awall-cli 6.38 KB
Newer Older
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
1 2 3 4
#!/usr/bin/lua

--[[
Alpine Wall
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
5
Copyright (C) 2012-2013 Kaarle Ritvanen
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
6 7 8
Licensed under the terms of GPL2
]]--

9
require 'alt_getopt'
10
require 'lfs'
11
require 'signal'
12 13
require 'stringy'

14 15
short_opts = 'fo:V'
long_opts = {force='f', ['output-dir']='o', verify='V'}
16

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
17 18 19 20 21
function help()
   io.stderr:write([[
Alpine Wall usage

Translate policy files to firewall configuration files:
22
    awall translate [-o|--output <dir>] [-V|--verify]
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
23 24 25 26 27 28 29 30 31 32 33

    The --verify option makes awall verify the configuration using the
    test mode of iptables-restore before overwriting the old files.

    Specifying the output directory allows testing awall policies
    without overwriting the current iptables and ipset configuration
    files. By default, awall generates the configuration to
    /etc/iptables and /etc/ipset.d, which are read by the init
    scripts.

Run-time activation of new firewall configuration:
34
    awall activate [-f|--force]
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
35

36
    This command genereates firewall configuration from the policy
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
37
    files and enables it. If the user confirms the new configuration
38 39 40
    by hitting RETURN within 10 seconds or the --force option is used,
    the configuration is saved to the files. Otherwise, the old
    configuration is restored.
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
41

42 43 44 45 46 47
Flush firewall configuration:
    awall flush

    This command deletes all firewall rules and configures it to drop
    all packets.

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
48 49 50 51 52 53 54 55 56 57 58 59
Enable/disable optional policies:
    awall {enable|disable} <policy>...

List optional policies:
    awall list

    The 'enabled' status means that the policy has been enabled by the
    user. The 'disabled' status means that the policy is not in
    use. The 'required' status means that the policy has not been
    enabled by the user but is in use because it is required by
    another policy which is in use.

60
Dump variable and zone definitions:
61 62
    awall dump [level]

63
    Verbosity level is an integer in range 0-5 and defaults to 0.
64

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
65
]])
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
66
   os.exit(1)
67 68 69
end

params = {}
70

71 72
if stringy.endswith(arg[0], '/awall-cli') then
   basedir = string.sub(arg[0], 1, -11)
73 74
   params.i = {basedir..'/json'}
   params.I = {}
75

76
   short_opts = short_opts..'i:I:'
77
   long_opts['input-dir'] = 'i'
78
   long_opts['import-path'] = 'I'
79 80
end

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
81
if not arg[1] then help() end
82 83 84 85 86

if not stringy.startswith(arg[1], '-') then
   mode = arg[1]
   table.remove(arg, 1)
end
87

88 89
opts, opind = alt_getopt.get_opts(arg, short_opts, long_opts)
for switch, value in pairs(opts) do
90 91
   if switch == 'f' then force = true
   elseif switch == 'V' then verify = true
92
   elseif switch == 'o' then outputdir = value
93
   else table.insert(params[switch], value) end
94
end
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
95

96 97 98 99 100 101 102
if not mode then
   mode = arg[opind]
   opind = opind + 1
end


require 'awall.util'
103
util = awall.util
104

105
if not util.contains({'translate', 'activate', 'fallback', 'flush',
106 107
		      'enable', 'disable', 'list', 'dump'},
		     mode) then help() end
108

109

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
110
require 'awall.uerror'
111

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
112 113 114 115
if not awall.uerror.call(
   function()
      
      require 'awall'
116

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
117
      policyset = awall.PolicySet.new(params.i, params.I)
118

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
119 120 121 122
      if mode == 'list' then
	 util.printtabular(policyset:list())
	 os.exit()
      end
123

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
124 125 126 127 128 129 130 131
      if util.contains({'disable', 'enable'}, mode) then
	 if opind > #arg then help() end
	 repeat
	    policyset[mode](policyset, arg[opind])
	    opind = opind + 1
	 until opind > #arg
	 os.exit()
      end
132

133

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
134
      input = policyset:load()
135

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
136
      if mode == 'dump' then level = 0 + (arg[opind] or 0) end
137

