« back to all changes in this revision
Viewing changes to script/uruk.in
- browse files at revision 1
- compare with another revision
- download diff
- download tarball
- view history from revision 1
- Committer: Bazaar Package Importer
- Author(s): Joost van Baal
- Date: 2005-10-30 18:44:05 UTC
- Revision ID: james.westby@ubuntu.com-20051030184405-18qmgrz4vzlw589a
Tags: upstream-20051027
Import upstream version 20051027
- files added:
- doc
- init
- man
- script
added
removed
script/uruk.in
1
#!/bin/sh
2
3
# this file maintained using arch at http://arch.gna.org/uruk/
4
5
# Copyright (C) 2003 Stichting LogReport Foundation logreport@logreport.org
6
# Copyright (C) 2003, 2004 Tilburg University http://www.uvt.nl/
7
# Copyright (C) 2003, 2004 Joost van Baal
8
#
9
# This file is part of Uruk. Uruk is free software; you can redistribute
10
# it and/or modify it under the terms of the GNU GPL, see the file named
11
# COPYING.
12
13
14
#
15
# peeksheet: iptables predefined chains:
16
#
17
# - INPUT - - localhost - - OUTPUT -
18
# / \
19
# PREROUTING - - - - - - - - FORWARD - - - - - - - - POSTROUTING
20
#
21
22
iptables=${URUK_IPTABLES:-/sbin/iptables}
23
24
# By default, we don't do any /sbin/ip6tables calls. This will change
25
# once Uruk's IPv6 support is blessed mature.
26
ip6tables=${URUK_IP6TABLES:-":"}
27
#
28
# Add
29
#
30
# ip6tables=${URUK_IP6TABLES:-/sbin/ip6tables}
31
#
32
# to your rc file and
33
#
34
# "enable_ipv6=true"
35
#
36
# to /etc/default/uruk if you'd like to play with IPv6 support in Uruk
37
#
38
# New variables used: ip6_<...>, sources6_<...>, ip6tables.
39
40
41
etcdir="@SYSCONF_PATH@/@PACKAGE_TARNAME@"
42
43
config=${URUK_CONFIG:-${etcdir}/rc}
44
45
test -r $config || {
46
echo >&2 "No readable rc file $config found. Please create one." && exit 1
47
}
48
49
. $config
50
51
if test -n "$version"
52
then
53
if test "$version" -lt 20040210
54
then
55
cat >&2 <<EOT
56
Uruk rc file $config claims to be pre-20040210 format. That's likely not
57
supported. Please read the Uruk README file for upgrade instructions.
58
EOT
59
exit 1
60
fi
61
fi
62
63
uruk_log () {
64
$iptables -A INPUT -j LOG --log-level debug --log-prefix 'iptables: ' $@
65
$ip6tables -A INPUT -j LOG --log-level debug --log-prefix 'ip6tables: ' $@
66
}
67
68
#
69
# bootstrap these rules
70
#
71
72
# 40 < 60 ( 50) medium: log denied non-broadcasts (default)
73
test -z "$loglevel" && loglevel=50
74
75
test -r "$rc_a" && . "$rc_a"
76
77
if test $loglevel -ge 80
78
then
79
# 80 < 99 ( 90) fascist: log all packets
80
uruk_log
81
fi
82
83
$iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
84
85
# ip6tables has no connection tracking support.
86
$ip6tables -A INPUT --protocol tcp ! --syn --destination-port 1024: -j ACCEPT
87
$ip6tables -A INPUT --protocol udp --destination-port 1024: -j ACCEPT
88
89
90
test -r "$rc_b" && . "$rc_b"
91
92
#
93
# protect interfaces_public agains spoofing
94
#
95
96
for iface in ${interfaces}
97
do
98
#
99
# don't allow anyone to spoof non-routeable addresses
100
#
101
102
eval is="\"\$ips_${iface}\""
103
if test -n "$is"
104
then
105
interfaces_x=
106
for i in $is
107
do
108
interfaces_x="$interfaces_x ${iface}_$i"
109
done
110
else
111
interfaces_x=$iface
112
fi
113
114
for iface_x in $interfaces_x
115
do
116
eval net="\"\$net_${iface_x}\""
117
for no_route_ip in 127.0.0.1/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
118
do
119
if test $no_route_ip != "$net"
