DeforaNetworks/fwknop
3
0
Fork 0
Code Releases Activity

more changes for firewalld

Browse Source
This commit is contained in:
Gerry Reno
2014-08-31 13:51:08 -04:00
parent d47ebb602a
commit ac82b1ced2
10 changed files with 501 additions and 101 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitignore
+15 -10
View File
@@ -35,12 +35,16 @@ Makefile
cmake_install.cmake
install_manifest.txt
# autoconf
*.m4
Makefile.in
# C, C++
*.o
*.lo
#project generated files
autom4te.cache/
*.m4
client/.deps/
client/Makefile.in
common/libfko_util.a
common/Makefile.in
config.h
config.h.in
@@ -48,23 +52,24 @@ config.log
config.status
config/
configure
doc/libfko.info
doc/Makefile.in
doc/stamp-vti
doc/version.texi
lib/libfko.la
lib/.deps/
lib/.dirstamp
lib/.libs/
lib/Makefile.in
libtool
Makefile.in
server/.deps/
server/.libs/
server/fwknopd
server/fwknopd.8
server/Makefile.in
stamp-h1
# C, C++
*.o
*.lo
#project generated files
common/libfko_util.a
lib/libfko.la
android/project/libs
android/project/obj
android/project/jni/fwknop/fko.h
server/Makefile.am
+1
View File
@@ -8,6 +8,7 @@ fwknopd_SOURCES = fwknopd.c fwknopd.h config_init.c config_init.h \
access.c access.h fwknopd_errors.c fwknopd_errors.h \
tcp_server.c tcp_server.h extcmd.c extcmd.h \
fw_util.c fw_util.h fw_util_ipf.c fw_util_ipf.h \
fw_util_firewalld.c fw_util_firewalld.h \
fw_util_iptables.c fw_util_iptables.h \
fw_util_ipfw.c fw_util_ipfw.h \
fw_util_pf.c fw_util_pf.h cmd_opts.h
server/access.c
+28 -2
View File
@@ -1585,7 +1585,20 @@ parse_access_file(fko_srv_options_t *opts)
}
else if(CONF_VAR_IS(var, "FORCE_NAT"))
{
#if defined(FIREWALL_FIREWALLD) || defined(FIREWALL_IPTABLES)
#if FIREWALL_FIREWALLD
if(strncasecmp(opts->config[CONF_ENABLE_FIREWD_FORWARDING], "Y", 1) !=0 )
{
log_msg(LOG_ERR,
"[*] FORCE_NAT requires ENABLE_FIREWD_FORWARDING to be enabled in fwknopd.conf");
fclose(file_ptr);
clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE);
}
if(add_acc_force_nat(opts, curr_acc, val) != SUCCESS)
{
fclose(file_ptr);
clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE);
}
#elif FIREWALL_IPTABLES
if(strncasecmp(opts->config[CONF_ENABLE_IPT_FORWARDING], "Y", 1) !=0 )
{
log_msg(LOG_ERR,
@@ -1607,7 +1620,20 @@ parse_access_file(fko_srv_options_t *opts)
}
else if(CONF_VAR_IS(var, "FORCE_SNAT"))
{
#if defined(FIREWALL_FIREWALLD) || defined(FIREWALL_IPTABLES)
#if FIREWALL_FIREWALLD
if(strncasecmp(opts->config[CONF_ENABLE_FIREWD_FORWARDING], "Y", 1) !=0 )
{
log_msg(LOG_ERR,
"[*] FORCE_SNAT requires ENABLE_FIREWD_FORWARDING to be enabled in fwknopd.conf");
fclose(file_ptr);
clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE);
}
if(add_acc_force_snat(opts, curr_acc, val) != SUCCESS)
{
fclose(file_ptr);
clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE);
}
#elif FIREWALL_IPTABLES
if(strncasecmp(opts->config[CONF_ENABLE_IPT_FORWARDING], "Y", 1) !=0 )
{
log_msg(LOG_ERR,
server/cmd_opts.h
+18 -1
View File
@@ -66,7 +66,22 @@ static char *config_map[NUMBER_OF_CONFIG_ENTRIES] = {
//"EXTERNAL_CMD_ALARM",
//"ENABLE_EXT_CMD_PREFIX",
//"EXT_CMD_PREFIX",
#if defined(FIREWALL_FIREWALLD) || defined(FIREWALL_IPTABLES)
#if FIREWALL_FIREWALLD
"ENABLE_FIREWD_FORWARDING",
"ENABLE_FIREWD_LOCAL_NAT",
"ENABLE_FIREWD_SNAT",
"SNAT_TRANSLATE_IP",
"ENABLE_FIREWD_OUTPUT",
"FLUSH_FIREWD_AT_INIT",
"FLUSH_FIREWD_AT_EXIT",
"FIREWD_INPUT_ACCESS",
"FIREWD_OUTPUT_ACCESS",
"FIREWD_FORWARD_ACCESS",
"FIREWD_DNAT_ACCESS",
"FIREWD_SNAT_ACCESS",
"FIREWD_MASQUERADE_ACCESS",
"ENABLE_FIREWD_COMMENT_CHECK",
#elif FIREWALL_IPTABLES
"ENABLE_IPT_FORWARDING",
"ENABLE_IPT_LOCAL_NAT",
"ENABLE_IPT_SNAT",
@@ -121,6 +136,7 @@ enum {
FW_FLUSH,
GPG_HOME_DIR,
GPG_EXE_PATH,
FIREWD_DISABLE_CHECK_SUPPORT,
IPT_DISABLE_CHECK_SUPPORT,
PCAP_FILE,
ENABLE_PCAP_ANY_DIRECTION,
@@ -158,6 +174,7 @@ static struct option cmd_opts[] =
{"fw-list-all", 0, NULL, FW_LIST_ALL },
{"gpg-home-dir", 1, NULL, GPG_HOME_DIR },
{"gpg-exe", 1, NULL, GPG_EXE_PATH },
{"no-firewd-check-support", 0, NULL, FIREWD_DISABLE_CHECK_SUPPORT },
{"no-ipt-check-support", 0, NULL, IPT_DISABLE_CHECK_SUPPORT },
{"locale", 1, NULL, 'l' },
{"rotate-digest-cache", 0, NULL, ROTATE_DIGEST_CACHE },
server/config_init.c
+149 -1
View File
@@ -430,7 +430,150 @@ validate_options(fko_srv_options_t *opts)
if(opts->config[CONF_MAX_SNIFF_BYTES] == NULL)
set_config_entry(opts, CONF_MAX_SNIFF_BYTES, DEF_MAX_SNIFF_BYTES);
#if defined(FIREWALL_FIREWALLD) || defined(FIREWALL_IPTABLES)
#if FIREWALL_FIREWALLD
/* Enable FIREWD forwarding.
