brielle
/
SRFirewall
1
0
Fork 0
Code Issues Pull Requests Releases 1 Wiki Activity

Add missing syn support

master
bbruns 2014-04-12 18:32:12 +00:00
parent eb9d37a7ff
commit 9a1f7d3322
4 changed files with 18 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
CHANGELOG
View File

@ -1,6 +1,7 @@
2.00 Alpha 2 - 04/11/2014 2.00 Alpha 2 - 04/11/2014
- Slightly better documentation - Slightly better documentation
- Kernel module loading - 4/11/2014 - Kernel module loading - 4/11/2014
- Add syn matching to acl.conf rules
2.00 Alpha 1 - 04/10/2014 2.00 Alpha 1 - 04/10/2014
- Complete code rewrite and restructure to solve some long standing issues with v1 - Complete code rewrite and restructure to solve some long standing issues with v1

9
etc/ipv4/acl.conf
View File

@ -2,7 +2,7 @@
# Use this file to set up more complex access control lists. # Use this file to set up more complex access control lists.
# Use tabs or single space to separate # Use tabs or single space to separate
# #
# <direction> <action> <interface> <src-address> <src-port> <dst-address> <dst-port> <protocol> # <direction> <action> <interface> <src-address> <src-port> <dst-address> <dst-port> <protocol> <syn>
# #
# Direction: Required ( IN | OUT ) # Direction: Required ( IN | OUT )
# Action: Required (ACCEPT | DROP) # Action: Required (ACCEPT | DROP)
@ -12,9 +12,10 @@
# Dst Address: Optional ( destination of traffic ) # Dst Address: Optional ( destination of traffic )
# Dst Port: Optional ( destination port, 1 - 65535, Requires Protocol ) # Dst Port: Optional ( destination port, 1 - 65535, Requires Protocol )
# Protocol: Optional, Required if port is specified ( tcp | udp ) # Protocol: Optional, Required if port is specified ( tcp | udp )
# Syn: Optional, only match (not) syn packets (syn | notsyn )
# You can use '-' for optional fields # You can use '-' for optional fields
#============================================================ #============================================================
#<dir> <action> <interface> <src-address> <src-port> <dst-address> <dst-port> <protocol> #<dir> <action> <interface> <src-address> <src-port> <dst-address> <dst-port> <protocol> <syn>
#IN ACCEPT eth0 10.0.0.1 22 - - tcp #IN ACCEPT eth0 10.0.0.1 22 - - tcp -
#IN DROP - - - - 22 tcp #IN DROP - - - - 22 tcp syn

9
etc/ipv6/acl.conf
View File

@ -2,7 +2,7 @@
# Use this file to set up more complex access control lists. # Use this file to set up more complex access control lists.
# Use tabs or single space to separate # Use tabs or single space to separate
# #
# <direction> <action> <interface> <src-address> <src-port> <dst-address> <dst-port> <protocol> # <direction> <action> <interface> <src-address> <src-port> <dst-address> <dst-port> <protocol> <syn>
# #
# Direction: Required ( IN | OUT ) # Direction: Required ( IN | OUT )
# Action: Required (ACCEPT | DROP) # Action: Required (ACCEPT | DROP)
@ -12,9 +12,10 @@
# Dst Address: Optional ( destination of traffic ) # Dst Address: Optional ( destination of traffic )
# Dst Port: Optional ( destination port, 1 - 65535, Requires Protocol ) # Dst Port: Optional ( destination port, 1 - 65535, Requires Protocol )
# Protocol: Optional, Required if port is specified ( tcp | udp ) # Protocol: Optional, Required if port is specified ( tcp | udp )
# Syn: Optional, only match (not) syn packets (syn | notsyn )
# You can use '-' for optional fields # You can use '-' for optional fields
#============================================================ #============================================================
#<dir> <action> <interface> <src-address> <src-port> <dst-address> <dst-port> <protocol> #<dir> <action> <interface> <src-address> <src-port> <dst-address> <dst-port> <protocol> <syn>
#IN ACCEPT eth0 2002:dead:beef::/64 22 - - tcp #IN ACCEPT eth0 2002:dead:beef::/64 22 - - tcp -
#IN DROP - - - - 22 tcp #IN DROP - - - - 22 tcp syn

