From ac82b1ced2b976d8010d73cc2786503b14a73641 Mon Sep 17 00:00:00 2001 From: Gerry Reno Date: Sun, 31 Aug 2014 13:51:08 -0400 Subject: [PATCH] more changes for firewalld --- .gitignore | 25 +++--- server/Makefile.am | 1 + server/access.c | 30 ++++++- server/cmd_opts.h | 19 ++++- server/config_init.c | 150 +++++++++++++++++++++++++++++++++- server/fw_util_firewalld.c | 162 ++++++++++++++++++------------------- server/fw_util_firewalld.h | 2 +- server/fwknopd.conf | 110 +++++++++++++++++++++++++ server/fwknopd_common.h | 91 ++++++++++++++++++++- server/incoming_spa.c | 12 ++- 10 files changed, 501 insertions(+), 101 deletions(-) diff --git a/.gitignore b/.gitignore index 1552b488..44778bc3 100644 --- a/.gitignore +++ b/.gitignore @@ -35,12 +35,16 @@ Makefile cmake_install.cmake install_manifest.txt -# autoconf -*.m4 -Makefile.in +# C, C++ +*.o +*.lo + +#project generated files autom4te.cache/ +*.m4 client/.deps/ client/Makefile.in +common/libfko_util.a common/Makefile.in config.h config.h.in @@ -48,23 +52,24 @@ config.log config.status config/ configure +doc/libfko.info doc/Makefile.in +doc/stamp-vti +doc/version.texi +lib/libfko.la lib/.deps/ lib/.dirstamp lib/.libs/ lib/Makefile.in libtool +Makefile.in server/.deps/ +server/.libs/ +server/fwknopd +server/fwknopd.8 server/Makefile.in stamp-h1 -# C, C++ -*.o -*.lo - -#project generated files -common/libfko_util.a -lib/libfko.la android/project/libs android/project/obj android/project/jni/fwknop/fko.h diff --git a/server/Makefile.am b/server/Makefile.am index fc321ba4..c9ccdbc2 100644 --- a/server/Makefile.am +++ b/server/Makefile.am @@ -8,6 +8,7 @@ fwknopd_SOURCES = fwknopd.c fwknopd.h config_init.c config_init.h \ access.c access.h fwknopd_errors.c fwknopd_errors.h \ tcp_server.c tcp_server.h extcmd.c extcmd.h \ fw_util.c fw_util.h fw_util_ipf.c fw_util_ipf.h \ + fw_util_firewalld.c fw_util_firewalld.h \ fw_util_iptables.c fw_util_iptables.h \ fw_util_ipfw.c fw_util_ipfw.h \ fw_util_pf.c fw_util_pf.h cmd_opts.h diff --git a/server/access.c b/server/access.c index 1e6d986f..7e27b196 100644 --- a/server/access.c +++ b/server/access.c @@ -1585,7 +1585,20 @@ parse_access_file(fko_srv_options_t *opts) } else if(CONF_VAR_IS(var, "FORCE_NAT")) { -#if defined(FIREWALL_FIREWALLD) || defined(FIREWALL_IPTABLES) +#if FIREWALL_FIREWALLD + if(strncasecmp(opts->config[CONF_ENABLE_FIREWD_FORWARDING], "Y", 1) !=0 ) + { + log_msg(LOG_ERR, + "[*] FORCE_NAT requires ENABLE_FIREWD_FORWARDING to be enabled in fwknopd.conf"); + fclose(file_ptr); + clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE); + } + if(add_acc_force_nat(opts, curr_acc, val) != SUCCESS) + { + fclose(file_ptr); + clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE); + } +#elif FIREWALL_IPTABLES if(strncasecmp(opts->config[CONF_ENABLE_IPT_FORWARDING], "Y", 1) !=0 ) { log_msg(LOG_ERR, @@ -1607,7 +1620,20 @@ parse_access_file(fko_srv_options_t *opts) } else if(CONF_VAR_IS(var, "FORCE_SNAT")) { -#if defined(FIREWALL_FIREWALLD) || defined(FIREWALL_IPTABLES) +#if FIREWALL_FIREWALLD + if(strncasecmp(opts->config[CONF_ENABLE_FIREWD_FORWARDING], "Y", 1) !=0 ) + { + log_msg(LOG_ERR, + "[*] FORCE_SNAT requires ENABLE_FIREWD_FORWARDING to be enabled in fwknopd.conf"); + fclose(file_ptr); + clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE); + } + if(add_acc_force_snat(opts, curr_acc, val) != SUCCESS) + { + fclose(file_ptr); + clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE); + } +#elif FIREWALL_IPTABLES if(strncasecmp(opts->config[CONF_ENABLE_IPT_FORWARDING], "Y", 1) !=0 ) { log_msg(LOG_ERR, diff --git a/server/cmd_opts.h b/server/cmd_opts.h index 5ba7b108..db2d4885 100644 --- a/server/cmd_opts.h +++ b/server/cmd_opts.h @@ -66,7 +66,22 @@ static char *config_map[NUMBER_OF_CONFIG_ENTRIES] = { //"EXTERNAL_CMD_ALARM", //"ENABLE_EXT_CMD_PREFIX", //"EXT_CMD_PREFIX", -#if defined(FIREWALL_FIREWALLD) || defined(FIREWALL_IPTABLES) +#if FIREWALL_FIREWALLD + "ENABLE_FIREWD_FORWARDING", + "ENABLE_FIREWD_LOCAL_NAT", + "ENABLE_FIREWD_SNAT", + "SNAT_TRANSLATE_IP", + "ENABLE_FIREWD_OUTPUT", + "FLUSH_FIREWD_AT_INIT", + "FLUSH_FIREWD_AT_EXIT", + "FIREWD_INPUT_ACCESS", + "FIREWD_OUTPUT_ACCESS", + "FIREWD_FORWARD_ACCESS", + "FIREWD_DNAT_ACCESS", + "FIREWD_SNAT_ACCESS", + "FIREWD_MASQUERADE_ACCESS", + "ENABLE_FIREWD_COMMENT_CHECK", +#elif FIREWALL_IPTABLES "ENABLE_IPT_FORWARDING", "ENABLE_IPT_LOCAL_NAT", "ENABLE_IPT_SNAT", @@ -121,6 +136,7 @@ enum { FW_FLUSH, GPG_HOME_DIR, GPG_EXE_PATH, + FIREWD_DISABLE_CHECK_SUPPORT, IPT_DISABLE_CHECK_SUPPORT, PCAP_FILE, ENABLE_PCAP_ANY_DIRECTION, @@ -158,6 +174,7 @@ static struct option cmd_opts[] = {"fw-list-all", 0, NULL, FW_LIST_ALL }, {"gpg-home-dir", 1, NULL, GPG_HOME_DIR }, {"gpg-exe", 1, NULL, GPG_EXE_PATH }, + {"no-firewd-check-support", 0, NULL, FIREWD_DISABLE_CHECK_SUPPORT }, {"no-ipt-check-support", 0, NULL, IPT_DISABLE_CHECK_SUPPORT }, {"locale", 1, NULL, 'l' }, {"rotate-digest-cache", 0, NULL, ROTATE_DIGEST_CACHE }, diff --git a/server/config_init.c b/server/config_init.c index c3dd7bb1..55ca9d37 