← Back
Editing: firewall-lib.pl
# firewall-lib.pl # Unified functions for firewall4-lib and firewall6-lib # has to be included from every perl and cgi script # cgi scripts has also to include firewall4/6-lib based on result of get_ipvx_version() BEGIN { push(@INC, ".."); }; use WebminCore; &init_config(); $config{'perpage'} ||= 50; # a value of 0 can cause problems # provide default values if only firewall-lib is included, e.g. foreign_require(firewall, firewall-lib.pl) calls set_ipvx_version(get_ipvx_version()); # set_ipvx_version(version) # version can be ipv6 or ipv4, sub set_ipvx_version { $ipvx_save=$iptables_save_file; $ipvx_lib='firewall4-lib.pl'; $ipv4_link='../firewall/'; $ipv6_link='../firewall6/'; $ipvx_icmp=""; $ipvx_arg="inet4"; if ($_[0] =~ /6$/i) { $ipvx='6'; $ipvx_save=$ip6tables_save_file; $ipvx_lib='firewall6-lib.pl'; $ipvx_icmp="v6"; $ipvx_arg="inet6"; } } # get_ipvx_version # get iptables version used from environment # if script runs in firewall6 or version=inet6, 6 is returned, else 4 sub get_ipvx_version { return $in{'version'} =~ /6$/ || $module_name =~ /6$/ ? 6 : 4; } # get_iptables_save([file|"direct"]) # Parse the iptables save file into a list of tables # format seems to be: # *table # :chain defaultpolicy # -A chain options # -N chain # COMMIT sub get_iptables_save { local ($file) = @_; local (@rv, $table, %got); local $lnum = 0; local $direct = "ip${ipvx}tables-save 2>/dev/null |"; if (!$file) { # Use default file $file = $config{"direct${ipvx}"} ? $direct : "<".$ipvx_save; } elsif ($file eq "direct") { # Read active rules $file = $direct; } open(FILE, $file); local $cmt; LINE: while(<FILE>) { local $read_comment; s/\r|\n//g; # regex to filter out chains not managed by firewall, i.e. fail2ban if ($config{"direct${ipvx}"} && $config{'filter_chain'}) { foreach $filter (split(',', $config{'filter_chain'})) { # NOTE: keep ":chain ..." as reference to avoid error when rebuild active config # -A|-I chain ... -j chain -> skip line if machtes filter_chain if (/^.?-(A|I)\s+(\S+).*\s+-j\s+(.*)/) { next LINE if($2 =~ /^$filter$/); } } } if (s/#\s*(.*)$//) { $cmt .= " " if ($cmt); $cmt .= $1; $read_comment=1; } if (/^\*(\S+)/) { # Start of a new table $got{$1}++; push(@rv, $table = { 'line' => $lnum, 'eline' => $lnum, 'name' => $1, 'rules' => [ ], 'defaults' => { } }); } elsif (/^:(\S+)\s+(\S+)/) { # Default policy definition $table->{'defaults'}->{$1} = $2; } elsif (/^(\[[^\]]*\]\s+)?-N\s+(\S+)(.*)/) { # New chain definition $table->{'defaults'}->{$2} = '-'; } elsif (/^(\[[^\]]*\]\s+)?-(A|I)\s+(\S+)(.*)/) { # Rule definition local $rule = { 'line' => $lnum, 'eline' => $lnum, 'index' => scalar(@{$table->{'rules'}}), 'cmt' => $cmt, 'chain' => $3, 'args' => $4 }; if ($2 eq "I") { unshift(@{$table->{'rules'}}, $rule); } else { push(@{$table->{'rules'}}, $rule); } # Parse arguments foreach $a (@known_args) { local @vl; while($rule->{'args'} =~ s/\s+(!?)\s*($a)\s+(!?)\s*("[^"]*")(\s+|$)/ / || $rule->{'args'} =~ s/\s+(!?)\s*($a)\s+(!?)\s*('[^']*')(\s+|$)/ / || $rule->{'args'} =~ s/\s+(!?)\s*($a)\s+(!?)\s*(([^ \-!]\S*(\s+|$))+)/ / || $rule->{'args'} =~ s/\s+(!?)