3 ### Utility functions for firewall scripts
5 ### (c) 2008 Mark Wooding
8 ###----- Licensing notice ---------------------------------------------------
10 ### This program is free software; you can redistribute it and/or modify
11 ### it under the terms of the GNU General Public License as published by
12 ### the Free Software Foundation; either version 2 of the License, or
13 ### (at your option) any later version.
15 ### This program is distributed in the hope that it will be useful,
16 ### but WITHOUT ANY WARRANTY; without even the implied warranty of
17 ### MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 ### GNU General Public License for more details.
20 ### You should have received a copy of the GNU General Public License
21 ### along with this program; if not, write to the Free Software Foundation,
22 ### Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
25 ###--------------------------------------------------------------------------
26 ### Utility functions.
28 ## doit COMMAND ARGS...
30 ## If debugging, print the COMMAND and ARGS. If serious, execute them.
33 if [ "$FW_DEBUG" ]; then echo "* $*"; fi
34 if ! [ "$FW_NOACT" ]; then "$@"; fi
39 ## If debugging, print the MESSAGE.
42 if [ "$FW_DEBUG" ]; then echo "$*"; fi
45 ## defport NAME NUMBER
47 ## Define $port_NAME to be NUMBER.
50 eval port_$name=$number
53 ## defproto NAME NUMBER
55 ## Define $proto_NAME to be NUMBER.
58 eval proto_$name=$number
63 ## Adds WORD to the value of the shell variable VAR, if it's not there
64 ## already. Words are separated by a single space; no leading or trailing
65 ## spaces are introduced.
71 *) eval "$var=\${$var:+\$val }\$word" ;;
76 ###--------------------------------------------------------------------------
77 ### Utility chains (used by function definitions).
80 ###--------------------------------------------------------------------------
81 ### Basic chain constructions.
83 ## ip46tables ARGS ...
85 ## Do the same thing for `iptables' and `ip6tables'.
92 ## clearchain CHAIN CHAIN ...
94 ## Ensure that the named chains exist and are empty.
99 *:*) table=${chain%:*} chain=${chain#*:} ;;
102 run ip46tables -t $table -N $chain 2>/dev/null || :
106 ## makeset SET TYPE [PARAMS]
108 ## Ensure that the named ipset exists. Don't clear it.
112 if ipset -nL | grep -q "^Name: $name$"; then
115 ipset -N "$name" "$@"
119 ## errorchain CHAIN ACTION ARGS ...
121 ## Make a chain which logs a message and then invokes some other action,
122 ## typically REJECT. Log messages are prefixed by `fw: CHAIN'.
127 *:*) table=${chain%:*} chain=${chain#*:} ;;
130 clearchain $table:$chain
131 run ip46tables -t $table -A $chain -j LOG \
132 -m limit --limit 3/minute --limit-burst 10 \
133 --log-prefix "fw: $chain " --log-level notice
134 run ip46tables -t $table -A $chain -j "$@" \
135 -m limit --limit 20/second --limit-burst 100
136 run ip46tables -t $table -A $chain -j DROP
140 ###--------------------------------------------------------------------------
141 ### Basic option setting.
143 ## setopt OPTION VALUE
150 for ver in ipv4 ipv6; do
151 if [ -f /proc/sys/net/$ver/$opt ]; then
152 run sysctl -q net/$ver/$opt="$val"
157 nil) echo >&2 "$0: unknown IP option $opt"; exit 1 ;;
161 ## setdevopt OPTION VALUE [INTERFACES ...]
163 ## Set an IP interface-level sysctl.
166 opt=$1 val=$2; shift 2
171 for ver in ipv4 ipv6; do
172 cd /proc/sys/net/$ver/conf
174 [ -f $i/$opt ] || continue
175 case "$seen" in (*:$i:*) continue ;; esac
183 for ver in ipv4 ipv6; do
184 if [ -f /proc/sys/net/$ver/conf/$i/$opt ]; then
186 run sysctl -q net/ipv4/conf/$i/$opt="$val"
190 nil) echo >&2 "$0: unknown device option $opt"; exit 1 ;;
196 ###--------------------------------------------------------------------------
197 ### Packet filter construction.
201 ## Add connection tracking to CHAIN, and allow obvious stuff.
205 run ip46tables -A $chain -p tcp -m state \
206 --state ESTABLISHED,RELATED -j ACCEPT
207 run ip46tables -A $chain -p tcp ! --syn -g bad-tcp
212 ## Add standard IP filtering rules to the CHAIN.
217 ## Pass fragments through, assuming that the eventual destination will sort
218 ## things out properly. Except for TCP, that is, which should never be
219 ## fragmented. This is an extra pain for ip6tables, which doesn't provide
220 ## a pleasant way to detect non-initial fragments.
