#!/usr/bin/lua
--[[
Alpine Wall
Copyright (C) 2012-2020 Kaarle Ritvanen
See LICENSE file for license details
]]--
get_opts = require('alt_getopt').get_opts
lpc = require('lpc')
posix = require('posix')
signal = posix.signal
stat = posix.stat
stringy = require('stringy')
-- Lua 5.1 compatibility
if not table.unpack then table.unpack = unpack end
function help()
io.stderr:write([[
Alpine Wall
Copyright (C) 2012-2020 Kaarle Ritvanen
This is free software with ABSOLUTELY NO WARRANTY,
available under the terms of the GNU General Public License, version 2
Usage:
Translate policy files to firewall configuration files:
awall translate [-o|--output
] [-V|--verify]
The --verify option makes awall verify the configuration using the
test mode of iptables-restore before overwriting the old files.
Specifying the output directory allows testing awall policies
without overwriting the current iptables and ipset configuration
files. By default, awall generates the configuration to
/etc/iptables and /etc/ipset.d, which are read by the init
scripts.
Run-time activation of new firewall configuration:
awall activate [-f|--force]
This command genereates firewall configuration from the policy
files and enables it. If the user confirms the new configuration
by hitting RETURN within 10 seconds or the --force option is used,
the configuration is saved to the files. Otherwise, the old
configuration is restored.
Flush firewall configuration:
awall flush [-a|--all]
Normally, this command deletes all firewall rules and configures
it to drop all packets.
If awall is configured to co-exist with other firewall management
tools, this command flushes only the rules installed by awall.
Specifying --all overrides this behavior and causes all rules to
be flushed.
Enable/disable optional policies:
awall {enable|disable} ...
List optional policies:
awall list [-a|--all]
The 'enabled' status means that the policy has been enabled by the
user. The 'disabled' status means that the policy is not in
use. The 'required' status means that the policy has not been
enabled by the user but is in use because it is required by
another policy which is in use.
Normally, the command lists only optional policies. Specifying
--all makes it list all policies and more information about them.
Dump variable and zone definitions:
awall dump [level]
Verbosity level is an integer in range 0-5 and defaults to 0.
Show difference between modified and saved configurations:
awall diff [-o|--output ]
Displays the difference in the input policy files and generated
output files since the last 'translate' or 'activate' command.
When the --output option is used, the updated configuration is
compared to the generated files in the specified directory
(generated by the equivalent 'translate' command).
]])
os.exit(2)
end
if not arg[1] then help() end
if not stringy.startswith(arg[1], '-') then
mode = arg[1]
table.remove(arg, 1)
end
opts, opind = get_opts(
arg,
'afo:V',
{all='a', force='f', ['output-dir']='o', verify='V'}
)
for switch, value in pairs(opts) do
if switch == 'a' then all = true
elseif switch == 'f' then force = true
elseif switch == 'c' then verbose = true
elseif switch == 'V' then verify = true
elseif switch == 'o' then outputdir = value
else assert(false) end
end
if not mode then
mode = arg[opind]
opind = opind + 1
end
dev_mode = stringy.endswith(arg[0], '/awall-cli')
if dev_mode then
basedir = arg[0]:sub(1, -11)
package.path = basedir..'/?/init.lua;'..basedir..'/?.lua;'..package.path
end
util = require('awall.util')
contains = util.contains
printmsg = util.printmsg
if not contains(
{
'translate',
'activate',
'fallback',
'flush',
'enable',
'disable',
'list',
'dump',
'diff'
},
mode
) then help() end
pol_paths = {}
for i, cls in ipairs{'mandatory', 'optional', 'private'} do
path = os.getenv('AWALL_PATH_'..cls:upper())
if path then pol_paths[cls] = util.split(path, ':') end
end
if dev_mode then
util.setdefault(pol_paths, 'mandatory', {'/etc/awall'})
table.insert(pol_paths.mandatory, basedir..'/mandatory')
end
uerror = require('awall.uerror')
call = uerror.call
raise = uerror.raise
if not call(
function()
local awall = require('awall')
local printtabular = util.printtabular
local sortedkeys = util.sortedkeys
local policyset = awall.PolicySet(pol_paths)
if mode == 'list' then
local imported = policyset:load().policies
local data = {}
for i, name in sortedkeys(policyset.policies) do
local policy = policyset.policies[name]
if all or policy.type == 'optional' then
if policy.enabled then status = 'enabled'
