networks. During source classification, a packet
392 ## arriving on interface NAME from an address in NETWORK/MASK is classified
393 ## as coming from to NETCLASS. During destination classification, all
394 ## packets going to NETWORK/MASK are classified as going to NETCLASS,
395 ## regardless of interface (which is good, because the outgoing interface
396 ## hasn't been determined yet).
398 ## As a special case, the NETWORK/MASK can be the string `default', which
399 ## indicates that all addresses not matched elsewhere should be considered.
407 for name in $(echo $names | sed 'y/,/ /'); do
408 case $seen in *:"$name":*) continue ;; esac
413 clearchain mangle:in-$name
414 run ip46tables -t mangle -A in-classify -i $name -g in-$name
419 netclass=${item%:*} addr=${item#*:}
422 case "$defaultifaces,$defaultclass" in
424 defaultifaces="$defaultifaces $name"
425 defaultclass=$netclass
428 echo >&2 "$0: inconsistent default netclasses"
434 run ip6tables -t mangle -A in-$name -g mark-from-$netclass \
436 run ip6tables -t mangle -A out-classify -g mark-to-$netclass \
438 allnets6="$allnets6 $name:$addr"
441 run iptables -t mangle -A in-$name -g mark-from-$netclass \
443 run iptables -t mangle -A out-classify -g mark-to-$netclass \
445 allnets="$allnets $name:$addr"
452 ## defvpn IFACE CLASS NET HOST:ADDR ...
454 ## Defines a VPN interface. If the interface has the form `ROOT+' (i.e., a
455 ## netfilter wildcard) then define a separate interface ROOTHOST routing to
456 ## ADDR; otherwise just write a blanket rule allowing the whole NET. All
457 ## addresses concerned are put in the named CLASS.
460 iface=$1 class=$2 net=$3; shift 3
465 name=${host%%:*} addr=${host#*:}
466 defiface $root$name $class:$addr
470 defiface $iface $class:$net
476 ###----- That's all, folks --------------------------------------------------