diff --git a/build_num b/build_num index 49bf9c48e..9f9ad16ad 100644 --- a/build_num +++ b/build_num @@ -1 +1 @@ -#define BUILD_NUM 3161 +#define BUILD_NUM 3162 diff --git a/doc/ChangeLog b/doc/ChangeLog index 5177b64d3..ca944b61a 100644 --- a/doc/ChangeLog +++ b/doc/ChangeLog @@ -1,3 +1,21 @@ +2010-07-27 Vadim Kurland + + * configlets/linux24/block_action: fixed #1640 "default policy + when the script is stopped should be optional". The "stop" command + used to be interpreted by the iptables script generated by + fwbuilder in a way that it blocked all connections going to, from + and through the firewall. Luc Paulin + pointed out that this behavior is incompatible with other firewall + management scripts, such as /etc/rc.d/init.d/iptables on Fedora + Linux or ufw on Ubuntu, where "stop" means disabling the firewall. + In v4.1 the "stop" command flushed all chains in all tables and + sets default policy to ACCEPT. New command "block" does what + "stop" used to do before, that is, flushes all chains in all + tables and sets default policy to "DROP". The option to add + a rule to permit ssh access from the management workstation when + firewall is stopped now adds this rule when firewall script is + run with "block" command instead. + 2010-07-26 Vadim Kurland * configlets/linux24/run_time_address_tables: implemented support diff --git a/src/gui/iptadvanceddialog_q.ui b/src/gui/iptadvanceddialog_q.ui index fb300799f..0a85b61b5 100644 --- a/src/gui/iptadvanceddialog_q.ui +++ b/src/gui/iptadvanceddialog_q.ui @@ -12,8 +12,8 @@ 0 0 - 858 - 618 + 842 + 602 @@ -546,7 +546,7 @@ packets to IPv6 policies - Install the rule for ssh access from the management workstation when the firewall is stopped + Install the rule for ssh access from the management workstation when the firewall script is run with the "block" command diff --git a/src/iptlib/CompilerDriver_ipt_run.cpp b/src/iptlib/CompilerDriver_ipt_run.cpp index be9e95899..758bc2283 100644 --- a/src/iptlib/CompilerDriver_ipt_run.cpp +++ b/src/iptlib/CompilerDriver_ipt_run.cpp @@ -635,22 +635,34 @@ QString CompilerDriver_ipt::run(const std::string &cluster_id, script_buffer = ""; - Configlet stop_action(fw, "linux24", "stop_action"); - stop_action.collapseEmptyStrings(true); + Configlet block_action(fw, "linux24", "block_action"); + block_action.collapseEmptyStrings(true); + // the name of the option is historical (including the typo) if (fw->getOptionsObject()->getBool("add_mgmt_ssh_rule_when_stoped")) { - std::auto_ptr policy_compiler = createPolicyCompiler( - fw, false, NULL, NULL); + std::auto_ptr policy_compiler = + createPolicyCompiler(fw, false, NULL, NULL); PolicyCompiler_ipt::PrintRule* print_rule = policy_compiler->createPrintRuleProcessor(); print_rule->setContext(policy_compiler.get()); - print_rule->_printBackupSSHAccessRules(&stop_action); + print_rule->_printBackupSSHAccessRules(&block_action); } else - stop_action.setVariable("mgmt_access", 0); + { + block_action.setVariable("mgmt_access", 0); + } + + script_skeleton.setVariable("block_action", block_action.expand()); + + + Configlet stop_action(fw, "linux24", "stop_action"); + stop_action.collapseEmptyStrings(true); + stop_action.setVariable("ipv6", have_ipv6); script_skeleton.setVariable("stop_action", stop_action.expand()); + + Configlet status_action(fw, "linux24", "status_action"); status_action.collapseEmptyStrings(true); script_skeleton.setVariable("status_action", status_action.expand()); diff --git a/src/res/configlets/dd-wrt-jffs/script_skeleton b/src/res/configlets/dd-wrt-jffs/script_skeleton index 329eb6af5..e7efa6cc1 100644 --- a/src/res/configlets/dd-wrt-jffs/script_skeleton +++ b/src/res/configlets/dd-wrt-jffs/script_skeleton @@ -67,6 +67,8 @@ reset_all() { {{$reset_all}} } +{{$block_action}} + {{$stop_action}} {{$status_action}} @@ -111,6 +113,11 @@ case "$cmd" in RETVAL=$? ;; + block) + block_action + RETVAL=$? + ;; + reload) $0 stop $0 start diff --git a/src/res/configlets/linux24/block_action b/src/res/configlets/linux24/block_action new file mode 100644 index 000000000..9ea3e9132 --- /dev/null +++ b/src/res/configlets/linux24/block_action @@ -0,0 +1,37 @@ +## -*- mode: shell-script; -*- +## +## To be able to make changes to the part of configuration created +## from this configlet you need to copy this file to the directory +## fwbuilder/configlets/sveasoft/ in your home directory and modify it. +## Double "##" comments are removed during processing but single "#" +## comments are be retained and appear in the generated script. Empty +## lines are removed as well. +## +## Configlets support simple macro language with these constructs: +## {{$var}} is variable expansion +## {{if var}} is conditional operator. +## +## This configlet defines commands executed when iptables script is ran +## with command line argument "block". By default it resets iptables +## tables and chains using function reset_all and optionally adds backup +## ssh access rules. + +block_action() { + reset_all + +## it helps to add backup ssh access rule as early as possible so that +## ssh session opened from the management station won't break after +## all chains are flushed. The installation process may stall if +## stdout buffer gets filled with diagnostic or progress output from +## this script printed after chains are flushed but before a rule +## permitting ssh is installed. This may happen if script debugging is +## on or there are many NAT rules (so it prints a lot of "Rule NN +## (NAT)" lines). + +{{if mgmt_access}} + # backup ssh access + $IPTABLES -A INPUT -p tcp -m tcp -s {{$ssh_management_address}} --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT + $IPTABLES -A OUTPUT -p tcp -m tcp -d {{$ssh_management_address}} --sport 22 -m state --state ESTABLISHED,RELATED -j ACCEPT +{{endif}} +} + diff --git a/src/res/configlets/linux24/script_skeleton b/src/res/configlets/linux24/script_skeleton index 329eb6af5..e7efa6cc1 100644 --- a/src/res/configlets/linux24/script_skeleton +++ b/src/res/configlets/linux24/script_skeleton @@ -67,6 +67,8 @@ reset_all() { {{$reset_all}} } +{{$block_action}} + {{$stop_action}} {{$status_action}} @@ -111,6 +113,11 @@ case "$cmd" in RETVAL=$? ;; + block) + block_action + RETVAL=$? + ;; + reload) $0 stop $0 start diff --git a/src/res/configlets/linux24/stop_action b/src/res/configlets/linux24/stop_action index e29e29dc8..4fa6289c4 100644 --- a/src/res/configlets/linux24/stop_action +++ b/src/res/configlets/linux24/stop_action @@ -13,25 +13,20 @@ ## ## This configlet defines commands executed when iptables script is ran ## with command line argument "stop". By default it resets iptables -## tables and chains using function reset_all and optionally adds backup -## ssh access rules. +## tables and chains using function reset_all and sets all chains +## default policy to ACCEPT stop_action() { reset_all -## it helps to add backup ssh access rule as early as possible so that -## ssh session opened from the management station won't break after -## all chains are flushed. The installation process may stall if -## stdout buffer gets filled with diagnostic or progress output from -## this script printed after chains are flushed but before a rule -## permitting ssh is installed. This may happen if script debugging is -## on or there are many NAT rules (so it prints a lot of "Rule NN -## (NAT)" lines). + $IPTABLES -P OUTPUT ACCEPT + $IPTABLES -P INPUT ACCEPT + $IPTABLES -P FORWARD ACCEPT -{{if mgmt_access}} - # backup ssh access - $IPTABLES -A INPUT -p tcp -m tcp -s {{$ssh_management_address}} --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT - $IPTABLES -A OUTPUT -p tcp -m tcp -d {{$ssh_management_address}} --sport 22 -m state --state ESTABLISHED,RELATED -j ACCEPT +{{if ipv6}} + $IP6TABLES -P OUTPUT ACCEPT + $IP6TABLES -P INPUT ACCEPT + $IP6TABLES -P FORWARD ACCEPT {{endif}} } diff --git a/src/res/configlets/secuwall/script_skeleton b/src/res/configlets/secuwall/script_skeleton index 9e3821717..dc636abc4 100644 --- a/src/res/configlets/secuwall/script_skeleton +++ b/src/res/configlets/secuwall/script_skeleton @@ -74,6 +74,8 @@ reset_all() { {{$reset_all}} } +{{$block_action}} + {{$stop_action}} {{$status_action}} @@ -119,6 +121,11 @@ case "$cmd" in RETVAL=$? ;; + block) + block_action + RETVAL=$? + ;; + reload) $0 stop $0 start diff --git a/src/res/help/en_US/release_notes_4.1.0.html b/src/res/help/en_US/release_notes_4.1.0.html index 614e54135..3e87b3033 100644 --- a/src/res/help/en_US/release_notes_4.1.0.html +++ b/src/res/help/en_US/release_notes_4.1.0.html @@ -557,6 +557,26 @@