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
138 139 140 141
      if mode ~= 'dump' or level > 3 then
	 awall.loadmodules(basedir)
	 config = awall.Config.new(input)
      end
142 143


Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
144
      require 'awall.iptables'
145

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
146 147 148 149 150 151 152
      if mode == 'dump' then
	 require 'json'
	 expinput = input:expand()

	 function capitalize(cls)
	    return string.upper(string.sub(cls, 1, 1))..string.sub(cls, 2, -1)
	 end
153

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
154 155 156 157 158 159
	 for cls, objs in pairs(input.data) do
	    if level > 2 or (level == 2 and cls ~= 'service') or util.contains(
	       {'variable', 'zone'},
	       cls
	    ) then
	       if level == 0 then print(capitalize(cls)..'s:') end
160
	 
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185
	       items = {}
	       for k, v in pairs(objs) do
		  exp = expinput[cls][k]
		  expj = json.encode(exp)
		  src = input.source[cls][k]

		  if level == 0 then table.insert(items, {k, expj, src})

		  else
		     data = {
			{capitalize(cls)..' '..k, json.encode(v)},
			{
			   '('..src..')',
			   util.compare(exp, v) and '' or '-> '..expj
			}
		     }

		     if level > 3 then
			obj = config.objects[cls][k]
			if type(obj) == 'table' and obj.info then
			   util.extend(data, obj:info())
			end
		     end
	       
		     table.insert(items, {k, data})
186 187
		  end
	       end
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
188 189 190 191 192 193 194 195 196 197 198
	       table.sort(items, function(a, b) return a[1] < b[1] end)

	       if level == 0 then util.printtabular(items)
	       else
		  util.printtabulars(
		     util.map(items, function(x) return x[2] end)
		  )
		  print()
	       end
	    end
	 end
199

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224
	 if level > 4 then config:print() end

      elseif mode == 'translate' then
	 if verify then config:test() end
	 config:dump(outputdir)
   
      elseif mode == 'activate' then

	 awall.iptables.backup()

	 if not force then
	    signal.signal(
	       'SIGCHLD',
	       function()
		  if pid and lpc.wait(pid, 1) then os.exit(2) end
	       end
	    )
	    for i, sig in ipairs({'INT', 'TERM'}) do
	       signal.signal(
		  'SIG'..sig,
		  function()
		     interrupted = true
		     io.stdin:close()
		  end
	       )
225
	    end
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
226 227 228 229 230

	    require 'lpc'
	    pid, stdio, stdout = lpc.run(arg[0], 'fallback')
	    stdio:close()
	    stdout:close()
231 232
	 end

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
233 234 235 236
	 function kill()
	    signal.signal('SIGCHLD', 'default')
	    signal.kill(pid, 'SIGTERM')
	    lpc.wait(pid)
237
	 end
238

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
239 240 241 242
	 function revert()
	    awall.iptables.revert()
	    os.exit(1)
	 end
243

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
244
	 if awall.uerror.call(config.activate, config) then
245

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
246 247 248 249
	    if not force then
	       io.stderr:write('New firewall configuration activated\n')
	       io.stderr:write('Press RETURN to commit changes permanently: ')
	       interrupted = not io.read()
250

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
251
	       kill()
252

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
253 254 255 256 257 258 259
	       if interrupted then
		  io.stderr:write(
		     '\nActivation canceled, reverting to the old configuration\n'
		  )
		  revert()
	       end
	    end
260

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
261
	    config:dump()
262

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
263 264 265 266
	 else
	    if not force then kill() end
	    revert()
	 end
267 268


Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
269 270 271 272 273
      elseif mode == 'fallback' then
   
	 for i, sig in ipairs({'HUP', 'PIPE'}) do
	    signal.signal('SIG'..sig, function() end)
	 end
274

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
275 276
	 require 'lsleep'
	 lsleep.sleep(10)
277

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
278 279
	 io.stderr:write('\nTimeout, reverting to the old configuration\n')
	 awall.iptables.revert()
280

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
281
      elseif mode == 'flush' then awall.iptables.flush()
282

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
283
      else assert(false) end
284

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
285 286
   end
) then os.exit(1) end