100644 --- a/server/config_init.c +++ b/server/config_init.c @@ -430,7 +430,150 @@ validate_options(fko_srv_options_t *opts) if(opts->config[CONF_MAX_SNIFF_BYTES] == NULL) set_config_entry(opts, CONF_MAX_SNIFF_BYTES, DEF_MAX_SNIFF_BYTES); -#if defined(FIREWALL_FIREWALLD) || defined(FIREWALL_IPTABLES) +#if FIREWALL_FIREWALLD + /* Enable FIREWD forwarding. + */ + if(opts->config[CONF_ENABLE_FIREWD_FORWARDING] == NULL) + set_config_entry(opts, CONF_ENABLE_FIREWD_FORWARDING, + DEF_ENABLE_FIREWD_FORWARDING); + + /* Enable FIREWD local NAT. + */ + if(opts->config[CONF_ENABLE_FIREWD_LOCAL_NAT] == NULL) + set_config_entry(opts, CONF_ENABLE_FIREWD_LOCAL_NAT, + DEF_ENABLE_FIREWD_LOCAL_NAT); + + /* Enable FIREWD SNAT. + */ + if(opts->config[CONF_ENABLE_FIREWD_SNAT] == NULL) + set_config_entry(opts, CONF_ENABLE_FIREWD_SNAT, + DEF_ENABLE_FIREWD_SNAT); + + /* Make sure we have a valid IP if SNAT is enabled + */ + if(strncasecmp(opts->config[CONF_ENABLE_FIREWD_SNAT], "Y", 1) == 0) + { + /* Note that fw_config_init() will set use_masquerade if necessary + */ + if(opts->config[CONF_SNAT_TRANSLATE_IP] != NULL) + { + if(! is_valid_ipv4_addr(opts->config[CONF_SNAT_TRANSLATE_IP])) + { + log_msg(LOG_ERR, + "Invalid IPv4 addr for SNAT_TRANSLATE_IP" + ); + clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE); + } + } + } + + /* Enable FIREWD OUTPUT. + */ + if(opts->config[CONF_ENABLE_FIREWD_OUTPUT] == NULL) + set_config_entry(opts, CONF_ENABLE_FIREWD_OUTPUT, + DEF_ENABLE_FIREWD_OUTPUT); + + /* Flush FIREWD at init. + */ + if(opts->config[CONF_FLUSH_FIREWD_AT_INIT] == NULL) + set_config_entry(opts, CONF_FLUSH_FIREWD_AT_INIT, DEF_FLUSH_FIREWD_AT_INIT); + + /* Flush FIREWD at exit. + */ + if(opts->config[CONF_FLUSH_FIREWD_AT_EXIT] == NULL) + set_config_entry(opts, CONF_FLUSH_FIREWD_AT_EXIT, DEF_FLUSH_FIREWD_AT_EXIT); + + /* FIREWD input access. + */ + if(opts->config[CONF_FIREWD_INPUT_ACCESS] == NULL) + set_config_entry(opts, CONF_FIREWD_INPUT_ACCESS, + DEF_FIREWD_INPUT_ACCESS); + + if(validate_firewd_chain_conf(opts->config[CONF_FIREWD_INPUT_ACCESS]) != 1) + { + log_msg(LOG_ERR, + "Invalid FIREWD_INPUT_ACCESS specification, see fwknopd.conf comments" + ); + clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE); + } + + /* FIREWD output access. + */ + if(opts->config[CONF_FIREWD_OUTPUT_ACCESS] == NULL) + set_config_entry(opts, CONF_FIREWD_OUTPUT_ACCESS, + DEF_FIREWD_OUTPUT_ACCESS); + + if(validate_firewd_chain_conf(opts->config[CONF_FIREWD_OUTPUT_ACCESS]) != 1) + { + log_msg(LOG_ERR, + "Invalid FIREWD_OUTPUT_ACCESS specification, see fwknopd.conf comments" + ); + clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE); + } + + /* FIREWD forward access. + */ + if(opts->config[CONF_FIREWD_FORWARD_ACCESS] == NULL) + set_config_entry(opts, CONF_FIREWD_FORWARD_ACCESS, + DEF_FIREWD_FORWARD_ACCESS); + + if(validate_firewd_chain_conf(opts->config[CONF_FIREWD_FORWARD_ACCESS]) != 1) + { + log_msg(LOG_ERR, + "Invalid FIREWD_FORWARD_ACCESS specification, see fwknopd.conf comments" + ); + clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE); + } + + /* FIREWD dnat access. + */ + if(opts->config[CONF_FIREWD_DNAT_ACCESS] == NULL) + set_config_entry(opts, CONF_FIREWD_DNAT_ACCESS, + DEF_FIREWD_DNAT_ACCESS); + + if(validate_firewd_chain_conf(opts->config[CONF_FIREWD_DNAT_ACCESS]) != 1) + { + log_msg(LOG_ERR, + "Invalid FIREWD_DNAT_ACCESS specification, see fwknopd.conf comments" + ); + clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE); + } + + /* FIREWD snat access. + */ + if(opts->config[CONF_FIREWD_SNAT_ACCESS] == NULL) + set_config_entry(opts, CONF_FIREWD_SNAT_ACCESS, + DEF_FIREWD_SNAT_ACCESS); + + if(validate_firewd_chain_conf(opts->config[CONF_FIREWD_SNAT_ACCESS]) != 1) + { + log_msg(LOG_ERR, + "Invalid FIREWD_SNAT_ACCESS specification, see fwknopd.conf comments" + ); + clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE); + } + + /* FIREWD masquerade access. + */ + if(opts->config[CONF_FIREWD_MASQUERADE_ACCESS] == NULL) + set_config_entry(opts, CONF_FIREWD_MASQUERADE_ACCESS, + DEF_FIREWD_MASQUERADE_ACCESS); + + if(validate_firewd_chain_conf(opts->config[CONF_FIREWD_MASQUERADE_ACCESS]) != 1) + { + log_msg(LOG_ERR, + "Invalid FIREWD_MASQUERADE_ACCESS specification, see fwknopd.conf comments" + ); + clean_exit(opts, NO_FW_CLEANUP, EXIT_FAILURE); + } + + /* Check for the firewalld 'comment' match at init time + */ + if(opts->config[CONF_ENABLE_FIREWD_COMMENT_CHECK] == NULL) + set_config_entry(opts, CONF_ENABLE_FIREWD_COMMENT_CHECK, + DEF_ENABLE_FIREWD_COMMENT_CHECK); + +#elif FIREWALL_IPTABLES /* Enable IPT forwarding. */ if(opts->config[CONF_ENABLE_IPT_FORWARDING] == NULL) @@ -931,6 +1074,9 @@ config_init(fko_srv_options_t *opts, int argc, char **argv) case 'i': set_config_entry(opts, CONF_PCAP_INTF, optarg); break; + case FIREWD_DISABLE_CHECK_SUPPORT: + opts->firewd_disable_check_support = 1; + break; case IPT_DISABLE_CHECK_SUPPORT: opts->ipt_disable_check_support = 1; break; @@ -1071,6 +1217,8 @@ usage(void) " done in the access.conf file).