From 9a1f7d3322474f35bb95240984ca4696a8f06c45 Mon Sep 17 00:00:00 2001
From: bbruns <bbruns@e5899ace-8841-11de-95b9-8f387cfb8bc3>
Date: Sat, 12 Apr 2014 18:32:12 +0000
Subject: [PATCH] Add missing syn support

---
 CHANGELOG         |  1 +
 etc/ipv4/acl.conf |  9 +++++----
 etc/ipv6/acl.conf |  9 +++++----
 lib/iptables.inc  | 11 +++++++----
 4 files changed, 18 insertions(+), 12 deletions(-)

diff --git a/CHANGELOG b/CHANGELOG
index 3cc241f..67c6d9d 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,6 +1,7 @@
 2.00 Alpha 2 - 04/11/2014
 	- Slightly better documentation
 	- Kernel module loading - 4/11/2014
+	- Add syn matching to acl.conf rules
 
 2.00 Alpha 1 - 04/10/2014
 	- Complete code rewrite and restructure to solve some long standing issues with v1
diff --git a/etc/ipv4/acl.conf b/etc/ipv4/acl.conf
index 4e5f65d..c50c1e8 100644
--- a/etc/ipv4/acl.conf
+++ b/etc/ipv4/acl.conf
@@ -2,7 +2,7 @@
 # Use this file to set up more complex access control lists.
 # Use tabs or single space to separate
 #
-# <direction> <action> <interface> <src-address> <src-port> <dst-address> <dst-port> <protocol>
+# <direction> <action> <interface> <src-address> <src-port> <dst-address> <dst-port> <protocol> <syn>
 #
 # Direction: Required ( IN | OUT )
 # Action: Required (ACCEPT | DROP)
@@ -12,9 +12,10 @@
 # Dst Address: Optional ( destination of traffic )
 # Dst Port: Optional ( destination port, 1 - 65535, Requires Protocol )
 # Protocol: Optional, Required if port is specified ( tcp | udp )
+# Syn: Optional, only match (not) syn packets (syn | notsyn )
 # You can use '-' for optional fields
 #============================================================
-#<dir> <action> <interface> <src-address> <src-port> <dst-address> <dst-port> <protocol>
-#IN ACCEPT eth0 10.0.0.1 22 - - tcp
-#IN DROP - - - - 22 tcp
+#<dir> <action> <interface> <src-address> <src-port> <dst-address> <dst-port> <protocol> <syn>
+#IN ACCEPT eth0 10.0.0.1 22 - - tcp -
+#IN DROP - - - - 22 tcp syn
 
diff --git a/etc/ipv6/acl.conf b/etc/ipv6/acl.conf
index 5c3734c..6c595e8 100644
--- a/etc/ipv6/acl.conf
+++ b/etc/ipv6/acl.conf
@@ -2,7 +2,7 @@
 # Use this file to set up more complex access control lists.
 # Use tabs or single space to separate
 #
-# <direction> <action> <interface> <src-address> <src-port> <dst-address> <dst-port> <protocol>
+# <direction> <action> <interface> <src-address> <src-port> <dst-address> <dst-port> <protocol> <syn>
 #
 # Direction: Required ( IN | OUT )
 # Action: Required (ACCEPT | DROP)
@@ -12,9 +12,10 @@
 # Dst Address: Optional ( destination of traffic )
 # Dst Port: Optional ( destination port, 1 - 65535, Requires Protocol )
 # Protocol: Optional, Required if port is specified ( tcp | udp )
+# Syn: Optional, only match (not) syn packets (syn | notsyn )
 # You can use '-' for optional fields
 #============================================================
-#<dir> <action> <interface> <src-address> <src-port> <dst-address> <dst-port> <protocol>
-#IN ACCEPT eth0 2002:dead:beef::/64 22	- -	tcp
-#IN DROP - - - - 22 tcp
+#<dir> <action> <interface> <src-address> <src-port> <dst-address> <dst-port> <protocol> <syn>
+#IN ACCEPT eth0 2002:dead:beef::/64 22	- -	tcp -
+#IN DROP - - - - 22 tcp syn
 
diff --git a/lib/iptables.inc b/lib/iptables.inc
index 2a6b537..27872ca 100644
--- a/lib/iptables.inc
+++ b/lib/iptables.inc
@@ -306,13 +306,13 @@ function enable_filtering {
 	${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} loading"
 	if [ -e "${FWCONFIGDIR}/ipv${IPVER}/acl.conf" ]; then
 		${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} read ${FWCONFIGDIR}/ipv${IPVER}/acl.conf successful"
-		while read -r direction action interface srcaddress srcport dstaddress dstport protocol; do
+		while read -r direction action interface srcaddress srcport dstaddress dstport protocol syn; do
 			[[ ${direction} = \#* ]] && continue
 			[[ ${direction} = "" ]] && continue
 			([[ ${direction} != "IN" ]] && [[ ${direction} != "OUT" ]]) \
-					&& ${display} RED "acl.conf: Error - must begin with IN/OUT: ${DEFAULT_COLOR}${direction} ${action} ${interface} ${srcaddress} ${srcport} ${dstaddress} ${dstport} ${protocol}" && continue
+					&& ${display} RED "acl.conf: Error - must begin with IN/OUT: ${DEFAULT_COLOR}${direction} ${action} ${interface} ${srcaddress} ${srcport} ${dstaddress} ${dstport} ${protocol} ${syn}" && continue
 			([[ ${action} != "ACCEPT" ]] && [[ ${action} != "DROP" ]] && [[ ${action} != "REJECT" ]]) \
-					&& ${display} RED "acl.conf: Error - action must be either ACCEPT, DROP, or REJECT : ${DEFAULT_COLOR}${direction} ${action} ${interface} ${srcaddress} ${srcport} ${dstaddress} ${dstport} ${protocol}" && continue
+					&& ${display} RED "acl.conf: Error - action must be either ACCEPT, DROP, or REJECT : ${DEFAULT_COLOR}${direction} ${action} ${interface} ${srcaddress} ${srcport} ${dstaddress} ${dstport} ${protocol} ${syn}" && continue
 
 			# Do some creative work with variables to make building the iptables rules fairly painless
 			[[ ${dstport} != "-" ]] && dstport="--dport ${dstport}"
@@ -325,6 +325,8 @@ function enable_filtering {
 			[[ ${direction} == "IN" ]] && chain="${InFilter}"
 			[[ ${protocol} != "-" ]] && protocol="-p ${protocol}"
 			[[ ${action} == "REJECT" ]] && action="REJECT --reject-with tcp-reset"
+			[[ ${syn} == "syn" ]] && syn="--syn"
+			[[ ${syn} == "notsyn" ]] && syn="! --syn"
 			
 			${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR}${direction} ${action} ${interface} ${srcaddress} ${srcport} ${dstaddress} ${dstport} ${protocol}"
 			
@@ -335,8 +337,9 @@ function enable_filtering {
 			[[ ${dstaddress} == "-" ]] && dstaddress=""
 			[[ ${srcaddress} == "-" ]] && srcaddress=""
 			[[ ${protocol} == "-" ]] && protocol=""
+			[[ ${syn} == "-" ]] && syn=""
 			
-			${VER_IPTABLES} -A ${chain} ${interface} ${protocol} ${srcaddress} ${srcport} ${dstaddress} ${dstport} -j ${action}
+			${VER_IPTABLES} -A ${chain} ${interface} ${protocol} ${srcaddress} ${srcport} ${syn} ${dstaddress} ${dstport} -j ${action}
 		done < "${FWCONFIGDIR}/ipv${IPVER}/acl.conf"
 		${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} done"
 	fi