elseif contains(imported, name) then status = 'required'
else status = 'disabled' end
local polinfo = {name, status, policy:load().description}
if all then
table.insert(polinfo, 2, policy.type)
table.insert(polinfo, 4, policy.path)
end
table.insert(data, polinfo)
end
end
printtabular(data)
os.exit()
end
if contains({'disable', 'enable'}, mode) then
if opind > #arg then help() end
repeat
local name = arg[opind]
local policy = policyset.policies[name]
if not policy then raise('No such policy: '..name) end
policy[mode](policy)
opind = opind + 1
until opind > #arg
os.exit()
end
local iptables = require('awall.iptables')
if mode == 'fallback' then
for _, sig in ipairs{'HUP', 'INT', 'PIPE'} do
signal(posix['SIG'..sig], 'SIG_IGN')
end
posix.sleep(10)
printmsg('\nTimeout, reverting to the old configuration')
iptables.revert()
os.exit()
end
local input = policyset:load()
if mode == 'dump' then level = 0 + (arg[opind] or 0) end
local config
if mode ~= 'dump' or level > 3 then
awall.loadmodules(basedir)
config = awall.Config(input)
end
local function dump(level)
local json = require('cjson').new()
json.encode_sort_keys(true)
local expinput = input:expand()
local function capitalize(cls)
return cls:sub(1, 1):upper()..cls:sub(2, -1)
end
for _, cls in sortedkeys(input.data) do
if level > 2 or (level == 2 and cls ~= 'service') or contains(
{'variable', 'zone'},
cls
) then
if level == 0 then io.write(capitalize(cls)..'s:\n') end
local clsdata = input.data[cls]
local items = {}
for _, key in sortedkeys(clsdata) do
local exp = expinput[cls][key]
local expj = json.encode(exp)
local src = input.source[cls][key]
if level == 0 then table.insert(items, {key, expj, src})
else
local value = clsdata[key]
local data = {
{capitalize(cls)..' '..key, json.encode(value)},
{
'('..src..')',
util.compare(exp, value) and '' or '-> '..expj
}
}
if level > 3 then
local obj = config.objects[cls][key]
if type(obj) == 'table' and obj.info then
util.extend(data, obj:info())
end
end
table.insert(items, {key, data})
end
end
table.sort(items, function(a, b) return a[1] < b[1] end)
if level == 0 then printtabular(items)
else
util.printtabulars(
util.map(items, function(x) return x[2] end)
)
io.write('\n')
end
end
end
if level > 4 then config:print() end
end
local function filedump(file)
io.output(file)
dump(5)
end
local sysdumpfile = '/etc/iptables/awall-save'
local dumpfile = outputdir and outputdir..'/dump' or sysdumpfile
if mode == 'dump' then dump(level)
elseif mode == 'diff' then
if not stat(dumpfile) then
printmsg('Please translate or activate first')
os.exit(2)
end
local pid, stdin, stdout = lpc.run(
'diff', '-w', '--', dumpfile, '/proc/self/fd/0'
)
filedump(stdin)
stdin:close()
local data
repeat
-- Lua 5.2 compatibility: prefix with *
data = stdout:read('*a')
io.stdout:write(data)
until data == ''
stdout:close()
os.exit(lpc.wait(pid) / 256)
elseif mode == 'translate' then
if verify then config:test() end
config:dump(outputdir)
filedump(dumpfile)
elseif mode == 'activate' then
local function translate()
config:dump()
filedump(sysdumpfile)
end
local interrupted
if not force then
for _, sig in ipairs{'INT', 'TERM'} do
signal(
posix['SIG'..sig],
function()
interrupted = true
io.stdin:close()
end
)
end
end
if not iptables.isenabled() then
local INIT = '/usr/libexec/awall-init'
if not force and stat(INIT) then
printmsg('Firewall is not active')
io.stderr:write(
'Press RETURN to perform initial configuration and activation: '
)
if io.read() then
translate()
for _, family in ipairs(require('awall.family').ACTIVE) do
os.execute(
INIT..' '..
({inet='iptables', inet6='ip6tables'})[family]
)
end
os.exit(0)
end
printmsg('\nCanceled')
os.exit(2)
end
raise('Firewall not enabled in kernel')
end
iptables.backup()
local pid
if not force then
signal(
posix.SIGCHLD,
function()
if pid and lpc.wait(pid, 1) then os.exit(1) end
end
)
pid = util.run(arg[0], 'fallback')
end
local function kill()
signal(posix.SIGCHLD, 'SIG_DFL')
posix.kill(pid, posix.SIGTERM)
lpc.wait(pid)
end
local function revert()
iptables.revert()
os.exit(2)
end
if call(config.activate, config) then
if not force then
printmsg('New firewall configuration activated')
io.stderr:write('Press RETURN to commit changes permanently: ')
interrupted = not io.read()
kill()
if interrupted then
printmsg(
'\nActivation canceled, reverting to the old configuration'
)
revert()
end
end
translate()
else
if not force then kill() end
revert()
end
elseif mode == 'flush' then
if all then iptables.flush()
else config:flush() end
else assert(false) end
end
) then os.exit(2) end