\n" " --gpg-exe - Specify the path to GPG (this is normally done in\n" " the access.conf file).\n" + " --no-firewd-check-support\n" + " - Disable test for 'firewall-cmd ... -C' support.\n" " --no-ipt-check-support - Disable test for 'iptables -C' support.\n" "\n" ); diff --git a/server/fw_util_firewalld.c b/server/fw_util_firewalld.c index 9fcb2a48..3eae64a2 100644 --- a/server/fw_util_firewalld.c +++ b/server/fw_util_firewalld.c @@ -44,8 +44,8 @@ static char cmd_buf[CMD_BUFSIZE]; static char err_buf[CMD_BUFSIZE]; static char cmd_out[STANDARD_CMD_OUT_BUFSIZE]; -/* assume 'firewalld -C' is offered since only older versions - * don't have this (see firewd_chk_support()). +/* assume 'firewall-cmd --direct --passthrough ipv4 -C' is offered + * (see firewd_chk_support()). */ static int have_firewd_chk_support = 1; @@ -81,7 +81,7 @@ rule_exists_no_chk_support(const fko_srv_options_t * const opts, char exp_ts_search[CMD_BUFSIZE] = {0}; FILE *firewd; - snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " IPT_LIST_RULES_ARGS, + snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " FIREWD_LIST_RULES_ARGS, opts->fw_config->fw_command, fwc->table, fwc->to_chain @@ -152,7 +152,7 @@ rule_exists_chk_support(const fko_srv_options_t * const opts, zero_cmd_buffers(); - snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " IPT_CHK_RULE_ARGS, + snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " FIREWD_CHK_RULE_ARGS, opts->fw_config->fw_command, chain, rule); res = run_extcmd(cmd_buf, err_buf, CMD_BUFSIZE, 0); @@ -203,7 +203,7 @@ static void firewd_chk_support(const fko_srv_options_t * const opts) { int res = 1; - struct fw_chain *in_chain = &(opts->fw_config->chain[IPT_INPUT_ACCESS]); + struct fw_chain *in_chain = &(opts->fw_config->chain[FIREWD_INPUT_ACCESS]); zero_cmd_buffers(); @@ -211,7 +211,7 @@ firewd_chk_support(const fko_srv_options_t * const opts) * supports '-C' to check for it. Set "have_firewd_chk_support" accordingly, * delete the rule, and return. */ - snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " IPT_TMP_CHK_RULE_ARGS, + snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " FIREWD_TMP_CHK_RULE_ARGS, opts->fw_config->fw_command, in_chain->table, in_chain->from_chain, @@ -229,7 +229,7 @@ firewd_chk_support(const fko_srv_options_t * const opts) /* Now see if '-C' works - any output indicates failure */ - snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " IPT_TMP_VERIFY_CHK_ARGS, + snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " FIREWD_TMP_VERIFY_CHK_ARGS, opts->fw_config->fw_command, in_chain->table, in_chain->from_chain, @@ -257,7 +257,7 @@ firewd_chk_support(const fko_srv_options_t * const opts) */ zero_cmd_buffers(); - snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " IPT_DEL_RULE_ARGS, + snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " FIREWD_DEL_RULE_ARGS, opts->fw_config->fw_command, in_chain->table, in_chain->from_chain, @@ -273,7 +273,7 @@ comment_match_exists(const fko_srv_options_t * const opts) { int res = 1; char *ndx = NULL; - struct fw_chain *in_chain = &(opts->fw_config->chain[IPT_INPUT_ACCESS]); + struct fw_chain *in_chain = &(opts->fw_config->chain[FIREWD_INPUT_ACCESS]); zero_cmd_buffers(); @@ -281,7 +281,7 @@ comment_match_exists(const fko_srv_options_t * const opts) * match and make sure it exists. If not, return zero. Otherwise, delete * the rule and return true. */ - snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " IPT_TMP_COMMENT_ARGS, + snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " FIREWD_TMP_COMMENT_ARGS, opts->fw_config->fw_command, in_chain->table, in_chain->from_chain, @@ -297,7 +297,7 @@ comment_match_exists(const fko_srv_options_t * const opts) zero_cmd_buffers(); - snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " IPT_LIST_RULES_ARGS, + snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " FIREWD_LIST_RULES_ARGS, opts->fw_config->fw_command, in_chain->table, in_chain->from_chain @@ -321,7 +321,7 @@ comment_match_exists(const fko_srv_options_t * const opts) */ zero_cmd_buffers(); - snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " IPT_DEL_RULE_ARGS, + snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " FIREWD_DEL_RULE_ARGS, opts->fw_config->fw_command, in_chain->table, in_chain->from_chain, @@ -340,7 +340,7 @@ add_jump_rule(const fko_srv_options_t * const opts, const int chain_num) zero_cmd_buffers(); - snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " IPT_ADD_JUMP_RULE_ARGS, + snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " FIREWD_ADD_JUMP_RULE_ARGS, fwc.fw_command, fwc.chain[chain_num].table, fwc.chain[chain_num].from_chain, @@ -370,7 +370,7 @@ chain_exists(const fko_srv_options_t * const opts, const int chain_num) zero_cmd_buffers(); - snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " IPT_CHAIN_EXISTS_ARGS, + snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " FIREWD_CHAIN_EXISTS_ARGS, fwc.fw_command, fwc.chain[chain_num].table, fwc.chain[chain_num].to_chain @@ -398,7 +398,7 @@ jump_rule_exists_chk_support(const fko_srv_options_t * const opts, const int cha int exists = 0; char rule_buf[CMD_BUFSIZE] = {0}; - snprintf(rule_buf, CMD_BUFSIZE-1, IPT_CHK_JUMP_RULE_ARGS, + snprintf(rule_buf, CMD_BUFSIZE-1, FIREWD_CHK_JUMP_RULE_ARGS, fwc.chain[chain_num].table, fwc.chain[chain_num].to_chain ); @@ -423,7 +423,7 @@ jump_rule_exists_no_chk_support(const fko_srv_options_t * const opts, const int char line_buf[CMD_BUFSIZE] = {0}; FILE *firewd; - snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " IPT_LIST_RULES_ARGS, + snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " FIREWD_LIST_RULES_ARGS, fwc.fw_command, fwc.chain[chain_num].table, fwc.chain[chain_num].from_chain @@ -508,7 +508,7 @@ fw_dump_rules(const fko_srv_options_t * const opts) /* Create the list command */ - snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " IPT_LIST_ALL_RULES_ARGS, + snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " FIREWD_LIST_ALL_RULES_ARGS, opts->fw_config->fw_command, ch[i].table ); @@ -541,7 +541,7 @@ fw_dump_rules(const fko_srv_options_t * const opts) /* Create the list command */ - snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " IPT_LIST_RULES_ARGS, + snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " FIREWD_LIST_RULES_ARGS, opts->fw_config->fw_command, ch[i].table, ch[i].to_chain @@ -586,7 +586,7 @@ delete_all_chains(const fko_srv_options_t * const opts) { zero_cmd_buffers(); - snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " IPT_DEL_JUMP_RULE_ARGS, + snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " FIREWD_DEL_JUMP_RULE_ARGS, fwc.fw_command, fwc.chain[i].table, fwc.chain[i].from_chain, @@ -611,7 +611,7 @@ delete_all_chains(const fko_srv_options_t * const opts) /* Now flush and remove the chain. */ snprintf(cmd_buf, CMD_BUFSIZE-1, - "(%s " IPT_FLUSH_CHAIN_ARGS "; %s " IPT_DEL_CHAIN_ARGS ")", // > /dev/null 2>&1", + "(%s " FIREWD_FLUSH_CHAIN_ARGS "; %s " FIREWD_DEL_CHAIN_ARGS ")", // > /dev/null 2>&1", fwc.fw_command, fwc.chain[i].table, fwc.chain[i].to_chain, @@ -641,7 +641,7 @@ create_chain(const fko_srv_options_t * const opts, const int chain_num) /* Create the custom chain. */ - snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " IPT_NEW_CHAIN_ARGS, + snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " FIREWD_NEW_CHAIN_ARGS, fwc.fw_command, fwc.chain[chain_num].table, fwc.chain[chain_num].to_chain @@ -764,7 +764,7 @@ set_fw_chain_conf(const int type, const char * const conf_str) /* Pull and set Jump_rule_position */ chain->jump_rule_pos = strtol_wrapper(chain_fields[3], - 0, RCHK_MAX_IPT_RULE_NUM, NO_EXIT_UPON_ERR, &is_err); + 0, RCHK_MAX_FIREWD_RULE_NUM, NO_EXIT_UPON_ERR, &is_err); if(is_err != FKO_SUCCESS) { log_msg(LOG_ERR, "[*] invalid jump rule position in Line: %s", @@ -777,7 +777,7 @@ set_fw_chain_conf(const int type, const char * const conf_str) /* Pull and set to_chain rule position */ chain->rule_pos = strtol_wrapper(chain_fields[5], - 0, RCHK_MAX_IPT_RULE_NUM, NO_EXIT_UPON_ERR, &is_err); + 0, RCHK_MAX_FIREWD_RULE_NUM, NO_EXIT_UPON_ERR, &is_err); if(is_err != FKO_SUCCESS) { log_msg(LOG_ERR, "[*] invalid to_chain rule position in Line: %s", @@ -802,44 +802,44 @@ fw_config_init(fko_srv_options_t * const opts) #endif /* Pull the fwknop chain config info and setup our internal - * config struct. The IPT_INPUT is the only one that is + * config struct. The FIREWD_INPUT is the only one that is * required. The rest are optional. */ - if(set_fw_chain_conf(IPT_INPUT_ACCESS, opts->config[CONF_IPT_INPUT_ACCESS]) != 1) + if(set_fw_chain_conf(FIREWD_INPUT_ACCESS, opts->config[CONF_FIREWD_INPUT_ACCESS]) != 1) return 0; - /* The FWKNOP_OUTPUT_ACCESS requires ENABLE_IPT_OUTPUT_ACCESS be Y + /* The FWKNOP_OUTPUT_ACCESS requires ENABLE_FIREWD_OUTPUT_ACCESS be Y */ - if(strncasecmp(opts->config[CONF_ENABLE_IPT_OUTPUT], "Y", 1)==0) - if(set_fw_chain_conf(IPT_OUTPUT_ACCESS, opts->config[CONF_IPT_OUTPUT_ACCESS]) != 1) + if(strncasecmp(opts->config[CONF_ENABLE_FIREWD_OUTPUT], "Y", 1)==0) + if(set_fw_chain_conf(FIREWD_OUTPUT_ACCESS, opts->config[CONF_FIREWD_OUTPUT_ACCESS]) != 1) return 0; - /* The remaining access chains require ENABLE_IPT_FORWARDING = Y + /* The remaining access chains require ENABLE_FIREWD_FORWARDING = Y */ - if(strncasecmp(opts->config[CONF_ENABLE_IPT_FORWARDING], "Y", 1)==0) + if(strncasecmp(opts->config[CONF_ENABLE_FIREWD_FORWARDING], "Y", 1)==0) { - if(set_fw_chain_conf(IPT_FORWARD_ACCESS, opts->config[CONF_IPT_FORWARD_ACCESS]) != 1) + if(set_fw_chain_conf(FIREWD_FORWARD_ACCESS, opts->config[CONF_FIREWD_FORWARD_ACCESS]) != 1) return 0; - if(set_fw_chain_conf(IPT_DNAT_ACCESS, opts->config[CONF_IPT_DNAT_ACCESS]) != 1) + if(set_fw_chain_conf(FIREWD_DNAT_ACCESS, opts->config[CONF_FIREWD_DNAT_ACCESS]) != 1) return 0; - /* SNAT (whichever mode) requires ENABLE_IPT_SNAT = Y + /* SNAT (whichever mode) requires ENABLE_FIREWD_SNAT = Y */ - if(strncasecmp(opts->config[CONF_ENABLE_IPT_SNAT], "Y", 1)==0) + if(strncasecmp(opts->config[CONF_ENABLE_FIREWD_SNAT], "Y", 