DeforaNetworks/fwknop
3
0
Fork 0
Code Releases Activity

[server] added FORCE_MASQUERADE to fwknopd(8) man page, closes #101

Browse Source 
This commit completes the addition of generalized NAT (both DNAT and
SNAT) capabilities to access.conf stanzas.
This commit is contained in:
Michael Rash
2013-12-14 15:44:39 -05:00
parent 3a2c33cd3c
commit 92cdb47ff7
5 changed files with 61 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
doc/fwknopd.man.asciidoc
View File

@@ -244,9 +244,9 @@ See the '@sysconfdir@/fwknop/fwknopd.conf'' file for the full list and correspon
Specify the IP address for SNAT. This functionality is only enabled
when ``ENABLE_IPT_SNAT'' is set to ``Y'' and by default SNAT rules are
built with the MASQUERADE target (since then the internal IP does not
have to be defined here in the '@sysconfdir@/fwknop/fwknopd.conf'' file), but if you want
*fwknopd* to use the SNAT target, you must also define an IP address with
the ``SNAT_TRANSLATE_IP'' variable.
have to be defined here in the '@sysconfdir@/fwknop/fwknopd.conf' file),
but if you want *fwknopd* to use the SNAT target, you must also define an
IP address with the ``SNAT_TRANSLATE_IP'' variable.
*ENABLE_IPT_OUTPUT* '<Y/N>'::
Add ACCEPT rules to the FWKNOP_OUTPUT chain. This is usually only useful
@@ -446,17 +446,22 @@ directive starts a new stanza.
*FORCE_SNAT* '<IP>'::
For any valid SPA packet, add an SNAT rule in addition to any DNAT rule
created with a corresponding (required) FORCE_NAT variable. This is
analogous to SNAT_TRANSLATE_IP from the '@sysconfdir@/fwknop/fwknopd.conf'' file
except that it is per access stanza and overrides any value set with
SNAT_TRANSLATE_IP. This is useful for situations where an incoming NAT'd
connection may be otherwise unanswerable due to routing constraints (i.e.
the system receiving the SPA authenticated connection has a default route
to a different device than the SPA system itself).
analogous to ``SNAT_TRANSLATE_IP'' from the '@sysconfdir@/fwknop/fwknopd.conf'
file except that it is per access stanza and overrides any value set with
``SNAT_TRANSLATE_IP''. This is useful for situations where an incoming
NAT'd connection may be otherwise unanswerable due to routing constraints
(i.e. the system receiving the SPA authenticated connection has a default
route to a different device than the SPA system itself).
*FORCE_MASQUERADE* '<Y/N>'::
This is similar to the ``FORCE_SNAT'' variable, except that it is not
necessary to also specify an IP address for SNAT rules because the
MASQUERADE target is used instead.
*GPG_HOME_DIR* '<path>'::
Define the path to the GnuPG directory to be used by the *fwknopd*
server. If this keyword is not specified within '@sysconfdir@/fwknop/access.conf' then
*fwknopd* will default to using the '/root/.gnupg' directory for the
server. If this keyword is not specified within '@sysconfdir@/fwknop/access.conf'
then *fwknopd* will default to using the '/root/.gnupg' directory for the
server key(s) for incoming SPA packets handled by the matching
'access.conf' stanza.

6
server/config_init.c
View File

@@ -447,7 +447,11 @@ validate_options(fko_srv_options_t *opts)
/* Make sure we have a valid IP if SNAT is enabled
*/
if(strncasecmp(opts->config[CONF_ENABLE_IPT_SNAT], "Y", 1) == 0)
{
/* Note that fw_initialize() will set use_masquerade if necessary
*/
if(opts->config[CONF_SNAT_TRANSLATE_IP] != NULL)
{
if(! is_valid_ipv4_addr(opts->config[CONF_SNAT_TRANSLATE_IP]))
{
log_msg(LOG_ERR,
@@ -455,6 +459,8 @@ validate_options(fko_srv_options_t *opts)
);
clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE);
}
}
}
/* Enable IPT OUTPUT.
*/

