awall-cli 4.78 KB
Newer Older
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
1 2 3 4 5 6 7 8
#!/usr/bin/lua

--[[
Alpine Wall
Copyright (C) 2012 Kaarle Ritvanen
Licensed under the terms of GPL2
]]--

9
require 'alt_getopt'
10
require 'lfs'
11
require 'signal'
12 13
require 'stringy'

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
14 15
short_opts = 'o:V'
long_opts = {['output-dir']='o', verify='V'}
16

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
17 18 19 20 21
function help()
   io.stderr:write([[
Alpine Wall usage

Translate policy files to firewall configuration files:
22
    awall translate [-o|--output <dir>] [-V|--verify]
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
23 24 25 26 27 28 29 30 31 32 33 34 35

    The --verify option makes awall verify the configuration using the
    test mode of iptables-restore before overwriting the old files.

    Specifying the output directory allows testing awall policies
    without overwriting the current iptables and ipset configuration
    files. By default, awall generates the configuration to
    /etc/iptables and /etc/ipset.d, which are read by the init
    scripts.

Run-time activation of new firewall configuration:
    awall activate

36
    This command genereates firewall configuration from the policy
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
37
    files and enables it. If the user confirms the new configuration
38 39
    by hitting RETURN within 10 seconds, the configuration is saved to
    the files. Otherwise, the old configuration is restored.
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
40 41 42 43 44 45 46 47 48 49 50 51 52

Enable/disable optional policies:
    awall {enable|disable} <policy>...

List optional policies:
    awall list

    The 'enabled' status means that the policy has been enabled by the
    user. The 'disabled' status means that the policy is not in
    use. The 'required' status means that the policy has not been
    enabled by the user but is in use because it is required by
    another policy which is in use.

53 54 55
Dump variable and zone definitions:
    awall dump

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
56
]])
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
57 58 59 60
   os.exit()
end

params = {}
61

62 63
if stringy.endswith(arg[0], '/awall-cli') then
   basedir = string.sub(arg[0], 1, -11)
64 65
   params.i = {basedir..'/json'}
   params.I = {}
66

67
   short_opts = short_opts..'i:I:'
68
   long_opts['input-dir'] = 'i'
69
   long_opts['import-path'] = 'I'
70 71
end

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
72
if not arg[1] then help() end
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
73 74 75 76 77

if not stringy.startswith(arg[1], '-') then
   mode = arg[1]
   table.remove(arg, 1)
end
78

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
79 80 81
opts, opind = alt_getopt.get_opts(arg, short_opts, long_opts)
for switch, value in pairs(opts) do
   if switch == 'V' then verify = true
82 83 84
   elseif switch == 'o' then
      iptdir = value
      ipsfile = value..'/ipset'
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
85
   else table.insert(params[switch], value) end
86
end
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
87

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
88 89 90 91 92 93 94 95 96
if not mode then
   mode = arg[opind]
   opind = opind + 1
end


require 'awall.util'

if not awall.util.contains({'translate', 'activate', 'fallback',
97
			    'enable', 'disable', 'list', 'dump'},
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
98
			   mode) then help() end
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
99

100

101 102 103
require 'awall'

policyset = awall.PolicySet.new(params.i, params.I)
104

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
105
if mode == 'list' then
106
   awall.util.printtabular(policyset:list())
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
107
   os.exit()
108 109
end

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
110
if awall.util.contains({'disable', 'enable'}, mode) then
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
111
   if opind > #arg then help() end
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
112 113 114 115
   repeat
      policyset[mode](policyset, arg[opind])
      opind = opind + 1
   until opind > #arg
116 117 118
   os.exit()
end

119

120 121
config = policyset:load()

122 123
if mode == 'dump' then
   require 'json'
124 125 126 127 128 129 130 131 132 133
   expconfig = config:expand()

   for i, section in ipairs({'variable', 'zone'}) do
      if config.data[section] then
	 print(string.upper(string.sub(section, 1, 1))..string.sub(section, 2, -1)..'s:')
	 lines = {}
	 for k, v in pairs(config.data[section]) do
	    def = json.encode(v)
	    exp = json.encode(expconfig[section][k])
	    if exp ~= def then def = def..' = '..exp end
134
	    table.insert(lines, k..' = '..def..' ('..config.source[section][k]..')')
135 136 137 138
	 end
	 table.sort(lines)
	 for i, line in ipairs(lines) do print(line) end
	 print()
139 140 141 142 143 144
      end
   end

   os.exit()
end

145

146
require 'awall.iptables'
147
awall.loadmodules(basedir)
148

149
config = awall.Config.new(config)
150

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
151 152 153 154 155
if mode == 'translate' then
   if verify then config:test() end
   config:dump(iptdir, ipsfile)      
   
elseif mode == 'activate' then
156 157 158 159 160 161 162 163 164 165 166 167 168

   awall.iptables.backup()

   signal.signal('SIGCHLD',
		 function() if pid and lpc.wait(pid, 1) then os.exit(2) end end)
   for i, sig in ipairs({'INT', 'TERM'}) do
      signal.signal('SIG'..sig, function()
				   interrupted = true
				   io.stdin:close()
				end)
   end

   require 'lpc'
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
169
   pid, stdio, stdout = lpc.run(arg[0], 'fallback')
170 171 172 173 174 175 176
   stdio:close()
   stdout:close()
   
   config:activate()

   io.stderr:write('New firewall configuration activated\n')
   io.stderr:write('Press RETURN to commit changes permanently: ')
177
   interrupted = not io.read()
178 179 180 181 182 183 184 185 186 187 188 189

   signal.signal('SIGCHLD', 'default')
   signal.kill(pid, 'SIGTERM')
   lpc.wait(pid)

   if interrupted then
      io.stderr:write('\nActivation canceled, reverting to the old configuration\n')
      awall.iptables.revert()

   else config:dump() end


Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
190
elseif mode == 'fallback' then
191 192 193 194 195 196 197 198 199 200 201

   for i, sig in ipairs({'HUP', 'PIPE'}) do
      signal.signal('SIG'..sig, function() end)
   end

   require 'lsleep'
   lsleep.sleep(10)

   io.stderr:write('\nTimeout, reverting to the old configuration\n')
   awall.iptables.revert()

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
202
else assert(false) end