1)==0) { if(opts->config[CONF_SNAT_TRANSLATE_IP] == NULL || ! is_valid_ipv4_addr(opts->config[CONF_SNAT_TRANSLATE_IP])) { fwc.use_masquerade = 1; - if(set_fw_chain_conf(IPT_MASQUERADE_ACCESS, opts->config[CONF_IPT_MASQUERADE_ACCESS]) != 1) + if(set_fw_chain_conf(FIREWD_MASQUERADE_ACCESS, opts->config[CONF_FIREWD_MASQUERADE_ACCESS]) != 1) return 0; } else { if(is_valid_ipv4_addr(opts->config[CONF_SNAT_TRANSLATE_IP])) { - if(set_fw_chain_conf(IPT_SNAT_ACCESS, opts->config[CONF_IPT_SNAT_ACCESS]) != 1) + if(set_fw_chain_conf(FIREWD_SNAT_ACCESS, opts->config[CONF_FIREWD_SNAT_ACCESS]) != 1) return 0; } else @@ -864,7 +864,7 @@ fw_initialize(const fko_srv_options_t * const opts) /* Flush the chains (just in case) so we can start fresh. */ - if(strncasecmp(opts->config[CONF_FLUSH_IPT_AT_INIT], "Y", 1) == 0) + if(strncasecmp(opts->config[CONF_FLUSH_FIREWD_AT_INIT], "Y", 1) == 0) delete_all_chains(opts); /* Now create any configured chains. @@ -878,7 +878,7 @@ fw_initialize(const fko_srv_options_t * const opts) /* Make sure that the 'comment' match is available */ - if(strncasecmp(opts->config[CONF_ENABLE_IPT_COMMENT_CHECK], "Y", 1) == 0) + if(strncasecmp(opts->config[CONF_ENABLE_FIREWD_COMMENT_CHECK], "Y", 1) == 0) { if(comment_match_exists(opts) == 1) { @@ -905,7 +905,7 @@ fw_initialize(const fko_srv_options_t * const opts) int fw_cleanup(const fko_srv_options_t * const opts) { - if(strncasecmp(opts->config[CONF_FLUSH_IPT_AT_EXIT], "N", 1) == 0 + if(strncasecmp(opts->config[CONF_FLUSH_FIREWD_AT_EXIT], "N", 1) == 0 && opts->fw_flush == 0) return(0); @@ -961,10 +961,10 @@ process_spa_request(const fko_srv_options_t * const opts, unsigned int fst_proto; unsigned int fst_port; - struct fw_chain * const in_chain = &(opts->fw_config->chain[IPT_INPUT_ACCESS]); - struct fw_chain * const out_chain = &(opts->fw_config->chain[IPT_OUTPUT_ACCESS]); - struct fw_chain * const fwd_chain = &(opts->fw_config->chain[IPT_FORWARD_ACCESS]); - struct fw_chain * const dnat_chain = &(opts->fw_config->chain[IPT_DNAT_ACCESS]); + struct fw_chain * const in_chain = &(opts->fw_config->chain[FIREWD_INPUT_ACCESS]); + struct fw_chain * const out_chain = &(opts->fw_config->chain[FIREWD_OUTPUT_ACCESS]); + struct fw_chain * const fwd_chain = &(opts->fw_config->chain[FIREWD_FORWARD_ACCESS]); + struct fw_chain * const dnat_chain = &(opts->fw_config->chain[FIREWD_DNAT_ACCESS]); struct fw_chain *snat_chain; /* We assign this later (if we need to). */ int res = 0, is_err, snat_chain_num = 0; @@ -1008,19 +1008,19 @@ process_spa_request(const fko_srv_options_t * const opts, /* Check to make sure that the jump rules exist for each * required chain */ - if(chain_exists(opts, IPT_INPUT_ACCESS) == 0) - create_chain(opts, IPT_INPUT_ACCESS); + if(chain_exists(opts, FIREWD_INPUT_ACCESS) == 0) + create_chain(opts, FIREWD_INPUT_ACCESS); - if(jump_rule_exists(opts, IPT_INPUT_ACCESS) == 0) - add_jump_rule(opts, IPT_INPUT_ACCESS); + if(jump_rule_exists(opts, FIREWD_INPUT_ACCESS) == 0) + add_jump_rule(opts, FIREWD_INPUT_ACCESS); if(strlen(out_chain->to_chain)) { - if(chain_exists(opts, IPT_OUTPUT_ACCESS) == 0) - create_chain(opts, IPT_OUTPUT_ACCESS); + if(chain_exists(opts, FIREWD_OUTPUT_ACCESS) == 0) + create_chain(opts, FIREWD_OUTPUT_ACCESS); - if(jump_rule_exists(opts, IPT_OUTPUT_ACCESS) == 0) - add_jump_rule(opts, IPT_OUTPUT_ACCESS); + if(jump_rule_exists(opts, FIREWD_OUTPUT_ACCESS) == 0) + add_jump_rule(opts, FIREWD_OUTPUT_ACCESS); } /* Create an access command for each proto/port for the source ip. @@ -1029,7 +1029,7 @@ process_spa_request(const fko_srv_options_t * const opts, { memset(rule_buf, 0, CMD_BUFSIZE); - snprintf(rule_buf, CMD_BUFSIZE-1, IPT_RULE_ARGS, + snprintf(rule_buf, CMD_BUFSIZE-1, FIREWD_RULE_ARGS, in_chain->table, ple->proto, spadat->use_src_ip, @@ -1065,7 +1065,7 @@ process_spa_request(const fko_srv_options_t * const opts, { memset(rule_buf, 0, CMD_BUFSIZE); - snprintf(rule_buf, CMD_BUFSIZE-1, IPT_OUT_RULE_ARGS, + snprintf(rule_buf, CMD_BUFSIZE-1, FIREWD_OUT_RULE_ARGS, out_chain->table, ple->proto, spadat->use_src_ip, @@ -1138,7 +1138,7 @@ process_spa_request(const fko_srv_options_t * const opts, { memset(rule_buf, 0, CMD_BUFSIZE); - snprintf(rule_buf, CMD_BUFSIZE-1, IPT_RULE_ARGS, + snprintf(rule_buf, CMD_BUFSIZE-1, FIREWD_RULE_ARGS, in_chain->table, fst_proto, spadat->use_src_ip, @@ -1150,11 +1150,11 @@ process_spa_request(const fko_srv_options_t * const opts, /* Check to make sure that the jump rules exist for each * required chain */ - if(chain_exists(opts, IPT_INPUT_ACCESS) == 0) - create_chain(opts, IPT_INPUT_ACCESS); + if(chain_exists(opts, FIREWD_INPUT_ACCESS) == 0) + create_chain(opts, FIREWD_INPUT_ACCESS); - if(jump_rule_exists(opts, IPT_INPUT_ACCESS) == 0) - add_jump_rule(opts, IPT_INPUT_ACCESS); + if(jump_rule_exists(opts, FIREWD_INPUT_ACCESS) == 0) + add_jump_rule(opts, FIREWD_INPUT_ACCESS); if(rule_exists(opts, in_chain, rule_buf, fst_proto, spadat->use_src_ip, nat_port, exp_ts) == 0) @@ -1181,15 +1181,15 @@ process_spa_request(const fko_srv_options_t * const opts, /* Make