onkelbeh/fwbuilder
1
0
Fork 0
mirror of https://github.com/fwbuilder/fwbuilder synced 2026-09-12 16:13:13 +02:00
Code Issues Releases Wiki Activity

see #939 Add backup ssh access rule to the "stop" section of generated iptables script. this adds the rule, still need to add GUI control to make it optional

Browse Source
This commit is contained in:
Vadim Kurland
2009-12-18 23:10:53 +00:00
parent b6dfff6fb0
commit 73b4e92d4f
10 changed files with 191 additions and 143 deletions
Download Patch File Download Diff File Expand all files Collapse all files
build_num
+1 -1
View File
@@ -1 +1 @@
#define BUILD_NUM 2196
#define BUILD_NUM 2197
src/compiler_lib/CompilerDriver.h
+2 -1
View File
@@ -32,6 +32,7 @@
#include <string>
#include <sstream>
#include <memory>
#include <QDir>
#include <QTextStream>
@@ -133,7 +134,7 @@ protected:
Configlet *script_skeleton,
Configlet *top_comment,
const QString &comment_char);
public:
CompilerDriver(libfwbuilder::FWObjectDatabase *db);
src/iptlib/CompilerDriver_ipt.cpp
+32
View File
@@ -27,6 +27,8 @@
#include "Configlet.h"
#include "CompilerDriver_ipt.h"
#include "PolicyCompiler_ipt.h"
#include "PolicyCompiler_secuwall.h"
#include "fwbuilder/Resources.h"
#include "fwbuilder/FWObjectDatabase.h"
@@ -177,4 +179,34 @@ string CompilerDriver_ipt::dumpScript(Firewall *fw,
return res.str();
}
std::auto_ptr<PolicyCompiler_ipt> CompilerDriver_ipt::createPolicyCompiler(
Firewall *fw,
bool ipv6_policy,
OSConfigurator *oscnf,
std::map<const std::string, bool> *minus_n_commands_filter)
{
string platform = fw->getStr("platform");
string platform_family = Resources::platform_res[platform]->
getResourceStr("/FWBuilderResources/Target/family");
std::auto_ptr<PolicyCompiler_ipt> policy_compiler;
if (fw->getStr("host_OS") == "secuwall") {
policy_compiler = std::auto_ptr<PolicyCompiler_ipt>(
new PolicyCompiler_secuwall(objdb,fw, ipv6_policy, oscnf,
minus_n_commands_filter));
} else {
policy_compiler = std::auto_ptr<PolicyCompiler_ipt>(
new PolicyCompiler_ipt(objdb,fw, ipv6_policy, oscnf,
minus_n_commands_filter));
}
if (policy_compiler.get()==NULL)
abort("Unrecognized firewall platform " +
fw->getStr("platform") +
" (family " + platform_family+")");
return policy_compiler;
}
src/iptlib/CompilerDriver_ipt.h
+7
View File
@@ -28,6 +28,7 @@
#include "../compiler_lib/CompilerDriver.h"
#include "PolicyCompiler_ipt.h"
#include "OSConfigurator_linux24.h"
#include <string>
@@ -65,6 +66,12 @@ namespace fwcompiler {
// or "POSTROUTING"
std::map<std::string, std::list<std::string> > branch_ruleset_to_chain_mapping;
std::auto_ptr<PolicyCompiler_ipt> createPolicyCompiler(
libfwbuilder::Firewall *fw,
bool ipv6_policy,
fwcompiler::OSConfigurator *_oscnf,
std::map<const std::string, bool> *m_n_commands_map);
public:
CompilerDriver_ipt(libfwbuilder::FWObjectDatabase *db);
src/iptlib/CompilerDriver_ipt_policy.cpp
+7 -23
View File
@@ -177,28 +177,8 @@ bool CompilerDriver_ipt::processPolicyRuleSet(
}
}
std::auto_ptr<PolicyCompiler_ipt> policy_compiler;
if (fw->getStr("host_OS") == "secuwall") {
policy_compiler = std::auto_ptr<PolicyCompiler_ipt>(
new PolicyCompiler_secuwall(objdb,fw, ipv6_policy, oscnf,
&minus_n_commands_filter));
} else {
policy_compiler = std::auto_ptr<PolicyCompiler_ipt>(
new PolicyCompiler_ipt(objdb,fw, ipv6_policy, oscnf,
&minus_n_commands_filter));
}
if (policy_compiler.get()==NULL)
abort("Unrecognized firewall platform " +
fw->getStr("platform") +
" (family " + platform_family+")");
if (!policy->isTop())
policy_compiler->registerRuleSetChain(branch_name);
policy_compiler->setSourceRuleSet( policy );
policy_compiler->setRuleSetName(branch_name);
