DeforaNetworks/fwknop
DeforaNetworks/fwknop
3
0
Fork 0
Code Releases Activity

more changes for firewalld

Browse Source
This commit is contained in:
Gerry Reno 2014-08-31 00:29:17 -04:00
parent e54383b518
commit 25d252c11a
4 changed files with 63 additions and 31 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
README.md
View File

@ -9,9 +9,9 @@ default-drop filtering stance. The main application of SPA is to use a firewall
to drop all attempts to connect to services such as SSH in order to make the to drop all attempts to connect to services such as SSH in order to make the
exploitation of vulnerabilities (both 0-day and unpatched code) more difficult. exploitation of vulnerabilities (both 0-day and unpatched code) more difficult.
Because there are no open ports, any service that is concealed by SPA naturally Because there are no open ports, any service that is concealed by SPA naturally
cannot be scanned for with Nmap. The fwknop project supports three different cannot be scanned for with Nmap. The fwknop project supports four different
firewalls: iptables on Linux systems, pf on OpenBSD, and ipfw on FreeBSD and firewalls: firewalld and iptables on Linux systems, pf on OpenBSD, and ipfw on
Mac OS X. FreeBSD and Mac OS X.
SPA is essentially next generation Port Knocking (PK), but solves many of the SPA is essentially next generation Port Knocking (PK), but solves many of the
limitations exhibited by PK while retaining its core benefits. PK limitations limitations exhibited by PK while retaining its core benefits. PK limitations
@ -103,6 +103,9 @@ the `INSTALL` file for the general basics on using autoconf.
--with-gpgme-prefix=PFX prefix where GPGME is installed (optional) --with-gpgme-prefix=PFX prefix where GPGME is installed (optional)
--with-gpg=/path/to/gpg Specify path to the gpg executable that gpgme will --with-gpg=/path/to/gpg Specify path to the gpg executable that gpgme will
use [default=check path] use [default=check path]
--with-firewalld=/path/to/firewalld
Specify path to the firewalld executable
[default=check path]
--with-iptables=/path/to/iptables --with-iptables=/path/to/iptables
Specify path to the iptables executable Specify path to the iptables executable
[default=check path] [default=check path]

37
configure.ac
View File

@ -476,6 +476,24 @@ AS_IF([test "$want_server" = yes], [
AM_CONDITIONAL([USE_NDBM], [test x$use_ndbm = xyes]) AM_CONDITIONAL([USE_NDBM], [test x$use_ndbm = xyes])
AM_CONDITIONAL([CONFIG_FILE_CACHE], [test x$want_file_cache = xyes]) AM_CONDITIONAL([CONFIG_FILE_CACHE], [test x$want_file_cache = xyes])
dnl Check for firewalld
dnl
AC_ARG_WITH([firewall-cmd],
[AS_HELP_STRING([--with-firewall-cmd=/path/to/firewall-cmd],
[Specify path to the firewall-cmd executable @<:@default=check path@:>@])],
[
AS_IF([ test "x$withval" = xno ], [],
AS_IF([ test "x$withval" = x -o "x$withval" = xyes ],
[AC_MSG_ERROR([--with-firewall-cmd requires an argument specifying a path to firewall-cmd])],
[ FORCE_FIREWALLD_EXE=$withval ]
)
)
],
[
AC_PATH_PROG(FIREWALLD_EXE, [firewall-cmd], [], [$APP_PATH])
]
)
dnl Check for iptables dnl Check for iptables
dnl dnl
AC_ARG_WITH([iptables], AC_ARG_WITH([iptables],
@ -550,6 +568,9 @@ dnl
dnl If a firewall was forced. set the appropriate _EXE var and clear the others. dnl If a firewall was forced. set the appropriate _EXE var and clear the others.
dnl dnl
AS_IF([test "x$FORCE_FIREWALLD_EXE" != x], [
FIREWALLD_EXE="$FORCE_FIREWALLD_EXE"
],[
AS_IF([test "x$FORCE_IPTABLES_EXE" != x], [ AS_IF([test "x$FORCE_IPTABLES_EXE" != x], [
IPTABLES_EXE="$FORCE_IPTABLES_EXE" IPTABLES_EXE="$FORCE_IPTABLES_EXE"
],[ ],[
@ -571,12 +592,19 @@ dnl
] ]
] ]
] ]
)))) ]
)))))
dnl Determine which firewall exe we use (if we have one). dnl Determine which firewall exe we use (if we have one).
dnl If iptables was found or specified, it wins, then we fallback to ipfw, dnl If firewalld was found or specified, it wins, then we fallback to iptables,
dnl then pf, and otherwise we try ipf. dnl then ipfw, pf, and otherwise we try ipf.
dnl dnl
AS_IF([test "x$FIREWALLD_EXE" != x], [
FW_DEF="FW_FIREWALLD"
FIREWALL_TYPE="firewalld"
FIREWALL_EXE=$FIREWALLD_EXE
AC_DEFINE_UNQUOTED([FIREWALL_FIREWALLD], [1], [The firewall type: firewalld.])
],[
AS_IF([test "x$IPTABLES_EXE" != x], [ AS_IF([test "x$IPTABLES_EXE" != x], [
FW_DEF="FW_IPTABLES" FW_DEF="FW_IPTABLES"
FIREWALL_TYPE="iptables" FIREWALL_TYPE="iptables"
@ -604,7 +632,8 @@ dnl
] ]
] ]
] ]
)))) ]
)))))
AC_DEFINE_UNQUOTED([FIREWALL_EXE], ["$FIREWALL_EXE"], AC_DEFINE_UNQUOTED([FIREWALL_EXE], ["$FIREWALL_EXE"],
[Path to firewall command executable (it should match the firewall type).]) [Path to firewall command executable (it should match the firewall type).])

