path: root/awall-cli

#!/usr/bin/lua

--[[
Alpine Wall
Copyright (C) 2012-2020 Kaarle Ritvanen
See LICENSE file for license details
]]--

get_opts = require('alt_getopt').get_opts
lpc = require('lpc')

posix = require('posix')
signal = posix.signal
stat = posix.stat

stringy = require('stringy')

-- Lua 5.1 compatibility
if not table.unpack then table.unpack = unpack end

function help()
   io.stderr:write([[
Alpine Wall
Copyright (C) 2012-2020 Kaarle Ritvanen
This is free software with ABSOLUTELY NO WARRANTY,
available under the terms of the GNU General Public License, version 2

Usage:

Translate policy files to firewall configuration files:
    awall translate [-o|--output <dir>] [-V|--verify]

    The --verify option makes awall verify the configuration using the
    test mode of iptables-restore before overwriting the old files.

    Specifying the output directory allows testing awall policies
    without overwriting the current iptables and ipset configuration
    files. By default, awall generates the configuration to
    /etc/iptables and /etc/ipset.d, which are read by the init
    scripts.

Run-time activation of new firewall configuration:
    awall activate [-f|--force]

    This command genereates firewall configuration from the policy
    files and enables it. If the user confirms the new configuration
    by hitting RETURN within 10 seconds or the --force option is used,
    the configuration is saved to the files. Otherwise, the old
    configuration is restored.

Flush firewall configuration:
    awall flush [-a|--all]

    Normally, this command deletes all firewall rules and configures
    it to drop all packets.

    If awall is configured to co-exist with other firewall management
    tools, this command flushes only the rules installed by awall.
    Specifying --all overrides this behavior and causes all rules to
    be flushed.

Enable/disable optional policies:
    awall {enable|disable} <policy>...

List optional policies:
    awall list [-a|--all]

    The 'enabled' status means that the policy has been enabled by the
    user. The 'disabled' status means that the policy is not in
    use. The 'required' status means that the policy has not been
    enabled by the user but is in use because it is required by
    another policy which is in use.

    Normally, the command lists only optional policies. Specifying
    --all makes it list all policies and more information about them.

Dump variable and zone definitions:
    awall dump [level]

    Verbosity level is an integer in range 0-5 and defaults to 0.

Show difference between modified and saved configurations:
    awall diff [-o|--output <dir>]

    Displays the difference in the input policy files and generated
    output files since the last 'translate' or 'activate' command.

    When the --output option is used, the updated configuration is
    compared to the generated files in the specified directory
    (generated by the equivalent 'translate' command).

]])
   os.exit(2)
end

if not arg[1] then help() end

if not stringy.startswith(arg[1], '-') then
   mode = arg[1]
   table.remove(arg, 1)
end

opts, opind = get_opts(
   arg,
   'afo:V',
   {all='a', force='f', ['output-dir']='o', verify='V'}
)
for switch, value in pairs(opts) do
   if switch == 'a' then all = true
   elseif switch == 'f' then force = true
   elseif switch == 'c' then verbose = true
   elseif switch == 'V' then verify = true
   elseif switch == 'o' then outputdir = value
   else assert(false) end
end

if not mode then
   mode = arg[opind]
   opind = opind + 1
end


dev_mode = stringy.endswith(arg[0], '/awall-cli')
if dev_mode then
   basedir = arg[0]:sub(1, -11)
   package.path = basedir..'/?/init.lua;'..basedir..'/?.lua;'..package.path
end

util = require('awall.util')
contains = util.contains
printmsg = util.printmsg

if not contains(
   {
      'translate',
      'activate',
      'fallback',
      'flush',
      'enable',
      'disable',
      'list',
      'dump',
      'diff'
   },
   mode
) then help() end

pol_paths = {}
for i, cls in ipairs{'mandatory', 'optional', 'private'} do
   path = os.getenv('AWALL_PATH_'..cls:upper())
   if path then pol_paths[cls] = util.split(path, ':') end
end

if dev_mode then
   util.setdefault(pol_paths, 'mandatory', {'/etc/awall'})
   table.insert(pol_paths.mandatory, basedir..'/mandatory')
end

uerror = require('awall.uerror')
call = uerror.call
raise = uerror.raise

if not call(
   function()
      
      local awall = require('awall')
      local printtabular = util.printtabular
      local sortedkeys = util.sortedkeys

      local policyset = awall.PolicySet(pol_paths)

      if mode == 'list' then
	 local imported = policyset:load().policies
	 local data = {}
	 
	 for i, name in sortedkeys(policyset.policies) do
	    local policy = policyset.policies[name]

	    if all or policy.type == 'optional' then
	       if policy.enabled then status = 'enabled'
	       elseif contains(imported, name) then status = 'required'
	       else status = 'disabled' end

	       local polinfo = {name, status, policy:load().description}

	       if all then
		  table.insert(polinfo, 2, policy.type)
		  table.insert(polinfo, 4, policy.path)
	       end

	       table.insert(data, polinfo)
	    end
	 end
	 
	 printtabular(data)
	 os.exit()
      end

      if contains({'disable', 'enable'}, mode) then
	 if opind > #arg then help() end
	 repeat
	    local name = arg[opind]
	    local policy = policyset.policies[name]
	    if not policy then raise('No such policy: '..name) end
	    policy[mode](policy)
	    opind = opind + 1
	 until opind > #arg
	 os.exit()
      end


