From 92cdb47ff7eb34ebf4924d0eed75ac3ea7ce1429 Mon Sep 17 00:00:00 2001 From: Michael Rash Date: Sat, 14 Dec 2013 15:44:39 -0500 Subject: [PATCH] [server] added FORCE_MASQUERADE to fwknopd(8) man page, closes #101 This commit completes the addition of generalized NAT (both DNAT and SNAT) capabilities to access.conf stanzas. --- doc/fwknopd.man.asciidoc | 27 ++++++++++++++++----------- server/config_init.c | 6 ++++++ server/fw_util_iptables.c | 31 +++++++++++++++++-------------- server/fwknopd.8.in | 21 +++++++++++++++++---- server/fwknopd_common.h | 5 +++++ 5 files changed, 61 insertions(+), 29 deletions(-) diff --git a/doc/fwknopd.man.asciidoc b/doc/fwknopd.man.asciidoc index d1d9da1f..082b6fbc 100644 --- a/doc/fwknopd.man.asciidoc +++ b/doc/fwknopd.man.asciidoc @@ -244,9 +244,9 @@ See the '@sysconfdir@/fwknop/fwknopd.conf'' file for the full list and correspon Specify the IP address for SNAT. This functionality is only enabled when ``ENABLE_IPT_SNAT'' is set to ``Y'' and by default SNAT rules are built with the MASQUERADE target (since then the internal IP does not - have to be defined here in the '@sysconfdir@/fwknop/fwknopd.conf'' file), but if you want - *fwknopd* to use the SNAT target, you must also define an IP address with - the ``SNAT_TRANSLATE_IP'' variable. + have to be defined here in the '@sysconfdir@/fwknop/fwknopd.conf' file), + but if you want *fwknopd* to use the SNAT target, you must also define an + IP address with the ``SNAT_TRANSLATE_IP'' variable. *ENABLE_IPT_OUTPUT* '':: Add ACCEPT rules to the FWKNOP_OUTPUT chain. This is usually only useful @@ -446,17 +446,22 @@ directive starts a new stanza. *FORCE_SNAT* '':: For any valid SPA packet, add an SNAT rule in addition to any DNAT rule created with a corresponding (required) FORCE_NAT variable. This is - analogous to SNAT_TRANSLATE_IP from the '@sysconfdir@/fwknop/fwknopd.conf'' file - except that it is per access stanza and overrides any value set with - SNAT_TRANSLATE_IP. This is useful for situations where an incoming NAT'd - connection may be otherwise unanswerable due to routing constraints (i.e. - the system receiving the SPA authenticated connection has a default route - to a different device than the SPA system itself). + analogous to ``SNAT_TRANSLATE_IP'' from the '@sysconfdir@/fwknop/fwknopd.conf' + file except that it is per access stanza and overrides any value set with + ``SNAT_TRANSLATE_IP''. This is useful for situations where an incoming + NAT'd connection may be otherwise unanswerable due to routing constraints + (i.e. the system receiving the SPA authenticated connection has a default + route to a different device than the SPA system itself). + +*FORCE_MASQUERADE* '':: + This is similar to the ``FORCE_SNAT'' variable, except that it is not + necessary to also specify an IP address for SNAT rules because the + MASQUERADE target is used instead. *GPG_HOME_DIR* '':: Define the path to the GnuPG directory to be used by the *fwknopd* - server. If this keyword is not specified within '@sysconfdir@/fwknop/access.conf' then - *fwknopd* will default to using the '/root/.gnupg' directory for the + server. If this keyword is not specified within '@sysconfdir@/fwknop/access.conf' + then *fwknopd* will default to using the '/root/.gnupg' directory for the server key(s) for incoming SPA packets handled by the matching 'access.conf' stanza. diff --git a/server/config_init.c b/server/config_init.c index 019584df..0ff30005 100644 --- a/server/config_init.c +++ b/server/config_init.c @@ -447,7 +447,11 @@ validate_options(fko_srv_options_t *opts) /* Make sure we have a valid IP if SNAT is enabled */ if(strncasecmp(opts->config[CONF_ENABLE_IPT_SNAT], "Y", 1) == 0) + { + /* Note that fw_initialize() will set use_masquerade if necessary + */ if(opts->config[CONF_SNAT_TRANSLATE_IP] != NULL) + { if(! is_valid_ipv4_addr(opts->config[CONF_SNAT_TRANSLATE_IP])) { log_msg(LOG_ERR, @@ -455,6 +459,8 @@ validate_options(fko_srv_options_t *opts) ); clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE); } + } + } /* Enable IPT OUTPUT. */ diff --git a/server/fw_util_iptables.c b/server/fw_util_iptables.c index 27702769..65bda34f 100644 --- a/server/fw_util_iptables.c +++ b/server/fw_util_iptables.c @@ -825,25 +825,19 @@ fw_config_init(fko_srv_options_t * const opts) */ if(strncasecmp(opts->config[CONF_ENABLE_IPT_SNAT], "Y", 1)==0) { - /* If an SNAT_TRANSLATE_IP is specified use the SNAT_ACCESS mode. - * Otherwise, use MASQUERADE_ACCESS. - * - * XXX: --DSS: Not sure if using the TRANSLATE_IP parameter