*/
if(opts->config[CONF_ENABLE_FIREWD_FORWARDING] == NULL)
set_config_entry(opts, CONF_ENABLE_FIREWD_FORWARDING,
DEF_ENABLE_FIREWD_FORWARDING);
/* Enable FIREWD local NAT.
*/
if(opts->config[CONF_ENABLE_FIREWD_LOCAL_NAT] == NULL)
set_config_entry(opts, CONF_ENABLE_FIREWD_LOCAL_NAT,
DEF_ENABLE_FIREWD_LOCAL_NAT);
/* Enable FIREWD SNAT.
*/
if(opts->config[CONF_ENABLE_FIREWD_SNAT] == NULL)
set_config_entry(opts, CONF_ENABLE_FIREWD_SNAT,
DEF_ENABLE_FIREWD_SNAT);
/* Make sure we have a valid IP if SNAT is enabled
*/
if(strncasecmp(opts->config[CONF_ENABLE_FIREWD_SNAT], "Y", 1) == 0)
{
/* Note that fw_config_init() will set use_masquerade if necessary
*/
if(opts->config[CONF_SNAT_TRANSLATE_IP] != NULL)
{
if(! is_valid_ipv4_addr(opts->config[CONF_SNAT_TRANSLATE_IP]))
{
log_msg(LOG_ERR,
"Invalid IPv4 addr for SNAT_TRANSLATE_IP"
);
clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE);
}
}
}
/* Enable FIREWD OUTPUT.
*/
if(opts->config[CONF_ENABLE_FIREWD_OUTPUT] == NULL)
set_config_entry(opts, CONF_ENABLE_FIREWD_OUTPUT,
DEF_ENABLE_FIREWD_OUTPUT);
/* Flush FIREWD at init.
*/
if(opts->config[CONF_FLUSH_FIREWD_AT_INIT] == NULL)
set_config_entry(opts, CONF_FLUSH_FIREWD_AT_INIT, DEF_FLUSH_FIREWD_AT_INIT);
/* Flush FIREWD at exit.
*/
if(opts->config[CONF_FLUSH_FIREWD_AT_EXIT] == NULL)
set_config_entry(opts, CONF_FLUSH_FIREWD_AT_EXIT, DEF_FLUSH_FIREWD_AT_EXIT);
/* FIREWD input access.
*/
if(opts->config[CONF_FIREWD_INPUT_ACCESS] == NULL)
set_config_entry(opts, CONF_FIREWD_INPUT_ACCESS,
DEF_FIREWD_INPUT_ACCESS);
if(validate_firewd_chain_conf(opts->config[CONF_FIREWD_INPUT_ACCESS]) != 1)
{
log_msg(LOG_ERR,
"Invalid FIREWD_INPUT_ACCESS specification, see fwknopd.conf comments"
);
clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE);
}
/* FIREWD output access.
*/
if(opts->config[CONF_FIREWD_OUTPUT_ACCESS] == NULL)
set_config_entry(opts, CONF_FIREWD_OUTPUT_ACCESS,
DEF_FIREWD_OUTPUT_ACCESS);
if(validate_firewd_chain_conf(opts->config[CONF_FIREWD_OUTPUT_ACCESS]) != 1)
{
log_msg(LOG_ERR,
"Invalid FIREWD_OUTPUT_ACCESS specification, see fwknopd.conf comments"
);
clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE);
}
/* FIREWD forward access.
*/
if(opts->config[CONF_FIREWD_FORWARD_ACCESS] == NULL)
set_config_entry(opts, CONF_FIREWD_FORWARD_ACCESS,
DEF_FIREWD_FORWARD_ACCESS);
if(validate_firewd_chain_conf(opts->config[CONF_FIREWD_FORWARD_ACCESS]) != 1)
{
log_msg(LOG_ERR,
"Invalid FIREWD_FORWARD_ACCESS specification, see fwknopd.conf comments"
);
clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE);
}
/* FIREWD dnat access.
*/
if(opts->config[CONF_FIREWD_DNAT_ACCESS] == NULL)
set_config_entry(opts, CONF_FIREWD_DNAT_ACCESS,
DEF_FIREWD_DNAT_ACCESS);
if(validate_firewd_chain_conf(opts->config[CONF_FIREWD_DNAT_ACCESS]) != 1)
{
log_msg(LOG_ERR,
"Invalid FIREWD_DNAT_ACCESS specification, see fwknopd.conf comments"
);
clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE);
}
/* FIREWD snat access.
*/
if(opts->config[CONF_FIREWD_SNAT_ACCESS] == NULL)
set_config_entry(opts, CONF_FIREWD_SNAT_ACCESS,
DEF_FIREWD_SNAT_ACCESS);
if(validate_firewd_chain_conf(opts->config[CONF_FIREWD_SNAT_ACCESS]) != 1)
{
log_msg(LOG_ERR,
"Invalid FIREWD_SNAT_ACCESS specification, see fwknopd.conf comments"
);
clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE);
}
/* FIREWD masquerade access.
*/
if(opts->config[CONF_FIREWD_MASQUERADE_ACCESS] == NULL)
set_config_entry(opts, CONF_FIREWD_MASQUERADE_ACCESS,
DEF_FIREWD_MASQUERADE_ACCESS);
if(validate_firewd_chain_conf(opts->config[CONF_FIREWD_MASQUERADE_ACCESS]) != 1)
{
log_msg(LOG_ERR,
"Invalid FIREWD_MASQUERADE_ACCESS specification, see fwknopd.conf comments"
);
clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE);
}
/* Check for the firewalld 'comment' match at init time
*/
if(opts->config[CONF_ENABLE_FIREWD_COMMENT_CHECK] == NULL)
set_config_entry(opts, CONF_ENABLE_FIREWD_COMMENT_CHECK,
DEF_ENABLE_FIREWD_COMMENT_CHECK);
#elif FIREWALL_IPTABLES
/* Enable IPT forwarding.