10
fwknop.spec
View File

@ -50,11 +50,11 @@ Requires: libfko => 2.0.3, libpcap, iptables
%description %description
Fwknop implements an authorization scheme known as Single Packet Authorization Fwknop implements an authorization scheme known as Single Packet Authorization
(SPA) for Linux systems running iptables. This mechanism requires only a (SPA) for Linux systems running firewalld or iptables. This mechanism requires
single encrypted and non-replayed packet to communicate various pieces of only a single encrypted and non-replayed packet to communicate various pieces of
information including desired access through an iptables policy. The main information including desired access through a firewalld or iptables policy. The
application of this program is to use iptables in a default-drop stance to main application of this program is to use firewalld or iptables in a default-drop
protect services such as SSH with an additional layer of security in order stance to protect services such as SSH with an additional layer of security in order
to make the exploitation of vulnerabilities (both 0-day and unpatched code) to make the exploitation of vulnerabilities (both 0-day and unpatched code)
much more difficult. much more difficult.

38
server/fw_util_firewalld.h
View File

@ -35,25 +35,25 @@
/* firewalld command args /* firewalld command args
*/ */
#define FIREWD_CHK_RULE_ARGS "--direct --passthrough -C %s %s" /* 2>&1 is always added in the second %s */ #define FIREWD_CHK_RULE_ARGS "--direct --passthrough ipv4 -C %s %s" /* 2>&1 is always added in the second %s */
#define FIREWD_RULE_ARGS "--direct --passthrough -t %s -p %i -s %s --dport %i -m comment --comment " EXPIRE_COMMENT_PREFIX "%u -j %s 2>&1" #define FIREWD_RULE_ARGS "--direct --passthrough ipv4 -t %s -p %i -s %s --dport %i -m comment --comment " EXPIRE_COMMENT_PREFIX "%u -j %s 2>&1"
#define FIREWD_OUT_RULE_ARGS "--direct --passthrough -t %s -p %i -d %s --sport %i -m comment --comment " EXPIRE_COMMENT_PREFIX "%u -j %s 2>&1" #define FIREWD_OUT_RULE_ARGS "--direct --passthrough ipv4 -t %s -p %i -d %s --sport %i -m comment --comment " EXPIRE_COMMENT_PREFIX "%u -j %s 2>&1"
#define FIREWD_FWD_RULE_ARGS "--direct --passthrough -t %s -p %i -s %s -d %s --dport %i -m comment --comment " EXPIRE_COMMENT_PREFIX "%u -j %s 2>&1" #define FIREWD_FWD_RULE_ARGS "--direct --passthrough ipv4 -t %s -p %i -s %s -d %s --dport %i -m comment --comment " EXPIRE_COMMENT_PREFIX "%u -j %s 2>&1"
#define FIREWD_DNAT_RULE_ARGS "--direct --passthrough -t %s -p %i -s %s --dport %i -m comment --comment " EXPIRE_COMMENT_PREFIX "%u -j %s --to-destination %s:%i 2>&1" #define FIREWD_DNAT_RULE_ARGS "--direct --passthrough ipv4 -t %s -p %i -s %s --dport %i -m comment --comment " EXPIRE_COMMENT_PREFIX "%u -j %s --to-destination %s:%i 2>&1"