our FORWARD and NAT rules, and make sure the * required chain and jump rule exists */ - if(chain_exists(opts, IPT_FORWARD_ACCESS) == 0) - create_chain(opts, IPT_FORWARD_ACCESS); + if(chain_exists(opts, FIREWD_FORWARD_ACCESS) == 0) + create_chain(opts, FIREWD_FORWARD_ACCESS); - if (jump_rule_exists(opts, IPT_FORWARD_ACCESS) == 0) - add_jump_rule(opts, IPT_FORWARD_ACCESS); + if (jump_rule_exists(opts, FIREWD_FORWARD_ACCESS) == 0) + add_jump_rule(opts, FIREWD_FORWARD_ACCESS); memset(rule_buf, 0, CMD_BUFSIZE); - snprintf(rule_buf, CMD_BUFSIZE-1, IPT_FWD_RULE_ARGS, + snprintf(rule_buf, CMD_BUFSIZE-1, FIREWD_FWD_RULE_ARGS, fwd_chain->table, fst_proto, spadat->use_src_ip, @@ -1224,15 +1224,15 @@ process_spa_request(const fko_srv_options_t * const opts, { /* Make sure the required chain and jump rule exist */ - if(chain_exists(opts, IPT_DNAT_ACCESS) == 0) - create_chain(opts, IPT_DNAT_ACCESS); + if(chain_exists(opts, FIREWD_DNAT_ACCESS) == 0) + create_chain(opts, FIREWD_DNAT_ACCESS); - if (jump_rule_exists(opts, IPT_DNAT_ACCESS) == 0) - add_jump_rule(opts, IPT_DNAT_ACCESS); + if (jump_rule_exists(opts, FIREWD_DNAT_ACCESS) == 0) + add_jump_rule(opts, FIREWD_DNAT_ACCESS); memset(rule_buf, 0, CMD_BUFSIZE); - snprintf(rule_buf, CMD_BUFSIZE-1, IPT_DNAT_RULE_ARGS, + snprintf(rule_buf, CMD_BUFSIZE-1, FIREWD_DNAT_RULE_ARGS, dnat_chain->table, fst_proto, spadat->use_src_ip, @@ -1266,43 +1266,43 @@ process_spa_request(const fko_srv_options_t * const opts, /* If SNAT (or MASQUERADE) is wanted, then we add those rules here as well. */ - if(acc->force_snat || strncasecmp(opts->config[CONF_ENABLE_IPT_SNAT], "Y", 1) == 0) + if(acc->force_snat || strncasecmp(opts->config[CONF_ENABLE_FIREWD_SNAT], "Y", 1) == 0) { /* Add SNAT or MASQUERADE rules. */ if(acc->force_snat && is_valid_ipv4_addr(acc->force_snat_ip)) { /* Using static SNAT */ - snat_chain = &(opts->fw_config->chain[IPT_SNAT_ACCESS]); + snat_chain = &(opts->fw_config->chain[FIREWD_SNAT_ACCESS]); snprintf(snat_target, SNAT_TARGET_BUFSIZE-1, "--to-source %s:%i", acc->force_snat_ip, fst_port); - snat_chain_num = IPT_SNAT_ACCESS; + snat_chain_num = FIREWD_SNAT_ACCESS; } else if(acc->force_snat && acc->force_masquerade) { /* Using MASQUERADE */ - snat_chain = &(opts->fw_config->chain[IPT_MASQUERADE_ACCESS]); + snat_chain = &(opts->fw_config->chain[FIREWD_MASQUERADE_ACCESS]); snprintf(snat_target, SNAT_TARGET_BUFSIZE-1, "--to-ports %i", fst_port); - snat_chain_num = IPT_MASQUERADE_ACCESS; + snat_chain_num = FIREWD_MASQUERADE_ACCESS; } else if((opts->config[CONF_SNAT_TRANSLATE_IP] != NULL) && is_valid_ipv4_addr(opts->config[CONF_SNAT_TRANSLATE_IP])) { /* Using static SNAT */ - snat_chain = &(opts->fw_config->chain[IPT_SNAT_ACCESS]); + snat_chain = &(opts->fw_config->chain[FIREWD_SNAT_ACCESS]); snprintf(snat_target, SNAT_TARGET_BUFSIZE-1, "--to-source %s:%i", opts->config[CONF_SNAT_TRANSLATE_IP], fst_port); - snat_chain_num = IPT_SNAT_ACCESS; + snat_chain_num = FIREWD_SNAT_ACCESS; } else { /* Using MASQUERADE */ - snat_chain = &(opts->fw_config->chain[IPT_MASQUERADE_ACCESS]); + snat_chain = &(opts->fw_config->chain[FIREWD_MASQUERADE_ACCESS]); snprintf(snat_target, SNAT_TARGET_BUFSIZE-1, "--to-ports %i", fst_port); - snat_chain_num = IPT_MASQUERADE_ACCESS; + snat_chain_num = FIREWD_MASQUERADE_ACCESS; } if(chain_exists(opts, snat_chain_num) == 0) @@ -1313,7 +1313,7 @@ process_spa_request(const fko_srv_options_t * const opts, memset(rule_buf, 0, CMD_BUFSIZE); - snprintf(rule_buf, CMD_BUFSIZE-1, IPT_SNAT_RULE_ARGS, + snprintf(rule_buf, CMD_BUFSIZE-1, FIREWD_SNAT_RULE_ARGS, snat_chain->table, fst_proto, nat_ip, @@ -1386,7 +1386,7 @@ check_firewall_rules(const fko_srv_options_t * const opts) /* There should be a rule to delete. Get the current list of * rules for this chain and delete the ones that are expired. */ - snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " IPT_LIST_RULES_ARGS, + snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " FIREWD_LIST_RULES_ARGS, opts->fw_config->fw_command, ch[i].table, ch[i].to_chain @@ -1478,7 +1478,7 @@ check_firewall_rules(const fko_srv_options_t * const opts) strlcpy(rule_num_str, rn_start, (rn_end - rn_start)+1); - rule_num = strtol_wrapper(rule_num_str, rn_offset, RCHK_MAX_IPT_RULE_NUM, + rule_num = strtol_wrapper(rule_num_str, rn_offset, RCHK_MAX_FIREWD_RULE_NUM, NO_EXIT_UPON_ERR, &is_err); if(is_err != FKO_SUCCESS) { @@ -1493,7 +1493,7 @@ check_firewall_rules(const fko_srv_options_t * const opts) zero_cmd_buffers(); - snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " IPT_DEL_RULE_ARGS, + snprintf(cmd_buf, CMD_BUFSIZE-1, "%s " FIREWD_DEL_RULE_ARGS, opts->fw_config->fw_command, ch[i].table, ch[i].to_chain, diff --git a/server/fw_util_firewalld.h b/server/fw_util_firewalld.h index 21c91ff4..2fe789d2 100644 --- a/server/fw_util_firewalld.h +++ b/server/fw_util_firewalld.h @@ -55,7 +55,7 @@ #define FIREWD_LIST_RULES_ARGS "--direct --passthrough ipv4 -t %s -L %s --line-numbers -n 2>&1" #define FIREWD_LIST_ALL_RULES_ARGS "--direct --passthrough ipv4 -t %s -v -n -L --line-numbers 2>&1" -int validate_ipt_chain_conf(const char * const chain_str); +int validate_firewd_chain_conf(const char * const chain_str); #endif /* FW_UTIL_FIREWALLD_H */ diff --git a/server/fwknopd.conf b/server/fwknopd.conf index 1370b313..8faeebd6 100644 --- a/server/fwknopd.conf +++ b/server/fwknopd.conf @@ -196,6 +196,114 @@ #ENABLE_EXT_CMD_PREFIX N; #EXT_CMD_PREFIX FWKNOP_; +############################################################################## +# Parameters specific to firewalld: + +# Flush all existing rules in the fwknop chains at fwknop start time and/or +# exit time. They default to Y and it is a recommended setting for both. +# +#FLUSH_FIREWD_AT_INIT Y; +#FLUSH_FIREWD_AT_EXIT Y; +# + +# Allow SPA clients to request access to services through an firewalld +# firewall instead of just to it (i.e. access through the FWKNOP_FORWARD +# chain instead of the INPUT chain). +# +#ENABLE_FIREWD_FORWARDING N; + +# Allow SPA clients to request access to a local socket via NAT. This still +# puts an ACCEPT rule into the FWKNOP_INPUT chain, but a different port is +# translated via DNAT rules to the real one. So, the user would do +# "ssh -p " to access the local service (see the --NAT-local and +# --NAT-rand-port on the fwknop client command line). +# +#ENABLE_FIREWD_LOCAL_NAT Y; + +# By default, if forwarding access is enabled (see the ENABLE_FIREWD_FORWARDING +# variable above), then fwknop creates DNAT rules for incoming connections, +# but does not also complement these rules with SNAT rules at the same time. +# In some situations, internal systems may not have a route back out for the +# source address of the incoming connection, so it is necessary to also +# apply SNAT rules so that the internal systems see the IP of the internal +# interface where fwknopd is running. This functionality is only enabled +# when ENABLE_FIREWD_SNAT is set to "Y", and by default SNAT rules are built +# with the MASQUERADE target (since then the internal IP does not have to be +# defined here in the fwknop.conf file), but if you want fwknopd to use the +# SNAT target then also defined an IP address with the SNAT_TRANSLATE_IP +# variable. +# +#ENABLE_FIREWD_SNAT N; +#SNAT_TRANSLATE_IP __CHANGEME__; + +# Add ACCEPT rules to the FWKNOP_OUTPUT chain. This is usually only useful +# if there are no state tracking rules to allow connection responses out and +# the OUTPUT chain has a default-drop stance. +# +#ENABLE_FIREWD_OUTPUT N; + +# fwknopd adds allow rules to a custom firewalld chain "FWKNOP_INPUT". +# This chain is called from the INPUT chain, and by default no other +# firewalld chains are used. However, additional chains can be added +# (say, if access needs to be allowed through the local system via the +# FORWARD chain) by altering the FIREWD_FORWARD_ACCESS variable below. +# For a discussion of the format followed by these keywords, read on: +# +# Specify chain names to which firewalld blocking rules will be +# added with the FIREWD_INPUT_ACCESS and FIREWD_FORWARD_ACCESS keyword. +# The format for these variables is: +# +# ,,,,\ +# ,. +# +# "Target": +# Can be any legitimate firewalld target, but should usually just be "DROP". +# +# "Table": +# Can be any firewalld table, but the default is "filter". +# +# "From_chain": +# Is the chain from which packets will be jumped. +# +# "Jump_rule_position": +# Defines the position within the From_chain where the jump rule is added. +# +# "To_chain": +# Is the chain to which packets will be jumped. This is the main chain +# where fwknop rules are added. +# +# "Rule_position": +# Defines the position where rule are added within the To_chain. +# +#FIREWD_INPUT_ACCESS ACCEPT, filter, INPUT, 1, FWKNOP_INPUT, 1; + +# The FIREWD_OUTPUT_ACCESS variable is only used if ENABLE_FIREWD_OUTPUT is enabled +# +#FIREWD_OUTPUT_ACCESS ACCEPT, filter, OUTPUT, 1, FWKNOP_OUTPUT, 1; + +# The FIREWD_FORWARD_ACCESS variable is only used if ENABLE_FIREWD_FORWARDING is +# enabled. +# +#FIREWD_FORWARD_ACCESS ACCEPT, filter, FORWARD, 1, FWKNOP_FORWARD, 1; +#FIREWD_DNAT_ACCESS DNAT, nat, PREROUTING, 1, FWKNOP_PREROUTING, 1; + +# The FIREWD_SNAT_ACCESS variable is not used unless both ENABLE_FIREWD_SNAT and +# ENABLE_FIREWD_FORWARDING are enabled. Also, the external static IP must be +# set with the SNAT_TRANSLATE_IP variable. The default is to use the +# FIREWD_MASQUERADE_ACCESS variable. +# +#FIREWD_SNAT_ACCESS SNAT, nat, POSTROUTING, 1, FWKNOP_POSTROUTING, 1; +#FIREWD_MASQUERADE_ACCESS MASQUERADE, nat, POSTROUTING, 1, FWKNOP_POSTROUTING, 1; + +# The ENABLE_COMMENT_MATCH_CHECK variable instructs fwknopd to check for the +# firewalld 'comment' match at start up. If it's not found, then fwknopd will +# exit and throw an error. This variable is enabled by default, but can be +# disabled if you want fwknopd to run without being sure that the comment match +# if available (not recommended, since the comment match enables new SPA rules +# to be timed out). +# +#ENABLE_FIREWD_COMMENT_CHECK