*/
if(opts->config[CONF_ENABLE_IPT_FORWARDING] == NULL)
@@ -931,6 +1074,9 @@ config_init(fko_srv_options_t *opts, int argc, char **argv)
case 'i':
set_config_entry(opts, CONF_PCAP_INTF, optarg);
break;
case FIREWD_DISABLE_CHECK_SUPPORT:
opts->firewd_disable_check_support = 1;
break;
case IPT_DISABLE_CHECK_SUPPORT:
opts->ipt_disable_check_support = 1;
break;
@@ -1071,6 +1217,8 @@ usage(void)
" done in the access.conf file).\n"
" --gpg-exe - Specify the path to GPG (this is normally done in\n"
" the access.conf file).\n"
" --no-firewd-check-support\n"
" - Disable test for 'firewall-cmd ... -C' support.\n"
" --no-ipt-check-support - Disable test for 'iptables -C' support.\n"
"\n"
);
server/fw_util_firewalld.c
+81 -81
View File
@@ -44,8 +44,8 @@ static char cmd_buf[CMD_BUFSIZE];
static char err_buf[CMD_BUFSIZE];
static char cmd_out[STANDARD_CMD_OUT_BUFSIZE];
/* assume 'firewalld -C' is offered since only older versions
* don't have this (see firewd_chk_support()).
/* assume 'firewall-cmd --direct --passthrough ipv4 -C' is offered
* (see firewd_chk_support()).
*/
static int have_firewd_chk_support = 1;
@@ -81,7 +81,7 @@ rule_exists_no_chk_support(const fko_srv_options_t * const opts,
char exp_ts_search[CMD_BUFSIZE] = {0};
FILE *firewd;
snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " IPT_LIST_RULES_ARGS,
snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " FIREWD_LIST_RULES_ARGS,
opts->fw_config->fw_command,
fwc->table,
fwc->to_chain
@@ -152,7 +152,7 @@ rule_exists_chk_support(const fko_srv_options_t * const opts,
zero_cmd_buffers();
snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " IPT_CHK_RULE_ARGS,
snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " FIREWD_CHK_RULE_ARGS,
opts->fw_config->fw_command, chain, rule);
res = run_extcmd(cmd_buf, err_buf, CMD_BUFSIZE, 0);
@@ -203,7 +203,7 @@ static void
firewd_chk_support(const fko_srv_options_t * const opts)
{
int res = 1;
struct fw_chain *in_chain = &(opts->fw_config->chain[IPT_INPUT_ACCESS]);
struct fw_chain *in_chain = &(opts->fw_config->chain[FIREWD_INPUT_ACCESS]);
zero_cmd_buffers();
@@ -211,7 +211,7 @@ firewd_chk_support(const fko_srv_options_t * const opts)
* supports '-C' to check for it. Set "have_firewd_chk_support" accordingly,
* delete the rule, and return.
*/
snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " IPT_TMP_CHK_RULE_ARGS,
snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " FIREWD_TMP_CHK_RULE_ARGS,
opts->fw_config->fw_command,
in_chain->table,
in_chain->from_chain,
@@ -229,7 +229,7 @@ firewd_chk_support(const fko_srv_options_t * const opts)
/* Now see if '-C' works - any output indicates failure
*/
snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " IPT_TMP_VERIFY_CHK_ARGS,
snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " FIREWD_TMP_VERIFY_CHK_ARGS,
opts->fw_config->fw_command,
in_chain->table,
in_chain->from_chain,
@@ -257,7 +257,7 @@ firewd_chk_support(const fko_srv_options_t * const opts)
*/
zero_cmd_buffers();
snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " IPT_DEL_RULE_ARGS,
snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " FIREWD_DEL_RULE_ARGS,
opts->fw_config->fw_command,
in_chain->table,
in_chain->from_chain,
@@ -273,7 +273,7 @@ comment_match_exists(const fko_srv_options_t * const opts)
{
int res = 1;
char *ndx = NULL;
struct fw_chain *in_chain = &(opts->fw_config->chain[IPT_INPUT_ACCESS]);
struct fw_chain *in_chain = &(opts->fw_config->chain[FIREWD_INPUT_ACCESS]);
zero_cmd_buffers();
@@ -281,7 +281,7 @@ comment_match_exists(const fko_srv_options_t * const opts)
* match and make sure it exists. If not, return zero. Otherwise, delete
* the rule and return true.
*/
snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " IPT_TMP_COMMENT_ARGS,
snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " FIREWD_TMP_COMMENT_ARGS,
opts->fw_config->fw_command,
in_chain->table,
in_chain->from_chain,
@@ -297,7 +297,7 @@ comment_match_exists(const fko_srv_options_t * const opts)
zero_cmd_buffers();
snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " IPT_LIST_RULES_ARGS,
snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " FIREWD_LIST_RULES_ARGS,
opts->fw_config->fw_command,
in_chain->table,
in_chain->from_chain
@@ -321,7 +321,7 @@ comment_match_exists(const fko_srv_options_t * const opts)
*/
zero_cmd_buffers();
snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " IPT_DEL_RULE_ARGS,
snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " FIREWD_DEL_RULE_ARGS,
opts->fw_config->fw_command,
in_chain->table,
in_chain->from_chain,
@@ -340,7 +340,7 @@ add_jump_rule(const fko_srv_options_t * const opts, const int chain_num)
zero_cmd_buffers();
snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " IPT_ADD_JUMP_RULE_ARGS,
snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " FIREWD_ADD_JUMP_RULE_ARGS,
fwc.fw_command,
fwc.chain[chain_num].table,
fwc.chain[chain_num].from_chain,
@@ -370,7 +370,7 @@ chain_exists(const fko_srv_options_t * const opts, const int chain_num)
zero_cmd_buffers();
snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " IPT_CHAIN_EXISTS_ARGS,
snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " FIREWD_CHAIN_EXISTS_ARGS,
fwc.fw_command,
fwc.chain[chain_num].table,
fwc.chain[chain_num].to_chain
@@ -398,7 +398,7 @@ jump_rule_exists_chk_support(const fko_srv_options_t * const opts, const int cha
int exists = 0;
char rule_buf[CMD_BUFSIZE] = {0};
snprintf(rule_buf, CMD_BUFSIZE-1, IPT_CHK_JUMP_RULE_ARGS,
snprintf(rule_buf, CMD_BUFSIZE-1, FIREWD_CHK_JUMP_RULE_ARGS,
fwc.chain[chain_num].table,
fwc.chain[chain_num].to_chain
);
@@ -423,7 +423,7 @@ jump_rule_exists_no_chk_support(const fko_srv_options_t * const opts, const int
char line_buf[CMD_BUFSIZE] = {0};
FILE *firewd;
snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " IPT_LIST_RULES_ARGS,
snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " FIREWD_LIST_RULES_ARGS,
fwc.fw_command,
fwc.chain[chain_num].table,
fwc.chain[chain_num].from_chain
@@ -508,7 +508,7 @@ fw_dump_rules(const fko_srv_options_t * const opts)
/* Create the list command
*/
snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " IPT_LIST_ALL_RULES_ARGS,
snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " FIREWD_LIST_ALL_RULES_ARGS,
opts->fw_config->fw_command,
ch[i].table
);
@@ -541,7 +541,7 @@ fw_dump_rules(const fko_srv_options_t * const opts)
/* Create the list command
*/
snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " IPT_LIST_RULES_ARGS,
snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " FIREWD_LIST_RULES_ARGS,
opts->fw_config->fw_command,
ch[i].table,
ch[i].to_chain
@@ -586,7 +586,7 @@ delete_all_chains(const fko_srv_options_t * const opts)
{
zero_cmd_buffers();
snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " IPT_DEL_JUMP_RULE_ARGS,
snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " FIREWD_DEL_JUMP_RULE_ARGS,
fwc.fw_command,
fwc.chain[i].table,
fwc.chain[i].from_chain,
@@ -611,7 +611,7 @@ delete_all_chains(const fko_srv_options_t * const opts)
/* Now flush and remove the chain.
