awall-cli 5.95 KB
Newer Older
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
1 2 3 4 5 6 7 8
#!/usr/bin/lua

--[[
Alpine Wall
Copyright (C) 2012 Kaarle Ritvanen
Licensed under the terms of GPL2
]]--

9
require 'alt_getopt'
10
require 'lfs'
11
require 'signal'
12 13
require 'stringy'

14 15
short_opts = 'fo:V'
long_opts = {force='f', ['output-dir']='o', verify='V'}
16

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
17 18 19 20 21
function help()
   io.stderr:write([[
Alpine Wall usage

Translate policy files to firewall configuration files:
22
    awall translate [-o|--output <dir>] [-V|--verify]
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
23 24 25 26 27 28 29 30 31 32 33

    The --verify option makes awall verify the configuration using the
    test mode of iptables-restore before overwriting the old files.

    Specifying the output directory allows testing awall policies
    without overwriting the current iptables and ipset configuration
    files. By default, awall generates the configuration to
    /etc/iptables and /etc/ipset.d, which are read by the init
    scripts.

Run-time activation of new firewall configuration:
34
    awall activate [-f|--force]
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
35

36
    This command genereates firewall configuration from the policy
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
37
    files and enables it. If the user confirms the new configuration
38 39 40
    by hitting RETURN within 10 seconds or the --force option is used,
    the configuration is saved to the files. Otherwise, the old
    configuration is restored.
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
41

42 43 44 45 46 47
Flush firewall configuration:
    awall flush

    This command deletes all firewall rules and configures it to drop
    all packets.

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
48 49 50 51 52 53 54 55 56 57 58 59
Enable/disable optional policies:
    awall {enable|disable} <policy>...

List optional policies:
    awall list

    The 'enabled' status means that the policy has been enabled by the
    user. The 'disabled' status means that the policy is not in
    use. The 'required' status means that the policy has not been
    enabled by the user but is in use because it is required by
    another policy which is in use.

60
Dump variable and zone definitions:
61 62
    awall dump [level]

63
    Verbosity level is an integer in range 0-5 and defaults to 0.
64

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
65
]])
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
66 67 68 69
   os.exit()
end

params = {}
70

71 72
if stringy.endswith(arg[0], '/awall-cli') then
   basedir = string.sub(arg[0], 1, -11)
73 74
   params.i = {basedir..'/json'}
   params.I = {}
75

76
   short_opts = short_opts..'i:I:'
77
   long_opts['input-dir'] = 'i'
78
   long_opts['import-path'] = 'I'
79 80
end

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
81
if not arg[1] then help() end
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
82 83 84 85 86

if not stringy.startswith(arg[1], '-') then
   mode = arg[1]
   table.remove(arg, 1)
end
87

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
88 89
opts, opind = alt_getopt.get_opts(arg, short_opts, long_opts)
for switch, value in pairs(opts) do
90 91
   if switch == 'f' then force = true
   elseif switch == 'V' then verify = true
92 93 94
   elseif switch == 'o' then
      iptdir = value
      ipsfile = value..'/ipset'
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
95
   else table.insert(params[switch], value) end
96
end
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
97

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
98 99 100 101 102 103 104
if not mode then
   mode = arg[opind]
   opind = opind + 1
end


require 'awall.util'
105
util = awall.util
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
106

107
if not util.contains({'translate', 'activate', 'fallback', 'flush',
108 109
		      'enable', 'disable', 'list', 'dump'},
		     mode) then help() end
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
110

111

112 113 114
require 'awall'

policyset = awall.PolicySet.new(params.i, params.I)
115

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
116
if mode == 'list' then
117
   util.printtabular(policyset:list())
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
118
   os.exit()
119 120
end

121
if util.contains({'disable', 'enable'}, mode) then
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
122
   if opind > #arg then help() end
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
123 124 125 126
   repeat
      policyset[mode](policyset, arg[opind])
      opind = opind + 1
   until opind > #arg
127 128 129
   os.exit()
end