Y; + ############################################################################## # Parameters specific to iptables: @@ -372,6 +480,7 @@ # #PF_EXPIRE_INTERVAL 30; +############################################################################## # Directories - These can override compile-time defaults. # @@ -389,6 +498,7 @@ # System binaries # +#FIREWALL_EXE /bin/firewall-cmd; #FIREWALL_EXE /sbin/iptables; ###EOF### diff --git a/server/fwknopd_common.h b/server/fwknopd_common.h index 93990189..5622d36d 100644 --- a/server/fwknopd_common.h +++ b/server/fwknopd_common.h @@ -115,9 +115,29 @@ #define RCHK_MAX_PCAP_DISPATCH_COUNT (2 << 22) #define RCHK_MAX_FW_TIMEOUT (2 << 22) -/* FirewallD or Iptables-specific defines +/* FirewallD-specific defines */ -#if defined(FIREWALL_FIREWALLD) || defined(FIREWALL_IPTABLES) +#if FIREWALL_FIREWALLD + + #define DEF_FLUSH_FIREWD_AT_INIT "Y" + #define DEF_FLUSH_FIREWD_AT_EXIT "Y" + #define DEF_ENABLE_FIREWD_FORWARDING "N" + #define DEF_ENABLE_FIREWD_LOCAL_NAT "Y" + #define DEF_ENABLE_FIREWD_SNAT "N" + #define DEF_ENABLE_FIREWD_OUTPUT "N" + #define DEF_ENABLE_FIREWD_COMMENT_CHECK "Y" + #define DEF_FIREWD_INPUT_ACCESS "ACCEPT, filter, INPUT, 1, FWKNOP_INPUT, 1" + #define DEF_FIREWD_OUTPUT_ACCESS "ACCEPT, filter, OUTPUT, 1, FWKNOP_OUTPUT, 1" + #define DEF_FIREWD_FORWARD_ACCESS "ACCEPT, filter, FORWARD, 1, FWKNOP_FORWARD, 1" + #define DEF_FIREWD_DNAT_ACCESS "DNAT, nat, PREROUTING, 1, FWKNOP_PREROUTING, 1" + #define DEF_FIREWD_SNAT_ACCESS "SNAT, nat, POSTROUTING, 1, FWKNOP_POSTROUTING, 1" + #define DEF_FIREWD_MASQUERADE_ACCESS "MASQUERADE, nat, POSTROUTING, 1, FWKNOP_POSTROUTING, 1" + + #define RCHK_MAX_FIREWD_RULE_NUM (2 << 15) + +/* Iptables-specific defines +*/ +#elif FIREWALL_IPTABLES #define DEF_FLUSH_IPT_AT_INIT "Y" #define DEF_FLUSH_IPT_AT_EXIT "Y" @@ -215,7 +235,22 @@ enum { //CONF_EXTERNAL_CMD_ALARM, //CONF_ENABLE_EXT_CMD_PREFIX, //CONF_EXT_CMD_PREFIX, -#if defined(FIREWALL_FIREWALLD) || defined(FIREWALL_IPTABLES) +#if FIREWALL_FIREWALLD + CONF_ENABLE_FIREWD_FORWARDING, + CONF_ENABLE_FIREWD_LOCAL_NAT, + CONF_ENABLE_FIREWD_SNAT, + CONF_SNAT_TRANSLATE_IP, + CONF_ENABLE_FIREWD_OUTPUT, + CONF_FLUSH_FIREWD_AT_INIT, + CONF_FLUSH_FIREWD_AT_EXIT, + CONF_FIREWD_INPUT_ACCESS, + CONF_FIREWD_OUTPUT_ACCESS, + CONF_FIREWD_FORWARD_ACCESS, + CONF_FIREWD_DNAT_ACCESS, + CONF_FIREWD_SNAT_ACCESS, + CONF_FIREWD_MASQUERADE_ACCESS, + CONF_ENABLE_FIREWD_COMMENT_CHECK, +#elif FIREWALL_IPTABLES CONF_ENABLE_IPT_FORWARDING, CONF_ENABLE_IPT_LOCAL_NAT, CONF_ENABLE_IPT_SNAT, @@ -352,7 +387,54 @@ typedef struct acc_stanza /* Firewall-related data and types. */ -#if defined(FIREWALL_FIREWALLD) || defined(FIREWALL_IPTABLES) +#if FIREWALL_FIREWALLD + /* --DSS XXX: These are arbitrary. We should determine appropriate values. + */ + #define MAX_TABLE_NAME_LEN 64 + #define MAX_CHAIN_NAME_LEN 64 + #define MAX_TARGET_NAME_LEN 64 + + /* Fwknop custom chain types + */ + enum { + FIREWD_INPUT_ACCESS, + FIREWD_OUTPUT_ACCESS, + FIREWD_FORWARD_ACCESS, + FIREWD_DNAT_ACCESS, + FIREWD_SNAT_ACCESS, + FIREWD_MASQUERADE_ACCESS, + NUM_FWKNOP_ACCESS_TYPES /* Leave this entry last */ + }; + + /* Structure to define an fwknop firewall chain configuration. + */ + struct fw_chain { + int type; + char target[MAX_TARGET_NAME_LEN]; + //int direction; + char table[MAX_TABLE_NAME_LEN]; + char from_chain[MAX_CHAIN_NAME_LEN]; + int jump_rule_pos; + char to_chain[MAX_CHAIN_NAME_LEN]; + int rule_pos; + int active_rules; + time_t next_expire; + }; + + /* Based on the fw_chain fields (not counting type) + */ + #define FW_NUM_CHAIN_FIELDS 6 + + struct fw_config { + struct fw_chain chain[NUM_FWKNOP_ACCESS_TYPES]; + char fw_command[MAX_PATH_LEN]; + + /* Flag for firewalld SNAT vs. MASQUERADE usage + */ + unsigned char use_masquerade; + }; + +#elif FIREWALL_IPTABLES /* --DSS XXX: These are arbitrary. We should determine appropriate values. */ #define MAX_TABLE_NAME_LEN 64 @@ -484,6 +566,7 @@ typedef struct fko_srv_options unsigned char verbose; /* Verbose mode flag */ unsigned char exit_after_parse_config; /* Parse config and exit */ + unsigned char firewd_disable_check_support; /* Don't use firewall-cmd ... -C */ unsigned char ipt_disable_check_support; /* Don't use iptables -C */ /* Flag for permitting SPA packets regardless of directionality test diff --git a/server/incoming_spa.c b/server/incoming_spa.c index 9d55af73..bbea1b1f 100644 --- a/server/incoming_spa.c +++ b/server/incoming_spa.c @@ -815,7 +815,17 @@ incoming_spa(fko_srv_options_t *opts) || spadat.message_type == FKO_NAT_ACCESS_MSG || spadat.message_type == FKO_CLIENT_TIMEOUT_NAT_ACCESS_MSG) { -#if defined(FIREWALL_FIREWALLD) || defined(FIREWALL_IPTABLES) +#if FIREWALL_FIREWALLD + if(strncasecmp(opts->config[CONF_ENABLE_FIREWD_FORWARDING], "Y", 1)!=0) + { + log_msg(LOG_WARNING, + "(stanza #%d) SPA packet from %s requested NAT access, but is not enabled", + stanza_num, spadat.pkt_source_ip + ); + acc = acc->next; + continue; + } +#elif FIREWALL_IPTABLES if(strncasecmp(opts->config[CONF_ENABLE_IPT_FORWARDING], "Y", 1)!=0) { log_msg(LOG_WARNING,