std::auto_ptr<PolicyCompiler_ipt> policy_compiler = createPolicyCompiler(
fw, ipv6_policy, oscnf, &minus_n_commands_filter);
policy_compiler->setSingleRuleCompileMode(single_rule_id);
policy_compiler->setDebugLevel( dl );
@@ -207,7 +187,11 @@ bool CompilerDriver_ipt::processPolicyRuleSet(
policy_compiler->setHaveDynamicInterfaces(have_dynamic_interfaces);
if (inTestMode()) policy_compiler->setTestMode();
if (inEmbeddedMode()) policy_compiler->setEmbeddedMode();
if (!policy->isTop()) policy_compiler->registerRuleSetChain(branch_name);
policy_compiler->setSourceRuleSet( policy );
policy_compiler->setRuleSetName(branch_name);
if ( (policy_rules_count=policy_compiler->prolog()) > 0 )
{
policy_compiler->compile();
src/iptlib/CompilerDriver_ipt_run.cpp
+10
View File
@@ -603,6 +603,16 @@ string CompilerDriver_ipt::run(const std::string &cluster_id,
script_buffer = "";
Configlet stop_action(fw, "linux24", "stop_action");
stop_action.collapseEmptyStrings(true);
std::auto_ptr<PolicyCompiler_ipt> policy_compiler = createPolicyCompiler(
fw, false, NULL, NULL);
PolicyCompiler_ipt::PrintRule* print_rule =
policy_compiler->createPrintRuleProcessor();
print_rule->setContext(policy_compiler.get());
print_rule->_printBackupSSHAccessRules(&stop_action);
script_skeleton.setVariable("stop_action", stop_action.expand());
Configlet top_comment(fw, "linux24", "top_comment");
src/iptlib/PolicyCompiler_PrintRule.cpp
+50 -41
View File
@@ -1605,47 +1605,7 @@ string PolicyCompiler_ipt::PrintRule::_printOptionalGlobalRules()
compiler->getCachedFwOpt()->getBool("accept_established") &&
ipt_comp->my_table=="filter");
if ( compiler->getCachedFwOpt()->getBool("mgmt_ssh") &&
! compiler->getCachedFwOpt()->getStr("mgmt_addr").empty() )
{
string addr_str = compiler->getCachedFwOpt()->getStr("mgmt_addr");
InetAddrMask *inet_addr = NULL;
bool addr_is_good = true;
if (isIPv6)
{
// check if given address is ipv6
try
{
inet_addr = new Inet6AddrMask(addr_str);
} catch(const FWException &ex) {
// address does not parse as ipv6, skip this rule.
addr_is_good = false;
QString err("Backup ssh access rule could not be added "
"to IPv6 policy because specified address "
"'%1' is invalid");
compiler->warning(err.arg(addr_str.c_str()).toStdString());
}
} else
{
// check if given address parses as ipv4
try
{
inet_addr = new InetAddrMask(addr_str);
} catch(const FWException &ex) {
// address does not parse
addr_is_good = false;
QString err("Backup ssh access rule could not be added "
"to IPv4 policy because specified address "
"'%1' is invalid");
compiler->warning(err.arg(addr_str.c_str()).toStdString());
}
}
if (addr_is_good)
{
configlet.setVariable("mgmt_access", 1);
configlet.setVariable("management_address", inet_addr->toString().c_str());
}
}
_printBackupSSHAccessRules(&configlet);
configlet.setVariable(
"drop_new_tcp_with_no_syn",
@@ -1702,6 +1662,55 @@ string PolicyCompiler_ipt::PrintRule::_printOptionalGlobalRules()
return configlet.expand().toStdString();
}
void PolicyCompiler_ipt::PrintRule::_printBackupSSHAccessRules(Configlet *conf)
{
PolicyCompiler_ipt *ipt_comp = dynamic_cast<PolicyCompiler_ipt*>(compiler);
bool isIPv6 = ipt_comp->ipv6;
if ( compiler->getCachedFwOpt()->getBool("mgmt_ssh") &&
! compiler->getCachedFwOpt()->getStr("mgmt_addr").empty() )
{
string addr_str = compiler->getCachedFwOpt()->getStr("mgmt_addr");
InetAddrMask *inet_addr = NULL;
bool addr_is_good = true;
if (isIPv6)
{
// check if given address is ipv6
try
{
inet_addr = new Inet6AddrMask(addr_str);
} catch(const FWException &ex) {
// address does not parse as ipv6, skip this rule.