\s*($a)()(\s+|$)/ /) { push(@vl, [ $1 || $3, &split_quoted_string($4) ]); } local ($aa = $a); $aa =~ s/^-+//; if ($a eq '-m') { $rule->{$aa} = \@vl if (@vl); } else { $rule->{$aa} = $vl[0]; } } } elsif (/^COMMIT/) { # Marks end of a table $table->{'eline'} = $lnum; } elsif (/\S/) { &error(&text('eiptables2', "<tt>$_</tt>", $lnum+1)); } $lnum++; if (! defined($read_comment)) { $cmt=undef; } } close(FILE); @rv = sort { $a->{'name'} cmp $b->{'name'} } @rv; local $i; map { $_->{'index'} = $i++ } @rv; return @rv; } # save_table(&table) # Updates an existing IPtable in the save file sub save_table { local $lref; if ($config{"direct${ipvx}"}) { # Read in the current iptables-save output $lref = &read_file_lines("ip${ipvx}tables-save 2>/dev/null |", 1); } else { # Updating the save file $lref = &read_file_lines($ipvx_save); } local @lines = ( "*$_[0]->{'name'}" ); local ($d, $r); foreach $d (keys %{$_[0]->{'defaults'}}) { push(@lines, ":$d $_[0]->{'defaults'}->{$d} [0:0]"); } foreach $r (@{$_[0]->{'rules'}}) { local $line = ""; $line = "# $r->{'cmt'}\n" if ($r->{'cmt'}); $line .= &make_rule_command($r); push(@lines, $line); } push(@lines, "COMMIT"); if (defined($_[0]->{'line'})) { # Update in file splice(@$lref, $_[0]->{'line'}, $_[0]->{'eline'} - $_[0]->{'line'} + 1, @lines); } else { # Append new table to file push(@$lref, "# Generated by webmin", @lines, "# Completed"); } if ($config{"direct${ipvx}"}) { # Pass new lines to iptables-restore open(SAVE, "| ip${ipvx}tables-restore"); print SAVE map { $_."\n" } @$lref; close(SAVE); } else { # Just save the file &flush_file_lines(); } } # make_rule_command(&rule) # Returns the flags needed to create a rule sub make_rule_command { my ($r) = @_; my $line = "-A $r->{'chain'}"; foreach my $a (@known_args) { my $aa = $a; $aa =~ s/^-+//; if ($r->{$aa}) { my @al = ref($r->{$aa}->[0]) ? @{$r->{$aa}} : ( $r->{$aa} ); foreach my $ag (@al) { my $n = shift(@$ag); my @w = ( $n ? ( $n ) : (), $a, @$ag ); @w = map { $_ =~ /'/ ? "\"$_\"" : $_ =~ /"/ ? "'".$_."'" : $_ =~ /\s/ ? "\"$_\"" : $_ } @w; $line .= " ".join(" ", @w); } } } $line .= " $r->{'args'}" if ($r->{'args'} =~ /\S/); return $line; } # get_ipsets_active() # return a list of active ipsets sub get_ipsets_active { my (@rv, $name, $set); open(FILE, "ipset list -t 2>/dev/null |"); while(<FILE>) { # remove newlines, get arg and value s/\r|\n//g; my ($n, $v) = split(/: /, $_); $n =~ s/^(\S+).*/$1/; if ($n eq "Name") { $set = { }; push(@rv, $set); } $set->{$n} = $v; } return @rv; } # describe_rule(&rule) # Returns a human-readable description of some rule conditions sub describe_rule { my ($rule) = @_; my (@c, $d); foreach $d ('p', 's', 'd', 'i', 'o', 'f', 'dport', 'sport', 'tcp-flags', 'tcp-option', 'icmp-type', 'icmpv6-type', 'mac-source', 'limit', 'limit-burst', 'ports', 'uid-owner', 'gid-owner', 'pid-owner', 'sid-owner', 'ctstate', 'state', 'tos', 'dports', 'sports', 'physdev-in', 'physdev-out', 'match-set', 'args') { if ($rule->{$d}) { # get name and values my ($n, @v) = @{$rule->{$d}}; # with additional args if ($d eq 'args') { # get args @v = grep {/\S/} split(/ / , $rule->{$d}); # first arg is name, next are values $n=shift(@v); # translate src and dest parameter for ipset push(@v, &text("desc_".pop(@v))) if ($n eq "--match-set"); } # uppercase for p @v = map { uc($_) } @v if ($d eq 'p'); # merge all in one for s and d @v = map { join(", ", split(/,/, $_)) } @v if ($d eq 's' || $d eq 'd' ); # compose desc_$n$d to get myized message, provide values # as $1, ..., $n if ($d eq 'match-set') { $v[1] = $text{'desc_'.$d.'_'.