init.lua 3.43 KB
Newer Older
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
1 2 3 4 5 6 7 8
--[[
Alpine Wall main module
Copyright (C) 2012 Kaarle Ritvanen
Licensed under the terms of GPL2
]]--

module(..., package.seeall)

9
require 'lfs'
10
require 'stringy'
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
11

12
require 'awall.ipset'
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
13
require 'awall.iptables'
14
require 'awall.model'
15
require 'awall.object'
16
require 'awall.optfrag'
17
require 'awall.policy'
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
18 19
require 'awall.util'

20 21
local optfrag = awall.optfrag

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
22

23 24
local procorder
local defrules
25 26

function loadmodules(path)
27 28 29
   classmap = {}
   procorder = {}
   defrules = {}
30
   achains = {}
31 32

   local function readmetadata(mod)
33
      for i, clsdef in ipairs(mod.classes or {}) do
34 35 36 37
	 local path, cls = unpack(clsdef)
	 classmap[path] = cls
	 table.insert(procorder, path)
      end
38
      for phase, rules in pairs(mod.defrules or {}) do
39
	 if not defrules[phase] then defrules[phase] = {} end
40
	 table.insert(defrules[phase], rules)
41
      end
42 43 44 45
      for name, opts in pairs(mod.achains or {}) do
	 assert(not achains[name])
	 achains[name] = opts
      end
46 47 48 49
   end

   readmetadata(model)

50 51 52
   local cdir = lfs.currentdir()
   if path then lfs.chdir(path) end

53
   local modules = {}
54 55
   for modfile in lfs.dir((path or '/usr/share/lua/5.1')..'/awall/modules') do
      if stringy.endswith(modfile, '.lua') then
56
	 table.insert(modules, 'awall.modules.'..string.sub(modfile, 1, -5))
57
      end
58
   end
59 60 61 62 63
   table.sort(modules)
   for i, name in ipairs(modules) do
      require(name)
      readmetadata(package.loaded[name])
   end
64 65

   lfs.chdir(cdir)
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
66 67 68
end


69 70 71
PolicySet = policy.PolicySet


72
Config = object.class(object.Object)
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
73

74
function Config:init(policyconfig)
75

76
   self.objects = policyconfig:expand()
77
   self.iptables = iptables.IPTables.new()
78

79
   local function morph(path, cls)
80
      local objs = self.objects[path]
81 82 83 84 85 86 87 88 89
      if objs then
	 for k, v in pairs(objs) do
	    objs[k] = cls.morph(v,
				self,
				path..' '..k..' ('..policyconfig.source[path][k]..')')
	 end
      end
   end

90 91
   local acfrags = {}

92 93 94
   local function insertrules(trules)
      for i, trule in ipairs(trules) do
	 local t = self.iptables.config[trule.family][trule.table][trule.chain]
95 96 97 98 99 100 101
	 local opts = (trule.opts and trule.opts..' ' or '')..'-j '..trule.target

	 local acfrag = {family=trule.family,
			 table=trule.table,
			 chain=trule.target}
	 acfrags[optfrag.location(acfrag)] = acfrag

102
	 if trule.position == 'prepend' then
103
	    table.insert(t, 1, opts)
104
	 else
105
	    table.insert(t, opts)
106
	 end
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
107 108 109
      end
   end

110
   local function insertdefrules(phase)
111 112
      for i, rulegroup in ipairs(defrules[phase] or {}) do
	 if type(rulegroup) == 'function' then
113
	    insertrules(rulegroup(self.objects))
114 115
	 else insertrules(rulegroup) end
      end
116
   end
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
117

118
   for i, path in ipairs(procorder) do morph(path, classmap[path]) end
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
119

120
   insertdefrules('pre')
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
121

122
   for i, path in ipairs(procorder) do
123 124
      if self.objects[path] then
	 for i, rule in ipairs(self.objects[path]) do
125 126
	    insertrules(rule:trules())
	 end
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
127
      end
128
      insertdefrules('post-'..path)
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
129
   end
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
130

131 132 133 134
   local ofrags = {}
   for k, v in pairs(acfrags) do table.insert(ofrags, v) end
   insertrules(optfrag.combinations(achains, ofrags))

135
   morph('ipset', awall.model.ConfigObject)
136
   self.ipset = ipset.IPSet.new(self.objects.ipset)
137
end
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
138

139 140 141 142 143 144
function Config:print()
   self.ipset:print()
   print()
   self.iptables:print()
end

145 146 147
function Config:dump(dir)
   self.ipset:dump(dir or '/etc/ipset.d')
   self.iptables:dump(dir or '/etc/iptables')
148
end
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
149

150 151 152
function Config:test()
   self.ipset:create()
   self.iptables:test()
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
153
end
154 155 156 157 158

function Config:activate()
   self:test()
   self.iptables:activate()
end