addr_is_good = false;
QString err("Backup ssh access rule could not be added "
"to IPv6 policy because specified address "
"'%1' is invalid");
compiler->warning(err.arg(addr_str.c_str()).toStdString());
}
} else
{
// check if given address parses as ipv4
try
{
inet_addr = new InetAddrMask(addr_str);
} catch(const FWException &ex) {
// address does not parse
addr_is_good = false;
QString err("Backup ssh access rule could not be added "
"to IPv4 policy because specified address "
"'%1' is invalid");
compiler->warning(err.arg(addr_str.c_str()).toStdString());
}
}
if (addr_is_good)
{
conf->setVariable("begin_rule", _startRuleLine().c_str());
conf->setVariable("end_rule", _endRuleLine().c_str());
conf->setVariable("mgmt_access", 1);
conf->setVariable("management_address", inet_addr->toString().c_str());
}
}
}
string PolicyCompiler_ipt::PrintRule::_quote(const string &s)
{
return "\"" + s + "\"";
src/iptlib/PolicyCompiler_ipt.cpp
+1 -1
View File
@@ -4528,7 +4528,7 @@ void PolicyCompiler_ipt::epilog()
PolicyCompiler_ipt::PrintRule* PolicyCompiler_ipt::createPrintRuleProcessor()
{
PolicyCompiler_ipt::PrintRule* print_rule = NULL;
if (fwopt->getBool("use_iptables_restore"))
if (fw->getOptionsObject()->getBool("use_iptables_restore"))
{
// bug #1812295: we should use PrintRuleIptRstEcho not only
// when we have dynamic interfaces, but also when we have
src/iptlib/PolicyCompiler_ipt.h
+79 -74
View File
@@ -31,6 +31,7 @@
#include "fwcompiler/PolicyCompiler.h"
#include "fwbuilder/RuleElement.h"
#include "config.h"
#include "Configlet.h"
namespace libfwbuilder
{
@@ -56,10 +57,12 @@ namespace fwcompiler
{
class PolicyCompiler_ipt : public PolicyCompiler
{
protected:
public:
class PrintRule;
protected:
bool have_dynamic_interfaces;
bool have_connmark;
bool have_connmark_in_output;
@@ -102,8 +105,6 @@ namespace fwcompiler
const std::string label,
const bool related = false);
PolicyCompiler_ipt::PrintRule* createPrintRuleProcessor();
std::string getInterfaceVarName(libfwbuilder::FWObject *iface,
bool v6=false);
std::string getAddressTableVarName(libfwbuilder::FWObject *iface);
@@ -869,6 +870,78 @@ namespace fwcompiler
DECLARE_POLICY_RULE_PROCESSOR(countChainUsage);
virtual std::string myPlatformName();
/**
* TODO: move these two to class fwcompiler::PolicyCompiler,
* then create enum for all possible actions on reject in that
* class and use it instead of string.
*/
std::string getActionOnReject(libfwbuilder::PolicyRule *rule);
bool isActionOnRejectTCPRST(libfwbuilder::PolicyRule *rule);
void resetActionOnReject(libfwbuilder::PolicyRule *rule);
public:
PolicyCompiler_ipt(libfwbuilder::FWObjectDatabase *_db,
libfwbuilder::Firewall *fw,
bool ipv6_policy,
fwcompiler::OSConfigurator *_oscnf,
std::map<const std::string, bool> *m_n_commands_map
) :
PolicyCompiler(_db, fw, ipv6_policy, _oscnf)
{
have_dynamic_interfaces = false;
have_connmark = false;
have_connmark_in_output = false;
my_table = "filter";
minus_n_commands = m_n_commands_map;
}
virtual ~PolicyCompiler_ipt();
/**
* Add some predefined rules controlled by checkboxes in
* firewall settings dialog
*/
virtual void addPredefinedPolicyRules();
virtual void verifyPlatform();
virtual int prolog();
virtual void compile();
virtual void epilog();
/**
* addRuleFilter() is a hook where we can add a rule processor to filter
* some of the rules out before we begin actual processing
*/
virtual void addRuleFilter();
/**
* this method registers chain used for the ruleset (most
* often branch rule set). Since rules in the same ruleset do
* not use this chain as target, rule processor
* countChainUsage considers it unused. Registering it makes
* sure its usage counter is > 0.