*/
snprintf(cmd_buf, CMD_BUFSIZE-1,
"(%s " IPT_FLUSH_CHAIN_ARGS "; %s " IPT_DEL_CHAIN_ARGS ")", // > /dev/null 2>&1",
"(%s " FIREWD_FLUSH_CHAIN_ARGS "; %s " FIREWD_DEL_CHAIN_ARGS ")", // > /dev/null 2>&1",
fwc.fw_command,
fwc.chain[i].table,
fwc.chain[i].to_chain,
@@ -641,7 +641,7 @@ create_chain(const fko_srv_options_t * const opts, const int chain_num)
/* Create the custom chain.
*/
snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " IPT_NEW_CHAIN_ARGS,
snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " FIREWD_NEW_CHAIN_ARGS,
fwc.fw_command,
fwc.chain[chain_num].table,
fwc.chain[chain_num].to_chain
@@ -764,7 +764,7 @@ set_fw_chain_conf(const int type, const char * const conf_str)
/* Pull and set Jump_rule_position */
chain->jump_rule_pos = strtol_wrapper(chain_fields[3],
0, RCHK_MAX_IPT_RULE_NUM, NO_EXIT_UPON_ERR, &is_err);
0, RCHK_MAX_FIREWD_RULE_NUM, NO_EXIT_UPON_ERR, &is_err);
if(is_err != FKO_SUCCESS)
{
log_msg(LOG_ERR, "[*] invalid jump rule position in Line: %s",
@@ -777,7 +777,7 @@ set_fw_chain_conf(const int type, const char * const conf_str)
/* Pull and set to_chain rule position */
chain->rule_pos = strtol_wrapper(chain_fields[5],
0, RCHK_MAX_IPT_RULE_NUM, NO_EXIT_UPON_ERR, &is_err);
0, RCHK_MAX_FIREWD_RULE_NUM, NO_EXIT_UPON_ERR, &is_err);
if(is_err != FKO_SUCCESS)
{
log_msg(LOG_ERR, "[*] invalid to_chain rule position in Line: %s",
@@ -802,44 +802,44 @@ fw_config_init(fko_srv_options_t * const opts)
#endif
/* Pull the fwknop chain config info and setup our internal
* config struct. The IPT_INPUT is the only one that is
* config struct. The FIREWD_INPUT is the only one that is
* required. The rest are optional.
*/
if(set_fw_chain_conf(IPT_INPUT_ACCESS, opts->config[CONF_IPT_INPUT_ACCESS]) != 1)
if(set_fw_chain_conf(FIREWD_INPUT_ACCESS, opts->config[CONF_FIREWD_INPUT_ACCESS]) != 1)
return 0;
/* The FWKNOP_OUTPUT_ACCESS requires ENABLE_IPT_OUTPUT_ACCESS be Y
/* The FWKNOP_OUTPUT_ACCESS requires ENABLE_FIREWD_OUTPUT_ACCESS be Y
*/
if(strncasecmp(opts->config[CONF_ENABLE_IPT_OUTPUT], "Y", 1)==0)
if(set_fw_chain_conf(IPT_OUTPUT_ACCESS, opts->config[CONF_IPT_OUTPUT_ACCESS]) != 1)
if(strncasecmp(opts->config[CONF_ENABLE_FIREWD_OUTPUT], "Y", 1)==0)
if(set_fw_chain_conf(FIREWD_OUTPUT_ACCESS, opts->config[CONF_FIREWD_OUTPUT_ACCESS]) != 1)
return 0;
/* The remaining access chains require ENABLE_IPT_FORWARDING = Y
/* The remaining access chains require ENABLE_FIREWD_FORWARDING = Y
*/
if(strncasecmp(opts->config[CONF_ENABLE_IPT_FORWARDING], "Y", 1)==0)
if(strncasecmp(opts->config[CONF_ENABLE_FIREWD_FORWARDING], "Y", 1)==0)
{
if(set_fw_chain_conf(IPT_FORWARD_ACCESS, opts->config[CONF_IPT_FORWARD_ACCESS]) != 1)
if(set_fw_chain_conf(FIREWD_FORWARD_ACCESS, opts->config[CONF_FIREWD_FORWARD_ACCESS]) != 1)
return 0;
if(set_fw_chain_conf(IPT_DNAT_ACCESS, opts->config[CONF_IPT_DNAT_ACCESS]) != 1)
if(set_fw_chain_conf(FIREWD_DNAT_ACCESS, opts->config[CONF_FIREWD_DNAT_ACCESS]) != 1)
return 0;
/* SNAT (whichever mode) requires ENABLE_IPT_SNAT = Y
/* SNAT (whichever mode) requires ENABLE_FIREWD_SNAT = Y
*/
if(strncasecmp(opts->config[CONF_ENABLE_IPT_SNAT], "Y", 1)==0)
if(strncasecmp(opts->config[CONF_ENABLE_FIREWD_SNAT], "Y", 1)==0)
{
if(opts->config[CONF_SNAT_TRANSLATE_IP] == NULL
|| ! is_valid_ipv4_addr(opts->config[CONF_SNAT_TRANSLATE_IP]))
{
fwc.use_masquerade = 1;
if(set_fw_chain_conf(IPT_MASQUERADE_ACCESS, opts->config[CONF_IPT_MASQUERADE_ACCESS]) != 1)
if(set_fw_chain_conf(FIREWD_MASQUERADE_ACCESS, opts->config[CONF_FIREWD_MASQUERADE_ACCESS]) != 1)
return 0;
}
else
{
if(is_valid_ipv4_addr(opts->config[CONF_SNAT_TRANSLATE_IP]))
{
if(set_fw_chain_conf(IPT_SNAT_ACCESS, opts->config[CONF_IPT_SNAT_ACCESS]) != 1)
if(set_fw_chain_conf(FIREWD_SNAT_ACCESS, opts->config[CONF_FIREWD_SNAT_ACCESS]) != 1)
return 0;
}
else
@@ -864,7 +864,7 @@ fw_initialize(const fko_srv_options_t * const opts)
/* Flush the chains (just in case) so we can start fresh.