120
then
121
# TODO: this behaves odd in multiple-IP cases. Furthermore,
122
# excluding one private network from being dropped works ugly.
123
$iptables -A INPUT -i $iface --source $no_route_ip -j DROP
124
$iptables -A INPUT -i $iface --destination $no_route_ip \
125
-j DROP
126
127
$iptables -A OUTPUT -o $iface --source $no_route_ip -j DROP
128
$iptables -A OUTPUT -o $iface --destination $no_route_ip \
129
-j DROP
130
fi
131
done
132
133
# block outgoing packets that don't have our address as source,
134
# they are either spoofed or something is misconfigured (NAT disabled,
135
# for instance), we want to be nice and don't send out garbage.
136
#
137
# NOTE: this is stricter than above no_route_ip rule.
138
if test -n "$is"
139
then
140
# this rule is only enabled in single-ip-per-nic situations.
141
# in multiple ip mode, we'd have to drop only if source is
142
# not _one_ of the nic's IPs
143
144
# supporting this for multiple-ips would need multiple chains
145
# or, perhaps, some iptables extension.
146
:
147
else
148
eval ip="\"\$ip_${iface_x}\""
149
$iptables -A OUTPUT -o $iface --source ! "$ip" -j DROP
150
151
# drop all incoming packets which don't have us as destination
152
$iptables -A INPUT -i $iface --destination ! "$ip" -j DROP
153
# NOTE: this is stricter than above no_route_ip rule. If this
154
# rule is used, above rule ``$iptables -A INPUT -i $iface
155
# --destination $no_route_ip -j DROP'' could get disabled. See
156
# also the broadcast rule below.
157
fi
158
done
159
160
# Always allow outgoing connections
161
$iptables -A OUTPUT -m state --state NEW -o $iface -j ACCEPT
162
done
163
164
test -r "$rc_c" && . "$rc_c"
165
166
#
167
# allow traffic to offered services, from trusted sources
168
#
169
170
for iface in $interfaces
171
do
172
eval is="\"\$ips_${iface}\""
173
if test -n "$is"
174
then
175
interfaces_x=
176
for i in $is
177
do
178
interfaces_x="$interfaces_x ${iface}_$i"
179
done
180
else
181
interfaces_x=$iface
182
fi
183
184
for iface_x in $interfaces_x
185
do
186
eval ip="\"\$ip_${iface_x}\""
187
eval ip6="\"\$ip6_${iface_x}\""
188
for proto in tcp udp
189
do
190
eval services="\"\$services_${iface_x}_${proto}\""
191
if test -n "$services"
192
then
193
for service in $services
194
do
195
# service is a servicegroupname, e.g. "local"
196
eval sources="\"\$sources_${iface_x}_${proto}_${service}\""
197
eval sources6="\"\$sources6_${iface_x}_${proto}_${service}\""
198
eval ports="\"\$ports_${iface_x}_${proto}_${service}\""
199
if test -n "$ports"
200
then
201
for port in $ports
202
do
203
# port is e.g. www or 1023
204
for source in $sources
205
do
206
# source is e.g. 10.56.0.10/32
207
$iptables -A INPUT -m state --state NEW \
208
-i $iface --protocol $proto \
209
--source "$source" --destination "$ip" \
210
--destination-port "$port" -j ACCEPT
211
done
212
for source6 in $sources6
213
do
214
$ip6tables -A INPUT \
215
-i $iface --protocol $proto \
216
--source "$source6" --destination "$ip6" \
217
--destination-port "$port" -j ACCEPT
218
done
219
done
220
fi
221
done
222
fi
223
done
224
done
225
done
226
227
test -r "$rc_d" && . "$rc_d"
228
229
#
230
# traffic on lo is trusted
231
#
232
233
$iptables -A INPUT -i lo -j ACCEPT
234
$iptables -A OUTPUT -o lo -j ACCEPT
235
236
$ip6tables -A INPUT -i lo -j ACCEPT
237
$ip6tables -A OUTPUT -o lo -j ACCEPT
238
239
test -r "$rc_e" && . "$rc_e"
240
241
#
242
# Don't answer broadcast and multicast packets
243
#
244
for iface in $interfaces_nocast
245
do
246
eval is="\"\$bcasts_${iface}\""
247
if test -n "$is"
248
then
249
interfaces_x=
250
for i in $is
251
do
252
interfaces_x="$interfaces_x ${iface}_$i"
253
done
254
else
255
interfaces_x=$iface
256
fi
257
258
for iface_x in $interfaces_x
259
do
260
eval bcast="\"\$bcast_${iface_x}\""
261
$iptables -A INPUT -i $iface --destination "$bcast" -j DROP
262
done
263
264
$iptables -A INPUT -i $iface --destination 255.255.255.255 -j DROP
265
done
266
267
test -r "$rc_f" && . "$rc_f"