130

131
input = policyset:load()
132

133 134 135 136 137 138
if mode == 'dump' then level = 0 + (arg[opind] or 0) end

if mode ~= 'dump' or level > 3 then
   awall.loadmodules(basedir)
   config = awall.Config.new(input)
end
139

140 141 142 143

require 'awall.iptables'

if mode == 'dump' then
144
   require 'json'
145
   expinput = input:expand()
146

147 148 149 150
   function capitalize(cls)
      return string.upper(string.sub(cls, 1, 1))..string.sub(cls, 2, -1)
   end

151
   for cls, objs in pairs(input.data) do
152 153 154 155 156 157 158
      if level > 2 or (level == 2 and cls ~= 'service') or util.contains({'variable',
									  'zone'},
									 cls) then
	 if level == 0 then print(capitalize(cls)..'s:') end
	 
	 items = {}
	 for k, v in pairs(objs) do
159
	    exp = expinput[cls][k]
160
	    expj = json.encode(exp)
161 162
	    src = input.source[cls][k]

163
	    if level == 0 then table.insert(items, {k, expj, src})
164

165
	    else
166 167 168 169 170 171 172 173 174 175 176 177
	       data = {{capitalize(cls)..' '..k, json.encode(v)},
		       {'('..src..')',
			util.compare(exp, v) and '' or '-> '..expj}}

	       if level > 3 then
		  obj = config.objects[cls][k]
		  if type(obj) == 'table' and obj.info then
		     util.extend(data, obj:info())
		  end
	       end

	       table.insert(items, {k, data})
178 179 180 181 182 183 184 185 186
	    end
	 end
	 table.sort(items, function(a, b) return a[1] < b[1] end)

	 if level == 0 then util.printtabular(items)
	 else
	    util.printtabulars(util.map(items,
					function(x) return x[2] end))
	    print()
187
	 end
188 189 190
      end
   end

191
   if level > 4 then config:print() end
192 193

elseif mode == 'translate' then
Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
194 195 196 197
   if verify then config:test() end
   config:dump(iptdir, ipsfile)      
   
elseif mode == 'activate' then
198

199 200 201 202 203 204 205 206 207 208 209 210 211
   if not force then
      awall.iptables.backup()

      signal.signal('SIGCHLD',
		    function()
		       if pid and lpc.wait(pid, 1) then os.exit(2) end
		    end)
      for i, sig in ipairs({'INT', 'TERM'}) do
	 signal.signal('SIG'..sig, function()
				      interrupted = true
				      io.stdin:close()
				   end)
      end
212

213 214 215 216
      require 'lpc'
      pid, stdio, stdout = lpc.run(arg[0], 'fallback')
      stdio:close()
      stdout:close()
217 218 219 220
   end
   
   config:activate()

221 222 223 224
   if not force then
      io.stderr:write('New firewall configuration activated\n')
      io.stderr:write('Press RETURN to commit changes permanently: ')
      interrupted = not io.read()
225

226 227 228 229
      signal.signal('SIGCHLD', 'default')
      signal.kill(pid, 'SIGTERM')
      lpc.wait(pid)
   end
230 231 232 233 234 235 236 237

   if interrupted then
      io.stderr:write('\nActivation canceled, reverting to the old configuration\n')
      awall.iptables.revert()

   else config:dump() end


Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
238
elseif mode == 'fallback' then
239 240 241 242 243 244 245 246 247 248 249

   for i, sig in ipairs({'HUP', 'PIPE'}) do
      signal.signal('SIG'..sig, function() end)
   end

   require 'lsleep'
   lsleep.sleep(10)

   io.stderr:write('\nTimeout, reverting to the old configuration\n')
   awall.iptables.revert()

250 251
elseif mode == 'flush' then awall.iptables.flush()

Kaarle Ritvanen's avatar
Kaarle Ritvanen committed
252
else assert(false) end