*/
if(strncasecmp(opts->config[CONF_FLUSH_IPT_AT_INIT], "Y", 1) == 0)
if(strncasecmp(opts->config[CONF_FLUSH_FIREWD_AT_INIT], "Y", 1) == 0)
delete_all_chains(opts);
/* Now create any configured chains.
@@ -878,7 +878,7 @@ fw_initialize(const fko_srv_options_t * const opts)
/* Make sure that the 'comment' match is available
*/
if(strncasecmp(opts->config[CONF_ENABLE_IPT_COMMENT_CHECK], "Y", 1) == 0)
if(strncasecmp(opts->config[CONF_ENABLE_FIREWD_COMMENT_CHECK], "Y", 1) == 0)
{
if(comment_match_exists(opts) == 1)
{
@@ -905,7 +905,7 @@ fw_initialize(const fko_srv_options_t * const opts)
int
fw_cleanup(const fko_srv_options_t * const opts)
{
if(strncasecmp(opts->config[CONF_FLUSH_IPT_AT_EXIT], "N", 1) == 0
if(strncasecmp(opts->config[CONF_FLUSH_FIREWD_AT_EXIT], "N", 1) == 0
&& opts->fw_flush == 0)
return(0);
@@ -961,10 +961,10 @@ process_spa_request(const fko_srv_options_t * const opts,
unsigned int fst_proto;
unsigned int fst_port;
struct fw_chain * const in_chain = &(opts->fw_config->chain[IPT_INPUT_ACCESS]);
struct fw_chain * const out_chain = &(opts->fw_config->chain[IPT_OUTPUT_ACCESS]);
struct fw_chain * const fwd_chain = &(opts->fw_config->chain[IPT_FORWARD_ACCESS]);
struct fw_chain * const dnat_chain = &(opts->fw_config->chain[IPT_DNAT_ACCESS]);
struct fw_chain * const in_chain = &(opts->fw_config->chain[FIREWD_INPUT_ACCESS]);
struct fw_chain * const out_chain = &(opts->fw_config->chain[FIREWD_OUTPUT_ACCESS]);
struct fw_chain * const fwd_chain = &(opts->fw_config->chain[FIREWD_FORWARD_ACCESS]);
struct fw_chain * const dnat_chain = &(opts->fw_config->chain[FIREWD_DNAT_ACCESS]);
struct fw_chain *snat_chain; /* We assign this later (if we need to). */
int res = 0, is_err, snat_chain_num = 0;
@@ -1008,19 +1008,19 @@ process_spa_request(const fko_srv_options_t * const opts,
/* Check to make sure that the jump rules exist for each
* required chain
*/
if(chain_exists(opts, IPT_INPUT_ACCESS) == 0)
create_chain(opts, IPT_INPUT_ACCESS);
if(chain_exists(opts, FIREWD_INPUT_ACCESS) == 0)
create_chain(opts, FIREWD_INPUT_ACCESS);
if(jump_rule_exists(opts, IPT_INPUT_ACCESS) == 0)
add_jump_rule(opts, IPT_INPUT_ACCESS);
if(jump_rule_exists(opts, FIREWD_INPUT_ACCESS) == 0)
add_jump_rule(opts, FIREWD_INPUT_ACCESS);
if(strlen(out_chain->to_chain))
{
if(chain_exists(opts, IPT_OUTPUT_ACCESS) == 0)
create_chain(opts, IPT_OUTPUT_ACCESS);
if(chain_exists(opts, FIREWD_OUTPUT_ACCESS) == 0)
create_chain(opts, FIREWD_OUTPUT_ACCESS);
if(jump_rule_exists(opts, IPT_OUTPUT_ACCESS) == 0)
add_jump_rule(opts, IPT_OUTPUT_ACCESS);
if(jump_rule_exists(opts, FIREWD_OUTPUT_ACCESS) == 0)
add_jump_rule(opts, FIREWD_OUTPUT_ACCESS);
}
/* Create an access command for each proto/port for the source ip.
@@ -1029,7 +1029,7 @@ process_spa_request(const fko_srv_options_t * const opts,
{
memset(rule_buf, 0, CMD_BUFSIZE);
snprintf(rule_buf, CMD_BUFSIZE-1, IPT_RULE_ARGS,
snprintf(rule_buf, CMD_BUFSIZE-1, FIREWD_RULE_ARGS,
in_chain->table,
ple->proto,
spadat->use_src_ip,
@@ -1065,7 +1065,7 @@ process_spa_request(const fko_srv_options_t * const opts,
{
memset(rule_buf, 0, CMD_BUFSIZE);
snprintf(rule_buf, CMD_BUFSIZE-1, IPT_OUT_RULE_ARGS,
snprintf(rule_buf, CMD_BUFSIZE-1, FIREWD_OUT_RULE_ARGS,
out_chain->table,
ple->proto,
spadat->use_src_ip,
@@ -1138,7 +1138,7 @@ process_spa_request(const fko_srv_options_t * const opts,
{
memset(rule_buf, 0, CMD_BUFSIZE);
snprintf(rule_buf, CMD_BUFSIZE-1, IPT_RULE_ARGS,
snprintf(rule_buf, CMD_BUFSIZE-1, FIREWD_RULE_ARGS,
in_chain->table,
fst_proto,
spadat->use_src_ip,
@@ -1150,11 +1150,11 @@ process_spa_request(const fko_srv_options_t * const opts,
/* Check to make sure that the jump rules exist for each
* required chain
*/
if(chain_exists(opts, IPT_INPUT_ACCESS) == 0)
create_chain(opts, IPT_INPUT_ACCESS);
if(chain_exists(opts, FIREWD_INPUT_ACCESS) == 0)
create_chain(opts, FIREWD_INPUT_ACCESS);
if(jump_rule_exists(opts, IPT_INPUT_ACCESS) == 0)
add_jump_rule(opts, IPT_INPUT_ACCESS);
if(jump_rule_exists(opts, FIREWD_INPUT_ACCESS) == 0)