268
269
#
270
# icmp stuff. See RFC 1122 and also RFC 792, RFC 950, RFC 1812, RFC 1349,
271
# RFC 2474 and Stevens' TCP/IP Illustrated Chapter 6, p 69.
272
# The icmp types are even in %num2icmp_type in Lire::Firewall.
273
# Running "iptables -p icmp -h" gives iptables's idea of icmp types
274
#
275
276
#
277
# By default, we disallow
278
#
279
# source-quench
280
# redirect (
281
# network-redirect
282
# host-redirect
283
# TOS-network-redirect
284
# TOS-host-redirect
285
# )
286
# router-advertisement
287
# router-solicitation
288
#
289
# You might want to allow just
290
#
291
# echo-request echo-reply ttl-zero-during-transit \
292
# ttl-zero-during-reassembly ip-header-bad required-option-missing
293
#
294
# This makes pings succeed, as well as traceroute. However
295
# debugging network problems might be _much_ more difficult when disallowing
296
# lots of other icmp types. If you really want to do this, use rc_g.
297
#
298
299
for type in \
300
address-mask-reply \
301
address-mask-request \
302
destination-unreachable \
303
echo-reply \
304
echo-request \
305
parameter-problem \
306
timestamp-reply \
307
timestamp-request \
308
ttl-zero-during-reassembly \
309
ttl-zero-during-transit
310
do
311
$iptables -A INPUT --protocol icmp --icmp-type $type -j ACCEPT
312
done
313
314
# for now, we allow _all_ ICMPv6 packets.
315
$ip6tables -A INPUT --protocol icmpv6 -j ACCEPT
316
317
test -r "$rc_g" && . "$rc_g"
318
319
#
320
# log packets which make it till here: denied packets (not denied broadcasts
321
# or spoofed stuff). take loglevel into account.
322
#
323
324
if test $loglevel -lt 20
325
then
326
# be silent
327
:
328
elif test $loglevel -lt 40
329
then
330
# log denied packets, targetted at our IPs
331
for iface in $interfaces
332
do
333
eval is="\"\$ips_${iface}\""
334
if test -n "$is"
335
then
336
interfaces_x=
337
for i in $is
338
do
339
interfaces_x="$interfaces_x ${iface}_$i"
340
done
341
else
342
interfaces_x=$iface
343
fi
344
345
for iface_x in $interfaces_x
346
do
347
eval ip="\"\$ip_${iface_x}\""
348
uruk_log -i $iface --destination $ip
349
done
350
done
351
elif test $loglevel -lt 60
352
then
353
# 40 < 60 ( 50) medium: log denied non-broadcasts (default)
354
uruk_log
355
fi
356
357
# FIXME : yet to implement:
358
# 60 < 80 ( 70) high: log denied packets
359
360
test -r "$rc_h" && . "$rc_h"
361
362
#
363
# reject all others
364
#
365
366
$iptables -A INPUT -j REJECT --reject-with tcp-reset --protocol tcp
367
$iptables -A INPUT -j REJECT
368
369
$ip6tables -A INPUT -j DROP
370
# FIXME : these:
371
# $ip6tables -A INPUT -j REJECT --reject-with tcp-reset --protocol tcp
372
# $ip6tables -A INPUT -j REJECT --reject-with icmp6-adm-prohibited
373
# would be better but don't seem to be supported with stock linux kernel.
374
375
test -r "$rc_i" && . "$rc_i"
376
377
# make sure we exit 0, even if last test failed
378
exit 0
379
Loggerhead is a web-based interface for Breezy
Version: 2.0.1