awall-cli 5.47 KB
Newer Older
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
1 2 3 4 5 6 7 8
#!/usr/bin/lua

--[[
Alpine Wall
Copyright (C) 2012 Kaarle Ritvanen
Licensed under the terms of GPL2
]]--

9
require 'alt_getopt'
10
require 'lfs'
11
require 'signal'
12 13
require 'stringy'

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
14 15
short_opts = 'o:V'
long_opts = {['output-dir']='o', verify='V'}
16

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
17 18 19 20 21
function help()
   io.stderr:write([[
Alpine Wall usage

Translate policy files to firewall configuration files:
22
    awall translate [-o|--output <dir>] [-V|--verify]
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
23 24 25 26 27 28 29 30 31 32 33 34 35

    The --verify option makes awall verify the configuration using the
    test mode of iptables-restore before overwriting the old files.

    Specifying the output directory allows testing awall policies
    without overwriting the current iptables and ipset configuration
    files. By default, awall generates the configuration to
    /etc/iptables and /etc/ipset.d, which are read by the init
    scripts.

Run-time activation of new firewall configuration:
    awall activate

36
    This command genereates firewall configuration from the policy
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
37
    files and enables it. If the user confirms the new configuration
38 39
    by hitting RETURN within 10 seconds, the configuration is saved to
    the files. Otherwise, the old configuration is restored.
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
40

41 42 43 44 45 46
Flush firewall configuration:
    awall flush

    This command deletes all firewall rules and configures it to drop
    all packets.

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
47 48 49 50 51 52 53 54 55 56 57 58
Enable/disable optional policies:
    awall {enable|disable} <policy>...

List optional policies:
    awall list

    The 'enabled' status means that the policy has been enabled by the
    user. The 'disabled' status means that the policy is not in
    use. The 'required' status means that the policy has not been
    enabled by the user but is in use because it is required by
    another policy which is in use.

59
Dump variable and zone definitions:
60 61 62
    awall dump [level]

    Verbosity level is an integer in range 0-3 and defaults to 0.
63

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
64
]])
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
65 66 67 68
   os.exit()
end

params = {}
69

70 71
if stringy.endswith(arg[0], '/awall-cli') then
   basedir = string.sub(arg[0], 1, -11)
72 73
   params.i = {basedir..'/json'}
   params.I = {}
74

75
   short_opts = short_opts..'i:I:'
76
   long_opts['input-dir'] = 'i'
77
   long_opts['import-path'] = 'I'
78 79
end

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
80
if not arg[1] then help() end
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
81 82 83 84 85

if not stringy.startswith(arg[1], '-') then
   mode = arg[1]
   table.remove(arg, 1)
end
86

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
87 88 89
opts, opind = alt_getopt.get_opts(arg, short_opts, long_opts)
for switch, value in pairs(opts) do
   if switch == 'V' then verify = true
90 91 92
   elseif switch == 'o' then
      iptdir = value
      ipsfile = value..'/ipset'
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
93
   else table.insert(params[switch], value) end
94
end
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
95

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
96 97 98 99 100 101 102
if not mode then
   mode = arg[opind]
   opind = opind + 1
end


require 'awall.util'
103
util = awall.util
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
104

105
if not util.contains({'translate', 'activate', 'fallback', 'flush',
106 107
		      'enable', 'disable', 'list', 'dump'},
		     mode) then help() end
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
108

109

110 111 112
require 'awall'

policyset = awall.PolicySet.new(params.i, params.I)
113

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
114
if mode == 'list' then
115
   util.printtabular(policyset:list())
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
116
   os.exit()
117 118
end

119
if util.contains({'disable', 'enable'}, mode) then
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
120
   if opind > #arg then help() end
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
121 122 123 124
   repeat
      policyset[mode](policyset, arg[opind])
      opind = opind + 1
   until opind > #arg
125 126 127
   os.exit()
end

128

129 130
config = policyset:load()

131
if mode == 'dump' then
132 133
   level = 0 + (arg[opind] or 0)

134
   require 'json'
135 136
   expconfig = config:expand()

137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166
   function capitalize(cls)
      return string.upper(string.sub(cls, 1, 1))..string.sub(cls, 2, -1)
   end

   for cls, objs in pairs(config.data) do
      if level > 2 or (level == 2 and cls ~= 'service') or util.contains({'variable',
									  'zone'},
									 cls) then
	 if level == 0 then print(capitalize(cls)..'s:') end
	 
	 items = {}
	 for k, v in pairs(objs) do
	    exp = expconfig[cls][k]
	    expj = json.encode(exp)
	    src = config.source[cls][k]
	    if level == 0 then table.insert(items, {k, expj, src})
	    else
	       table.insert(items,
			    {k, {{capitalize(cls)..' '..k, json.encode(v)},
				 {'('..src..')',
				  util.compare(exp, v) and '' or '-> '..expj}}})
	    end
	 end
	 table.sort(items, function(a, b) return a[1] < b[1] end)

	 if level == 0 then util.printtabular(items)
	 else
	    util.printtabulars(util.map(items,
					function(x) return x[2] end))
	    print()
167
	 end
168 169 170 171 172 173
      end
   end

   os.exit()
end

174

175
require 'awall.iptables'
176
awall.loadmodules(basedir)
177

178
config = awall.Config.new(config)
179

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
180 181 182 183 184
if mode == 'translate' then
   if verify then config:test() end
   config:dump(iptdir, ipsfile)      
   
elseif mode == 'activate' then
185 186 187 188 189 190 191 192 193 194 195 196 197

   awall.iptables.backup()

   signal.signal('SIGCHLD',
		 function() if pid and lpc.wait(pid, 1) then os.exit(2) end end)
   for i, sig in ipairs({'INT', 'TERM'}) do
      signal.signal('SIG'..sig, function()
				   interrupted = true
				   io.stdin:close()
				end)
   end

   require 'lpc'
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
198
   pid, stdio, stdout = lpc.run(arg[0], 'fallback')
199 200 201 202 203 204 205
   stdio:close()
   stdout:close()
   
   config:activate()

   io.stderr:write('New firewall configuration activated\n')
   io.stderr:write('Press RETURN to commit changes permanently: ')
206
   interrupted = not io.read()
207 208 209 210 211 212 213 214 215 216 217 218

   signal.signal('SIGCHLD', 'default')
   signal.kill(pid, 'SIGTERM')
   lpc.wait(pid)

   if interrupted then
      io.stderr:write('\nActivation canceled, reverting to the old configuration\n')
      awall.iptables.revert()

   else config:dump() end


Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
219
elseif mode == 'fallback' then
220 221 222 223 224 225 226 227 228 229 230

   for i, sig in ipairs({'HUP', 'PIPE'}) do
      signal.signal('SIG'..sig, function() end)
   end

   require 'lsleep'
   lsleep.sleep(10)

   io.stderr:write('\nTimeout, reverting to the old configuration\n')
   awall.iptables.revert()

231 232
elseif mode == 'flush' then awall.iptables.flush()

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
233
else assert(false) end