$v[1]} || $v[1]; } my $txt = &text("desc_$d$n", map { "<b>$_</b>" } @v); push(@c, $txt) if ($txt); } } my $rv; if (@c) { $rv = &text('desc_conds', join(" $text{'desc_and'} ", @c)); } else { $rv = $text{'desc_always'}; } return $rv; } # create_firewall_init() # Do whatever is needed to have the firewall started at boot time sub create_firewall_init { if (defined(&enable_at_boot)) { # Use distro's function &enable_at_boot(); } else { # May need to create init script &create_webmin_init(); } } # create_webmin_init() # Create (if necessary) the Webmin iptables init script sub create_webmin_init { local $res = &iptables_restore_command(); local $ipt = &has_command("ip${ipvx}tables"); local $out = &backquote_command("$res -h 2>&1 </dev/null"); if ($out =~ /\s+-w\s+/) { # Supports the wait flag, in case two instances are run at once $res .= " -w"; $ipt .= " -w"; } local $start = "$res <$ipvx_save"; local $stop = "$ipt -t filter -F\n". "$ipt -t nat -F\n". "$ipt -t mangle -F\n". "$ipt -t filter -P INPUT ACCEPT\n". "$ipt -t filter -P OUTPUT ACCEPT\n". "$ipt -t filter -P FORWARD ACCEPT\n". "$ipt -t nat -P PREROUTING ACCEPT\n". "$ipt -t nat -P POSTROUTING ACCEPT\n". "$ipt -t nat -P OUTPUT ACCEPT\n". "$ipt -t mangle -P PREROUTING ACCEPT\n". "$ipt -t mangle -P OUTPUT ACCEPT"; &foreign_require("init", "init-lib.pl"); &init::enable_at_boot("webmin-ip${ipvx}tables", "Load ip${ipvx}tables save file", $start, $stop, undef, { 'exit' => 1 }); } # interface_choice(name, value) sub interface_choice { local ($name, $value) = @_; local @ifaces; if (&foreign_check("net")) { &foreign_require("net", "net-lib.pl"); return &net::interface_choice($name, $value, undef, 0, 1); } else { return &ui_textbox($name, $value, 6); } } sub check_previous { my (@p,$max,$n)=@_; for ($i=0;$i<$max;$i++) { if ($n eq $p[$i]){return 1} } return -1; } sub by_string_for_iptables { my @p=("PREROUTING","INPUT","FORWARD","OUTPUT","POSTROUTING"); for ($i=0;$i<@p;$i++) { if ($a eq $p[$i]){ if (&check_previous(@p,$i,$b)){return -1;} else{ return 1;}} if ($b eq $p[$i]){ if (&check_previous(@p,$i,$b)){return 1;} else{ return -1;}} } return $a cmp $b; } sub missing_firewall_commands { local $c; foreach $c ("ip${ipvx}tables", "ip${ipvx}tables-restore", "ip${ipvx}tables-save") { return $c if (!&has_command($c)); } return undef; } sub iptables_restore_command { return &has_command("ip${ipvx}tables-restore") || &has_command("ip${ipvx}tables-legacy-restore"); } # iptables_restore() # Activates the current firewall rules, and returns any error sub iptables_restore { local $rcmd = &iptables_restore_command(); local $out = &backquote_logged("cd / && $rcmd <$ipvx_save 2>&1"); return $? ? "<pre>$out</pre>" : undef; } sub iptables_save_command { return &has_command("ip${ipvx}tables-save") || &has_command("ip${ipvx}tables-legacy-save"); } # iptables_save() # Saves the active firewall rules, and returns any error sub iptables_save { local $scmd = &iptables_save_command(); local $out = &backquote_logged("cd / && $scmd >$ipvx_save 2>&1"); return $? ? "<pre>$out</pre>" : undef; } # can_edit_table(name) sub can_edit_table { return $access{$_[0]}; } # can_jump(jump|&rule) sub can_jump { return 1 if (!$access{'jumps'}); if (!%can_jumps_cache) { %can_jumps_cache = map { lc($_), 1 } split(/\s+/, $access{'jumps'}); } local $j = ref($_[0]) ? $_[0]->{'j'}->[1] : $_[0]; return 1 if (!