+
  • +

    + fixed #1640 "default policy when the script is stopped should be + optional". The "stop" command used to be interpreted by the + iptables script generated by fwbuilder in a way that it blocked + all connections going to, from and through the firewall. Luc + Paulin pointed out that this behavior + is incompatible with other firewall management scripts, such as + /etc/rc.d/init.d/iptables on Fedora Linux or ufw on Ubuntu, + where "stop" means disabling the firewall. In v4.1 the "stop" + command flushed all chains in all tables and sets default policy + to ACCEPT. New command "block" does what "stop" used to do + before, that is, flushes all chains in all tables and sets + default policy to "DROP". The option to add a rule to permit ssh + access from the management workstation when firewall is stopped + now adds this rule when firewall script is run with "block" + command instead. +

    +
    • + diff --git a/test/ipt/objects-for-regression-tests.fwb b/test/ipt/objects-for-regression-tests.fwb index 648c53f39..f4be6234f 100644 --- a/test/ipt/objects-for-regression-tests.fwb +++ b/test/ipt/objects-for-regression-tests.fwb @@ -31652,7 +31652,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT% - + @@ -32364,6 +32364,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT% + @@ -32371,6 +32372,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT% + @@ -32431,8 +32433,8 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT% - - + + @@ -32467,6 +32469,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT% + @@ -40747,7 +40750,7 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT% - + @@ -41474,12 +41477,15 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT% + + + @@ -41541,8 +41547,8 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT% - - + + @@ -41577,11 +41583,12 @@ echo '%FWBPROMPT%'; sh /tmp/%FWSCRIPT% + - +