*/
void registerRuleSetChain(const std::string &chain_name);
void setHaveDynamicInterfaces(bool f) { have_dynamic_interfaces=f; }
virtual std::string flushAndSetDefaultPolicy();
virtual std::string printAutomaticRules();
std::string commit();
std::string getNewTmpChainName(libfwbuilder::PolicyRule *rule);
std::string getNewChainName(libfwbuilder::PolicyRule *rule,libfwbuilder::Interface *rule_iface);
bool haveConnMarkRules() { return have_connmark; }
bool haveConnMarkRulesInOutput() { return have_connmark_in_output; }
std::list<std::string> getUsedChains();
PolicyCompiler_ipt::PrintRule* createPrintRuleProcessor();
/**
* prints single policy rule, assuming all groups have been
* expanded, so source, destination and service hold exactly
@@ -963,6 +1036,8 @@ namespace fwcompiler
virtual std::string _startRuleLine();
virtual std::string _endRuleLine();
virtual void _printBackupSSHAccessRules(Configlet *c);
virtual bool processNext();
std::string PolicyRuleToString(libfwbuilder::PolicyRule *r);
@@ -1003,76 +1078,6 @@ namespace fwcompiler
};
friend class PolicyCompiler_ipt::PrintRuleIptRstEcho;
virtual std::string myPlatformName();
/**
* TODO: move these two to class fwcompiler::PolicyCompiler,
* then create enum for all possible actions on reject in that
* class and use it instead of string.
*/
std::string getActionOnReject(libfwbuilder::PolicyRule *rule);
bool isActionOnRejectTCPRST(libfwbuilder::PolicyRule *rule);
void resetActionOnReject(libfwbuilder::PolicyRule *rule);
public:
PolicyCompiler_ipt(libfwbuilder::FWObjectDatabase *_db,
libfwbuilder::Firewall *fw,
bool ipv6_policy,
fwcompiler::OSConfigurator *_oscnf,
std::map<const std::string, bool> *m_n_commands_map
) :
PolicyCompiler(_db, fw, ipv6_policy, _oscnf)
{
have_dynamic_interfaces = false;
have_connmark = false;
have_connmark_in_output = false;
my_table = "filter";
minus_n_commands = m_n_commands_map;
}
virtual ~PolicyCompiler_ipt();
/**
* Add some predefined rules controlled by checkboxes in
* firewall settings dialog
*/
virtual void addPredefinedPolicyRules();
virtual void verifyPlatform();
virtual int prolog();
virtual void compile();
virtual void epilog();
/**
* addRuleFilter() is a hook where we can add a rule processor to filter
* some of the rules out before we begin actual processing
*/
virtual void addRuleFilter();
/**
* this method registers chain used for the ruleset (most
* often branch rule set). Since rules in the same ruleset do
* not use this chain as target, rule processor
* countChainUsage considers it unused. Registering it makes
* sure its usage counter is > 0.
*/
void registerRuleSetChain(const std::string &chain_name);
void setHaveDynamicInterfaces(bool f) { have_dynamic_interfaces=f; }
virtual std::string flushAndSetDefaultPolicy();
virtual std::string printAutomaticRules();
std::string commit();
std::string getNewTmpChainName(libfwbuilder::PolicyRule *rule);
std::string getNewChainName(libfwbuilder::PolicyRule *rule,libfwbuilder::Interface *rule_iface);
bool haveConnMarkRules() { return have_connmark; }
bool haveConnMarkRulesInOutput() { return have_connmark_in_output; }
std::list<std::string> getUsedChains();
};
src/res/configlets/linux24/stop_action
+2 -2
View File
@@ -29,7 +29,7 @@ reset_all
{{if mgmt_access}}
# backup ssh access
$IPTABLES INPUT -p tcp -m tcp -s {{$management_address}} --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPTABLES OUTPUT -p tcp -m tcp -d {{$management_address}} --sport 22 -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -p tcp -m tcp -s {{$management_address}} --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
$IPTABLES -A OUTPUT -p tcp -m tcp -d {{$management_address}} --sport 22 -m state --state ESTABLISHED,RELATED -j ACCEPT
{{endif}}