221 run iptables -A $chain -p tcp -f -g tcp-fragment
222 run iptables -A $chain -f -j ACCEPT
223 run ip6tables -A $chain -p tcp -g tcp-fragment \
224 -m ipv6header --soft --header frag
225 run ip6tables -A $chain -j accept-non-init-frag
229 ## Accept a non-initial fragment. This is only needed by IPv6, to work
230 ## around a deficiency in the option parser.
231 run ip6tables -N accept-non-init-frag
232 run ip6tables -A accept-non-init-frag -j RETURN \
234 run ip6tables -A accept-non-init-frag -j ACCEPT
237 ## allowservices CHAIN PROTO SERVICE ...
239 ## Add rules to allow the SERVICES on the CHAIN.
242 chain=$1 proto=$2; shift 2
249 left=${svc%:*} right=${svc#*:}
250 case $left in *[!0-9]*) eval left=\$port_$left ;; esac
251 case $right in *[!0-9]*) eval right=\$port_$right ;; esac
256 case $svc in *[!0-9]*) eval svc=\$port_$svc ;; esac
260 *: | :* | "" | *[!0-9:]*)
261 echo >&2 "Bad service name"
265 count=$(( $count + $n ))
266 if [ $count -gt 15 ]; then
267 run ip46tables -A $chain -p $proto -m multiport -j ACCEPT \
268 --destination-ports ${list#,}
277 run ip46tables -A $chain -p $proto -m multiport -j ACCEPT \
278 --destination-ports ${list#,}
281 run ip46tables -A $chain -p $proto -j ACCEPT \
282 --destination-port ${list#,}
287 ## ntpclient CHAIN NTPSERVER ...
289 ## Add rules to CHAIN to allow NTP with NTPSERVERs.
294 clearchain ntp-servers
295 for ntp; do run iptables -A ntp-servers -j ACCEPT -s $ntp; done
296 run iptables -A $ntpchain -j ntp-servers \
297 -p udp --source-port 123 --destination-port 123
302 ## Add rules to allow CHAIN to be a DNS resolver.
307 run ip46tables -A $chain -j ACCEPT \
308 -m state --state ESTABLISHED \
309 -p $p --source-port 53
313 ## openports CHAIN [MIN MAX]
315 ## Add rules to CHAIN to allow the open ports.
319 [ $# -eq 0 ] && set -- $open_port_min $open_port_max
320 run ip46tables -A $chain -p tcp -g interesting --destination-port $1:$2
321 run ip46tables -A $chain -p udp -g interesting --destination-port $1:$2
325 ###--------------------------------------------------------------------------
326 ### Packet classification.
328 ### See `classify.m4' for an explanation of how the firewall machinery for
329 ### packet classification works.
331 ### A list of all network names is kept in `allnets'. For each network NET,
332 ### shell variables are defined describing their properties.
334 ### net_class_NET The class of the network, as defined by
336 ### net_inet_NET List of IPv4 address ranges in the network.
337 ### net_inet6_NET List of IPv6 address ranges in the network.
338 ### net_fwd_NET List of other networks that this one forwards to.
339 ### net_hosts_NET List of hosts known to be in the network.
340 ### host_inet_HOST IPv4 address of the named HOST.
341 ### host_inet6_HOST IPv6 address of the named HOST.
343 ### Similarly, a list of hosts is kept in `allhosts', and for each host HOST,
344 ### a shell variables are defined:
346 ### host_ifaces_HOST List of interfaces for this host and the networks
347 ### they attach to, in the form IFACE=NET.
349 ## defbitfield NAME WIDTH
351 ## Defines MASK_NAME and BIT_NAME symbolic constants for dealing with
352 ## bitfields: x << BIT_NAME yields the value x in the correct position, and
353 ## ff & MASK_NAME extracts the corresponding value.
357 eval MASK_$name=$(( (1 << $width) - 1 << $bitindex ))
358 eval BIT_$name=$bitindex
359 bitindex=$(( $bitindex + $width ))
362 ## Define the layout of the bitfield.
368 ## defnetclass NAME FORWARD-TO...
370 ## Defines a netclass called NAME, which is allowed to forward to the
371 ## FORWARD-TO netclasses.
373 ## For each netclass, constants from_NAME and to_NAME are defined as the
374 ## appropriate values in the FROM and TO fields (i.e., not including any mask
377 ## This function also establishes mangle chains mark-from-NAME and
378 ## mark-to-NAME for applying the appropriate mark bits to the packet.
380 ## Because it needs to resolve forward references, netclasses must be defined
381 ## in a two-pass manner, using a loop of the form
383 ## for pass in 1 2; do netclassindex=0; ...; done
391 ## Pass 1. Establish the from_NAME and to_NAME constants, and the
392 ## netclass's mask bit.
