Changeset c9d8db9916965607ae249b301f1991b931044ee8

Timestamp:

09/19/09 15:50:15 (3 years ago)

Author:

Neutron Soutmun <neo.neutron@…>

Children:

f947fbf519faeaa105b8df830c6030924a957e16

Parents:

aefa26aefdd4538de7337e9c9b0cced45abb1d74

git-committer:

Neutron Soutmun <neo.neutron@…> (09/19/09 15:50:15)

Message:

Add common firewall code

[ Security Fix ]

• Add common firewall code with new extra config fields in rahunas main config file.
• If no new config fields setting, the old behavior is used which the external interfaces accept all connections.

Files:

• example/rahunas.conf.in (modified) (1 diff)
• tools/rahunas-firewall.in (modified) (4 diffs)

example/rahunas.conf.in

@@ -14 +14 @@
   bittorrent_download_max = "512"
   bittorrent_upload_max = "256"
+
+  external_iface_firewall = "yes"
+  external_iface_ports_allow = "22,80,443"
+  external_iface_ping_accept = "yes"
 }

tools/rahunas-firewall.in

@@ -51 +51 @@
 MAIN_BITTORRENT_UPLOAD_MAX=`get_config_value main bittorrent_upload_max $RAHUNAS_CONFIG`
 MAIN_DHCP=`get_config_value main dhcp $RAHUNAS_CONFIG`
+
+MAIN_EXT_IFACE_FIREWALL=`get_config_value main external_iface_firewall $RAHUNAS_CONFIG`
+MAIN_EXT_IFACE_PORTS_ALLOW=`get_config_value main external_iface_ports_allow $RAHUNAS_CONFIG`
+MAIN_EXT_IFACE_PING_ACCEPT=`get_config_value main external_iface_ping_accept $RAHUNAS_CONFIG`
+MAIN_EXT_IFACE_LIST=
 
 if [ "$ENV_OVERRIDE" != "yes" ]; then
@@ -258 +263 @@
 
   # INPUT from external
-  # TODO: Make a common firewall to filter the external requests.
   for dev in $DEV_EXTERNAL_LIST; do
-    $IPTABLES $action INPUT \
-      $DEV_IN_PARAM $dev -j ACCEPT 
+    # Filter duplicated external interfaces
+    if ! echo $MAIN_EXT_IFACE_LIST | grep $dev > /dev/null; then
+      MAIN_EXT_IFACE_LIST=`echo "$MAIN_EXT_IFACE_LIST $dev"`
+
+      $IPTABLES $action INPUT $DEV_IN_PARAM $dev -j ${NAME}_ext_fw
+    fi
   done
 
@@ -435 +443 @@
     $IPTABLES -A FORWARD -p udp --dport 67:68 -j ACCEPT
   fi
+
+  $IPTABLES -N ${NAME}_ext_fw
+
+  if [ "x$MAIN_EXT_IFACE_FIREWALL" = "xyes" ]; then
+    # Accept all connections that made by server itself
+    $IPTABLES -A ${NAME}_ext_fw -m state --state ESTABLISHED,RELATED -j ACCEPT
+
+    # Accept DNS reply
+    $IPTABLES -A ${NAME}_ext_fw -p udp --sport 53 \
+      -m state --state ESTABLISHED,RELATED -j ACCEPT
+
+    if [ -n "$MAIN_EXT_IFACE_PORTS_ALLOW" ]; then
+      $IPTABLES -A ${NAME}_ext_fw -p tcp \
+        -m multiport --dports ${MAIN_EXT_IFACE_PORTS_ALLOW} -j ACCEPT
+    fi
+
+    if [ "x$MAIN_EXT_IFACE_PING_ACCEPT" = "xyes" ]; then
+      # Accept echo-request from outside
+      $IPTABLES -A ${NAME}_ext_fw -p icmp --icmp-type 8 \
+        -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
+    fi
+
+    # Accept echo-reply from outside
+    $IPTABLES -A ${NAME}_ext_fw -p icmp --icmp-type 0 \
+      -m state --state ESTABLISHED,RELATED -j ACCEPT
+  else
+    if [ "x$MAIN_EXT_IFACE_FIREWALL" = "xaccept" -o "x$MAIN_EXT_IFACE_FIREWALL" = "x" ]; then
+      $IPTABLES -A ${NAME}_ext_fw -j ACCEPT
+    fi
+  fi
+
+  $IPTABLES -A ${NAME}_ext_fw -j RETURN
 }
 
@@ -457 +497 @@
     $IPTABLES -D FORWARD -p udp --dport 67:68 -j ACCEPT
   fi
+
+  $IPTABLES -F ${NAME}_ext_fw
+  $IPTABLES -X ${NAME}_ext_fw
 }