11
lib/iptables.inc
View File

@ -306,13 +306,13 @@ function enable_filtering {
${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} loading" ${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} loading"
if [ -e "${FWCONFIGDIR}/ipv${IPVER}/acl.conf" ]; then if [ -e "${FWCONFIGDIR}/ipv${IPVER}/acl.conf" ]; then
${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} read ${FWCONFIGDIR}/ipv${IPVER}/acl.conf successful" ${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} read ${FWCONFIGDIR}/ipv${IPVER}/acl.conf successful"
while read -r direction action interface srcaddress srcport dstaddress dstport protocol; do while read -r direction action interface srcaddress srcport dstaddress dstport protocol syn; do
[[ ${direction} = \#* ]] && continue [[ ${direction} = \#* ]] && continue
[[ ${direction} = "" ]] && continue [[ ${direction} = "" ]] && continue
([[ ${direction} != "IN" ]] && [[ ${direction} != "OUT" ]]) \ ([[ ${direction} != "IN" ]] && [[ ${direction} != "OUT" ]]) \
&& ${display} RED "acl.conf: Error - must begin with IN/OUT: ${DEFAULT_COLOR}${direction} ${action} ${interface} ${srcaddress} ${srcport} ${dstaddress} ${dstport} ${protocol}" && continue && ${display} RED "acl.conf: Error - must begin with IN/OUT: ${DEFAULT_COLOR}${direction} ${action} ${interface} ${srcaddress} ${srcport} ${dstaddress} ${dstport} ${protocol} ${syn}" && continue
([[ ${action} != "ACCEPT" ]] && [[ ${action} != "DROP" ]] && [[ ${action} != "REJECT" ]]) \ ([[ ${action} != "ACCEPT" ]] && [[ ${action} != "DROP" ]] && [[ ${action} != "REJECT" ]]) \
&& ${display} RED "acl.conf: Error - action must be either ACCEPT, DROP, or REJECT : ${DEFAULT_COLOR}${direction} ${action} ${interface} ${srcaddress} ${srcport} ${dstaddress} ${dstport} ${protocol}" && continue && ${display} RED "acl.conf: Error - action must be either ACCEPT, DROP, or REJECT : ${DEFAULT_COLOR}${direction} ${action} ${interface} ${srcaddress} ${srcport} ${dstaddress} ${dstport} ${protocol} ${syn}" && continue
# Do some creative work with variables to make building the iptables rules fairly painless # Do some creative work with variables to make building the iptables rules fairly painless
[[ ${dstport} != "-" ]] && dstport="--dport ${dstport}" [[ ${dstport} != "-" ]] && dstport="--dport ${dstport}"
@ -325,6 +325,8 @@ function enable_filtering {
[[ ${direction} == "IN" ]] && chain="${InFilter}" [[ ${direction} == "IN" ]] && chain="${InFilter}"
[[ ${protocol} != "-" ]] && protocol="-p ${protocol}" [[ ${protocol} != "-" ]] && protocol="-p ${protocol}"
[[ ${action} == "REJECT" ]] && action="REJECT --reject-with tcp-reset" [[ ${action} == "REJECT" ]] && action="REJECT --reject-with tcp-reset"
[[ ${syn} == "syn" ]] && syn="--syn"
[[ ${syn} == "notsyn" ]] && syn="! --syn"
${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR}${direction} ${action} ${interface} ${srcaddress} ${srcport} ${dstaddress} ${dstport} ${protocol}" ${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR}${direction} ${action} ${interface} ${srcaddress} ${srcport} ${dstaddress} ${dstport} ${protocol}"
@ -335,8 +337,9 @@ function enable_filtering {
[[ ${dstaddress} == "-" ]] && dstaddress="" [[ ${dstaddress} == "-" ]] && dstaddress=""
[[ ${srcaddress} == "-" ]] && srcaddress="" [[ ${srcaddress} == "-" ]] && srcaddress=""
[[ ${protocol} == "-" ]] && protocol="" [[ ${protocol} == "-" ]] && protocol=""
[[ ${syn} == "-" ]] && syn=""
${VER_IPTABLES} -A ${chain} ${interface} ${protocol} ${srcaddress} ${srcport} ${dstaddress} ${dstport} -j ${action} ${VER_IPTABLES} -A ${chain} ${interface} ${protocol} ${srcaddress} ${srcport} ${syn} ${dstaddress} ${dstport} -j ${action}
done < "${FWCONFIGDIR}/ipv${IPVER}/acl.conf" done < "${FWCONFIGDIR}/ipv${IPVER}/acl.conf"
${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} done" ${debug} ${DebugColor} "${FUNCNAME}:${DEFAULT_COLOR} done"
fi fi