      local iptables = require('awall.iptables')

      if mode == 'fallback' then

	 for _, sig in ipairs{'HUP', 'INT', 'PIPE'} do
	    signal(posix['SIG'..sig], 'SIG_IGN')
	 end

	 posix.sleep(10)

	 printmsg('\nTimeout, reverting to the old configuration')
	 iptables.revert()
	 os.exit()
      end


      local input = policyset:load()

      if mode == 'dump' then level = 0 + (arg[opind] or 0) end

      local config
      if mode ~= 'dump' or level > 3 then
	 awall.loadmodules(basedir)
	 config = awall.Config(input)
      end


      local function dump(level)
	 local json = require('cjson').new()
	 json.encode_sort_keys(true)

	 local expinput = input:expand()

	 local function capitalize(cls)
	    return cls:sub(1, 1):upper()..cls:sub(2, -1)
	 end

	 for _, cls in sortedkeys(input.data) do
	    if level > 2 or (level == 2 and cls ~= 'service') or contains(
	       {'variable', 'zone'},
	       cls
	    ) then
	       if level == 0 then io.write(capitalize(cls)..'s:\n') end

	       local clsdata = input.data[cls]
	       local items = {}

	       for _, key in sortedkeys(clsdata) do
		  local exp = expinput[cls][key]
		  local expj = json.encode(exp)
		  local src = input.source[cls][key]

		  if level == 0 then table.insert(items, {key, expj, src})

		  else
		     local value = clsdata[key]
		     local data = {
			{capitalize(cls)..' '..key, json.encode(value)},
			{
			   '('..src..')',
			   util.compare(exp, value) and '' or '-> '..expj
			}
		     }

		     if level > 3 then
			local obj = config.objects[cls][key]
			if type(obj) == 'table' and obj.info then
			   util.extend(data, obj:info())
			end
		     end
	       
		     table.insert(items, {key, data})
		  end
	       end
	       table.sort(items, function(a, b) return a[1] < b[1] end)

	       if level == 0 then printtabular(items)
	       else
		  util.printtabulars(
		     util.map(items, function(x) return x[2] end)
		  )
		  io.write('\n')
	       end
	    end
	 end

	 if level > 4 then config:print() end
      end

      local function filedump(file)
	 io.output(file)
	 dump(5)
      end

      local sysdumpfile = '/etc/iptables/awall-save'
      local dumpfile = outputdir and outputdir..'/dump' or sysdumpfile


      if mode == 'dump' then dump(level)

      elseif mode == 'diff' then
	 if not stat(dumpfile) then
	    printmsg('Please translate or activate first')
	    os.exit(2)
	 end

	 local pid, stdin, stdout = lpc.run(
	    'diff', '-w', '--', dumpfile, '/proc/self/fd/0'
	 )

	 filedump(stdin)
	 stdin:close()

	 local data
	 repeat
	    -- Lua 5.2 compatibility: prefix with *
	    data = stdout:read('*a')

	    io.stdout:write(data)
	 until data == ''
	 stdout:close()

	 os.exit(lpc.wait(pid) / 256)
   
      elseif mode == 'translate' then
	 if verify then config:test() end
	 config:dump(outputdir)	 
	 filedump(dumpfile)

      elseif mode == 'activate' then

	 local function translate()
	    config:dump()
	    filedump(sysdumpfile)
	 end

	 local interrupted

	 if not force then
	    for _, sig in ipairs{'INT', 'TERM'} do
	       signal(
		  posix['SIG'..sig],
		  function()
		     interrupted = true
		     io.stdin:close()
		  end
	       )
	    end
	 end

	 if not iptables.isenabled() then
	    local INIT = '/usr/libexec/awall-init'
	    if not force and stat(INIT) then
	       printmsg('Firewall is not active')
	       io.stderr:write(
		  'Press RETURN to perform initial configuration and activation: '
	       )
	       if io.read() then
		  translate()
		  for _, family in ipairs(require('awall.family').ACTIVE) do
		     os.execute(
			INIT..' '..
			   ({inet='iptables', inet6='ip6tables'})[family]
		     )
		  end
		  os.exit(0)
	       end
	       printmsg('\nCanceled')
	       os.exit(2)
	    end

	    raise('Firewall not enabled in kernel')
	 end

	 iptables.backup()

	 local pid

	 if not force then
	    signal(
	       posix.SIGCHLD,
	       function()
		  if pid and lpc.wait(pid, 1) then os.exit(1) end
	       end
	    )
	    pid = util.run(arg[0], 'fallback')
	 end

	 local function kill()
	    signal(posix.SIGCHLD, 'SIG_DFL')
	    posix.kill(pid, posix.SIGTERM)
	    lpc.wait(pid)
	 end

	 local function revert()
	    iptables.revert()
	    os.exit(2)
	 end

	 if call(config.activate, config) then

	    if not force then
	       printmsg('New firewall configuration activated')
	       io.stderr:write('Press RETURN to commit changes permanently: ')
	       interrupted = not io.read()

	       kill()

	       if interrupted then
		  printmsg(
		     '\nActivation canceled, reverting to the old configuration'
		  )
		  revert()
	       end
	    end

	    translate()

	 else
	    if not force then kill() end
	    revert()
	 end


      elseif mode == 'flush' then
	 if all then iptables.flush()
	 else config:flush() end

      else assert(false) end

   end
) then os.exit(2) end