add_jump_rule(opts, FIREWD_INPUT_ACCESS);
if(rule_exists(opts, in_chain, rule_buf,
fst_proto, spadat->use_src_ip, nat_port, exp_ts) == 0)
@@ -1181,15 +1181,15 @@ process_spa_request(const fko_srv_options_t * const opts,
/* Make our FORWARD and NAT rules, and make sure the
* required chain and jump rule exists
*/
if(chain_exists(opts, IPT_FORWARD_ACCESS) == 0)
create_chain(opts, IPT_FORWARD_ACCESS);
if(chain_exists(opts, FIREWD_FORWARD_ACCESS) == 0)
create_chain(opts, FIREWD_FORWARD_ACCESS);
if (jump_rule_exists(opts, IPT_FORWARD_ACCESS) == 0)
add_jump_rule(opts, IPT_FORWARD_ACCESS);
if (jump_rule_exists(opts, FIREWD_FORWARD_ACCESS) == 0)
add_jump_rule(opts, FIREWD_FORWARD_ACCESS);
memset(rule_buf, 0, CMD_BUFSIZE);
snprintf(rule_buf, CMD_BUFSIZE-1, IPT_FWD_RULE_ARGS,
snprintf(rule_buf, CMD_BUFSIZE-1, FIREWD_FWD_RULE_ARGS,
fwd_chain->table,
fst_proto,
spadat->use_src_ip,
@@ -1224,15 +1224,15 @@ process_spa_request(const fko_srv_options_t * const opts,
{
/* Make sure the required chain and jump rule exist
*/
if(chain_exists(opts, IPT_DNAT_ACCESS) == 0)
create_chain(opts, IPT_DNAT_ACCESS);
if(chain_exists(opts, FIREWD_DNAT_ACCESS) == 0)
create_chain(opts, FIREWD_DNAT_ACCESS);
if (jump_rule_exists(opts, IPT_DNAT_ACCESS) == 0)
add_jump_rule(opts, IPT_DNAT_ACCESS);
if (jump_rule_exists(opts, FIREWD_DNAT_ACCESS) == 0)
add_jump_rule(opts, FIREWD_DNAT_ACCESS);
memset(rule_buf, 0, CMD_BUFSIZE);
snprintf(rule_buf, CMD_BUFSIZE-1, IPT_DNAT_RULE_ARGS,
snprintf(rule_buf, CMD_BUFSIZE-1, FIREWD_DNAT_RULE_ARGS,
dnat_chain->table,
fst_proto,
spadat->use_src_ip,
@@ -1266,43 +1266,43 @@ process_spa_request(const fko_srv_options_t * const opts,
/* If SNAT (or MASQUERADE) is wanted, then we add those rules here as well.
*/
if(acc->force_snat || strncasecmp(opts->config[CONF_ENABLE_IPT_SNAT], "Y", 1) == 0)
if(acc->force_snat || strncasecmp(opts->config[CONF_ENABLE_FIREWD_SNAT], "Y", 1) == 0)
{
/* Add SNAT or MASQUERADE rules.
*/
if(acc->force_snat && is_valid_ipv4_addr(acc->force_snat_ip))
{
/* Using static SNAT */
snat_chain = &(opts->fw_config->chain[IPT_SNAT_ACCESS]);
snat_chain = &(opts->fw_config->chain[FIREWD_SNAT_ACCESS]);
snprintf(snat_target, SNAT_TARGET_BUFSIZE-1,
"--to-source %s:%i", acc->force_snat_ip, fst_port);
snat_chain_num = IPT_SNAT_ACCESS;
snat_chain_num = FIREWD_SNAT_ACCESS;
}
else if(acc->force_snat && acc->force_masquerade)
{
/* Using MASQUERADE */
snat_chain = &(opts->fw_config->chain[IPT_MASQUERADE_ACCESS]);
snat_chain = &(opts->fw_config->chain[FIREWD_MASQUERADE_ACCESS]);
snprintf(snat_target, SNAT_TARGET_BUFSIZE-1,
"--to-ports %i", fst_port);
snat_chain_num = IPT_MASQUERADE_ACCESS;
snat_chain_num = FIREWD_MASQUERADE_ACCESS;
}
else if((opts->config[CONF_SNAT_TRANSLATE_IP] != NULL)
&& is_valid_ipv4_addr(opts->config[CONF_SNAT_TRANSLATE_IP]))
{
/* Using static SNAT */
snat_chain = &(opts->fw_config->chain[IPT_SNAT_ACCESS]);
snat_chain = &(opts->fw_config->chain[FIREWD_SNAT_ACCESS]);
snprintf(snat_target, SNAT_TARGET_BUFSIZE-1,
"--to-source %s:%i", opts->config[CONF_SNAT_TRANSLATE_IP],
fst_port);
snat_chain_num = IPT_SNAT_ACCESS;
snat_chain_num = FIREWD_SNAT_ACCESS;
}
else
{
/* Using MASQUERADE */
snat_chain = &(opts->fw_config->chain[IPT_MASQUERADE_ACCESS]);
snat_chain = &(opts->fw_config->chain[FIREWD_MASQUERADE_ACCESS]);
snprintf(snat_target, SNAT_TARGET_BUFSIZE-1,
"--to-ports %i", fst_port);
snat_chain_num = IPT_MASQUERADE_ACCESS;
snat_chain_num = FIREWD_MASQUERADE_ACCESS;
}
if(chain_exists(opts, snat_chain_num) == 0)
@@ -1313,7 +1313,7 @@ process_spa_request(const fko_srv_options_t * const opts,
memset(rule_buf, 0, CMD_BUFSIZE);
snprintf(rule_buf, CMD_BUFSIZE-1, IPT_SNAT_RULE_ARGS,
snprintf(rule_buf, CMD_BUFSIZE-1, FIREWD_SNAT_RULE_ARGS,
snat_chain->table,
fst_proto,
nat_ip,
@@ -1386,7 +1386,7 @@ check_firewall_rules(const fko_srv_options_t * const opts)
/* There should be a rule to delete. Get the current list of
* rules for this chain and delete the ones that are expired.