as - * the determining factor is the best why to handle - * this. - * - */ - if((opts->config[CONF_SNAT_TRANSLATE_IP] != NULL) - && (strncasecmp(opts->config[CONF_SNAT_TRANSLATE_IP], "__CHANGEME__", 10)) != 0) + if(opts->fw_config->use_masquerade == 1) + { + if(set_fw_chain_conf(IPT_MASQUERADE_ACCESS, opts->config[CONF_IPT_MASQUERADE_ACCESS]) != 1) + return 0; + } + else if((opts->config[CONF_SNAT_TRANSLATE_IP] != NULL) + && (is_valid_ipv4_addr(opts->config[CONF_SNAT_TRANSLATE_IP]))) { if(set_fw_chain_conf(IPT_SNAT_ACCESS, opts->config[CONF_IPT_SNAT_ACCESS]) != 1) return 0; } else - { - if(set_fw_chain_conf(IPT_MASQUERADE_ACCESS, opts->config[CONF_IPT_MASQUERADE_ACCESS]) != 1) - return 0; - } + return 0; } } @@ -888,6 +882,15 @@ fw_initialize(const fko_srv_options_t * const opts) } } + if(strncasecmp(opts->config[CONF_ENABLE_IPT_SNAT], "Y", 1) == 0) + { + if(opts->config[CONF_SNAT_TRANSLATE_IP] == NULL + || ! is_valid_ipv4_addr(opts->config[CONF_SNAT_TRANSLATE_IP])) + { + opts->fw_config->use_masquerade = 1; + } + } + /* See if iptables offers the '-C' argument (older versions don't). If not, * then switch to parsing iptables -L output to find rules. */ diff --git a/server/fwknopd.8.in b/server/fwknopd.8.in index 38373486..bb41b6f1 100644 --- a/server/fwknopd.8.in +++ b/server/fwknopd.8.in @@ -1,13 +1,13 @@ '\" t .\" Title: fwknopd .\" Author: [see the "AUTHORS" section] -.\" Generator: DocBook XSL Stylesheets v1.76.1 -.\" Date: 07/29/2013 +.\" Generator: DocBook XSL Stylesheets v1.78.1 +.\" Date: 12/14/2013 .\" Manual: Fwknop Server .\" Source: Fwknop Server .\" Language: English .\" -.TH "FWKNOPD" "8" "07/29/2013" "Fwknop Server" "Fwknop Server" +.TH "FWKNOPD" "8" "12/14/2013" "Fwknop Server" "Fwknop Server" .\" ----------------------------------------------------------------- .\" * Define some portability stuff .\" ----------------------------------------------------------------- @@ -325,7 +325,8 @@ is running\&. \fBSNAT_TRANSLATE_IP\fR \fI\fR .RS 4 Specify the IP address for SNAT\&. This functionality is only enabled when \(lqENABLE_IPT_SNAT\(rq is set to \(lqY\(rq and by default SNAT rules are built with the MASQUERADE target (since then the internal IP does not have to be defined here in the -\fI@sysconfdir@/fwknop/fwknopd\&.conf\fR\*(Aq file), but if you want +\fI@sysconfdir@/fwknop/fwknopd\&.conf\fR +file), but if you want \fBfwknopd\fR to use the SNAT target, you must also define an IP address with the \(lqSNAT_TRANSLATE_IP\(rq variable\&. .RE @@ -543,6 +544,18 @@ argument\&. For any valid SPA packet, force the requested connection to be NAT\(cqd through to the specified (usually internal) IP and port value\&. This is useful if there are multiple internal systems running a service such as SSHD, and you want to give transparent access to only one internal system for each stanza in the access\&.conf file\&. This way, multiple external users can each directly access only one internal system per SPA key\&. .RE .PP +\fBFORCE_SNAT\fR \fI\fR +.RS 4 +For any valid SPA packet, add an SNAT rule in addition to any DNAT rule created with a corresponding (required) FORCE_NAT variable\&. This is analogous to \(lqSNAT_TRANSLATE_IP\(rq from the +\fI@sysconfdir@/fwknop/fwknopd\&.conf\fR +file except that it is per access stanza and overrides any value set with \(lqSNAT_TRANSLATE_IP\(rq\&. This is useful for situations where an incoming NAT\(cqd connection may be otherwise unanswerable due to routing constraints (i\&.e\&. the system receiving the SPA authenticated connection has a default route to a different device than the SPA system itself)\&. +.RE +.PP +\fBFORCE_MASQUERADE\fR \fI\fR +.RS 4 +This is similar to the \(lqFORCE_SNAT\(rq variable, except that it is not necessary to also specify an IP address for SNAT rules because the MASQUERADE target is used instead\&. +.RE +.PP \fBGPG_HOME_DIR\fR \fI\fR .RS 4 Define the path to the GnuPG directory to be used by the diff --git a/server/fwknopd_common.h b/server/fwknopd_common.h index 1083bd72..2e632ed0 100644 --- a/server/fwknopd_common.h +++ b/server/fwknopd_common.h @@ -382,6 +382,10 @@ typedef struct acc_stanza struct fw_config { struct fw_chain chain[NUM_FWKNOP_ACCESS_TYPES]; char fw_command[MAX_PATH_LEN]; + + /* Flag for iptables SNAT vs. MASQUERADE usage + */ + unsigned char use_masquerade; }; #elif FIREWALL_IPFW @@ -504,6 +508,7 @@ typedef struct fko_srv_options /* Set to 1 when messages have to go through syslog, 0 otherwise */ unsigned char syslog_enable; + } fko_srv_options_t; extern fko_srv_options_t options;