31
server/fw_util_iptables.c
View File

@@ -825,25 +825,19 @@ fw_config_init(fko_srv_options_t * const opts)
*/
if(strncasecmp(opts->config[CONF_ENABLE_IPT_SNAT], "Y", 1)==0)
{
/* If an SNAT_TRANSLATE_IP is specified use the SNAT_ACCESS mode.
* Otherwise, use MASQUERADE_ACCESS.
*
* XXX: --DSS: Not sure if using the TRANSLATE_IP parameter as
* the determining factor is the best why to handle
* this.
*
*/
if((opts->config[CONF_SNAT_TRANSLATE_IP] != NULL)
&& (strncasecmp(opts->config[CONF_SNAT_TRANSLATE_IP], "__CHANGEME__", 10)) != 0)
if(opts->fw_config->use_masquerade == 1)
{
if(set_fw_chain_conf(IPT_MASQUERADE_ACCESS, opts->config[CONF_IPT_MASQUERADE_ACCESS]) != 1)
return 0;
}
else if((opts->config[CONF_SNAT_TRANSLATE_IP] != NULL)
&& (is_valid_ipv4_addr(opts->config[CONF_SNAT_TRANSLATE_IP])))
{
if(set_fw_chain_conf(IPT_SNAT_ACCESS, opts->config[CONF_IPT_SNAT_ACCESS]) != 1)
return 0;
}
else
{
if(set_fw_chain_conf(IPT_MASQUERADE_ACCESS, opts->config[CONF_IPT_MASQUERADE_ACCESS]) != 1)
return 0;
}
return 0;
}
}
@@ -888,6 +882,15 @@ fw_initialize(const fko_srv_options_t * const opts)
}
}
if(strncasecmp(opts->config[CONF_ENABLE_IPT_SNAT], "Y", 1) == 0)
{
if(opts->config[CONF_SNAT_TRANSLATE_IP] == NULL
|| ! is_valid_ipv4_addr(opts->config[CONF_SNAT_TRANSLATE_IP]))
{
opts->fw_config->use_masquerade = 1;
}
}
/* See if iptables offers the '-C' argument (older versions don't). If not,
* then switch to parsing iptables -L output to find rules.
*/

21
server/fwknopd.8.in
View File

@@ -1,13 +1,13 @@
'\" t
.\" Title: fwknopd
.\" Author: [see the "AUTHORS" section]
.\" Generator: DocBook XSL Stylesheets v1.76.1 <http://docbook.sf.net/>
.\" Date: 07/29/2013
.\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
.\" Date: 12/14/2013
.\" Manual: Fwknop Server
.\" Source: Fwknop Server
.\" Language: English
.\"
.TH "FWKNOPD" "8" "07/29/2013" "Fwknop Server" "Fwknop Server"
.TH "FWKNOPD" "8" "12/14/2013" "Fwknop Server" "Fwknop Server"
.\" -----------------------------------------------------------------
.\" * Define some portability stuff
.\" -----------------------------------------------------------------
@@ -325,7 +325,8 @@ is running\&.
\fBSNAT_TRANSLATE_IP\fR \fI<ip_address>\fR
.RS 4
Specify the IP address for SNAT\&. This functionality is only enabled when \(lqENABLE_IPT_SNAT\(rq is set to \(lqY\(rq and by default SNAT rules are built with the MASQUERADE target (since then the internal IP does not have to be defined here in the
\fI@sysconfdir@/fwknop/fwknopd\&.conf\fR\*(Aq file), but if you want
\fI@sysconfdir@/fwknop/fwknopd\&.conf\fR
file), but if you want
\fBfwknopd\fR
to use the SNAT target, you must also define an IP address with the \(lqSNAT_TRANSLATE_IP\(rq variable\&.
.RE
@@ -543,6 +544,18 @@ argument\&.
For any valid SPA packet, force the requested connection to be NAT\(cqd through to the specified (usually internal) IP and port value\&. This is useful if there are multiple internal systems running a service such as SSHD, and you want to give transparent access to only one internal system for each stanza in the access\&.conf file\&. This way, multiple external users can each directly access only one internal system per SPA key\&.
.RE
.PP
\fBFORCE_SNAT\fR \fI<IP>\fR
.RS 4
For any valid SPA packet, add an SNAT rule in addition to any DNAT rule created with a corresponding (required) FORCE_NAT variable\&. This is analogous to \(lqSNAT_TRANSLATE_IP\(rq from the
\fI@sysconfdir@/fwknop/fwknopd\&.conf\fR
file except that it is per access stanza and overrides any value set with \(lqSNAT_TRANSLATE_IP\(rq\&. This is useful for situations where an incoming NAT\(cqd connection may be otherwise unanswerable due to routing constraints (i\&.e\&. the system receiving the SPA authenticated connection has a default route to a different device than the SPA system itself)\&.
.RE
.PP
\fBFORCE_MASQUERADE\fR \fI<Y/N>\fR
.RS 4
This is similar to the \(lqFORCE_SNAT\(rq variable, except that it is not necessary to also specify an IP address for SNAT rules because the MASQUERADE target is used instead\&.
.RE
.PP
\fBGPG_HOME_DIR\fR \fI<path>\fR
.RS 4
Define the path to the GnuPG directory to be used by the

5
server/fwknopd_common.h
View File

@@ -382,6 +382,10 @@ typedef struct acc_stanza
struct fw_config {
struct fw_chain chain[NUM_FWKNOP_ACCESS_TYPES];
char fw_command[MAX_PATH_LEN];
/* Flag for iptables SNAT vs. MASQUERADE usage
*/
unsigned char use_masquerade;
};
#elif FIREWALL_IPFW
@@ -504,6 +508,7 @@ typedef struct fko_srv_options
/* Set to 1 when messages have to go through syslog, 0 otherwise */
unsigned char syslog_enable;
} fko_srv_options_t;
extern fko_srv_options_t options;