*/
snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " IPT_LIST_RULES_ARGS,
snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " FIREWD_LIST_RULES_ARGS,
opts->fw_config->fw_command,
ch[i].table,
ch[i].to_chain
@@ -1478,7 +1478,7 @@ check_firewall_rules(const fko_srv_options_t * const opts)
strlcpy(rule_num_str, rn_start, (rn_end - rn_start)+1);
rule_num = strtol_wrapper(rule_num_str, rn_offset, RCHK_MAX_IPT_RULE_NUM,
rule_num = strtol_wrapper(rule_num_str, rn_offset, RCHK_MAX_FIREWD_RULE_NUM,
NO_EXIT_UPON_ERR, &is_err);
if(is_err != FKO_SUCCESS)
{
@@ -1493,7 +1493,7 @@ check_firewall_rules(const fko_srv_options_t * const opts)
zero_cmd_buffers();
snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " IPT_DEL_RULE_ARGS,
snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " FIREWD_DEL_RULE_ARGS,
opts->fw_config->fw_command,
ch[i].table,
ch[i].to_chain,
server/fw_util_firewalld.h
+1 -1
View File
@@ -55,7 +55,7 @@
#define FIREWD_LIST_RULES_ARGS "--direct --passthrough ipv4 -t %s -L %s --line-numbers -n 2>&1"
#define FIREWD_LIST_ALL_RULES_ARGS "--direct --passthrough ipv4 -t %s -v -n -L --line-numbers 2>&1"
int validate_ipt_chain_conf(const char * const chain_str);
int validate_firewd_chain_conf(const char * const chain_str);
#endif /* FW_UTIL_FIREWALLD_H */
server/fwknopd.conf
+110
View File
@@ -196,6 +196,114 @@
#ENABLE_EXT_CMD_PREFIX N;
#EXT_CMD_PREFIX FWKNOP_;
##############################################################################
# Parameters specific to firewalld:
# Flush all existing rules in the fwknop chains at fwknop start time and/or
# exit time. They default to Y and it is a recommended setting for both.
#
#FLUSH_FIREWD_AT_INIT Y;
#FLUSH_FIREWD_AT_EXIT Y;
#
# Allow SPA clients to request access to services through an firewalld
# firewall instead of just to it (i.e. access through the FWKNOP_FORWARD
# chain instead of the INPUT chain).
#
#ENABLE_FIREWD_FORWARDING N;
# Allow SPA clients to request access to a local socket via NAT. This still
# puts an ACCEPT rule into the FWKNOP_INPUT chain, but a different port is
# translated via DNAT rules to the real one. So, the user would do
# "ssh -p <port>" to access the local service (see the --NAT-local and
# --NAT-rand-port on the fwknop client command line).
#
#ENABLE_FIREWD_LOCAL_NAT Y;
# By default, if forwarding access is enabled (see the ENABLE_FIREWD_FORWARDING
# variable above), then fwknop creates DNAT rules for incoming connections,
# but does not also complement these rules with SNAT rules at the same time.
# In some situations, internal systems may not have a route back out for the
# source address of the incoming connection, so it is necessary to also
# apply SNAT rules so that the internal systems see the IP of the internal
# interface where fwknopd is running. This functionality is only enabled
# when ENABLE_FIREWD_SNAT is set to "Y", and by default SNAT rules are built
# with the MASQUERADE target (since then the internal IP does not have to be
# defined here in the fwknop.conf file), but if you want fwknopd to use the
# SNAT target then also defined an IP address with the SNAT_TRANSLATE_IP
# variable.
#
#ENABLE_FIREWD_SNAT N;
#SNAT_TRANSLATE_IP __CHANGEME__;
# Add ACCEPT rules to the FWKNOP_OUTPUT chain. This is usually only useful
# if there are no state tracking rules to allow connection responses out and
# the OUTPUT chain has a default-drop stance.
#
#ENABLE_FIREWD_OUTPUT N;
# fwknopd adds allow rules to a custom firewalld chain "FWKNOP_INPUT".
# This chain is called from the INPUT chain, and by default no other
# firewalld chains are used. However, additional chains can be added
# (say, if access needs to be allowed through the local system via the
# FORWARD chain) by altering the FIREWD_FORWARD_ACCESS variable below.
# For a discussion of the format followed by these keywords, read on:
#
# Specify chain names to which firewalld blocking rules will be
# added with the FIREWD_INPUT_ACCESS and FIREWD_FORWARD_ACCESS keyword.
# The format for these variables is:
#
# <Target>,<Table>,<From_chain>,<Jump_rule_position>,\
# <To_chain>,<Rule_position>.
#
# "Target":
# Can be any legitimate firewalld target, but should usually just be "DROP".
#
# "Table":
# Can be any firewalld table, but the default is "filter".
#
# "From_chain":
# Is the chain from which packets will be jumped.
#
# "Jump_rule_position":
# Defines the position within the From_chain where the jump rule is added.
#
# "To_chain":
# Is the chain to which packets will be jumped. This is the main chain
# where fwknop rules are added.
#
# "Rule_position":
# Defines the position where rule are added within the To_chain.
#
#FIREWD_INPUT_ACCESS ACCEPT, filter, INPUT, 1, FWKNOP_INPUT, 1;
# The FIREWD_OUTPUT_ACCESS variable is only used if ENABLE_FIREWD_OUTPUT is enabled
#
#FIREWD_OUTPUT_ACCESS ACCEPT, filter, OUTPUT, 1, FWKNOP_OUTPUT, 1;
# The FIREWD_FORWARD_ACCESS variable is only used if ENABLE_FIREWD_FORWARDING is
# enabled.
#
#FIREWD_FORWARD_ACCESS ACCEPT, filter, FORWARD, 1, FWKNOP_FORWARD, 1;
#FIREWD_DNAT_ACCESS DNAT, nat, PREROUTING, 1, FWKNOP_PREROUTING, 1;
# The FIREWD_SNAT_ACCESS variable is not used unless both ENABLE_FIREWD_SNAT and
# ENABLE_FIREWD_FORWARDING are enabled. Also, the external static IP must be
# set with the SNAT_TRANSLATE_IP variable. The default is to use the
# FIREWD_MASQUERADE_ACCESS variable.
#
#FIREWD_SNAT_ACCESS SNAT, nat, POSTROUTING, 1, FWKNOP_POSTROUTING, 1;
#FIREWD_MASQUERADE_ACCESS MASQUERADE, nat, POSTROUTING, 1, FWKNOP_POSTROUTING, 1;
# The ENABLE_COMMENT_MATCH_CHECK variable instructs fwknopd to check for the
# firewalld 'comment' match at start up. If it's not found, then fwknopd will
# exit and throw an error. This variable is enabled by default, but can be
# disabled if you want fwknopd to run without being sure that the comment match
# if available (not recommended, since the comment match enables new SPA rules
# to be timed out).
#
#ENABLE_FIREWD_COMMENT_CHECK Y;
##############################################################################
# Parameters specific to iptables:
@@ -372,6 +480,7 @@
#
#PF_EXPIRE_INTERVAL 30;