393 trace "netclass $name = $netclassindex"
394 eval from_$name=$(( $netclassindex << $BIT_FROM ))
395 eval to_$name=$(( $netclassindex << $BIT_TO ))
396 eval _mask_$name=$(( 1 << ($netclassindex + $BIT_MASK) ))
401 ## Pass 2. Compute the actual from and to values. We're a little bit
402 ## clever during source classification, and set the TO field to
403 ## all-bits-one, so that destination classification needs only a single
405 from=$(( ($netclassindex << $BIT_FROM) + (0xf << $BIT_TO) ))
407 eval bit=\$_mask_$net
408 from=$(( $from + $bit ))
410 to=$(( ($netclassindex << $BIT_TO) + \
411 (0xf << $BIT_FROM) + \
412 (1 << ($netclassindex + $BIT_MASK)) ))
413 trace "from $name --> set $(printf %x $from)"
414 trace " to $name --> and $(printf %x $from)"
416 ## Now establish the mark-from-NAME and mark-to-NAME chains.
417 clearchain mangle:mark-from-$name mangle:mark-to-$name
418 run ip46tables -t mangle -A mark-from-$name -j MARK --set-mark $from
419 run ip46tables -t mangle -A mark-to-$name -j MARK --and-mark $to
422 netclassindex=$(( $netclassindex + 1 ))
427 ## Define a network. Follow by calls to `addr', `forwards', etc. to define
428 ## properties of the network. Networks are processed in order, so if their
429 ## addresses overlap then the more specific addresses should be defined
434 eval net_class_$1=\$class
437 ## addr ADDRESS/LEN ...
439 ## Define addresses for the network being defined. ADDRESSes are in
440 ## colon-separated IPv6 or dotted-quad IPv4 form.
444 *:*) addword net_inet6_$net $i ;;
445 *) addword net_inet_$net $i ;;
452 ## Declare that packets from this network are forwarded to the other NETs.
454 eval "net_fwd_$net=\"$*\""
459 ## Declare that packets from this network must not be forwarded to the other
462 eval "net_noxit_$net=\"$*\""
465 ## host HOST ADDR ...
467 ## Define the address of an individual host on the current network. The
468 ## ADDRs may be full IPv4 or IPv6 addresses, or offsets from the containing
469 ## network address, which is a simple number for IPv4, or a suffix beginning
470 ## with `::' for IPv6. If an IPv6 base address is provided for the network
471 ## but not for the host then the host's IPv4 address is used as a suffix.
475 ## Work out which addresses we've actually been given.
478 case "$i" in ::*) a6=$i ;; *) a=$i ;; esac
482 *) echo >&2 "$0: no address for $name"; exit 1 ;;
484 case "${a6+t}" in t) ;; *) a6=::$a ;; esac
486 ## Work out the IPv4 address.
487 eval nn=\$net_inet_$net
492 case $a in *.*) aa=$a ;; *) aa=$base.$(( $offset + $a )) ;; esac
493 eval host_inet_$name=$aa
496 ## Work out the IPv6 address.
497 eval nn=\$net_inet6_$net
501 case $a6 in ::*) aa=$base$a6 ;; *) aa=$a6 ;; esac
502 eval host_inet6_$name=$aa
505 ## Remember the host in the list.
506 addword net_hosts_$net $name
511 ## Define a new host. Follow by calls to `iface' to define the host's
515 addword allhosts $host
516 eval host_type_$host=endsys
521 ## Declare the host to be a router, so it should forward packets and so on.
523 eval host_type_$host=router
526 ## iface IFACE NET ...
528 ## Define a host's interfaces. Specifically, declares that the host has an
529 ## interface IFACE attached to the listed NETs.
533 addword host_ifaces_$host $name=$net
537 ## net_interfaces HOST NET
539 ## Determine the interfaces on which packets may plausibly arrive from the
540 ## named NET. Returns `-' if no such interface exists.
542 ## This algorithm is not very clever. It's just about barely good enough to
543 ## deduce transitivity through a simple routed network; with complicated
544 ## networks, it will undoubtedly give wrong answers. Check the results
545 ## carefully, and, if necessary, list the connectivity explicitly; use the
546 ## special interface `-' for networks you know shouldn't send packets to a
551 ## Determine the locally attached networks.
553 eval ii=\$host_ifaces_$host
554 for i in $ii; do targets=$targets$i:; done
556 ## Determine the transitivity.
561 ## First pass. Determine whether any of the networks we're considering
562 ## are in the target set. If they are, then return the corresponding
571 n=${tg%=$net:*}; tg=${n%:*}:; n=${n##*:}
576 case $any in nil) break ;; esac
579 case "$found" in ?*) echo $found; return ;; esac
581 ## No joy. Determine the set of networks which (a) these ones can
582 ## forward to, and (b) that we've not considered already. These are the
583 ## nets we'll consider next time around.
587 eval fwd=\$net_fwd_$net
589 case $seen in *":$n:"*) continue ;; esac
591 eval noxit=\$net_noxit_$n
592 case " $noxit " in *" $startnet "*) continue ;; esac
593 case " $nextnets " in
595 *) addword nextnets $n; any=t ;;
600 ## If we've run out of networks then there's no reachability. Return a
602 case $any in nil) echo -; return ;; esac
608 ###----- That's all, folks --------------------------------------------------