awall-cli 4.12 KB
Newer Older
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
1 2 3 4 5 6 7 8
#!/usr/bin/lua

--[[
Alpine Wall
Copyright (C) 2012 Kaarle Ritvanen
Licensed under the terms of GPL2
]]--

9
require 'alt_getopt'
10
require 'lfs'
11
require 'signal'
12 13
require 'stringy'

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
14 15
short_opts = 'o:V'
long_opts = {['output-dir']='o', verify='V'}
16

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53
function help()
   io.stderr:write([[
Alpine Wall usage

Translate policy files to firewall configuration files:
    awall translate [--output <dir>] [--verify]

    The --verify option makes awall verify the configuration using the
    test mode of iptables-restore before overwriting the old files.

    Specifying the output directory allows testing awall policies
    without overwriting the current iptables and ipset configuration
    files. By default, awall generates the configuration to
    /etc/iptables and /etc/ipset.d, which are read by the init
    scripts.

Run-time activation of new firewall configuration:
    awall activate

    This function genereates firewall configuration from the policy
    files and enables it. If the user confirms the new configuration
    by hitting RETURN within 10 seconds, the configuration is saved
    to the files. Otherwise, the old configuration is restored.

Enable/disable optional policies:
    awall {enable|disable} <policy>...

List optional policies:
    awall list

    The 'enabled' status means that the policy has been enabled by the
    user. The 'disabled' status means that the policy is not in
    use. The 'required' status means that the policy has not been
    enabled by the user but is in use because it is required by
    another policy which is in use.

]])
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
54 55 56 57
   os.exit()
end

params = {}
58

59 60
if stringy.endswith(arg[0], '/awall-cli') then
   basedir = string.sub(arg[0], 1, -11)
61 62
   params.i = {basedir..'/json'}
   params.I = {}
63

64
   short_opts = short_opts..'i:I:'
65
   long_opts['input-dir'] = 'i'
66
   long_opts['import-path'] = 'I'
67 68
end

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
69
if not arg[1] then help() end
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
70 71 72 73 74

if not stringy.startswith(arg[1], '-') then
   mode = arg[1]
   table.remove(arg, 1)
end
75

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
76 77 78
opts, opind = alt_getopt.get_opts(arg, short_opts, long_opts)
for switch, value in pairs(opts) do
   if switch == 'V' then verify = true
79 80 81
   elseif switch == 'o' then
      iptdir = value
      ipsfile = value..'/ipset'
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
82
   else table.insert(params[switch], value) end
83
end
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
84

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
85 86 87 88 89 90 91 92 93 94
if not mode then
   mode = arg[opind]
   opind = opind + 1
end


require 'awall.util'

if not awall.util.contains({'translate', 'activate', 'fallback',
			    'enable', 'disable', 'list'},
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
95
			   mode) then help() end
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
96

97

98 99 100
require 'awall'

policyset = awall.PolicySet.new(params.i, params.I)
101

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
102
if mode == 'list' then
103 104 105
   for name, status, desc in policyset:list() do
       print(name, status, desc)
   end
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
106
   os.exit()
107 108
end

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
109
if awall.util.contains({'disable', 'enable'}, mode) then
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
110
   if opind > #arg then help() end
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
111 112 113 114
   repeat
      policyset[mode](policyset, arg[opind])
      opind = opind + 1
   until opind > #arg
115 116 117 118
   os.exit()
end


119
require 'awall.iptables'
120
awall.loadmodules(basedir)
121

122
config = awall.Config.new(policyset)
123

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
124 125 126 127 128
if mode == 'translate' then
   if verify then config:test() end
   config:dump(iptdir, ipsfile)      
   
elseif mode == 'activate' then
129 130 131 132 133 134 135 136 137 138 139 140 141

   awall.iptables.backup()

   signal.signal('SIGCHLD',
		 function() if pid and lpc.wait(pid, 1) then os.exit(2) end end)
   for i, sig in ipairs({'INT', 'TERM'}) do
      signal.signal('SIG'..sig, function()
				   interrupted = true
				   io.stdin:close()
				end)
   end

   require 'lpc'
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
142
   pid, stdio, stdout = lpc.run(arg[0], 'fallback')
143 144 145 146 147 148 149
   stdio:close()
   stdout:close()
   
   config:activate()

   io.stderr:write('New firewall configuration activated\n')
   io.stderr:write('Press RETURN to commit changes permanently: ')
150
   interrupted = not io.read()
151 152 153 154 155 156 157 158 159 160 161 162

   signal.signal('SIGCHLD', 'default')
   signal.kill(pid, 'SIGTERM')
   lpc.wait(pid)

   if interrupted then
      io.stderr:write('\nActivation canceled, reverting to the old configuration\n')
      awall.iptables.revert()

   else config:dump() end


Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
163
elseif mode == 'fallback' then
164 165 166 167 168 169 170 171 172 173 174

   for i, sig in ipairs({'HUP', 'PIPE'}) do
      signal.signal('SIG'..sig, function() end)
   end

   require 'lsleep'
   lsleep.sleep(10)

   io.stderr:write('\nTimeout, reverting to the old configuration\n')
   awall.iptables.revert()

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
175
else assert(false) end