##############################################################################
# Directories - These can override compile-time defaults.
#
@@ -389,6 +498,7 @@
# System binaries
#
#FIREWALL_EXE /bin/firewall-cmd;
#FIREWALL_EXE /sbin/iptables;
###EOF###
server/fwknopd_common.h
+87 -4
View File
@@ -115,9 +115,29 @@
#define RCHK_MAX_PCAP_DISPATCH_COUNT (2 << 22)
#define RCHK_MAX_FW_TIMEOUT (2 << 22)
/* FirewallD or Iptables-specific defines
/* FirewallD-specific defines
*/
#if defined(FIREWALL_FIREWALLD) || defined(FIREWALL_IPTABLES)
#if FIREWALL_FIREWALLD
#define DEF_FLUSH_FIREWD_AT_INIT "Y"
#define DEF_FLUSH_FIREWD_AT_EXIT "Y"
#define DEF_ENABLE_FIREWD_FORWARDING "N"
#define DEF_ENABLE_FIREWD_LOCAL_NAT "Y"
#define DEF_ENABLE_FIREWD_SNAT "N"
#define DEF_ENABLE_FIREWD_OUTPUT "N"
#define DEF_ENABLE_FIREWD_COMMENT_CHECK "Y"
#define DEF_FIREWD_INPUT_ACCESS "ACCEPT, filter, INPUT, 1, FWKNOP_INPUT, 1"
#define DEF_FIREWD_OUTPUT_ACCESS "ACCEPT, filter, OUTPUT, 1, FWKNOP_OUTPUT, 1"
#define DEF_FIREWD_FORWARD_ACCESS "ACCEPT, filter, FORWARD, 1, FWKNOP_FORWARD, 1"
#define DEF_FIREWD_DNAT_ACCESS "DNAT, nat, PREROUTING, 1, FWKNOP_PREROUTING, 1"
#define DEF_FIREWD_SNAT_ACCESS "SNAT, nat, POSTROUTING, 1, FWKNOP_POSTROUTING, 1"
#define DEF_FIREWD_MASQUERADE_ACCESS "MASQUERADE, nat, POSTROUTING, 1, FWKNOP_POSTROUTING, 1"
#define RCHK_MAX_FIREWD_RULE_NUM (2 << 15)
/* Iptables-specific defines
*/
#elif FIREWALL_IPTABLES
#define DEF_FLUSH_IPT_AT_INIT "Y"
#define DEF_FLUSH_IPT_AT_EXIT "Y"
@@ -215,7 +235,22 @@ enum {
//CONF_EXTERNAL_CMD_ALARM,
//CONF_ENABLE_EXT_CMD_PREFIX,
//CONF_EXT_CMD_PREFIX,
#if defined(FIREWALL_FIREWALLD) || defined(FIREWALL_IPTABLES)
#if FIREWALL_FIREWALLD
CONF_ENABLE_FIREWD_FORWARDING,
CONF_ENABLE_FIREWD_LOCAL_NAT,
CONF_ENABLE_FIREWD_SNAT,
CONF_SNAT_TRANSLATE_IP,
CONF_ENABLE_FIREWD_OUTPUT,
CONF_FLUSH_FIREWD_AT_INIT,
CONF_FLUSH_FIREWD_AT_EXIT,
CONF_FIREWD_INPUT_ACCESS,
CONF_FIREWD_OUTPUT_ACCESS,
CONF_FIREWD_FORWARD_ACCESS,
CONF_FIREWD_DNAT_ACCESS,
CONF_FIREWD_SNAT_ACCESS,
CONF_FIREWD_MASQUERADE_ACCESS,
CONF_ENABLE_FIREWD_COMMENT_CHECK,
#elif FIREWALL_IPTABLES
CONF_ENABLE_IPT_FORWARDING,
CONF_ENABLE_IPT_LOCAL_NAT,
CONF_ENABLE_IPT_SNAT,
@@ -352,7 +387,54 @@ typedef struct acc_stanza
/* Firewall-related data and types. */
#if defined(FIREWALL_FIREWALLD) || defined(FIREWALL_IPTABLES)
#if FIREWALL_FIREWALLD
/* --DSS XXX: These are arbitrary. We should determine appropriate values.
*/
#define MAX_TABLE_NAME_LEN 64
#define MAX_CHAIN_NAME_LEN 64
#define MAX_TARGET_NAME_LEN 64
/* Fwknop custom chain types
*/
enum {
FIREWD_INPUT_ACCESS,
FIREWD_OUTPUT_ACCESS,
FIREWD_FORWARD_ACCESS,
FIREWD_DNAT_ACCESS,
FIREWD_SNAT_ACCESS,
FIREWD_MASQUERADE_ACCESS,
NUM_FWKNOP_ACCESS_TYPES /* Leave this entry last */
};
/* Structure to define an fwknop firewall chain configuration.
*/
struct fw_chain {
int type;
char target[MAX_TARGET_NAME_LEN];
//int direction;
char table[MAX_TABLE_NAME_LEN];
char from_chain[MAX_CHAIN_NAME_LEN];
int jump_rule_pos;
char to_chain[MAX_CHAIN_NAME_LEN];
int rule_pos;
int active_rules;
time_t next_expire;
};
/* Based on the fw_chain fields (not counting type)
*/
#define FW_NUM_CHAIN_FIELDS 6
struct fw_config {
struct fw_chain chain[NUM_FWKNOP_ACCESS_TYPES];
char fw_command[MAX_PATH_LEN];
/* Flag for firewalld SNAT vs. MASQUERADE usage
*/
unsigned char use_masquerade;
};
#elif FIREWALL_IPTABLES
/* --DSS XXX: These are arbitrary. We should determine appropriate values.
*/
#define MAX_TABLE_NAME_LEN 64
@@ -484,6 +566,7 @@ typedef struct fko_srv_options
unsigned char verbose; /* Verbose mode flag */
unsigned char exit_after_parse_config; /* Parse config and exit */
unsigned char firewd_disable_check_support; /* Don't use firewall-cmd ... -C */
unsigned char ipt_disable_check_support; /* Don't use iptables -C */
/* Flag for permitting SPA packets regardless of directionality test
server/incoming_spa.c
+11 -1
View File
@@ -815,7 +815,17 @@ incoming_spa(fko_srv_options_t *opts)
|| spadat.message_type == FKO_NAT_ACCESS_MSG
|| spadat.message_type == FKO_CLIENT_TIMEOUT_NAT_ACCESS_MSG)
{
#if defined(FIREWALL_FIREWALLD) || defined(FIREWALL_IPTABLES)
#if FIREWALL_FIREWALLD
if(strncasecmp(opts->config[CONF_ENABLE_FIREWD_FORWARDING], "Y", 1)!=0)
{
log_msg(LOG_WARNING,
"(stanza #%d) SPA packet from %s requested NAT access, but is not enabled",
stanza_num, spadat.pkt_source_ip
);
acc = acc->next;
continue;
}
#elif FIREWALL_IPTABLES
if(strncasecmp(opts->config[CONF_ENABLE_IPT_FORWARDING], "Y", 1)!=0)
{
log_msg(LOG_WARNING,