$j); # always allow 'do nothing' return $can_jumps_cache{lc($j)}; } # run_before_command() # Runs the before-saving command, if any sub run_before_command { if ($config{'before_cmd'}) { &system_logged("($config{'before_cmd'}) </dev/null >/dev/null 2>&1"); } } # run_after_command() # Runs the after-saving command, if any sub run_after_command { if ($config{'after_cmd'}) { &system_logged("($config{'after_cmd'}) </dev/null >/dev/null 2>&1"); } } # run_before_apply_command() # Runs the before-applying command, if any. If it fails, returns the error # message output sub run_before_apply_command { if ($config{'before_apply_cmd'}) { local $out = &backquote_logged("($config{'before_apply_cmd'}) </dev/null 2>&1"); return $out if ($?); } return undef; } # run_after_apply_command() # Runs the after-applying command, if any sub run_after_apply_command { if ($config{'after_apply_cmd'}) { &system_logged("($config{'after_apply_cmd'}) </dev/null >/dev/null 2>&1"); } } # apply_configuration() # Calls all the appropriate apply functions and programs, and returns an error # message if anything fails sub apply_configuration { local $err = &run_before_apply_command(); return $err if ($err); local @oldlive = &get_iptables_save("direct"); if (defined(&apply_iptables)) { # Call distro's apply command $err = &apply_iptables(); } else { # Manually run iptables-restore $err = &iptables_restore(); } return $err if ($err); if (!$config{"direct${ipvx}"}) { # Put back fail2ban rules local @newlive = &get_iptables_save("direct"); &merge_fail2ban_rules(\@oldlive, \@newlive); } &run_after_apply_command(); return undef; } # merge_fail2ban_rules(&old-live, &new-live) # If there were fail2ban rules before applying but not after, re-create them sub merge_fail2ban_rules { local ($oldlive, $newlive) = @_; # Get old and new filter table local ($oldfilter) = grep { $_->{'name'} eq 'filter' } @$oldlive; local ($newfilter) = grep { $_->{'name'} eq 'filter' } @$newlive; return if (!$oldfilter || !$newfilter); local $oldrules = $oldfilter->{'rules'}; local $newrules = $newfilter->{'rules'}; # Get all old fail2ban chain rules and inputs that jump to them local @oldrules = grep { $_->{'chain'} =~ /^f2b-/ } @$oldrules; return if (!@oldrules); local @oldjumps = grep { $_->{'chain'} eq 'INPUT' && $_->{'j'}->[1] =~ /^f2b-/ } @$oldrules; # Get all new fail2ban chain rules and inputs that jump to them local @newrules = grep { $_->{'chain'} =~ /^f2b-/ } @$newrules; local @newjumps = grep { $_->{'chain'} eq 'INPUT' && $_->{'j'}->[1] =~ /^f2b-/ } @newrules; # Re-create the chains my @oldchains = &unique(map { $_->{'chain'} } @oldrules); foreach my $c (@oldchains) { &system_logged("ip${ipvx}tables -t filter -N $c 2>&1"); } # Re-create any missing old rules foreach my $r (@oldrules) { &create_active_rule($newfilter, $r, 0); } foreach my $j (@oldjumps) { my ($nj) = grep { $_->{'j'}->[1] eq $j->{'j'}->[1] } @newjumps; if (!$nj) { &create_active_rule($newfilter, $j, 1); } } } # list_cluster_servers() # Returns a list of servers on which the firewall is managed sub list_cluster_servers { &foreign_require("servers", "servers-lib.pl"); local %ids = map { $_, 1 } split(/\s+/, $config{'servers'}); return grep { $ids{$_->{'id'}} } &servers::list_servers(); } # add_cluster_server(&server) sub add_cluster_server { local @sids = split(/\s+/, $config{'servers'}); $config{'servers'} = join(" ", @sids, $_[0]->{'id'}); &save_module_config(); } # delete_cluster_server(&server) sub delete_cluster_server { local @sids = split(/\s+/, $config{'servers'}); $config{'servers'} = join(" ", grep { $_ != $_[0]->{'id'} } @sids); &save_module_config(); } # server_name(&server) sub server_name { return $_[0]->{'desc'} ? $_[0]->{'desc'} : $_[0]->{'host'}; } # copy_to_cluster([force]) # Copy all firewall rules from this server to those in the cluster sub copy_to_cluster { return if (!