#define FIREWD_SNAT_RULE_ARGS "--direct --passthrough -t %s -p %i -d %s --dport %i -m comment --comment " EXPIRE_COMMENT_PREFIX "%u -j %s %s 2>&1" #define FIREWD_SNAT_RULE_ARGS "--direct --passthrough ipv4 -t %s -p %i -d %s --dport %i -m comment --comment " EXPIRE_COMMENT_PREFIX "%u -j %s %s 2>&1"
#define FIREWD_TMP_COMMENT_ARGS "--direct --passthrough -t %s -I %s %i -s 127.0.0.2 -m comment --comment " TMP_COMMENT " -j %s 2>&1" #define FIREWD_TMP_COMMENT_ARGS "--direct --passthrough ipv4 -t %s -I %s %i -s 127.0.0.2 -m comment --comment " TMP_COMMENT " -j %s 2>&1"
#define FIREWD_TMP_CHK_RULE_ARGS "--direct --passthrough -t %s -I %s %i -s 127.0.0.2 -p udp -j %s 2>&1" #define FIREWD_TMP_CHK_RULE_ARGS "--direct --passthrough ipv4 -t %s -I %s %i -s 127.0.0.2 -p udp -j %s 2>&1"
#define FIREWD_TMP_VERIFY_CHK_ARGS "--direct --passthrough -t %s -C %s -s 127.0.0.2 -p udp -j %s 2>&1" #define FIREWD_TMP_VERIFY_CHK_ARGS "--direct --passthrough ipv4 -t %s -C %s -s 127.0.0.2 -p udp -j %s 2>&1"
#define FIREWD_DEL_RULE_ARGS "--direct --passthrough -t %s -D %s %i 2>&1" #define FIREWD_DEL_RULE_ARGS "--direct --passthrough ipv4 -t %s -D %s %i 2>&1"
#define FIREWD_NEW_CHAIN_ARGS "--direct --passthrough -t %s -N %s 2>&1" #define FIREWD_NEW_CHAIN_ARGS "--direct --passthrough ipv4 -t %s -N %s 2>&1"
#define FIREWD_FLUSH_CHAIN_ARGS "--direct --passthrough -t %s -F %s 2>&1" #define FIREWD_FLUSH_CHAIN_ARGS "--direct --passthrough ipv4 -t %s -F %s 2>&1"
#define FIREWD_CHAIN_EXISTS_ARGS "--direct --passthrough -t %s -L %s -n 2>&1" #define FIREWD_CHAIN_EXISTS_ARGS "--direct --passthrough ipv4 -t %s -L %s -n 2>&1"
#define FIREWD_DEL_CHAIN_ARGS "--direct --passthrough -t %s -X %s 2>&1" #define FIREWD_DEL_CHAIN_ARGS "--direct --passthrough ipv4 -t %s -X %s 2>&1"
#define FIREWD_CHK_JUMP_RULE_ARGS "--direct --passthrough -t %s -j %s 2>&1" #define FIREWD_CHK_JUMP_RULE_ARGS "--direct --passthrough ipv4 -t %s -j %s 2>&1"
#define FIREWD_ADD_JUMP_RULE_ARGS "--direct --passthrough -t %s -I %s %i -j %s 2>&1" #define FIREWD_ADD_JUMP_RULE_ARGS "--direct --passthrough ipv4 -t %s -I %s %i -j %s 2>&1"
#define FIREWD_DEL_JUMP_RULE_ARGS "--direct --passthrough -t %s -D %s -j %s 2>&1" /* let firewalld work out the rule number */ #define FIREWD_DEL_JUMP_RULE_ARGS "--direct --passthrough ipv4 -t %s -D %s -j %s 2>&1" /* let firewalld work out the rule number */
#define FIREWD_LIST_RULES_ARGS "--direct --passthrough -t %s -L %s --line-numbers -n 2>&1" #define FIREWD_LIST_RULES_ARGS "--direct --passthrough ipv4 -t %s -L %s --line-numbers -n 2>&1"
#define FIREWD_LIST_ALL_RULES_ARGS "--direct --passthrough -t %s -v -n -L --line-numbers 2>&1" #define FIREWD_LIST_ALL_RULES_ARGS "--direct --passthrough ipv4 -t %s -v -n -L --line-numbers 2>&1"
int validate_firewd_chain_conf(const char * const chain_str); int validate_firewd_chain_conf(const char * const chain_str);