$config{'servers'}); # no servers defined return if (!$_[0] && $config{'cluster_mode'}); # only push out when applying local $s; local $ltemp; if ($config{"direct${ipvx}"}) { # Dump current configuration $ltemp = &transname(); system("ip${ipvx}tables-save >$ltemp 2>/dev/null"); } foreach $s (&list_cluster_servers()) { &remote_foreign_require($s, $module_name); if ($config{"direct${ipvx}"}) { # Directly activate on remote server! local $rtemp = &remote_write($s, $ltemp); unlink($ltemp); local $err = &remote_eval($s, $module_name, "\$out = `ip${ipvx}tables-restore <$rtemp 2>&1`; [ \$out, \$? ]"); &remote_foreign_call($s, $module_name, "unlink_file", $rtemp); &error(&text('apply_remote', $s->{'host'}, $err->[0])) if ($err->[1]); } else { # Can just copy across save file local $rfile = &remote_eval($s, $module_name, "\$ip${ipvx}tables_save_file"); &remote_write($s, $ipvx_save, $rfile); } } } # apply_cluster_configuration() # Activate the current configuration on all servers in the cluster sub apply_cluster_configuration { return undef if (!$config{'servers'}); if ($config{'cluster_mode'}) { ©_to_cluster(1); } local $s; foreach $s (&list_cluster_servers()) { &remote_foreign_require($s->{'host'}, $module_name); local $err = &remote_foreign_call( $s->{'host'}, $module_name, "apply_configuration"); if ($err) { return &text('apply_remote', $s->{'host'}, $err); } } return undef; } # validate_iptables_config() # Tests that the rules file can be parsed sub validate_iptables_config { my $out = &backquote_command( "ip${ipvx}tables-restore --test <$ipvx_save 2>&1"); return undef if (!$?); $out =~ s/Try\s.*more\s+information.*//; return $out; } sub supports_conntrack { if (!defined($supports_conntrack_cache)) { my $out = &backquote_command("uname -r 2>/dev/null"); $supports_conntrack_cache = $out =~ /^[3-9]\./ ? 1 : 0; } return $supports_conntrack_cache; } # create_active_rule(&table, &rule, insert?) # Execute the commands to create one rule sub create_active_rule { my ($table, $rule, $insert) = @_; my $flags = &make_rule_command($rule); $flags =~ s/^-A /-I / if ($insert); my $cmd = "ip${ipvx}tables -t ".$table->{'name'}." ".$flags; my $out = &backquote_logged("$cmd 2>&1 </dev/null"); return $? ? $out : undef; } # external_firewall_list(&tables) # Returns a list of all external firewalls detected sub external_firewall_list { my ($tables) = @_; my @fwname; my ($filter) = grep { $_->{'name'} eq 'filter' } @$tables; if ($filter->{'defaults'}->{'shorewall'}) { push(@fwname, 'shorewall'); } if ($filter->{'defaults'}->{'INPUT_ZONES'}) { push(@fwname, 'firewalld'); } if ($filter->{'defaults'} =~ /^f2b-|^fail2ban-/ && !$config{'filter_chain'} ) { push(@fwname, 'fail2ban'); } if (&indexof('firewalld', @fwname) < 0 && &foreign_installed("firewalld", 1) == 2) { push(@fwname, 'firewalld'); } if (&indexof('shorewall', @fwname) < 0 && &foreign_installed("shorewall", 1) == 2) { push(@fwname, 'shorewall'); } return &unique(@fwname); } 1;
Save File
Cancel